joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4a48
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, 0x4af04c
call fcn.0040aef4
mov ebx, 0x4c03a8
xor eax, eax
push ebp
push 0x4b4bce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4b961c]
mov edx, 0x4b4be8
call fcn.00407184
call fcn.004a8ad0
push 0
xor ecx, ecx
mov dl, 1
mov eax, 0x4b4c00
call fcn.004ab060
mov eax, dword [0x4adc88]
push eax
xor ecx, ecx
mov edx, 0x4b4c1c
mov eax, 0x4b4c00
call fcn.004aaf9c
mov dl, 1
mov eax, dword [0x4addf0]
call fcn.004ac2b4
mov edx, eax
test edx, edx
je 0x4b4ac1
sub edx, 0xfffffff8
lea eax, [ebp - 0x14]
mov ecx, 0x4b4c28
call fcn.0040a2fc
mov ecx, dword [ebp - 0x14]
mov edx, 0x4b4c44
mov eax, 0x4b4f9c
call fcn.004ab0a8
xor eax, eax
push ebp
push 0x4b4bb1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], 3
mov dword [ebx + 4], 0x4adef4
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 0xc], eax
mov eax, dword [0x4bcc30]
mov dword [ebx + 0x10], eax
push 0x7f00
push 0
call sub.user32.dll_LoadIconW
mov dword [ebx + 0x14], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorW
mov dword [ebx + 0x18], eax
xor eax, eax
mov dword [ebx + 0x1c], eax
xor eax, eax
mov dword [ebx + 0x20], eax
mov eax, 0x4b4fac
mov dword [ebx + 0x24], eax
push ebx
call sub.user32.dll_RegisterClassW
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0
push 0
mov eax, dword [0x4bcc30]
push eax
push 0
mov edx, 0x4b4fc0
mov eax, 0x4b4fac
mov ecx, 0x2cf0000
call fcn.0040c21c
mov dword [0x4c0388], eax
push 5
mov eax, dword [0x4c0388]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4c0388]
push eax
call sub.user32.dll_UpdateWindow
call fcn.004aae7c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b4bb8
mov eax, 0x4b95c4
call fcn.0040a2b8
ret
Function at 0x401000
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push edi
push 0x103
lea eax, [ebp - 0x117]
push 0
push eax
mov byte [ebp - 0x118], 0
call sub.ntdll.dll_memset
xor eax, eax
mov byte [ebp - 0x14], 0
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
push 0x1c
stosb byte es:[edi], al
pop eax
mov dword [ebp - 4], 1
call sub.ntdll.dll__alloca_probe
mov eax, esp
test eax, eax
je 0x401059
push 0x7f
push 0x1b
mov edx, str.Z0_Z_Z12:__09___0_:__0__Z
call fcn.00402d34
push 0x104
lea ecx, [ebp - 0x118]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsA]
test eax, eax
je 0x4010e2
lea eax, [ebp - 0x118]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401079
lea ecx, [ebp - 0x14]
sub eax, edx
push ecx
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.00401c4f
test eax, eax
je 0x4010e2
xor al, al
lea edi, [ebp - 0x118]
mov ecx, 0x104
rep stosb byte es:[edi], al
lea eax, [ebp - 0x118]
lea edi, [ebp - 0x14]
call fcn.00401d26
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalFindAtomA]
test ax, ax
jne 0x4010e2
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.DLL_GlobalAddAtomA]
mov word [0x42b17c], ax
test ax, ax
je 0x4010e2
and dword [ebp - 4], 0
mov eax, dword [ebp - 4]
lea esp, [ebp - 0x11c]
pop edi
leave
ret

Function at 0x4010ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, 0x103
xor ebx, ebx
push esi
lea eax, [ebp - 0x103]
push ebx
push eax
mov byte [ebp - 0x104], bl
call sub.ntdll.dll_memset
push esi
lea eax, [ebp - 0x207]
push ebx
push eax
mov byte [ebp - 0x208], bl
call sub.ntdll.dll_memset
add esp, 0x18
inc esi
push esi
lea eax, [ebp - 0x208]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
push 0x5c
push ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrA]
cmp eax, ebx
je 0x401151
mov byte [eax], bl
lea eax, [ebp - 0x104]
push eax
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4011cd
lea eax, [ebp - 0x208]
push eax
lea ebx, [ebp - 0x104]
call fcn.004025e4
test eax, eax
je 0x4011cd
push edi
mov edi, ebx
call fcn.0040266f
test eax, eax
je 0x4011cc
mov eax, ebx
push eax
call fcn.00402761
xor edi, edi
inc edi
push esi
test eax, eax
jne 0x4011ad
push 0x42b188
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
mov dword [0x42b178], edi
jmp 0x4011c6
lea eax, [ebp - 0x104]
push eax
push 0x42b188
call dword [sym.imp.KERNEL32.DLL_lstrcpynA]
and dword [0x42b178], 0
mov dword [0x42b174], edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40137b
Capabilities:
Check os version
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push 0x11c
lea eax, [ebp - 0x158]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
mov dword [ebp - 0x158], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x40140d
cmp dword [ebp - 0x154], 6
jb 0x40140d
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call fcn.00402065
cmp eax, 0x2000
jae 0x40140d
call fcn.00401880
test eax, eax
jne 0x40140d
push 6
push eax
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x40140d
lea eax, [ebp - 0x3c]
call fcn.00401ac4
test eax, eax
je 0x4013ff
lea edi, [ebp - 0x3c]
call fcn.00401bfc
test eax, eax
je 0x4013f3
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
leave
ret
Function at 0x401ac4
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push esi
push edi
xor ebx, ebx
push 0x3c
mov esi, eax
push ebx
push esi
mov dword [ebp - 4], ebx
call sub.ntdll.dll_memset
add esp, 0xc
mov edi, 0x104
push edi
lea eax, [ebp - 0x424]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test eax, eax
je 0x401bf4
push edi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameW]
test eax, eax
je 0x401bf4
call dword [sym.imp.KERNEL32.DLL_GetCommandLineW]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00401a4f
mov dword [ebp - 8], eax
cmp eax, ebx
jne 0x401b3e
mov dword [ebp - 8], 0x404604
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push 0x618
push 8
call edi
mov ebx, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push eax
call ebx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x401bf4
push dword [ebp - 8]
lea ecx, [ebp - 0x424]
push ecx
push 0x404608
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0x20a
push 8
call edi
push eax
call ebx
mov ebx, eax
xor eax, eax
cmp ebx, eax
je 0x401bd8
push ebx
push eax
push eax
push 0x25
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x401bd8
push 0x404634
push ebx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
test eax, eax
je 0x401bd8
mov eax, dword [ebp - 0xc]
and dword [esi + 0x1c], 0
mov dword [ebp - 4], 1
mov dword [esi], 0x3c
mov dword [esi + 0xc], str.runas
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], eax
mov dword [esi + 4], 0x40
jmp 0x401bf4
push dword [ebp - 0xc]
push 0
call edi
mov esi, dword [sym.imp.KERNEL32.DLL_HeapFree]
push eax
call esi
test ebx, ebx
je 0x401bf4
push ebx
push 0
call edi
push eax
call esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401bfc
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
xor ebx, ebx
jmp 0x401c20
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x4c7
jne 0x401c27
push 0x2710
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
call esi
test eax, eax
je 0x401c08
push 0xffffffffffffffff
push dword [edi + 0x38]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
push dword [edi + 0x38]
test eax, eax
je 0x401c41
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x401c4a
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor ebx, ebx
inc ebx
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x40219c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
xor esi, esi
mov dword [ebp - 4], ebx
cmp dword [ebp + 8], ebx
je 0x402221
push 0x80000000
push dword [ebp + 8]
call fcn.00402143
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x402221
push edi
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0xc], esi
cmp esi, ebx
je 0x402215
call fcn.00402e4e
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, ebx
je 0x402215
push ebx
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
cmp eax, ebx
jne 0x402215
mov esi, edi
call fcn.00402e9d
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call fcn.00401e1d
mov esi, dword [ebp - 0xc]
pop edi
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40222a
mov dword [eax], esi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 8

Function at 0x402292
Capabilities:
Delete file
Set file attributes

Disassembly:
xor eax, eax
test edi, edi
je 0x4022b2
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push edi
call esi
test eax, eax
jne 0x4022b1
push edi
call esi
pop esi
ret
Function at 0x4024cc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x40253c
push dword [ebp + 8]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
call esi
test eax, eax
je 0x40253c
push 0x14
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, edi
je 0x402509
push 0x7f
push 0x12
mov edx, str.Z_fE_
call fcn.00402d34
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snprintf]
add esp, 0x10
lea eax, [ebp - 0x104]
push eax
call esi
test eax, eax
je 0x40253c
lea edi, [ebp - 0x104]
call fcn.00402292
mov edi, eax
mov eax, edi
lea esp, [ebp - 0x10c]
pop edi
pop esi
leave
ret 4

Function at 0x40254a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push edi
push 3
xor edi, edi
call fcn.00402ed1
add eax, 3
push eax
call fcn.00402ef8
mov ebx, eax
cmp ebx, edi
je 0x4025de
push esi
push 4
mov dword [ebp - 0x10], 0x23
mov dword [ebp - 0xc], 0x1c
mov dword [ebp - 8], 0x1a
mov dword [ebp - 4], 0x28
call fcn.00402ed1
mov eax, dword [ebp + eax*4 - 0x10]
lea ecx, [ebp - 0x114]
push ecx
push edi
push edi
or eax, 0x8000
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x4025d6
mov esi, 0x104
call fcn.00402e4e
mov edi, eax
test edi, edi
je 0x4025d6
push edi
push 0xffffffffffffffff
call fcn.00402ed1
push eax
push ebx
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
mov esi, ebx
call fcn.00402e9d
pop esi
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x40266f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
xor ebx, ebx
xor esi, esi
cmp edi, ebx
je 0x402755
push edi
push ebx
push ebx
push 0x23
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
js 0x402755
push 4
pop eax
call sub.ntdll.dll__alloca_probe
mov esi, esp
cmp esi, ebx
je 0x4026bb
push 0x92
push 2
mov eax, esi
mov edx, 0x4069a8
call fcn.00402d34
push 0xffffffffffffffff
call fcn.00402ed1
push eax
push esi
lea eax, [ebp - 0x104]
push 0x104
push eax
call dword [sym.imp.ntdll.dll__snprintf]
lea eax, [ebp - 0x104]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4026e2
sub eax, edx
cmp eax, 6
jb 0x4026bb
cmp byte [ebp - 0x104], bl
je 0x40271c
lea ecx, [ebp - 0x104]
movsx eax, byte [ecx]
lea edx, [eax - 0x30]
and edx, 0x80000001
jns 0x402711
dec edx
or edx, 0xfffffffe
inc edx
je 0x402717
add al, 0x31
mov byte [ecx], al
inc ecx
cmp byte [ecx], bl
jne 0x4026fe
lea eax, [ebp - 0x104]
push eax
push edi
push edi
call dword [sym.imp.SHLWAPI.dll_PathCombineA]
push 8
pop eax
call sub.ntdll.dll__alloca_probe
mov eax, esp
cmp eax, ebx
je 0x40274a
push 0x8e
push 4
mov edx, 0x406578
call fcn.00402d34
push eax
push edi
call dword [sym.imp.SHLWAPI.dll_PathAddExtensionA]
xor esi, esi
inc esi
mov eax, esi
lea esp, [ebp - 0x10c]
pop esi
pop ebx
leave
ret
Function at 0x402761
Capabilities:
Access pe header
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
xor edi, edi
and dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x4027eb
push esi
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.0040219c
mov esi, eax
test esi, esi
je 0x4027cd
cmp dword [ebp - 4], edi
je 0x4027cd
push esi
call dword [sym.imp.ntdll.dll_RtlImageNtHeader]
mov edi, eax
test edi, edi
je 0x4027cd
push 0xffffffffffffffff
call fcn.00402ed1
push esi
push dword [ebp + 8]
mov dword [edi + 0x58], eax
mov eax, dword [ebp - 4]
call fcn.00402233
mov edi, eax
test edi, edi
jne 0x4027e1
push 1
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov edi, eax
test esi, esi
je 0x4027ea
call fcn.00402e9d
pop esi
mov eax, edi
pop edi
leave
ret 4

Function at 0x40292c
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push ebx
push esi
push edi
xor eax, eax
push 0x220
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x22c], eax
lea eax, [ebp - 0x228]
push eax
call sub.ntdll.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_CreateToolhelp32Snapshot]
add esp, 0xc
push dword [ebp + 8]
push 8
pop edi
push edi
call esi
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x402985
call ebx
cmp eax, 0x18
jne 0x402985
push dword [ebp + 8]
push edi
call esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x22c], 0x224
call dword [sym.imp.KERNEL32.DLL_Module32First]
test eax, eax
jne 0x4029ae
call ebx
cmp eax, 0x12
je 0x402a27
call ebx
jmp 0x402a27
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov ebx, esp
test ebx, ebx
je 0x4029ce
push 0x84
push 6
mov eax, ebx
mov edx, 0x4065d8
call fcn.00402d34
mov eax, edi
call sub.ntdll.dll__alloca_probe
mov edi, esp
test edi, edi
je 0x4029ee
push 0x95
push 4
mov eax, edi
mov edx, 0x406574
call fcn.00402d34
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push ebx
lea eax, [ebp - 0x20c]
push eax
call esi
test eax, eax
je 0x402a0a
push edi
push eax
call esi
test eax, eax
jne 0x402a20
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_Module32Next]
test eax, eax
jne 0x4029f4
jmp 0x402a27
mov dword [ebp - 8], 1
cmp dword [ebp - 4], 0xffffffff
je 0x402a35
push dword [ebp - 4]
call fcn.00401e1d
mov eax, dword [ebp - 8]
lea esp, [ebp - 0x238]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x40f13b]
shl eax, 2
mov dword [0x40f13f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.00405934
pop edx
call fcn.00404cd0
call fcn.00405938
push 0
call fcn.0040679c
pop ecx
push 0x40f0e4
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x40f143], eax
push 0
jmp fcn.0040c6dc

Function at 0x401274
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 4]
push edx
push 0
push edi
push esi
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4012c6
push dword [ebp - 8]
call fcn.00404948
pop ecx
mov ebx, eax
lea eax, [ebp - 8]
push eax
push ebx
lea edx, [ebp - 4]
push edx
push 0
push edi
push esi
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4012bf
mov eax, ebx
jmp 0x4012f3
push ebx
call fcn.00404780
pop ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Cannot_locate_registry_string_value
call fcn.00402490
pop ecx
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
push edx
push 0x4011c0
call fcn.0040d4f4
add esp, 0x24
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40160c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
push 0x1000
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetEnvironmentVariableA
test eax, eax
jne 0x401632
xor eax, eax
jmp 0x40163f
lea edx, [ebp - 0x1000]
push edx
call fcn.00402490
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x401644
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
push 0x104
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
jne 0x401694
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Unable_to_determine_temporary_path
call fcn.00402490
pop ecx
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
push 0x4011c0
call fcn.0040d4f4
add esp, 0x24
lea ecx, [ebp - 0x218]
push ecx
push 0
push 0x40f1ff
lea eax, [ebp - 0x114]
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
test eax, eax
jne 0x4016df
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Unable_to_create_temporary_file
call fcn.00402490
pop ecx
mov dword [ebp - 8], eax
lea edx, [ebp - 8]
push edx
push 0x4011c0
call fcn.0040d4f4
add esp, 0x24
push 0
push 0x80
push 5
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x218]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401731
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push str.Unable_to_open_temporary_file
call fcn.00402490
pop ecx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x4011c0
call fcn.0040d4f4
add esp, 0x24
push 0
lea edx, [ebp - 0x10]
push edx
push esi
call fcn.00405bd8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
lea ecx, [ebp - 0x218]
push ecx
call fcn.00402490
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401770
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov ebx, eax
jmp 0x4017ce
push ebx
call fcn.00405bd8
pop ecx
mov dword [ebp - 4], eax
push 0x3d
push ebx
call fcn.00405ca9
add esp, 8
test eax, eax
je 0x4017c8
cmp ebx, eax
je 0x4017c8
mov esi, eax
sub esi, ebx
lea eax, [esi + 1]
push eax
call fcn.00404948
pop ecx
mov edi, eax
push esi
push ebx
push edi
call fcn.004059b8
add esp, 0xc
mov byte [edi + esi], 0
push edi
push dword [ebp + 8]
call fcn.00402594
add esp, 8
mov eax, dword [ebp - 4]
inc eax
add ebx, eax
cmp byte [ebx], 0
jne 0x401780
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x4017dc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffebc
push ebx
push esi
push edi
push 0x1000
call fcn.00404948
pop ecx
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push str._s._s
push dword [ebp - 4]
call fcn.00407600
add esp, 0x10
push dword [ebp + 0x10]
call fcn.00405bd8
pop ecx
mov edi, eax
lea eax, [ebp - 0x144]
push eax
push dword [ebp - 4]
call sub.KERNEL32.DLL_FindFirstFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40188f
lea esi, [ebp - 0x118]
push esi
call fcn.00405bd8
pop ecx
cmp edi, eax
jge 0x401870
add eax, esi
sub eax, edi
push eax
push dword [ebp + 0x10]
call fcn.00405d5c
add esp, 8
test eax, eax
jne 0x401870
lea edx, [ebp - 0x118]
push edx
push dword [ebp + 0xc]
call fcn.0040191c
add esp, 8
push eax
push dword [ebp + 8]
call fcn.00402594
add esp, 8
lea ecx, [ebp - 0x144]
push ecx
push ebx
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
jne 0x40188a
push ebx
call sub.KERNEL32.DLL_FindClose
or ebx, 0xffffffff
cmp ebx, 0xffffffff
jne 0x40182d
push dword [ebp - 4]
call fcn.00404780
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40191c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test ebx, ebx
jne 0x401949
lea ebx, [ebp - 0x108]
push esi
call fcn.00405bd8
pop ecx
mov edi, eax
push esi
call fcn.00402490
pop ecx
mov dword [ebp - 4], eax
cmp edi, 2
jl 0x40196d
mov eax, dword [ebp - 4]
movsx edx, byte [eax + 1]
cmp edx, 0x3a
je 0x401978
mov ecx, dword [ebp - 4]
movsx eax, byte [ecx]
cmp eax, 0x2f
jne 0x401996
mov eax, dword [ebp - 4]
jmp 0x401989
movsx edx, byte [eax]
cmp edx, 0x2f
jne 0x401988
mov byte [eax], 0x5c
inc eax
cmp byte [eax], 0
jne 0x40197d
mov eax, dword [ebp - 4]
jmp 0x401a49
push 0x1000
call fcn.00404948
pop ecx
mov edi, eax
push ebx
push edi
call fcn.00405ba8
add esp, 8
mov esi, dword [ebp - 4]
jmp 0x401a31
mov ebx, esi
push 0x2f
push ebx
call fcn.00405ca9
add esp, 8
mov esi, eax
push 0x5c
push ebx
call fcn.00405ca9
add esp, 8
test eax, eax
je 0x4019d6
cmp esi, eax
jbe 0x4019d6
mov esi, eax
test esi, esi
je 0x4019e0
mov byte [esi], 0
inc esi
jmp 0x4019e2
xor esi, esi
push ebx
push 0x40f249
call fcn.00405b5c
add esp, 8
test eax, eax
je 0x401a31
push ebx
push 0x40f24b
call fcn.00405b5c
add esp, 8
test eax, eax
jne 0x401a1a
push 0x5c
push edi
call fcn.00405cb5
add esp, 8
test eax, eax
je 0x401a31
mov byte [eax], 0
jmp 0x401a31
push edi
call fcn.00405bd8
pop ecx
add eax, edi
mov byte [eax], 0x5c
push ebx
inc eax
push eax
call fcn.00405ba8
add esp, 8
test esi, esi
je 0x401a3e
cmp byte [esi], 0
jne 0x4019b2
push dword [ebp - 4]
call fcn.00404780
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401a50
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe70
mov ax, 2
lea edx, [ebp - 0x190]
push edx
push eax
call sub.WSOCK32.DLL_WSAStartup
mov esp, ebp
pop ebp
ret