joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402da0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov edi, eax
cmp dword [ebp - 8], esi
jbe 0x402ded
push 0x482910
push dword [edi + esi*4]
call fcn.00453801
add esp, 8
test eax, eax
je 0x402dff
inc esi
cmp esi, dword [ebp - 8]
jb 0x402dd3
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x402e20
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor esi, esi
mov edi, eax
cmp dword [ebp - 8], esi
jbe 0x402e6d
push str.__SDK
push dword [edi + esi*4]
call fcn.00453801
add esp, 8
test eax, eax
je 0x402e7f
inc esi
cmp esi, dword [ebp - 8]
jb 0x402e53
pop edi
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x402ea0
Capabilities:
Accept command line arguments
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp - 8], 0
mov ebx, eax
mov dword [ebp - 0xc], ebx
jbe 0x402f05
mov esi, 1
mov edi, ebx
lea ecx, [ecx]
push str.__DEL
push dword [edi]
call fcn.00453801
mov ecx, dword [ebp - 8]
add esp, 8
test eax, eax
jne 0x402efa
cmp esi, ecx
jb 0x402f1d
inc esi
add edi, 4
lea eax, [esi - 1]
cmp eax, ecx
jb 0x402ee0
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
mov esi, dword [ebx + esi*4]
test esi, esi
je 0x402f05
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edi, edi
lea esp, [esp]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x402f63
push esi
call ebx
test eax, eax
jne 0x402f5d
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call ebx
test eax, eax
jne 0x402f5d
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 0x1e
jl 0x402f30
push 0
push 0
push 0
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
push dword [ebp - 0xc]
jmp 0x402f06
Function at 0x402f80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c0
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x263]
push esi
push edi
push 0x257
push 0
push eax
mov dword [ebp - 0x2c0], ecx
mov byte [ebp - 0x264], 0
call fcn.004523e0
lea edi, [ebp - 0x264]
add esp, 0xc
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x402fc3
mov ax, word [0x482934]
mov esi, ebx
mov word [edi], ax
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x402fd8
lea edi, [ebp - 0x264]
sub ebx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402fe8
mov ecx, ebx
lea edx, [ebp - 0x264]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
dec edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [edx + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x403005
mov ecx, dword [str.____UP___DEL__]
mov dword [edx], ecx
mov ecx, dword [0x48293c]
mov dword [edx + 4], ecx
mov ecx, dword [0x482940]
mov dword [edx + 8], ecx
mov cx, word [0x482944]
mov word [edx + 0xc], cx
mov cl, byte [0x482946]
mov byte [edx + 0xe], cl
mov edx, dword [ebp - 0x2c0]
mov esi, edx
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x403045
lea edi, [ebp - 0x264]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x403055
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x264]
dec edi
mov cl, byte [edi + 1]
lea edi, [edi + 1]
test cl, cl
jne 0x403072
push 0x40
mov word [edi], ax
lea eax, [ebp - 0x2a8]
push 0
push eax
call fcn.004523e0
add esp, 0xc
mov dword [ebp - 0x2ac], 0x44
lea eax, [ebp - 0x2bc]
mov dword [ebp - 0x280], 0
xorps xmm0, xmm0
mov edi, 1
mov word [ebp - 0x27c], di
push eax
lea eax, [ebp - 0x2ac]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x264]
push eax
push 0
movdqu xmmword [ebp - 0x2bc], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, edi
jne 0x403100
push dword [ebp - 0x2b8]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x2bc]
call esi
mov ecx, dword [ebp - 8]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x403120
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b4
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x257
lea eax, [ebp - 0x25b]
mov byte [ebp - 0x25c], 0
push 0
push eax
mov edi, ecx
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x25c]
push 0x258
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x25c]
push 0x5c
push eax
call fcn.004578c0
add esp, 8
test eax, eax
je 0x403191
lea eax, [ebp - 0x25c]
push 0x5c
push eax
call fcn.004578c0
add esp, 8
mov byte [eax], 0
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x25c]
push 0x4a8890
push eax
push str.Start
push str.PATH
call esi
push 0x257
lea eax, [ebp - 0x4b3]
mov byte [ebp - 0x4b4], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x4b4]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x4b4]
push eax
call fcn.00457453
add esp, 8
push 0x4a8890
test eax, eax
jne 0x403201
push edi
jmp 0x403208
lea eax, [ebp - 0x25c]
push eax
push str.Start
push str.PATH
call esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x403970
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0x67]
mov byte [ebp - 0x68], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x4a8890
push 0x64
push eax
push 0
push str.isReleaseEnableSpecifyingReleaseDir
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x4039dd
lea eax, [ebp - 0x68]
push 0x4829dc
push eax
call fcn.00457453
add esp, 8
test eax, eax
jne 0x4039dd
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x4039f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0x67]
mov byte [ebp - 0x68], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x4a8890
push 0x64
push eax
push 0
push str.isEnableSearchKeyword
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x403a5d
lea eax, [ebp - 0x68]
push 0x4829dc
push eax
call fcn.00457453
add esp, 8
test eax, eax
jne 0x403a5d
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret

Function at 0x403a70
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x63
lea eax, [ebp - 0x67]
mov byte [ebp - 0x68], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x4a8890
push 0x64
push eax
push 0
push str.IsReleaseCurrentDir
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x403ae0
lea eax, [ebp - 0x68]
push 0x4829dc
push eax
call fcn.00457453
add esp, 8
test eax, eax
jne 0x403ae0
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
push 0x63
lea eax, [ebp - 0xcb]
mov byte [ebp - 0xcc], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0xcc]
push 0x4a8890
push 0x64
push eax
push 0
push str.isReleaseEnableSpecifyingReleaseDir
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x403b36
lea eax, [ebp - 0xcc]
push 0x4829dc
push eax
call fcn.00457453
add esp, 8
test eax, eax
je 0x403b3f
call fcn.004039f0
test eax, eax
je 0x403acd
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x4041d0
Capabilities:
Copy file
Get common file path
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58c
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x257
lea eax, [ebp - 0x32f]
mov byte [ebp - 0x330], 0
push 0
push eax
mov ebx, ecx
call fcn.004523e0
add esp, 0xc
mov byte [ebp - 0x588], 0
lea eax, [ebp - 0x587]
push 0x257
push 0
push eax
call fcn.004523e0
add esp, 0xc
mov byte [ebp - 0x70], 0
lea eax, [ebp - 0x6f]
push 0x63
push 0
push eax
call fcn.004523e0
add esp, 0xc
mov byte [ebp - 0xd8], 0
lea eax, [ebp - 0xd7]
push 0x63
push 0
push eax
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0x588]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea edi, [ebp - 0x588]
dec edi
lea ebx, [ebx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x404270
mov ax, word [0x482998]
mov edx, 0x6b07ac
mov word [edi], ax
mov esi, edx
lea ebx, [ebx]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x404290
lea edi, [ebp - 0x588]
sub edx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4042a0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea edx, [ebp - 0x588]
and ecx, 3
dec edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [ecx]
mov cl, byte [edx + 1]
lea edx, [edx + 1]
test cl, cl
jne 0x4042c0
mov ecx, dword [str..lnk]
mov esi, ebx
mov dword [edx], ecx
mov cl, byte [0x482a20]
mov byte [edx + 4], cl
lea ecx, [ecx]
mov cl, byte [ebx]
inc ebx
test cl, cl
jne 0x4042e0
lea edi, [ebp - 0x330]
sub ebx, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4042f0
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x330]
dec edi
lea ecx, [ecx]
mov cl, byte [edi + 1]
lea edi, [edi + 1]
test cl, cl
jne 0x404310
mov edx, 0x6b07ac
mov word [edi], ax
mov esi, edx
mov al, byte [edx]
inc edx
test al, al
jne 0x404324
lea edi, [ebp - 0x330]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404334
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x330]
dec ecx
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x404351
mov eax, dword [str..lnk]
lea edx, [ebp - 0x70]
mov dword [ecx], eax
mov al, byte [0x482a20]
mov byte [ecx + 4], al
lea ecx, [ebp - 0x588]
call fcn.004024a0
cmp eax, 1
jne 0x4043aa
lea edx, [ebp - 0xd8]
lea ecx, [ebp - 0x330]
call fcn.004024a0
cmp eax, 1
jne 0x4043aa
lea eax, [ebp - 0xd8]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00457453
add esp, 8
test eax, eax
je 0x4043c0
push 0
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x588]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x404800
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 8
mov ebx, edx
mov edi, ecx
call fcn.00452c03
mov esi, eax
add esp, 4
test esi, esi
je 0x40486c
lea eax, [ebp - 8]
mov dword [esi], edi
push eax
push 0
push esi
push 0x404520
push 0
push 0
mov dword [esi + 4], ebx
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x404856
push eax
call ebx
cmp dword [ebp - 8], 0
jne 0x40486c
test edi, edi
je 0x404863
push edi
call ebx
push esi
call fcn.00453dbd
add esp, 4
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x4054c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x3aa4
call fcn.00457150
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
push 0x95e
push eax
mov word [ebp - 0xbbc], ax
lea eax, [ebp - 0xbba]
push eax
mov dword [ebp - 0x3aa4], ebx
call fcn.004523e0
add esp, 0xc
lea eax, [ebp - 0xbbc]
push 0x4b0
push eax
push 0xffffffffffffffff
push ebx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [0x4a8b54]
test eax, eax
je 0x405535
lea ecx, [ebp - 0xbbc]
push ecx
push str._STS_DUILIB_SearchUpdateProcessChange
call eax
call eax
add esp, 4
mov ecx, 0xbb8
lea edi, [ebp - 0x3a9c]
mov esi, 0x4ab890
rep movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x3a9c], 0
je 0x405679
push 0x257
lea eax, [ebp - 0x25b]
mov byte [ebp - 0x25c], 0
push 0
push eax
call fcn.004523e0
add esp, 0xc
mov dword [ebp - 0x3aa0], 0
lea ebx, [ebp - 0x3a9c]
cmp byte [ebx], 0
je 0x405643
push 0x258
lea eax, [ebp - 0x25c]
push 0
push eax
call fcn.004523e0
mov eax, dword [ebp - 0x3aa4]
add esp, 0xc
mov esi, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4055a8
lea edi, [ebp - 0x25c]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4055b8
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x25c]
dec edi
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x4055d5
mov ax, word [0x482998]
mov edx, ebx
mov word [edi], ax
mov esi, edx
lea esp, [esp]
mov al, byte [edx]
inc edx
test al, al
jne 0x4055f0
lea edi, [ebp - 0x25c]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405600
mov ecx, edx
lea eax, [ebp - 0x25c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x405679
mov eax, dword [ebp - 0x3aa0]
add ebx, 0x258
inc eax
mov dword [ebp - 0x3aa0], eax
cmp eax, 0x14
jb 0x405581
mov ecx, dword [ebp - 0x3aa4]
lea edi, [ecx - 1]
lea esp, [esp]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x405650
mov ax, word [0x482998]
push 0x4a8890
push ecx
push str.Game
push str.PATH
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x405690
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x13c
lea eax, [ebp - 0x39c]
mov dword [ebp - 0x3a0], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x3a4], esi
call fcn.004523e0
push 0x257
lea eax, [ebp - 0x25f]
mov byte [ebp - 0x260], 0
push 0
push eax
call fcn.004523e0
add esp, 0x18
mov edx, esi
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x4056f0
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405700
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x260]
dec ecx
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x405720
mov eax, dword [0x482a74]
mov dword [ecx], eax
mov al, byte [0x482a78]
mov byte [ecx + 4], al
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4058bd
mov esi, dword [ebp - 0x3a4]
mov ecx, esi
call fcn.004054c0
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x4058bd
jmp 0x405780
mov ecx, 0x482a18
lea eax, [ebp - 0x374]
jmp 0x405790
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4057b0
test dl, dl
je 0x4057ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4057b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x405790
xor eax, eax
jmp 0x4057b5
sbb eax, eax
or eax, 1
test eax, eax
je 0x4058a7
mov eax, 0x482a7c
lea ecx, [ebp - 0x374]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x4057e8
test dl, dl
je 0x4057e4
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x4057e8
add ecx, 2
add eax, 2
test dl, dl
jne 0x4057c8
xor eax, eax
jmp 0x4057ed
sbb eax, eax
or eax, 1
test eax, eax
je 0x4058a7
test byte [ebp - 0x3a0], 0x10
je 0x4058a7
push 0x258
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.004523e0
add esp, 0xc
mov edx, esi
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x405820
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405830
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x260]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x405850
mov ax, word [0x482998]
lea edx, [ebp - 0x374]
mov word [edi], ax
mov esi, edx
jmp 0x405870
mov al, byte [edx]
inc edx
test al, al
jne 0x405870
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405880
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x260]
call fcn.004054c0
mov esi, dword [ebp - 0x3a4]
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405780
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret
Function at 0x4058d0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3a4
mov eax, dword [0x4a4300]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x13c
lea eax, [ebp - 0x39c]
mov dword [ebp - 0x3a0], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x3a4], esi
call fcn.004523e0
add esp, 0xc
mov byte [ebp - 0x260], 0
lea eax, [ebp - 0x25f]
push 0x257
push 0
push eax
call fcn.004523e0
add esp, 0xc
mov edx, esi
lea ecx, [ecx]
mov al, byte [edx]
inc edx
test al, al
jne 0x405930
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405940
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x260]
dec ecx
lea ecx, [ecx]
mov al, byte [ecx + 1]
lea ecx, [ecx + 1]
test al, al
jne 0x405960
mov eax, dword [0x482a74]
mov dword [ecx], eax
mov al, byte [0x482a78]
mov byte [ecx + 4], al
lea eax, [ebp - 0x3a0]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x405afd
mov esi, dword [ebp - 0x3a4]
mov ecx, esi
call fcn.004054c0
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x405afd
jmp 0x4059c0
mov ecx, 0x482a18
lea eax, [ebp - 0x374]
jmp 0x4059d0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4059f0
test dl, dl
je 0x4059ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4059f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4059d0
xor eax, eax
jmp 0x4059f5
sbb eax, eax
or eax, 1
test eax, eax
je 0x405ae7
mov eax, 0x482a7c
lea ecx, [ebp - 0x374]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x405a28
test dl, dl
je 0x405a24
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x405a28
add ecx, 2
add eax, 2
test dl, dl
jne 0x405a08
xor eax, eax
jmp 0x405a2d
sbb eax, eax
or eax, 1
test eax, eax
je 0x405ae7
test byte [ebp - 0x3a0], 0x10
je 0x405ae7
push 0x258
lea eax, [ebp - 0x260]
push 0
push eax
call fcn.004523e0
add esp, 0xc
mov edx, esi
lea ebx, [ebx]
mov al, byte [edx]
inc edx
test al, al
jne 0x405a60
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405a70
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x260]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
lea edi, [edi + 1]
test al, al
jne 0x405a90
mov ax, word [0x482998]
lea edx, [ebp - 0x374]
mov word [edi], ax
mov esi, edx
jmp 0x405ab0
mov al, byte [edx]
inc edx
test al, al
jne 0x405ab0
lea edi, [ebp - 0x260]
sub edx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405ac0
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x260]
call fcn.00405690
mov esi, dword [ebp - 0x3a4]
lea eax, [ebp - 0x3a0]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4059c0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004516e1
mov esp, ebp
pop ebp
ret