joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418e10
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.181135858b8fb59d8ccdf9918527
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418eb7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418eb7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418ed0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418eb7
test al, 1
jne 0x418e95
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418e62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418eb7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.8e27f19556a947ab28c9aa
call fcn.00437e92
add esp, 4
jmp 0x418eb7

Function at 0x418ee0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.bbf9cdfb539d4f1ff941df
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418f87
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418f87
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418fa0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418f87
test al, 1
jne 0x418f65
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418f32
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418f87
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.297fa9735613862ba1d3e1632
call fcn.00437e92
add esp, 4
jmp 0x418f87
Function at 0x418fb0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xbd
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419031
cmp eax, 0x1a
jbe 0x418ff3
push eax
push str.fff1401733dfb8b712f7adc13
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.7dbf5faf77ef3a5b8175716780b3a8
call esi
test eax, eax
jne 0x419029
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x419040
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.47cb887ba0f72c395f2fcf7f4cd
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4190e7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4190e7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419100
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4190e7
test al, 1
jne 0x4190c5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419092
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4190e7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.416b04e969252f3b87fb728d72bf
call fcn.00437e92
add esp, 4
jmp 0x4190e7
Function at 0x419110
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.bd1996793089472dcea3e87bd3
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4191b7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4191b7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4191d0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4191b7
test al, 1
jne 0x419195
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419162
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4191b7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.506f36d1d4d58d319b41807b03f13c0
call fcn.00437e92
add esp, 4
jmp 0x4191b7

Function at 0x4192c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0x4b
idiv ecx
inc esi
add dl, 0x23
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4192f6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419377
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419377
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret
Function at 0x419390
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0xdb
idiv ecx
inc esi
sub dl, 0x39
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4193c6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419447
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419447
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret

Function at 0x419460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0xaa
idiv ecx
inc esi
add dl, 0x33
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419496
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419517
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419517
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret
Function at 0x419530
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0xff
idiv ecx
inc esi
sub dl, 0x31
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419566
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4195e7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4195e7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret

Function at 0x4196e0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.1e930925a28f64d924b
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419787
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419787
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4197a0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419787
test al, 1
jne 0x419765
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419732
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419787
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.0087ac91261b33e9410f
call fcn.00437e92
add esp, 4
jmp 0x419787
Function at 0x4197b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x44b898
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], eax
mov byte [esp + 0x2c], al
mov dword [esp + 0x50], eax
lea ebx, [esp + 0x28]
lea ebp, [eax + 0x19]
call fcn.00437f69
cdq
mov ecx, 0x19
idiv ecx
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x2c]
mov eax, edi
add dl, 0x61
mov byte [esp + 0x1c], dl
cmp ecx, 0x10
jae 0x419830
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
lea esi, [eax + edx]
test esi, esi
je 0x41985b
mov eax, edi
cmp ecx, 0x10
jae 0x419846
lea eax, [esp + 0x2c]
cmp eax, esi
ja 0x41985b
mov eax, edi
cmp ecx, 0x10
jae 0x419855
lea eax, [esp + 0x2c]
add eax, edx
cmp esi, eax
jbe 0x419860
call fcn.00437e82
mov edx, dword [esp + 0x1c]
push esi
push ebx
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00402e20
sub ebp, 1
jne 0x419809
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x419891
cmp dword [esp + 0x40], 0x10
jmp 0x41990c
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [esp + 0x3c]
inc ecx
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x4198bf
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [esp + 0x40], 0x10
jb 0x41991b
mov edx, dword [esp + 0x2c]
push edx
jmp 0x419913
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, pe_nt_image_headers32
mov edi, eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], ebx
jae 0x4198db
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
push ecx
push eax
push edi
call fcn.0043cdb0
mov edx, dword [esp + 0x48]
add esp, 0xc
push esi
mov byte [edx + edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [esp + 0x40], ebx
jb 0x41991b
mov eax, dword [esp + 0x2c]
push eax
call fcn.00437f8b
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00437983
add esp, 0x40
ret
Function at 0x419940
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xb9
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4199c1
cmp eax, 0x5f
jbe 0x419983
push eax
push str.794b994131299cf9ee5b2d9d
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.3af3d6c58d21f7ef0bb55a39be0f5
call esi
test eax, eax
jne 0x4199b9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x419a70
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.00ff75c3679521a1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419b17
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419b17
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419b30
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419b17
test al, 1
jne 0x419af5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419ac2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419b17
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.8bdd94a1882b957101d99c
call fcn.00437e92
add esp, 4
jmp 0x419b17
Function at 0x419b40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0xa6
idiv ecx
inc esi
add dl, 0x7b
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419b76
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419bf7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419bf7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret

Function at 0x419c10
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x5d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419c90
cmp eax, 0xd6
jbe 0x419c52
push eax
push str.add5766b397ff42b
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.5efb60e91b5f1915cf057c
call esi
test eax, eax
jne 0x419c88
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
Function at 0x419ca0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.0a8912bfe335b8dddbaf9d491a2f
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419d47
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419d47
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419d60
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419d47
test al, 1
jne 0x419d25
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419cf2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419d47
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.c443e4c3fbcb1e858ac525212391ff0
call fcn.00437e92
add esp, 4
jmp 0x419d47

Function at 0x419d70
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419dee
cmp eax, 0x4a
jbe 0x419db0
push eax
push str.ee83a11f7affd32f6897604b1bc
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.39499fed1d1fdd9791e53a39
call esi
test eax, eax
jne 0x419de6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
Function at 0x419e00
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x419e80
cmp eax, 0xdf
jbe 0x419e42
push eax
push str.5abb8d5b3b5fbb830
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.b3ef956fb7b999e5c0236f77e
call esi
test eax, eax
jne 0x419e78
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x419e90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0x82
idiv ecx
inc esi
sub dl, 0x5c
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419ec6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419f47
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419f47
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret