joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4445f0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.8081883538b7e2b1fb2
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x444621
jmp 0x444722
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 9
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0xe3
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x5b
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x62
mov edx, 0xa
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x444676
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x444696
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x44466d
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4446c6
jmp 0x444722
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4446ea
jmp 0x444722
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x4448c0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.28a13f497c79f65355eb2b8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4448f3
jmp 0x4449d5
lea eax, [ebp - 0x148]
push eax
push 0x456298
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x444919
jmp 0x4449d5
cmp dword [ebp - 0x258], 0
jne 0x4449c8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x444982
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x44495e
jmp 0x4449d5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x444980
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x444992
push str.99a34251b639b18d57d943f96
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x4449d5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4449c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4449c1
mov dword [ebp - 0x258], 1
jmp 0x4449c3
jmp 0x4449d5
jmp 0x444919
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x4449f0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x25
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444a17
jmp 0x444a61
cmp dword [ebp - 4], 0x41
jbe 0x444a31
mov ecx, dword [ebp - 4]
push ecx
push str.c2c76b1d43f511bf
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444a61
push str.3bdbe8ff7497d01b1c898cb364b9687
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x444a57
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4562f0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444a61
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x444a70
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x3d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444a97
jmp 0x444ae4
cmp dword [ebp - 4], 0xec
jbe 0x444ab4
mov ecx, dword [ebp - 4]
push ecx
push str.0de9ad31fdeb236b01c7387f63d324b
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444ae4
push str.f353e7b53051ff97c763bc8baf4
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x444ada
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x45634c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444ae4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x444b00
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x52
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444b27
jmp 0x444b74
cmp dword [ebp - 4], 0x82
jbe 0x444b44
mov ecx, dword [ebp - 4]
push ecx
push str.cec961c99699e19dab9996
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444b74
push str.3d936269c2b3945bab3d18e3376d
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x444b6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4563a4
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444b74
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x444b90
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x8f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444bba
jmp 0x444c07
cmp dword [ebp - 4], 0xdd
jbe 0x444bd7
mov ecx, dword [ebp - 4]
push ecx
push str.0d298795aa759e41f4
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444c07
push str.f119aaf1a77b73fd8
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x444bfd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4563ec
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444c07
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x444d00
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.784532cd6c3bf339f949f75fa8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x444d33
jmp 0x444e15
lea eax, [ebp - 0x148]
push eax
push 0x456488
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x444d59
jmp 0x444e15
cmp dword [ebp - 0x258], 0
jne 0x444e08
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x444dc2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x444d9e
jmp 0x444e15
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x444dc0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x444dd2
push str.06ad29af54bb383b7d25080b62c9c7
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x444e15
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x444e03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x444e01
mov dword [ebp - 0x258], 1
jmp 0x444e03
jmp 0x444e15
jmp 0x444d59
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x444f10
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x7b
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444f37
jmp 0x444f81
cmp dword [ebp - 4], 0x7c
jbe 0x444f51
mov ecx, dword [ebp - 4]
push ecx
push str.33c3d6553e8109414699
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444f81
push str.57b381090fe1e1a994c19813f6a7e6
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x444f77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x456508
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x444f81
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x444f90
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xd5
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x444fba
jmp 0x445004
cmp dword [ebp - 4], 0x25
jbe 0x444fd4
mov ecx, dword [ebp - 4]
push ecx
push str.1df96a2bfda305f1a43f2591874
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x445004
push str.d433a5135ffda209116
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x444ffa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x456558
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x445004
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x445020
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x6e
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x445047
jmp 0x445091
cmp dword [ebp - 4], 0x5d
jbe 0x445061
mov ecx, dword [ebp - 4]
push ecx
push str.23457c29e7b156633addaea15
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x445091
push str.5139812b38f19b2b36c1809ba31
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x445087
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x4565b0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x445091
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x445130
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.257b81d3012f1c577c0f5
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x445163
jmp 0x445245
lea eax, [ebp - 0x148]
push eax
push 0x456600
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x445189
jmp 0x445245
cmp dword [ebp - 0x258], 0
jne 0x445238
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4451f2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4451ce
jmp 0x445245
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x4451f0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x445202
push str.cc376fb93a3d6df581
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x445245
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x445233
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x445231
mov dword [ebp - 0x258], 1
jmp 0x445233
jmp 0x445245
jmp 0x445189
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x4453b0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.0fff8dcf3c5188d1ab9b7947017
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4453e1
jmp 0x4454e5
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0xfa
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 6
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x86
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0xf9
mov edx, 0x9a
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x445439
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x445459
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x445430
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x445489
jmp 0x4454e5
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4454ad
jmp 0x4454e5
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x4454f0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.fec32d87a6cdc32d8ae33
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x445523
jmp 0x445605
lea eax, [ebp - 0x148]
push eax
push 0x4566ac
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x445549
jmp 0x445605
cmp dword [ebp - 0x258], 0
jne 0x4455f8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4455b2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x44558e
jmp 0x445605
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x4455b0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x4455c2
push str.06199ced6d6f41d364434a0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x445605
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4455f3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4455f1
mov dword [ebp - 0x258], 1
jmp 0x4455f3
jmp 0x445605
jmp 0x445549
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x445820
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.dbcff317bc2d5c7d8fb1250f15f3f6
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x445853
jmp 0x445935
lea eax, [ebp - 0x148]
push eax
push 0x456788
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x445879
jmp 0x445935
cmp dword [ebp - 0x258], 0
jne 0x445928
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4458e2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4458be
jmp 0x445935
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x4458e0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x4458f2
push str.d755ab1fe49101231a93a333a3610
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x445935
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x445923
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x445921
mov dword [ebp - 0x258], 1
jmp 0x445923
jmp 0x445935
jmp 0x445879
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x445950
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.a1a18e7d3ad9a75b
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x445981
jmp 0x445a85
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 1
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x27
xor edx, edx
div dword [ebp - 0x20]
add edx, 0xd5
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x14e
mov edx, 0xf
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x4459d9
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x4459f9
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4459d0
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x445a29
jmp 0x445a85
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x445a4d
jmp 0x445a85
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x445b00
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.6fa7287d32b7f82ff42db065
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x445b33
jmp 0x445c15
lea eax, [ebp - 0x148]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x445b59
jmp 0x445c15
cmp dword [ebp - 0x258], 0
jne 0x445c08
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x445bc2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x445b9e
jmp 0x445c15
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x445bc0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x445bd2
push str.f88dca29bfeb03cb1a1dbd35fe29
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x445c15
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x445c03
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x445c01
mov dword [ebp - 0x258], 1
jmp 0x445c03
jmp 0x445c15
jmp 0x445b59
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret