joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412268
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.00403570
add esp, 0x3f0
pop ebx
ret

Function at 0x4124dc
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403778
xor eax, eax
push ebp
push 0x41254d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.00407aec
mov edx, dword [ebp - 8]
mov eax, 0x417fe8
call fcn.00403464
xor eax, eax
mov dword [0x417fe4], eax
push 0
push 0x4123f0
call sub.user32.dll_EnumWindows
mov ebx, dword [0x417fe4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412554
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403434
ret

Function at 0x41255c
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push ecx
xor ebx, ebx
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov esi, eax
push esp
push esi
call sub.kernel32.dll_GetExitCodeProcess
test esi, esi
je 0x41258b
mov eax, dword [esp]
push eax
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop esi
pop ebx
ret
Function at 0x412ee0
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x412f87
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x417fcc]
push dword [eax + 0x28]
push 0x412f9c
push ebx
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00403648
mov edx, dword [ebp - 0x24]
mov eax, dword [0x417fc8]
call fcn.00412e38
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00404660
mov dword [ebp - 0x1a], 3
mov word [ebp - 0xe], 0x14
lea edx, [ebp - 0x28]
mov eax, ebx
call fcn.00404fe8
lea eax, [ebp - 0x28]
mov edx, 0x412fa8
call fcn.00403590
mov eax, dword [ebp - 0x28]
call fcn.00403788
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412f8e
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00403434
ret

Function at 0x412fac
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413040
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov bl, 1
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00404fe8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00407aec
mov esi, 8
mov edi, 0x417fec
mov eax, dword [ebp - 0xc]
mov edx, dword [edi]
call fcn.004036d4
jne 0x413004
xor ebx, ebx
jmp 0x41300a
add edi, 4
dec esi
jne 0x412ff4
test bl, bl
je 0x413025
mov eax, dword [ebp - 4]
call fcn.00403788
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413047
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403434
ret
Function at 0x413054
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403778
xor eax, eax
push ebp
push 0x413138
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
je 0x41311d
test bl, bl
je 0x4130b4
mov ebx, 8
mov eax, dword [ebp - 4]
call fcn.00403788
mov esi, eax
push esi
call sub.kernel32.dll_GetFileAttributesA
test al, 1
je 0x4130ac
push 0x80
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x4130c1
mov ebx, 0xa
mov eax, dword [ebp - 4]
call fcn.00412fac
mov eax, dword [0x417fcc]
push dword [eax + ebx*4]
push 0x413150
push dword [ebp - 4]
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403648
mov edx, dword [ebp - 8]
mov eax, dword [0x417fc8]
call fcn.00412e38
mov ebx, 0xa
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00404ffc
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.00404fe8
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
call fcn.004034a8
mov eax, dword [ebp - 4]
call fcn.00412fac
test al, al
jne 0x4130c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41313f
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403434
ret

Function at 0x4133b4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x48], ebx
mov ebx, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403778
mov eax, dword [ebp - 8]
call fcn.00403778
lea esi, [ebp - 0x44]
xor eax, eax
push ebp
push 0x413495
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00402a00
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 8], eax
mov eax, dword [ebp - 4]
call fcn.00403788
mov dword [esi + 0x10], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.00404ffc
mov eax, dword [ebp - 0x48]
call fcn.00403788
mov dword [esi + 0x18], eax
mov eax, dword [ebp - 8]
call fcn.00403788
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebx
mov dword [esi + 4], 0x200
cmp dword [ebp + 8], 1
jne 0x413443
or dword [esi + 4], 0x40
push esi
call sub.shell32.dll_ShellExecuteExA
jmp 0x413457
mov eax, dword [0x416b10]
mov eax, dword [eax]
call fcn.00408ac4
push 0x32
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x41344b
mov eax, dword [esi + 0x38]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41349c
lea eax, [ebp - 0x48]
call fcn.00403410
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403434
ret
Function at 0x402db0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.004043ec
test esi, esi
jne 0x402de7
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.004044dc
jmp 0x402e08
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402c4c
mov dword [esp], eax
test esi, esi
je 0x402e08
cmp dword [ebx], 0
je 0x402e08
dec esi
jmp 0x402def
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x4030ec
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x45e008], 0x8088405
inc edx
mov dword [ebx + 0x45e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403544
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x45e024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4035dc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4035bc
xor eax, eax
push ebp
push 0x4035b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x4035f8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4035bc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x45e024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x45e024], ax
mov esp, ebp
pop ebp
ret

Function at 0x4041e4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x46304c], 0
je 0x404245
cmp word [0x463220], 0xd7b2
jne 0x40420d
cmp dword [0x463228], 0
jbe 0x40420d
mov eax, 0x46321c
call dword [0x463238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x45e070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40426c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x45e034], 0
jne 0x404261
push 0
push 0x45e068
push 0x45e070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4043a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402a18
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x46304d], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404368
push eax
push esi
push ebx
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40654c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4065b2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040465c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00403108
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x40659c
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4065b9
lea eax, [ebp - 0x10]
call fcn.004043ec
ret

Function at 0x40b548
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b581
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004044dc
jmp 0x40b58a
mov eax, ebx
mov edx, esi
call fcn.00404440
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b594
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b5b5
mov al, byte [esp]
jmp 0x40b5b7
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40bc4c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40bab4
mov eax, dword [0x462b38]
cmp byte [eax], 0
je 0x40bcc8
mov eax, dword [0x4628d8]
call fcn.00402f1c
call fcn.00402b78
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408d50
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40bd10
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40bcfe
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x462880]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x463668]
call fcn.004059ac
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40cbb0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40cc14
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.0040465c
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408694
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cc1b
lea eax, [ebp - 0xc]
call fcn.004043ec
ret

Function at 0x40dfa4
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x40dfb7
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x40dfc6
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x40ec70
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x40ec83
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x40ec92
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x41a920
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
mov ebx, eax
mov eax, dword [ebx + 4]
push eax
call sub.kernel32.dll_ResumeThread
mov esi, eax
test esi, esi
setge dl
mov eax, ebx
call fcn.0041a74c
dec esi
jne 0x41a942
mov byte [ebx + 0xe], 0
pop esi
pop ebx
ret

Function at 0x41b0e8
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push ecx
mov edi, eax
xor ebx, ebx
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x41b14d
push 1
call sub.user32.dll_GetClipboardData
mov esi, eax
test esi, esi
je 0x41b148
push esi
call sub.kernel32.dll_GlobalLock
mov dword [esp], eax
cmp dword [esp], 0
je 0x41b148
push esi
call sub.kernel32.dll_GlobalSize
mov esi, eax
test esi, esi
je 0x41b13f
mov eax, edi
mov edx, esi
call fcn.004049f8
mov eax, edi
call fcn.00404920
mov ecx, esi
mov edx, dword [esp]
call fcn.00406f04
mov bl, 1
mov eax, dword [esp]
push eax
call sub.kernel32.dll_GlobalUnlock
call sub.user32.dll_CloseClipboard
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4246b4
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
push edi
test dl, dl
je 0x4246c3
add esp, 0xfffffff0
call fcn.00403938
mov ebx, edx
mov edi, eax
xor edx, edx
mov eax, edi
call fcn.00423dfc
mov dl, 1
mov eax, dword [0x416718]
call fcn.00403680
mov dword [edi + 0x2c], eax
mov dl, 1
mov eax, dword [0x416718]
call fcn.00403680
mov dword [edi + 0x64], eax
mov dl, 1
mov eax, dword [0x416a5c]
call fcn.00403680
mov dword [edi + 0x30], eax
mov dl, 1
mov eax, dword [0x41ea34]
call fcn.00423314
mov esi, eax
mov dword [edi + 0x1c], esi
mov dword [esi + 0x1c4], edi
mov byte [esi + 0x88], 1
mov eax, esi
mov edx, 0x10000
call fcn.00421718
mov eax, dword [edi + 0x1c]
mov edx, 0x10000
call fcn.00421740
mov dword [edi + 0x10], 0x493e0
lea eax, [edi + 8]
mov edx, 0x4247e0
call fcn.00404440
lea eax, [edi + 0x48]
call fcn.004043ec
lea eax, [edi + 0x4c]
mov edx, 0x4247ec
call fcn.00404440
lea eax, [edi + 0x50]
call fcn.004043ec
lea eax, [edi + 0x54]
call fcn.004043ec
lea eax, [edi + 0x24]
call fcn.004043ec
lea eax, [edi + 0x28]
call fcn.004043ec
lea eax, [edi + 0x38]
mov edx, 0x4247fc
call fcn.00404440
mov byte [edi + 0x3c], 1
mov byte [edi + 0x44], 0
lea eax, [edi + 0x60]
mov edx, 0x424808
call fcn.00404440
xor eax, eax
mov dword [edi + 0x68], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov byte [edi + 0x78], 1
mov dword [edi + 0x40], 0x12c
mov eax, edi
call fcn.004248c0
mov eax, edi
test bl, bl
je 0x4247d0
call fcn.00403990
pop dword fs:[0]
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x42b81c
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b8e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [0x462804]
mov ecx, dword [ecx]
lea eax, [ebp - 0xc]
mov edx, 0x42b8fc
call fcn.00404714
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 8]
call fcn.00404c0c
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42b8b9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00404bb4
push dword [ebp - 0x10]
push dword [ebp - 8]
push 0x42b904
mov eax, ebx
mov edx, 3
call fcn.00404d00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b8c0
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
ret

Function at 0x42b910
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42b9db
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
call fcn.00431df8
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov ecx, 0x42b9f0
call fcn.00404714
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004355e0
test al, al
jne 0x42b9c0
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42b9a1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 7
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004053c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b9a8
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b9e2
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00404410
ret

Function at 0x42bb10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42bb89
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f0c
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x42bb9c
mov edx, ebx
call fcn.00404c98
mov eax, dword [ebp - 0x24]
call fcn.00404c1c
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0xc14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bb90
lea eax, [ebp - 0x24]
call fcn.00404a8c
ret
Function at 0x42bba4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42bc1d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f0c
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 3
lea eax, [ebp - 0x24]
mov ecx, 0x42bc34
mov edx, ebx
call fcn.00404714
mov eax, dword [ebp - 0x24]
call fcn.004048c8
mov dword [ebp - 0x16], eax
mov word [ebp - 0xe], 0xc14
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bc24
lea eax, [ebp - 0x24]
call fcn.004043ec
ret

Function at 0x42bc38
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42bcd6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
mov edx, 0x1e
call fcn.00406f0c
xor eax, eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x42bcf0
mov edx, ebx
call fcn.00404714
mov eax, dword [ebp - 0x24]
call fcn.004048c8
mov dword [ebp - 0x16], eax
lea eax, [ebp - 0x28]
mov ecx, 0x42bcf0
mov edx, esi
call fcn.00404714
mov eax, dword [ebp - 0x28]
call fcn.004048c8
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x614
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bcdd
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404410
ret

Function at 0x42bcf4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42bdac
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 4]
mov eax, 0x42bdc0
call fcn.00435840
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004355e0
test al, al
jne 0x42bd7e
push 0x208
call sub.ole32.dll_CoTaskMemAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x42bd77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 5
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004053c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bd7e
mov eax, dword [ebp - 8]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040c958
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00404440
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42bdb3
lea eax, [ebp - 0xc]
call fcn.004043ec
ret