joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a5d0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.fe8fdb9d352f6b1942dd0af9
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41a603
jmp 0x41a6e5
lea eax, [ebp - 0x148]
push eax
push 0x46d83c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41a629
jmp 0x41a6e5
cmp dword [ebp - 0x258], 0
jne 0x41a6d8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41a692
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41a66e
jmp 0x41a6e5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41a690
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41a6a2
push str.a401501def07a5e9ce47d6
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41a6e5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a6d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41a6d1
mov dword [ebp - 0x258], 1
jmp 0x41a6d3
jmp 0x41a6e5
jmp 0x41a629
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41a700
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x41a752
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x41a77b
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x36
idiv ecx
add edx, 0x10
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x41a743
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x41a7ac
jmp 0x41a81d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x41a7d1
jmp 0x41a81d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x41a80c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41abd0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xf2
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41abfa
jmp 0x41ac47
cmp dword [ebp - 4], 0x81
jbe 0x41ac17
mov ecx, dword [ebp - 4]
push ecx
push str.3441a0916bf70ea9f645b533e87
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41ac47
push str.7129fb71c565678952012d492335
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41ac3d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46d8a0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41ac47
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x41ac60
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.48957921c73d5d0b3d21d2b3a15d
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41ac93
jmp 0x41ad75
lea eax, [ebp - 0x148]
push eax
push 0x46d8e0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41acb9
jmp 0x41ad75
cmp dword [ebp - 0x258], 0
jne 0x41ad68
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41ad22
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41acfe
jmp 0x41ad75
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41ad20
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41ad32
push str.57b36253123f897d2b9bd70fa325c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41ad75
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ad63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41ad61
mov dword [ebp - 0x258], 1
jmp 0x41ad63
jmp 0x41ad75
jmp 0x41acb9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41ae70
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.20dd0e2f4937c30bb9297e
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41aea3
jmp 0x41af85
lea eax, [ebp - 0x148]
push eax
push 0x46d940
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41aec9
jmp 0x41af85
cmp dword [ebp - 0x258], 0
jne 0x41af78
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41af32
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41af0e
jmp 0x41af85
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41af30
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41af42
push str.c2c94df5c6518f7f9d8
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41af85
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41af73
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41af71
mov dword [ebp - 0x258], 1
jmp 0x41af73
jmp 0x41af85
jmp 0x41aec9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x41b040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x2000
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push str.89dfbaf1da995aebd4772f332441
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.3c35252f1d5ffe5bd61bd89dc633e6
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xea
jne 0x41b0e0
mov ecx, dword [ebp - 0xc]
add ecx, 0x1000
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.3829bf299d31afe5dfcf4cd7f0
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
jmp 0x41b090
cmp dword [ebp - 4], 0
jne 0x41b0fa
mov ecx, dword [ebp - 0xc]
push ecx
push str.e8f9546bd541d39377_d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41b10c
mov edx, dword [ebp - 4]
push edx
push str.feed370baaff98199c__d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41b110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x2000
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push str.a829d73b47d156897b5742ed4f8
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.4445ff717c6d4857b0ddd3
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xea
jne 0x41b1b0
mov ecx, dword [ebp - 0xc]
add ecx, 0x1000
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.55d17cb1d7fb00c75745de8b305
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
jmp 0x41b160
cmp dword [ebp - 4], 0
jne 0x41b1ca
mov ecx, dword [ebp - 0xc]
push ecx
push str.0503f5d7e7b3b1fb2ce782b9b1e185_d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41b1dc
mov edx, dword [ebp - 4]
push edx
push str.bbb3ea43143b153f35cb08__d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x41b1e0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.402177c9fccd03a95f
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41b213
jmp 0x41b2f5
lea eax, [ebp - 0x148]
push eax
push 0x46daa0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41b239
jmp 0x41b2f5
cmp dword [ebp - 0x258], 0
jne 0x41b2e8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41b2a2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41b27e
jmp 0x41b2f5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41b2a0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41b2b2
push str.201135dd727bb5f3257b3
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41b2f5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41b2e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41b2e1
mov dword [ebp - 0x258], 1
jmp 0x41b2e3
jmp 0x41b2f5
jmp 0x41b239
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41bc00
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.bc4d596591d1e24f08f1bc9
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41bc33
jmp 0x41bd15
lea eax, [ebp - 0x148]
push eax
push 0x46db48
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41bc59
jmp 0x41bd15
cmp dword [ebp - 0x258], 0
jne 0x41bd08
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41bcc2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41bc9e
jmp 0x41bd15
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41bcc0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41bcd2
push str.fd85e481292d03293e95
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41bd15
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41bd03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41bd01
mov dword [ebp - 0x258], 1
jmp 0x41bd03
jmp 0x41bd15
jmp 0x41bc59
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41bd30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x41bd82
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x41bdab
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xc9
idiv ecx
add edx, 0x6d
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x41bd73
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x41bddc
jmp 0x41be4d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x41be01
jmp 0x41be4d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x41be3c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41be60
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.149f3cd55eefded3096ff419387f1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41be93
jmp 0x41bf75
lea eax, [ebp - 0x148]
push eax
push 0x46db88
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41beb9
jmp 0x41bf75
cmp dword [ebp - 0x258], 0
jne 0x41bf68
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41bf22
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41befe
jmp 0x41bf75
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41bf20
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41bf32
push str.5717b16151ab08adabe139
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41bf75
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41bf63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41bf61
mov dword [ebp - 0x258], 1
jmp 0x41bf63
jmp 0x41bf75
jmp 0x41beb9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41bf90
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.389ddae7046d15957c4f
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41bfc3
jmp 0x41c0a5
lea eax, [ebp - 0x148]
push eax
push 0x46dbc0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41bfe9
jmp 0x41c0a5
cmp dword [ebp - 0x258], 0
jne 0x41c098
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41c052
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41c02e
jmp 0x41c0a5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41c050
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41c062
push str.5489266f78f5138d4cb1c86
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41c0a5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41c093
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41c091
mov dword [ebp - 0x258], 1
jmp 0x41c093
jmp 0x41c0a5
jmp 0x41bfe9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41c5d0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.505f96292ed7568bfa8b6c13724
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41c603
jmp 0x41c6e5
lea eax, [ebp - 0x148]
push eax
push 0x46dc40
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41c629
jmp 0x41c6e5
cmp dword [ebp - 0x258], 0
jne 0x41c6d8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41c692
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41c66e
jmp 0x41c6e5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41c690
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41c6a2
push str.d447c92ba2757b119eb
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41c6e5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41c6d3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41c6d1
mov dword [ebp - 0x258], 1
jmp 0x41c6d3
jmp 0x41c6e5
jmp 0x41c629
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x41c700
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x9d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41c72a
jmp 0x41c774
cmp dword [ebp - 4], 0x40
jbe 0x41c744
mov ecx, dword [ebp - 4]
push ecx
push str.1d9b33437e7bd29d25c1eb1
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41c774
push str.98d900b361a12bcd6351640
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41c76a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46dc8c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41c774
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret