joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f9b0
Capabilities:
Set environment variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40fb6e
push 0x3d
push edi
call fcn.004109c0
mov esi, eax
add esp, 8
test esi, esi
je 0x40fb6e
cmp edi, esi
je 0x40fb6e
mov dl, byte [esi + 1]
mov ecx, dword [0x4172d0]
xor eax, eax
test dl, dl
sete al
mov ebp, eax
mov eax, dword [0x4172cc]
cmp eax, ecx
jne 0x40fa07
push eax
call fcn.0040fc40
add esp, 4
mov dword [0x4172cc], eax
test eax, eax
jne 0x40fa82
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40fa2e
mov eax, dword [0x4172d4]
test eax, eax
je 0x40fa2e
call fcn.0040dc60
test eax, eax
je 0x40fa7d
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
test ebp, ebp
je 0x40fa3a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 4
call fcn.0040b7e0
add esp, 4
mov dword [0x4172cc], eax
test eax, eax
je 0x40fb6e
mov dword [eax], 0
mov eax, dword [0x4172d4]
test eax, eax
jne 0x40fa7d
push 4
call fcn.0040b7e0
add esp, 4
mov dword [0x4172d4], eax
test eax, eax
je 0x40fb6e
mov dword [eax], 0
mov eax, dword [0x4172cc]
mov ebx, eax
mov eax, esi
sub eax, edi
push eax
push edi
mov dword [esp + 0x18], eax
call fcn.0040fbc0
mov esi, eax
add esp, 8
test esi, esi
jl 0x40fb7f
cmp dword [ebx], 0
je 0x40fb7f
test ebp, ebp
je 0x40fb77
mov ecx, dword [ebx + esi*4]
lea edi, [ebx + esi*4]
push ecx
call fcn.0040b210
mov eax, dword [edi]
add esp, 4
test eax, eax
je 0x40fad9
mov eax, edi
mov edx, dword [eax + 4]
add eax, 4
mov dword [edi], edx
inc esi
mov ecx, dword [eax]
mov edi, eax
test ecx, ecx
jne 0x40fac8
lea eax, [esi*4]
push eax
push ebx
call fcn.00410820
add esp, 8
test eax, eax
je 0x40faf3
mov dword [0x4172cc], eax
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x40fb66
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
inc ecx
push ecx
call fcn.0040b7e0
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40fb66
mov edi, dword [esp + 0x18]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x10]
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
neg ebp
rep movsb byte es:[edi], byte [esi]
sbb ebp, ebp
mov byte [ebx + eax], 0
lea eax, [ebx + eax + 1]
not ebp
and ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push ebx
call fcn.0040b210
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
mov dword [ebx + esi*4], edi
jmp 0x40faf7
test ebp, ebp
jne 0x40fb66
test esi, esi
jge 0x40fb89
neg esi
lea ecx, [esi*4 + 8]
push ecx
push ebx
call fcn.00410820
add esp, 8
test eax, eax
je 0x40fb6e
mov dword [eax + esi*4], edi
mov dword [eax + esi*4 + 4], 0
mov dword [0x4172cc], eax
jmp 0x40faf7
Function at 0x410ac0
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1004
call fcn.0040b260
mov eax, dword [0x4177e0]
push ebx
mov ebx, dword [esp + 0x100c]
push ebp
xor ebp, ebp
push esi
cmp ebx, eax
push edi
jae 0x410c22
mov eax, ebx
mov ecx, ebx
sar eax, 5
and ecx, 0x1f
mov edx, dword [eax*4 + 0x4176e0]
test byte [edx + ecx*8 + 4], 1
je 0x410c22
push 1
push ebp
push ebx
call fcn.0040dce0
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x410c2c
push 2
push ebp
push ebx
call fcn.0040dce0
add esp, 0xc
cmp eax, 0xffffffff
je 0x410c2c
mov ecx, dword [esp + 0x101c]
mov esi, ecx
sub esi, eax
test esi, esi
jle 0x410bc8
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x14]
push 0x8000
rep stosd dword es:[edi], eax
push ebx
call fcn.00410d10
add esp, 8
mov edi, eax
cmp esi, 0x1000
mov eax, 0x1000
jge 0x410b6f
mov eax, esi
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.0040dda0
add esp, 0xc
cmp eax, 0xffffffff
je 0x410b8b
sub esi, eax
test esi, esi
jle 0x410ba1
jmp 0x410b60
cmp dword [0x4172a8], 5
jne 0x410b9e
mov dword [0x4172a4], 0xd
or ebp, 0xffffffff
push edi
push ebx
call fcn.00410d10
mov edi, dword [esp + 0x18]
add esp, 8
push 0
push edi
push ebx
call fcn.0040dce0
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
jge 0x410c09
push 0
push ecx
push ebx
call fcn.0040dce0
add esp, 0xc
push ebx
call fcn.0040ff30
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ebp, eax
neg ebp
sbb ebp, ebp
neg ebp
dec ebp
cmp ebp, 0xffffffff
jne 0x410c09
mov dword [0x4172a4], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4172a8], eax
push 0
push edi
push ebx
call fcn.0040dce0
add esp, 0xc
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1004
ret
mov dword [0x4172a4], 9
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x1004
ret
Function at 0x4012c9
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get number of processors

Disassembly:
mov eax, 0x47c828
call fcn.0047bf90
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x14], esi
lea ecx, [esi + 4]
call fcn.0042a6b5
xor ebx, ebx
lea ecx, [esi + 0xc]
mov dword [ebp - 4], ebx
call fcn.0042a6b5
lea ecx, [esi + 0x10]
mov byte [ebp - 4], 1
call fcn.0042a6b5
lea ecx, [esi + 0x24]
mov byte [ebp - 4], 2
call fcn.0042a6b5
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 3
call fcn.0042a6b5
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 4
call fcn.0042a6b5
lea ecx, [esi + 0x34]
mov byte [ebp - 4], 5
call fcn.0042a6b5
lea ecx, [esi + 0x40]
mov byte [ebp - 4], 6
call fcn.00428ebc
mov al, byte [ebp - 0xd]
lea ecx, [esi + 0x64]
mov byte [ebp - 4], 7
mov byte [ecx], al
mov al, byte [ebp - 0xd]
mov byte [ecx + 1], al
mov byte [ecx + 8], bl
call fcn.00402d67
or dword [esi + 0x20], 0xffffffff
lea edi, [esi + 0x74]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword [esi], 0x4838dc
mov dword [esi + 0x14], 0x1f40
mov byte [esi + 0x18], 1
mov word [esi + 8], bx
mov dword [esi + 0x1c], ebx
mov word [esi + 0x30], bx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x60], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4018e5
Capabilities:
Get socket status
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, ecx
push edi
mov edi, str.S:Ammyy_sourcesmainproxyHttpClient.cpp
cmp dword [esi + 0x20], 0xffffffff
jne 0x401913
push 0x117
push edi
lea ecx, [ebp - 0x10]
call fcn.00425726
mov ecx, eax
call fcn.00425832
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x40191f
cmp dword [ebp + 0xc], ebx
jg 0x401934
push 0x118
push edi
lea ecx, [ebp - 0x10]
call fcn.00425726
mov ecx, eax
call fcn.00425832
mov eax, dword [esi + 0x14]
xor edx, edx
mov ecx, 0x3e8
mov dword [ebp - 0x114], 1
div ecx
lea ecx, [ebp - 8]
push ecx
push ebx
lea ecx, [ebp - 0x114]
push ebx
push ecx
mov dword [ebp - 8], eax
lea eax, [edx + edx*4]
add eax, eax
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x110], eax
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp edi, ebx
jle 0x401993
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.WS2_32.dll_recv]
mov edi, eax
cmp edi, ebx
jl 0x4019b5
xor eax, eax
jmp 0x4019bb
jne 0x40198b
push dword [esi + 0x14]
push str.CHttpClient::ReadSocket__:_no_data_received_during__u_ms.
push 0x4aea90
call fcn.004287f7
add esp, 0xc
mov dword [esi + 0x1c], 0x274c
xor eax, eax
jmp 0x4019c0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [esi + 0x1c], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x403470
Capabilities:
Get client handle via schannel
Get inbound credentials handle via credssp
Get outbound credentials handle via credssp

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
push str.NTLM
mov esi, ecx
mov dword [ebp - 4], ebx
call sub.Secur32.dll_QuerySecurityPackageInfoA
cmp eax, ebx
je 0x40349d
push eax
push str.ERROR_in_CHttpNTLMAuthObject::Prepare__:_QuerySecurityPackageInfo___failed__result__0x_x_
jmp 0x403531
mov eax, dword [ebp - 4]
mov eax, dword [eax + 8]
cmp eax, 0x80000
mov dword [ebp - 8], eax
jbe 0x4034b5
push eax
push str.ERROR_in_CHttpNTLMAuthObject::Prepare__:_invalid_token_size__size___u_
jmp 0x403531
push 0xa
xor eax, eax
pop ecx
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x3c], 0x200
mov dword [ebp - 0x38], 0x2c
mov dword [ebp - 0x1c], 1
call fcn.0042b153
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x34], eax
call fcn.0042b131
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
call fcn.0042b153
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
call fcn.0042b131
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 4]
push eax
push ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
mov eax, dword [ebp - 4]
push ebx
push 2
push dword [eax + 0xc]
push ebx
call sub.Secur32.dll_AcquireCredentialsHandleA
push dword [ebp - 4]
mov edi, eax
call sub.Secur32.dll_FreeContextBuffer
cmp edi, ebx
je 0x403542
push edi
push str.ERROR_in_CHttpNTLMAuthObject::Prepare__:_AcquireCredentialsHandle___failed__result__0x_x_
push 0x4aea90
call fcn.004287df
add esp, 0xc
xor al, al
jmp 0x40354a
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4064d7
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x47cb54
call fcn.0047bf90
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0xc]
call fcn.00428ebc
and dword [ebp - 4], 0
lea ecx, [esi + 0x24]
call fcn.0042bc6f
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.0042bc6f
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 2
call fcn.0042a6b5
lea ecx, [esi + 0x30]
mov byte [ebp - 4], 3
call fcn.0042a6b5
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40652f
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x47cb8c
call fcn.0047bf90
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.0042a9b6
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 2
call fcn.0042a9b6
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.0042bf6c
and byte [ebp - 4], 0
lea ecx, [esi + 0x24]
call fcn.0042bf6c
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.00428f7e
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40653a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x47cb8c
call fcn.0047bf90
push ecx
push esi
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 0x30]
mov dword [ebp - 4], 3
call fcn.0042a9b6
lea ecx, [esi + 0x2c]
mov byte [ebp - 4], 2
call fcn.0042a9b6
lea ecx, [esi + 0x28]
mov byte [ebp - 4], 1
call fcn.0042bf6c
and byte [ebp - 4], 0
lea ecx, [esi + 0x24]
call fcn.0042bf6c
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xc]
call fcn.00428f7e
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40761e
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x47cd8c
call fcn.0047bf90
sub esp, 0x234
push ebx
push esi
mov esi, ecx
xor ebx, ebx
inc ebx
push edi
cmp byte [esi + 8], 0
jne 0x40764b
cmp byte [esi + 5], 0
jne 0x40764b
and dword [0x4aea90], 0
jmp 0x407651
mov dword [0x4aea90], ebx
cmp byte [esi + 8], 0
je 0x4076a7
lea eax, [ebp - 0x10]
push eax
call fcn.00407c3a
and dword [ebp - 4], 0
mov dword [esp], 0x4a0414
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0042c250
add esp, 0xc
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.0042bf6c
lea ecx, [ebp - 0x18]
call fcn.0042b153
mov edi, 0x4aea90
push eax
mov ecx, edi
call fcn.0042856f
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042bf6c
jmp 0x4076b6
push dword [esi + 0x48]
mov edi, 0x4aea90
mov ecx, edi
call fcn.00428597
mov ecx, esi
call fcn.00406a49
cmp dword [0x4aea90], 0
push ebx
sete al
mov byte [0x4aed04], al
call fcn.00425863
pop ecx
mov ebx, str.Ammyy_Admin
push ebx
mov ecx, 0x4aed00
call fcn.0042ab80
push ebx
mov ecx, 0x4ae434
call fcn.0042ab80
push 0x4a0410
mov ecx, 0x4ae42c
call fcn.0042ab80
call fcn.00421efb
push eax
mov ecx, 0x4ae430
call fcn.0042ab80
push 0
push 0x100
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
lea eax, [ebp - 0xb0]
mov dword [ebp - 0xb0], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
movzx eax, word [ebp - 0xac]
movzx ecx, word [ebp - 0xa8]
shl eax, 0x10
or eax, ecx
push eax
push str.OS_version__X
push edi
mov dword [esi + 0x38], eax
call fcn.004287f7
add esp, 0xc
mov ecx, esi
call fcn.00407510
cmp byte [esi + 8], 0
jne 0x407848
lea eax, [ebp - 0x240]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4077a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x14]
push str.Error_d_WSAStartup__
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x14]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
mov edi, 0x4ae9b0
mov ecx, edi
call fcn.004211b2
cmp dword [esi + 0x1c], 0
jbe 0x407848
add esi, 0x10
mov ecx, esi
call fcn.00429234
mov word [0x4aed1a], ax
lea eax, [ebp - 0x10]
push eax
mov ecx, esi
call fcn.004292f1
push eax
mov ecx, 0x4aed14
mov dword [ebp - 4], 3
call fcn.0042aaeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042a9b6
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.004292f1
push eax
mov ecx, 0x4aed0c
mov dword [ebp - 4], 4
call fcn.0042aaeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042a9b6
lea eax, [ebp - 0x1c]
mov ecx, esi
push eax
call fcn.004292f1
push eax
mov ecx, 0x4aed08
mov dword [ebp - 4], 5
call fcn.0042aaeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042a9b6
mov ecx, edi
call fcn.00421a83
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4079bd
Capabilities:
Create directory
Set current directory

Disassembly:
mov eax, 0x47cdf8
call fcn.0047bf90
sub esp, 0x24
cmp byte [0x4ae3cc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
je 0x407a2b
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.0040ba66
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040aea6
add esp, 0x10
mov ecx, dword [ebp - 0x18]
push eax
mov byte [ebp - 4], 1
call fcn.0042c0ad
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0042bf6c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042bf6c
push dword [ebp - 0x18]
call fcn.0040b294
pop ecx
jmp 0x407b14
xor esi, esi
push 2
inc esi
pop ebx
cmp esi, ebx
jg 0x407b14
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.0040b71d
add esp, 4
lea eax, [ebp - 0x14]
mov ecx, esp
mov dword [ebp - 0x20], esp
push eax
mov dword [ebp - 4], ebx
call fcn.0042bc7b
call fcn.0040af95
test al, al
pop ecx
jne 0x407b3e
push 0
lea ecx, [ebp - 0x14]
call fcn.0042b153
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407ac2
lea ecx, [ebp - 0x14]
call fcn.0042b153
push eax
lea ecx, [ebp - 0x1c]
call fcn.0042aa6e
mov edi, eax
mov byte [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, edi
call fcn.0042b153
push eax
push str.CreateDirectoryW__s__error_u
push 0x4aea90
call fcn.004287df
add esp, 0x10
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.0042a9b6
jmp 0x407b51
cmp esi, 1
jne 0x407af9
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 4
call fcn.0042b153
push eax
call fcn.0040b52b
pop ecx
jmp 0x407af9
mov dword [ebp - 4], ebx
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
push eax
call fcn.0042c0ad
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0042bf6c
mov ecx, dword [ebp - 0x18]
call fcn.0042c6d5
test eax, eax
je 0x407b63
lea eax, [ebp - 0x28]
push str.Cant_find_any_writtable_folder
push eax
call fcn.0042783a
pop ecx
lea eax, [ebp - 0x28]
pop ecx
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
cmp esi, 1
jne 0x407afc
lea eax, [ebp - 0x14]
push eax
call fcn.0040b158
test al, al
pop ecx
jne 0x407afc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0042bf6c
inc esi
jmp 0x407a31
mov ecx, dword [ebp - 0x18]
call fcn.0042b153
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x407bbe
mov ecx, dword [ebp - 0x18]
call fcn.0042b153
push eax
lea ecx, [ebp - 0x20]
call fcn.0042aa6e
mov esi, eax
mov dword [ebp - 4], 6
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0042b153
push eax
lea eax, [ebp - 0x30]
push str.SetCurrentDirectoryW__s__error_u
push eax
call fcn.0042783a
add esp, 0x10
lea eax, [ebp - 0x30]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x408324
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x47cea0
call fcn.0047bf90
push ecx
push esi
push edi
lea ecx, [ebp - 0x10]
call fcn.0042a6b5
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx esi, ax
call fcn.004081c4
mov edi, eax
call fcn.004081f6
push eax
push edi
push esi
lea eax, [ebp - 0x10]
push str._u._u._d
push eax
call fcn.0042bbbf
mov ecx, dword [ebp + 8]
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
call fcn.00429139
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042a9b6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x40a206
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x47d2f8
call fcn.0047bf90
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
mov ecx, edi
call fcn.00429220
mov byte [esi + 0xc], al
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.004292f1
and dword [ebp - 4], 0
push eax
lea ecx, [esi + 0x10]
call fcn.0042aaeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0042a9b6
mov ecx, edi
call fcn.00429249
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.00429234
push eax
push dword [ebp + 8]
call fcn.00452a4c
pop ecx
mov dword [esi + 0x18], eax
pop ecx
mov dword [esi + 0x1c], edx
mov ecx, edi
call fcn.00429249
mov ecx, edi
call fcn.00429249
mov ecx, edi
mov dword [esi + 0x20], eax
call fcn.00429249
mov dword [esi + 0x24], eax
lea eax, [ebp + 8]
push eax
mov ecx, edi
call fcn.004292f1
push eax
lea ecx, [esi + 0x28]
mov dword [ebp - 4], 1
call fcn.0042aaeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0042a9b6
lea eax, [ebp - 0x10]
mov ecx, edi
push eax
call fcn.004292f1
push eax
lea ecx, [esi + 0x2c]
mov dword [ebp - 4], 2
call fcn.0042aaeb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0042a9b6
mov ecx, edi
call fcn.0042925d
and dword [esi + 0x3c], 0
mov ecx, edi
mov dword [esi + 0x38], eax
call fcn.0042925d
and dword [esi + 0x34], 0
mov ecx, edi
mov dword [esi + 0x30], eax
call fcn.0042925d
mov ecx, dword [ebp - 0xc]
and dword [esi + 0x44], 0
mov dword [esi + 0x40], eax
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40b036
Capabilities:
Create directory

Disassembly:
mov eax, 0x47d49c
call fcn.0047bf90
sub esp, 0xc
push esi
push ecx
mov ecx, esp
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
call fcn.0042bc7b
call fcn.0040af95
test al, al
pop ecx
jne 0x40b0b6
mov ecx, dword [ebp + 8]
push 0
call fcn.0042b153
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40b0b6
mov ecx, dword [ebp + 8]
call fcn.0042b153
push eax
lea ecx, [ebp + 8]
call fcn.0042aa6e
mov esi, eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0042b153
push eax
lea eax, [ebp - 0x18]
push str.cant_create_folder__s_error__d
push eax
call fcn.0042783a
add esp, 0x10
lea eax, [ebp - 0x18]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40b33a
Capabilities:
Delete file

Disassembly:
mov eax, 0x47d550
call fcn.0047bf90
push ecx
push ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40b394
push esi
lea ecx, [ebp + 8]
push dword [ebp + 8]
call fcn.0042aa6e
mov esi, eax
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, esi
call fcn.0042b153
push eax
lea eax, [ebp - 0x14]
push str.Cant_delete_file__s_error_d
push eax
call fcn.0042783a
add esp, 0x10
lea eax, [ebp - 0x14]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x40b3c7
Capabilities:
Move file

Disassembly:
mov eax, 0x47d56c
call fcn.0047bf90
sub esp, 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x40b440
push esi
push edi
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.0042aa6e
mov esi, eax
push dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042aa6e
mov edi, eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0042b153
push eax
mov ecx, edi
call fcn.0042b153
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x18]
push str.error_d_while_renaming__s_to__s
push eax
call fcn.0042783a
add esp, 0x14
lea eax, [ebp - 0x18]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x40b71d
Capabilities:
Get common file path

Disassembly:
mov eax, 0x47d5d7
call fcn.0047bf90
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
call fcn.0042bc6f
mov esi, dword [ebp + 0xc]
xor edi, edi
inc edi
dec esi
neg esi
sbb esi, esi
push 0x104
and esi, 0xfffffff9
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], edi
add esi, 0x23
call fcn.0042c46b
push eax
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
cmp eax, ebx
jge 0x40b78a
push eax
lea eax, [ebp - 0x1c]
push str.SHGetFolderPathW___Error_X
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x1c]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0042c541
lea eax, [ebp - 0x10]
push eax
call fcn.0040b294
lea ecx, [ebp - 0x10]
mov dword [esp], str.AMMYY_
call fcn.0042c41a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0042bc7b
mov dword [ebp - 0x14], edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0042bf6c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40b812
Capabilities:
Get hostname

Disassembly:
mov eax, 0x47d603
call fcn.0047bf90
sub esp, 0x14
and dword [ebp - 0x18], 0
push esi
lea ecx, [ebp - 0x10]
call fcn.0042a6b5
xor esi, esi
lea ecx, [ebp - 0x14]
mov eax, 0x400
inc esi
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], eax
call fcn.0042aea3
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x40b878
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x20]
push str.GetComputerName___error_d
push eax
call fcn.0042783a
add esp, 0xc
lea eax, [ebp - 0x20]
push 0x48e404
push eax
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
call fcn.0042af79
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0042a6c1
mov dword [ebp - 0x18], esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0042a9b6
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret