joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464010
Capabilities:
Get session user name

Disassembly:
sub esp, 0x108
xor eax, eax
push ebx
mov ebx, dword [esp + 0x114]
mov ecx, ebx
push ebp
mov ebp, dword [esp + 0x114]
push esi
mov edx, ecx
push edi
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call fcn.004767a0
test eax, eax
je 0x4640e6
push 0x41
push 0
push 1
push str.default
call dword [sym.imp.USER32.dll_OpenDesktopA]
mov esi, eax
test esi, esi
jne 0x46406b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push eax
push 0x464190
push esi
call dword [sym.imp.USER32.dll_EnumDesktopWindows]
push esi
call dword [sym.imp.USER32.dll_CloseDesktop]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jb 0x4640b5
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, eax
test esi, esi
je 0x464167
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, ebx
jb 0x464136
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x4dd
jne 0x464179
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x466ac0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov edx, ecx
push edi
xor ebx, ebx
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], bx
add edx, 4
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
lea ecx, [esp + 0x18]
push eax
push edx
push 0x68d12c
push ecx
call fcn.004398bf
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x18]
xor esi, esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x466b9a
mov edi, dword [esp + 0x220]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea edx, [esp + 0x1c]
push ebx
push edx
push ebx
push edi
push eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x2c], ebx
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 2
jb 0x466b80
add eax, 2
mov dword [esp + 0x14], eax
shr eax, 1
lea ecx, [eax + eax]
push ecx
call fcn.005f17db
mov esi, eax
add esp, 4
cmp esi, ebx
je 0x466b80
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push ebx
push edi
push ecx
call ebp
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x20c
ret 8

Function at 0x466bb0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x210
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x1a]
mov word [esp + 0x18], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [esp + 0x21c]
add edx, 4
push eax
push edx
lea ecx, [esp + 0x20]
push 0x68d12c
push ecx
call fcn.004398bf
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0x18]
mov dword [esp + 0xc], esi
push edx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x466c49
lea ecx, [esp + 0x10]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x224]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push edx
mov dword [esp + 0x2c], esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x210
ret 8
Function at 0x466e70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp]
push esi
push eax
xor esi, esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x10], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x466f0a
mov ecx, dword [esp + 4]
push ebx
lea edx, [esp + 0x14]
push edi
mov edi, dword [esp + 0x1c]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], eax
push eax
lea eax, [esp + 0x18]
push eax
push esi
push edi
push ecx
call ebx
mov eax, dword [esp + 0x18]
cmp eax, 2
jb 0x466ef4
add eax, 2
mov dword [esp + 0x18], eax
shr eax, 1
lea edx, [eax + eax]
push edx
call fcn.005f17db
mov esi, eax
add esp, 4
test esi, esi
je 0x466ef4
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push esi
push ecx
push 0
push edi
push edx
call ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop ebx
pop esi
add esp, 8
ret 8
mov eax, esi
pop esi
add esp, 8
ret 8
Function at 0x4670a0
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x621e4b
push eax
mov dword fs:[0], esp
sub esp, 0x65c
mov ecx, 0x6b2d30
push ebx
push ebp
push esi
push edi
push str.PATH
push 0x6b2d34
call fcn.00466e70
mov ebp, eax
xor ebx, ebx
cmp ebp, ebx
je 0x4670f1
push ebp
call fcn.00435355
add esp, 4
test eax, eax
jne 0x467134
push ebp
call fcn.005f1804
add esp, 4
push 0x694ed4
call fcn.00435355
inc eax
lea esi, [eax + eax]
push esi
call fcn.005f17db
mov ebp, eax
add esp, 8
cmp ebp, ebx
je 0x467278
mov ecx, esi
xor eax, eax
mov edx, ecx
mov edi, ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push 0x694ed4
and ecx, 3
push ebp
rep stosb byte es:[edi], al
call fcn.00435330
add esp, 8
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x266]
mov word [esp + 0x264], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x80
xor eax, eax
lea edi, [esp + 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x67c]
lea ecx, [esp + 0x264]
push eax
push str.oadbg_
push str._s_s_
push ecx
call fcn.004398bf
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x476]
mov word [esp + 0x474], bx
rep stosd dword es:[edi], eax
add esp, 0x10
lea edx, [esp + 0x264]
stosw word es:[edi], ax
push edx
push ebp
lea eax, [esp + 0x46c]
push 0x694ea8
push eax
call fcn.004398bf
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], ebx
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [esp + 0x14]
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x46726f
mov esi, dword [esp + 0x680]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
lea eax, [esp + 0x40]
push 0x694ea0
push eax
call edi
test eax, eax
je 0x467258
lea ecx, [esp + 0x40]
push 0x694e9c
push ecx
call edi
test eax, eax
je 0x467258
test byte [esp + 0x14], 0x10
jne 0x467258
lea edx, [esp + 0x40]
lea ecx, [esp + 0x10]
push edx
call fcn.005f00e0
mov eax, dword [esi + 8]
lea ecx, [esp + 0x10]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x67c], 0
call fcn.005ec0ce
lea ecx, [esp + 0x10]
mov dword [esp + 0x674], 0xffffffff
call fcn.005f0020
lea edx, [esp + 0x14]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4671f4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call fcn.005f1804
add esp, 4
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x668
ret 8
Function at 0x469c40
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x622025
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x68faac]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
push 0x104
push ecx
mov dword [esp + 0x22c], 1
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x469d69
lea edx, [esp + 0x14]
push 0x5c
push edx
call fcn.004356a0
add esp, 8
cmp eax, ebx
je 0x469cd3
mov byte [eax], bl
lea eax, [esp + 0x118]
test eax, eax
je 0x469d62
lea ecx, [esp + 0x14]
test ecx, ecx
je 0x469d62
mov eax, dword [esp + 0x230]
mov edx, 0x7a
cmp eax, ebx
je 0x469d20
lea edx, [esp + 0x14]
push eax
push edx
push 0x681344
lea eax, [esp + 0x124]
push 0x104
push eax
call fcn.005422a2
add esp, 0x14
xor edx, edx
mov eax, edx
jmp 0x469d6f
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jae 0x469d5e
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x118]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov eax, edx
jmp 0x469d6f
mov eax, 0x57
jmp 0x469d6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x6b2fb0], eax
je 0x469d81
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x469d92
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0x10]
call fcn.005f01a9
mov esi, dword [esp + 0x22c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.005efd95
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x224], bl
call fcn.005f0020
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x46a140
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x622075
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x210
mov eax, dword [0x68faac]
push ebx
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0xc], eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x119]
mov byte [esp + 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x14]
push 0x104
push ecx
mov dword [esp + 0x22c], 1
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x46a254
lea edx, [esp + 0x118]
test edx, edx
je 0x46a24d
lea eax, [esp + 0x14]
test eax, eax
je 0x46a24d
mov eax, dword [esp + 0x230]
mov edx, 0x7a
cmp eax, ebx
je 0x46a20b
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x681344
lea edx, [esp + 0x124]
push 0x104
push edx
call fcn.005422a2
add esp, 0x14
xor edx, edx
mov eax, edx
jmp 0x46a25a
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x104
jae 0x46a249
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x118]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov eax, edx
jmp 0x46a25a
mov eax, 0x57
jmp 0x46a25a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, ebx
mov dword [0x6b2fb0], eax
je 0x46a26c
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x46a27d
lea ecx, [esp + 0x118]
push ecx
lea ecx, [esp + 0x10]
call fcn.005f01a9
mov esi, dword [esp + 0x22c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call fcn.005efd95
mov dword [esp + 0x10], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x224], bl
call fcn.005f0020
mov ecx, dword [esp + 0x21c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x21c
ret
Function at 0x46be00
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0x214
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
mov dword [esp + 0x14], 0x104
push eax
push 0x681140
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp eax, ebx
jne 0x46be79
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push eax
push ebx
push 0x68112c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 0xc]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x46bee4
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x18]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
mov edi, 0x695134
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov byte [esp + 0x11c], bl
mov eax, ecx
mov esi, edi
mov edi, edx
push 0x104
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, 0x40
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x120]
push ecx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dl, byte [esp + 0x11c]
mov byte [esp + 0x18], dl
jmp 0x46bf0a
lea edi, [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x11b], bl
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
lea eax, [esp + ecx + 0x18]
mov cl, byte [esp + ecx + 0x18]
cmp cl, 0x5c
jne 0x46bf0a
mov byte [eax], bl
push ebp
mov ebp, dword [esp + 0x228]
cmp ebp, ebx
je 0x46bf8b
mov esi, dword [esp + 0x22c]
cmp esi, ebx
je 0x46bf8b
lea eax, [esp + 0x1c]
test eax, eax
je 0x46bf8b
mov eax, dword [esp + 0x230]
mov edx, 0x7a
cmp eax, ebx
je 0x46bf54
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0x681344
push esi
push ebp
call fcn.005422a2
add esp, 0x14
xor edx, edx
mov esi, edx
jmp 0x46bf90
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jbe 0x46bf87
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
xor edx, edx
rep movsb byte es:[edi], byte [esi]
mov esi, edx
jmp 0x46bf90
mov esi, 0x57
cmp esi, ebx
mov dword [0x6b2fb0], esi
pop ebp
je 0x46bfa2
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
cmp esi, ebx
pop edi
pop esi
sete al
pop ebx
add esp, 0x214
ret
Function at 0x471d10
Capabilities:
Create directory
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x471d2f
push 0x57
mov dword [0x6b2fb0], 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push 0
push eax
push esi
mov dword [esp + 0x24], 0
call fcn.00535f00
mov eax, dword [esp + 0x24]
add esp, 0x1c
cmp eax, 0xffffffff
je 0x471d75
test al, 0x10
je 0x471d75
push 0xb7
mov dword [0x6b2fb0], 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x471d9c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
mov dword [0x6b2fb0], eax
je 0x471d98
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0xc]
mov dword [0x6b2fb0], 0
test eax, eax
je 0x471db6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, 1
pop esi
ret
Function at 0x471f20
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x208
push ebx
mov ebx, dword [esp + 0x210]
test ebx, ebx
jne 0x471f3c
xor eax, eax
pop ebx
add esp, 0x208
ret
push ebp
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.004355a0
lea ecx, [esp + 0x1c]
push 0x5c
push ecx
call fcn.0043feb0
mov esi, eax
lea edi, [esp + 0x24]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x14
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jbe 0x471fc0
cmp byte [esp + 0x10], 0x5c
jne 0x471fc0
cmp byte [esp + 0x11], 0x5c
jne 0x471fc0
lea edx, [esp + 0x12]
push 0x5c
push edx
call fcn.0043feb0
add esp, 8
test eax, eax
je 0x47203e
inc eax
push 0x5c
push eax
call fcn.0043feb0
add esp, 8
mov esi, eax
test esi, esi
je 0x47203e
lea eax, [esp + 0x10]
mov byte [esi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x472002
test bl, 1
je 0x471ff1
mov ecx, ebx
lea edx, [esp + 0x10]
and ecx, 0xfffffffe
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x472074
cmp ebx, 0xffffffff
je 0x47200b
test edi, edi
jne 0x47201a
lea ecx, [esp + 0x10]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
test ebp, ebp
je 0x472074
mov byte [esi], 0x5c
inc esi
push 0x5c
push esi
call fcn.0043feb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x471fc4
test ebp, ebp
je 0x472074
mov ebx, dword [esp + 0x21c]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x472069
test al, 0x10
jne 0x472074
test al, 1
je 0x47205c
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, eax
test ebp, ebp
je 0x472074
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x472090
Capabilities:
Check if file exists
Create directory
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x410
push ebx
mov ebx, dword [esp + 0x418]
test ebx, ebx
jne 0x4720ac
xor eax, eax
pop ebx
add esp, 0x410
ret
push ebp
push esi
push edi
mov ecx, 0x103
xor eax, eax
lea edi, [esp + 0x12]
mov word [esp + 0x10], 0
push 0x207
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x14]
push ebx
push eax
mov ebp, 1
call fcn.00435372
mov edi, 0x5c
lea ecx, [esp + 0x1c]
push edi
push ecx
call fcn.00541980
lea edx, [esp + 0x24]
mov esi, eax
push edx
call fcn.00435355
add esp, 0x18
cmp eax, 2
jbe 0x472131
cmp word [esp + 0x10], di
jne 0x472131
cmp word [esp + 0x12], di
jne 0x472131
lea eax, [esp + 0x14]
push edi
push eax
call fcn.00541980
add esp, 8
test eax, eax
je 0x4721b9
add eax, 2
push edi
push eax
call fcn.00541980
add esp, 8
mov esi, eax
test esi, esi
je 0x4721b9
lea ecx, [esp + 0x10]
mov word [esi], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov edi, ebx
and edi, 0x10
jne 0x472179
test bl, 1
je 0x472168
mov edx, ebx
lea eax, [esp + 0x10]
and edx, 0xfffffffe
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x4721ef
cmp ebx, 0xffffffff
je 0x472182
test edi, edi
jne 0x472191
lea edx, [esp + 0x10]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
test ebp, ebp
je 0x4721ef
mov word [esi], 0x5c
add esi, 2
push 0x5c
push esi
call fcn.00541980
mov esi, eax
add esp, 8
test esi, esi
jne 0x472139
test ebp, ebp
je 0x4721ef
mov ebx, dword [esp + 0x424]
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4721e4
test al, 0x10
jne 0x4721ef
test al, 1
je 0x4721d7
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
test ebp, ebp
je 0x4721ef
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebp, eax
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x410
ret
Function at 0x4728e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x154
push ebx
mov ebx, dword [esp + 0x15c]
push ebp
mov ebp, dword [esp + 0x164]
push esi
mov esi, dword [esp + 0x16c]
mov eax, 0x1f3
push esi
sub eax, ebp
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x472929
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x154
ret
push edi
mov dword [esp + 0x10], 1
mov eax, dword [esi]
test al, 0x10
mov dword [esp + 0x14], eax
je 0x472a91
mov al, byte [esi + 0x2c]
lea edx, [esi + 0x2c]
cmp al, 0x2e
jne 0x472964
mov al, byte [esi + 0x2d]
test al, al
je 0x472ab9
cmp al, 0x2e
jne 0x472964
mov al, byte [esi + 0x2e]
test al, al
je 0x472ab9
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x20]
not ecx
dec ecx
mov dword [esp + 0x1c], ecx
inc ecx
cmp eax, ecx
jb 0x472ab9
add ebp, ebx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 1], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov edx, dword [esp + 0x174]
and ecx, 3
test dl, 0x10
rep movsb byte es:[edi], byte [esi]
je 0x4729dc
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push 0
push ebx
call dword [esp + 0x188]
mov edx, dword [esp + 0x174]
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x472a48
test dl, 0x40
jne 0x472a48
mov esi, dword [esp + 0x1c]
mov ecx, 0x4f
xor eax, eax
lea edi, [esp + 0x28]
mov dword [esp + 0x24], 0
mov byte [esi + ebp - 1], 0x5c
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x17c]
mov ecx, dword [esp + 0x178]
push eax
mov eax, dword [esp + 0x170]
push ecx
push edx
lea edx, [esp + 0x30]
lea ecx, [esi + eax + 1]
push edx
push ecx
mov byte [esi + ebp], 0x2a
push ebx
mov byte [esi + ebp + 1], 0
call fcn.004728e0
mov edx, dword [esp + 0x18c]
add esp, 0x18
mov dword [esp + 0x10], eax
jmp 0x472a4c
mov esi, dword [esp + 0x1c]
test dl, 0x20
je 0x472a79
mov eax, dword [esp + 0x10]
test eax, eax
je 0x472a79
mov edx, dword [esp + 0x17c]
mov eax, dword [esp + 0x14]
push edx
push eax
push 0
push ebx
mov byte [esi + ebp - 1], 0
call dword [esp + 0x188]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x170]
mov byte [ebp - 1], 0x2a
mov byte [ebp], 0
mov ebp, dword [esp + 0x16c]
jmp 0x472ab9
mov ecx, dword [esp + 0x17c]
lea edx, [esi + 0x2c]
push ecx
push eax
push edx
push ebx
mov byte [ebx + ebp - 2], 0
call dword [esp + 0x188]
mov byte [ebx + ebp - 2], 0x5c
mov dword [esp + 0x10], eax
mov byte [ebx + ebp - 1], 0x2a
mov edi, dword [esp + 0x10]
test edi, edi
je 0x472ad5
mov eax, dword [esp + 0x18]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x472932
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x154
ret