joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419900
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0xffffffffffffffff
push 0x44cd68
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [esp + 0x18], eax
xor eax, eax
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], eax
mov byte [esp + 0x2c], al
mov dword [esp + 0x50], eax
lea ebx, [esp + 0x28]
lea ebp, [eax + 0x19]
call fcn.004393a7
cdq
mov ecx, 0x19
idiv ecx
mov ecx, dword [esp + 0x40]
mov edi, dword [esp + 0x2c]
mov eax, edi
add dl, 0x61
mov byte [esp + 0x1c], dl
cmp ecx, 0x10
jae 0x419980
lea eax, [esp + 0x2c]
mov edx, dword [esp + 0x3c]
lea esi, [eax + edx]
test esi, esi
je 0x4199ab
mov eax, edi
cmp ecx, 0x10
jae 0x419996
lea eax, [esp + 0x2c]
cmp eax, esi
ja 0x4199ab
mov eax, edi
cmp ecx, 0x10
jae 0x4199a5
lea eax, [esp + 0x2c]
add eax, edx
cmp esi, eax
jbe 0x4199b0
call fcn.004392c0
mov edx, dword [esp + 0x1c]
push esi
push ebx
push edx
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x38]
push ecx
call fcn.00402e60
sub ebp, 1
jne 0x419959
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4199e1
cmp dword [esp + 0x40], 0x10
jmp 0x419a5c
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, dword [esp + 0x3c]
inc ecx
push ecx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
jne 0x419a0f
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [esp + 0x40], 0x10
jb 0x419a6b
mov edx, dword [esp + 0x2c]
push edx
jmp 0x419a63
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, 0x10
mov edi, eax
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], ebx
jae 0x419a2b
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x3c]
push ecx
push eax
push edi
call fcn.0043e200
mov edx, dword [esp + 0x48]
add esp, 0xc
push esi
mov byte [edx + edi], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
cmp dword [esp + 0x40], ebx
jb 0x419a6b
mov eax, dword [esp + 0x2c]
push eax
call fcn.004393c9
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00438dc1
add esp, 0x40
ret
Function at 0x419a90
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.129fa927469d02f36823e0
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.ffd55a27d6c1422550c
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x419b08
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.0db12681d787b7670ed133d791d5
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419ad5
test eax, eax
jne 0x419b1f
push edi
push str.cc93d7b9c8856bc39c05cca9485f36b_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.6d6f16ed4dbf1ac9bd13206164cde5e__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x419b40
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.63c9edf3ea07f36b
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419be7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419be7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419c00
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419be7
test al, 1
jne 0x419bc5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419b92
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419be7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.62a7f91b05576eb911bb6f1f5
call fcn.004392d0
add esp, 4
jmp 0x419be7
Function at 0x419c10
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.fc577c613369423b6de
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419cb7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419cb7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419cd0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419cb7
test al, 1
jne 0x419c95
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419c62
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419cb7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.2adf22a7a3196347739190271265428
call fcn.004392d0
add esp, 4
jmp 0x419cb7

Function at 0x419ce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0xa5
idiv ecx
inc esi
add dl, 0x16
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419d16
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419d97
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x419d97
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret
Function at 0x419db0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.2cb976bdb19150cb3
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.b47db38dd9f1a9ede6db46490eaf055
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x419e28
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.9f27f0c553db2bb3063da
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419df5
test eax, eax
jne 0x419e3f
push edi
push str.b185e1b12e07275dc1b17b95df_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.aa6f35251ef920f74475a5__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x419e60
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.40a7b5efc181fce7cf
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x419f07
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x419f07
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x419f20
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x419f07
test al, 1
jne 0x419ee5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x419eb2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x419f07
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.3b1f4471c961c3b775a947d538b151
call fcn.004392d0
add esp, 4
jmp 0x419f07
Function at 0x41a0c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0xee
idiv ecx
inc esi
sub dl, 0x66
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41a0f6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a177
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41a177
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x41a200
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.085f3699edb14cef4405b935ffb99
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.854359a148bf3b959
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a278
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.1f1b9f152a194293bd73ad4d34
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a245
test eax, eax
jne 0x41a28f
push edi
push str.be3b121b9f2bbac588_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.cef33b1105978bc190eb5fcfe7__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x41a2b0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xfd
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41a333
cmp eax, 0xe8
jbe 0x41a2f5
push eax
push str.ac37f151581d15cd
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.7e136d53988d1bcf3393768142
call esi
test eax, eax
jne 0x41a32b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
Function at 0x41a3c0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x31
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41a440
cmp eax, 0xaf
jbe 0x41a402
push eax
push str.8565f82bd343a0a1b
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.f1c3bf33a06b7e95c379a8016cb
call esi
test eax, eax
jne 0x41a438
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret

Function at 0x41a450
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.dc47dd01335ff37b82e1996
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41a4f7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41a4f7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x41a510
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x41a4f7
test al, 1
jne 0x41a4d5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a4a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41a4f7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.9555c271d637827d
call fcn.004392d0
add esp, 4
jmp 0x41a4f7
Function at 0x41a520
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0x26
idiv ecx
inc esi
add dl, 0xb
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41a556
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a5d7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41a5d7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x41a5f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.b93766e9383beef39d17a4a3
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.53237b875615f9a56
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41a668
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.298d0583278df18f8d8bac7154993
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41a635
test eax, eax
jne 0x41a67f
push edi
push str.3c011f4b28194287ee19aea_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.11dd5155fc23f8ef__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41a6a0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.6bc126c11db74d4f5bfb46fbf2
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41a747
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41a747
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x41a760
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x41a747
test al, 1
jne 0x41a725
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a6f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41a747
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.684b550b887f87e3a7cdabad
call fcn.004392d0
add esp, 4
jmp 0x41a747

Function at 0x41a7e0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.d1f5a35d559fea4b4d51d
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41a887
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41a887
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x41a8a0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x41a887
test al, 1
jne 0x41a865
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41a832
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41a887
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.2d27274b3e35345b4
call fcn.004392d0
add esp, 4
jmp 0x41a887
Function at 0x41a8b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0xfe
idiv ecx
inc esi
add dl, 0x6d
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41a8e6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41a967
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41a967
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x41a980
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 9
idiv ecx
inc esi
sub dl, 0x6f
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41a9b6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41aa37
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41aa37
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret