joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418060
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0xfd
idiv ecx
inc esi
add dl, 0x6e
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418096
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418117
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418117
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x418130
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.def54c01c0f9fba5954928
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4181d7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4181d7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4181f0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4181d7
test al, 1
jne 0x4181b5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418182
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4181d7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.110b87e3b3e7d813e54779
call fcn.0043c75a
add esp, 4
jmp 0x4181d7
Function at 0x418270
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x9f
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4182f3
cmp eax, 0x8b
jbe 0x4182b5
push eax
push str.995ffdb97b27084dc1f59d8fed6
call fcn.0043c75a
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.66b1097bb2a5afe545c
call esi
test eax, eax
jne 0x4182eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.0043c75a
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret

Function at 0x418310
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.93d3894fced5f439ea8
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4183f1
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0x48
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0xe0
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0x1d
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x4183a4
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x418382
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x175
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x4183ee
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x4183ee
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret

Function at 0x418470
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push esi
push edi
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4184c4
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea edx, [esp + 8]
push edx
push esi
call edi
test eax, eax
jne 0x4184a6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4184c4
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x254]
pop edi
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
Function at 0x4184e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.0043c523
push str.c3b7fbb1fa9fccab1fe9a
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.0043c75a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.850719e7da935a1558d71f0f55cd2
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x418558
add edi, 0x1000
push edi
push esi
call fcn.0043c8db
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.6cbde10514bdde4190951
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x418525
test eax, eax
jne 0x41856f
push edi
push str.a8e97b1703c5de71192d0e11aff7_d
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.5f471c9bfd9dd0f52fb9557__d_
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x418590
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x1d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x418610
cmp eax, 0xd4
jbe 0x4185d2
push eax
push str.19d70e59a377501d3a838d21373d4c
call fcn.0043c75a
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.2af3f5cb2a195d8b257bacb7e847f6
call esi
test eax, eax
jne 0x418608
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.0043c75a
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret

Function at 0x418690
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.0043c523
push str.5947246bf641e2498775328b5e5bdd
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.0043c75a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.5bcbd8c7d7bbab85a7191
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x418708
add edi, 0x1000
push edi
push esi
call fcn.0043c8db
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.49bdb82d86cddb7bf0a3f
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x4186d5
test eax, eax
jne 0x41871f
push edi
push str.8937662720ad6777_d
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.022dff3b14a96c7de30__d_
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4187c0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
sub esp, 0x30
push esi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.d42b2fbd4b6f3c05b29bbbad084f5f
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x41889e
push ebx
push ebp
push edi
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [esp + 0x38]
xor edx, edx
mov eax, 0xe8
div ecx
xor edx, edx
mov edi, ecx
mov dword [esp + 0x10], 0
mov ebp, eax
mov eax, 0x2a
imul ebp, ecx
div ecx
mov ebx, edx
add ebx, 0x4a
mov dword [esp + 0x14], ebx
test ecx, ecx
jle 0x418854
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 4
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
mov eax, dword [esp + 0x10]
inc eax
cmp eax, edi
mov dword [esp + 0x10], eax
jl 0x418832
mov ebx, dword [esp + 0x14]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push 0x79
push 0
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
je 0x41889b
push ebx
push ebp
push 0
push 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
je 0x41889b
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push esi
call edi
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x30
ret

Function at 0x4188b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x3e
idiv ecx
inc esi
add dl, 0x48
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4188e6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418967
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418967
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret
Function at 0x418980
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.a5c91de38c3dbb19471d4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418a27
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418a27
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418a40
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418a27
test al, 1
jne 0x418a05
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4189d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418a27
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.1b21bf2141b9f805fd434e05
call fcn.0043c75a
add esp, 4
jmp 0x418a27

Function at 0x418af0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.7a313a79406d7a8d0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418b97
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418b97
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418bb0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418b97
test al, 1
jne 0x418b75
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418b42
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418b97
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.2821ecb1a2cd60f941
call fcn.0043c75a
add esp, 4
jmp 0x418b97
Function at 0x418bc0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x6d
idiv ecx
inc esi
add dl, 8
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418bf6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418c77
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418c77
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x418c90
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xb0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x418d11
cmp eax, 0x29
jbe 0x418cd3
push eax
push str.513754af6d57f50bb849715d88151ef
call fcn.0043c75a
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.0dbf058d2e95a013a
call esi
test eax, eax
jne 0x418d09
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.0043c75a
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0043c2d9
add esp, 0x68
ret
Function at 0x418d20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x7b
idiv ecx
inc esi
add dl, 0x43
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418d56
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418dd7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418dd7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x418df0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.d59f8b5f8b33acd5d773507384c7ec2
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418e97
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418e97
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418eb0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418e97
test al, 1
jne 0x418e75
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418e42
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418e97
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043c2d9
add esp, 0x254
ret
push str.c8914c39b3cf48b9bcd98
call fcn.0043c75a
add esp, 4
jmp 0x418e97
Function at 0x418ec0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x1b
idiv ecx
inc esi
add dl, 0x2a
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418ef6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418f77
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418f77
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x418f90
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
and eax, 0x80000007
jns 0x418fd7
dec eax
or eax, 0xfffffff8
inc eax
add al, 0xe
mov byte [esp + esi + 0x160], al
inc esi
cmp esi, 0x19
jl 0x418fc6
xor eax, eax
lea ecx, [esp + 0x160]
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41904a
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41904a
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x34]
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x10]
mov dword [esp + 8], ecx
push eax
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x14], edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret
Function at 0x419140
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x467334]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00444d20
add esp, 0xc
xor esi, esi
call fcn.0043c831
cdq
mov ecx, 0x37
idiv ecx
inc esi
add dl, 8
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x419176
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4191f7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4191f7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.0043c2d9
add esp, 0x270
ret

Function at 0x4192f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.0043c523
push str.df81572d600b27a5
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.0043c75a
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.57259a97a86761edc
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x419368
add edi, 0x1000
push edi
push esi
call fcn.0043c8db
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.f58356e39b6fc69f41f9
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x419335
test eax, eax
jne 0x41937f
push edi
push str.e9ff9b717cc5d6abb2b337475de_d
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.13376c576447d1e7ea9__d_
call fcn.0043c75a
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret