joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48fb30
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], ecx
mov edi, eax
mov dword [esp + 8], edx
xor esi, esi
xor ebp, ebp
xor eax, eax
mov edx, dword [esp]
test edx, edx
jns 0x48fb4f
add edx, 3
sar edx, 2
test edx, edx
jle 0x48fc5c
mov dword [esp + 0xc], edx
mov edx, 4
lea eax, [esp + 4]
xor ecx, ecx
mov cl, byte [edi + esi]
cmp ecx, 0x3d
jg 0x48fb85
je 0x48fbc5
sub ecx, 0x2b
je 0x48fbbb
sub ecx, 4
je 0x48fbc0
dec ecx
sub ecx, 0xa
jb 0x48fbae
jmp 0x48fbc8
add ecx, 0xffffffbf
sub ecx, 0x1a
jb 0x48fb97
add ecx, 0xfffffffa
sub ecx, 0x1a
jb 0x48fba1
jmp 0x48fbc8
mov cl, byte [edi + esi]
sub cl, 0x41
mov byte [eax], cl
jmp 0x48fbc8
mov cl, byte [edi + esi]
sub cl, 0x61
add cl, 0x1a
mov byte [eax], cl
jmp 0x48fbc8
mov cl, byte [edi + esi]
sub cl, 0x30
add cl, 0x34
mov byte [eax], cl
jmp 0x48fbc8
mov byte [eax], 0x3e
jmp 0x48fbc8
mov byte [eax], 0x3f
jmp 0x48fbc8
mov byte [eax], 0xff
inc esi
inc eax
dec edx
jne 0x48fb67
mov al, byte [esp + 4]
shl eax, 2
xor edx, edx
mov dl, byte [esp + 5]
shr edx, 4
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp], al
lea eax, [ebp + 1]
mov dl, byte [esp + 6]
cmp dl, 0xff
je 0x48fc19
cmp byte [esp + 7], 0xff
jne 0x48fc19
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
lea eax, [ebp + 2]
inc ebp
jmp 0x48fc51
cmp dl, 0xff
je 0x48fc51
mov al, byte [esp + 5]
shl eax, 4
and edx, 0xff
shr edx, 2
or al, dl
mov edx, dword [esp + 8]
mov byte [edx + ebp + 1], al
mov eax, dword [esp + 8]
mov dl, byte [esp + 6]
shl edx, 6
or dl, byte [esp + 7]
mov byte [eax + ebp + 2], dl
lea eax, [ebp + 3]
add ebp, 2
inc ebp
dec dword [esp + 0xc]
jne 0x48fb5e
add esp, 0x10
pop ebp
pop edi
pop esi
ret
Function at 0x491de0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x491e0a
mov ecx, 0x491e68
mov dl, 1
mov eax, dword [0x491448]
call fcn.0040e4fc
call fcn.0040414c
mov dword [ebp - 8], edx
mov esi, dword [ebp - 4]
mov eax, dword [ebp + 8]
test eax, eax
jle 0x491e57
mov dword [ebp - 0xc], eax
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebp - 8]
mov al, byte [eax]
mov edx, dword [ebx + 0x40]
xor al, byte [edx]
mov byte [esi], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.004029f8
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
mov dl, byte [esi]
mov byte [eax], dl
inc dword [ebp - 8]
inc esi
dec dword [ebp - 0xc]
jne 0x491e1a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x491e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp byte [ebx + 0x30], 0
jne 0x491eaa
mov ecx, 0x491f10
mov dl, 1
mov eax, dword [0x491448]
call fcn.0040e4fc
call fcn.0040414c
mov esi, edx
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
test eax, eax
jle 0x491eff
mov dword [ebp - 0x10], eax
mov al, byte [esi]
mov byte [ebp - 9], al
mov ecx, dword [ebx + 0x40]
mov edx, dword [ebx + 0x3c]
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0x60]
mov eax, dword [ebx + 0x40]
mov al, byte [eax]
xor al, byte [esi]
mov edx, dword [ebp - 8]
mov byte [edx], al
mov ecx, dword [ebx + 0x44]
dec ecx
mov edx, dword [ebx + 0x3c]
mov eax, dword [ebx + 0x3c]
inc eax
call fcn.004029f8
mov eax, dword [ebx + 0x3c]
add eax, dword [ebx + 0x44]
dec eax
mov dl, byte [ebp - 9]
mov byte [eax], dl
inc esi
inc dword [ebp - 8]
dec dword [ebp - 0x10]
jne 0x491ebc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x492560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4925e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x49176c]
mov eax, 0x14
call fcn.004056b8
mov edi, eax
mov dword [edi + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004090b0
mov edx, dword [ebp - 4]
lea eax, [edi + 4]
call fcn.004047e8
mov eax, esi
call dword [eax + 0x30]
mov dword [edi + 8], eax
mov eax, dword [0x576c20]
mov dword [edi], eax
mov byte [edi + 0x10], bl
mov dword [0x576c20], edi
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4925e9
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047b8
ret
Function at 0x4925f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x49266c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [0x491794]
mov eax, 0x10
call fcn.004056b8
mov ebx, eax
mov dword [ebx + 0xc], esi
lea edx, [ebp - 8]
mov eax, esi
call dword [eax + 0x34]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.004090b0
mov edx, dword [ebp - 4]
lea eax, [ebx + 4]
call fcn.004047e8
mov eax, esi
call dword [eax + 0x30]
mov dword [ebx + 8], eax
mov eax, dword [0x576c24]
mov dword [ebx], eax
mov dword [0x576c24], ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x492673
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047b8
ret

Function at 0x4926c8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
test esi, esi
jle 0x4926e8
mov ecx, 1
mov ebx, edx
add ebx, ecx
dec ebx
mov bl, byte [ebx]
mov edi, eax
add edi, ecx
dec edi
xor byte [edi], bl
inc ecx
dec esi
jne 0x4926d6
pop edi
pop esi
pop ebx
ret

Function at 0x49674c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042ca34
cmp ebx, dword [ebp - 8]
jge 0x4967af
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042cf60
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042cf60
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, esi
mov edx, ebx
call fcn.0042cfa0
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x496775
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x4967b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov ebx, dword [ebp - 4]
inc ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042ca34
cmp ebx, dword [ebp - 8]
jge 0x49681b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042cf60
mov edi, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042cf60
xor edi, eax
push edi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov ecx, ebx
mov edx, esi
call fcn.0042cfa0
add ebx, 2
cmp ebx, dword [ebp - 8]
jl 0x4967e1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x49ad60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x49ae0c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 1
call fcn.00404de0
push 0
mov eax, dword [ebp - 8]
call fcn.00404c54
push eax
mov eax, esi
call fcn.00404c54
mov edi, eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov ebx, eax
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404de0
push ebx
mov eax, dword [ebp - 8]
call fcn.00404c54
push eax
push edi
call sub.kernel32.dll_ExpandEnvironmentStringsA
test eax, eax
jle 0x49adec
mov eax, dword [ebp - 8]
call fcn.00404c54
call fcn.0040a574
mov edx, eax
lea eax, [ebp - 8]
call fcn.00404de0
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004047e8
jmp 0x49adf6
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.004047e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49ae13
lea eax, [ebp - 8]
call fcn.00404794
ret

Function at 0x49e194
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [0x574dd4]
mov eax, dword [eax]
call fcn.0048d7e8
cmp byte [ebx + 0x290], 0
je 0x49e1c8
cmp byte [ebx + 0x298], 0
je 0x49e1c8
push 0
mov eax, dword [0x574dd4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
mov eax, ebx
mov si, 0xffe7
call fcn.00403b7c
pop esi
pop ebx
ret
Function at 0x4c90e8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
mov byte [ebp - 1], 0
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4c919f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, esi
call fcn.00404c54
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x4c912a
call fcn.004041f8
jmp 0x4c91a6
mov eax, ebx
call fcn.00402784
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
push ebx
push 0
mov eax, esi
call fcn.00404c54
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x4c9153
call fcn.004041f8
jmp 0x4c91a6
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x4c91b0
mov eax, dword [ebp - 8]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x4c9174
call fcn.004041f8
jmp 0x4c91a6
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [edi + 4], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov dword [edi], eax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c91a6
mov eax, dword [ebp - 8]
call fcn.004027a4
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c9414
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4c9485
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x168]
xor ecx, ecx
mov edx, 0x160
call fcn.004031ec
cmp dword [ebp - 4], 0
jne 0x4c9457
mov word [ebp - 6], 0
lea eax, [ebp - 6]
mov dword [ebp - 4], eax
or ebx, 0x4008
push ebx
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x164]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c9491
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c949c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4c94fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x160]
xor ecx, ecx
mov edx, 0x160
call fcn.004031ec
or esi, 0x4000
push esi
push 0x160
lea eax, [ebp - 0x160]
push eax
push 0
mov eax, ebx
call fcn.00404c54
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x15c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4c950a
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c984c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
push 0x4c99f8
call sub.kernel32.dll_LoadLibraryA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4c99f0
xor eax, eax
push ebp
push 0x4c99e9
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 6], 0
push 0x4001
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x4c9a04
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
test esi, esi
jne 0x4c98c4
push 0x4009
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, eax
push 0x4000
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
push 0x4c9a04
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
test edi, edi
jne 0x4c9905
push 0x4008
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
lea eax, [ebp - 6]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov edi, eax
push 0x8000
push 0x10
push 0x10
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, esi
call fcn.00434d10
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1d
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 1
mov edx, ebx
mov eax, edi
call fcn.00434d10
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x10
push 0x10
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, esi
call fcn.00434d10
push eax
push esi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
push 0x8000
push 0x20
push 0x20
push 1
push 0x1e
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_LoadImageA
mov ebx, eax
push 2
mov edx, ebx
mov eax, edi
call fcn.00434d10
push eax
push edi
call sub.comctl32.dll_ImageList_SetOverlayImage
push ebx
call sub.user32.dll_DestroyIcon
mov byte [0x56f7ac], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c99f0
cmp dword [ebp - 4], 0
je 0x4c99e8
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FreeLibrary_1
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c9a08
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffe9c
mov ebx, eax
call fcn.004c90dc
test al, al
je 0x4c9a35
cmp dword [0x576ce4], 0x40047
jl 0x4c9a35
cmp byte [0x56f7ac], 0
jne 0x4c9a35
call fcn.004c984c
mov esi, ebx
and esi, 0x7f
mov eax, dword [esi*4 + 0x56f7b0]
or eax, 0x4000
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
push 0x4c9a98
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
jne 0x4c9a8d
mov word [esp], 0
mov eax, dword [esi*4 + 0x56f7b0]
or eax, 0x4000
or eax, 8
push eax
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
add esp, 0x164
pop esi
pop ebx
ret
Function at 0x4e80ec
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e8161
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00404de0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404c54
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404a54
push eax
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404de0
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004e7d8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e8168
lea eax, [ebp - 0xc]
call fcn.00404794
ret

Function at 0x4e816c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e8217
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x105
call fcn.00404de0
cmp dword [ebp - 4], 0
jbe 0x4e81cb
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404c54
push eax
push 0
push 0x4e8224
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004e7d8c
mov eax, dword [ebp - 0xc]
call fcn.00404c54
push eax
call sub.kernel32.dll_GetTempFileNameA
jmp 0x4e81ed
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404c54
push eax
push 0
push 0x4e8224
mov eax, dword [0x576fb0]
call fcn.00404c54
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404c54
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0040498c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e821e
lea eax, [ebp - 0xc]
call fcn.00404794
ret
Function at 0x4fa918
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fa989
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.004fa8f4
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.004e748c
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
call fcn.004e6fdc
mov eax, dword [ebp - 8]
mov edx, dword [eax + 8]
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x10]
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fa990
lea eax, [ebp - 0x14]
call fcn.00404794
ret

Function at 0x505734
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x50573c
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x505889
push dword fs:[eax]
mov dword fs:[eax], esp
test dl, dl
je 0x505792
lea edx, [ebp - 4]
mov eax, dword [0x57488c]
call fcn.00406808
cmp ebx, 1
jbe 0x5057c9
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5058a0
call fcn.0040ad74
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.00404a5c
jmp 0x5057c9
lea eax, [ebp - 4]
mov edx, 0x5058b0
call fcn.0040482c
cmp ebx, 1
jbe 0x5057c9
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 0
lea edx, [ebp - 0x10]
xor ecx, ecx
mov eax, 0x5058c0
call fcn.0040ad74
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 4]
call fcn.00404a5c
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
lea eax, [ebp - 0x18]
mov ecx, dword [ebp - 4]
call fcn.00404aa0
mov eax, dword [ebp - 0x18]
call fcn.00404c54
push eax
call sub.kernel32.dll_CreateDirectoryA
test eax, eax
jne 0x505851
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
cmp ebx, 0xb7
jne 0x505801
mov bl, 1
jmp 0x505861
push 0
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.0040db78
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [0x574ee4]
call fcn.00406808
mov eax, dword [ebp - 0x24]
mov ecx, 1
pop edx
call fcn.004ca8c8
mov eax, dword [ebp - 0x1c]
mov cx, word [0x5058c4]
xor edx, edx
call fcn.00439c14
mov bl, 2
jmp 0x505861
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
mov edx, dword [ebp - 4]
call fcn.004047e8
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x505890
lea eax, [ebp - 0x24]
mov edx, 5
call fcn.004047b8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004047b8
ret
Function at 0x505f00
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffea0
mov ebx, ecx
mov esi, eax
test edx, 0x40000000
jne 0x505f22
mov edx, ebx
mov eax, dword [0x574ee0]
call fcn.00406808
jmp 0x505f59
push 0x408
push 0x160
lea eax, [esp + 8]
push eax
push 0
push esi
call sub.shell32.dll_SHGetFileInfoA
test eax, eax
je 0x505f52
mov eax, ebx
lea edx, [esp + 0x110]
mov ecx, 0x50
call fcn.00404a04
jmp 0x505f59
mov eax, ebx
call fcn.00404794
add esp, 0x160
pop esi
pop ebx
ret

Function at 0x506980
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x158], ebx
mov ebx, ecx
test ebx, ebx
js 0x5069b3
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x5069ac
mov edx, esp
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404c44
mov ecx, dword [ebp - 0xc]
inc ecx
mov eax, dword [ebp - 8]
mov edx, dword [0x4010cc]
call fcn.004053d0
xor eax, eax
push ebp
push 0x506b41
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
test eax, eax
jl 0x506b09
inc eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x154]
push eax
push dword [ebp - 4]
push 0x506b68
push dword [esi]
lea eax, [ebp - 0x158]
mov edx, 3
call fcn.00404b14
mov eax, dword [ebp - 0x158]
call fcn.00404c54
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x506afd
mov eax, dword [ebp - 0x154]
test al, 0x10
jne 0x506ae2
test al, 2
jne 0x506ae2
xor eax, eax
mov dword [ebp - 0x10], eax
push dword [ebp - 4]
push 0x506b68
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00404a04
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.00404b14
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 0x10]
call fcn.004c926c
call fcn.00419510
test al, al
je 0x506aa0
or edi, 0xffffffff
jmp 0x506aaf
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.004c9414
mov edi, eax
mov eax, dword [ebp - 0x10]
call fcn.004c91d0
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x128]
mov ecx, 0x104
call fcn.00404a04
mov edx, dword [ebp - 0x164]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax]
mov ecx, edi
mov edi, dword [eax]
call dword [edi + 0x3c]
lea eax, [ebp - 0x154]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x506a35
push ebx
call sub.kernel32.dll_FindClose_1
add esi, 4
dec dword [ebp - 0x14]
jne 0x5069f8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x506b48
lea eax, [ebp - 0x164]
mov edx, 4
call fcn.004047b8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
inc ecx
mov edx, dword [0x4010cc]
call fcn.00405290
lea eax, [ebp - 4]
call fcn.00404794
ret