joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406160
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [ebp - 0x138], ecx
lea eax, [ebp - 0x114]
push eax
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
add edx, 0x188
push edx
lea eax, [ebp - 0x110]
push eax
call fcn.0041e1b0
add esp, 8
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x134], ecx
mov edx, dword [ebp - 0x114]
mov dword [ebp - 0x130], edx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x12c], eax
push 0
push 0
push 0
push str.folder_to_install
mov ecx, 0x42fdb8
call fcn.0041c530
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], 0x60
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x118], 0
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x40639b
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
add edx, 0x188
push edx
call fcn.0041e1b0
add esp, 8
lea eax, [ebp - 0x110]
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
add edx, 0x28c
push edx
call fcn.0041e1b0
add esp, 8
push 0x42a07c
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
add ecx, 0x188
push ecx
call fcn.0041e1c0
add esp, 8
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 4]
add eax, 0x84
push eax
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
add edx, 0x188
push edx
call fcn.0041e1c0
add esp, 8
push 0x42a080
push 0x42a084
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
add ecx, 0x188
push ecx
call fcn.00406010
add esp, 0xc
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
add ecx, 0x188
push ecx
call fcn.0041e1b0
add esp, 8
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 4]
cmp dword [eax + 0x4dc], 0
je 0x406353
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
movsx eax, byte [edx + 0x390]
test eax, eax
je 0x406353
push 0x42a088
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
add edx, 0x28c
push edx
call fcn.0041e1c0
add esp, 8
mov eax, dword [ebp - 0x138]
mov ecx, dword [eax + 4]
add ecx, 0x390
push ecx
mov edx, dword [ebp - 0x138]
mov eax, dword [edx + 4]
add eax, 0x28c
push eax
call fcn.0041e1c0
add esp, 8
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
add edx, 0x188
push edx
push 0x3fa
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov ecx, dword [ebp - 0x138]
mov edx, dword [ecx + 4]
add edx, 0x188
push edx
mov eax, dword [ebp - 0x138]
add eax, 0xc
push eax
call fcn.0041e1b0
add esp, 8
mov eax, 1
jmp 0x40639d
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x40a7a0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x348
mov dword [ebp - 0x348], ecx
lea eax, [ebp - 0x22c]
push eax
push 2
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x40a7da
xor eax, eax
jmp 0x40a952
lea edx, [ebp - 0x11c]
push edx
push 0
push str.Manufacturer
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetLineByIndexA]
test eax, eax
je 0x40a940
push 0
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x11c]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
test eax, eax
je 0x40a940
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineCountA]
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x234], 0
jmp 0x40a85b
mov edx, dword [ebp - 0x234]
add edx, 1
mov dword [ebp - 0x234], edx
mov eax, dword [ebp - 0x234]
cmp eax, dword [ebp - 0x230]
jge 0x40a940
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x234]
push edx
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.SETUPAPI.dll_SetupGetLineByIndexA]
test eax, eax
je 0x40a93b
push 0
push 0x104
lea edx, [ebp - 0x228]
push edx
push 0
push 0
push 0
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupGetLineTextA]
test eax, eax
je 0x40a93b
push 0x2c
lea ecx, [ebp - 0x228]
push ecx
call fcn.00420500
add esp, 8
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x40a93b
mov edx, dword [ebp - 0x238]
add edx, 1
mov dword [ebp - 0x344], edx
push str.Enum_
lea eax, [ebp - 0x340]
push eax
call fcn.0041e1b0
add esp, 8
mov ecx, dword [ebp - 0x344]
push ecx
lea edx, [ebp - 0x340]
push edx
call fcn.0041e1c0
add esp, 8
push str.SUBSYS_00000000REV_11
lea eax, [ebp - 0x340]
push eax
call fcn.0041e1c0
add esp, 8
lea ecx, [ebp - 0x340]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x40a84c
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x40a9f0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 4
mov ecx, dword [ebp - 8]
push ecx
push 0x40a9b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 8]
mov dword [edx + 0x290], eax
mov eax, dword [ebp - 8]
cmp dword [eax + 0x290], 0
je 0x40aa52
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x294], 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x290]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
jmp 0x40aa54
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40b100
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov dword [ebp - 0x21c], ecx
cmp dword [ebp + 8], 0
jne 0x40b11f
mov eax, 1
jmp 0x40b26b
push 0x42a808
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x74]
push edx
call fcn.00420120
add esp, 8
test eax, eax
jne 0x40b147
mov eax, 1
jmp 0x40b26b
push 0
push 0
push 0
push 0
push str.create_group
mov ecx, 0x42fdb8
call fcn.0041c530
push eax
mov ecx, dword [ebp - 0x21c]
call fcn.0040c650
lea eax, [ebp - 8]
push eax
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
call dword [eax + 0x14]
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
call dword [eax + 8]
push 0x42a820
lea edx, [ebp - 0x110]
push edx
call fcn.0041e1c0
add esp, 8
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.0041e1c0
add esp, 8
push 0
lea edx, [ebp - 0x110]
push edx
call fcn.0041ea1b
add esp, 8
cmp eax, 0xffffffff
jne 0x40b241
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041e1b0
add esp, 8
lea edx, [ebp - 0x218]
push edx
call fcn.0041e990
add esp, 4
movsx eax, byte [ebp + eax - 0x219]
cmp eax, 0x5c
je 0x40b232
push 0x42a824
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041e1c0
add esp, 8
lea edx, [ebp - 0x218]
push edx
call fcn.00404030
add esp, 4
mov eax, dword [ebp - 0x21c]
add eax, 0x184
push eax
lea ecx, [ebp - 0x110]
push ecx
push str.group
mov edx, dword [0x42f060]
push edx
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40b280
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
mov dword [ebp - 0x454], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x14]
push eax
push 0x42ba88
push 1
push 0
push 0x42ba98
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x40b46d
push 0x104
lea ecx, [ebp - 0x120]
push ecx
call fcn.0041ef75
add esp, 8
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea ecx, [ebp - 0x228]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
call dword [eax + 0x14]
mov edx, dword [ebp - 8]
mov eax, dword [edx]
mov ecx, dword [ebp - 8]
push ecx
call dword [eax + 8]
lea edx, [ebp - 0x228]
push edx
call fcn.0041ed10
add esp, 4
lea eax, [ebp - 0x340]
push eax
push 0x42a830
call fcn.0041e7d1
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
je 0x40b452
lea ecx, [ebp - 0x344]
push ecx
push 0x42baa8
mov edx, dword [ebp - 0x14]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [eax]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jl 0x40b42b
push 0
lea edx, [ebp - 0x32c]
push edx
mov ecx, 0x42fdb8
call fcn.0041c5d0
push eax
mov eax, dword [ebp - 0x344]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x344]
push edx
call dword [ecx + 0x14]
test eax, eax
jne 0x40b419
push 1
push 0
push 0x104
lea eax, [ebp - 0x450]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x14]
push eax
call dword [edx + 0xc]
lea ecx, [ebp - 0x450]
push ecx
call fcn.0040f6f0
add esp, 4
mov dword [ebp - 0x348], eax
cmp dword [ebp - 0x348], 0
je 0x40b419
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x348]
push eax
call fcn.0042828e
add esp, 8
test eax, eax
jne 0x40b419
push 0
push 0
push 0
push 0
push str.delete_old_shortcuts
mov ecx, 0x42fdb8
call fcn.0041c530
push eax
mov ecx, dword [ebp - 0x454]
call fcn.0040c650
lea ecx, [ebp - 0x32c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x344]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x344]
push ecx
call dword [eax + 8]
lea edx, [ebp - 0x340]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.0041e8ae
add esp, 8
test eax, eax
je 0x40b346
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.0041e74d
add esp, 4
lea edx, [ebp - 0x120]
push edx
call fcn.0041ed10
add esp, 4
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x14]
push edx
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x40c730
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x474
mov dword [ebp - 0x474], ecx
cmp dword [ebp + 8], 0
jle 0x40c74b
cmp dword [ebp + 0xc], 0
jne 0x40c755
mov eax, 1
jmp 0x40c951
mov dword [ebp - 4], 1
mov dword [ebp - 8], 0
jmp 0x40c76e
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp + 8]
jge 0x40c94e
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x40c933
mov dword [ebp - 0x138], 0x128
lea edx, [ebp - 0x138]
push edx
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40c929
cmp dword [ebp - 0x130], 0
jne 0x40c7c0
jmp 0x40c911
mov ecx, dword [ebp - 0x130]
push ecx
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0xffffffff
jne 0x40c7e2
jmp 0x40c911
mov dword [ebp - 0x368], 0x224
lea edx, [ebp - 0x368]
push edx
mov eax, dword [ebp - 0x13c]
push eax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x40c904
push 0x5c
lea ecx, [ebp - 0x248]
push ecx
call fcn.0041e720
add esp, 8
mov dword [ebp - 0x36c], eax
cmp dword [ebp - 0x36c], 0
je 0x40c838
mov edx, dword [ebp - 0x36c]
add edx, 1
mov dword [ebp - 0x36c], edx
jmp 0x40c844
lea eax, [ebp - 0x248]
mov dword [ebp - 0x36c], eax
mov ecx, dword [ebp - 0x36c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0042828e
add esp, 8
test eax, eax
jne 0x40c904
mov eax, dword [ebp - 0x360]
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x370], eax
push 0
mov ecx, dword [ebp - 0x370]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40c8ec
push str.Failed_to_terminate_process._n
lea edx, [ebp - 0x470]
push edx
call fcn.0041e1b0
add esp, 8
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x470]
push ecx
call fcn.0041e1c0
add esp, 8
push 0x10
lea edx, [ebp - 0x470]
push edx
push 0x42a9d8
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x370]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x13c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c929
mov edx, dword [ebp - 0x370]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x138]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40c7b2
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041e990
add esp, 4
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax + 1]
mov dword [ebp + 0xc], eax
jmp 0x40c765
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x40c960
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0x68], ecx
cmp dword [ebp + 8], 0
jle 0x40c975
cmp dword [ebp + 0xc], 0
jne 0x40c97f
mov eax, 1
jmp 0x40caad
push 0
push 0
push 0
push 0x42a9e0
mov ecx, 0x42fdb8
call fcn.0041c530
push eax
push 0
mov ecx, dword [ebp - 0x68]
call fcn.0040c650
mov dword [ebp - 4], 0
jmp 0x40c9b1
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jge 0x40caa8
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x68]
call fcn.0040c650
mov ecx, dword [ebp - 0x68]
call fcn.0040c600
mov ecx, dword [ebp - 0x68]
call fcn.0040dc60
test eax, eax
je 0x40c9e6
xor eax, eax
jmp 0x40caad
push 0x44
push 0
lea eax, [ebp - 0x60]
push eax
call fcn.0041ecb0
add esp, 0xc
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x34], 1
mov word [ebp - 0x30], 5
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0041ecb0
add esp, 0xc
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x60]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40ca71
push 0x1f4
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40ca5b
call fcn.0040f750
jmp 0x40ca3e
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40ca8d
push 0
push 0x42a9ec
mov edx, dword [ebp + 0xc]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041e990
add esp, 4
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + eax + 1]
mov dword [ebp + 0xc], edx
jmp 0x40c9a8
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40cac0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov dword [ebp - 0x170], ecx
cmp dword [ebp + 8], 0
jle 0x40cadb
cmp dword [ebp + 0xc], 0
jne 0x40cae5
mov eax, 1
jmp 0x40cc72
push 0
push 0
push 0
push 0x42aa04
mov ecx, 0x42fdb8
call fcn.0041c530
push eax
push 0
mov ecx, dword [ebp - 0x170]
call fcn.0040c650
mov dword [ebp - 4], 0
jmp 0x40cb1a
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jge 0x40cc6d
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x170]
call fcn.0040c650
mov ecx, dword [ebp - 0x170]
call fcn.0040c600
mov ecx, dword [ebp - 0x170]
call fcn.0040dc60
test eax, eax
je 0x40cb58
xor eax, eax
jmp 0x40cc72
push 0x44
push 0
lea eax, [ebp - 0x168]
push eax
call fcn.0041ecb0
add esp, 0xc
mov dword [ebp - 0x168], 0x44
mov dword [ebp - 0x13c], 1
mov word [ebp - 0x138], 5
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0041ecb0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x460]
push edx
push 0x42aa10
lea eax, [ebp - 0x120]
push eax
call fcn.0041ff7b
add esp, 0x10
mov ecx, dword [ebp - 0x170]
call fcn.0040a9f0
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x168]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x120]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40cc28
push 0x1f4
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40cc12
call fcn.0040f750
jmp 0x40cbf5
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40cc47
push 0
push 0x42aa58
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x170]
call fcn.0040aa60
mov edx, dword [ebp + 0xc]
push edx
call fcn.0041e990
add esp, 4
mov ecx, dword [ebp + 0xc]
lea edx, [ecx + eax + 1]
mov dword [ebp + 0xc], edx
jmp 0x40cb11
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40cc80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x170
mov dword [ebp - 0x170], ecx
cmp dword [ebp + 8], 0
jle 0x40cc9b
cmp dword [ebp + 0xc], 0
jne 0x40cca5
mov eax, 1
jmp 0x40ce32
push 0
push 0
push 0
push str.running_ext
mov ecx, 0x42fdb8
call fcn.0041c530
push eax
push 0
mov ecx, dword [ebp - 0x170]
call fcn.0040c650
mov dword [ebp - 4], 0
jmp 0x40ccda
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jge 0x40ce2d
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x170]
call fcn.0040c650
mov ecx, dword [ebp - 0x170]
call fcn.0040c600
mov ecx, dword [ebp - 0x170]
call fcn.0040dc60
test eax, eax
je 0x40cd18
xor eax, eax
jmp 0x40ce32
push 0x44
push 0
lea eax, [ebp - 0x168]
push eax
call fcn.0041ecb0
add esp, 0xc
mov dword [ebp - 0x168], 0x44
mov dword [ebp - 0x13c], 1
mov word [ebp - 0x138], 5
push 0x10
push 0
lea ecx, [ebp - 0x14]
push ecx
call fcn.0041ecb0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x170]
mov ecx, dword [eax + 4]
add ecx, 0x188
push ecx
push str.RUNDLL32.EXE_SETUPAPI.DLL_InstallHinfSection_DefaultInstall_132__s_s
lea edx, [ebp - 0x120]
push edx
call fcn.0041ff7b
add esp, 0x10
mov ecx, dword [ebp - 0x170]
call fcn.0040a9f0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x168]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x120]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40cde8
push 0x1f4
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40cdd2
call fcn.0040f750
jmp 0x40cdb5
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40ce07
push 0
push str.CreateProcess___Failed
mov eax, dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x16c], eax
mov ecx, dword [ebp - 0x170]
call fcn.0040aa60
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041e990
add esp, 4
mov edx, dword [ebp + 0xc]
lea eax, [edx + eax + 1]
mov dword [ebp + 0xc], eax
jmp 0x40ccd1
mov eax, 1
mov esp, ebp
pop ebp
ret 8
Function at 0x40d640
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov dword [ebp - 0x220], ecx
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax + 4]
cmp dword [ecx + 0x4d4], 0
je 0x40d673
mov edx, dword [ebp - 0x220]
mov eax, dword [edx + 4]
cmp dword [eax + 0x4d8], 0
jg 0x40d67a
xor eax, eax
jmp 0x40d773
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x460]
push eax
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041e1b0
add esp, 8
push str.embed_
lea edx, [ebp - 0x218]
push edx
call fcn.0041e1c0
add esp, 8
mov eax, dword [ebp - 0x220]
mov ecx, dword [eax + 4]
mov edx, dword [ecx + 0x4d4]
push edx
lea eax, [ebp - 0x218]
push eax
call fcn.0041e1c0
add esp, 8
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.0041ea1b
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40d6ed
xor eax, eax
jmp 0x40d773
mov edx, dword [ebp - 0x220]
mov eax, dword [edx + 4]
mov ecx, dword [eax + 0x4d8]
mov dword [ebp - 0x224], ecx
cmp dword [ebp - 0x224], 1
je 0x40d70d
jmp 0x40d76e
push 0x104
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x42add4
lea eax, [ebp - 0x110]
push eax
call fcn.0041e1c0
add esp, 8
mov ecx, dword [ebp - 0x220]
mov edx, dword [ecx + 4]
mov eax, dword [edx + 0x4d4]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.0041e1c0
add esp, 8
push 1
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 0x21c], eax
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x40d9d0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov dword [ebp - 0x12c], ecx
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.0041ecb0
add esp, 0xc
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.0041e1b0
add esp, 8
push 0x42add8
lea eax, [ebp - 0x108]
push eax
call fcn.0041e1c0
add esp, 8
mov ecx, dword [ebp + 0x14]
push ecx
lea edx, [ebp - 0x108]
push edx
call fcn.0041e1c0
add esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x124], 2
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x120], ecx
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x11c], edx
mov word [ebp - 0x118], 0x210
mov dword [ebp - 0x116], 0
mov dword [ebp - 0x112], 0
mov dword [ebp - 0x10e], 0
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
cmp dword [ebp - 0x116], 0
je 0x40da98
xor eax, eax
jmp 0x40da9d
mov eax, 1
mov esp, ebp
pop ebp
ret 0x10