joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4109a0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x44bd48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push edi
mov eax, dword [0x45f2b0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
xor eax, eax
push 0xffffffffffffffff
mov word [esp + 0x14], ax
mov eax, dword [esp + 0x3c]
push edi
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], edi
call fcn.00402f60
mov eax, ebx
mov dword [esp + 0x30], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4109f6
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
lea ecx, [esp + 0x10]
call fcn.00410c00
xor ecx, ecx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push 0xffffffffffffffff
mov word [esi + 4], cx
push edi
mov ecx, esi
call fcn.00402f60
cmp dword [esp + 0x24], 8
jb 0x410a3f
mov edx, dword [esp + 0x10]
push edx
call fcn.00437f8b
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
add esp, 0x2c
ret
Function at 0x4178a0
Capabilities:
Delete file

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x4178b9
fadd qword [0x456798]
call fcn.004471a0
fstp qword [esp + 4]
push 0
call fcn.00439283
add esp, 4
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x4178dc
fadd qword [0x456798]
fcomp qword [esp + 4]
fnstsw ax
test ah, 5
jp 0x4178f8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x417930
Capabilities:
Delete file

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.00439283
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
pop esi
jbe 0x41795c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
ret
xor eax, eax
ret

Function at 0x4179f0
Capabilities:
Delete file

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x417a08
sub eax, 2
je 0x417a08
sub eax, 4
je 0x417a08
xor eax, eax
ret
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, 1
ret

Function at 0x417a90
Capabilities:
Set uefi variable

Disassembly:
sub esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x417aa9
fadd qword [0x456798]
call fcn.004471a0
fstp qword [esp + 4]
push 0
call fcn.00439283
add esp, 4
mov dword [esp], eax
fild dword [esp]
test eax, eax
jge 0x417acc
fadd qword [0x456798]
fcomp qword [esp + 4]
fnstsw ax
test ah, 5
jp 0x417aee
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x417c10
Capabilities:
Set uefi variable

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push 0
shr esi, 0x18
call fcn.00439283
imul eax, eax, 0x63
add esp, 4
cmp esi, eax
pop esi
jbe 0x417c42
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
ret
xor eax, eax
ret
Function at 0x417ed0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.b077501b9651f41b
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x417f77
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x417f77
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x417f90
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x417f77
test al, 1
jne 0x417f55
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417f22
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x417f77
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.e8d936835005ad690
call fcn.00437e92
add esp, 4
jmp 0x417f77

Function at 0x417fa0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.883ddd779f137ab5d94b707b
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418047
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418047
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418060
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418047
test al, 1
jne 0x418025
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x417ff2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418047
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.12cf47d1bb3b28870d67ce
call fcn.00437e92
add esp, 4
jmp 0x418047
Function at 0x418070
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x77
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4180f0
cmp eax, 0xac
jbe 0x4180b2
push eax
push str.8cc7b42d26af9677ed1583b1
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.7a652c3dea257dfd02
call esi
test eax, eax
jne 0x4180e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x418100
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.9ba9a78f3b531f81c2efdd9b
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4181a7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4181a7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4181c0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4181a7
test al, 1
jne 0x418185
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418152
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4181a7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.6c576a25049704077a4d9715a9d3fe
call fcn.00437e92
add esp, 4
jmp 0x4181a7
Function at 0x4182b0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0x7a
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x41832e
cmp eax, 0x52
jbe 0x4182f0
push eax
push str.a1b3084379559b3b
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.ef638433acab09754fe54807d
call esi
test eax, eax
jne 0x418326
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret

Function at 0x4183b0
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xaa
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x418431
cmp eax, 0x2c
jbe 0x4183f3
push eax
push str.695b94ad0819389d4615027b594581c
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.836f0a7501fd43751d
call esi
test eax, eax
jne 0x418429
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
Function at 0x418440
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.46bd35034e0d00bf731771191ad
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4184e7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4184e7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418500
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4184e7
test al, 1
jne 0x4184c5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418492
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4184e7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.aabdf44524df3b590f739b6
call fcn.00437e92
add esp, 4
jmp 0x4184e7

Function at 0x418580
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.4157e12d311f6e437
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418627
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418627
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418640
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418627
test al, 1
jne 0x418605
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4185d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418627
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.726b8dcf49b9aea3ed53c
call fcn.00437e92
add esp, 4
jmp 0x418627
Function at 0x4186c0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.9ea58057a82d9e4d75df38a72db7c8
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418767
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418767
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418780
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418767
test al, 1
jne 0x418745
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418712
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418767
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.ed67eefd63bf0c47241fb6a5c5c7
call fcn.00437e92
add esp, 4
jmp 0x418767

Function at 0x418790
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x4c
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x44], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea edx, [esp]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
call fcn.00437f69
call fcn.00437f69
call fcn.00437f69
lea eax, [esp]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00437983
add esp, 0x4c
ret

Function at 0x418800
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00437c5b
push str.25fbefe33f7fc28df61b6e1d73
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.00437e92
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.29d18e3129fbea43a355ebc7135f062
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x418878
add edi, 0x1000
push edi
push esi
call fcn.00438068
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.f8774da93d993c937b2b952f
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x418845
test eax, eax
jne 0x41888f
push edi
push str.a21bfc83581578dda06d9_d
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.dced6515804dd3792bd7ebf5934__d_
call fcn.00437e92
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4188b0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.28933f4fdd1591b1ae737b49b2d99
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418957
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418957
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418970
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418957
test al, 1
jne 0x418935
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418902
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418957
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.e1b96f8966ab1e6d230d075fa22f1f
call fcn.00437e92
add esp, 4
jmp 0x418957

Function at 0x418980
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 5
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4189fe
cmp eax, 0x25
jbe 0x4189c0
push eax
push str.52fb0dcf0f930ae9d0
call fcn.00437e92
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.752b025312e307ff47
call esi
test eax, eax
jne 0x4189f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.00437e92
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00437983
add esp, 0x68
ret
Function at 0x418a60
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.879d79a9a9a1334b45f189f12983e9
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x418b07
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x418b07
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x418b20
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x418b07
test al, 1
jne 0x418ae5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418ab2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x418b07
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00437983
add esp, 0x254
ret
push str.d1dfe4a108bfbe21141d9d
call fcn.00437e92
add esp, 4
jmp 0x418b07

Function at 0x418b30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0xd8
idiv ecx
inc esi
sub dl, 0x56
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418b66
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418be7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418be7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret
Function at 0x418c00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0xa8
idiv ecx
inc esi
sub dl, 0x4f
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418c36
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418cb7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418cb7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret

Function at 0x418d40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x45f2b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043e780
add esp, 0xc
xor esi, esi
call fcn.00437f69
cdq
mov ecx, 0x3b
idiv ecx
inc esi
sub dl, 0x54
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x418d76
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418df7
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x418df7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00437983
add esp, 0x270
ret