joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x9e
idiv ecx
inc esi
add dl, 0x55
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418c66
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418ce7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418ce7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x418d00
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.870f70cb949beefdd3c1f9
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418da7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418da7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418dc0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418da7
test al, 1
jne 0x418d85
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418d52
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418da7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.dfe7cc8773970c7b98fb
call fcn.00439b50
add esp, 4
jmp 0x418da7
Function at 0x418dd0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x8f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x418e53
cmp eax, 0xdc
jbe 0x418e15
push eax
push str.096982130727d60f4cc5c4b9b57b92b
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.bf1f6b5f7e31e15bbddb0bc317bbb3
call esi
test eax, eax
jne 0x418e4b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x418e70
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.8b0f786935df09d7123
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418f17
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418f17
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418f30
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418f17
test al, 1
jne 0x418ef5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418ec2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418f17
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.77c97dcb75b5c27fc75bdc
call fcn.00439b50
add esp, 4
jmp 0x418f17
Function at 0x418f40
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.50ef06a38545e091a5f739
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418fe7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418fe7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419000
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418fe7
test al, 1
jne 0x418fc5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418f92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418fe7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.2f93210fbbfbaf75d1311c
call fcn.00439b50
add esp, 4
jmp 0x418fe7

Function at 0x419010
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x3e
idiv ecx
inc esi
sub dl, 0x35
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419046
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4190c7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4190c7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret
Function at 0x4190e0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x7e
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419160
cmp eax, 0xcb
jbe 0x419122
push eax
push str.352563cf1d3723b3ef7d084b7bc5d
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.a9090a2bdb51b00f67a7f4
call esi
test eax, eax
jne 0x419158
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x4191e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.5b375cd9bc33c4cfbcdf8d57
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.be8beb8f965f1241740b6f33b987c
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x419258
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.015d76d7ba8b0ff30787ad493aeb28
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419225
test eax, eax
jne 0x41926f
push edi
push str.4e2b261bfefd12293f8541addfe7_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.4eaf9e5d5e0dfda7423d4c276__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x419290
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x83
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419313
cmp eax, 0xb9
jbe 0x4192d5
push eax
push str.99d59b7d5471b4b523f1120350e1c3e
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.3087c449f6afce55d3351805eaa5
call esi
test eax, eax
jne 0x41930b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
Function at 0x419330
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xbc
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4193b3
cmp eax, 0xbb
jbe 0x419375
push eax
push str.ed3179f7c82fe151667b
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.78fd146f7041efb3e083c90345
call esi
test eax, eax
jne 0x4193ab
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x4193d0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xef
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419453
cmp eax, 0xf8
jbe 0x419415
push eax
push str.c47194f73bf9429feb8b2a85ef
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.9ac13f09491bc1fd
call esi
test eax, eax
jne 0x41944b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x419470
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xc4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4194f3
cmp eax, 0xba
jbe 0x4194b5
push eax
push str.121fe6edaa118d5f0
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.024fb82f90f788494ab3023f779b
call esi
test eax, eax
jne 0x4194eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
Function at 0x419580
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.6fcd7479b65bcfdff92
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419627
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419627
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419640
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419627
test al, 1
jne 0x419605
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4195d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419627
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.423fc76be747a5f10a
call fcn.00439b50
add esp, 4
jmp 0x419627

Function at 0x419650
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0xad
idiv ecx
inc esi
add dl, 0x66
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419686
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419707
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419707
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret
Function at 0x419720
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x55
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41979e
cmp eax, 0x71
jbe 0x419760
push eax
push str.6ae330296bc9a7ebf26332c
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.ebe9530fc235546716c19d39781
call esi
test eax, eax
jne 0x419796
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x4197b0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x9c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419831
cmp eax, 0x78
jbe 0x4197f3
push eax
push str.8cad7419a551e7a179
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.13d76405b66b3e49d1
call esi
test eax, eax
jne 0x419829
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x419840
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.30e1b30585d98e81ca730
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.8a3d5011385d4afb
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4198b8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.9097683f34adb3996f19652715
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419885
test eax, eax
jne 0x4198cf
push edi
push str.0ef551b9edefbcaf739f3d_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.6ab1bf39084d95f57bb342339b__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4198f0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xa3
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419973
cmp eax, 0x9e
jbe 0x419935
push eax
push str.1e4916b957f39d81968b1e333f430
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.f17d8211224be7a151ff5e9f64ed
call esi
test eax, eax
jne 0x41996b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x419990
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.4709b1aba9ab9a5f3d0b7a0949e3e4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419a37
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419a37
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419a50
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419a37
test al, 1
jne 0x419a15
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4199e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419a37
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.cef5432159d7bb6927712b
call fcn.00439b50
add esp, 4
jmp 0x419a37
Function at 0x419a60
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.20f174a3874144a95183
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419b07
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419b07
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419b20
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419b07
test al, 1
jne 0x419ae5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419ab2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419b07
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.3fb7a517b8912db1d
call fcn.00439b50
add esp, 4
jmp 0x419b07

Function at 0x419b30
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.27ad4899707b80bbc0
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.7261c4d59a5d8c6f52
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x419ba8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.f51767d328271671d31f464
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419b75
test eax, eax
jne 0x419bbf
push edi
push str.4571f7659c7d613bc8537e_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.ca51bbf71a3f368b499__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret