joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421460
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x46c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x46c], 0
push 0x46b014
mov eax, dword [ebp + 8]
push eax
call fcn.00448c8e
add esp, 8
mov dword [ebp - 8], eax
push 0x46b018
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00448c8e
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 8], 0
je 0x4215b9
cmp dword [ebp - 4], 0
je 0x4215b9
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call fcn.00448b56
add esp, 0xc
mov eax, dword [ebp - 8]
push eax
call fcn.00449b47
add esp, 4
test eax, eax
jne 0x4215b9
mov ecx, dword [ebp - 8]
push ecx
push 0x3e8
push 1
lea edx, [ebp - 0x468]
push edx
call fcn.00448aaf
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push eax
call fcn.00449b6f
add esp, 4
test eax, eax
je 0x421543
cmp dword [ebp - 8], 0
je 0x42152a
mov ecx, dword [ebp - 8]
push ecx
call fcn.004484c1
add esp, 4
cmp dword [ebp - 4], 0
je 0x42153c
mov edx, dword [ebp - 4]
push edx
call fcn.004484c1
add esp, 4
xor eax, eax
jmp 0x4215e0
cmp dword [ebp - 0xc], 0
je 0x4215b4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
push 1
lea edx, [ebp - 0x468]
push edx
call fcn.004463bd
add esp, 0x10
mov dword [ebp - 0x46c], eax
mov eax, dword [ebp - 0x46c]
cmp eax, dword [ebp - 0xc]
jne 0x421583
mov ecx, dword [ebp - 4]
push ecx
call fcn.00449b6f
add esp, 4
test eax, eax
je 0x4215ab
cmp dword [ebp - 8], 0
je 0x421595
mov edx, dword [ebp - 8]
push edx
call fcn.004484c1
add esp, 4
cmp dword [ebp - 4], 0
je 0x4215a7
mov eax, dword [ebp - 4]
push eax
call fcn.004484c1
add esp, 4
xor eax, eax
jmp 0x4215e0
mov ecx, dword [ebp - 0x10]
add ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
jmp 0x4214d7
cmp dword [ebp - 8], 0
je 0x4215cb
mov edx, dword [ebp - 8]
push edx
call fcn.004484c1
add esp, 4
cmp dword [ebp - 4], 0
je 0x4215dd
mov eax, dword [ebp - 4]
push eax
call fcn.004484c1
add esp, 4
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret

Function at 0x421760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e4
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xd4], 1
push 0xc8
lea eax, [ebp - 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x46b01c
lea ecx, [ebp - 0x1a0]
push ecx
push 0x46b028
lea edx, [ebp - 0xd0]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x2e0]
push eax
lea ecx, [ebp - 0xd0]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x2e4], eax
cmp dword [ebp - 0x2e4], 0xffffffff
je 0x4217ef
mov dword [0x4b9dc4], 1
push str.ws2_32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4ba3c4], eax
jmp 0x4217ff
push str.Wsock32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x4ba3c4], eax
mov edx, dword [ebp - 0x2e4]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x425160
Capabilities:
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x470
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 1
mov al, byte [0x46a026]
mov byte [ebp - 0x110], al
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0x114], 0
mov dl, byte [0x46a027]
mov byte [ebp - 0x220], dl
push 0x104
push 0
lea eax, [ebp - 0x21f]
push eax
call fcn.004456b0
add esp, 0xc
mov cl, byte [0x46a049]
mov byte [ebp - 0x328], cl
push 0x104
push 0
lea edx, [ebp - 0x327]
push edx
call fcn.004456b0
add esp, 0xc
push 0x48d748
push str._s_spoolin.tif
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
push str.MoveOrphanSpoolFilesToVsiFaxRecvDir___s__
call fcn.00428bf0
add esp, 8
lea edx, [ebp - 0x470]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x32c], eax
mov dword [ebp - 0x118], 1
cmp dword [ebp - 0x32c], 0xffffffff
je 0x42534e
cmp dword [ebp - 0x118], 0
je 0x42534e
push 0x46be94
lea ecx, [ebp - 0x444]
push ecx
call fcn.004497e8
add esp, 8
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0
je 0x42532f
mov edx, dword [ebp - 0x458]
push edx
mov eax, dword [ebp - 0x45c]
push eax
call fcn.00425370
add esp, 8
test eax, eax
je 0x42532f
lea ecx, [ebp - 0x444]
push ecx
push 0x48d748
push str._s_spoolin_s.tif
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x444]
push eax
push 0x491a48
push str._s_s.tif
lea ecx, [ebp - 0x328]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x328]
push edx
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x425314
lea ecx, [ebp - 0x328]
push ecx
lea edx, [ebp - 0x220]
push edx
push str.MoveOrphanSpoolFilesToVsiFaxRecvDir___MoveFile__s___s__FAILED_
call fcn.00428bf0
add esp, 0xc
jmp 0x42532f
lea eax, [ebp - 0x328]
push eax
lea ecx, [ebp - 0x220]
push ecx
push str.MoveOrphanSpoolFilesToVsiFaxRecvDir___MoveFile__s___s_
call fcn.00428bf0
add esp, 0xc
lea edx, [ebp - 0x470]
push edx
mov eax, dword [ebp - 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x118], eax
jmp 0x42523e
mov ecx, dword [ebp - 0x32c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x425460
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x104], 0xc
mov dword [ebp - 0xfc], 1
mov dword [ebp - 0x100], 0
push 0x46a04a
mov eax, dword [ebp + 0xc]
push eax
call fcn.00445510
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push str.vfxilog__U_vsifax__f_que__s
lea edx, [ebp - 0xa0]
push edx
call fcn.00445608
add esp, 0xc
push 0x46bfac
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
lea eax, [ebp - 0x104]
push eax
push 1
push 0xc0000000
push 0x46bfb8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x10c], eax
push 0x48
push 0
mov ecx, dword [ebp - 0x10c]
push ecx
lea edx, [ebp - 0xa0]
push edx
call fcn.00425fa0
add esp, 0x10
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.FAXQUEUE
lea ecx, [ebp - 0xf8]
push ecx
call fcn.00445510
add esp, 8
push 0x46bfd0
lea edx, [ebp - 0xf8]
push edx
call fcn.00448c8e
add esp, 8
mov dword [ebp - 0xa8], eax
cmp dword [ebp - 0xa8], 0
je 0x4255ef
mov eax, dword [ebp - 0xa8]
push eax
push 0x14
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00449395
add esp, 0xc
mov dword [ebp - 0xa4], 0
jmp 0x425589
mov edx, dword [ebp - 0xa4]
add edx, 1
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00445950
add esp, 4
cmp dword [ebp - 0xa4], eax
jge 0x4255cd
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xa4]
movsx edx, byte [ecx]
cmp edx, 0x20
je 0x4255bf
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xa4]
movsx ecx, byte [eax]
cmp ecx, 0xa
jne 0x4255cb
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xa4]
mov byte [edx], 0
jmp 0x42557a
push 0
push 0x46bfd4
mov eax, dword [ebp + 0xc]
push eax
call fcn.00425690
add esp, 0xc
mov ecx, dword [ebp - 0xa8]
push ecx
call fcn.004484c1
add esp, 4
lea edx, [ebp - 0xf8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp + 0xc]
push eax
call fcn.00445950
add esp, 4
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.SetRecvDevice___s___strlen___s_____d
call fcn.00428bf0
add esp, 0x10
mov eax, dword [ebp + 0xc]
push eax
call fcn.00445950
add esp, 4
test eax, eax
jne 0x425661
push 0x492040
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00445510
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
call fcn.00445950
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.SetRecvDevice___s___strlen___s_____d_FORCED_DEVICE
call fcn.00428bf0
add esp, 0x10
mov edx, dword [ebp + 0xc]
push edx
call fcn.00445950
add esp, 4
test eax, eax
jne 0x425675
xor eax, eax
jmp 0x42567a
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x425a90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xa4], 0
mov al, byte [0x46a06e]
mov byte [ebp - 0xa0], al
push 0x95
push 0
lea ecx, [ebp - 0x9f]
push ecx
call fcn.004456b0
add esp, 0xc
mov dl, byte [0x46a06f]
mov byte [ebp - 0x108], dl
push 0x4f
push 0
lea eax, [ebp - 0x107]
push eax
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0xb0], 0xc
mov dword [ebp - 0xa8], 1
mov dword [ebp - 0xac], 0
mov ecx, dword [ebp + 8]
push ecx
push 0x46c0c0
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x46a089
mov eax, dword [ebp + 0xc]
add eax, 0x212
push eax
call fcn.00445510
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push str.vfxolog__f_atq__d
lea edx, [ebp - 0xa0]
push edx
call fcn.00445608
add esp, 0xc
push 0x46c0d8
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 2
lea eax, [ebp - 0xb0]
push eax
push 1
push 0xc0000000
push 0x46c0e4
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xb8], eax
push 0x48
push 0
mov ecx, dword [ebp - 0xb8]
push ecx
lea edx, [ebp - 0xa0]
push edx
call fcn.00425fa0
add esp, 0x10
mov eax, dword [ebp - 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.FAXDEVICE
lea ecx, [ebp - 0x108]
push ecx
call fcn.00445510
add esp, 8
push 0x46c0fc
lea edx, [ebp - 0x108]
push edx
call fcn.00448c8e
add esp, 8
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
je 0x425c92
mov eax, dword [ebp - 0x10c]
push eax
push 0x1e
mov ecx, dword [ebp + 0xc]
add ecx, 0x212
push ecx
call fcn.00449395
add esp, 0xc
mov dword [ebp - 0xa4], 0
jmp 0x425c2e
mov edx, dword [ebp - 0xa4]
add edx, 1
mov dword [ebp - 0xa4], edx
mov eax, dword [ebp + 0xc]
add eax, 0x212
push eax
call fcn.00445950
add esp, 4
cmp dword [ebp - 0xa4], eax
jge 0x425c83
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 0xa4]
movsx edx, byte [ecx + 0x212]
cmp edx, 0x20
je 0x425c71
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 0xa4]
movsx ecx, byte [eax + 0x212]
cmp ecx, 0xa
jne 0x425c81
mov edx, dword [ebp + 0xc]
add edx, dword [ebp - 0xa4]
mov byte [edx + 0x212], 0
jmp 0x425c1f
mov eax, dword [ebp - 0x10c]
push eax
call fcn.004484c1
add esp, 4
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x425fa0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push 0x44
push 0
lea eax, [ebp - 0x48]
push eax
call fcn.004456b0
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x58]
push ecx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 0x101
xor edx, edx
mov word [ebp - 0x18], dx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
lea edx, [ebp - 0x58]
push edx
lea eax, [ebp - 0x48]
push eax
push 0
push 0
mov ecx, dword [ebp + 0x14]
push ecx
push 1
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov eax, dword [ebp + 8]
push eax
push str.OnMyCommand__s__WaitForSingleObject__piCommand.hProcess__INFINITE__
call fcn.00428bf0
add esp, 8
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp + 8]
push edx
push str.OnMyCommand__s__After_WaitForSingleObject__piCommand.hProcess__INFINITE__
call fcn.00428bf0
add esp, 8
mov eax, dword [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x54]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4284e0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x13c], 1
push str.C:medent_faxrecv_
push 0x46d958
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0xffffffff
je 0x42858d
cmp dword [ebp - 0x13c], 0
je 0x42858d
lea eax, [ebp - 0x31c]
push eax
push str.C:medent_faxrecv_
push 0x46d960
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x348]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x13c], eax
jmp 0x428531
mov edx, dword [ebp - 0x34c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret

Function at 0x4285b0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x13c], 1
push 0x48fbe8
push 0x46d968
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x348]
push ecx
lea edx, [ebp - 0x138]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x34c], eax
cmp dword [ebp - 0x34c], 0xffffffff
je 0x42865d
cmp dword [ebp - 0x13c], 0
je 0x42865d
lea eax, [ebp - 0x31c]
push eax
push 0x48fbe8
push 0x46d970
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x348]
push eax
mov ecx, dword [ebp - 0x34c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x13c], eax
jmp 0x428601
mov edx, dword [ebp - 0x34c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x428db0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov al, byte [0x46a1fb]
mov byte [ebp - 0x110], al
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0x114], 0
mov edx, dword [ebp + 8]
push edx
push str.FAX_SERVICE_SEND_MUTEX_d
lea eax, [ebp - 0x110]
push eax
call fcn.00445608
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x428e36
push 0x2710
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0043da70
add esp, 0x10
mov dword [ebp - 0x114], eax
cmp dword [ebp - 4], 0
je 0x428e6e
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x4296b0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe74
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0xc28], 1
mov al, byte [0x46a33b]
mov byte [ebp - 0x8e0], al
push 0x103
push 0
lea ecx, [ebp - 0x8df]
push ecx
call fcn.004456b0
add esp, 0xc
mov dl, byte [0x46a36e]
mov byte [ebp - 0xc20], dl
push 0x103
push 0
lea eax, [ebp - 0xc1f]
push eax
call fcn.004456b0
add esp, 0xc
mov cl, byte [0x46a36f]
mov byte [ebp - 0xd30], cl
push 0x103
push 0
lea edx, [ebp - 0xd2f]
push edx
call fcn.004456b0
add esp, 0xc
mov dword [ebp - 0xc24], 0
mov al, byte [0x46a3cb]
mov byte [ebp - 0xb18], al
push 0x103
push 0
lea ecx, [ebp - 0xb17]
push ecx
call fcn.004456b0
add esp, 0xc
mov dl, byte [0x46a3cf]
mov byte [ebp - 0x7d8], dl
push 0x7cf
push 0
lea eax, [ebp - 0x7d7]
push eax
call fcn.004456b0
add esp, 0xc
push 0x46a433
mov ecx, dword [ebp + 8]
push ecx
call fcn.00445510
add esp, 8
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xb18]
push eax
call fcn.00445510
add esp, 8
push 0x46de34
lea ecx, [ebp - 0xb18]
push ecx
call fcn.004497e8
add esp, 8
mov dword [ebp - 0xc24], eax
mov edx, dword [ebp - 0xc24]
push edx
lea eax, [ebp - 0xb18]
push eax
call fcn.00445510
add esp, 8
lea ecx, [ebp - 0xb18]
push ecx
push 0x46de38
lea edx, [ebp - 0xa10]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0xe70]
push eax
lea ecx, [ebp - 0xa10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0xe74], eax
cmp dword [ebp - 0xe74], 0xffffffff
je 0x42992b
cmp dword [ebp - 0xc28], 0
je 0x42992b
push str..pcl
lea edx, [ebp - 0xe44]
push edx
call fcn.0040fd70
add esp, 8
test eax, eax
je 0x42990c
lea eax, [ebp - 0xe44]
push eax
push str.C:medent_faxsend_
push 0x46de48
lea ecx, [ebp - 0xc20]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0xc20]
push edx
lea eax, [ebp - 0xd30]
push eax
call fcn.00445510
add esp, 8
push 0x46de50
lea ecx, [ebp - 0xd30]
push ecx
call fcn.004497e8
add esp, 8
mov dword [ebp - 0xc24], eax
mov edx, dword [ebp - 0xc24]
push edx
push str._s.tif
lea eax, [ebp - 0x8e0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0xc20]
push ecx
lea edx, [ebp - 0x8e0]
push edx
push 0x48d748
push str.__slbinpcltotif___o__s__E_fine__s
lea eax, [ebp - 0x7d8]
push eax
call fcn.00445608
add esp, 0x14
push 0
push 0
push 0
lea ecx, [ebp - 0x7d8]
push ecx
call fcn.00425fa0
add esp, 0x10
lea edx, [ebp - 0x8e0]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00445520
add esp, 8
push 0x46de80
mov ecx, dword [ebp + 8]
push ecx
call fcn.00445520
add esp, 8
lea edx, [ebp - 0xe70]
push edx
mov eax, dword [ebp - 0xe74]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0xc28], eax
jmp 0x429809
mov ecx, dword [ebp - 0xe74]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret
Function at 0x429950
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x248], 1
mov dword [ebp - 0x244], 0
mov al, byte [0x46a452]
mov byte [ebp - 0x110], al
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.004456b0
add esp, 0xc
push 0x46de84
mov edx, dword [ebp + 8]
push edx
call fcn.004497e8
add esp, 8
mov dword [ebp - 0x244], eax
mov eax, dword [ebp - 0x244]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00445510
add esp, 8
lea edx, [ebp - 0x110]
push edx
push str._s.
lea eax, [ebp - 0x240]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x450]
push ecx
lea edx, [ebp - 0x240]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x454], eax
cmp dword [ebp - 0x454], 0xffffffff
je 0x429a57
cmp dword [ebp - 0x248], 0
je 0x429a57
lea eax, [ebp - 0x424]
push eax
push str.C:medent_faxsend_
push str._s_s
lea ecx, [ebp - 0x310]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x310]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp - 0x454]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 0x248], eax
jmp 0x4299fb
mov edx, dword [ebp - 0x454]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret

Function at 0x429a80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x429af0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x429ace
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartServerUserInterfaceNamedPipeThread___CreateThread___FAILED_ERROR:_d
call fcn.00428bf0
add esp, 8
xor eax, eax
jmp 0x429add
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x429d90
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x488fdc]
xor eax, ebp
mov dword [ebp - 8], eax
push 0x46e06c
mov eax, dword [ebp + 8]
push eax
call fcn.00448730
add esp, 8
test eax, eax
jne 0x429ddb
push 0xbe
push 0xdc
push 0x46e0d4
call fcn.0042aa10
add esp, 0xc
push 1
call fcn.0042ed90
jmp 0x429e84
push 0x46e1fc
mov ecx, dword [ebp + 8]
push ecx
call fcn.00448730
add esp, 8
test eax, eax
jne 0x429e84
mov dword [ebp - 4], 0
mov dl, byte [0x46a4e2]
mov byte [ebp - 0x110], dl
push 0x104
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.004456b0
add esp, 0xc
push 0x46e264
lea ecx, [ebp - 0x110]
push ecx
call fcn.00445510
add esp, 8
xor edx, edx
cmp dword [0x4b9f8c], 0
sete dl
mov dword [0x4b9f8c], edx
cmp dword [0x4b9f8c], 0
je 0x429e77
push 0x46e284
lea eax, [ebp - 0x110]
push eax
call fcn.00448c8e
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x429e75
mov ecx, dword [ebp - 4]
push ecx
call fcn.004484c1
add esp, 4
jmp 0x429e84
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044545a
mov esp, ebp
pop ebp
ret

Function at 0x429ea0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 4], 0
push str.MedentFaxServiceUIMutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x429ede
push str.MedentFaxServiceUIMutex_ERROR_ALREADY_EXISTS
call fcn.0042aa10
add esp, 4
jmp 0x429fdb
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x429fe0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
push 0x68
mov ecx, dword [0x4b9f74]
push ecx
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x34], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x30], eax
push 1
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0x46e438
lea edx, [ebp - 0x48]
push edx
call dword [sym.imp.USER32.dll_RegisterClassA]
push 0
mov eax, dword [ebp + 8]
push eax
push 0
push 0
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push SysReAllocStringLen
push 0xcf0000
push 0x46e448
push str.FaxServiceUI
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x4b9f78], eax
push 0x4215f0
push 0x3e8
push 1
mov ecx, dword [0x4b9f78]
push ecx
call dword [sym.imp.USER32.dll_SetTimer]
push 0x42b070
push 0x36ee80
push 0xa
mov edx, dword [0x48d84c]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x429fdb
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x429fb1
mov esp, ebp
pop ebp
ret