joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4453d0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x3014
call fcn.00454790
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x3010], eax
cmp byte [0x48956c], 0
jne 0x4453fe
cmp byte [0x48956d], 0
je 0x4454a4
mov eax, dword [esp + 0x3018]
push eax
lea ecx, [esp + 0x1014]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x301c]
push edx
lea eax, [esp + 0x1014]
push eax
lea ecx, [esp + 0x2018]
push ecx
call dword [sym.imp.USER32.dll_wvsprintfA]
lea edx, [esp]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [esp + 0xe]
movzx ecx, word [esp + 0xc]
movzx edx, word [esp + 0xa]
push eax
movzx eax, word [esp + 0xc]
push ecx
movzx ecx, word [esp + 8]
push edx
movzx edx, word [esp + 0x12]
push eax
movzx eax, word [esp + 0x12]
push ecx
push edx
push eax
lea ecx, [esp + 0x2c]
push str._02i__02i__02i__02i:_02i:_02i:_03i
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x2034]
push edx
lea eax, [esp + 0x38]
push 0x1000
push eax
call fcn.00457753
add esp, 0x30
cmp byte [0x48956c], 0
je 0x4454a4
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 0x3010]
xor ecx, esp
call fcn.00453432
add esp, 0x3014
ret

Function at 0x4454c0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x4014
call fcn.00454790
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x4010], eax
cmp byte [0x48956c], 0
jne 0x4454ee
cmp byte [0x48956d], 0
je 0x445576
mov ecx, dword [esp + 0x4018]
lea eax, [esp + 0x401c]
push eax
push ecx
lea edx, [esp + 0x18]
push 0x400
push edx
call fcn.00455218
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
movzx ecx, word [esp + 0xe]
push edx
movzx edx, word [esp + 0x10]
push eax
movzx eax, word [esp + 0xc]
push ecx
movzx ecx, word [esp + 0x16]
push edx
movzx edx, word [esp + 0x16]
push eax
push ecx
push edx
lea eax, [esp + 0x2030]
push str._02i__02i__02i__02i:_02i:_02i:_03i__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
cmp byte [0x48956c], 0
je 0x445576
lea ecx, [esp + 0x2010]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov ecx, dword [esp + 0x4010]
xor ecx, esp
call fcn.00453432
add esp, 0x4014
ret

Function at 0x445590
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4455c6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
Function at 0x4456d0
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x1014
call fcn.00454790
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x1010], eax
cmp byte [0x48956e], 0
je 0x445803
mov ecx, dword [esp + 0x1018]
lea eax, [esp + 0x101c]
push eax
push ecx
lea edx, [esp + 0x818]
push 0x400
push edx
call fcn.00455218
add esp, 0x10
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0xe]
movzx eax, word [esp + 0xc]
lea ecx, [esp + 0x810]
push ecx
movzx ecx, word [esp + 0xe]
push edx
movzx edx, word [esp + 0x10]
push eax
movzx eax, word [esp + 0xc]
push ecx
movzx ecx, word [esp + 0x16]
push edx
movzx edx, word [esp + 0x16]
push eax
push ecx
push edx
lea eax, [esp + 0x30]
push str._02i__02i__02i__02i:_02i:_02i:_03i__s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp byte [0x48956e], 0
je 0x445803
cmp byte [0x489570], 0
je 0x44579f
push 0x489570
call fcn.00445590
add esp, 4
cmp eax, dword [0x488078]
jle 0x4457d5
movzx edx, word [esp + 0xa]
movzx eax, word [esp + 8]
movzx ecx, word [esp + 6]
push edx
movzx edx, word [esp + 6]
push eax
movzx eax, word [esp + 8]
push ecx
push edx
push eax
push 0x489468
push str._sLOG._02i._02i._02i._02i._02i.txt
push 0x489570
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x20
push esi
push 0x47e50c
push 0x489570
call fcn.004579f7
mov esi, eax
add esp, 8
test esi, esi
je 0x445802
lea ecx, [esp + 0x14]
push esi
push ecx
call fcn.00457887
push esi
call fcn.0045574a
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x1010]
xor ecx, esp
call fcn.00453432
add esp, 0x1014
ret
Function at 0x448bf0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
push ebx
push esi
push edi
push 2
push 0
mov edi, ecx
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
cmp esi, 0x80010106
je 0x448c0d
test esi, esi
jl 0x448c50
push edi
push 0x47ea38
push 1
push 0
push 0x47ea28
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x448c50
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
lea ebx, [edi + 4]
push ebx
push eax
call edx
mov esi, eax
test esi, esi
jl 0x448c50
mov eax, dword [ebx]
mov ecx, dword [eax]
lea edx, [edi + 8]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
test esi, esi
jge 0x448c59
mov ecx, edi
call fcn.00448af0
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x449760
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0x414
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
push ebx
push edi
push 0
push 0x80
push 3
push 0
push 0
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x438]
push SysReAllocString
xor bl, bl
push eax
mov dword [esp + 0x28], ecx
mov byte [esp + 0x27], bl
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44985e
push ebp
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
test ebp, ebp
jle 0x449850
push esi
lea ebx, [ebp + 4]
push ebx
call fcn.004534f0
mov esi, eax
add esp, 4
test esi, esi
je 0x44984f
push ebx
push 0
push esi
call fcn.00453450
add esp, 0xc
push 0
lea edx, [esp + 0x20]
push edx
push ebp
push esi
push edi
mov dword [esp + 0x30], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x3ff
lea eax, [esp + 0x25]
push 0
push eax
mov byte [esp + 0x2c], 0
call fcn.00453450
mov ecx, dword [esp + 0x20]
add esp, 0xc
push 0
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x28]
push edx
call fcn.00449450
lea eax, [esp + 0x20]
push eax
push esi
call fcn.00457a40
add esp, 8
test eax, eax
je 0x449846
mov byte [esp + 0x13], 1
push esi
call fcn.004534ca
add esp, 4
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [esp + 0xf]
pop ebp
jmp 0x449860
mov al, bl
mov ecx, dword [esp + 0x418]
pop edi
pop ebx
xor ecx, esp
call fcn.00453432
add esp, 0x414
ret 8
Function at 0x449880
Capabilities:
Create directory

Disassembly:
sub esp, 0x41c
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [esp + 0x424]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x420]
lea edx, [esp + 8]
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4498b0
push ebx
push ebp
push esi
push edi
push 2
mov byte [esp + 0x17], cl
lea ecx, [esp + 0x1c]
push 0x47eab4
push ecx
xor bl, bl
call fcn.00457ac6
add esp, 0xc
test eax, eax
jne 0x4498e3
mov bl, 1
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.00453b87
mov esi, eax
add esp, 8
test esi, esi
je 0x4499c6
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x449910
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449920
sub eax, edx
sar eax, 1
cmp eax, 2
jbe case.0x44995c.161
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call ebp
test eax, eax
jne case.0x44995c.161
call edi
lea ecx, [eax - 5]
cmp ecx, 0xb2
ja case.0x44995c.6
movzx ecx, byte [ecx + 0x449a08]
jmp dword [ecx*4 + 0x4499f8]
lea edx, [esp + 0x18]
push 0x5c
push edx
call fcn.00453b87
add esp, 8
test eax, eax
jne 0x4499f4
jmp case.0x44995c.161
test bl, bl
je 0x4499f4
mov eax, 0x5c
mov word [esi], ax
add esi, 2
cmp word [esi], 0
je 0x449992
mov byte [esp + 0x13], 1
push 0x5c
push esi
call fcn.00453b87
mov esi, eax
add esp, 8
test esi, esi
jne 0x449910
cmp byte [esp + 0x13], al
je 0x4499c6
mov ecx, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
call ebp
test eax, eax
jne 0x4499c6
call edi
cmp eax, 0xb7
jne 0x4499f4
mov eax, 1
mov ecx, dword [esp + 0x428]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00453432
add esp, 0x41c
ret 8
push eax
push str.KXAPI::CreateDirectory___failed__ld_n
call fcn.004453d0
add esp, 8
xor eax, eax
jmp 0x4499cb
Function at 0x44a070
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
push str.KXAPI::DeleteFile_____s__n
mov ebx, ecx
call fcn.004454c0
add esp, 8
push 0x80
push esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x44a11a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x44a0c3
push str.KXAPI::DeleteFile___ERROR_FILE_NOT_FOUND_n
call fcn.004453d0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
cmp eax, 3
jne 0x44a0dd
push str.KXAPI::DeleteFile___Can_not_find_the_file_path._n
call fcn.004453d0
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
cmp byte [ebx + 5], 0
je 0x44a0fd
push str.WIN9X___file_is_in_use__set_the_flag_to_delete_it_when_system_reboot_n
call fcn.004453d0
add esp, 4
mov edi, 2
mov eax, edi
pop edi
pop esi
pop ebx
ret 4
push 0x47ebf0
call fcn.004453d0
add esp, 4
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov edi, 2
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x44a130
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
push str.KXAPI::DeleteFileAfterReboot_____s__n
mov edi, ecx
call fcn.004454c0
add esp, 8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp byte [edi + 5], 0
je 0x44a16f
push str.WIN9X___file_is_in_use__set_the_flag_to_delete_it_when_system_reboot_n
call fcn.004453d0
add esp, 4
pop edi
mov eax, 2
pop esi
ret 4
push 0x47ebf0
call fcn.004453d0
add esp, 4
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop edi
mov eax, 2
pop esi
ret 4

Function at 0x44a1a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x414
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x410], eax
push ebx
push esi
mov esi, dword [esp + 0x428]
push edi
mov edi, dword [esp + 0x424]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x16]
push ecx
xor ebx, ebx
mov word [esp + 0x18], ax
call fcn.00453450
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x22a]
push eax
mov word [esp + 0x22c], dx
call fcn.00453450
add esp, 0x18
lea ecx, [esp + 0xc]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x44a222
push 0x104
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [esp + 0x428]
lea eax, [esp + 0x214]
push eax
push ecx
push edi
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x44a266
lea eax, [esp + 0x214]
mov edx, esi
mov ecx, eax
sub edx, ecx
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x44a250
mov eax, 1
jmp 0x44a268
mov eax, ebx
mov ecx, dword [esp + 0x41c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00453432
add esp, 0x414
ret 0xc
Function at 0x44a610
Capabilities:
Enumerate gui resources

Disassembly:
sub esp, 0x6c
push 0x6c
lea eax, [esp + 4]
push 0
push eax
call fcn.00453450
mov ecx, dword [esp + 0x7c]
mov edx, dword [esp + 0x80]
add esp, 0xc
lea eax, [esp]
push eax
push 0x44a290
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x70], ecx
mov dword [esp + 0x6c], edx
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x60]
add esp, 0x6c
ret 8
Function at 0x44b3d0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x10]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push eax
mov dword [esp + 0x30], 0
call esi
mov ecx, dword [esp + 0x20]
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push ecx
mov ebp, eax
call esi
mov ebx, eax
mov dword [esp + 0x20], ebx
cmp ebp, 0xffffffff
je 0x44b52e
cmp ebx, 0xffffffff
je 0x44b52e
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push ebp
call edi
push 0
push ebx
mov esi, eax
call edi
mov edi, eax
cmp esi, edi
jne 0x44b514
push esi
call fcn.004534f0
push edi
mov ebx, eax
call fcn.004534f0
xor ecx, ecx
add esp, 8
mov dword [esp + 0x20], eax
cmp ebx, ecx
je 0x44b503
cmp eax, ecx
je 0x44b4f6
push ecx
lea edx, [esp + 0x14]
push edx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push ebp
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], ecx
call esi
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
push 0
lea eax, [esp + 0x18]
push eax
push edi
push ecx
push edx
call esi
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x14]
jne 0x44b4f6
mov ecx, dword [esp + 0x20]
mov esi, ebx
cmp eax, 4
jb 0x44b4ca
mov edx, dword [esi]
cmp edx, dword [ecx]
jne 0x44b4f6
sub eax, 4
add ecx, 4
add esi, 4
cmp eax, 4
jae 0x44b4b6
test eax, eax
je 0x44b4ee
mov dl, byte [ecx]
cmp dl, byte [esi]
jne 0x44b4f6
cmp eax, 1
jbe 0x44b4ee
mov dl, byte [ecx + 1]
cmp dl, byte [esi + 1]
jne 0x44b4f6
cmp eax, 2
jbe 0x44b4ee
mov al, byte [ecx + 2]
cmp al, byte [esi + 2]
jne 0x44b4f6
mov dword [esp + 0x18], 1
push ebx
call fcn.004534ca
mov eax, dword [esp + 0x24]
add esp, 4
test eax, eax
je 0x44b510
push eax
call fcn.004534ca
add esp, 4
mov ebx, dword [esp + 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call esi
push ebx
call esi
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x44b540
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push edi
lea ecx, [esp + 0xc]
push ecx
xor eax, eax
push 0x2e
push eax
xor edi, edi
mov word [esp + 0x1c], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x44b5b6
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x44b5c7
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
jmp 0x44b5c7
push 0
push 0x2e
lea eax, [esp + 0x18]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp word [esp + 0x10], di
je 0x44b607
test esi, esi
je 0x44b5ef
lea eax, [esp + 0x10]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x44b5e0
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44b5f6
sub eax, edx
sar eax, 1
jmp 0x44b609
mov eax, edi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
xor ecx, esp
call fcn.00453432
add esp, 0x214
ret 4

Function at 0x44b630
Capabilities:
Get common file path

Disassembly:
sub esp, 0x214
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push edi
lea ecx, [esp + 0xc]
push ecx
xor eax, eax
push 0x23
push eax
xor edi, edi
mov word [esp + 0x1c], ax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x44b6a4
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jne 0x44b6a4
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x14]
push ecx
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp word [esp + 0x10], di
je 0x44b6e7
test esi, esi
je 0x44b6cf
lea eax, [esp + 0x10]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x44b6c0
lea eax, [esp + 0x10]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x44b6d6
sub eax, edx
sar eax, 1
jmp 0x44b6e9
mov eax, edi
mov ecx, dword [esp + 0x218]
pop edi
pop esi
xor ecx, esp
call fcn.00453432
add esp, 0x214
ret 4

Function at 0x44b790
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x44b7c6
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x44c2f0
Capabilities:
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0xa84
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0xa80], eax
mov eax, dword [esp + 0xa8c]
push ebx
mov ebx, dword [esp + 0xa9c]
push esi
mov esi, dword [esp + 0xa90]
push edi
mov dword [esp + 0xc], ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], eax
test ebx, ebx
je 0x44c351
lea edx, [esp + 0x474]
mov eax, ebx
sub edx, ebx
jmp 0x44c340
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x44c340
jmp 0x44c377
xor eax, eax
jmp 0x44c360
movzx ecx, word [eax + 0x46abbc]
mov word [esp + eax + 0x474], cx
add eax, 2
test cx, cx
jne 0x44c360
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [esp + 0x474]
push ecx
push esi
lea edx, [esp + 0x88c]
push 0x46ab98
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x888]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x44c4f1
mov esi, dword [esp + 0xa9c]
push ebp
mov ebp, dword [esp + 0xaa4]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x4c]
push edx
push eax
lea ecx, [esp + 0x688]
push 0x46ab98
push ecx
call edi
mov eax, dword [esp + 0x2c]
lea edx, [esp + 0x5c]
push edx
push eax
lea ecx, [esp + 0x288]
push 0x46ab98
push ecx
call edi
add esp, 0x20
