joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad7dc
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4ad9d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x4ad9e8
push 0x4ad9fc
call sub.user32.dll_FindWindowA
mov edi, eax
cmp byte [ebp - 9], 0
je 0x4ad9ae
test edi, edi
je 0x4ad9ae
call fcn.004ad578
test eax, eax
jne 0x4ad9ae
push 0x4ada10
mov al, byte [0x4ada14]
push eax
lea eax, [ebp - 0x6c]
push eax
lea edx, [ebp - 0x70]
xor eax, eax
call fcn.00402ff8
mov eax, dword [ebp - 0x70]
xor ecx, ecx
mov edx, 0x4ada10
call fcn.0040ef34
push dword [ebp - 0x6c]
push 0x4ada10
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00404f34
call fcn.00402f90
mov ebx, eax
test ebx, ebx
jle 0x4ad8dc
mov esi, 1
lea edx, [ebp - 0x14]
mov eax, esi
call fcn.00402ff8
mov edx, dword [ebp - 0x14]
mov eax, 0x4ada20
call fcn.004051b8
test eax, eax
jne 0x4ad8d8
mov edx, dword [ebp - 0x14]
mov eax, 0x4ada2c
call fcn.004051b8
test eax, eax
jne 0x4ad8d8
push dword [ebp - 0x10]
push 0x4ada38
push dword [ebp - 0x14]
push 0x4ada10
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404f34
inc esi
dec ebx
jne 0x4ad88f
push dword [ebp - 0x10]
push 0x4ada44
lea edx, [ebp - 0x74]
mov eax, dword [ebp - 4]
call fcn.004098c4
push dword [ebp - 0x74]
push 0x4ada10
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404f34
cmp dword [ebp - 8], 0x270f
je 0x4ad935
push dword [ebp - 0x10]
push 0x4ada54
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 8]
call fcn.004098c4
push dword [ebp - 0x78]
push 0x4ada10
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00404f34
lea eax, [ebp - 0x58]
mov edx, 0x44
call fcn.00407e9c
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], 4
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x40
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 0x10]
call fcn.00405074
push eax
push 0
call sub.kernel32.dll_CreateProcessA
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
je 0x4ad9ae
push 0
mov eax, dword [ebp - 0x60]
push eax
push 0x52d
push edi
call sub.user32.dll_SendMessageA
cmp byte [ebp - 9], 0
je 0x4ad99c
mov eax, dword [ebp - 0x60]
call fcn.004ad4ac
mov eax, dword [ebp - 0x64]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x68]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ad9dd
lea eax, [ebp - 0x78]
mov edx, 4
call fcn.00404bd8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00404bd8
ret
Function at 0x4adc28
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x102c], ebx
mov dword [ebp - 0x1028], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00405064
mov eax, dword [ebp - 8]
call fcn.00405064
xor eax, eax
push ebp
push 0x4ade65
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x4addfc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 4]
call fcn.004ae024
test al, al
jne 0x4adcb4
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.004adeb0
test al, al
jne 0x4adcbf
mov ebx, 0xffffff9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ade32
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 4]
call fcn.00404c4c
mov word [ebp - 0x24], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0x22], ax
mov eax, dword [ebp - 0x14]
call fcn.00405074
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x20], eax
push 0xea60
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, dword [ebp - 0x14]
call fcn.004ae144
test eax, eax
je 0x4add15
mov ebx, 2
mov eax, dword [ebp + 8]
mov edx, 0x4ade80
call fcn.00404c08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ade32
xor esi, esi
mov eax, dword [ebp - 8]
call fcn.00405074
mov dword [ebp - 0x10], eax
cmp edi, esi
jle 0x4add85
lea eax, [ebp - 0x1024]
xor ecx, ecx
mov edx, 0x1001
call fcn.0040362c
mov eax, edi
sub eax, esi
cmp eax, 0x1000
jle 0x4add4a
mov ebx, 0x1000
jmp 0x4add4e
mov ebx, edi
sub ebx, esi
lea eax, [ebp - 0x1024]
mov ecx, ebx
mov edx, dword [ebp - 0x10]
call fcn.00407e94
push 0
lea eax, [ebp - 0x1024]
call fcn.0040a204
push eax
lea eax, [ebp - 0x1024]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_send
add dword [ebp - 0x10], ebx
add esi, ebx
cmp edi, esi
jg 0x4add26
mov eax, dword [ebp + 8]
call fcn.00404bb4
lea eax, [ebp - 0x1024]
xor ecx, ecx
mov edx, 0x1000
call fcn.0040362c
push 0
push 0x1000
lea eax, [ebp - 0x1024]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
test ebx, ebx
jle 0x4adde3
lea eax, [ebp - 0x1028]
lea edx, [ebp - 0x1024]
mov ecx, 0x1000
call fcn.00404e24
mov edx, dword [ebp - 0x1028]
mov eax, dword [ebp + 8]
call fcn.00404e7c
mov eax, dword [ebp + 8]
test ebx, ebx
jg 0x4add8d
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_closesocket
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4ade32
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ade6c
lea eax, [ebp - 0x102c]
mov edx, 2
call fcn.00404bd8
lea eax, [ebp - 0x14]
call fcn.00404bb4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404bd8
ret
Function at 0x4adeb0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffecc
push ebx
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405064
xor eax, eax
push ebp
push 0x4ae000
push dword fs:[eax]
mov dword fs:[eax], esp
xor edx, edx
push ebp
push 0x4adfd8
push dword fs:[edx]
mov dword fs:[edx], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x110]
mov edx, dword [ebp - 4]
call fcn.0040a29c
lea eax, [ebp - 0x110]
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4adfc6
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x4adfc0
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4adfba
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
mov dword [ebp - 0x134], eax
mov byte [ebp - 0x130], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 1]
mov dword [ebp - 0x12c], eax
mov byte [ebp - 0x128], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 2]
mov dword [ebp - 0x124], eax
mov byte [ebp - 0x120], 0
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax + 3]
mov dword [ebp - 0x11c], eax
mov byte [ebp - 0x118], 0
lea edx, [ebp - 0x134]
mov ecx, 3
mov eax, 0x4ae018
call fcn.0040a944
mov edx, dword [ebp - 0x114]
mov eax, ebx
call fcn.00404c08
mov byte [ebp - 5], 1
jmp 0x4adfca
mov byte [ebp - 5], 0
jmp 0x4adfca
mov byte [ebp - 5], 0
jmp 0x4adfca
mov byte [ebp - 5], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4adfdf
ret
Function at 0x4ae144
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4ae25c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.004ae024
test al, al
jne 0x4ae189
lea edx, [ebp - 4]
mov eax, esi
call fcn.004adeb0
test al, al
jne 0x4ae193
mov ebx, 1
jmp 0x4ae246
lea eax, [ebp - 4]
mov edx, esi
call fcn.00404c4c
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx], eax
cmp dword [ebx], 0xffffffff
jne 0x4ae1af
mov ebx, 2
jmp 0x4ae246
mov word [ebp - 0x14], 2
push edi
call sub.wsock32.dll_htons
mov word [ebp - 0x12], ax
mov eax, dword [ebp - 4]
call fcn.00405074
push eax
call sub.wsock32.dll_inet_addr
mov dword [ebp - 0x10], eax
push 0x10
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_connect
inc eax
jne 0x4ae1f0
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_closesocket
mov ebx, 3
jmp 0x4ae246
push 4
lea eax, [ebp + 8]
push eax
push 0x1006
push 0xffff
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x4ae21a
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_closesocket
mov ebx, 4
jmp 0x4ae246
push 4
lea eax, [ebp + 8]
push eax
push 0x1005
push 0xffff
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_setsockopt
inc eax
jne 0x4ae244
mov eax, dword [ebx]
push eax
call sub.wsock32.dll_closesocket
mov ebx, 5
jmp 0x4ae246
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ae263
lea eax, [ebp - 4]
call fcn.00404bb4
ret

Function at 0x4ae270
Capabilities:
Initialize winsock library

Disassembly:
add esp, 0xfffffe70
push esp
push 0x101
call sub.wsock32.dll_WSAStartup
test eax, eax
jne 0x4ae289
mov al, 1
jmp 0x4ae28b
xor eax, eax
add esp, 0x190
ret
Function at 0x4ae9a8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x214], edx
mov dword [ebp - 0x210], edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4aeb61
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x109]
mov ecx, 0x104
xor edx, edx
call fcn.0040362c
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x4aeb3b
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.0040a42c
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004ae5c8
mov edx, dword [ebp - 0x210]
lea eax, [ebp - 4]
call fcn.00404c4c
mov eax, dword [ebp - 4]
call fcn.00404e74
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x4aea49
lea eax, [ebp - 4]
mov edx, 0x4aeb78
call fcn.00404e7c
lea eax, [ebp - 4]
mov edx, dword [0x4b7a9c]
call fcn.00404e7c
lea eax, [ebp - 0x209]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.0040362c
mov edx, 0x4aeb7c
lea eax, [ebp - 0x209]
call fcn.0040a240
lea edx, [ebp - 0x214]
mov eax, ebx
call fcn.004098c4
mov eax, dword [ebp - 0x214]
call fcn.00405074
mov edx, eax
lea eax, [ebp - 0x209]
call fcn.0040a2f0
mov edx, 0x4aeb7c
lea eax, [ebp - 0x209]
call fcn.0040a2f0
mov eax, dword [0x4b7ab8]
call fcn.00405074
mov edx, eax
lea eax, [ebp - 0x209]
call fcn.0040a2f0
mov edx, 0x4aeb7c
lea eax, [ebp - 0x209]
call fcn.0040a2f0
lea eax, [ebp - 0x209]
call fcn.0040a204
mov esi, eax
xor eax, eax
push ebp
push 0x4aeb31
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x41bab4]
call fcn.00420354
mov ebx, eax
push 0
push 0
mov eax, ebx
call fcn.0041fec0
lea edx, [ebp - 0x209]
mov ecx, esi
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x10]
mov eax, ebx
call fcn.00403e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aeb3b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aeb68
lea eax, [ebp - 0x214]
mov edx, 2
call fcn.00404bd8
lea eax, [ebp - 4]
call fcn.00404bb4
ret
Function at 0x4aeb80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x12c], eax
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4aed7c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x11d]
mov ecx, 0x104
xor edx, edx
call fcn.0040362c
push 0x104
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jbe 0x4aed56
lea edx, [ebp - 8]
lea eax, [ebp - 0x11d]
call fcn.0040a42c
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.004ae5c8
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 8]
call fcn.00404c4c
mov eax, dword [ebp - 8]
call fcn.00404e74
mov edx, dword [ebp - 8]
cmp byte [edx + eax - 1], 0x5c
je 0x4aec30
lea eax, [ebp - 8]
mov edx, 0x4aed98
call fcn.00404e7c
lea eax, [ebp - 8]
mov edx, dword [0x4b7a9c]
call fcn.00404e7c
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.004ae674
test al, al
je 0x4aed56
call sub.kernel32.dll_GetTickCount_1
mov ecx, 0x3e8
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
cmp edx, dword [ebp - 0xc]
jne 0x4aec7c
cmp eax, dword [ebp - 0x10]
jae 0x4aec82
jmp 0x4aed56
jl 0x4aed56
xor eax, eax
push ebp
push 0x4aed4c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b8b4]
call fcn.00403ddc
mov ebx, eax
mov edx, dword [ebp - 8]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4aed3b
mov dl, 1
mov eax, dword [0x4254c0]
call fcn.00425534
mov esi, eax
mov dl, 0x7c
mov eax, esi
call fcn.00425764
lea ecx, [ebp - 0x128]
xor edx, edx
mov eax, ebx
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x128]
mov eax, esi
call fcn.00425774
cmp dword [esi + 0x10], 3
jl 0x4aed34
lea ecx, [ebp - 0x12c]
mov edx, 1
mov eax, esi
call fcn.004256ec
mov eax, dword [ebp - 0x12c]
xor edx, edx
call fcn.00409a3c
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x130]
mov edx, 2
mov eax, esi
call fcn.004256ec
mov edx, dword [ebp - 0x130]
mov eax, 0x4b7ab8
call fcn.00404c08
mov eax, esi
call fcn.00403e0c
mov eax, ebx
call fcn.00403e0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4aed56
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4aed83
lea eax, [ebp - 0x130]
mov edx, 4
call fcn.00404bd8
lea eax, [ebp - 8]
call fcn.00404bb4
ret

Function at 0x4b029c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
mov edi, edx
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
push 0x64
call sub.kernel32.dll_Sleep_1
mov eax, dword [0x4b7f9c]
mov eax, dword [eax]
call fcn.00443800
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
sub ebx, esi
imul eax, edi, 0x3e8
cmp ebx, eax
jbe 0x4b02a8
pop edi
pop esi
pop ebx
ret
Function at 0x4b1ef8
Capabilities:
Create thread

Disassembly:
push ecx
push esp
push 0
push 0
push 0x4b1a54
push 0
push 0
call sub.kernel32.dll_CreateThread
test eax, eax
je 0x4b1f16
push eax
call sub.kernel32.dll_CloseHandle_1
pop edx
ret

Function at 0x4b1f20
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, ecx
mov byte [esp], dl
push eax
push 0
push 2
call dword [0x4b7ac4]
mov esi, eax
test esi, esi
seta bl
test bl, bl
je 0x4b1f61
cmp byte [esp], 0
jne 0x4b1f4d
push esi
call sub.kernel32.dll_SuspendThread
jmp 0x4b1f53
push esi
call sub.kernel32.dll_ResumeThread
test edi, edi
je 0x4b1f5b
mov dword [edi], esi
jmp 0x4b1f61
push esi
call sub.kernel32.dll_CloseHandle_1
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x40d400
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x58]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
call fcn.004011cc
test eax, eax
jne 0x40d434
xor eax, eax
jmp 0x40d48a
mov ecx, dword [ebp - 4]
call fcn.004011e0
push 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.004012d0
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40d463
xor eax, eax
jmp 0x40d48a
mov esi, esp
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x100]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp esi, esp
call fcn.00415960
pop edi
pop esi
pop ebx
add esp, 0x58
cmp ebp, esp
call fcn.00415960
mov esp, ebp
pop ebp
ret 0xc

Function at 0x40d720
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x48]
mov ecx, 0x12
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
xor eax, eax
cmp dword [ebp + 0x10], 0
sete al
mov esi, esp
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp esi, esp
call fcn.00415960
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40d76e
mov eax, 1
jmp 0x40d7b4
mov esi, esp
push 0x80
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp esi, esp
call fcn.00415960
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40d793
xor eax, eax
jmp 0x40d7b4
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
mov esi, esp
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
cmp esi, esp
call fcn.00415960
pop edi
pop esi
pop ebx
add esp, 0x48
cmp ebp, esp
call fcn.00415960
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e440
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x5c]
mov ecx, 0x17
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
ja case.0x40e47f.5
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov cl, byte [edx + 0x40e659]
jmp dword [ecx*4 + 0x40e641]
mov esi, esp
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, esp
call fcn.00415960
jmp 0x40e5b6
mov esi, esp
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp esi, esp
call fcn.00415960
jmp 0x40e5b6
mov esi, esp
mov edx, dword [ebp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp esi, esp
call fcn.00415960
jmp 0x40e5b6
mov esi, esp
push 0x105
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, esp
call fcn.00415960
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 2], 0
jmp 0x40e5b6
mov esi, esp
push 0x105
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, esp
call fcn.00415960
push str.Recycled
mov eax, dword [ebp + 0xc]
add eax, 3
push eax
call fcn.00415a20
add esp, 8
jmp 0x40e5b6
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 3
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 9
ja case.default.0x40e551
mov eax, dword [ebp - 0x1c]
jmp dword [eax*4 + 0x40e668]
mov dword [ebp - 8], 7
jmp 0x40e5b6
mov dword [ebp - 8], 0x18
jmp 0x40e5b6
mov dword [ebp - 8], 0x10
jmp 0x40e5b6
mov dword [ebp - 8], 0x19
jmp 0x40e5b6
mov dword [ebp - 8], 2
jmp 0x40e5b6
mov dword [ebp - 8], 0x17
jmp 0x40e5b6
mov dword [ebp - 8], 0xb
jmp 0x40e5b6
mov dword [ebp - 8], 0x16
jmp 0x40e5b6
mov dword [ebp - 8], 0x26
jmp 0x40e5b6
mov dword [ebp - 8], 5
jmp 0x40e5b6
xor eax, eax
jmp 0x40e62e
cmp dword [ebp - 0xc], 0
je 0x40e629
mov esi, esp
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp esi, esp
call fcn.00415960
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40e5dd
xor eax, eax
jmp 0x40e62e
mov esi, esp
push str.SHGetSpecialFolderPathA
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00415960
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40e602
xor eax, eax
jmp 0x40e62e
mov esi, esp
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [ebp - 0x10]
cmp esi, esp
call fcn.00415960
test eax, eax
je 0x40e625
mov eax, 1
jmp 0x40e62e
xor eax, eax
jmp 0x40e62e
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x5c
cmp ebp, esp
call fcn.00415960
mov esp, ebp
pop ebp
ret 8
Function at 0x40e486
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push ecx
lea edi, [ebp - 0x5c]
mov ecx, 0x17
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
pop ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
ja case.0x40e47f.5
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov cl, byte [edx + 0x40e659]
jmp dword [ecx*4 + 0x40e641]
mov esi, esp
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, esp
call fcn.00415960
jmp 0x40e5b6
mov esi, esp
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp esi, esp
call fcn.00415960
jmp 0x40e5b6
mov esi, esp
mov edx, dword [ebp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
cmp esi, esp
call fcn.00415960
jmp 0x40e5b6
mov esi, esp
push 0x105
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, esp
call fcn.00415960
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 2], 0
jmp 0x40e5b6
mov esi, esp
push 0x105
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
cmp esi, esp
call fcn.00415960
push str.Recycled
mov eax, dword [ebp + 0xc]
add eax, 3
push eax
call fcn.00415a20
add esp, 8
jmp 0x40e5b6
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 3
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 9
ja case.default.0x40e551
mov eax, dword [ebp - 0x1c]
jmp dword [eax*4 + 0x40e668]
mov dword [ebp - 8], 7
jmp 0x40e5b6
mov dword [ebp - 8], 0x18
jmp 0x40e5b6
mov dword [ebp - 8], 0x10
jmp 0x40e5b6
mov dword [ebp - 8], 0x19
jmp 0x40e5b6
mov dword [ebp - 8], 2
jmp 0x40e5b6
mov dword [ebp - 8], 0x17
jmp 0x40e5b6
mov dword [ebp - 8], 0xb
jmp 0x40e5b6
mov dword [ebp - 8], 0x16
jmp 0x40e5b6
mov dword [ebp - 8], 0x26
jmp 0x40e5b6
mov dword [ebp - 8], 5
jmp 0x40e5b6
xor eax, eax
jmp 0x40e62e
cmp dword [ebp - 0xc], 0
je 0x40e629
mov esi, esp
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp esi, esp
call fcn.00415960
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40e5dd
xor eax, eax
jmp 0x40e62e
mov esi, esp
push str.SHGetSpecialFolderPathA
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp esi, esp
call fcn.00415960
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40e602
xor eax, eax
jmp 0x40e62e
mov esi, esp
push 0
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [ebp - 0x10]
cmp esi, esp
call fcn.00415960
test eax, eax
je 0x40e625
mov eax, 1
jmp 0x40e62e
xor eax, eax
jmp 0x40e62e
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x5c
cmp ebp, esp
call fcn.00415960
mov esp, ebp
pop ebp
ret 8