joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401080
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x3b
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4010fe
cmp eax, 0xa
jbe 0x4010c0
push eax
push str.7501ca2df44d0bd74ad9a6d1c
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.cfadb10b2eeb92bf84c7b47f7
call esi
test eax, eax
jne 0x4010f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x401110
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00437c5b
push str.966da7ed6bd76e435659c26fba0
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00437e92
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.70ffe90baa67cfb1f215e
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x401188
add edi, 0x1000
push edi
push esi
call fcn.00438068
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.a1a7f3c91113eff9d9538c07a5
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x401155
test eax, eax
jne 0x40119f
push edi
push str.d795a0bb18d93c379bdb5_d
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.a4dda919d81bfa55dec9c573__d_
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4012a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0x8a
idiv ecx
inc esi
add dl, 0x79
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4012d6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401357
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401357
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret
Function at 0x401370
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.764f599d3583fcc55109a5774
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401417
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401417
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x401430
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x401417
test al, 1
jne 0x4013f5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4013c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x401417
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.28a3d3a5d5c72cbf5b25d3e
call fcn.00437e92
add esp, 4
jmp 0x401417
Function at 0x4018b0
Capabilities:
Set uefi variable

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0
shr edi, 0x18
call fcn.00439283
imul eax, eax, 0x63
add esp, 4
cmp edi, eax
jbe 0x4018f2
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov ecx, 1
jmp 0x4018f4
xor ecx, ecx
mov eax, 0x83993053
imul ecx
add edx, ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x1f2
jle 0x401923
push 0x1f2
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004353a0
call fcn.00401230
mov edi, dword [esi + 0x54]
push 0
shr edi, 1
call fcn.00439283
add esp, 4
cmp edi, dword [esi + 0x54]
jae 0x4019a7
mov ecx, dword [esi + 0x14]
xor edx, edx
mov eax, edi
div ecx
mov ebp, edx
cmp ebp, ecx
jbe 0x40194b
call fcn.00437e82
mov ebx, pe_nt_image_headers32
cmp dword [esi + 0x18], ebx
jb 0x40195e
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
jmp 0x401965
lea eax, [esi + 4]
mov dword [esp + 0x14], eax
cmp edi, dword [esi + 0x4c]
jbe 0x40196f
call fcn.00437e82
cmp dword [esi + 0x50], ebx
jb 0x401979
mov eax, dword [esi + 0x3c]
jmp 0x40197c
lea eax, [esi + 0x3c]
mov bl, byte [eax + edi]
mov edx, dword [esp + 0x14]
xor bl, byte [edx + ebp]
cmp edi, dword [esi + 0x4c]
jbe 0x401990
call fcn.00437e82
cmp dword [esi + 0x50], 0x10
jb 0x40199b
mov eax, dword [esi + 0x3c]
jmp 0x40199e
lea eax, [esi + 0x3c]
mov byte [eax + edi], bl
inc edi
cmp edi, dword [esi + 0x54]
jb 0x401937
mov ebp, dword [esi + 0x54]
xor edi, edi
sub ebp, 1
je 0x401a17
cmp ebp, dword [esi + 0x4c]
jbe 0x4019bb
call fcn.00437e82
mov ebx, pe_nt_image_headers32
cmp dword [esi + 0x50], ebx
jb 0x4019ce
mov eax, dword [esi + 0x3c]
mov dword [esp + 0x14], eax
jmp 0x4019d5
lea ecx, [esi + 0x3c]
mov dword [esp + 0x14], ecx
cmp edi, dword [esi + 0x4c]
jbe 0x4019df
call fcn.00437e82
cmp dword [esi + 0x50], ebx
jb 0x4019e9
mov eax, dword [esi + 0x3c]
jmp 0x4019ec
lea eax, [esi + 0x3c]
mov bl, byte [eax + edi]
mov edx, dword [esp + 0x14]
xor bl, byte [edx + ebp]
cmp edi, dword [esi + 0x4c]
jbe 0x401a00
call fcn.00437e82
cmp dword [esi + 0x50], 0x10
jb 0x401a0b
mov eax, dword [esi + 0x3c]
jmp 0x401a0e
lea eax, [esi + 0x3c]
mov byte [eax + edi], bl
inc edi
dec ebp
cmp edi, ebp
jb 0x4019b1
mov edi, dword [esp + 0x1c]
push 0xffffffffffffffff
add esi, 0x38
push 0
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
push esi
mov ecx, edi
mov byte [edi + 4], 0
call fcn.00402d10
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x403830
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00437c5b
push str.98a7c0b3e16f730527bd7e
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00437e92
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.1ecdc2c98695464916c963d5
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4038a8
add edi, 0x1000
push edi
push esi
call fcn.00438068
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.17f14a1397ef9e7763ef0c3
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x403875
test eax, eax
jne 0x4038bf
push edi
push str.8a05cb5792ad23a5a12f67_d
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.7d27faf70dbf259d8ebbdd1f011__d_
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x404480
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x5a
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4044fe
cmp eax, 0x72
jbe 0x4044c0
push eax
push str.100511f3d40543132f773189f9f947
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.34d1bbbba16b40efb1
call esi
test eax, eax
jne 0x4044f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
Function at 0x4045f0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.d6633e97aa3d99eb54e1a053
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x404697
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404697
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4046b0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x404697
test al, 1
jne 0x404675
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404642
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x404697
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.5a6794e71c990dc997bd7e3de7
call fcn.00437e92
add esp, 4
jmp 0x404697

Function at 0x4046c0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.a23b130d7fb5b04d1f3d2325a
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x404767
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404767
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x404780
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x404767
test al, 1
jne 0x404745
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404712
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x404767
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.75891bad8b25976f6159baa17f9d5
call fcn.00437e92
add esp, 4
jmp 0x404767
Function at 0x404800
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.deeb7de3718d84ade15b68136107
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4048a7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4048a7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4048c0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4048a7
test al, 1
jne 0x404885
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x404852
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4048a7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.4c77d6fb765166810abfa177
call fcn.00437e92
add esp, 4
jmp 0x4048a7

Function at 0x4048d0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x44bf19
mov eax, dword fs:[0]
push eax
sub esp, 0x1a0
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x19c], eax
push ebx
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x1a8]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 0xf
mov dword [esi + 0x18], eax
mov dword [esi + 0x14], ebx
mov dword [esp + 0x10], esi
mov byte [esi + 4], bl
mov dword [esp + 0x1b0], ebx
mov dword [esi + 0x38], eax
mov dword [esi + 0x34], ebx
mov byte [esi + 0x24], bl
mov byte [esp + 0x1b0], 1
push ebx
mov dword [esi + 0x3c], ebx
call fcn.00439283
add esp, 4
xor eax, eax
mov word [esi + 0x1c], ax
lea eax, [esp + 0xb]
mov dword [esi + 0x40], ebx
mov byte [esp + 0xb], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404954
sub eax, edx
je 0x404969
call fcn.00406fe0
call fcn.00401440
call fcn.00417cd0
sub eax, 1
jne 0x40497d
call fcn.00404480
call fcn.00404510
lea eax, [esp + 0xb]
mov byte [esp + 0xb], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404988
sub eax, edx
mov eax, 0
setne al
sub eax, 1
jne 0x4049a8
call fcn.004353a0
call fcn.00406c60
lea ecx, [esp + 0x14]
push ecx
push 0x202
call sub.WS2_32.dll_WSAStartup
mov eax, esi
mov ecx, dword [esp + 0x1a8]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [esp + 0x19c]
xor ecx, esp
call fcn.00437983
add esp, 0x1ac
ret
Function at 0x406790
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44be48
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x1c
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 0xf
push eax
mov byte [ecx + 4], al
lea eax, [esp + 0x40]
push eax
call fcn.00402d10
call fcn.004014c0
cmp dword [esp + 0x34], 0x10
jb 0x4067f6
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00437f8b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c

Function at 0x406ac0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.569b4e2bda43bf035191c3dbaa05
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406b67
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406b67
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x406b80
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x406b67
test al, 1
jne 0x406b45
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406b12
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x406b67
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.2e57af6373a55907793df2eb94d9
call fcn.00437e92
add esp, 4
jmp 0x406b67
Function at 0x406b90
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.4fbfde2fdb273fc38
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406c37
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406c37
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x406c50
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x406c37
test al, 1
jne 0x406c15
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406be2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x406c37
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.0a7f5c0f204b58b7906f75
call fcn.00437e92
add esp, 4
jmp 0x406c37

Function at 0x406d20
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.ebe5f769aa81d4a7becbae05a1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x406dc7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406dc7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x406de0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x406dc7
test al, 1
jne 0x406da5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406d72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x406dc7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.a025744d403fe209
call fcn.00437e92
add esp, 4
jmp 0x406dc7
Function at 0x406e60
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00437c5b
push str.8f47e891b98fa26d7d33b21
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00437e92
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.1c4d7943a93f1307fd5108f
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x406ed8
add edi, 0x1000
push edi
push esi
call fcn.00438068
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.227bf19b8881e15b7f0f2a95a1fd
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x406ea5
test eax, eax
jne 0x406eef
push edi
push str.bcf9c5731f43f177afd1da439d_d
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.12e74831efd942318fa3f__d_
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x406f10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0x33
idiv ecx
inc esi
add dl, 0x46
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x406f46
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406fc7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x406fc7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret

Function at 0x4070b0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x87
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x407131
cmp eax, 0x1e
jbe 0x4070f3
push eax
push str.bf2b665ff7a5a2152
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.9f1bdae5d1b38f1f102d046f57478e
call esi
test eax, eax
jne 0x407129
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
Function at 0x407140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0x21
idiv ecx
inc esi
sub dl, 6
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x407176
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4071f7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4071f7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret