joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45245c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00403870
xor eax, eax
push ebp
push 0x45266a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 1
push 0x452688
push ebx
push 0x452688
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040377c
test edi, edi
je 0x4524c6
push dword [ebp - 0xc]
push 0x452694
push edi
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040377c
lea edx, [ebp - 0x64]
mov eax, ebx
call fcn.0042c984
mov eax, dword [ebp - 0x64]
mov edx, 0x4526a0
call fcn.00406af4
test eax, eax
je 0x4524fc
lea edx, [ebp - 0x64]
mov eax, ebx
call fcn.0042c984
mov eax, dword [ebp - 0x64]
mov edx, 0x4526b0
call fcn.00406af4
test eax, eax
jne 0x45256c
call fcn.0042da90
test al, al
je 0x45253c
push 0x452688
lea eax, [ebp - 0x68]
call fcn.0042d87c
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.0042c5e0
push dword [ebp - 0x64]
push 0x4526c0
push dword [ebp - 0xc]
push 0x452688
lea eax, [ebp - 0xc]
mov edx, 5
call fcn.0040377c
jmp 0x45256c
push 0x452688
lea eax, [ebp - 0x68]
call fcn.0042d850
mov eax, dword [ebp - 0x68]
lea edx, [ebp - 0x64]
call fcn.0042c5e0
push dword [ebp - 0x64]
push 0x4526d8
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.0040377c
cmp dword [ebp - 4], 0
jne 0x45257c
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0042c92c
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x44
call fcn.00402a64
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x24], 1
mov ax, word [ebp + 0x10]
mov word [ebp - 0x20], ax
cmp dword [ebp - 4], 0
je 0x4525b3
mov eax, dword [ebp - 4]
call fcn.00403880
mov ebx, eax
jmp 0x4525b5
xor ebx, ebx
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x50]
push eax
push ebx
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403880
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x4525ec
mov byte [ebp - 5], 0
call sub.kernel32.dll_GetLastError_1
mov edx, dword [ebp + 8]
mov dword [edx], eax
jmp 0x45263f
mov eax, dword [ebp - 0x5c]
push eax
call sub.kernel32.dll_CloseHandle_1
cmp byte [ebp + 0x14], 0
je 0x452606
push 0xffffffffffffffff
mov eax, dword [ebp - 0x60]
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x18], 0
je 0x452629
test esi, esi
je 0x452612
call esi
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x60]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x45260c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x60]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452671
lea eax, [ebp - 0x68]
mov edx, 2
call fcn.00403568
lea eax, [ebp - 0xc]
call fcn.00403548
lea eax, [ebp - 4]
call fcn.00403548
ret
Function at 0x4526ec
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 0x1c]
call fcn.00403870
xor eax, eax
push ebp
push 0x4527fd
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0x1c], 0
jne 0x452729
lea edx, [ebp + 0x1c]
mov eax, ebx
call fcn.0042c92c
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402a64
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x540
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov eax, ebx
call fcn.00403880
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.00403880
mov dword [ebp - 0x30], eax
cmp dword [ebp + 0x1c], 0
je 0x452772
mov eax, dword [ebp + 0x1c]
call fcn.00403880
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x452796
call sub.kernel32.dll_GetLastError_1
mov dword [esi], eax
jmp 0x4527e7
mov dword [esi], 0x103
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4527e7
cmp byte [ebp + 0x14], 0
je 0x4527b1
push 0xffffffffffffffff
push eax
call sub.user32.dll_WaitForInputIdle
cmp byte [ebp + 0x18], 0
je 0x4527d4
test edi, edi
je 0x4527bd
call edi
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0xc]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x4527b7
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x452804
lea eax, [ebp + 0x1c]
call fcn.00403548
ret

Function at 0x45299c
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffec
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x4529ca
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x10
call fcn.004036a4
jmp 0x4529d1
mov eax, ebx
call fcn.00403548
add esp, 0x14
pop ebx
ret

Function at 0x4529d8
Capabilities:
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, eax
mov dword [esp], pe_nt_image_headers32
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
test eax, eax
je 0x452a09
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004036a4
jmp 0x452a10
mov eax, ebx
call fcn.00403548
add esp, 0x104
pop ebx
ret
Function at 0x452a40
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
cmp dword [0x4880e0], 2
jne 0x452aad
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x452a65
call fcn.00452a20
jmp 0x452abf
lea eax, [esp + 8]
push eax
push 0x452ac4
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
je 0x452aad
call fcn.00452a20
jmp 0x452abf
push 0
push 2
call sub.user32.dll_ExitWindowsEx
test eax, eax
jne 0x452abf
call fcn.00452a20
add esp, 0x14
ret

