joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41c790
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x41c7e2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x41c80b
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x4d
idiv ecx
add edx, 0x7f
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x41c7d3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x41c83c
jmp 0x41c8ad
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x41c861
jmp 0x41c8ad
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x41c89c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x41cb40
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x2000
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push str.b86f11b5da51cd912d7b7e2362
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.4a737caf65bbb839712d28f1
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xea
jne 0x41cbe0
mov ecx, dword [ebp - 0xc]
add ecx, 0x1000
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.49c5741f9d153f83402d46b3587
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
jmp 0x41cb90
cmp dword [ebp - 4], 0
jne 0x41cbfa
mov ecx, dword [ebp - 0xc]
push ecx
push str.dd99b277d6ef8c3360c37_d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41cc0c
mov edx, dword [ebp - 4]
push edx
push str.748f2631beff43574265b7d33b__d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41cc80
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x3c
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41cca7
jmp 0x41ccf1
cmp dword [ebp - 4], 0x72
jbe 0x41ccc1
mov ecx, dword [ebp - 4]
push ecx
push str.917f6a8feff1c769be11c74f36d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41ccf1
push str.ff47b65393abf4096a23
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41cce7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46ddf8
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41ccf1
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41cd00
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.feb5a7b903d51c61
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x41cd31
jmp 0x41ce35
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x16
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x42
xor edx, edx
div dword [ebp - 0x20]
add edx, 0xca
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x77
mov edx, 0xb1
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x41cd89
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x41cda9
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x41cd80
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x41cdd9
jmp 0x41ce35
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x41cdfd
jmp 0x41ce35
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x41ce40
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.f70dbc714f0b96c1496f7
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41ce73
jmp 0x41cf55
lea eax, [ebp - 0x148]
push eax
push 0x46de44
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41ce99
jmp 0x41cf55
cmp dword [ebp - 0x258], 0
jne 0x41cf48
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41cf02
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41cede
jmp 0x41cf55
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41cf00
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41cf12
push str.85f5abf338c709cb5
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41cf55
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41cf43
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41cf41
mov dword [ebp - 0x258], 1
jmp 0x41cf43
jmp 0x41cf55
jmp 0x41ce99
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41cf70
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.1673b1f9ac7918a3f88fc
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41cfa3
jmp 0x41d085
lea eax, [ebp - 0x148]
push eax
push 0x46de78
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41cfc9
jmp 0x41d085
cmp dword [ebp - 0x258], 0
jne 0x41d078
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41d032
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41d00e
jmp 0x41d085
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41d030
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41d042
push str.054fa6c51ef10fa76543d30d0c33e
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41d085
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41d073
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41d071
mov dword [ebp - 0x258], 1
jmp 0x41d073
jmp 0x41d085
jmp 0x41cfc9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41d180
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x41d1d2
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x41d1fe
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xb9
idiv ecx
add edx, 0xc0
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x41d1c3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x41d22f
jmp 0x41d2a0
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x41d254
jmp 0x41d2a0
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x41d28f
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x41d400
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xc3
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x41d42a
jmp 0x41d474
cmp dword [ebp - 4], 0x24
jbe 0x41d444
mov ecx, dword [ebp - 4]
push ecx
push str.a0fd40b7e0091df5ca63
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41d474
push str.9d7fe44f6aeb5953cd51e20d4
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41d46a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x46df50
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41d474
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41d830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x41d882
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x41d8ab
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0xe9
idiv ecx
add edx, 0x5b
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x41d873
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x41d8dc
jmp 0x41d94d
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x41d901
jmp 0x41d94d
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x41d93c
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x41d960
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x2000
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push str.62958a55e7e52899
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.93cbbf0db44db8e1a20196736c8507
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xea
jne 0x41da00
mov ecx, dword [ebp - 0xc]
add ecx, 0x1000
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.720d9c2d1b7b54df
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
jmp 0x41d9b0
cmp dword [ebp - 4], 0
jne 0x41da1a
mov ecx, dword [ebp - 0xc]
push ecx
push str.00f9c49b7fb3f853dd21dd9b7edf_d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41da2c
mov edx, dword [ebp - 4]
push edx
push str.1f235277fa5f83d90f2f__d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov esp, ebp
pop ebp
ret
Function at 0x41da30
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0xffffffff
mov dword [ebp - 0x254], 0
lea eax, [ebp - 0x148]
push eax
lea ecx, [ebp - 0x250]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x258], eax
cmp dword [ebp - 0x258], 0xffffffff
jne 0x41da7c
jmp 0x41dadd
mov edx, dword [ebp - 0x148]
and edx, 0x10
je 0x41da89
jmp 0x41daa1
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x12c]
mov dword [ebp - 0x25c], ecx
lea edx, [ebp - 0x148]
push edx
mov eax, dword [ebp - 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41da7c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0x12
je 0x41dad0
jmp 0x41dadd
mov ecx, dword [ebp - 0x258]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret

Function at 0x41db60
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.35072b7322cd664573
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41db93
jmp 0x41dc75
lea eax, [ebp - 0x148]
push eax
push 0x46e040
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41dbb9
jmp 0x41dc75
cmp dword [ebp - 0x258], 0
jne 0x41dc68
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41dc22
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41dbfe
jmp 0x41dc75
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41dc20
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41dc32
push str.291b2a7f2bf1ef99420b125feab
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41dc75
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41dc63
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41dc61
mov dword [ebp - 0x258], 1
jmp 0x41dc63
jmp 0x41dc75
jmp 0x41dbb9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41dd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0x2000
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
push str.9f453f0f36b76d130
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.71f945b91993068f845741
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xea
jne 0x41ddc0
mov ecx, dword [ebp - 0xc]
add ecx, 0x1000
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.MSVCR90.dll_realloc]
add esp, 8
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
push 0
push 0
push str.807b0783e939c18d9a95da47682f4
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 4], eax
jmp 0x41dd70
cmp dword [ebp - 4], 0
jne 0x41ddda
mov ecx, dword [ebp - 0xc]
push ecx
push str.dd11b777297b2cb9807fb08d529d389_d
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x41ddec
mov edx, dword [ebp - 4]
push edx
push str.ea3bf25f44d79ca977e94__d_
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
mov esp, ebp
pop ebp
ret

Function at 0x41e080
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.40e555db6b851e41d6c3b785014bbf
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x41e0b3
jmp 0x41e195
lea eax, [ebp - 0x148]
push eax
push 0x46e140
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x41e0d9
jmp 0x41e195
cmp dword [ebp - 0x258], 0
jne 0x41e188
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x41e142
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x41e11e
jmp 0x41e195
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x41e140
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41e152
push str.403f80114a67e661d8530c3dc11
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x41e195
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41e183
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x41e181
mov dword [ebp - 0x258], 1
jmp 0x41e183
jmp 0x41e195
jmp 0x41e0d9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret
Function at 0x41e1b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x47e0b0]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov byte [ebp - 0x129], 0
mov dword [ebp - 0x27c], 0
jmp 0x41e202
mov ecx, dword [ebp - 0x27c]
add ecx, 1
mov dword [ebp - 0x27c], ecx
cmp dword [ebp - 0x27c], 0x19
jge 0x41e22e
call dword [sym.imp.MSVCR90.dll_rand]
cdq
mov ecx, 0x5c
idiv ecx
add edx, 0xb0
mov eax, dword [ebp - 0x27c]
mov byte [ebp + eax - 0x118], dl
jmp 0x41e1f3
push 0x10
push 0
lea ecx, [ebp - 0x128]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x41e25f
jmp 0x41e2d0
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0xffffffff
jne 0x41e284
jmp 0x41e2d0
mov edx, dword [ebp - 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x25c]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x258]
mov dword [ebp - 4], ecx
movzx edx, byte [ebp - 0x129]
test edx, edx
je 0x41e2bf
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x25c]
push ecx
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea edx, [ebp - 0x128]
push edx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00462030
mov esp, ebp
pop ebp
ret