test byte [esp + 0x20], 0x10
je 0x44c4b1
test ebp, ebp
je 0x44c4cd
mov ecx, 0x46abac
lea eax, [esp + 0x4c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44c43e
test dx, dx
je 0x44c43a
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44c43e
add eax, 4
add ecx, 4
test dx, dx
jne 0x44c418
xor eax, eax
jmp 0x44c443
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44c4cd
mov ecx, 0x46aba4
lea eax, [esp + 0x4c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x44c47a
test dx, dx
je 0x44c476
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x44c47a
add eax, 4
add ecx, 4
test dx, dx
jne 0x44c454
xor eax, eax
jmp 0x44c47f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x44c4cd
push 0
lea edx, [esp + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
push ebp
push esi
lea eax, [esp + 0x27c]
push eax
lea ecx, [esp + 0x690]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.0044c2f0
jmp 0x44c4cd
mov ecx, dword [esp + 0x10]
push 0
push esi
lea edx, [esp + 0x278]
push edx
lea eax, [esp + 0x68c]
push eax
call fcn.0044bf30
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x44c3c7
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
mov ecx, dword [esp + 0xa8c]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00453432
add esp, 0xa84
ret 0x14
Function at 0x44c8b0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x22c
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push ebp
mov ebp, dword [esp + 0x23c]
push esi
push edi
mov edi, dword [esp + 0x240]
xor eax, eax
mov ebx, ecx
push 0x206
push eax
lea ecx, [esp + 0x3a]
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x34], edi
mov dword [esp + 0x30], ebp
xor esi, esi
mov word [esp + 0x3c], ax
call fcn.00453450
add esp, 0xc
push esi
push edi
mov ecx, ebx
mov byte [esp + 0x1b], 0
call fcn.004496a0
lea edx, [esp + 0x30]
test al, al
je 0x44ca3d
mov eax, edi
sub edx, edi
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x44c920
mov dword [esp + 0x20], esi
test ebp, ebp
je 0x44c93a
mov dword [ebp], esi
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x34]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test ebp, ebp
jbe 0x44c9ed
push ebp
call fcn.004534f0
mov edi, eax
add esp, 4
mov dword [esp + 0x18], edi
test edi, edi
je 0x44c9ed
push edi
push ebp
push 0
lea edx, [esp + 0x3c]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x44c9e4
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x46ab94
push edi
mov dword [esp + 0x24], esi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0x14]
mov dx, word [eax + 8]
mov si, word [eax + 0xe]
movzx ebx, word [eax + 0xc]
mov cx, word [eax + 0xa]
movzx edi, dx
mov edx, dword [esp + 0x28]
push edx
movzx ebp, si
push ebx
push ebp
movzx esi, cx
push edi
push esi
push str.GetFileVersion____d__d__d__d___s__n
call fcn.004454c0
mov eax, dword [esp + 0x3c]
shl esi, 0x10
or esi, edi
mov edi, dword [esp + 0x30]
add esp, 0x18
test eax, eax
je 0x44c9e0
shl ebp, 0x10
or ebp, ebx
mov dword [eax], ebp
mov ebx, dword [esp + 0x1c]
push edi
call fcn.004534ca
add esp, 4
cmp byte [esp + 0x13], 0
je 0x44ca12
push 0
lea eax, [esp + 0x34]
push eax
mov ecx, ebx
call fcn.004496a0
test al, al
je 0x44ca12
lea ecx, [esp + 0x30]
push ecx
mov ecx, ebx
call fcn.0044a070
push esi
push str.GetFileVersion_returns_0x_08x_n
call fcn.004453d0
add esp, 8
mov eax, esi
mov ecx, dword [esp + 0x238]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00453432
add esp, 0x22c
ret 8
push edx
push 0
push 0x477bc0
mov ecx, ebx
call fcn.0044a1a0
test eax, eax
je 0x44c92f
push 0
push 0
lea eax, [esp + 0x38]
push eax
push edi
mov ecx, ebx
mov byte [esp + 0x23], 1
call fcn.0044bf30
test eax, eax
jne 0x44c92f
push eax
lea ecx, [esp + 0x34]
push ecx
mov ecx, ebx
call fcn.004496a0
test al, al
je 0x44ca8f
lea edx, [esp + 0x30]
push edx
mov ecx, ebx
call fcn.0044a070
xor eax, eax
jmp 0x44ca22