joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63ec88
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
jne 0x63ecd0
cmp dword [0x997d74], 3
jle 0x63ecd0
cmp dword [0x997d70], 0
jne 0x63ecb7
cmp dword [0x997d6c], 0
jbe 0x63ecd0
jmp 0x63ecb9
jle 0x63ecd0
mov eax, dword [0x997d6c]
mov dword [ebp - 0x10], eax
mov eax, dword [0x997d70]
mov dword [ebp - 0xc], eax
jmp 0x63ee05
xor eax, eax
push ebp
push 0x63edfe
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x63ee14
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x63ed4d
push 0x63ee24
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov edi, eax
mov esi, edi
test edi, edi
je 0x63ed4d
lea eax, [ebp - 0x70]
xor ecx, ecx
mov edx, 0x40
call fcn.0040357c
mov dword [ebp - 0x70], 0x40
lea eax, [ebp - 0x70]
push eax
call esi
cmp byte [ebp - 1], 0
je 0x63ed31
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0xc], eax
jmp 0x63ed3d
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0xc], eax
push ebx
call sub.kernel32.dll_FreeLibrary_1
call fcn.004046a4
jmp 0x63ee05
mov dword [ebp - 0x30], 0x20
lea eax, [ebp - 0x30]
push eax
call sub.kernel32.dll_GlobalMemoryStatus
cmp byte [ebp - 1], 0
je 0x63ed70
mov eax, dword [ebp - 0x24]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
jmp 0x63ed7b
mov eax, dword [ebp - 0x28]
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x63ee05
cmp byte [ebp - 1], 0
jne 0x63edfd
cmp dword [ebp - 0xc], 0
jne 0x63ed9c
cmp dword [ebp - 0x10], 0
jbe 0x63edfd
jmp 0x63ed9e
jle 0x63edfd
cmp dword [ebp - 0xc], 0
jne 0x63edaf
cmp dword [ebp - 0x10], 0xee6b2800
jbe 0x63edbf
jmp 0x63edb1
jle 0x63edbf
mov dword [ebp - 0x10], 0xee6b2800
mov dword [ebp - 0xc], 0
cmp dword [0x997d74], 0
jle 0x63ede5
mov eax, dword [0x997d6c]
mov edx, dword [0x997d70]
cmp edx, dword [ebp - 0xc]
jne 0x63eddc
cmp eax, dword [ebp - 0x10]
je 0x63ede5
xor eax, eax
mov dword [0x997d74], eax
mov eax, dword [ebp - 0x10]
mov dword [0x997d6c], eax
mov eax, dword [ebp - 0xc]
mov dword [0x997d70], eax
inc dword [0x997d74]
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x642430
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6424af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x989ef8]
cmp dword [eax], 0
jne 0x64247a
lea eax, [ebp - 0x109]
push eax
push 0xfa
call sub.kernel32.dll_GetTempPathA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040c500
jmp 0x64248a
lea eax, [ebp - 4]
mov edx, dword [0x989ef8]
mov edx, dword [edx]
call fcn.00404d14
mov ecx, ebx
mov edx, dword [ebp - 4]
mov eax, 0x6424c4
call fcn.00642398
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6424b6
lea eax, [ebp - 4]
call fcn.00404c7c
ret
Function at 0x642efc
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, 0xa
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x642f11
mov al, 1
pop ebx
ret
push 0x32
call sub.kernel32.dll_Sleep_1
dec ebx
jne 0x642f02
xor eax, eax
pop ebx
ret

Function at 0x645364
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov ebx, eax
cmp dword [ebx + 0x48], 0
je 0x645375
mov eax, ebx
call fcn.00645490
mov eax, dword [ebx + 0x30]
xor edx, edx
call fcn.00405738
je 0x645440
test byte [ebx + 0x1c], 0x10
jne 0x645440
push 0
push 0
push 0
call fcn.00407940
mov esi, eax
mov dword [ebx + 0x40], esi
test esi, esi
jne 0x6453b9
mov ecx, 0x64544c
mov dl, 1
mov eax, dword [0x40a188]
call fcn.004102e8
call fcn.004045f8
push 0xffffffffffffffff
mov eax, dword [ebx + 0x40]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, 0x21c
call fcn.00402ab4
mov esi, eax
mov dword [ebx + 0x3c], esi
mov eax, dword [ebx + 0x38]
mov dword [esi], eax
mov eax, dword [ebx + 0x40]
mov dword [esi + 4], eax
mov eax, dword [ebx + 0x34]
mov dword [esi + 0x214], eax
mov al, byte [ebx + 0x44]
mov byte [esi + 0x218], al
mov eax, dword [ebx + 0x30]
call fcn.00405610
mov edx, eax
lea eax, [esi + 8]
call fcn.0047e690
lea eax, [ebx + 0x4c]
push eax
push 0
mov eax, dword [ebx + 0x3c]
push eax
push 0x6452a4
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov esi, eax
mov dword [ebx + 0x48], esi
test esi, esi
jne 0x645439
mov ecx, 0x645470
mov dl, 1
mov eax, dword [0x40a188]
call fcn.004102e8
call fcn.004045f8
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x34]
pop esi
pop ebx
ret

Function at 0x646998
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x14], 0x97fffc
xor edx, edx
push ebp
push 0x646a18
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x646a0e
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
mov eax, dword [0x9981f8]
push eax
mov eax, dword [eax]
call dword [eax + 0x1c]
test eax, eax
jne 0x6469ff
mov al, byte [ebp - 0xd]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x646a2f
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [0x9981f4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x646a22
inc byte [ebp - 0xd]
add dword [ebp - 0x14], 4
cmp byte [ebp - 0xd], 0x25
jne 0x6469b3
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x6472e8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x6473af
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push dword [ebx + 0x8c]
push dword [ebx + 0x88]
push 0
lea eax, [ebp - 4]
mov ecx, 0x6473c8
mov edx, dword [ebx + 8]
call fcn.00404f90
mov eax, dword [ebp - 4]
push eax
xor ecx, ecx
mov dx, word [ebx + 0x60]
mov eax, dword [ebx + 0x30]
call fcn.0046e368
mov esi, eax
mov dl, byte [ebx + 0x48]
mov eax, esi
call fcn.0046b7dc
mov dl, byte [ebx + 0x38]
mov eax, esi
call fcn.0046b85c
mov dl, byte [ebx + 0x3a]
mov eax, esi
call fcn.0046baa4
mov dl, byte [ebx + 0x39]
mov eax, esi
call fcn.0046b8b0
mov dl, byte [ebx + 0x3f]
mov eax, esi
call fcn.0046b928
mov eax, dword [ebx + 0x54]
mov dword [esi + 0x54], eax
mov dl, byte [ebx + 0x3d]
mov eax, esi
call fcn.0046bf50
mov eax, dword [ebx + 0xc]
mov dword [esi + 0xc], eax
mov dl, byte [ebx + 0x3e]
mov eax, esi
call fcn.0046b9cc
mov edx, dword [ebx + 8]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edx, dword [ebx + 0x40]
mov eax, esi
call fcn.0046b9dc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6473b6
lea eax, [ebp - 4]
call fcn.00404c7c
ret
Function at 0x648100
Capabilities:
Get common file path
Get file system object information

Disassembly:
add esp, 0xfffffb40
cmp dword [0x980090], 0xffffffff
jne 0x648148
lea eax, [esp + 0x2b4]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathW
push 0x4001
push 0x2b4
lea eax, [esp + 8]
push eax
push 0
lea eax, [esp + 0x2c4]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, dword [esp + 4]
mov dword [0x980090], eax
mov eax, dword [0x980090]
add esp, 0x4c0
ret

Function at 0x648268
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 4]
call fcn.004059c8
xor eax, eax
push ebp
push 0x64839c
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebx + 0x30]
mov eax, dword [ebp - 4]
call fcn.0040b23c
test al, al
je 0x6482ad
mov eax, dword [ebp - 4]
call fcn.00405620
test eax, eax
jg 0x64836e
lea eax, [ebp - 0xc]
mov edx, dword [ebx + 0x30]
call fcn.00405410
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 4]
call fcn.004053ec
mov eax, dword [ebx + 0x30]
call fcn.00405620
test eax, eax
jne 0x6482e4
lea eax, [ebp - 8]
push eax
push 0x11
mov eax, ebx
call fcn.00646e54
push eax
call sub.shell32.dll_SHGetSpecialFolderLocation
jmp 0x6482f1
mov edx, dword [ebx + 0x30]
xor eax, eax
call fcn.00646900
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x648331
lea eax, [ebx + 0x30]
mov edx, dword [ebp - 0xc]
call fcn.004053ec
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov edx, 0x6483ac
call fcn.0040568c
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
call fcn.00404f0c
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x646400]
call fcn.004102e8
call fcn.004045f8
mov eax, dword [ebx + 0x30]
call fcn.00405620
test eax, eax
jle 0x648355
mov edx, dword [ebx + 0x30]
cmp word [edx + eax*2 - 2], 0x5c
je 0x648355
lea eax, [ebx + 0x30]
mov edx, 0x6483dc
call fcn.0040562c
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.006483e0
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x9981f4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6483a3
lea eax, [ebp - 0x14]
call fcn.004053b0
lea eax, [ebp - 0x10]
call fcn.00404c7c
lea eax, [ebp - 0xc]
call fcn.004053b0
lea eax, [ebp - 4]
call fcn.004053b0
ret

Function at 0x6489ec
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
push 0x4009
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, ebx
call fcn.006481b4
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop ebx
ret

Function at 0x648a20
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffea0
mov ebx, eax
push 0x400b
push 0x160
lea eax, [esp + 8]
push eax
push 0
mov eax, ebx
call fcn.006481b4
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop ebx
ret
Function at 0x648c5c
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffe9c
mov word [esp], 0
push 0x4009
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 8]
add esp, 0x164
ret

Function at 0x648cc0
Capabilities:
Get file system object information

Disassembly:
push ebx
add esp, 0xfffffd48
mov ebx, edx
mov word [esp], 0
push 0x208
push 0x2b4
lea eax, [esp + 0xc]
push eax
push 0
lea eax, [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoW
mov eax, ebx
lea edx, [esp + 0x10]
mov ecx, 0x104
call fcn.00405578
add esp, 0x2b8
pop ebx
ret
Function at 0x6498e0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040512c
xor eax, eax
push ebp
push 0x6499c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00404f44
test eax, eax
jle 0x649942
mov eax, dword [ebp - 4]
cmp byte [eax], 0x2e
jne 0x649930
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6499d8
call fcn.00404f90
jmp 0x64994f
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6499e8
call fcn.00404f90
jmp 0x64994f
lea eax, [ebp - 8]
mov edx, 0x6499fc
call fcn.00404d14
cmp byte [ebx + 0x68], 1
jne 0x64997b
push 0x4010
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0x80
mov eax, dword [ebp - 8]
call fcn.0040513c
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x64999f
push 0x4011
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0x80
mov eax, dword [ebp - 8]
call fcn.0040513c
push eax
call sub.shell32.dll_SHGetFileInfoA
mov ebx, dword [ebp - 0x164]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6499c7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ca0
ret

Function at 0x649a04
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd48
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 4]
call fcn.004059c8
xor eax, eax
push ebp
push 0x649a8f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x68], 1
jne 0x649a52
push 0x4000
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405610
push eax
call sub.shell32.dll_SHGetFileInfoW
jmp 0x649a73
push 0x4001
push 0x2b4
lea eax, [ebp - 0x2b8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00405610
push eax
call sub.shell32.dll_SHGetFileInfoW
mov ebx, dword [ebp - 0x2b4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x649a96
lea eax, [ebp - 4]
call fcn.004053b0
ret

Function at 0x649aa0
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffe9c
mov ebx, edx
mov edi, eax
or esi, 0xffffffff
push esp
xor eax, eax
mov al, bl
mov eax, dword [eax*4 + 0x97fff8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x649b0a
cmp byte [edi + 0x68], 1
jne 0x649aeb
push 0x4008
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
jmp 0x649b06
push 0x4009
push 0x160
lea eax, [esp + 0xc]
push eax
push 0
mov eax, dword [esp + 0x10]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov esi, dword [esp + 8]
mov eax, esi
add esp, 0x164
pop edi
pop esi
pop ebx
ret
Function at 0x649b5c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
mov ebx, eax
cmp byte [ebx + 0x68], 0
jne 0x649b96
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x649c2c
call sub.shell32.dll_SHGetFileInfoA
mov edx, eax
mov eax, ebx
call fcn.004661d8
jmp 0x649bbc
push 0x4000
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x649c2c
call sub.shell32.dll_SHGetFileInfoA
mov edx, eax
mov eax, ebx
call fcn.004661d8
mov eax, ebx
call fcn.00649c30
test al, al
jne 0x649c25
mov ecx, ebx
mov dl, 1
mov eax, dword [0x455340]
call fcn.00465e7c
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x649c1e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov byte [eax + 0x42], 1
mov eax, ebx
call fcn.00466214
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.004661d8
mov edx, dword [ebp - 4]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x649c25
mov eax, dword [ebp - 4]
call fcn.00403e2c
ret
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x64a73c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe90
push ebx
xor ebx, ebx
mov dword [ebp - 0x170], ebx
mov dword [ebp - 0x16c], ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040512c
lea ebx, [ebp - 0x158]
xor eax, eax
push ebp
push 0x64a99e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x15c]
push eax
mov eax, dword [ebp - 8]
call fcn.00404f44
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 8]
call fcn.0040519c
mov eax, dword [ebp - 0x15c]
mov edx, 0x64a9b4
call fcn.00405088
jne 0x64a7e0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 8]
call fcn.00404f44
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040519c
mov eax, dword [ebp + 8]
call fcn.00404c7c
mov byte [ebp - 0x15], 1
push ebx
lea eax, [ebp - 0x160]
mov ecx, 0x64a9c0
mov edx, dword [ebp - 8]
call fcn.00404f90
mov eax, dword [ebp - 0x160]
call fcn.0040513c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x64a960
xor eax, eax
push ebp
push 0x64a916
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x164]
lea edx, [ebx + 0x2c]
mov ecx, 0x104
call fcn.00404ef4
mov eax, dword [ebp - 0x164]
mov edx, 0x64a9cc
call fcn.00405088
je 0x64a8ed
lea eax, [ebp - 0x168]
lea edx, [ebx + 0x2c]
mov ecx, 0x104
call fcn.00404ef4
mov eax, dword [ebp - 0x168]
mov edx, 0x64a9d8
call fcn.00405088
je 0x64a8ed
push dword [ebp - 8]
push 0x64a9b4
lea eax, [ebp - 0x16c]
lea edx, [ebx + 0x2c]
mov ecx, 0x104
call fcn.00404ef4
push dword [ebp - 0x16c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00405004
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
call fcn.0040aec4
test eax, eax
je 0x64a8ed
cmp byte [ebp - 0x15], 0
je 0x64a8cc
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0064a9dc
test al, al
jne 0x64a8d0
xor eax, eax
jmp 0x64a8d2
mov al, 1
mov byte [ebp - 0x15], al
cmp byte [ebp - 0x15], 0
jne 0x64a8ed
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404cd0
call fcn.004046a4
jmp 0x64a960
push ebx
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x64a82c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a91d
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64a9a5
lea eax, [ebp - 0x170]
mov edx, 4
call fcn.00404ca0
lea eax, [ebp - 0x160]
mov edx, 2
call fcn.00404ca0
lea eax, [ebp - 0x14]
call fcn.00404c7c
lea eax, [ebp - 8]
call fcn.00404c7c
ret
Function at 0x64b2d0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x168], ebx
mov dword [ebp - 0x160], ebx
mov dword [ebp - 0x164], ebx
mov dword [ebp - 0x15c], ebx
mov dword [ebp - 0x158], ebx
mov dword [ebp - 0x154], ebx
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x14c], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.0040512c
xor eax, eax
push ebp
push 0x64b547
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f44
mov edx, eax
mov ecx, 1
mov eax, dword [ebp - 4]
call fcn.0040519c
mov eax, dword [ebp - 0x14c]
mov edx, 0x64b560
call fcn.00405088
jne 0x64b37a
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 4]
call fcn.00404f44
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.0040519c
mov eax, dword [ebp - 4]
mov edx, edi
call fcn.00405088
je 0x64b50c
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x64b56c
mov edx, dword [ebp - 4]
call fcn.00404f90
mov eax, dword [ebp - 0x150]
call fcn.0040513c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x64b50c
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404ef4
mov eax, dword [ebp - 0x154]
mov edx, 0x64b578
call fcn.00405088
je 0x64b49f
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404ef4
mov eax, dword [ebp - 0x158]
mov edx, 0x64b584
call fcn.00405088
je 0x64b49f
push dword [ebp - 4]
push 0x64b560
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00404ef4
push dword [ebp - 0x15c]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405004
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 8]
call fcn.0040adfc
mov eax, dword [ebp - 0x160]
push eax
lea edx, [ebp - 0x164]
mov eax, edi
call fcn.0040adfc
mov edx, dword [ebp - 0x164]
pop eax
call fcn.00405088
je 0x64b49f
mov eax, dword [ebp - 0x148]
and eax, 0x10
cmp eax, 0x10
jne 0x64b494
lea eax, [ebp - 8]
mov edx, 0x64b56c
call fcn.00404f4c
mov edx, dword [ebp - 8]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x64b3c0
push ebx
call sub.kernel32.dll_FindClose_1
lea eax, [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00404d14
lea edx, [ebp - 8]
mov eax, esi
call fcn.0064b078
mov edx, dword [ebp - 8]
mov eax, dword [esi + 4]
mov ecx, dword [eax]
call dword [ecx + 0x54]
inc eax
jle 0x64b4ea
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 8]
call fcn.00404cd0
jmp 0x64b50c
mov eax, dword [ebp + 8]
push eax
lea edx, [ebp - 0x168]
mov eax, dword [ebp - 4]
call fcn.0040bee0
mov edx, dword [ebp - 0x168]
mov ecx, dword [ebp - 4]
mov eax, esi
call fcn.0064b2d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64b54e
lea eax, [ebp - 0x168]
mov edx, 6
call fcn.00404ca0
lea eax, [ebp - 0x150]
mov edx, 2
call fcn.00404ca0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404ca0
ret
Function at 0x64b9c0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14c], ecx
mov dword [ebp - 0x150], ecx
mov dword [ebp - 0x148], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 0x144]
xor eax, eax
push ebp
push 0x64baf8
push dword fs:[eax]
mov dword fs:[eax], esp
push edi
lea eax, [ebp - 0x148]
mov ecx, 0x64bb10
mov edx, esi
call fcn.00404f90
mov eax, dword [ebp - 0x148]
call fcn.0040513c
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x64bacf
xor eax, eax
push ebp
push 0x64bac8
push dword fs:[eax]
mov dword fs:[eax], esp
test dword [edi], 0x10
jbe 0x64ba8e
cmp byte [edi + 0x2c], 0x2e
jne 0x64ba50
mov al, byte [edi + 0x2d]
test al, al
je 0x64baa3
sub al, 0x2e
je 0x64baa3
push esi
lea eax, [ebp - 0x150]
lea edx, [edi + 0x2c]
mov ecx, 0x104
call fcn.00404ef4
push dword [ebp - 0x150]
push 0x64bb1c
lea eax, [ebp - 0x14c]
mov edx, 3
call fcn.00405004
mov edx, dword [ebp - 0x14c]
mov eax, ebx
call fcn.0064b9c0
jmp 0x64baa3
mov eax, dword [edi + 0x1c]
mov edx, eax
neg eax
add eax, dword [edi + 0x20]
xor edx, edx
add dword [ebx + 0x40], eax
adc dword [ebx + 0x44], edx
inc dword [ebx + 0x48]
push edi
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x64ba37
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64bacf
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x64baff
lea eax, [ebp - 0x150]
call fcn.00404c7c
lea eax, [ebp - 0x14c]
mov edx, 2
call fcn.00404ca0
ret

Function at 0x6580b4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x658112
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edx + 0xc]
mov edx, dword [eax + 4]
mov eax, dword [ebx + 0x3dc]
call fcn.00648154
lea edx, [ebp - 4]
mov esi, dword [ebx + 0x3dc]
mov eax, esi
call fcn.0064885c
mov ecx, dword [ebp - 4]
mov edx, dword [esi + 0x30]
mov eax, edi
call fcn.0040568c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x658119
lea eax, [ebp - 4]
call fcn.004053b0
ret