joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f6a0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x9e
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41f6ca
jmp 0x41f714
cmp dword [ebp - 4], 0x1c
jbe 0x41f6e4
mov ecx, dword [ebp - 4]
push ecx
push str.18d5394bd83988dfa
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41f714
push str.b60317c5d1e3374136616
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41f70a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452b6c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41f714
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x41f830
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.0943b081455fc45f76719b5ba22938
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41f863
jmp 0x41f945
lea eax, [ebp - 0x148]
push eax
push 0x452bfc
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41f889
jmp 0x41f945
cmp dword [ebp - 0x258], 0
jne 0x41f938
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41f8f2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41f8ce
jmp 0x41f945
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41f8f0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41f902
push str.3d17e2fb625bf56d5b715
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41f945
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41f933
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41f931
mov dword [ebp - 0x258], 1
jmp 0x41f933
jmp 0x41f945
jmp 0x41f889
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x41f960
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.cfc9afb5168b0f1d5b971b779
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x41f991
jmp 0x41fa95
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0xee
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x72
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x83
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x71
mov edx, 0xfd
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x41f9e9
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x41fa09
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41f9e0
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x41fa39
jmp 0x41fa95
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x41fa5d
jmp 0x41fa95
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x41fb80
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x4b
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41fba7
jmp 0x41fbf1
cmp dword [ebp - 4], 0x55
jbe 0x41fbc1
mov ecx, dword [ebp - 4]
push ecx
push str.00e3709fe0cdec7b65ab92
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41fbf1
push str.0d5d9edd64071dedf0f39
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41fbe7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452c88
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41fbf1
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x41fc00
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x8d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41fc2a
jmp 0x41fc77
cmp dword [ebp - 4], 0xd3
jbe 0x41fc47
mov ecx, dword [ebp - 4]
push ecx
push str.bcbbe44d6abd8fcf6
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41fc77
push str.3d4552cd9a852bcbba8f52df17
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41fc6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452cd8
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41fc77
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x41fc90
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x1a
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41fcb7
jmp 0x41fd04
cmp dword [ebp - 4], 0xe0
jbe 0x41fcd4
mov ecx, dword [ebp - 4]
push ecx
push str.adaf0ac7954198758f5f6ff1a9
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41fd04
push str.7c61a6f788c942f3e87b23
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41fcfa
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452d2c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41fd04
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x41fd20
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xd7
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41fd4a
jmp 0x41fd94
cmp dword [ebp - 4], 0x5a
jbe 0x41fd64
mov ecx, dword [ebp - 4]
push ecx
push str.b747c31b03e1c12f85
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41fd94
push str.bc09799763432717217787a7609311
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41fd8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452d80
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41fd94
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x41fe40
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.2fa7839fea492777d1c70d330
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41fe73
jmp 0x41ff55
lea eax, [ebp - 0x148]
push eax
push 0x452dd8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41fe99
jmp 0x41ff55
cmp dword [ebp - 0x258], 0
jne 0x41ff48
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41ff02
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41fede
jmp 0x41ff55
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41ff00
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41ff12
push str.f7f9fa0bc2c36d338bf7d1cda4bb1df
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41ff55
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41ff43
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41ff41
mov dword [ebp - 0x258], 1
jmp 0x41ff43
jmp 0x41ff55
jmp 0x41fe99
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x420090
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4200b7
jmp 0x420101
cmp dword [ebp - 4], 1
jbe 0x4200d1
mov ecx, dword [ebp - 4]
push ecx
push str.2733ccfd6ec52665a5793
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x420101
push str.f9073b971faf226d7607ad232
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4200f7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452e68
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x420101
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x420110
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.9a9568f17bc593697e6f406ba6af4f2
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x420143
jmp 0x420225
lea eax, [ebp - 0x148]
push eax
push 0x452ea8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x420169
jmp 0x420225
cmp dword [ebp - 0x258], 0
jne 0x420218
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4201d2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4201ae
jmp 0x420225
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x4201d0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x4201e2
push str.c935e97f65ffdd4da25b7e27e
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x420225
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x420213
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x420211
mov dword [ebp - 0x258], 1
jmp 0x420213
jmp 0x420225
jmp 0x420169
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x420490
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.f311318f351111f3d7f5
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4204c3
jmp 0x4205a5
lea eax, [ebp - 0x148]
push eax
push 0x452f44
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4204e9
jmp 0x4205a5
cmp dword [ebp - 0x258], 0
jne 0x420598
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x420552
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x42052e
jmp 0x4205a5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x420550
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x420562
push str.b027b03790598f57
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x4205a5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x420593
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x420591
mov dword [ebp - 0x258], 1
jmp 0x420593
jmp 0x4205a5
jmp 0x4204e9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x4205c0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.39a36ce1229984fbfda1b
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x4205f1
jmp 0x4206f5
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 5
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0xc3
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x86
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x1c
mov edx, 0x8f
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x420649
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x420669
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x420640
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x420699
jmp 0x4206f5
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4206bd
jmp 0x4206f5
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x420700
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x5d
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x420727
jmp 0x420771
cmp dword [ebp - 4], 0x3f
jbe 0x420741
mov ecx, dword [ebp - 4]
push ecx
push str.b9bff86d3f7bc6636d5555e7d2db
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x420771
push str.c2919b93eb719795bac369c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x420767
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x452fb0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x420771
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x420780
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x92
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4207aa
jmp 0x4207f7
cmp dword [ebp - 4], 0xa4
jbe 0x4207c7
mov ecx, dword [ebp - 4]
push ecx
push str.7b69e3270f1b4b211b4
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4207f7
push str.d809dbb7224522a5cac9e677a
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x4207ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x453000
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x4207f7
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret
Function at 0x4208f0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.873f1da5d7e1d1470ba78c3
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x420921
jmp 0x420a25
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x91
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x88
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x89
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x1aa
mov edx, 0x96
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x420979
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x420999
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x420970
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x4209c9
jmp 0x420a25
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x4209ed
jmp 0x420a25
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x420a30
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x14
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x420a57
jmp 0x420aa4
cmp dword [ebp - 4], 0xce
jbe 0x420a74
mov ecx, dword [ebp - 4]
push ecx
push str.4545fa7982737d2fb8e1566d8ec12a
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x420aa4
push str.e6c77e39a4a55b7d677b2553
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x420a9a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x453094
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x420aa4
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret

Function at 0x420ac0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4612c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.c3dbf5efdb170053bde17b
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x420af3
jmp 0x420bd5
lea eax, [ebp - 0x148]
push eax
push 0x4530cc
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x420b19
jmp 0x420bd5
cmp dword [ebp - 0x258], 0
jne 0x420bc8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x420b82
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x420b5e
jmp 0x420bd5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x420b80
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x420b92
push str.2743c6316fe5522b3491fb93be
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x420bd5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x420bc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x420bc1
mov dword [ebp - 0x258], 1
jmp 0x420bc3
jmp 0x420bd5
jmp 0x420b19
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00449600
mov esp, ebp
pop ebp
ret