joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4067e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.a2453457a5e3d4db
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.86c7c60fbfabf4d1964d
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x406858
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.68c17ee3d1ebfce7e2
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x406825
test eax, eax
jne 0x40686f
push edi
push str.6b7928c5373fb8972ea15d2d_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.9cbdde6b52d9e57d08ab8__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4069e0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x8a
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x406a63
cmp eax, 0xb9
jbe 0x406a25
push eax
push str.ab3d98c32b471ae1ad794cdd7
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.dcc7ba13d2f1f8eb2c9b3a97c7e
call esi
test eax, eax
jne 0x406a5b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x406af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0xac
idiv ecx
inc esi
sub dl, 0x7a
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x406b26
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x406ba7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x406ba7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret
Function at 0x410370
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x44d1d8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00402f90
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4103c6
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.004105d0
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00402f90
cmp dword [esp + 0x24], 8
jb 0x41040f
mov edx, dword [esp + 0x10]
push edx
call fcn.004393c9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x417260
Capabilities:
Delete file

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
pop esi
jbe 0x41728c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x417290
Capabilities:
Delete file

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x4172a8
sub eax, 2
je 0x4172a8
sub eax, 4
je 0x4172a8
xor eax, eax
ret
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
ret

Function at 0x417540
Capabilities:
Set uefi variable

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
pop esi
jbe 0x417572
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x417730
Capabilities:
Set uefi variable

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x417749
fadd qword [0x458208]
call fcn.004485f0
fstp qword [esp + 4]
push 0
call fcn.0043a6c4
add esp, 4
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x41776c
fadd qword [0x458208]
fcomp qword [esp + 4]
fnstsw ax
test ah, 5
jp 0x41778e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x4177a0
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x4177b9
fadd qword [0x458208]
call fcn.004485f0
fstp qword [esp + 4]
push 0
call fcn.0043a6c4
add esp, 4
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x4177dc
fadd qword [0x458208]
fcomp qword [esp + 4]
fnstsw ax
test ah, 5
jp 0x4177f8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret
Function at 0x417800
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.06a197a57f33a21b309793ede0672e
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4178a7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4178a7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4178c0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4178a7
test al, 1
jne 0x417885
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417852
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4178a7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.4419bc3520e79c177d97734d8961
call fcn.004392d0
add esp, 4
jmp 0x4178a7

Function at 0x417940
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.082bfde30e0d2a750b
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.207594216c93ef3fd023cc21f001
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4179b8
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.11ade397b91d6c1bf85924616ce1f0
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x417985
test eax, eax
jne 0x4179cf
push edi
push str.29cf8f97c62b470dc16d9_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.7e0734272dc9653d68bd9__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4179f0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.2785869f9bd5f40915d5db9989a
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x417a97
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x417a97
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x417ab0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x417a97
test al, 1
jne 0x417a75
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417a42
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x417a97
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.72cd8047c8bf9a87aa
call fcn.004392d0
add esp, 4
jmp 0x417a97

Function at 0x417b30
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xce
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x417bb3
cmp eax, 0xb7
jbe 0x417b75
push eax
push str.42eb5b674f1551fd6
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.4697de21c9d5549b1bf91aabfc93a
call esi
test eax, eax
jne 0x417bab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
Function at 0x417c40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.c617b617ea2f77f52d4fd
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.62239145f3a38fa53b27d
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x417cb8
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.c2550a2d056d09b54fa566d
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x417c85
test eax, eax
jne 0x417ccf
push edi
push str.6e07cbbd5bcd7a6dd2f_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.d3f1307f5525d62b__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x417cf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.3309e6ad155b55e1b2833667803
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.1a6103ab1bbd278f186157f7
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x417d68
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.fc636905b25fd4f3ec3538d
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x417d35
test eax, eax
jne 0x417d7f
push edi
push str.66359aa98929e2838ebd6c8d_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.085d11c3c8857e3b568__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x417da0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x35
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x417e20
cmp eax, 0xb2
jbe 0x417de2
push eax
push str.b4b7d6e7d5a190010a
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.75317d1feb29797587abea9d
call esi
test eax, eax
jne 0x417e18
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
Function at 0x417ed0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.4c05bc493e7f39b951d7bdf96677073
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.5c6dec2b92cb7b31138f22
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x417f48
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.36b3dfdbcd31b49f326dd597ebb92
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x417f15
test eax, eax
jne 0x417f5f
push edi
push str.55490a790b6dcbe751d9b5c145_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.731f8473f8ebef89a783647fd5af__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x417f80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0xa5
idiv ecx
inc esi
sub dl, 0x34
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x417fb6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418037
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418037
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x418050
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.f10d1e43c37f4f93
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.a099dae7bed1907781
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4180c8
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.fe3349677b13eb934b5f527
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x418095
test eax, eax
jne 0x4180df
push edi
push str.d8b784e3687540dbfc3b12c5320_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.d2237ad93845333b1b0d025b758b10__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x418100
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x20
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x418187
push esi
push edi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, eax
mov dword [esp + 0x20], 0xf
mov dword [esp + 0x1c], 0
mov byte [esp + 0xc], 0
lea edi, [ecx + 1]
lea esp, [esp]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x418150
sub ecx, edi
push ecx
push eax
lea ecx, [esp + 0x10]
call fcn.004030c0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [esp + 0x20], 0x10
pop edi
pop esi
jb 0x418187
mov eax, dword [esp + 4]
push eax
call fcn.004393c9
add esp, 4
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00438dc1
add esp, 0x20
ret

Function at 0x4181a0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x7f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41821e
cmp eax, 0x19
jbe 0x4181e0
push eax
push str.8f2df50553676c6b5943edef95a
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.beeb49bd064ba9fbe1
call esi
test eax, eax
jne 0x418216
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
Function at 0x418230
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.6e7d34dbe0bfab7ffdd1157baf8197
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4182d7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4182d7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4182f0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4182d7
test al, 1
jne 0x4182b5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418282
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4182d7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.ddadd9ab2d6bdd53c503bd218
call fcn.004392d0
add esp, 4
jmp 0x4182d7

Function at 0x418370
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.cc8fba89db83d53ff9f15e871f9d5b2
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418417
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418417
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418430
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418417
test al, 1
jne 0x4183f5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4183c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418417
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.a583787f656b116b47f5bc1d424
call fcn.004392d0
add esp, 4
jmp 0x418417
Function at 0x418440
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xcd
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4184c3
cmp eax, 0xc7
jbe 0x418485
push eax
push str.47e94f87f381c3f3d6e36525e983
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.6941d2fd05efbc85
call esi
test eax, eax
jne 0x4184bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x4184e0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x8b
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x418563
cmp eax, 0x8a
jbe 0x418525
push eax
push str.98896f17dc83bdd3268da
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.8ecd9c092b7b40957c5387d9196
call esi
test eax, eax
jne 0x41855b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret