joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aa50
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.bb073c0b0b055a5ba06b7769a6
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41aaf7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41aaf7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x41ab10
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x41aaf7
test al, 1
jne 0x41aad5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41aaa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41aaf7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.f3e7b7b7fc775289e4bfe
call fcn.004392d0
add esp, 4
jmp 0x41aaf7

Function at 0x41ab20
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.1151dc5b63c9393f8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41abc7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41abc7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x41abe0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x41abc7
test al, 1
jne 0x41aba5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ab72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41abc7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.7737bf11da89e3ed95c5
call fcn.004392d0
add esp, 4
jmp 0x41abc7
Function at 0x41d140
Capabilities:
Check mutex on windows

Disassembly:
cmp dword [esi + 0x198], 0x10
jb 0x41d151
mov eax, dword [esi + 0x184]
jmp 0x41d157
lea eax, [esi + 0x184]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x17c], eax
test eax, eax
jne 0x41d179
mov dword [esi + 0x308], 1
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41d176
push 0
mov dword [esi + 0x308], 0
call fcn.0043ace9
int3

Function at 0x41d1a0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x41d207
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.USER32.dll_GetCapture]
call dword [sym.imp.USER32.dll_GetClipboardOwner]
call fcn.004308a0
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00438dc1
add esp, 0x1a0
ret

Function at 0x41d5f0
Capabilities:
Delete file
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44e0c8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov dword [esp + 0x1c], 0
mov eax, dword [esp + 0x28]
mov edi, 0x10
cmp dword [esp + 0x3c], edi
jae 0x41d62f
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 4
mov ebx, eax
call esi
lea ecx, [esp + 0x10]
cmp eax, ecx
jle 0x41d659
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 1
jmp 0x41d668
push 0xe
call esi
lea edx, [esp + 0x10]
xor ecx, ecx
cmp eax, edx
setg cl
mov eax, 0x6bca1af3
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x26
jle 0x41d690
push 0x26
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00418100
call fcn.00418100
cmp ebx, 0xffffffff
jne 0x41d6c2
cmp dword [esp + 0x3c], edi
jb 0x41d6a8
mov ecx, dword [esp + 0x28]
push ecx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x1c
test bl, 0x10
je 0x41d6d4
cmp dword [esp + 0x3c], edi
jb 0x41d6e7
mov edx, dword [esp + 0x28]
push edx
jmp 0x41d6df
cmp dword [esp + 0x3c], edi
jb 0x41d6e7
mov eax, dword [esp + 0x28]
push eax
call fcn.004393c9
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret 0x1c
Function at 0x41d700
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100c
call fcn.00447d40
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1004], eax
push 0xfff
lea eax, [esp + 5]
push 0
push eax
mov byte [esp + 0xc], 0
call fcn.0043fbd0
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x41d75e
mov eax, 0x80004005
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.00438dc1
add esp, 0x100c
ret
cmp eax, 0x1000
jae 0x41d744
lea eax, [esp]
lea edx, [eax + 1]
jmp 0x41d770
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41d770
sub eax, edx
push eax
lea edx, [esp + 4]
push edx
lea ecx, [esi + 0x19c]
call fcn.004030c0
mov ecx, dword [esp + 0x1004]
xor ecx, esp
xor eax, eax
call fcn.00438dc1
add esp, 0x100c
ret
Function at 0x41eec0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x44d098
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.00447d40
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1000], eax
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x100c]
mov dword fs:[0], eax
push 0xfff
lea eax, [esp + 0xd]
push 0
mov dword [esp + 0x101c], 0
push eax
mov byte [esp + 0x14], 0
call fcn.0043fbd0
mov eax, dword [esp + 0x102c]
mov edi, 0x10
add esp, 0xc
cmp dword [esp + 0x1034], edi
jae 0x41ef3c
lea eax, [esp + 0x1020]
push 0x1000
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x41ef71
cmp dword [esp + 0x1034], edi
jb 0x41ef6a
mov edx, dword [esp + 0x1020]
push edx
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
jmp 0x41efd1
cmp eax, 0x1000
jb 0x41ef98
cmp dword [esp + 0x1034], edi
jb 0x41ef6a
mov eax, dword [esp + 0x1020]
push eax
call fcn.004393c9
add esp, 4
mov eax, 0x80004005
jmp 0x41efd1
lea eax, [esp + 8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41efa0
sub eax, edx
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.004030c0
cmp dword [esp + 0x1034], edi
jb 0x41efcf
mov edx, dword [esp + 0x1020]
push edx
call fcn.004393c9
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x100c]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00438dc1
add esp, 0x1010
ret 0x1c
Function at 0x422890
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x44dee0
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov eax, dword [ebp + 0x74]
lea ebx, [esi + 0x2c0]
mov ecx, ebx
call fcn.0042a870
cmp dword [eax + 0x3c], 0
je 0x422a90
mov edi, 0x10
cmp dword [ebp + 0x70], edi
jb 0x4228f1
mov ecx, dword [ebp + 0x5c]
jmp 0x4228f4
lea ecx, [ebp + 0x5c]
cmp dword [esi + 0x25c], edi
jb 0x422904
mov eax, dword [esi + 0x248]
jmp 0x42290a
lea eax, [esi + 0x248]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov eax, dword [ebp + 0x74]
mov ecx, ebx
jne 0x422a97
call fcn.0042a870
inc dword [eax + 0x38]
add eax, 0x38
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042a870
cmp dword [eax + 0x38], 3
jle 0x422a90
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042a870
cmp dword [eax + 0x18], edi
jb 0x422954
mov eax, dword [eax + 4]
jmp 0x422957
add eax, 4
push eax
lea eax, [esp + 0x20]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, 0x10
jb 0x422986
mov ecx, dword [edi]
jmp 0x422988
mov ecx, edi
cmp ecx, 0x4572e4
ja 0x4229c3
cmp eax, 0x10
jb 0x422999
mov ecx, dword [edi]
jmp 0x42299b
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x4572e4
jbe 0x4229c3
cmp eax, 0x10
jb 0x4229af
mov edi, dword [edi]
push 0x3b
mov eax, 0x4572e4
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402d80
jmp 0x422a07
cmp eax, 0x3b
jae 0x4229d5
mov ecx, dword [esi + 0x14]
push ecx
push 0x3b
mov ecx, esi
call fcn.004034b0
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x4229e1
mov eax, dword [edi]
jmp 0x4229e3
mov eax, edi
push 0x3b
push 0x4572e4
push ecx
push eax
call fcn.00439429
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x3b
jb 0x422a03
mov edi, dword [edi]
mov byte [edi + 0x3b], 0
lea esi, [esp + 0x5c]
call fcn.004016b0
xor edi, edi
mov dword [esp + 0xa0], edi
call fcn.00401930
mov esi, 0x10
mov byte [esp + 0x9c], 1
cmp dword [eax + 0x18], esi
jb 0x422a35
mov eax, dword [eax + 4]
jmp 0x422a38
add eax, 4
mov edx, dword [esp + 0xa4]
push eax
push 1
push edx
call fcn.0041d220
add esp, 0x10
cmp dword [esp + 0x34], esi
jb 0x422a5e
mov eax, dword [esp + 0x20]
push eax
call fcn.004393c9
add esp, 4
lea esi, [esp + 0x38]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], edi
mov byte [esp + 0x20], 0
mov dword [esp + 0x98], 0xffffffff
call fcn.00429e20
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042a870
mov dword [eax + 0x3c], edi
mov eax, 0x80004005
jmp 0x422aa5
call fcn.0042a870
mov dword [eax + 0x38], 0
xor eax, eax
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret 8
Function at 0x42daa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x451249
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
mov byte [edi + 4], dl
mov dword [esp + 0x24], edx
mov eax, dword [esi + 0x18]
mov dword [esp + 0x14], 1
lea ebp, [esi + 4]
cmp eax, 0x10
jb 0x42db00
mov ecx, dword [ebp]
jmp 0x42db02
mov ecx, ebp
mov ebx, dword [esi + 0x14]
add ecx, ebx
mov dword [esp + 0x10], ecx
cmp ecx, edx
je 0x42db31
cmp eax, 0x10
jb 0x42db19
mov edx, dword [ebp]
jmp 0x42db1b
mov edx, ebp
cmp edx, ecx
ja 0x42db31
cmp eax, 0x10
jb 0x42db29
mov eax, dword [ebp]
jmp 0x42db2b
mov eax, ebp
add ebx, eax
cmp ecx, ebx
jbe 0x42db36
call fcn.004392c0
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x42db43
mov ebx, dword [ebp]
jmp 0x42db45
mov ebx, ebp
test ebx, ebx
je 0x42db6a
cmp ecx, 0x10
jb 0x42db53
mov eax, dword [ebp]
jmp 0x42db55
mov eax, ebp
cmp eax, ebx
ja 0x42db6a
cmp ecx, 0x10
jb 0x42db61
mov ebp, dword [ebp]
mov ecx, dword [esi + 0x14]
add ecx, ebp
cmp ebx, ecx
jbe 0x42db6f
call fcn.004392c0
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0x30]
push esi
push ebx
push esi
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0042e050
add esp, 0x24
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x430190
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.52590eb92f4fe5cba
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.32c92cf74e0374f5b73f4ae5
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x430208
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.4ba35091629fdb55b06f0f
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x4301d5
test eax, eax
jne 0x43021f
push edi
push str.08bbd0436f9bfd19a9f15bd3_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.618ba3a3b66556e73f65a__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x430240
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x3c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4302c0
cmp eax, 0xd4
jbe 0x430282
push eax
push str.faebd4299a2f09bdd191a46de
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.aaa9945f430fcaef71515687e6a
call esi
test eax, eax
jne 0x4302b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x4302d0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xfe
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x430353
cmp eax, 0xef
jbe 0x430315
push eax
push str.306fb73597778ad59ea51a577f45505
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.73df5a776643f0ffffcd1a3
call esi
test eax, eax
jne 0x43034b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
Function at 0x4303e0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x36
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x430460
cmp eax, 0xb2
jbe 0x430422
push eax
push str.2dad7b43477df7b98c9fb009a6db09
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.2f23b4890fe9b9f58ab121b55f6dc2
call esi
test eax, eax
jne 0x430458
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x430470
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.35993e77813783c5f30f3a3338
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x430517
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x430517
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x430530
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x430517
test al, 1
jne 0x4304f5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4304c2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x430517
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.7dfb7b4bacb76fb926b96fff7e37
call fcn.004392d0
add esp, 4
jmp 0x430517
Function at 0x430540
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xe3
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4305c3
cmp eax, 0xb4
jbe 0x430585
push eax
push str.b19b9639462141fd3d0
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.4173af41ebef1df3e09
call esi
test eax, eax
jne 0x4305bb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x4305e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0x64
idiv ecx
inc esi
add dl, 0x57
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x430616
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x430697
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x430697
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret
Function at 0x4306b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0x50
idiv ecx
inc esi
add dl, 0x30
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4306e6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x430767
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x430767
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x4307f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.27ffe3cdb94f89ef610
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.e16f4cbbbe713bdd03d5439f340d6
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x430868
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.48b79431ee731df977674a81e
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x430835
test eax, eax
jne 0x43087f
push edi
push str.c4a94fadb767b4c7b25b_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.206b5b0dee4be60df9af1fe91__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4308a0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push esi
push edi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4308f4
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 8]
push edx
push esi
call edi
test eax, eax
jne 0x4308d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4308f4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x254]
pop edi
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret