joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6b8fb8
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x6b8fc0
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00405160
xor eax, eax
push ebp
push 0x6b9190
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x6b91a4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x334]
call fcn.0046f918
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x18]
call fcn.0040d39c
push dword [ebp - 0x18]
push 0x6b91e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x33c]
call fcn.004708e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x1c]
call fcn.0040d3b4
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405030
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409d4c
push dword [ebp - 0x10]
push 0x6b91ec
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x338]
call fcn.0046f918
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x28]
call fcn.0040d39c
push dword [ebp - 0x28]
push 0x6b91e0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x340]
call fcn.004708e4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x2c]
call fcn.0040d3b4
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00405030
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.00409d4c
push dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00405030
lea edx, [ebp - 0x30]
mov eax, dword [ebp - 8]
call fcn.00409c78
cmp dword [ebp - 0x30], 0
je 0x6b90e9
push dword [ebp - 0xc]
push 0x6b9208
push dword [ebp - 8]
push 0x6b9218
lea eax, [ebp - 0xc]
mov edx, 4
call fcn.00405030
lea eax, [ebp - 0xc]
mov edx, 0x6b9224
call fcn.00404f78
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
call fcn.004cecb0
xor eax, eax
push ebp
push 0x6b9166
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
call fcn.004cd23c
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0xc]
call fcn.0040558c
mov edx, dword [ebp - 0x34]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
call fcn.004dfe70
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
call fcn.004cd230
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6b916d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x324]
call fcn.004cecd0
ret
Function at 0x6bb88c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
mov esi, 0x6f555c
xor eax, eax
push ebp
push 0x6bba18
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [0x6f0660]
call fcn.00404ef8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409d4c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov edx, 0x6bba30
call fcn.00404fbc
lea eax, [ebp - 0x18]
mov edx, dword [0x6f0660]
call fcn.00404ef8
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409d4c
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 8]
mov edx, 0x6bba94
call fcn.00404fbc
xor ecx, ecx
mov dl, 1
mov eax, dword [0x6aea18]
call fcn.006aedd0
mov dword [esi], eax
mov eax, dword [esi]
add eax, 0x58
mov edx, dword [0x6efed8]
mov edx, dword [edx]
call fcn.00404ce8
mov eax, dword [esi]
add eax, 0x60
mov edx, 0x6bbb0c
call fcn.00404ce8
mov edx, dword [ebx + 0x358]
mov eax, dword [esi]
call fcn.006afc60
mov eax, dword [0x6f02e8]
mov eax, dword [eax]
mov edx, dword [eax + 0x58]
mov eax, dword [esi]
call fcn.006afc70
mov eax, dword [esi]
mov eax, dword [eax + 0x34]
mov edx, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x6bbb18
mov eax, dword [esi]
call fcn.006afdc8
mov edx, 0x6bbb2c
mov eax, dword [esi]
call fcn.006afdf0
mov edx, 0x6bbb2c
mov eax, dword [esi]
call fcn.006afd8c
mov eax, dword [esi]
mov eax, dword [eax + 0x3c]
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov edx, 0x6bbb3c
