joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4459e0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x7f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x445a07
jmp 0x445a51
cmp dword [ebp - 4], 0x40
jbe 0x445a21
mov ecx, dword [ebp - 4]
push ecx
push str.60fb69011effe7b74edbd
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x445a51
push str.67877d2db013fcb32445cd191c53
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x445a47
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x457230
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x445a51
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x445a60
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.dcb5a4b99683db0359cfaaedb7e9
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x445a93
jmp 0x445b75
lea eax, [ebp - 0x148]
push eax
push 0x457270
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x445ab9
jmp 0x445b75
cmp dword [ebp - 0x258], 0
jne 0x445b68
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x445b22
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x445afe
jmp 0x445b75
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x445b20
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x445b32
push str.e18d4c2558abdc8b297dba53
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x445b75
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x445b63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x445b61
mov dword [ebp - 0x258], 1
jmp 0x445b63
jmp 0x445b75
jmp 0x445ab9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x445c00
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.a777526bb10f3801f66f8d
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x445c31
jmp 0x445d35
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x9c
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0xc8
xor edx, edx
div dword [ebp - 0x20]
add edx, 0xc6
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x108
mov edx, 0x2b
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x445c89
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x445ca9
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x445c80
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x445cd9
jmp 0x445d35
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x445cfd
jmp 0x445d35
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x445f00
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.46b9b625db636a7734bb93d34fb
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x445f33
jmp 0x446015
lea eax, [ebp - 0x148]
push eax
push 0x457344
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x445f59
jmp 0x446015
cmp dword [ebp - 0x258], 0
jne 0x446008
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x445fc2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x445f9e
jmp 0x446015
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x445fc0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x445fd2
push str.3c6f418df9e539af803559d908a
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x446015
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x446003
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x446001
mov dword [ebp - 0x258], 1
jmp 0x446003
jmp 0x446015
jmp 0x445f59
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x446030
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x2a
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x446057
jmp 0x4460a4
cmp dword [ebp - 4], 0x80
jbe 0x446074
mov ecx, dword [ebp - 4]
push ecx
push str.3165f8a3c8a34fc71bd13
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4460a4
push str.b041dd914e531651e27938f9
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44609a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45739c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4460a4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x446130
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xd2
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44615a
jmp 0x4461a4
cmp dword [ebp - 4], 0x28
jbe 0x446174
mov ecx, dword [ebp - 4]
push ecx
push str.5a3d9ac985bdc0fb955
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4461a4
push str.22d32ffd7ae5be5b955982
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44619a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x457424
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4461a4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x446460
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xb8
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44648a
jmp 0x4464d7
cmp dword [ebp - 4], 0xb7
jbe 0x4464a7
mov ecx, dword [ebp - 4]
push ecx
push str.043db41ff059e777d09d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4464d7
push str.fda5ded9ac677b9744512db173c3b
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4464cd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x457538
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4464d7
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x446640
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x446669
jmp 0x4466a7
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 0x28]
push edx
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::constructor_char_const__]
mov eax, dword [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
lea ecx, [ebp - 0x20]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::destructor_void_]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x446810
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x34
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x446837
jmp 0x446884
cmp dword [ebp - 4], 0x94
jbe 0x446854
mov ecx, dword [ebp - 4]
push ecx
push str.531987d70b6fce19
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x446884
push str.870fcf1d40cf6e81bbefb38183156fd
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44687a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45766c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x446884
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x446910
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.320bd1bfccf7b137
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x446941
jmp 0x446a42
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x1e
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0xea
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x49
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x156
mov edx, 4
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x446996
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x4469b6
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x44698d
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4469e6
jmp 0x446a42
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x446a0a
jmp 0x446a42
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x446a50
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x26
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x446a77
jmp 0x446ac4
cmp dword [ebp - 4], 0xe9
jbe 0x446a94
mov ecx, dword [ebp - 4]
push ecx
push str.6159d2a9bc0533f3e
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x446ac4
push str.6791be5f7d6d632f8105
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x446aba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4576fc
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x446ac4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x446ae0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xa
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x446b07
jmp 0x446b54
cmp dword [ebp - 4], 0x98
jbe 0x446b24
mov ecx, dword [ebp - 4]
push ecx
push str.610dc59d8103af6f2ead8
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x446b54
push str.939b9ce71b3d39715b8f25e1c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x446b4a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x457750
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x446b54
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x446de0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.da87051fd789a211540104f
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x446e13
jmp 0x446ef5
lea eax, [ebp - 0x148]
push eax
push 0x457818
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x446e39
jmp 0x446ef5
cmp dword [ebp - 0x258], 0
jne 0x446ee8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x446ea2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x446e7e
jmp 0x446ef5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x446ea0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x446eb2
push str.3e4b3433142703af89c970b76a17a5
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x446ef5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x446ee3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x446ee1
mov dword [ebp - 0x258], 1
jmp 0x446ee3
jmp 0x446ef5
jmp 0x446e39
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x447230
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.9abf52a1c547d3cd54b7ace1f283
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x447263
jmp 0x447345
lea eax, [ebp - 0x148]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x447289
jmp 0x447345
cmp dword [ebp - 0x258], 0
jne 0x447338
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4472f2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4472ce
jmp 0x447345
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x4472f0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x447302
push str.8df1ca2319bf9aafd36d55e
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x447345
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x447333
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x447331
mov dword [ebp - 0x258], 1
jmp 0x447333
jmp 0x447345
jmp 0x447289
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x447360
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xfe
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44738a
jmp 0x4473d4
cmp dword [ebp - 4], 0x33
jbe 0x4473a4
mov ecx, dword [ebp - 4]
push ecx
push str.967f6a51e421b143caf9e7e5
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4473d4
push str.2bd516899a2fe0d7416f05dbfa5
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4473ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4578d8
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4473d4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x4473f0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x81
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44741a
jmp 0x447467
cmp dword [ebp - 4], 0xf9
jbe 0x447437
mov ecx, dword [ebp - 4]
push ecx
push str.c5a7b09b6703b4617759b699444
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x447467
push str.dd1b253db37dbdad45abe9ef38c34
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44745d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x457934
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x447467
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x447560
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xbe
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x44758a
jmp 0x4475d4
cmp dword [ebp - 4], 0x35
jbe 0x4475a4
mov ecx, dword [ebp - 4]
push ecx
push str.b037031f9b536c5dc725fc81fd2f43
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4475d4
push str.9ab101edcc6d17b5b36b6dff0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4475ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4475d4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x4475f0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.27cd8b31139d3aeb7a33382d38a9fe
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x447621
jmp 0x447725
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0xd1
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x3b
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x85
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0xa5
mov edx, 0xd7
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x447679
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x447699
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x447670
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4476c9
jmp 0x447725
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4476ed
jmp 0x447725
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret