joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x6b
idiv ecx
inc esi
sub dl, 0x2d
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x401796
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401817
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401817
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x401830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x90
idiv ecx
inc esi
add dl, 0x4d
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x401866
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4018e7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4018e7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret
Function at 0x401c70
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push ebx
push ebp
mov ebp, dword [esp + 0x20]
push esi
mov esi, dword [ebp + 0x54]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 0
shr esi, 1
call edi
lea ecx, [esp + 0x18]
cmp eax, ecx
jle 0x401cc4
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, 1
jmp 0x401cd5
push 0xe
call edi
xor ecx, ecx
lea edx, [esp + 0x18]
cmp eax, edx
setg cl
mov eax, ecx
sub eax, 1
jne 0x401ce4
call fcn.004399b0
call fcn.00401080
cmp esi, dword [ebp + 0x54]
jae 0x401d32
lea esp, [esp]
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov eax, esi
div ecx
mov eax, ebp
mov edi, edx
call fcn.00402d20
mov dl, byte [eax]
mov edi, esi
lea eax, [ebp + 0x38]
mov byte [esp + 0x14], dl
call fcn.00402d20
mov bl, byte [eax]
lea eax, [ebp + 0x38]
call fcn.00402d20
xor bl, byte [esp + 0x14]
push 0
mov byte [eax], bl
call fcn.0043cb47
inc esi
add esp, 4
cmp esi, dword [ebp + 0x54]
jb 0x401cf0
mov edi, dword [ebp + 0x54]
xor esi, esi
sub edi, 1
mov dword [esp + 0x18], edi
je 0x401d7d
jmp 0x401d46
mov edi, dword [esp + 0x18]
lea ebx, [ebp + 0x38]
mov eax, ebx
call fcn.00402d20
mov al, byte [eax]
mov byte [esp + 0x14], al
mov edi, esi
mov eax, ebx
call fcn.00402d20
mov bl, byte [eax]
lea eax, [ebp + 0x38]
call fcn.00402d20
xor bl, byte [esp + 0x14]
inc esi
mov byte [eax], bl
mov eax, dword [esp + 0x18]
dec eax
mov dword [esp + 0x18], eax
cmp esi, eax
jb 0x401d42
mov esi, dword [esp + 0x1c]
add ebp, 0x38
push ebp
mov ecx, esi
call fcn.00402c40
mov ecx, dword [esp + 0x20]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x14
ret 8
Function at 0x4049b0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.46610955df198c4bda0dce
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404a94
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0x5d
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x18
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0xff
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x404a47
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x404a25
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x19f
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x404a91
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x404a91
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret

Function at 0x404aa0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x198], eax
push ebx
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov byte [esi + 4], bl
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], ebx
mov byte [esi + 0x24], bl
mov dword [esi + 0x3c], ebx
call fcn.00403c90
test eax, eax
je 0x404af1
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.00418470
lea ecx, [esp + 8]
push ecx
xor eax, eax
push 0x202
mov dword [esi + 0x40], ebx
mov word [esi + 0x1c], ax
call sub.WS2_32.dll_WSAStartup
mov ecx, dword [esp + 0x19c]
pop ebx
xor ecx, esp
mov eax, esi
call fcn.0043c2d9
add esp, 0x1a0
ret
Function at 0x405040
Capabilities:
Resolve dns
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4546c8
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x68], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0x80]
mov dword fs:[0], eax
mov edi, ecx
xor ebx, ebx
mov dword [esp + 0x34], edi
cmp dword [edi + 0x40], ebx
jne 0x405229
lea eax, [esp + 0x1c]
push eax
call fcn.0042a300
mov dword [esp + 0x88], 2
cmp dword [edi + 0x18], 0x10
mov dword [esp + 0x18], ebx
jb 0x4050aa
mov eax, dword [edi + 4]
jmp 0x4050ad
lea eax, [edi + 4]
push ebx
lea ecx, [esp + 0x1c]
push ecx
push ebx
push ebx
push 0xf
push eax
call sub.DNSAPI.dll_DnsQuery_A
cmp eax, ebx
jne 0x4051e0
mov ebp, dword [esp + 0x18]
cmp ebp, ebx
je 0x40514a
cmp word [ebp + 8], 0xf
jne 0x40512f
mov edx, dword [ebp + 4]
push edx
mov ecx, edi
call fcn.004030b0
push eax
call fcn.0043cd92
add esp, 8
test eax, eax
jne 0x40512f
mov eax, dword [ebp + 0x18]
mov cx, word [ebp + 0x1c]
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x38]
lea esi, [esp + 0x40]
mov word [esp + 0x38], cx
call fcn.00405b70
mov ebx, esi
lea edi, [esp + 0x1c]
mov byte [esp + 0x88], 3
call fcn.004054c0
mov byte [esp + 0x88], 2
call fcn.00405250
mov edi, dword [esp + 0x34]
xor ebx, ebx
mov ebp, dword [ebp]
cmp ebp, ebx
jne 0x4050cd
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40514a
push 1
push eax
call sub.DNSAPI.dll_DnsFree
mov dword [esp + 0x18], ebx
mov dword [esp + 0x78], 0xf
mov dword [esp + 0x74], ebx
mov byte [esp + 0x64], bl
mov byte [esp + 0x88], 4
call fcn.004178d0
test eax, eax
je 0x405170
call fcn.00419f50
mov edx, dword [esp + 0x2c]
sub edx, dword [esp + 0x28]
xor esi, esi
sar edx, 5
test edx, edx
jbe 0x4051d1
mov eax, esi
lea ecx, [esp + 0x1c]
call fcn.00405430
cmp dword [eax], 0x11
jne 0x4051a4
mov eax, esi
lea ecx, [esp + 0x1c]
call fcn.00405430
add eax, 4
cmp dword [eax + 0x14], ebx
jne 0x4051b6
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x28]
inc esi
sar eax, 5
cmp esi, eax
jb 0x405181
jmp 0x4051d1
mov eax, esi
lea ecx, [esp + 0x1c]
call fcn.00405430
push 0xffffffffffffffff
add eax, 4
push ebx
push eax
lea ecx, [esp + 0x6c]
call fcn.00402ea0
cmp dword [esp + 0x74], ebx
jne 0x4051f0
lea ecx, [esp + 0x60]
call fcn.00402c70
lea esi, [esp + 0x1c]
call fcn.004053e0
mov eax, 0x80004005
jmp 0x40522b
cmp dword [esp + 0x78], 0x10
mov eax, dword [esp + 0x64]
jae 0x4051ff
lea eax, [esp + 0x64]
push eax
call sub.WS2_32.dll_gethostbyname
cmp eax, ebx
je 0x4051d7
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx]
mov dword [edi + 0x40], eax
lea ecx, [esp + 0x60]
cmp eax, ebx
je 0x4051db
call fcn.00402c70
lea esi, [esp + 0x1c]
call fcn.004053e0
xor eax, eax
mov ecx, dword [esp + 0x80]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x68]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x78
ret
Function at 0x406610
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x453b78
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x1c
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 0xf
push eax
mov byte [ecx + 4], al
lea eax, [esp + 0x40]
push eax
call fcn.00402ea0
call fcn.00401900
cmp dword [esp + 0x34], 0x10
jb 0x406676
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0043c853
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c

Function at 0x4068b0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.448d5cc1bb21b4f3ea
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406957
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406957
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x406970
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x406957
test al, 1
jne 0x406935
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406902
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x406957
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.cd5918b71dcf7c532d45f357db3da69
call fcn.0043c75a
add esp, 4
jmp 0x406957

Function at 0x406980
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.0043c523
push str.0075cdf3f44ff09bd9f
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.0043c75a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.fd198487dab7701f
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4069f8
add edi, 0x1000
push edi
push esi
call fcn.0043c8db
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.390d229f0eb71ce394
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x4069c5
test eax, eax
jne 0x406a0f
push edi
push str.d71def5df64934dd37fb477d4e3_d
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.9611be534d53ade57__d_
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x406a30
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.0043c523
push str.29816b397df72eeb8de9133d34c
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.0043c75a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.0de96f891e55804fd3
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x406aa8
add edi, 0x1000
push edi
push esi
call fcn.0043c8db
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.cf339b9b727f025b3a87ea9f20e
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x406a75
test eax, eax
jne 0x406abf
push edi
push str.a663799507c7273546bf5b0f8_d
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.f1110ec936c96333f9__d_
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x406ae0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0xa8
idiv ecx
inc esi
add dl, 0x17
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x406b16
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406b97
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x406b97
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret
Function at 0x406bb0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.8fc3ee715f1ba4dfd2b97
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406c57
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406c57
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x406c70
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x406c57
test al, 1
jne 0x406c35
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406c02
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x406c57
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.f23771db7195c04b0cd995fde3871
call fcn.0043c75a
add esp, 4
jmp 0x406c57

Function at 0x406c80
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x92
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x406d03
cmp eax, 0xb0
jbe 0x406cc5
push eax
push str.3b99c829a74f0531d
call fcn.0043c75a
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.bd8d2e45caafcd1fd4ab4fd36dd
call esi
test eax, eax
jne 0x406cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.0043c75a
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
Function at 0x406d20
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x92
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x406da1
cmp eax, 0x27
jbe 0x406d63
push eax
push str.e67301c54fb301272a73476
call fcn.0043c75a
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.dabd8e974127e605c
call esi
test eax, eax
jne 0x406d99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.0043c75a
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
Function at 0x410620
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x453a48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x467334]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.004030c0
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x410676
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00410880
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.004030c0
cmp dword [esp + 0x24], 8
jb 0x4106bf
mov edx, dword [esp + 0x10]
push edx
call fcn.0043c853
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x417b90
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.daaba693788fedd3a73b1ec97eb
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x417c37
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x417c37
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x417c50
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x417c37
test al, 1
jne 0x417c15
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417be2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x417c37
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.0a458b69d0712edf766b3525
call fcn.0043c75a
add esp, 4
jmp 0x417c37

Function at 0x417cd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x75
idiv ecx
inc esi
sub dl, 0x6e
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x417d06
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x417d87
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x417d87
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret
Function at 0x417da0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.a0c5daff3717cedd1e4d1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x417e84
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0x72
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0xb9
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0xbc
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x417e37
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x417e15
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0xa3
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x417e81
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x417e81
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret

Function at 0x417f70
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.49ad7c811a417935a31b02ffb4ef6b2
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x418051
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xf
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x1d
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0x65
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x418004
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x417fe2
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x13d
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x41804e
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x41804e
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret