joyce8/EMBER2024-capa huggingface dataset:
Function at 0x446870
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.dac54b858011c1e9824bc24
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4468a3
jmp 0x446985
lea eax, [ebp - 0x148]
push eax
push 0x458a38
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4468c9
jmp 0x446985
cmp dword [ebp - 0x258], 0
jne 0x446978
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x446932
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x44690e
jmp 0x446985
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x446930
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x446942
push str.883ffc1df031e4cbd
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x446985
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x446973
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x446971
mov dword [ebp - 0x258], 1
jmp 0x446973
jmp 0x446985
jmp 0x4468c9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x446a30
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x164
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x110], 0
push 0x107
push 0
lea eax, [ebp - 0x10f]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x13c], 0
mov ecx, dword [ebp - 0x13c]
add ecx, 1
mov dword [ebp - 0x13c], ecx
mov dword [ebp - 0x144], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x140], eax
push 4
lea edx, [ebp - 0x140]
push edx
mov eax, dword [ebp - 0x144]
lea ecx, [ebp + eax - 0x110]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x144]
add edx, 4
mov dword [ebp - 0x144], edx
lea eax, [ebp - 0x160]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push 8
lea ecx, [ebp - 0x160]
push ecx
mov edx, dword [ebp - 0x144]
lea eax, [ebp + edx - 0x110]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x144]
add ecx, 8
mov dword [ebp - 0x144], ecx
lea edx, [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push 0x10
lea eax, [ebp - 0x154]
push eax
mov ecx, dword [ebp - 0x144]
lea edx, [ebp + ecx - 0x110]
push edx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x144]
add eax, 0x10
mov dword [ebp - 0x144], eax
lea ecx, [ebp - 0x138]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
push 8
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 0x144]
lea ecx, [ebp + eax - 0x110]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x144]
add edx, 8
mov dword [ebp - 0x144], edx
call dword [sym.imp.MSVCR90.dll_rand]
mov word [ebp - 0x164], ax
push 2
lea eax, [ebp - 0x164]
push eax
mov ecx, dword [ebp - 0x144]
lea edx, [ebp + ecx - 0x110]
push edx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x144]
add eax, 2
mov dword [ebp - 0x144], eax
call dword [sym.imp.MSVCR90.dll_rand]
mov word [ebp - 0x164], ax
push 2
lea ecx, [ebp - 0x164]
push ecx
mov edx, dword [ebp - 0x144]
lea eax, [ebp + edx - 0x110]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x144]
add ecx, 2
mov dword [ebp - 0x144], ecx
call dword [sym.imp.MSVCR90.dll_rand]
mov word [ebp - 0x164], ax
push 2
lea edx, [ebp - 0x164]
push edx
mov eax, dword [ebp - 0x144]
lea ecx, [ebp + eax - 0x110]
push ecx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov edx, dword [ebp - 0x144]
add edx, 2
mov dword [ebp - 0x144], edx
lea eax, [ebp - 0x138]
push eax
call dword [sym.imp.USER32.dll_GetCaretPos]
push 8
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0x144]
lea eax, [ebp + edx - 0x110]
push eax
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp - 0x144]
add ecx, 8
mov dword [ebp - 0x144], ecx
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push 0x20
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp - 0x144]
lea edx, [ebp + ecx - 0x110]
push edx
call sub.MSVCR90.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x144]
add eax, 0x20
mov dword [ebp - 0x144], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x446db0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.8d2f0fb7760d19a549e
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x446de3
jmp 0x446ec5
lea eax, [ebp - 0x148]
push eax
push 0x458ad0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x446e09
jmp 0x446ec5
cmp dword [ebp - 0x258], 0
jne 0x446eb8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x446e72
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x446e4e
jmp 0x446ec5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x446e70
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x446e82
push str.34f76dc988bb5389dc934f
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x446ec5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x446eb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x446eb1
mov dword [ebp - 0x258], 1
jmp 0x446eb3
jmp 0x446ec5
jmp 0x446e09
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x446ee0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x89
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x446f0a
jmp 0x446f57
cmp dword [ebp - 4], 0xbd
jbe 0x446f27
mov ecx, dword [ebp - 4]
push ecx
push str.45f969153757e3b1dfa99593efc7
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x446f57
push str.1b2d880d87fd4d5b6317503d5e
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x446f4d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x458b2c
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x446f57
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x4470c0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4470e7
jmp 0x447134
cmp dword [ebp - 4], 0x8f
jbe 0x447104
mov ecx, dword [ebp - 4]
push ecx
push str.79adc3e9eaeb0b2377a3a40fbce
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x447134
push str.f8ad95bfb451f0238b770cf14e8576a
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44712a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x458bd8
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x447134
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x4471c0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0x96
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4471ea
jmp 0x447234
cmp dword [ebp - 4], 0x56
jbe 0x447204
mov ecx, dword [ebp - 4]
push ecx
push str.0f2522ff69b3cb2f50dd60d3e
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x447234
push str.3b8b40a539a52c9355
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x44722a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x458c54
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x447234
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x447250
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.e7214c8f609b73537aed9fbd0dd
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x447283
jmp 0x447365
lea eax, [ebp - 0x148]
push eax
push 0x458c90
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4472a9
jmp 0x447365
cmp dword [ebp - 0x258], 0
jne 0x447358
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447312
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x4472ee
jmp 0x447365
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x447310
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x447322
push str.5fcffcf5d4f986eb69ff616
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x447365
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x447353
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x447351
mov dword [ebp - 0x258], 1
jmp 0x447353
jmp 0x447365
jmp 0x4472a9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x4475a0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.f76d8da785871193a84df1
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4475d3
jmp 0x4476b5
lea eax, [ebp - 0x148]
push eax
push 0x458d44
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x4475f9
jmp 0x4476b5
cmp dword [ebp - 0x258], 0
jne 0x4476a8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447662
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x44763e
jmp 0x4476b5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x447660
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x447672
push str.39e7559de079c545a8a163a9342ba
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x4476b5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4476a3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4476a1
mov dword [ebp - 0x258], 1
jmp 0x4476a3
jmp 0x4476b5
jmp 0x4475f9
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x4479b0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.4e275d43ff733d2dde811
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4479e3
jmp 0x447ac5
lea eax, [ebp - 0x148]
push eax
push 0x458e50
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x447a09
jmp 0x447ac5
cmp dword [ebp - 0x258], 0
jne 0x447ab8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447a72
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x447a4e
jmp 0x447ac5
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x447a70
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x447a82
push str.bfefd22956fdd4d9f99de
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x447ac5
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x447ab3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x447ab1
mov dword [ebp - 0x258], 1
jmp 0x447ab3
jmp 0x447ac5
jmp 0x447a09
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x447ae0
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.0d8f169365c768bd800384
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x447b11
jmp 0x447c12
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0xc7
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0xd1
xor edx, edx
div dword [ebp - 0x20]
add edx, 0x4e
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x105
mov edx, 0x19
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x447b66
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x447b86
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x447b5d
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x447bb6
jmp 0x447c12
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x447bda
jmp 0x447c12
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x447c20
Capabilities:
Get file size
Get system information on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push str.9afd81e97e195111727
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0xffffffff
jne 0x447c51
jmp 0x447d55
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x40]
mov dword [ebp - 0x20], ecx
mov eax, 0x57
xor edx, edx
div dword [ebp - 0x20]
imul eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, 0x90
xor edx, edx
div dword [ebp - 0x20]
add edx, 0xa0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0x88
mov edx, 0xb3
sub edx, dword [ebp - 0x38]
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x14], 0
jmp 0x447ca9
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 0x20]
jge 0x447cc9
push 0
lea edx, [ebp - 0x24]
push edx
push 4
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x447ca0
push 0
mov edx, dword [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0
push 4
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
jne 0x447cf9
jmp 0x447d55
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x38]
push eax
push 0
push 0xf001f
mov ecx, dword [ebp - 0x30]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x447d1d
jmp 0x447d55
mov edx, dword [ebp - 0x34]
add edx, dword [ebp - 0x2c]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], eax
mov esp, ebp
pop ebp
ret
Function at 0x447d60
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp - 0x70]
push eax
push 0xab
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x447d8a
jmp 0x447dd7
cmp dword [ebp - 4], 0xc1
jbe 0x447da7
mov ecx, dword [ebp - 4]
push ecx
push str.65e77a63f0753081d2f
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x447dd7
push str.06b35ea1026f0699d4416243c32b
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x447dcd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x458ed0
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 8
jmp 0x447dd7
lea edx, [ebp - 0x70]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret

Function at 0x447df0
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.d75d0bdba183a8039b7b1407f9e30
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x447e23
jmp 0x447f05
lea eax, [ebp - 0x148]
push eax
push 0x458f10
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x447e49
jmp 0x447f05
cmp dword [ebp - 0x258], 0
jne 0x447ef8
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447eb2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x447e8e
jmp 0x447f05
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x447eb0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x447ec2
push str.70cd02e1bd9f6e539
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x447f05
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x447ef3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x447ef1
mov dword [ebp - 0x258], 1
jmp 0x447ef3
jmp 0x447f05
jmp 0x447e49
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret
Function at 0x447f20
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x4632c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x258], 0
push 0
push str.3259b29946552e096d0db0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x447f53
jmp 0x448035
lea eax, [ebp - 0x148]
push eax
push 0x458f44
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
jne 0x447f79
jmp 0x448035
cmp dword [ebp - 0x258], 0
jne 0x448028
push 0
lea ecx, [ebp - 0x250]
push ecx
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x447fe2
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x25c], eax
cmp dword [ebp - 0x25c], 0xffffffff
jne 0x447fbe
jmp 0x448035
mov ecx, dword [ebp - 0x25c]
and ecx, 1
jne 0x447fe0
mov edx, dword [ebp - 0x25c]
or edx, 1
push edx
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x447ff2
push str.cb71f79fdf4d600741
call dword [sym.imp.MSVCR90.dll_printf]
add esp, 4
jmp 0x448035
lea ecx, [ebp - 0x148]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x448023
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x448021
mov dword [ebp - 0x258], 1
jmp 0x448023
jmp 0x448035
jmp 0x447f79
mov eax, dword [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044b4f4
mov esp, ebp
pop ebp
ret