joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ad60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x96
idiv ecx
inc esi
add dl, 0x29
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41ad96
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41ae17
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41ae17
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x41ae30
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xfe
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41aeb1
cmp eax, 0x2d
jbe 0x41ae73
push eax
push str.e7db6373c7b7559f3c2b16a5a04
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.0ce784f18a3b8e7db0
call esi
test eax, eax
jne 0x41aea9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x41aec0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xfb
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41af41
cmp eax, 0x4f
jbe 0x41af03
push eax
push str.6eb1ae019fc327cdb29778d
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.782f3323e48bb1df8
call esi
test eax, eax
jne 0x41af39
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
Function at 0x41af50
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.b359dbcde9d37af521ddfaa1f2bb429
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41aff7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41aff7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x41b010
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x41aff7
test al, 1
jne 0x41afd5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41afa2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41aff7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.91c96d49c52bf6bf4d3d437bc173b
call fcn.00439b50
add esp, 4
jmp 0x41aff7

Function at 0x41b020
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x50
idiv ecx
inc esi
sub dl, 0xe
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41b056
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41b0d7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41b0d7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret
Function at 0x41b160
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x17
idiv ecx
inc esi
sub dl, 0x2d
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x41b196
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41b217
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x41b217
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x41b230
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.3afd2f4dbba77d999a27d731ba5
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.680136a7de454023d6410
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x41b2a8
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.211bcc5dbb152cd96fad6933177b197
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x41b275
test eax, eax
jne 0x41b2bf
push edi
push str.c9cf1ffbc15957f170_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.829b2d1d3287fd53ce2b00d74e__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x41b2e0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.c06796b7246fd4359975ade91e51b4
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41b387
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41b387
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x41b3a0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x41b387
test al, 1
jne 0x41b365
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41b332
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41b387
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.5533168551b5109f38d1ee45ad2b16
call fcn.00439b50
add esp, 4
jmp 0x41b387
Function at 0x41d910
Capabilities:
Check mutex on windows

Disassembly:
push ecx
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp], eax
cmp dword [esi + 0x198], 0x10
jb 0x41d92c
mov eax, dword [esi + 0x184]
jmp 0x41d932
lea eax, [esi + 0x184]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [esi + 0x17c], eax
test eax, eax
jne 0x41d95f
mov dword [esi + 0x308], 1
mov ecx, dword [esp]
xor ecx, esp
xor eax, eax
call fcn.00439641
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x41d951
push 0
mov dword [esi + 0x308], 0
call fcn.0043b559
int3

Function at 0x41da00
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
push eax
push 0x202
call sub.WS2_32.dll_WSAStartup
call fcn.00439c27
cdq
mov ecx, 0x14
idiv ecx
mov esi, edx
inc esi
call fcn.00439c27
cdq
idiv esi
cmp edx, esi
jg 0x41da49
mov eax, esi
cdq
idiv esi
test edx, edx
je 0x41da4e
call fcn.00418800
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.00439641
add esp, 0x1a0
ret

Function at 0x41ddd0
Capabilities:
Get file attributes

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push esi
push edi
mov edi, 0x10
cmp dword [esp + 0x2c], edi
jae 0x41dde7
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.0043af41
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
jbe 0x41de26
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
call fcn.0041a8a0
call fcn.00431550
cmp ebx, 0xffffffff
jne 0x41de4a
cmp dword [esp + 0x2c], edi
jb 0x41de3e
mov eax, dword [esp + 0x18]
push eax
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
pop edi
pop esi
pop ebx
pop ecx
ret 0x1c
test bl, 0x10
je 0x41de6b
cmp dword [esp + 0x2c], edi
jb 0x41de7e
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00439c49
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
ret 0x1c
cmp dword [esp + 0x2c], edi
jb 0x41de7e
mov edx, dword [esp + 0x18]
push edx
call fcn.00439c49
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 0x1c

Function at 0x41de90
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1010
call fcn.004485b0
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1008], eax
push esi
push 0xfff
lea eax, [esp + 0xd]
push 0
push eax
mov byte [esp + 0x14], 0
call fcn.00440440
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
mov esi, eax
call fcn.0043af41
add esp, 4
test esi, esi
jne 0x41defd
mov eax, 0x80004005
pop esi
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.00439641
add esp, 0x1010
ret
cmp esi, 0x1000
jae 0x41dee2
lea eax, [esp + 8]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41df10
sub eax, edx
push eax
lea edx, [esp + 0xc]
push edx
lea ecx, [edi + 0x19c]
call fcn.00402f50
push 0
call fcn.0043af41
mov ecx, dword [esp + 0x1010]
add esp, 4
pop esi
xor ecx, esp
xor eax, eax
call fcn.00439641
add esp, 0x1010
ret
Function at 0x41f730
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x44d8b8
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.004485b0
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x1000], eax
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x100c]
mov dword fs:[0], eax
push 0xfff
lea eax, [esp + 0xd]
push 0
mov dword [esp + 0x101c], 0
push eax
mov byte [esp + 0x14], 0
call fcn.00440440
mov eax, dword [esp + 0x102c]
mov edi, 0x10
add esp, 0xc
cmp dword [esp + 0x1034], edi
jae 0x41f7ac
lea eax, [esp + 0x1020]
push 0x1000
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x41f7e1
cmp dword [esp + 0x1034], edi
jb 0x41f7da
mov edx, dword [esp + 0x1020]
push edx
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
jmp 0x41f841
cmp eax, 0x1000
jb 0x41f808
cmp dword [esp + 0x1034], edi
jb 0x41f7da
mov eax, dword [esp + 0x1020]
push eax
call fcn.00439c49
add esp, 4
mov eax, 0x80004005
jmp 0x41f841
lea eax, [esp + 8]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41f810
sub eax, edx
push eax
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00402f50
cmp dword [esp + 0x1034], edi
jb 0x41f83f
mov edx, dword [esp + 0x1020]
push edx
call fcn.00439c49
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x100c]
mov dword fs:[0], ecx
pop ecx
pop edi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.00439641
add esp, 0x1010
ret 0x1c
Function at 0x4231b0
Capabilities:
Copy file

Disassembly:
push 0xffffffffffffffff
push 0x44e920
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov ebp, dword [esp + 0xa4]
mov esi, dword [esp + 0xa0]
mov eax, dword [ebp + 0x74]
lea ebx, [esi + 0x2c0]
mov ecx, ebx
call fcn.0042b690
cmp dword [eax + 0x3c], 0
je 0x4233b0
mov edi, 0x10
cmp dword [ebp + 0x70], edi
jb 0x423211
mov ecx, dword [ebp + 0x5c]
jmp 0x423214
lea ecx, [ebp + 0x5c]
cmp dword [esi + 0x25c], edi
jb 0x423224
mov eax, dword [esi + 0x248]
jmp 0x42322a
lea eax, [esi + 0x248]
push 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
mov eax, dword [ebp + 0x74]
mov ecx, ebx
jne 0x4233b7
call fcn.0042b690
inc dword [eax + 0x38]
add eax, 0x38
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042b690
cmp dword [eax + 0x38], 3
jle 0x4233b0
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042b690
cmp dword [eax + 0x18], edi
jb 0x423274
mov eax, dword [eax + 4]
jmp 0x423277
add eax, 4
push eax
lea eax, [esp + 0x20]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [esi + 0x18], 0xf
lea edi, [esi + 4]
mov dword [esi + 0x14], 0
mov byte [edi], 0
mov eax, dword [esi + 0x18]
mov dword [esp + 0x3c], esp
cmp eax, 0x10
jb 0x4232a6
mov ecx, dword [edi]
jmp 0x4232a8
mov ecx, edi
cmp ecx, 0x457464
ja 0x4232e3
cmp eax, 0x10
jb 0x4232b9
mov ecx, dword [edi]
jmp 0x4232bb
mov ecx, edi
mov edx, dword [esi + 0x14]
add edx, ecx
cmp edx, 0x457464
jbe 0x4232e3
cmp eax, 0x10
jb 0x4232cf
mov edi, dword [edi]
push 0x3b
mov eax, 0x457464
sub eax, edi
push eax
push esi
mov ecx, esi
call fcn.00402be0
jmp 0x423327
cmp eax, 0x3b
jae 0x4232f5
mov ecx, dword [esi + 0x14]
push ecx
push 0x3b
mov ecx, esi
call fcn.00403340
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x423301
mov eax, dword [edi]
jmp 0x423303
mov eax, edi
push 0x3b
push 0x457464
push ecx
push eax
call fcn.00439ca9
add esp, 0x10
cmp dword [esi + 0x18], 0x10
mov dword [esi + 0x14], 0x3b
jb 0x423323
mov edi, dword [edi]
mov byte [edi + 0x3b], 0
lea esi, [esp + 0x5c]
call fcn.004014e0
xor edi, edi
mov dword [esp + 0xa0], edi
call fcn.004016a0
mov esi, 0x10
mov byte [esp + 0x9c], 1
cmp dword [eax + 0x18], esi
jb 0x423355
mov eax, dword [eax + 4]
jmp 0x423358
add eax, 4
mov edx, dword [esp + 0xa4]
push eax
push 1
push edx
call fcn.0041da70
add esp, 0x10
cmp dword [esp + 0x34], esi
jb 0x42337e
mov eax, dword [esp + 0x20]
push eax
call fcn.00439c49
add esp, 4
lea esi, [esp + 0x38]
mov dword [esp + 0x34], 0xf
mov dword [esp + 0x30], edi
mov byte [esp + 0x20], 0
mov dword [esp + 0x98], 0xffffffff
call fcn.004037a0
mov eax, dword [ebp + 0x74]
mov ecx, ebx
call fcn.0042b690
mov dword [eax + 0x3c], edi
mov eax, 0x80004005
jmp 0x4233c5
call fcn.0042b690
mov dword [eax + 0x38], 0
xor eax, eax
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x88
ret 8
Function at 0x42e7b0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x451a79
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x30]
xor edx, edx
mov dword [esp + 0x14], edx
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], edx
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], eax
mov byte [edi + 4], dl
mov dword [esp + 0x24], edx
mov eax, dword [esi + 0x18]
mov dword [esp + 0x14], 1
lea ebp, [esi + 4]
cmp eax, 0x10
jb 0x42e810
mov ecx, dword [ebp]
jmp 0x42e812
mov ecx, ebp
mov ebx, dword [esi + 0x14]
add ecx, ebx
mov dword [esp + 0x10], ecx
cmp ecx, edx
je 0x42e841
cmp eax, 0x10
jb 0x42e829
mov edx, dword [ebp]
jmp 0x42e82b
mov edx, ebp
cmp edx, ecx
ja 0x42e841
cmp eax, 0x10
jb 0x42e839
mov eax, dword [ebp]
jmp 0x42e83b
mov eax, ebp
add ebx, eax
cmp ecx, ebx
jbe 0x42e846
call fcn.00439b40
mov ecx, dword [esi + 0x18]
cmp ecx, 0x10
jb 0x42e853
mov ebx, dword [ebp]
jmp 0x42e855
mov ebx, ebp
test ebx, ebx
je 0x42e87a
cmp ecx, 0x10
jb 0x42e863
mov eax, dword [ebp]
jmp 0x42e865
mov eax, ebp
cmp eax, ebx
ja 0x42e87a
cmp ecx, 0x10
jb 0x42e871
mov ebp, dword [ebp]
mov ecx, dword [esi + 0x14]
add ecx, ebp
cmp ebx, ecx
jbe 0x42e87f
call fcn.00439b40
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 0x30]
push esi
push ebx
push esi
push eax
push ecx
push edx
lea eax, [esp + 0x28]
push edi
push eax
call fcn.0042ed60
add esp, 0x24
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x430f50
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xa0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x430fd3
cmp eax, 0xd7
jbe 0x430f95
push eax
push str.48695ebb1fe90c5382158f2f3ea3c
call fcn.00439b50
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.3a11962b5cab94197adb15d9f3f
call esi
test eax, eax
jne 0x430fcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00439b50
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00439641
add esp, 0x68
ret

Function at 0x430ff0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.f55bdf47c187118d3887
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x431097
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x431097
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4310b0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x431097
test al, 1
jne 0x431075
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x431042
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x431097
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00439641
add esp, 0x254
ret
push str.ef03f223fe679b93f
call fcn.00439b50
add esp, 4
jmp 0x431097
Function at 0x4310c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.00440440
add esp, 0xc
xor esi, esi
call fcn.00439c27
cdq
mov ecx, 0x87
idiv ecx
inc esi
sub dl, 0x7a
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4310f6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x431177
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x431177
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00439641
add esp, 0x270
ret

Function at 0x431190
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.537bd5b7e14d08873239d
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.32cb9599ed27d37b92dfd16ba
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x431208
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.d58f572988b94655368d0b1dbc9f3
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x4311d5
test eax, eax
jne 0x43121f
push edi
push str.72e5dd9f0833048fe6195cfb47bb3_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.baefcba5f3f50719d755c00116b9__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4313d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439919
push str.535d43dd68c92a1d9bbdd473f6694d
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00439b50
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.e8c56a5183ad67fb
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x431448
add edi, 0x1000
push edi
push esi
call fcn.00439d26
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.698bd6f11c1b82659
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x431415
test eax, eax
jne 0x43145f
push edi
push str.99c9aa5d0afb397526_d
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.eb831c1bc323a2758aa__d_
call fcn.00439b50
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret