joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40346f
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
push str.NTLM
mov esi, ecx
mov dword [ebp - 4], ebx
call sub.Secur32.dll_QuerySecurityPackageInfoA
cmp eax, ebx
je 0x40349c
push eax
push str.ERROR_in_CHttpNTLMAuthObject::Prepare__:_QuerySecurityPackageInfo___failed__result__0x_x_
jmp 0x403530
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp eax, 0x80000
mov dword [ebp - 8], eax
jbe 0x4034b4
push eax
push str.ERROR_in_CHttpNTLMAuthObject::Prepare__:_invalid_token_size__size___u_
jmp 0x403530
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x3c], 0x200
mov dword [ebp - 0x38], 0x2c
mov dword [ebp - 0x1c], 1
call fcn.004311c6
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
call fcn.0042fb9f
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
call fcn.004311c6
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
call fcn.0042fb9f
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 4]
push eax
push ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
mov eax, dword [ebp - 4]
push ebx
push 2
push dword [eax + 0xc]
push ebx
call sub.Secur32.dll_AcquireCredentialsHandleA
push dword [ebp - 4]
mov edi, eax
call sub.Secur32.dll_FreeContextBuffer
cmp edi, ebx
je 0x403541
push edi
push str.ERROR_in_CHttpNTLMAuthObject::Prepare__:_AcquireCredentialsHandle___failed__result__0x_x_
push 0x4b5b78
call fcn.0042d050
add esp, 0xc
xor al, al
jmp 0x403549
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4064e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x480eb8
call fcn.004801f0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
call fcn.0042d733
and dword [ebp - 4], 0
lea ecx, [esi + 0x24]
call fcn.00430750
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.00430750
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 2
call fcn.0042f0da
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0042f0da
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x406538
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x480ef0
call fcn.004801f0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.0042f3db
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 2
call fcn.0042f3db
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.00430a4d
and byte [ebp - 4], 0
lea ecx, [esi + 0x24]
call fcn.00430a4d
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.0042d7f5
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x407720
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x48110c
call fcn.004801f0
sub esp, 0x23c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
inc ebx
push edi
cmp byte [esi + 8], 0
jne 0x40774d
cmp byte [esi + 5], 0
jne 0x40774d
and dword [0x4b5b78], 0
jmp 0x407753
mov dword [0x4b5b78], ebx
cmp byte [esi + 8], 0
je 0x4077a9
lea eax, [ebp - 0x10]
push eax
call fcn.0040814c
and dword [ebp - 4], 0
mov dword [esp], 0x4a751c
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.00430d31
add esp, 0xc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00430a4d
lea ecx, [ebp - 0x14]
call fcn.004311c6
mov edi, 0x4b5b78
push eax
mov ecx, edi
call fcn.0042cdf3
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00430a4d
jmp 0x4077b8
push dword [esi + 0x48]
mov edi, 0x4b5b78
mov ecx, edi
call fcn.0042ce1b
mov ecx, esi
call fcn.00406a5e
mov ecx, esi
call fcn.00407bbe
cmp dword [0x4b5b78], 0
push ebx
sete al
mov byte [0x4b5e00], al
call fcn.00429fde
pop ecx
mov ebx, 0x4a71dc
push ebx
mov ecx, 0x4b5dfc
call fcn.0042f5a5
push ebx
mov ecx, 0x4b5474
call fcn.0042f5a5
push 0x4a7518
mov ecx, 0x4b546c
call fcn.0042f5a5
call fcn.00425885
push eax
mov ecx, 0x4b5470
call fcn.0042f5a5
push 0
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea eax, [ebp - 0xb8]
mov dword [ebp - 0xb8], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
movzx eax, word [ebp - 0xb4]
movzx ecx, word [ebp - 0xb0]
shl eax, 0x10
or eax, ecx
push eax
push str.OS_version__X
push edi
mov dword [esi + 0x38], eax
call fcn.0042d068
add esp, 0xc
mov ecx, esi
call fcn.00407612
cmp byte [esi + 8], 0
jne 0x407951
lea eax, [ebp - 0x248]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4078a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x24]
push str.Error_d_WSAStartup__
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
mov edi, 0x4b5a58
mov ecx, edi
call fcn.00424d9a
cmp dword [esi + 0x1c], 0
jbe 0x407951
add esi, 0x10
mov ecx, esi
call fcn.0042dac6
mov word [0x4b5e16], ax
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.0042db83
push eax
mov ecx, 0x4b5e10
mov dword [ebp - 4], 3
call fcn.0042f510
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042f3db
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.0042db83
push eax
mov ecx, 0x4b5e08
mov dword [ebp - 4], 4
call fcn.0042f510
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042f3db
lea eax, [ebp - 0x18]
mov ecx, esi
push eax
call fcn.0042db83
push eax
mov ecx, 0x4b5e04
mov dword [ebp - 4], 5
call fcn.0042f510
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042f3db
mov ecx, edi
call fcn.00425424
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4079c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push esi
lea eax, [ebp - 0x60]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.004311c6
mov edi, dword [ebp + 8]
xor esi, esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov ecx, edi
call fcn.00430f4c
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407a2d
cmp dword [ebp - 0x1c], esi
je 0x407a2d
push dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov eax, dword [ebp + 0x10]
cmp eax, esi
jne 0x407a26
push dword [ebp - 0x1c]
call edi
pop edi
pop esi
leave
ret
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
jmp 0x407a22
push dword [ebp - 0x1c]
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0xc]
push str.Error_d_while_running__s__X
push eax
call fcn.0042c02a
add esp, 0x14
lea eax, [ebp - 0xc]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
Function at 0x407c9a
Capabilities:
Create directory
Set current directory

Disassembly:
mov eax, 0x481194
call fcn.004801f0
sub esp, 0x2c
cmp byte [0x4b535c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
je 0x407d08
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.0040c10b
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040b540
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.00430b8e
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00430a4d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00430a4d
push dword [ebp - 0x18]
call fcn.0040b92e
pop ecx
jmp 0x407df1
xor esi, esi
push 2
inc esi
pop ebx
cmp esi, ebx
jg 0x407df1
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0040bdb8
add esp, 4
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 4], ebx
call fcn.0043075c
call fcn.0040b62f
test al, al
pop ecx
jne 0x407e1b
push 0
lea ecx, [ebp - 0x14]
call fcn.004311c6
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407d9f
lea ecx, [ebp - 0x14]
call fcn.004311c6
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042f493
mov edi, eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.004311c6
push eax
push 0x4a7614
push 0x4b5b78
call fcn.0042d050
add esp, 0x10
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0042f3db
jmp 0x407e2e
cmp esi, 1
jne 0x407dd6
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.004311c6
push eax
call fcn.0040bbc6
pop ecx
jmp 0x407dd6
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.00430b8e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00430a4d
mov ecx, dword [ebp - 0x18]
call fcn.004311b6
test eax, eax
je 0x407e40
lea eax, [ebp - 0x2c]
push str.Cant_find_any_writtable_folder
push eax
call fcn.0042c02a
pop ecx
lea eax, [ebp - 0x2c]
pop ecx
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
cmp esi, 1
jne 0x407dd9
lea eax, [ebp - 0x14]
push eax
call fcn.0040b7f2
test al, al
pop ecx
jne 0x407dd9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00430a4d
inc esi
jmp 0x407d0e
mov ecx, dword [ebp - 0x18]
call fcn.004311c6
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x407e9b
mov ecx, dword [ebp - 0x18]
call fcn.004311c6
push eax
lea ecx, [ebp - 0x20]
call fcn.0042f493
mov esi, eax
mov dword [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.004311c6
push eax
lea eax, [ebp - 0x38]
push str.SetCurrentDirectoryW__s__error_u
push eax
call fcn.0042c02a
add esp, 0x10
lea eax, [ebp - 0x38]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x40872e
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x4812ec
call fcn.004801f0
push ecx
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.0042f0da
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call fcn.004086d8
mov edi, eax
call fcn.0040870a
push eax
push edi
push esi
lea eax, [ebp - 0x10]
push str._u._u._d
push eax
call fcn.00430647
mov ecx, dword [ebp + 8]
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
call fcn.0042d9cf
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042f3db
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40a7d6
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x481784
call fcn.004801f0
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, edi
call fcn.0042dab2
mov byte [esi + 0xc], al
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.0042db83
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x10]
call fcn.0042f510
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0042f3db
mov ecx, edi
call fcn.0042dadb
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.0042dac6
push eax
push dword [ebp + 8]
call fcn.0042e0a3
pop ecx
mov dword [esi + 0x18], eax
pop ecx
mov dword [esi + 0x1c], edx
mov ecx, edi
call fcn.0042dadb
mov ecx, edi
call fcn.0042dadb
mov ecx, edi
mov dword [esi + 0x20], eax
call fcn.0042dadb
mov dword [esi + 0x24], eax
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.0042db83
push eax
lea ecx, [esi + 0x28]
mov dword [ebp - 4], 1
call fcn.0042f510
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0042f3db
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.0042db83
push eax
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 2
call fcn.0042f510
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042f3db
mov ecx, edi
call fcn.0042daef
and dword [esi + 0x3c], 0
mov ecx, edi
mov dword [esi + 0x38], eax
call fcn.0042daef
and dword [esi + 0x34], 0
mov ecx, edi
mov dword [esi + 0x30], eax
call fcn.0042daef
mov ecx, dword [ebp - 0xc]
and dword [esi + 0x44], 0
mov dword [esi + 0x40], eax
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40b6d0
Capabilities:
Create directory

Disassembly:
mov eax, 0x48193c
call fcn.004801f0
sub esp, 0x10
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
call fcn.0043075c
call fcn.0040b62f
test al, al
pop ecx
jne 0x40b750
mov ecx, dword [ebp + 8]
push 0
call fcn.004311c6
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40b750
mov ecx, dword [ebp + 8]
call fcn.004311c6
push eax
lea ecx, [ebp + 8]
call fcn.0042f493
mov esi, eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.004311c6
push eax
lea eax, [ebp - 0x1c]
push str.cant_create_folder__s_error__d
push eax
call fcn.0042c02a
add esp, 0x10
lea eax, [ebp - 0x1c]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40b9d4
Capabilities:
Delete file

Disassembly:
mov eax, 0x4819f0
call fcn.004801f0
sub esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40ba2f
push esi
lea ecx, [ebp + 8]
push dword [ebp + 8]
call fcn.0042f493
mov esi, eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.004311c6
push eax
lea eax, [ebp - 0x18]
push str.Cant_delete_file__s_error_d
push eax
call fcn.0042c02a
add esp, 0x10
lea eax, [ebp - 0x18]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x40ba62
Capabilities:
Move file

Disassembly:
mov eax, 0x481a0c
call fcn.004801f0
sub esp, 0x10
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40badb
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0042f493
mov esi, eax
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042f493
mov edi, eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004311c6
push eax
mov ecx, edi
call fcn.004311c6
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x1c]
push str.error_d_while_renaming__s_to__s
push eax
call fcn.0042c02a
add esp, 0x14
lea eax, [ebp - 0x1c]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x40bdb8
Capabilities:
Get common file path

Disassembly:
mov eax, 0x481a77
call fcn.004801f0
sub esp, 0x14
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.00430750
mov esi, dword [ebp + 0xc]
xor edi, edi
inc edi
dec esi
neg esi
sbb esi, esi
push 0x104
and esi, 0xfffffff9
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
add esi, 0x23
call fcn.00430f4c
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x40be25
push eax
lea eax, [ebp - 0x20]
push str.SHGetFolderPathW___Error_X
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x20]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00431022
lea eax, [ebp - 0x10]
push eax
call fcn.0040b92e
lea ecx, [ebp - 0x10]
mov dword [esp], str.AMMYY_
call fcn.00430efb
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0043075c
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00430a4d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40bead
Capabilities:
Get hostname

Disassembly:
mov eax, 0x481aa3
call fcn.004801f0
sub esp, 0x18
and dword [ebp - 0x18], 0
push esi
lea ecx, [ebp - 0x10]
call fcn.0042f0da
xor esi, esi
lea ecx, [ebp - 0x14]
mov eax, 0x400
inc esi
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
call fcn.0042f8c8
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x40bf13
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x24]
push str.GetComputerName___error_d
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x24]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0042f99e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0042f0e6
mov dword [ebp - 0x18], esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042f3db
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40d389
Capabilities:
Get process heap force flags

Disassembly:
mov eax, 0x481dbb
call fcn.004801f0
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x488c40
lea ecx, [esi + 0x6c]
mov dword [ebp - 4], 9
call fcn.0041b548
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 8
call fcn.0042e942
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 7
call fcn.0042e942
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 6
call fcn.0042e942
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 5
call fcn.0042e942
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 4
call fcn.0042e942
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 3
call fcn.0042e942
lea ecx, [esi + 0x18]
mov byte [ebp - 4], 2
call fcn.00430a4d
lea ecx, [esi + 0x14]
mov byte [ebp - 4], 1
call fcn.00430a4d
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.00430a4d
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0042e942
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40f966
Capabilities:
Get common file path

Disassembly:
mov eax, 0x48227f
call fcn.004801f0
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.00430750
xor esi, esi
push 0x104
inc esi
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
call fcn.00430f4c
push eax
push ebx
push ebx
push 5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x40f9c5
push eax
lea eax, [ebp - 0x20]
push str.SHGetFolderPathW___Error_X
push eax
call fcn.0042c02a
add esp, 0xc
lea eax, [ebp - 0x20]
push 0x49451c
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00431022
lea eax, [ebp - 0x10]
push eax
call fcn.0040b92e
pop ecx
lea eax, [ebp - 0x10]
mov ecx, dword [ebp + 8]
push eax
call fcn.0043075c
mov dword [ebp - 0x14], esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.00430a4d
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41341a
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x482ad1
call fcn.004801f0
push ecx
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ecx
push ebx
mov dword [ebp - 0x10], esi
call fcn.0042ecee
lea ecx, [esi + 0x10]
mov dword [ebp - 4], ebx
call fcn.00422833
lea edi, [esi + 0x18]
push ebx
mov ecx, edi
call fcn.0042e914
mov dword [edi], 0x488c54
push ebx
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.0042e914
push ebx
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0042e914
push ebx
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 3
call fcn.0042e914
push ebx
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 4
call fcn.0042e914
push ebx
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 5
call fcn.0042e914
lea edi, [esi + 0x60]
push ebx
mov ecx, edi
mov byte [ebp - 4], 6
call fcn.0042e914
mov dword [edi], 0x488c58
push ebx
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 7
call fcn.0042e914
push ebx
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 8
call fcn.0042e914
push ebx
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 9
call fcn.0042e914
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 0xa
call fcn.0042e602
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 0xb
call fcn.0040dd92
push fcn.0041f8ca
push fcn.0041f892
push 0x10
lea eax, [esi + 0x278]
push 0x18
push eax
mov byte [ebp - 4], 0xc
call fcn.004803d3
lea ecx, [esi + 0x3f8]
mov byte [ebp - 4], 0xd
call fcn.0041f892
push 5
mov dword [esi], 0x488cf0
call dword [sym.imp.GDI32.dll_GetStockObject]
mov edi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0xdef5d2
mov dword [esi + 0x204], eax
call edi
push 0xf6e8d4
mov dword [0x4b554c], eax
call edi
push 0xffffff
mov dword [0x4b5550], eax
call edi
push 0xe9e9e9
mov dword [0x4b5554], eax
call edi
push 0xf0dcf5
mov dword [0x4b5558], eax
call edi
mov edi, dword [sym.imp.USER32.dll_LoadImageA]
push ebx
push 0x10
push 0x10
push 1
push 0x80
mov dword [0x4b555c], eax
push 0x400000
mov dword [esi + 0x26c], ebx
mov dword [esi + 0x270], ebx
mov dword [esi + 0x274], ebx
call edi
push ebx
push 0x20
push 0x20
push 1
push 0x80
push 0x400000
mov dword [esi + 0x42c], eax
call edi
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x430], eax
mov byte [esi + 0x410], bl
mov dword [0x4b5454], esi
mov dword [esi + 0x424], ebx
mov dword [esi + 0x268], ebx
mov dword [esi + 0x428], ebx
mov dword [esi + 0x260], ebx
mov dword [esi + 0x264], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x413613
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
mov eax, 0x482b97
call fcn.004801f0
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], 0x488cf0
mov dword [ebp - 4], 0xe
mov edi, 0x4b5ee0
jmp 0x413641
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, edi
call fcn.004528dc
test al, al
jne 0x413639
mov ecx, esi
call fcn.00413849
and dword [0x4b5454], 0
lea edi, [esi + 0x424]
mov eax, dword [edi]
test eax, eax
je 0x413670
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
and dword [edi], 0
lea edi, [esi + 0x268]
push ebx
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [edi]
test eax, eax
je 0x413689
push eax
call ebx
and dword [edi], 0
mov eax, dword [esi + 0x428]
test eax, eax
je 0x413696
push eax
call ebx
mov eax, dword [esi + 0x264]
pop ebx
test eax, eax
je 0x4136a8
push eax
call dword [sym.imp.USER32.dll_DestroyMenu]
lea ecx, [esi + 0x3f8]
mov byte [ebp - 4], 0xd
call fcn.0041f8ca
push fcn.0041f8ca
push 0x10
lea eax, [esi + 0x278]
push 0x18
push eax
mov byte [ebp - 4], 0xc
call fcn.004802df
lea ecx, [esi + 0xb4]
mov byte [ebp - 4], 0xb
call fcn.0040de8d
lea ecx, [esi + 0x90]
mov byte [ebp - 4], 0xa
call fcn.0042e670
lea ecx, [esi + 0x84]
mov byte [ebp - 4], 9
call fcn.0042e942
lea ecx, [esi + 0x78]
mov byte [ebp - 4], 8
call fcn.0042e942
lea ecx, [esi + 0x6c]
mov byte [ebp - 4], 7
call fcn.0042e942
lea ecx, [esi + 0x60]
mov byte [ebp - 4], 6
call fcn.0042e942
lea ecx, [esi + 0x54]
mov byte [ebp - 4], 5
call fcn.0042e942
lea ecx, [esi + 0x48]
mov byte [ebp - 4], 4
call fcn.0042e942
lea ecx, [esi + 0x3c]
mov byte [ebp - 4], 3
call fcn.0042e942
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 2
call fcn.0042e942
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 1
call fcn.0042e942
and byte [ebp - 4], 0
lea ecx, [esi + 0x18]
call fcn.0042e942
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.0042e942
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret