joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba30
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.005b02a0
add esp, 0xc
call fcn.004032c4
mov dword [ebp - 0x114], 1
call fcn.00402522
call dword [sym.imp.KERNEL32.dll_AllocConsole]
test eax, eax
jne 0x41baa4
mov dword [ebp - 0x114], 0
push 0x64ac5c
push str.:7:InitConsole___FAILED:_AllocConsole___FAILED:__s
call fcn.00401014
add esp, 8
push 7
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
jne 0x41bad5
mov dword [ebp - 0x114], 0
push 0x64aca0
push str.:7:InitConsole___FAILED:_SetConsoleMode_STD_INPUT_HANDLE__FAILED:__s
call fcn.00401014
add esp, 8
push 3
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_SetConsoleMode]
test eax, eax
jne 0x41bb06
mov dword [ebp - 0x114], 0
push 0x64acf8
push str.:7:InitConsole___FAILED:_SetConsoleMode_STD_OUTPUT_HANDLE__FAILED:__s
call fcn.00401014
add esp, 8
push 1
push 0x41bcd0
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
test eax, eax
jne 0x41bb33
mov dword [ebp - 0x114], 0
push 0x64ad50
push str.:7:InitConsole___FAILED:_SetConsoleCtrlHandler___FAILED:__s
call fcn.00401014
add esp, 8
push 0x35c
call dword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
test eax, eax
jne 0x41bb5e
mov dword [ebp - 0x114], 0
push 0x35c
push str.:9:InitConsole___FAILED:_SetConsoleOutputCP___FAILED:_could_not_set_code_page__d___
call fcn.00401014
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov dword [0x70122c], eax
cmp dword [0x70122c], 0
jne 0x41bb8e
mov dword [ebp - 0x114], 0
push 0x64adf4
push str.:7:InitConsole___FAILED:_GetConsoleWindow___FAILED:__s
call fcn.00401014
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
jbe 0x41bbde
lea edx, [ebp - 0x110]
push edx
call fcn.00403076
add esp, 4
push 0x64ad9c
lea eax, [ebp - 0x110]
push eax
call fcn.00402086
add esp, 8
test eax, eax
jne 0x41bbde
push 0
push 0
call fcn.004022b6
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.Sounds_
push 0
call fcn.004022b6
add esp, 8
push eax
call fcn.00403049
add esp, 4
cmp dword [ebp + 8], 0
je 0x41bc05
mov ecx, dword [ebp + 8]
mov dword [0x701228], ecx
call fcn.0040323d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.005b3da0
add esp, 4
call fcn.005b3db0
call fcn.005b3db0
call fcn.005b3db0
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x41d140
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x130], 0
push 0x124
push 0
lea eax, [ebp - 0x12c]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0x138], 0
mov dword [ebp - 0x134], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
je 0x41d1a8
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
test edx, edx
jne 0x41d1af
xor eax, eax
jmp 0x41d340
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
jne 0x41d1e4
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.CountProcesses__s___d__FAILED:_CreateToolhelp32Snapshot___FAILED_
call fcn.00401014
add esp, 0xc
or eax, 0xffffffff
jmp 0x41d340
mov dword [ebp - 0x130], 0x128
lea edx, [ebp - 0x130]
push edx
mov eax, dword [ebp - 0x13c]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x41d23d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.CountProcesses__s___d__FAILED:_Process32First___FAILED_
call fcn.00401014
add esp, 0xc
push 0x8e7
push 0x64b0ec
push 0x64b0f8
mov eax, dword [ebp - 0x13c]
push eax
call fcn.00401f5a
or eax, 0xffffffff
jmp 0x41d340
mov dword [ebp - 0x134], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0
je 0x41d283
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x10c]
push edx
call fcn.005b0660
add esp, 8
test eax, eax
jne 0x41d277
mov dword [ebp - 0x138], 1
jmp 0x41d281
mov dword [ebp - 0x138], 0
jmp 0x41d2b0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10c]
push ecx
call fcn.00401041
add esp, 8
test eax, eax
je 0x41d2a6
mov dword [ebp - 0x138], 1
jmp 0x41d2b0
mov dword [ebp - 0x138], 0
cmp dword [ebp - 0x138], 0
je 0x41d2c8
mov edx, dword [ebp - 0x134]
add edx, 1
mov dword [ebp - 0x134], edx
cmp dword [ebp - 4], 0x300
jle 0x41d2fa
cmp dword [ebp - 4], 0x309
jge 0x41d2f8
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push str.:9:CountProcesses__s___d__FAILED:_Process32Next__s__wont_stop_
call fcn.00401014
add esp, 0x10
jmp 0x41d2fa
jmp 0x41d315
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x13c]
push ecx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x41d24e
push 0x90b
push 0x64b148
push str.CountProcesses
mov edx, dword [ebp - 0x13c]
push edx
call fcn.00401f5a
mov dword [ebp - 0x13c], 0xffffffff
mov eax, dword [ebp - 0x134]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x41e530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x210], 0
push 0x207
push 0
lea eax, [ebp - 0x20f]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0x218], 0
mov dword [ebp - 0x214], 0
cmp dword [ebp + 0x14], 0
jge 0x41e581
mov dword [ebp + 0x14], 0x207
push 0x208
push 0
lea ecx, [ebp - 0x210]
push ecx
call fcn.005b02a0
add esp, 0xc
mov edx, dword [ebp + 0x10]
push edx
call fcn.00402158
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401389
add esp, 4
test eax, eax
je 0x41e5ba
xor eax, eax
jmp 0x41e63e
mov dword [ebp - 0x218], 0x207
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
je 0x41e621
mov edx, dword [ebp - 0x214]
push edx
push 0x64b8a4
mov eax, dword [ebp + 0xc]
push eax
push str.:4:GetRegString___s___FAILED:_RegQueryValueEx___FAILED:__s_ld
call fcn.004018ca
add esp, 0x10
mov ecx, dword [ebp - 0x214]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x41e63e
mov edx, dword [ebp + 0x14]
sub edx, 1
push edx
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00402725
add esp, 0xc
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x421cb0
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [0x703950], 0
je 0x421d13
mov dword [0x703954], 1
cmp dword [0x703950], 0
je 0x421cef
push 0x19
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 8], 0
jne 0x421d11
cmp dword [0x703950], 0
je 0x421d0a
mov eax, 1
jmp 0x421eb5
xor eax, eax
jmp 0x421eb5
jmp 0x421ccb
cmp dword [ebp + 8], 0
jne 0x421d20
xor eax, eax
jmp 0x421eb5
push 0x104
mov eax, dword [ebp + 8]
push eax
push 0x703958
call fcn.00402725
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call fcn.00402158
add esp, 4
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
jmp 0x421d5b
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax + 0x703958]
test ecx, ecx
je 0x421dc7
cmp dword [ebp - 0xc], 0
je 0x421d91
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x703958]
cmp eax, 0x29
jne 0x421d85
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x703a60], 0x20
jmp 0x421d52
mov edx, dword [ebp - 4]
movsx eax, byte [edx + 0x703958]
cmp eax, 0x28
jne 0x421db3
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x703a60], 0x20
jmp 0x421d52
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x703958]
mov byte [edx + 0x703a60], cl
jmp 0x421d52
mov edx, dword [ebp - 4]
mov byte [edx + 0x703a60], 0
push 0x703a60
push 0x703958
call fcn.005b61f0
add esp, 8
test eax, eax
je 0x421df0
call fcn.004032f1
test eax, eax
je 0x421e21
push 0x703958
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [0x703950], 0
mov dword [0x703954], 1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
jmp 0x421eb5
mov dword [ebp - 8], 0
mov dword [0x703954], 0
cmp dword [0x703954], 0
jne 0x421e9e
call fcn.004031ca
test eax, eax
jne 0x421e9e
mov dword [0x703950], 1
cmp dword [ebp - 8], 0
je 0x421e73
push 0x703a60
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0x703954
push 0x2ee
call fcn.00403071
add esp, 8
jmp 0x421e90
push 0x703958
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
push 0x703954
push 0x5dc
call fcn.00403071
add esp, 8
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov dword [ebp - 8], eax
jmp 0x421e32
push 0x703958
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov dword [0x703950], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x422040
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x100
mov byte [ebp - 0x118], 0
push 0xff
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 4], 0
mov word [ebp - 8], 0
xor ecx, ecx
mov word [ebp - 6], cx
mov dword [ebp - 0x14], 0
mov edx, dword [ebp + 0x10]
push edx
call fcn.0040259a
add esp, 4
test eax, eax
je 0x4220af
xor eax, eax
jmp 0x4221ac
lea eax, [ebp - 0x118]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
sub eax, 1
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005b8260
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x42212e
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x118]
cmp edx, eax
je 0x4220f7
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005b16b0
add esp, 8
mov edx, dword [ebp - 0x10]
shl edx, 1
mov dword [ebp - 0x10], edx
push 0x1594
push 0x64c418
push 1
mov eax, dword [ebp - 0x10]
add eax, 0xa
push eax
push 1
call fcn.005b0ce0
add esp, 0x14
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x42212c
xor eax, eax
jmp 0x4221ac
jmp 0x4220b8
mov cx, word [ebp + 8]
mov word [ebp - 8], cx
mov dx, word [ebp + 0xc]
mov word [ebp - 6], dx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.00401f5f
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
test eax, eax
jne 0x42218e
movsx ecx, byte [0x70347a]
test ecx, ecx
jne 0x42218e
push 0x64c424
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.:3:OutConsole__d___d___s__FAILED:_WriteConsoleOutputCharacter___FAILED:__s
call fcn.004018ca
add esp, 0x14
mov byte [0x70347a], 1
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x118]
cmp edx, eax
je 0x4221a9
push 1
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.005b16b0
add esp, 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x423590
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00401389
add esp, 4
test eax, eax
je 0x4235c2
or eax, 0xffffffff
jmp 0x42367b
call fcn.0040296e
test eax, eax
jne 0x42365b
mov byte [ebp - 0x88], 0
push 0x7f
push 0
lea ecx, [ebp - 0x87]
push ecx
call fcn.005b02a0
add esp, 0xc
push 0x80
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x88]
push eax
call fcn.00402725
add esp, 0xc
push 0x22
lea ecx, [ebp - 0x88]
push ecx
call fcn.004012f3
add esp, 8
lea edx, [ebp - 0x88]
push edx
call fcn.00403076
add esp, 4
push str.CLS
lea eax, [ebp - 0x88]
push eax
call fcn.00403125
add esp, 8
test eax, eax
jne 0x42363e
or eax, 0xffffffff
jmp 0x42367b
push str.COLOR
lea ecx, [ebp - 0x88]
push ecx
call fcn.00403125
add esp, 8
test eax, eax
jne 0x42365b
or eax, 0xffffffff
jmp 0x42367b
call fcn.004031ca
test eax, eax
je 0x423669
or eax, 0xffffffff
jmp 0x42367b
mov edx, dword [ebp + 8]
push edx
call fcn.005b8790
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x4440c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0x258], 0
push 0x13c
push 0
lea ecx, [ebp - 0x254]
push ecx
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
call fcn.00401389
add esp, 4
test eax, eax
je 0x444139
or eax, 0xffffffff
jmp 0x44430c
push 0x104
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00402725
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
call fcn.00403076
add esp, 4
lea eax, [ebp - 0x110]
push eax
call fcn.00402ec8
add esp, 4
push 0x22
lea ecx, [ebp - 0x110]
push ecx
call fcn.004012f3
add esp, 8
lea edx, [ebp - 0x110]
push edx
call fcn.005b4690
add esp, 4
movsx eax, byte [ebp + eax - 0x111]
cmp eax, 0x2a
je 0x4441ea
lea ecx, [ebp - 0x110]
push ecx
call fcn.005b4690
add esp, 4
movsx edx, byte [ebp + eax - 0x111]
cmp edx, 0x5c
je 0x4441d1
push 0x104
push 0x659054
lea eax, [ebp - 0x110]
push eax
call fcn.004014f1
add esp, 0xc
push 0x104
push 0x659058
lea ecx, [ebp - 0x110]
push ecx
call fcn.004014f1
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x114], eax
cmp dword [ebp - 0x114], 0xffffffff
jne 0x444215
or eax, 0xffffffff
jmp 0x44430c
lea ecx, [ebp - 0x22c]
push ecx
call fcn.00401389
add esp, 4
test eax, eax
je 0x44422d
jmp 0x4442d6
movsx edx, byte [ebp - 0x22c]
cmp edx, 0x2e
jne 0x44423e
jmp 0x4442d6
cmp dword [ebp + 0xc], 0
je 0x444254
mov eax, dword [ebp - 0x258]
and eax, 2
je 0x444254
jmp 0x4442d6
mov ecx, dword [ebp - 0x258]
and ecx, 0x10
je 0x4442cd
cmp dword [ebp + 0x10], 0
je 0x4442cb
mov byte [ebp - 0x360], 0
push 0x103
push 0
lea edx, [ebp - 0x35f]
push edx
call fcn.005b02a0
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x360]
push ecx
call fcn.005b4720
add esp, 8
lea edx, [ebp - 0x22c]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.004029eb
add esp, 8
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x360]
push eax
call fcn.004021cb
add esp, 0xc
add eax, dword [ebp - 4]
mov dword [ebp - 4], eax
jmp 0x4442d6
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x444215
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 0x114], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x444cb0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 8], eax
mov byte [ebp - 0x218], 0
push 0x103
push 0
lea eax, [ebp - 0x217]
push eax
call fcn.005b02a0
add esp, 0xc
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea ecx, [ebp - 0x10f]
push ecx
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 4], 0
mov edx, dword [ebp + 8]
push edx
call fcn.00401389
add esp, 4
test eax, eax
jne 0x444d24
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401389
add esp, 4
test eax, eax
je 0x444d2b
xor eax, eax
jmp 0x444e81
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x218]
push edx
call fcn.00402725
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
call fcn.00403076
add esp, 4
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402ec8
add esp, 4
lea edx, [ebp - 0x218]
push edx
call fcn.005b4690
add esp, 4
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x444d81
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jle 0x444da4
mov ecx, dword [ebp - 4]
movsx edx, byte [ebp + ecx - 0x218]
cmp edx, 0x5c
jne 0x444da4
mov eax, dword [ebp - 4]
mov byte [ebp + eax - 0x218], 0
jmp 0x444d78
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402608
add esp, 4
push 0x104
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.00402725
add esp, 0xc
lea ecx, [ebp - 0x110]
push ecx
call fcn.00403076
add esp, 4
lea edx, [ebp - 0x110]
push edx
call fcn.00402ec8
add esp, 4
lea eax, [ebp - 0x110]
push eax
call fcn.005b4690
add esp, 4
sub eax, 1
mov dword [ebp - 4], eax
jmp 0x444e09
mov ecx, dword [ebp - 4]
sub ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jle 0x444e2c
mov edx, dword [ebp - 4]
movsx eax, byte [ebp + edx - 0x110]
cmp eax, 0x5c
jne 0x444e2c
mov ecx, dword [ebp - 4]
mov byte [ebp + ecx - 0x110], 0
jmp 0x444e00
lea edx, [ebp - 0x110]
push edx
call fcn.00402338
add esp, 4
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402293
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x444e6e
push 0xb
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x444e81
push 0xa
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x444e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea eax, [ebp - 0x10f]
push eax
call fcn.005b02a0
add esp, 0xc
push 0x104
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x110]
push edx
call fcn.00402725
add esp, 0xc
lea eax, [ebp - 0x110]
push eax
call fcn.00402ec8
add esp, 4
push 0
push 0x5c
lea ecx, [ebp - 0x110]
push ecx
call fcn.004022de
add esp, 0xc
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x444fce
mov eax, dword [ebp - 0x118]
and eax, 0x10
je 0x444fce
mov dword [ebp - 0x11c], 0
push 0
push 1
lea ecx, [ebp - 0x110]
push ecx
call fcn.00401cd0
add esp, 0xc
push 0
push 1
lea edx, [ebp - 0x110]
push edx
call fcn.004015cd
add esp, 0xc
mov dword [ebp - 0x114], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x11c], eax
cmp dword [ebp - 0x114], 0
jne 0x444fbf
lea eax, [ebp - 0x110]
push eax
call fcn.004028ab
add esp, 4
test eax, eax
je 0x444fbf
mov ecx, dword [ebp - 0x11c]
push ecx
push 0x65909c
lea edx, [ebp - 0x110]
push edx
mov eax, dword [ebp + 8]
push eax
push str.:3:DeleteDirectory___s___FAILED:_DeleteFiles___s___1__0__FAILED:__s_ld
call fcn.00401014
add esp, 0x14
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x44501a
mov dword [ebp - 0x114], 0
cmp dword [ebp - 0x118], 0xffffffff
je 0x445012
mov edx, dword [ebp + 8]
push edx
call fcn.004028ab
add esp, 4
test eax, eax
je 0x445012
mov eax, dword [ebp + 8]
push eax
call fcn.00401b77
add esp, 4
test eax, eax
jne 0x445012
mov ecx, dword [ebp + 8]
push ecx
push str.:3:DeleteDirectory___s___FAILED:_The_given_file_is_not_a_directory_
call fcn.00401014
add esp, 8
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x114]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret
Function at 0x447ee0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x364
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x364], eax
mov byte [ebp - 0x220], 0
push 0x103
push 0
lea ecx, [ebp - 0x21f]
push ecx
call fcn.005b02a0
add esp, 0xc
mov byte [ebp - 0x110], 0
push 0x103
push 0
lea edx, [ebp - 0x10f]
push edx
call fcn.005b02a0
add esp, 0xc
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x360], 0
push 0x13c
push 0
lea eax, [ebp - 0x35c]
push eax
call fcn.005b02a0
add esp, 0xc
cmp dword [ebp - 0x364], 0
je 0x447f76
mov ecx, dword [ebp - 0x364]
movsx edx, byte [ecx]
test edx, edx
jne 0x447f7d
xor eax, eax
jmp 0x4480e2
push 0x104
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x220]
push ecx
call fcn.00402725
add esp, 0xc
lea edx, [ebp - 0x220]
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.005b4720
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
call fcn.00402608
add esp, 4
mov edx, dword [0x707640]
add edx, 0xf
cmp dword [0x70763c], edx
jle 0x447fe9
mov eax, dword [0x70763c]
mov dword [0x707640], eax
mov ecx, dword [0x70763c]
push ecx
push str.:8:DoesFileExist_Helper___has_determined_that_over__d_helper_threads_may_be_stuck_
call fcn.004018ca
add esp, 8
mov edx, dword [0x70763c]
add edx, 1
mov dword [0x70763c], edx
lea eax, [ebp - 0x360]
push eax
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x114], eax
mov edx, dword [0x70763c]
sub edx, 1
mov dword [0x70763c], edx
cmp dword [ebp - 0x114], 0xffffffff
jne 0x448031
xor eax, eax
jmp 0x4480e2
cmp dword [0x62a1f4], 0
je 0x4480d0
movsx eax, byte [ebp - 0x334]
cmp eax, 0x2e
je 0x4480a2
lea ecx, [ebp - 0x334]
push ecx
call fcn.00401389
add esp, 4
test eax, eax
jne 0x4480a2
movsx edx, byte [ebp - 0x110]
cmp edx, 0x2a
jne 0x4480a0
movsx eax, byte [ebp - 0x10e]
cmp eax, 0x2a
jne 0x4480a0
movsx ecx, byte [ebp - 0x10f]
cmp ecx, 0x3f
je 0x4480a0
movsx edx, byte [ebp - 0x10f]
push edx
lea eax, [ebp - 0x334]
push eax
call fcn.005b9e20
add esp, 8
test eax, eax
je 0x44809e
jmp 0x4480d0
jmp 0x4480a2
jmp 0x4480d0
lea ecx, [ebp - 0x360]
push ecx
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4480cb
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4480e2
jmp 0x448031
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret 4
Function at 0x44c010
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x6fb448]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x150], 0
push 0x103
push 0
lea eax, [ebp - 0x14f]
push eax
call fcn.005b02a0
add esp, 0xc
mov byte [ebp - 0x48], 0
push 0x3f
push 0
lea ecx, [ebp - 0x47]
push ecx
call fcn.005b02a0
add esp, 0xc
cmp dword [ebp + 8], 0
jne 0x44c061
xor eax, eax
jmp 0x44c103
mov edx, dword [ebp + 8]
push edx
call fcn.00402158
add esp, 4
push 0x21e88e
push 0xde
call fcn.004031d9
add esp, 8
push eax
push str.P2_Tmp__d
push 0x40
lea eax, [ebp - 0x48]
push eax
call fcn.00402dc9
add esp, 0x10
lea ecx, [ebp - 0x150]
push ecx
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x44c0bf
push 0x65b2f8
push str.:2:CreateTempFile___FAILED:_GetTempPath___FAILED:__s
call fcn.00401014
add esp, 8
xor eax, eax
jmp 0x44c103
mov edx, dword [ebp + 8]
push edx
push 0
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x44c0ea
mov edx, dword [ebp + 8]
push edx
call fcn.00401389
add esp, 4
test eax, eax
je 0x44c100
push 0x65b340
push str.:2:CreateTempFile___FAILED:_GetTempFileName___FAILED:__s
call fcn.00401014
add esp, 8
xor eax, eax
jmp 0x44c103
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005b0290
mov esp, ebp
pop ebp
ret