joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4011b0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x36
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4011d7
jmp 0x401224
cmp dword [ebp - 4], 0xe9
jbe 0x4011f4
mov ecx, dword [ebp - 4]
push ecx
push str.286b1bf15d554eafbde
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401224
push str.ee9f4b1bd2adcdc76c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40121a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452528
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401224
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x4012d0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x89
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4012fa
jmp 0x401344
cmp dword [ebp - 4], 0xf
jbe 0x401314
mov ecx, dword [ebp - 4]
push ecx
push str.e6dd1df5e557ba1be8694f
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401344
push str.546795cf21696c03ad5549e387
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x40133a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452598
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401344
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x401440
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x56
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401467
jmp 0x4014b4
cmp dword [ebp - 4], 0xa6
jbe 0x401484
mov ecx, dword [ebp - 4]
push ecx
push str.6487ee6f8c119ffb41295cb9
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4014b4
push str.d875735f5ae59af1
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4014aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452608
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4014b4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x401540
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x61
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401567
jmp 0x4015b1
cmp dword [ebp - 4], 0xf
jbe 0x401581
mov ecx, dword [ebp - 4]
push ecx
push str.577f8d5f6e89c60fc45359698
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4015b1
push str.8a259f4b9b93757575
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4015a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452684
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4015b1
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x401650
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x45
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401677
jmp 0x4016c1
cmp dword [ebp - 4], 0x62
jbe 0x401691
mov ecx, dword [ebp - 4]
push ecx
push str.d53b45c19d676b2b929fbd67
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4016c1
push str.8a737479ab7b621ffa8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4016b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4526ec
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4016c1
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x401760
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.6859e5dbfe379cdfb
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x401793
jmp 0x401875
lea eax, [ebp - 0x148]
push eax
push 0x452738
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4017b9
jmp 0x401875
cmp dword [ebp - 0x258], 0
jne 0x401868
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401822
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4017fe
jmp 0x401875
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x401820
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x401832
push str.0e572ffdc69fbde11c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x401875
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401863
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x401861
mov dword [ebp - 0x258], 1
jmp 0x401863
jmp 0x401875
jmp 0x4017b9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x401970
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.2205d7ff9e5fdcad
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4019a3
jmp 0x401a85
lea eax, [ebp - 0x148]
push eax
push 0x45298c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4019c9
jmp 0x401a85
cmp dword [ebp - 0x258], 0
jne 0x401a78
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x401a32
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x401a0e
jmp 0x401a85
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x401a30
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x401a42
push str.c897dc2715672bbdc8d55e15b2
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x401a85
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401a73
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x401a71
mov dword [ebp - 0x258], 1
jmp 0x401a73
jmp 0x401a85
jmp 0x4019c9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x401aa0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401ac7
jmp 0x401b14
cmp dword [ebp - 4], 0xff
jbe 0x401ae4
mov ecx, dword [ebp - 4]
push ecx
push str.234369999e6bdf63198f21b55ba
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401b14
push str.0e45319b4337b2e7b0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x401b0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4529e0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401b14
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x401c10
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xde
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401c3a
jmp 0x401c84
cmp dword [ebp - 4], 0x74
jbe 0x401c54
mov ecx, dword [ebp - 4]
push ecx
push str.8c5f8c3d79f5ea3b6
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401c84
push str.36f9020b27d3e26d6c2b6a1fc7
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x401c7a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452a50
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401c84
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x401ca0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.0033c67f871797b7480584778b69d
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x401cd1
jmp 0x401dd2
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, pe_nt_image_headers32
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x37
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x2a
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x2d
mov edx, 0xdc
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x401d26
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x401d46
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401d1d
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x401d76
jmp 0x401dd2
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x401d9a
jmp 0x401dd2
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x401de0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.d083acb58e25981d
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x401e11
jmp 0x401f12
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0xfb
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x6b
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x13
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x194
mov edx, 0x3a
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x401e66
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x401e86
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x401e5d
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x401eb6
jmp 0x401f12
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x401eda
jmp 0x401f12
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x401f20
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xc8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401f4a
jmp 0x401f94
cmp dword [ebp - 4], 0x25
jbe 0x401f64
mov ecx, dword [ebp - 4]
push ecx
push str.19b586476281766195f
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401f94
push str.3ba32f5d71b1040fab
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x401f8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452acc
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x401f94
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x402040
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xd
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402067
jmp 0x4020b4
cmp dword [ebp - 4], 0xd4
jbe 0x402084
mov ecx, dword [ebp - 4]
push ecx
push str.bd914acb306b36f95ee38ecd78fb7a0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4020b4
push str.075772657517d7d14c0d037
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4020aa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452b40
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4020b4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x4038c0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x15
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4038e7
jmp 0x403931
cmp dword [ebp - 4], 3
jbe 0x403901
mov ecx, dword [ebp - 4]
push ecx
push str.c0793eaf3ca9c13d7ed58f777f
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x403931
push str.ca598f23de650aa1df47df
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x403927
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452c1c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x403931
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x403e30
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x7b
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403e57
jmp 0x403ea4
cmp dword [ebp - 4], 0xc9
jbe 0x403e74
mov ecx, dword [ebp - 4]
push ecx
push str.a7f173b552297e737c01e
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x403ea4
push str.757f4027d279bd8b2ba393
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x403e9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452d04
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x403ea4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x403ec0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.1153608f59b7a207f4aba56197
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x403ef3
jmp 0x403fd5
lea eax, [ebp - 0x148]
push eax
push 0x452d40
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x403f19
jmp 0x403fd5
cmp dword [ebp - 0x258], 0
jne 0x403fc8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x403f82
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x403f5e
jmp 0x403fd5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x403f80
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x403f92
push str.635924d1bb495a25fe291a359031
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x403fd5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403fc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x403fc1
mov dword [ebp - 0x258], 1
jmp 0x403fc3
jmp 0x403fd5
jmp 0x403f19
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x404230
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44c32b
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1ac], ecx
mov ecx, dword [ebp - 0x1ac]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1ac]
add ecx, 0x20
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_void_]
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1ac]
mov dword [eax + 0x3c], 0
mov ecx, dword [ebp - 0x1ac]
mov dword [ecx + 0x40], 0
push 0xdd
push 0x32
call fcn.0041c6a0
add esp, 8
cmp eax, 0x2b2a
jne 0x4042b9
jmp 0x4042c7
call fcn.00441290
call fcn.004463f0
jmp 0x4042c7
xor edx, edx
mov eax, dword [ebp - 0x1ac]
mov word [eax + 0x1c], dx
call fcn.00403e00
test eax, eax
je 0x4042e1
call fcn.00447380
mov ecx, 0x202
mov word [ebp - 0x1a8], cx
call fcn.00403d90
test eax, eax
je 0x404300
call fcn.00403e30
call fcn.00424570
call fcn.0043f860
test eax, eax
je 0x404313
call fcn.00403ec0
call fcn.00403ff0
lea edx, [ebp - 0x1a4]
push edx
movzx eax, word [ebp - 0x1a8]
push eax
call sub.WS2_32.dll_WSAStartup
push 0x8e
push 0xf1
call fcn.0041c6a0
add esp, 8
cmp eax, 0x85ae
jne 0x40434e
call fcn.00403d60
test eax, eax
je 0x40434e
call fcn.00424570
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1ac]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret