joyce8/EMBER2024-capa huggingface dataset:
Function at 0x426990
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x98
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4269ba
jmp 0x426a04
cmp dword [ebp - 4], 0x71
jbe 0x4269d4
mov ecx, dword [ebp - 4]
push ecx
push str.23a90d01846d82afddadc147d71
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426a04
push str.82895673d5af66750a9b151ba1adc51
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4269fa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46f250
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426a04
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x426ab0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x32
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x426ad7
jmp 0x426b21
cmp dword [ebp - 4], 0x6b
jbe 0x426af1
mov ecx, dword [ebp - 4]
push ecx
push str.325bef43c9472d5f3
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426b21
push str.aa71f4fba74b9a6de32761
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x426b17
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46f2bc
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426b21
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x426ba0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.490bbae7fd2d7b338
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x426bd1
jmp 0x426cd5
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x77
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0xb5
xor edx, edx
div dword [ebp - 0x20]
add edx, 0xd9
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x1d1
mov edx, 0x2b
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x426c29
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x426c49
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x426c20
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x426c79
jmp 0x426cd5
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x426c9d
jmp 0x426cd5
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x4270f0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x4b
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x427117
jmp 0x427161
cmp dword [ebp - 4], 0xb
jbe 0x427131
mov ecx, dword [ebp - 4]
push ecx
push str.99b328f78e0dc5fb890b9
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x427161
push str.6cf12b49dfeb5eeb
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x427157
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46f38c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x427161
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x427170
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.96416e018b37748dea83941910d
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4271a3
jmp 0x427285
lea eax, [ebp - 0x148]
push eax
push 0x46f3c8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4271c9
jmp 0x427285
cmp dword [ebp - 0x258], 0
jne 0x427278
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x427232
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x42720e
jmp 0x427285
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x427230
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x427242
push str.fbf96adb7dfb0633062
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x427285
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x427273
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x427271
mov dword [ebp - 0x258], 1
jmp 0x427273
jmp 0x427285
jmp 0x4271c9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x427330
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xb1
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42735a
jmp 0x4273a4
cmp dword [ebp - 4], 0x2c
jbe 0x427374
mov ecx, dword [ebp - 4]
push ecx
push str.70fda1192bddd9238bfdd94
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4273a4
push str.f45d8b8543fd6b9721
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x42739a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46f720
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4273a4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x427430
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.dfcbbbe1fd77f80987bfa
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x427463
jmp 0x427545
lea eax, [ebp - 0x148]
push eax
push 0x46f78c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x427489
jmp 0x427545
cmp dword [ebp - 0x258], 0
jne 0x427538
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4274f2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4274ce
jmp 0x427545
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x4274f0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x427502
push str.41c9213d9067c7350f41
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x427545
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x427533
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x427531
mov dword [ebp - 0x258], 1
jmp 0x427533
jmp 0x427545
jmp 0x427489
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x427720
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xdb
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42774a
jmp 0x427794
cmp dword [ebp - 4], 0x13
jbe 0x427764
mov ecx, dword [ebp - 4]
push ecx
push str.c37787078103e7efcbed0f834871
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x427794
push str.1059b49732f3bc7bc077479b1a47
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x42778a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46f800
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x427794
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x4277b0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.faa7ecd5e6c3c5758a4745fdedb1f9
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4277e3
jmp 0x4278c5
lea eax, [ebp - 0x148]
push eax
push 0x46f840
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x427809
jmp 0x4278c5
cmp dword [ebp - 0x258], 0
jne 0x4278b8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x427872
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x42784e
jmp 0x4278c5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x427870
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x427882
push str.e129f3232fa53ba90857b00b7017e
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x4278c5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4278b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4278b1
mov dword [ebp - 0x258], 1
jmp 0x4278b3
jmp 0x4278c5
jmp 0x427809
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x427d10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x427d62
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x427d8f
call dword [sym.imp.MSVCR90.dll_rand]
and eax, 0x8000003f
jns 0x427d7d
dec eax
or eax, 0xffffffc0
inc eax
add eax, 0x58
mov edx, dword [ebp - 0x27c]
mov byte [ebp + edx - 0x118], al
jmp 0x427d53
push 0x10
push 0
lea eax, [ebp - 0x128]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x427dc0
jmp 0x427e31
lea edx, [ebp - 0x270]
push edx
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x427de5
jmp 0x427e31
mov ecx, dword [ebp - 0x274]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [ebp - 0x25c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x258]
mov dword [ebp - 4], eax
movzx ecx, byte [ebp - 0x129]
test ecx, ecx
je 0x427e20
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x128]
push ecx
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x427e40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x2000
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push str.83b36a472ba9aa0501cbb2d3640
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.c9055e212f97ff35613771fb1f21
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xea
jne 0x427ee0
mov ecx, dword [ebp - 0xc]
add ecx, 0x1000
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.903f8dc594ef65a310cfc7cdc81
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
jmp 0x427e90
cmp dword [ebp - 4], 0
jne 0x427efa
mov ecx, dword [ebp - 0xc]
push ecx
push str.1eb9ff3f1c2325f39365254ff03d5_d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x427f0c
mov edx, dword [ebp - 4]
push edx
push str.087152c10ceb39f5ab95c__d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x428080
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x4280d2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x4280fb
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xd1
idiv ecx
add edx, 0x50
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x4280c3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x42812c
jmp 0x42819d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x428151
jmp 0x42819d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x42818c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x4281b0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.96d366017bed46a57c7566f59
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4281e3
jmp 0x4282c5
lea eax, [ebp - 0x148]
push eax
push 0x46f978
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x428209
jmp 0x4282c5
cmp dword [ebp - 0x258], 0
jne 0x4282b8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x428272
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x42824e
jmp 0x4282c5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x428270
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x428282
push str.53293a6d1a45f12be3159be96
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x4282c5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4282b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4282b1
mov dword [ebp - 0x258], 1
jmp 0x4282b3
jmp 0x4282c5
jmp 0x428209
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x428370
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x4283c2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x4283eb
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xac
idiv ecx
add edx, 0x7d
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x4283b3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x42841c
jmp 0x42848d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x428441
jmp 0x42848d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x42847c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x428510
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xaa
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42853a
jmp 0x428587
cmp dword [ebp - 4], 0xc3
jbe 0x428557
mov ecx, dword [ebp - 4]
push ecx
push str.b0e7d1fb0dbf82cd1a779f651b
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x428587
push str.c919f555b23ff28b98ef8ac53
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x42857d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46fa20
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x428587
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x428680
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x4286d2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x4286fe
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xca
idiv ecx
add edx, 0xe5
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x4286c3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x42872f
jmp 0x4287a0
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x428754
jmp 0x4287a0
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x42878f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x4287b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x2000
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push str.fbb1942b6dfbc2393e
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.4e270877dc316befe355b321
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xea
jne 0x428850
mov ecx, dword [ebp - 0xc]
add ecx, 0x1000
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.3c3586335f2ff2af92b701732d
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
jmp 0x428800
cmp dword [ebp - 4], 0
jne 0x42886a
mov ecx, dword [ebp - 0xc]
push ecx
push str.a33729bb0b5548f3a33_d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x42887c
mov edx, dword [ebp - 4]
push edx
push str.55ebcc413573509948db195b38e17__d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov esp, ebp
pop ebp
ret