mov eax, dword [esi]
call fcn.006afcc0
mov edx, 0x6bbb50
mov eax, dword [esi]
call fcn.006afce8
mov eax, dword [esi]
mov byte [eax + 0x70], 1
mov eax, dword [esi]
call fcn.006afb60
mov eax, dword [ebx + 0x358]
mov eax, dword [eax + 0x26c]
call fcn.0045fa7c
test eax, eax
jle 0x6bb9fb
mov eax, dword [ebx + 0x358]
mov eax, dword [eax + 0x26c]
xor edx, edx
call fcn.0045fe70
mov dl, 1
call fcn.0045eda8
mov eax, dword [ebx + 0x358]
mov eax, dword [eax + 0x26c]
xor edx, edx
call fcn.0045fe70
mov dl, 1
call fcn.0045ed74
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6bba1f
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00404cb8
ret
Function at 0x6c3738
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00405160
xor eax, eax
push ebp
push 0x6c3841
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x304]
call fcn.0045d5f0
test eax, eax
jne 0x6c37a1
lea eax, [ebp - 8]
mov edx, 0x6c3858
call fcn.00404d2c
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x328]
call fcn.00646c1c
mov eax, dword [ebx + 0x300]
add eax, 0x2e4
mov edx, 0x6c38a4
call fcn.00404ce8
jmp 0x6c3826
mov eax, dword [ebx + 0x304]
call fcn.0045d5f0
dec eax
jne 0x6c3826
lea eax, [ebp - 0x10]
mov edx, dword [0x6f0660]
call fcn.00404ef8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00409d4c
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x6c38b8
call fcn.00404fbc
cmp dword [ebp - 4], 0
je 0x6c37f6
push dword [ebp - 8]
push 0x6c3918
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405030
lea eax, [ebp - 8]
mov edx, 0x6c3928
call fcn.00404f78
mov edx, dword [ebp - 8]
mov eax, dword [ebx + 0x32c]
call fcn.00646c1c
mov eax, dword [ebx + 0x300]
add eax, 0x2e4
mov edx, 0x6c3944
call fcn.00404ce8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c3848
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404cb8
ret
Function at 0x6c8bf4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x6c8dba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebx + 0x344]
call fcn.00404c94
mov eax, dword [0x6f02e8]
mov eax, dword [eax]
mov eax, dword [eax + 0x5c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004cd23c
mov eax, dword [ebp - 4]
call fcn.004e20e8
mov edx, 0x6c8dd4
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
call fcn.004e2010
mov eax, dword [ebp - 4]
call fcn.004e20e8
mov edx, 0x6c8e20
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
call fcn.004e2010
mov eax, dword [ebx + 0x334]
xor edx, edx
call fcn.006ae38c
cmp al, 2
je 0x6c8d6d
mov eax, dword [ebp - 4]
call fcn.004e20e8
mov edx, 0x6c8e64
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.004e0464
xor eax, eax
push ebp
push 0x6c8d66
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x334]
mov eax, dword [eax + 0x26c]
call fcn.0045fa7c
dec eax
test eax, eax
jl 0x6c8d4e
inc eax
mov dword [ebp - 8], eax
xor esi, esi
mov eax, dword [ebx + 0x334]
mov edx, esi
call fcn.006ae38c
cmp al, 2
jne 0x6c8d44
lea ecx, [ebp - 0x1c]
mov eax, dword [ebx + 0x348]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0x18]
call fcn.00416c24
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004e042c
xor edx, edx
call fcn.004d8870
pop edx
call fcn.004d965c
mov eax, dword [ebp - 4]
call fcn.004e2010
push dword [ebx + 0x344]
mov eax, dword [ebx + 0x334]
mov eax, dword [eax + 0x26c]
mov edx, esi
call fcn.0045fe70
push dword [eax + 8]
push 0x6c8e9c
lea eax, [ebx + 0x344]
mov edx, 3
call fcn.00405030
inc esi
dec dword [ebp - 8]
jne 0x6c8cc6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c8d9a
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.004e0464
ret
mov eax, dword [ebp - 4]
call fcn.004e20e8
mov edx, 0x6c8ea8
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 4]
call fcn.004e2010
lea eax, [ebx + 0x344]
mov edx, dword [0x6f040c]
mov edx, dword [edx]
call fcn.00404ce8
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6c8dc1
lea eax, [ebp - 0x1c]
call fcn.00404c94
lea eax, [ebp - 0x18]
call fcn.00412488
ret
Function at 0x6ca61c
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov esi, eax
xor eax, eax
push ebp
push 0x6ca771
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x6f02e8]
mov eax, dword [eax]
mov ebx, dword [eax + 0x5c]
mov eax, ebx
call fcn.004cd23c
mov eax, ebx
call fcn.004e20e8
mov edx, 0x6ca788
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call fcn.004cd230
mov eax, ebx
call fcn.004cd23c
mov eax, ebx
call fcn.004e20e8
mov edx, 0x6ca788
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call fcn.004cd230
mov eax, dword [esi + 0x318]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x44]
jmp 0x6ca6be
xor edx, edx
mov eax, dword [ebx + 0x30]
call fcn.004c372c
lea edx, [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x60]
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x318]
mov eax, dword [eax + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, ebx
call fcn.004cfa78
cmp byte [ebx + 0xa1], 0
je 0x6ca691
mov eax, dword [esi + 0x318]
mov eax, dword [eax + 0x23c]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x6ca728
lea eax, [ebp - 8]
mov edx, dword [0x6f09b8]
add edx, 0x120c
call fcn.00404ef8
mov edx, dword [ebp - 8]
mov edi, dword [esi + 0x318]
mov eax, dword [edi + 0x23c]
mov ecx, dword [eax]
call dword [ecx + 0x54]
mov edx, eax
mov eax, edi
mov ecx, dword [eax]
call dword [ecx + 0xd0]
mov eax, dword [esi + 0x318]
mov edi, eax
mov edx, eax
mov eax, dword [edi + 0x21c]
call dword [edi + 0x218]
jmp 0x6ca74f
xor edx, edx
mov eax, dword [esi + 0x318]
call fcn.004873d0
xor edx, edx
mov eax, dword [esi + 0x31c]
call fcn.004873d0
xor edx, edx
mov eax, dword [esi + 0x32c]
call fcn.004873d0
mov eax, ebx
call fcn.004cd23c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6ca778
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404cb8
ret
Function at 0x6d0ee4
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
add esp, 0xfffffeb4
mov esi, 0x6ec1f8
mov ecx, 0x4b
mov dword [esp], eax
mov ax, word [0x6ec1f6]
lea edi, [esp + 0x10]
mov word [esp + 8], ax
rep movsd dword es:[edi], dword [esi]
cmp dword [0x6f57c4], 0
jne 0x6d0fff
push 0x6f5948
call sub.kernel32.dll_EnterCriticalSection_1
push 0
push 0
push 4
push 0
push 3
push 0xc0000000
push 0x6ebf98
call sub.kernel32.dll_CreateFileA_1
mov dword [esp + 4], eax
lea eax, [esp + 0x13c]
push eax
call sub.kernel32.dll_GetLocalTime
movzx edx, word [esp + 0x148]
push edx
movzx ecx, word [esp + 0x14a]
push ecx
movzx eax, word [esp + 0x14c]
push eax
movzx edx, word [esp + 0x14e]
push edx
movzx ecx, word [esp + 0x14e]
push ecx
movzx eax, word [esp + 0x150]
push eax
push 0x6efa32
lea edx, [esp + 0x2c]
push edx
call fcn.006ce8a4
add esp, 0x20
mov ecx, dword [esp]
push ecx
lea eax, [esp + 0x14]
push eax
call sub.kernel32.dll_lstrcatA
push 2
push 0
push 0
mov edx, dword [esp + 0x10]
push edx
call sub.kernel32.dll_SetFilePointer_1
push 0
lea ecx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_lstrlenA_1
inc eax
push eax
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [esp + 0x14]
push ecx
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 0x10]
push eax
push 2
lea edx, [esp + 0x14]
push edx
mov ecx, dword [esp + 0x14]
push ecx
call sub.kernel32.dll_WriteFile_1
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle_1
push 0x6f5948
call sub.kernel32.dll_LeaveCriticalSection_1
add esp, 0x14c
pop edi
pop esi
ret
Function at 0x6d2ce4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcac
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, 0x6ec937
lea edi, [ebp - 0x248]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
cmp dword [0x6f5838], 0
je 0x6d2e11
mov word [ebp - 0x26], 0x109
mov byte [ebp - 0x354], 0x13
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_lstrlenA_1
inc eax
push eax
mov edx, dword [ebp - 4]
push edx
lea ecx, [ebp - 0x353]
push ecx
call fcn.006cb33c
add esp, 0xc
push 1
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x24f]
push edx
call fcn.006cb33c
add esp, 0xc
push 1
mov ecx, dword [ebp - 0xc]
push ecx
lea eax, [ebp - 0x24e]
push eax
call fcn.006cb33c
add esp, 0xc
push 1
mov edx, dword [ebp + 0x10]
push edx
lea ecx, [ebp - 0x24d]
push ecx
call fcn.006cb33c
add esp, 0xc
push 1
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x24c]
push edx
call fcn.006cb33c
add esp, 0xc
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x354]
push 6
mov dx, word [ebp - 0x26]
call fcn.006d780c
mov word [ebp - 0x28], ax
push 2
lea ecx, [ebp - 0x30]
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.006cb33c
add esp, 0xc
lea edx, [ebp - 0x2e]
push 1
push edx
mov ecx, dword [ebp - 8]
push ecx
call fcn.006cb33c
add esp, 0xc
lea eax, [ebp - 0x2d]
push 1
push eax
mov edx, dword [ebp - 0xc]
push edx
call fcn.006cb33c
add esp, 0xc
lea ecx, [ebp - 0x2c]
push 1
push ecx
mov eax, dword [ebp + 0x10]
push eax
call fcn.006cb33c
add esp, 0xc
lea edx, [ebp - 0x2b]
push 1
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.006cb33c
movsx eax, word [ebp - 0x28]
add esp, 0xc
jmp 0x6d2ed0
lea eax, [ebp - 0x248]
mov edx, dword [ebp - 4]
call fcn.006d6d40
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x248]
push ecx
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x6d2e4d
mov eax, 0xffffff37
jmp 0x6d2ed0
xor edx, edx
mov dword [ebp - 0x18], edx
push 0
lea ecx, [ebp - 0x24]
push ecx
push 1
lea eax, [ebp - 0x40]
add eax, dword [ebp - 0x18]
push eax
mov edx, dword [ebp - 0x10]
push edx
call sub.kernel32.dll_ReadFile_1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 0xf
jle 0x6d2e52
mov ecx, dword [ebp - 0x10]
push ecx
call sub.kernel32.dll_CloseHandle_1
push 0x6efa45
push 1
push 1
push 0
call sub.kernel32.dll_CreateSemaphoreA
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0x40]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.006cef04
mov dword [ebp - 0x14], eax
push 0
push 1
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_ReleaseSemaphore
mov edx, dword [ebp - 0x1c]
push edx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x6d3168
Capabilities:
Read file on windows

Disassembly:
push esi
push edi
add esp, 0xfffffba4
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
mov esi, 0x6ecc40
lea edi, [esp + 0x48]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
cmp dword [0x6f5838], 0
je 0x6d323d
mov word [esp + 0x34], 0x209
mov byte [esp + 0x148], 0x15
mov eax, dword [esp]
push eax
call sub.kernel32.dll_lstrlenA_1
inc eax
push eax
mov edx, dword [esp + 4]
push edx
lea ecx, [esp + 0x151]
push ecx
call fcn.006cb33c
add esp, 0xc
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_lstrlenA_1
inc eax
push eax
mov edx, dword [esp + 8]
push edx
lea ecx, [esp + 0x255]
push ecx
call fcn.006cb33c
add esp, 0xc
push 0x106
lea ecx, [esp + 0x358]
lea eax, [esp + 0x14c]
mov dx, word [esp + 0x38]
call fcn.006d780c
mov word [esp + 0x36], ax
push 2
lea eax, [esp + 0x358]
push eax
lea edx, [esp + 0x3e]
push edx
call fcn.006cb33c
add esp, 0xc
lea ecx, [esp + 0x356]
push ecx
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_lstrcpyA
movsx eax, word [esp + 0x36]
jmp 0x6d33a9
xor edx, edx
mov byte [esp + 0x26], dl
mov byte [esp + 0x25], dl
mov byte [esp + 0x24], dl
push 0
push 0
push 3
push 0
push 3
push 0x80000000
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [esp + 0xc], eax
cmp dword [esp + 0xc], 0xffffffff
jne 0x6d3279
mov eax, 0xffffff37
jmp 0x6d33a9
push 0
lea edx, [esp + 0x34]
push edx
push 0x10
lea ecx, [esp + 0x44]
push ecx
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_ReadFile_1
mov dword [esp + 0x2c], eax
cmp dword [esp + 0x2c], 0
jne 0x6d32a6
mov eax, 0xffffff35
jmp 0x6d33a9
mov edx, dword [esp + 0xc]
push edx
call sub.kernel32.dll_CloseHandle_1
mov ecx, dword [esp]
push ecx
call sub.kernel32.dll_lstrlenA_1
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x1c], 0x100
jle 0x6d32d1
mov eax, 0xffffff2b
jmp 0x6d33a9
push 0x6efa45
push 1
push 1
push 0
call sub.kernel32.dll_CreateSemaphoreA
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 1
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x1c]
jg 0x6d338e
mov ecx, dword [esp]
mov al, byte [ecx]
push 0xffffffffffffffff
mov edx, dword [esp + 0x24]
mov byte [0x6f5600], al
push edx
call sub.kernel32.dll_WaitForSingleObject
lea ecx, [esp + 0x24]
push ecx
lea eax, [esp + 0x2a]
push eax
push 0x6efa31
lea ecx, [esp + 0x31]
mov edx, 0x6f5600
lea eax, [esp + 0x44]
call fcn.006cef04
mov dword [esp + 0x10], eax
push 0
push 1
mov edx, dword [esp + 0x28]
push edx
call sub.kernel32.dll_ReleaseSemaphore
cmp dword [esp + 0x10], 0
je 0x6d335b
mov ecx, dword [esp + 0x20]
push ecx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [esp + 0x10]
jmp 0x6d33a9
mov dl, byte [0x6f5600]
lea ecx, [esp + 0x27]
mov byte [esp + 0x27], dl
mov byte [esp + 0x28], 0
push ecx
lea eax, [esp + 0x4c]
push eax
call sub.kernel32.dll_lstrcatA
inc dword [esp]
inc dword [esp + 0x14]
mov edx, dword [esp + 0x14]
cmp edx, dword [esp + 0x1c]
jle 0x6d32fb
lea ecx, [esp + 0x48]
push ecx
mov eax, dword [esp + 0xc]
push eax
call sub.kernel32.dll_lstrcpyA
mov edx, dword [esp + 0x20]
push edx
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
add esp, 0x45c
pop edi
pop esi
ret
Function at 0x6d4af0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff680
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea edi, [ebp - 0x228]
mov ecx, 0x82
mov esi, 0x6ed9a4
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x570]
mov ecx, 0x82
mov esi, 0x6edbad
mov edx, 0x5c
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
call fcn.006ce95c
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
sub ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_lstrlenA_1
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x18], 0
je 0x6d4b5c
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x1c]
je 0x6d4b6a
push 0x6efa70
mov ecx, dword [ebp - 4]
push ecx
call sub.kernel32.dll_lstrcatA
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x570]
push edx
call sub.kernel32.dll_lstrcpyA
mov ecx, dword [ebp - 0xc]
push ecx
lea eax, [ebp - 0x570]
push eax
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x368]
push edx
lea ecx, [ebp - 0x570]
push ecx
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x6d4bac
xor eax, eax
jmp 0x6d4ccb
push 0x208
push 0
lea edx, [ebp - 0x228]
push edx
call fcn.006cb324
add esp, 0xc
lea ecx, [ebp - 0x33c]
push ecx
lea eax, [ebp - 0x228]
push eax
call sub.kernel32.dll_lstrcpyA
test byte [ebp - 0x368], 0x10
je 0x6d4c54
push 0x6efa72
lea edx, [ebp - 0x228]
push edx
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x6d4ca8
push 0x6efa74
lea ecx, [ebp - 0x228]
push ecx
call sub.kernel32.dll_lstrcmpiA
test eax, eax
je 0x6d4ca8
lea edi, [ebp - 0x778]
mov esi, 0x6eddb6
mov ecx, 0x82
lea eax, [ebp - 0x228]
rep movsd dword es:[edi], dword [esi]
push eax
mov edx, dword [ebp - 4]
push edx
call sub.kernel32.dll_lstrcatA
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.006d4af0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6d4ca8
mov eax, dword [ebp - 0x10]
jmp 0x6d4ccb
mov esi, 0x6edfbf
lea edi, [ebp - 0x980]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x980]
push edx
call sub.kernel32.dll_lstrcpyA
lea ecx, [ebp - 0x228]
push ecx
lea eax, [ebp - 0x980]
push eax
call sub.kernel32.dll_lstrcatA
lea edx, [ebp - 0x980]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 8]
call fcn.006d45f8
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x6d4ca8
mov eax, dword [ebp - 0x10]
jmp 0x6d4ccb
lea edx, [ebp - 0x368]
push edx
mov ecx, dword [ebp - 0x14]
push ecx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x6d4bac
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x6d4f00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbb0
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov esi, 0x6ee1c8
lea edi, [ebp - 0x22c]
mov ecx, 0x82
rep movsd dword es:[edi], dword [esi]
cmp dword [0x6f5838], 0
je 0x6d4fdc
mov word [ebp - 0x22], 0x109
mov byte [ebp - 0x348], 5
push 2
lea eax, [ebp - 4]
push eax
lea edx, [ebp - 0x347]
push edx
call fcn.006cb33c
add esp, 0xc
mov ecx, dword [ebp - 8]
push ecx
call sub.kernel32.dll_lstrlenA_1
inc eax
push eax
mov eax, dword [ebp - 8]
push eax
lea edx, [ebp - 0x345]
push edx
call fcn.006cb33c
add esp, 0xc
push 2
lea ecx, [ebp - 0xc]
push ecx
lea eax, [ebp - 0x241]
push eax
call fcn.006cb33c
add esp, 0xc
lea ecx, [ebp - 0x450]
lea eax, [ebp - 0x348]
push 0x106
mov dx, word [ebp - 0x22]
call fcn.006d780c
mov word [ebp - 0x24], ax
push 2
lea ecx, [ebp - 0x450]
push ecx
lea eax, [ebp - 0x24]
push eax
call fcn.006cb33c
add esp, 0xc
lea edx, [ebp - 0x44e]
push 0x104
push edx
mov ecx, dword [ebp + 8]
push ecx
call fcn.006cb33c
movsx eax, word [ebp - 0x24]
add esp, 0xc
jmp 0x6d50ae
lea eax, [ebp - 0x22c]
mov edx, dword [ebp - 8]
call fcn.006d6d40
push 0
push 0
push 3
push 0
push 3
push 0x80000000
lea ecx, [ebp - 0x22c]
push ecx
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x6d5018
mov eax, 0xffffff37
jmp 0x6d50ae
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x18]
push ecx
call sub.kernel32.dll_SetFilePointer_1
lea eax, [ebp - 0x14]
push 0
push eax
lea edx, [ebp - 0x23c]
push 0x10
push edx
mov ecx, dword [ebp - 0x18]
push ecx
call sub.kernel32.dll_ReadFile_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x6d505a
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, 0xffffff34
jmp 0x6d50ae
mov edx, dword [ebp - 0x18]
push edx
call sub.kernel32.dll_CloseHandle_1
push 0x6efa45
push 1
push 1
push 0
call sub.kernel32.dll_CreateSemaphoreA
mov dword [ebp - 0x1c], eax
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x1c]
push ecx
call sub.kernel32.dll_WaitForSingleObject
lea edx, [ebp - 0x23c]
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.006cfc9c
mov dword [ebp - 0x20], eax
push 0
push 1
mov eax, dword [ebp - 0x1c]
push eax
call sub.kernel32.dll_ReleaseSemaphore
mov edx, dword [ebp - 0x1c]
push edx
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x20]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4