Function at 0x452ad8
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, eax
mov esi, edx
dec esi
test esi, esi
jl 0x452b35
inc esi
xor ebx, ebx
cmp ebx, 1
jne 0x452afe
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_Sleep
jmp 0x452b0c
cmp ebx, 1
jle 0x452b0c
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov eax, edi
call fcn.00403880
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
jne 0x452b35
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x452b35
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x452b35
inc ebx
dec esi
jne 0x452aee
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4

Function at 0x4534e8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push ecx
mov ebx, edx
mov esi, eax
cmp dword [0x4880e0], 1
je 0x45350e
push 0
mov eax, esi
call fcn.00403880
push eax
push 0x453568
call sub.kernel32.dll_WriteProfileStringA
jmp 0x453541
push esp
push 2
push 0
push 0x453570
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x453541
mov eax, esi
call fcn.00403880
push eax
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegDeleteValueA
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
call fcn.00403880
push eax
call sub.gdi32.dll_RemoveFontResourceA
test eax, eax
je 0x453562
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendNotifyMessageA
pop edx
pop esi
pop ebx
ret
Function at 0x4535a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x45368d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4536a0
push 0x4536b4
call sub.kernel32.dll_GetModuleHandleA_1
push eax
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x453607
push 0
mov eax, dword [ebp - 4]
push eax
push edi
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0042c5e0
mov eax, dword [ebp - 0x18]
call fcn.00403880
push eax
call ebx
neg eax
sbb eax, eax
neg eax
mov ebx, eax
jmp 0x453672
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x18]
mov eax, esi
call fcn.0042c88c
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x1c]
call fcn.0042c954
mov eax, dword [ebp - 0x1c]
lea edx, [ebp - 0x18]
call fcn.0042c5e0
mov eax, dword [ebp - 0x18]
call fcn.00403880
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
je 0x453672
mov ecx, edi
mov eax, dword [ebp - 0xc]
imul dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.004300a0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
imul dword [ebp - 8]
mov edx, dword [ebp - 0x14]
call fcn.004300a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453694
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00403568
ret
Function at 0x45394c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, ebx
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x45396b
xor eax, eax
jmp 0x453988
test al, 0x10
je 0x453976
mov eax, 3
jmp 0x453978
xor eax, eax
push edi
push eax
mov ecx, esi
mov edx, ebx
mov eax, 1
call fcn.004536c4
pop edi
pop esi
pop ebx
ret
Function at 0x453dc8
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
mov ebx, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x453fb3
push dword fs:[eax]
mov dword fs:[eax], esp
test bl, bl
je 0x453e0b
lea eax, [ebp - 8]
push eax
push 0x488788
push 1
push 0
push 0x4889d4
call sub.ole32.dll_CoCreateInstance
jmp 0x453e10
mov eax, 0x80004005
test eax, eax
je 0x453e3d
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x488788
push 1
push 0
push 0x488778
call sub.ole32.dll_CoCreateInstance
test eax, eax
je 0x453e3d
mov edx, eax
mov eax, 0x453fcc
call fcn.00453c2c
xor eax, eax
mov dword [ebp - 0xc], eax
xor eax, eax
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x453f96
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00403880
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
mov eax, dword [ebp + 0x24]
call fcn.00403880
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x2c]
cmp dword [ebp + 0x20], 0
je 0x453e91
mov eax, dword [ebp + 0x20]
call fcn.00403880
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
cmp dword [ebp + 0x1c], 0
je 0x453ead
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x1c]
call fcn.00403880
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x44]
mov eax, dword [ebp + 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x3c]
test edi, edi
je 0x453ecf
mov eax, edi
call fcn.00403880
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
cmp word [ebp + 0x10], 0
je 0x453ee4
mov ax, word [ebp + 0x10]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x34]
lea eax, [ebp - 0xc]
push eax
push 0x488758
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax]
test eax, eax
je 0x453f05
mov edx, eax
mov eax, 0x453fe8
call fcn.00453c2c
test bl, bl
je 0x453f2b
call fcn.00453cd0
test al, al
je 0x453f2b
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, esi
call fcn.0042c654
mov eax, dword [ebp - 0x14]
call fcn.00403dec
mov dword [ebp - 0x10], eax
jmp 0x453f35
mov eax, esi
call fcn.00403dec
mov dword [ebp - 0x10], eax
push 1
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
test eax, eax
je 0x453f54
mov edx, eax
mov eax, 0x45400c
call fcn.00453c2c
mov ecx, dword [ebp + 8]
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00453ce0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x453f9d
cmp dword [ebp - 0x10], 0
je 0x453f7d
mov eax, dword [ebp - 0x10]
push eax
call sub.oleaut32.dll_SysFreeString
cmp dword [ebp - 0xc], 0
je 0x453f8c
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 8]
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 8]
ret
Function at 0x455194
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov dword [esp], ecx
mov edi, edx
mov esi, eax
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4552f8
test bl, 0x10
je 0x4552f8
mov dword [esp + 4], esi
mov byte [esp + 8], 0xb
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45530c
call fcn.00454fa4
test bl, 1
je 0x455223
mov eax, esi
call fcn.004519c0
test al, al
je 0x455219
and ebx, 0xfffffffe
push ebx
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x45520d
mov eax, 0x45532c
call fcn.00454db4
jmp 0x455223
mov eax, 0x455354
call fcn.00454db4
jmp 0x455223
mov eax, 0x455384
call fcn.00454db4
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_RemoveDirectoryA
mov ebx, eax
neg ebx
sbb ebx, ebx
neg ebx
test bl, bl
jne 0x4552fa
call sub.kernel32.dll_GetLastError_1
mov ebp, eax
test edi, edi
je 0x455272
mov dword [esp + 4], ebp
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x4553e4
call fcn.00454fa4
mov edx, esi
mov eax, edi
call fcn.00453b28
jmp 0x4552fa
cmp dword [esp], 0
je 0x4552dd
mov edx, esi
mov eax, dword [esp]
call fcn.004550bc
test al, al
je 0x4552dd
cmp dword [0x4880e0], 2
jne 0x4552dd
mov dword [esp + 4], ebp
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x455420
call fcn.00454fa4
push 4
push 0
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_MoveFileExA
test eax, eax
jne 0x4552fa
call sub.kernel32.dll_GetLastError_1
mov dword [esp + 4], eax
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45546c
call fcn.00454fa4
jmp 0x4552fa
mov dword [esp + 4], ebp
mov byte [esp + 8], 0
lea edx, [esp + 4]
xor ecx, ecx
mov eax, 0x45548c
call fcn.00454fa4
jmp 0x4552fa
mov bl, 1
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4554b0
Capabilities:
Read .ini file

Disassembly:
add esp, 0xffffff00
mov byte [esp], 0
cmp byte [edx], 0
je 0x4554d9
push edx
push pe_nt_image_headers32
lea edx, [esp + 8]
push edx
push 0x455500
push 0
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
jmp 0x4554f0
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push 0x455500
push 0
push eax
call sub.kernel32.dll_GetProfileStringA
cmp byte [esp], 0
sete al
add esp, 0x100
ret
Function at 0x4559b0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x455bea
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea edx, [ebp - 8]
mov eax, esi
call fcn.0042c984
mov eax, dword [ebp - 8]
mov edx, 0x455c04
call fcn.00406af4
test eax, eax
jne 0x455a22
lea ecx, [ebp - 8]
mov edx, 0x455c14
mov eax, esi
call fcn.0042c654
mov eax, dword [ebp - 8]
call fcn.00407030
lea ecx, [ebp - 8]
mov edx, 0x455c24
mov eax, esi
call fcn.0042c654
mov eax, dword [ebp - 8]
call fcn.00407030
mov eax, esi
call fcn.0042cdb0
test al, al
je 0x455bcc
mov dword [ebp - 0x10], esi
mov byte [ebp - 0xc], 0xb
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x455c34
call fcn.00454fa4
cmp byte [ebp + 8], 0
je 0x455a94
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
mov edi, eax
cmp edi, 0xffffffff
je 0x455a94
test edi, 1
je 0x455a94
and edi, 0xfffffffe
push edi
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_SetFileAttributesA
test eax, eax
je 0x455a8a
mov eax, 0x455c50
call fcn.00454db4
jmp 0x455a94
mov eax, 0x455c78
call fcn.00454db4
mov eax, esi
call fcn.00407030
test al, al
jne 0x455b9b
call sub.kernel32.dll_GetLastError_1
mov edi, eax
cmp byte [ebp - 2], 0
je 0x455b81
mov eax, dword [ebp + 0xc]
cmp byte [eax - 1], 0
je 0x455b81
cmp edi, 5
je 0x455acf
cmp edi, 0x20
jne 0x455b81
mov eax, esi
call fcn.00403880
push eax
call sub.kernel32.dll_GetFileAttributesA
test al, 1
jne 0x455b81
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x455ca8
call fcn.00454fa4
xor eax, eax
push ebp
push 0x455b4b
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
mov eax, esi
call fcn.0045139c
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 8]
mov byte [eax + 0x18], 1
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.0042c88c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 8]
call fcn.0042c92c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
call fcn.00453b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x455bcc
mov dword [ebp - 0x10], edi
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x455d0c
call fcn.00454fa4
xor ebx, ebx
jmp 0x455bcc
cmp byte [ebp - 1], 0
je 0x455bcc
push 0
mov eax, esi
call fcn.00403880
push eax
push 1
push 4
call sub.shell32.dll_SHChangeNotify
lea edx, [ebp - 8]
mov eax, esi
call fcn.0042c92c
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0x10]
call fcn.00453b28
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x455bf1
lea eax, [ebp - 0x14]
call fcn.00403548
lea eax, [ebp - 8]
call fcn.00403548
ret
Function at 0x45a61c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x14c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45a6f0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, ebx
call fcn.0042c5e0
lea eax, [ebp - 0x14c]
mov edx, 0x45a70c
call fcn.004036c4
mov eax, dword [ebp - 0x14c]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x45a6d7
xor eax, eax
push ebp
push 0x45a6d0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.0045a5d0
test al, al
je 0x45a6a5
mov byte [ebp - 1], 1
jmp 0x45a6b9
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45a690
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a6d7
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45a6f7
lea eax, [ebp - 0x14c]
call fcn.00403548
ret

Function at 0x45a710
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
push 0x200
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403880
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45a750
mov eax, ebx
lea edx, [esp + 0xc]
mov ecx, 0x104
call fcn.004036a4
jmp 0x45a757
mov eax, ebx
call fcn.00403548
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x45a760
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, edx
mov esi, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x488a08]
or eax, 0x4001
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00403880
push eax
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45a7a0
mov eax, dword [esp + 4]
jmp 0x45a7a2
xor eax, eax
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x45a7ac
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x488a10]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x45a7f0
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45a7e6
mov eax, dword [esp + 4]
jmp 0x45a7e8
xor eax, eax
add esp, 0x160
pop ebx
ret

Function at 0x45a7d0
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x488a10]
or eax, 0x4011
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x10
push 0x45a7f0
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x45a7e6
mov eax, dword [esp + 4]
jmp 0x45a7e8
xor eax, eax
add esp, 0x160
pop ebx
ret
Function at 0x45b684
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b715
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
mov bl, 0x41
test esi, 1
je 0x45b6f7
push 0
push 0
push 1
lea eax, [ebp - 8]
mov edx, ebx
mov byte [eax + 1], dl
mov byte [eax], 1
lea edx, [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.004029a8
mov edx, 0x45b724
lea eax, [ebp - 0xc]
mov cl, 2
call fcn.00402978
lea edx, [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.00403668
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.0045b230
shr esi, 1
inc ebx
cmp bl, 0x5b
jne 0x45b6a9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b71c
lea eax, [ebp - 4]
call fcn.00403548
ret

Function at 0x45b728
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45b859
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45b839
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
lea edx, [ebp - 0x14c]
mov eax, esi
call fcn.0042c5e0
lea eax, [ebp - 0x14c]
mov edx, 0x45b870
call fcn.004036c4
mov eax, dword [ebp - 0x14c]
call fcn.00403880
push eax
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x45b822
xor eax, eax
push ebp
push 0x45b81b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
call fcn.0045a5d0
test al, al
je 0x45b7f0
push 0
push 0
push 0
lea eax, [ebp - 0x14c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004036a4
mov ecx, dword [ebp - 0x14c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, ebx
call fcn.0045b230
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x45b7b2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b822
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_FindClose
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b840
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret