joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4255c0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.e0fb6335a119718d5a2b2945
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4255f3
jmp 0x4256d5
lea eax, [ebp - 0x148]
push eax
push 0x454d6c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x425619
jmp 0x4256d5
cmp dword [ebp - 0x258], 0
jne 0x4256c8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x425682
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x42565e
jmp 0x4256d5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x425680
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x425692
push str.4871f247545fa3ab
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x4256d5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4256c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4256c1
mov dword [ebp - 0x258], 1
jmp 0x4256c3
jmp 0x4256d5
jmp 0x425619
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x425760
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x70
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425787
jmp 0x4257d1
cmp dword [ebp - 4], 0x2b
jbe 0x4257a1
mov ecx, dword [ebp - 4]
push ecx
push str.c9a579a10a51d73950f9aa2f93
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4257d1
push str.c255a6f56e0dd33fa81700a144
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4257c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x454df4
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4257d1
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x425870
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.13c99c67ad03222f5a93
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4258a3
jmp 0x425985
lea eax, [ebp - 0x148]
push eax
push 0x454e44
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4258c9
jmp 0x425985
cmp dword [ebp - 0x258], 0
jne 0x425978
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x425932
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x42590e
jmp 0x425985
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x425930
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x425942
push str.f4d72b3593b739b921
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x425985
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425973
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x425971
mov dword [ebp - 0x258], 1
jmp 0x425973
jmp 0x425985
jmp 0x4258c9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x425a10
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.d74dca6dc503d0bdd4f7847
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x425a43
jmp 0x425b25
lea eax, [ebp - 0x148]
push eax
push 0x454ea8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x425a69
jmp 0x425b25
cmp dword [ebp - 0x258], 0
jne 0x425b18
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x425ad2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x425aae
jmp 0x425b25
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x425ad0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x425ae2
push str.f623fe47b95f80e965bb13554b3562
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x425b25
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425b13
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x425b11
mov dword [ebp - 0x258], 1
jmp 0x425b13
jmp 0x425b25
jmp 0x425a69
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x425bb0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.6a954edbdb8305fd1e957
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x425be3
jmp 0x425cc5
lea eax, [ebp - 0x148]
push eax
push 0x454f14
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x425c09
jmp 0x425cc5
cmp dword [ebp - 0x258], 0
jne 0x425cb8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x425c72
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x425c4e
jmp 0x425cc5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x425c70
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x425c82
push str.359b56858f4f7b4339d12
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x425cc5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x425cb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x425cb1
mov dword [ebp - 0x258], 1
jmp 0x425cb3
jmp 0x425cc5
jmp 0x425c09
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x425d70
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x425d97
jmp 0x425de4
cmp dword [ebp - 4], 0x86
jbe 0x425db4
mov ecx, dword [ebp - 4]
push ecx
push str.284b717f419d4581f6fbdd73223b
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x425de4
push str.2f1bb4454df513b55ee9295
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x425dda
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x454f88
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x425de4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x425e70
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x110], 0
push 0x107
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x13c], 0
mov ecx, dword [ebp - 0x13c]
add ecx, 1
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x144], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x140], eax
push 4
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x144]
lea ecx, [ebp + eax - 0x110]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x144]
add edx, 4
mov dword [ebp - 0x144], edx
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 8
lea ecx, [ebp - 0x160]
push ecx
mov edx, dword [ebp - 0x144]
lea eax, [ebp + edx - 0x110]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x144]
add ecx, 8
mov dword [ebp - 0x144], ecx
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x10
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x144]
lea edx, [ebp + ecx - 0x110]
push edx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x144]
add eax, 0x10
mov dword [ebp - 0x144], eax
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 0x144]
lea ecx, [ebp + eax - 0x110]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x144]
add edx, 8
mov dword [ebp - 0x144], edx
call dword [sym.imp.MSVCR90.dll_rand]
mov word [ebp - 0x164], ax
push 2
lea eax, [ebp - 0x164]
push eax
mov ecx, dword [ebp - 0x144]
lea edx, [ebp + ecx - 0x110]
push edx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x144]
add eax, 2
mov dword [ebp - 0x144], eax
call dword [sym.imp.MSVCR90.dll_rand]
mov word [ebp - 0x164], ax
push 2
lea ecx, [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0x144]
lea eax, [ebp + edx - 0x110]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x144]
add ecx, 2
mov dword [ebp - 0x144], ecx
call dword [sym.imp.MSVCR90.dll_rand]
mov word [ebp - 0x164], ax
push 2
lea edx, [ebp - 0x164]
push edx
mov eax, dword [ebp - 0x144]
lea ecx, [ebp + eax - 0x110]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x144]
add edx, 2
mov dword [ebp - 0x144], edx
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
push 8
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x144]
lea eax, [ebp + edx - 0x110]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x144]
add ecx, 8
mov dword [ebp - 0x144], ecx
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x20
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x144]
lea edx, [ebp + ecx - 0x110]
push edx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x144]
add eax, 0x20
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x426210
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x24
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x426237
jmp 0x426284
cmp dword [ebp - 4], 0xb5
jbe 0x426254
mov ecx, dword [ebp - 4]
push ecx
push str.3efb0a9ddd1fc3477e21f27160450a6
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426284
push str.92b511ddc947dd47e7ef93e5cc
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x42627a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x455044
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426284
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x4264a0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.f673a09b8af17b5fde2d
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4264d3
jmp 0x4265b5
lea eax, [ebp - 0x148]
push eax
push 0x455108
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4264f9
jmp 0x4265b5
cmp dword [ebp - 0x258], 0
jne 0x4265a8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x426562
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x42653e
jmp 0x4265b5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x426560
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x426572
push str.438ba71d6b09c939
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x4265b5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4265a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4265a1
mov dword [ebp - 0x258], 1
jmp 0x4265a3
jmp 0x4265b5
jmp 0x4264f9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x4265d0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xe4
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4265fa
jmp 0x426647
cmp dword [ebp - 4], 0xc7
jbe 0x426617
mov ecx, dword [ebp - 4]
push ecx
push str.3801e5ff6ea53eb3aadd023b15ed455
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426647
push str.4f93dcdbf28715df28290
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x42663d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45515c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x426647
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret

Function at 0x426660
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.ca0fd1e1b66ff0277ab7ea3
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x426693
jmp 0x426775
lea eax, [ebp - 0x148]
push eax
push 0x455194
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4266b9
jmp 0x426775
cmp dword [ebp - 0x258], 0
jne 0x426768
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x426722
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4266fe
jmp 0x426775
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x426720
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x426732
push str.09ff98c56ea1bde3
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x426775
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x426763
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x426761
mov dword [ebp - 0x258], 1
jmp 0x426763
jmp 0x426775
jmp 0x4266b9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x426870
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x7d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x426897
jmp 0x4268e1
cmp dword [ebp - 4], 0x7a
jbe 0x4268b1
mov ecx, dword [ebp - 4]
push ecx
push str.1ab15d8386c9e1adc945348bebe93c2
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4268e1
push str.e32bb597e7550df7c1d39cdb5e5
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4268d7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45524c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4268e1
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x4268f0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.b649e843aeff6cb106
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x426921
jmp 0x426a25
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0xec
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x7b
xor edx, edx
div dword [ebp - 0x20]
add edx, 0xc9
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x14f
mov edx, 0x87
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x426979
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x426999
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x426970
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4269c9
jmp 0x426a25
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4269ed
jmp 0x426a25
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x426a30
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4622c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.38df5317f1938b152a8f2783c0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x426a63
jmp 0x426b45
lea eax, [ebp - 0x148]
push eax
push 0x45529c
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x426a89
jmp 0x426b45
cmp dword [ebp - 0x258], 0
jne 0x426b38
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x426af2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x426ace
jmp 0x426b45
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x426af0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x426b02
push str.62afe461a2fb12fbdaeb69
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x426b45
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x426b33
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x426b31
mov dword [ebp - 0x258], 1
jmp 0x426b33
jmp 0x426b45
jmp 0x426a89
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044a380
mov esp, ebp
pop ebp
ret
Function at 0x426b60
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.5e491dd7d043e293b84df509d97
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x426b91
jmp 0x426c92
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x38
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x57
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x7f
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0xa1
mov edx, 0x12
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x426be6
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x426c06
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x426bdd
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x426c36
jmp 0x426c92
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x426c5a
jmp 0x426c92
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret