joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46692f
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
mov eax, dword [0x4af040]
xor eax, esp
mov dword [esp + 0x108], eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call dword [sym.imp.mfc140.dll_Ordinal_10429]
mov edi, dword [sym.imp.mfc140.dll_Ordinal_14054]
lea ecx, [ebx + 0x328]
push str.Download_and_Convert_
call edi
push str.Also_Download_Video_
lea ecx, [ebx + 0x3a8]
call edi
push str.Compatible_with_TV_IPhone
lea ecx, [ebx + 0x428]
call edi
push str.Click_Here_To_Get_Pro_Version_
lea ecx, [ebx + 0x630]
call edi
push str.paste_url_like:_https:__www.youtube.com_watch_vnv_5K4YDsew
push 0x420
mov ecx, ebx
call dword [sym.imp.mfc140.dll_Ordinal_5401]
mov ecx, eax
call edi
push 1
lea esi, [ebx + 0x1d8]
mov dword [ebx + 0xdc8], 0xff0000
xor ebp, ebp
mov ecx, esi
push ebp
call dword [sym.imp.mfc140.dll_Ordinal_4385]
push dword [0x4e51bc]
mov ecx, esi
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, 0xf1
push ebp
push dword [0x4e51d4]
push edi
push dword [ebx + 0x3c8]
call esi
push ebp
push dword [0x4e51dc]
push edi
push dword [ebx + 0x448]
call esi
push ebp
lea ecx, [ebx + 0x5a8]
call dword [sym.imp.mfc140.dll_Ordinal_4468]
push 0x640000
push ebp
push 0x401
push dword [ebx + 0x548]
call esi
cmp dword [0x4e51d8], 1
mov ecx, ebx
je 0x466a23
call 0x466bf9
jmp 0x466a28
call 0x466b27
lea ecx, [ebx + 0x158]
call dword [sym.imp.mfc140.dll_Ordinal_13475]
lea eax, [esp + 0x10]
push eax
push ebp
push ebp
push 0x1c
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x14]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [esp + 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 0x14]
mov ecx, 0x4c1114
push eax
call dword [sym.imp.mfc140.dll_Ordinal_1529]
mov edi, dword [sym.imp.mfc140.dll_Ordinal_5401]
mov ecx, ebx
push 0x3fd
call edi
test eax, eax
jne 0x466a84
mov eax, ebp
jmp 0x466a87
mov eax, dword [eax + 0x20]
mov esi, dword [sym.imp.UxTheme.dll_SetWindowTheme]
mov ecx, 0x4a5278
push ecx
push ecx
push eax
call esi
push 0x3fe
mov ecx, ebx
call edi
test eax, eax
jne 0x466aa8
mov eax, ebp
jmp 0x466aab
mov eax, dword [eax + 0x20]
mov ecx, 0x4a5278
push ecx
push ecx
push eax
call esi
push 0x43b
mov ecx, ebx
call edi
test eax, eax
jne 0x466ac6
mov eax, ebp
jmp 0x466ac9
mov eax, dword [eax + 0x20]
mov ecx, 0x4a5278
push ecx
push ecx
push eax
call esi
push 0x3fb
mov ecx, ebx
call edi
test eax, eax
jne 0x466ae4
mov eax, ebp
jmp 0x466ae7
mov eax, dword [eax + 0x20]
mov ecx, 0x4a5278
push ecx
push ecx
push eax
call esi
push 0x43e
mov ecx, ebx
call edi
test eax, eax
je 0x466b01
mov ebp, dword [eax + 0x20]
mov eax, 0x4a5278
push eax
push eax
push ebp
call esi
mov ecx, dword [esp + 0x118]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
inc eax
call fcn.0046f100
add esp, 0x10c
ret
Function at 0x466fc4
Capabilities:
Create directory

Disassembly:
push 0x18
mov eax, 0x47b8e5
call fcn.0046fa56
push 0x4e51bc
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_300]
push ecx
lea eax, [ebp - 0x10]
mov ecx, esp
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.mfc140.dll_Ordinal_300]
call 0x466f9a
pop ecx
test al, al
je 0x467001
mov bl, 1
jmp 0x4670f5
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x10]
mov eax, dword [eax - 0xc]
dec eax
push eax
call dword [sym.imp.mfc140.dll_Ordinal_5059]
cmp al, 0x5c
je 0x467021
push 0x5c
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_2472]
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_316]
mov byte [ebp - 4], 2
xor esi, esi
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], esi
jle 0x467096
push esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_5059]
cmp al, 0x5c
je 0x46705f
push esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_5059]
movzx eax, al
push eax
jmp 0x467084
mov eax, dword [ebp - 0x20]
lea ecx, [ebp - 0x14]
push ecx
cmp eax, dword [ebp - 0x1c]
je 0x467079
mov ecx, eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
add dword [ebp - 0x20], 4
jmp 0x467082
push eax
lea ecx, [ebp - 0x24]
call fcn.00468fa5
push 0x5c
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_2472]
mov eax, dword [ebp - 0x10]
inc esi
cmp esi, dword [eax - 0xc]
jl 0x467041
mov esi, dword [ebp - 0x24]
jmp 0x4670ad
push 0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
setne bl
add esi, 4
cmp esi, dword [ebp - 0x20]
jne 0x46709b
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov esi, dword [ebp - 0x24]
test esi, esi
je 0x4670f5
mov edi, dword [ebp - 0x20]
cmp esi, edi
je 0x4670db
mov ecx, esi
call dword [sym.imp.mfc140.dll_Ordinal_1044]
add esi, 4
cmp esi, edi
jne 0x4670c9
mov esi, dword [ebp - 0x24]
mov edx, dword [ebp - 0x1c]
mov ecx, esi
sub edx, esi
and edx, 0xfffffffc
call fcn.0045f739
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov al, bl
call fcn.0046fa24
ret
Function at 0x467468
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x47b9a4
call fcn.0046fa56
mov edi, ecx
mov esi, dword [sym.imp.msi.dll_MsiRecordGetInteger]
push str.196BB40D_1578_3D01_B289_BEFC77A11A1E
call esi
cmp eax, 5
je 0x467598
push str.DA5E371C_6333_3D8A_93A4_6FD5B20BCC6E
call esi
cmp eax, 5
je 0x467598
push str.F0C3E5D1_1ADE_321E_8167_68EF0DE699A5
call esi
cmp eax, 5
je 0x467598
push str.1D8E6291_B0D5_35EC_8441_6616F567A0F7
call esi
cmp eax, 5
je 0x467598
push str._vcredist_x86.exe
mov edx, 0x4c1118
lea ecx, [ebp - 0x10]
call fcn.0045ecaf
pop ecx
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x46758b
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Upgrading_library
call dword [sym.imp.mfc140.dll_Ordinal_310]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
push dword [edi]
mov edx, 0x4e509c
push 0x4c113c
call fcn.0045eaec
pop ecx
mov byte [ebp - 4], 2
push dword [eax]
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Please_wait.
call dword [sym.imp.mfc140.dll_Ordinal_310]
push ecx
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Upgrading_Microsoft_runtime_library_for_the_first_running..
call dword [sym.imp.mfc140.dll_Ordinal_310]
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
push str._download_updates_vcredist_x86.exe
mov edx, 0x4c111c
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.0045ecaf
pop ecx
mov byte [ebp - 4], 6
push dword [eax]
mov ecx, 0x4e4020
mov byte [ebp - 4], 8
call fcn.0046bd41
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
xor eax, eax
jmp 0x46759b
xor eax, eax
inc eax
call fcn.0046fa24
ret
Function at 0x46b17c
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
mov eax, 0x47c2f2
call fcn.0046fa56
mov ebx, ecx
xor edi, edi
push ecx
xor esi, esi
lea eax, [ebp + 0xc]
inc esi
mov ecx, esp
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.mfc140.dll_Ordinal_300]
mov ecx, ebx
call 0x46b028
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x46b1b5
cmp eax, 2
jne 0x46b1d1
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
push dword [ebx + 0xc]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebx], eax
test eax, eax
je 0x46b1e3
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
jmp 0x46b268
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call esi
mov eax, dword [ebp - 0x10]
inc eax
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.mfc140.dll_Ordinal_265]
pop ecx
mov edi, eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp - 0x18]
call esi
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
call dword [sym.imp.mfc140.dll_Ordinal_316]
push edi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140.dll_Ordinal_1529]
push edi
call dword [sym.imp.mfc140.dll_Ordinal_266]
mov esi, dword [ebx]
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
test esi, esi
jne 0x46b258
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.mfc140.dll_Ordinal_300]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, dword [ebp + 8]
call fcn.0046fa24
ret 0xc

Function at 0x46b2fe
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x20006
xor edi, edi
push edi
push dword [ebx + 0xc]
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x46b357
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 3
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb esi, esi
cmp dword [ebx + 8], edi
jne 0x46b34a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esi + 1]
pop esi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
mov eax, edi
pop edi
pop ebx
leave
ret 8
Function at 0x46dad5
Capabilities:
Create process on windows
Create process suspended
Move file
Terminate process

Disassembly:
push 0x58
mov eax, 0x47c7b7
call fcn.0046fabf
xor edi, edi
mov dword [ebp - 4], edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 2
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x64], esi
xor ebx, ebx
inc ebx
or dword [ebp - 0x38], ebx
push ebx
push dword [ebp + 0xc]
mov word [ebp - 0x34], bx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, dword [0x4c1118]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_5096]
lea ecx, [ebp - 0x20]
push ecx
lea ecx, [ebp - 0x64]
push ecx
push esi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x46db4b
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, 0x46db4b
ret
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140.dll_Ordinal_1044]
call fcn.0046fa24
ret 8

Function at 0x46feda
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x46ff19
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46ff19
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46ff19
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x46ff19
cmp dword [ecx + 0x74], 0xe
jbe 0x46ff19
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x471b70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47cb94
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4af040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
test eax, eax
js 0x471c65
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
push eax
push 1
call sub.mfc140.dll_Ordinal_8031
mov edi, eax
test edi, edi
js 0x471c68
mov ecx, ebx
call fcn.004717c0
mov esi, eax
xor ecx, ecx
mov edx, 0x4c
mov dword [ebp + 8], esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.mfc140.dll_Ordinal_265
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x471c1a
push 0x4704b0
push 0x470320
push dword [ebp + 8]
mov dword [eax], esi
lea esi, [eax + 4]
push 0x4c
push esi
call fcn.0046f58d
jmp 0x471c1c
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x471c65
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push esi
push 0
push 0
push 0
push 0
push 4
push 0
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0xc], 0xffffffff
call sub.mfc140.dll_Ordinal_13574
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x43acc2
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.00561270
mov ebp, dword [esp + 0x14]
lea eax, [ebp + 6]
cmp eax, 5
ja case.default.0x43ace6
jmp dword [eax*4 + 0x43aea8]
mov dword [esi + 0x74], 0xfffffffa
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 0x10
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x74], 0xffffffff
push ecx
mov dword [esi + 0x68], 3
push 4
jmp 0x43ad53
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x74], 0xfffffffe
push ecx
mov dword [esi + 0x60], 3
push 0
jmp 0x43ad53
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x74], 0xfffffffd
push ecx
mov dword [esi + 0x64], 3
push 1
jmp 0x43ad53
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x74], 0xfffffffc
push ecx
mov dword [esi + 0x6c], 3
push 5
mov ecx, esi
call fcn.0043d180
mov edx, dword [esi + 0x1c]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x78], eax
mov eax, dword [esi + 0x1c]
push 0
mov ecx, dword [esi + 0x54]
mov dword [esi + 0x74], 0xfffffffb
push ecx
push 7
mov ecx, esi
mov dword [esi + 0x70], 3
call fcn.0043d180
mov edx, dword [esi + 0x1c]
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 0x10
mov ecx, esi
call fcn.00564293
mov ebx, dword [esp + 0x18]
test al, 0x40
je 0x43add7
test bl, 8
jne 0x43add7
mov ecx, dword [esi + 0x3c]
test ecx, ecx
jne 0x43ade7
test al, 0x80
je 0x43ae06
test bl, 8
je 0x43ae06
mov eax, dword [esi + 0x40]
test eax, eax
je 0x43ae06
mov eax, dword [esi + 0x1c]
push 0
push 0x12c
push 2
push eax
mov dword [esi + 0x74], ebp
mov dword [esi + 0x5c], 0xfffffffa
call dword [sym.imp.USER32.dll_SetTimer]
jmp 0x43ae0d
mov dword [esi + 0x74], 0xfffffffa
mov ecx, esi
call fcn.00564293
test al, 0x10
je 0x43ae2c
mov eax, ebx
and eax, 8
je 0x43ae2c
push eax
push 1
push ebp
mov ecx, esi
call fcn.0043cfc0
jmp 0x43ae61
mov edx, dword [esi + 0x54]
xor ecx, ecx
cmp ebp, edx
setne cl
and ebx, 8
mov edi, ecx
push ebx
push 1
push ebp
mov ecx, esi
call fcn.0043d0e0
test edi, edi
je 0x43ae61
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esi + 0x54]
push edx
push eax
push ecx
push 0
mov ecx, esi
call fcn.0043aec0
mov eax, dword [esi + 0x160]
xor edi, edi
test eax, eax
jle 0x43ae9c
mov ebx, dword [esp + 0x20]
mov edx, dword [esi + 0x15c]
mov eax, dword [edx + edi*4]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x43ae91
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
push edi
push 1
mov ecx, esi
call fcn.0043aec0
mov eax, dword [esi + 0x160]
inc edi
cmp edi, eax
jl 0x43ae71
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 0x10
Function at 0x440280
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x160
cmp eax, 0xffffffff
jne 0x440296
mov eax, 0x80
jmp 0x440298
or al, 0x80
mov edx, dword [esp + 0x164]
push 0x4010
lea ecx, [esp + 4]
push 0x160
push ecx
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [esp + 4]
add esp, 0x160
ret
Function at 0x441a50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x57f097
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [esp + 0x14], 0
lea eax, [esp + 0x30]
mov edi, 1
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], edi
call fcn.00564ae3
push 0x5c
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 2
call fcn.0055de9b
cmp eax, 0xffffffff
jne 0x441ab8
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00564ae3
mov dword [esp + 0x14], edi
jmp 0x441b7a
lea edx, [esp + 0x10]
push eax
push edx
lea ecx, [esp + 0x14]
call fcn.0055de23
mov bl, 3
push 0x5c
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.0055de9b
cmp eax, 0xffffffff
jne 0x441aed
push 0x5a36d8
lea ecx, [esp + 0x10]
call fcn.00564ef7
jmp 0x441b58
lea ecx, [esp + 0x18]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0055de23
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 4
call fcn.00564ea7
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], bl
call fcn.00564d6e
lea edx, [esp + 0x18]
push edi
push edx
lea ecx, [esp + 0x14]
call fcn.0055dda7
mov eax, dword [eax]
push 0x402374
push eax
call dword [fcn.00434a04]
add esp, 8
lea ecx, [esp + 0x18]
test eax, eax
setne bl
call fcn.00564d6e
test bl, bl
je 0x441b58
push 0x402374
lea ecx, [esp + 0x10]
call fcn.0056514a
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0xc]
push eax
mov ecx, esi
call fcn.00564ae3
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], edi
mov byte [esp + 0x24], 2
call fcn.00564d6e
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.00564d6e
lea ecx, [esp + 0x30]
mov byte [esp + 0x24], 0
call fcn.00564d6e
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 8
Function at 0x442750
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x57f10b
push eax
mov dword fs:[0], esp
sub esp, 0x354
xor eax, eax
push ebx
mov ebx, dword [esp + 0x368]
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 0x41
lea edi, [esp + 0x15c]
rep stosd dword es:[edi], eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [eax + ebx - 1], 0x5c
je 0x4427a1
mov edi, 0x402374
mov dword [esp + 0x14], edi
jmp 0x4427ad
mov dword [esp + 0x14], 0x5a36d8
mov edi, dword [esp + 0x14]
push edi
push ebx
lea eax, [esp + 0x164]
push 0x4023a8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x15c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
jne 0x4427ea
xor al, al
jmp 0x442934
cmp byte [esp + 0x48], 0x2e
je 0x442917
test byte [esp + 0x1c], 0x10
je 0x44282d
lea eax, [esp + 0x48]
lea ecx, [esp + 0x260]
push eax
push edi
push ebx
push 0x4023a0
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea edx, [esp + 0x260]
mov ecx, esi
push edx
call fcn.00442750
jmp 0x442917
mov eax, dword [0x412074]
mov dword [esp + 0x10], eax
lea ecx, [esp + 0x48]
lea edx, [esp + 0x10]
push ecx
push edi
push ebx
push 0x4023a0
push edx
mov dword [esp + 0x380], 0
call fcn.0055e243
mov eax, dword [esi + 0xb4]
mov ebp, dword [esi + 0xac]
add esp, 0x14
test eax, eax
jne 0x4428a6
mov eax, dword [esi + 0xbc]
push 0xc
lea ecx, [esi + 0xb8]
push eax
push ecx
call fcn.0055ffc9
mov ecx, dword [esi + 0xbc]
lea edx, [ecx + ecx*2]
dec ecx
test ecx, ecx
lea eax, [eax + edx*4 - 8]
jl 0x4428a6
inc ecx
mov edx, dword [esi + 0xb4]
mov dword [eax], edx
mov dword [esi + 0xb4], eax
sub eax, 0xc
dec ecx
jne 0x442892
mov edi, dword [esi + 0xb4]
push 1
mov eax, dword [edi]
mov dword [esi + 0xb4], eax
mov dword [edi + 4], ebp
mov dword [edi], 0
mov edx, dword [esi + 0xb0]
lea ebp, [edi + 8]
inc edx
push ebp
mov dword [esi + 0xb0], edx
call fcn.0055e2f4
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebp
call fcn.00564ea7
mov eax, dword [esi + 0xac]
test eax, eax
je 0x4428ef
mov dword [eax], edi
jmp 0x4428f5
mov dword [esi + 0xa8], edi
lea ecx, [esp + 0x10]
mov dword [esi + 0xac], edi
mov dword [esp + 0x36c], 0xffffffff
call fcn.00564d6e
mov edi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4427ea
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
mov ecx, dword [esp + 0x364]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x360
ret 4
Function at 0x443780
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
push ebx
push ebp
push esi
mov esi, ecx
push edi
push 9
mov ecx, dword [esi + 0x654]
add ecx, 0x24
call fcn.00437b70
mov ecx, dword [esi + 0x654]
push 1
add ecx, 0x24
mov ebp, eax
call fcn.00437b70
mov edi, dword [eax + 4]
mov edx, dword [eax]
xor ecx, ecx
xor ebx, ebx
or ecx, edi
or edx, ebx
mov dword [esi + 0x80], ecx
mov dword [esi + 0x84], edx
mov ecx, dword [eax]
mov dword [esp + 0x14], ecx
mov ecx, dword [esi + 0x654]
mov edx, dword [eax + 4]
add ecx, 0x24
mov dword [esp + 0x1c], edx
call fcn.004379b0
push ebx
push 0x80
push 3
push ebx
push 2
mov edi, eax
push 0x40000000
lea ecx, [esi + 0x60]
push ebx
sub edi, 9
call fcn.0056519e
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, dword [esp + 0x1c]
mov ebx, eax
lea eax, [esp + 0x14]
push 0
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x10], 0
lea edx, [esp + 0x18]
push 0
push edx
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jg 0x443843
mov ecx, dword [esp + 0x10]
inc ecx
cmp ecx, 0xf
mov dword [esp + 0x10], ecx
jl 0x443821
cmp dword [esp + 0x10], 0xf
jne 0x44387e
test eax, eax
jg 0x44387e
lea eax, [esi + 0x60]
push 0x402408
push eax
lea eax, [esp + 0x18]
push eax
call fcn.00565003
mov ecx, dword [eax]
mov edx, dword [esi + 0x1c]
push 0x30
push 0x4023bc
push ecx
push edx
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [esp + 0x10]
call fcn.00564d6e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x18]
mov edx, dword [esi + 0x80]
add edx, eax
mov dword [esi + 0x80], edx
mov ecx, dword [esi + 0x84]
adc ecx, 0
mov dword [esi + 0x84], ecx
mov ecx, esi
call fcn.00443b70
mov al, byte [esi + 0x5c]
test al, al
je 0x4438c3
mov ecx, esi
call fcn.00443b40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
add edx, eax
mov dword [esp + 0x21], ecx
mov dword [esp + 0x25], edx
mov edx, dword [esi + 0x654]
lea ecx, [esp + 0x20]
push 9
push ecx
mov ecx, dword [esi + 0x658]
push edx
mov byte [esp + 0x2c], 7
call fcn.00449660
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret