joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407630
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push ebx
push esi
push edi
xor edi, edi
xor esi, esi
jmp 0x407640
movzx edx, byte [esi + str.cw]
mov eax, edx
shr eax, 7
mov ecx, eax
imul eax, eax, 0x11b
imul ecx, ecx, 0x1b000000
mov ebx, edx
shl ebx, 0x19
xor ecx, ebx
mov ebx, edx
shl ebx, 8
or ebx, edx
shl ebx, 8
or ecx, ebx
lea ebx, [edx + edx]
xor eax, ebx
xor eax, edx
or eax, ecx
xor edx, edx
xor ebx, ebx
or edx, ecx
or eax, ebx
mov dword [esi*8 + 0x51b6a0], edx
mov dword [esi*8 + 0x51b6a4], eax
inc esi
cmp esi, 0x100
jl 0x407640
mov dword [0x51bea8], edi
mov dword [0x51beac], edi
mov dword [0x51bea0], edi
mov dword [0x51bea4], edi
pop edi
pop esi
mov byte [0x51beb4], 1
pop ebx
ret

Function at 0x4076c0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
mov dword [esp + 0x14], eax
push edi
lea ecx, [ecx]
movzx eax, byte [eax + 0x4e6860]
mov ebp, eax
shr ebp, 7
mov dword [esp + 0x1c], ebp
imul ebp, ebp, 0x1b000000
mov ecx, eax
shr ecx, 6
mov esi, ecx
and ecx, 1
mov dword [esp + 0x10], ecx
lea ebx, [eax + eax]
xor ebx, eax
lea ecx, [ebx + ebx]
xor ecx, eax
shl ecx, 0x19
xor ecx, ebp
and esi, 2
mov dword [esp + 0x14], esi
mov edi, eax
shr edi, 5
mov edx, edi
mov esi, edi
and edi, 1
mov ebp, edi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and esi, 2
mov ebp, esi
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x10]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
mov ebp, dword [esp + 0x14]
imul ebp, ebp, 0x1b000000
xor ecx, ebp
and edx, 4
mov ebp, edx
imul ebp, ebp, 0x1b000000
xor ecx, ebp
lea ebp, [ebx*4]
xor ebp, eax
shl ebp, 8
mov ebx, edi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, esi
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x10]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, dword [esp + 0x14]
imul ebx, ebx, 0x11b00
xor ebp, ebx
mov ebx, edx
imul ebx, ebx, 0x11b00
xor ebp, ebx
or ecx, ebp
mov ebp, edi
imul edi, edi, 0x11b
imul ebp, ebp, 0x11b0000
lea ebx, [eax*8]
xor ebx, eax
shl ebx, 0x10
xor ebx, ebp
mov ebp, esi
imul ebp, ebp, 0x11b0000
xor ebx, ebp
mov ebp, edx
imul ebp, ebp, 0x11b0000
xor ebx, ebp
or ecx, ebx
mov ebx, dword [esp + 0x1c]
imul ebx, ebx, 0x11b
lea ebp, [eax*4]
xor ebp, eax
add ebp, ebp
xor ebp, ebx
xor ebp, edi
imul esi, esi, 0x11b
imul edx, edx, 0x11b
xor ebp, esi
xor ebp, edx
xor ebp, eax
or eax, ecx
or ebp, ecx
xor edx, edx
or edx, eax
mov eax, dword [esp + 0x18]
xor ecx, ecx
or ebp, ecx
mov dword [eax*8 + 0x51aea0], edx
mov dword [eax*8 + 0x51aea4], ebp
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x100
jl 0x4076d0
pop edi
pop esi
pop ebp
mov byte [0x51beb5], 1
pop ebx
add esp, 0x10
ret
Function at 0x408d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 8]
movdqa xmm0, xmmword [eax]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
movdqa xmm1, xmmword [edi]
lea edx, [esi - 1]
pxor xmm0, xmm1
movdqa xmmword [eax], xmm0
cmp edx, 1
jbe 0x408db7
add edx, 0xfffffffe
shr edx, 1
lea ecx, [edi + 0x10]
inc edx
movdqa xmm1, xmmword [ecx]
movdqa xmm0, xmmword [eax]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx + 0x10]
add ecx, 0x20
dec edx
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
jne 0x408d92
movdqa xmm0, xmmword [eax]
add esi, esi
movdqa xmm1, xmmword [edi + esi*8 - 0x10]
lea ecx, [edi + esi*8]
aesenc xmm0, xmm1
movdqa xmmword [eax], xmm0
movdqa xmm1, xmmword [ecx]
pop edi
aesenclast xmm0, xmm1
movdqa xmmword [eax], xmm0
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408df0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov eax, dword [ebp + 8]
movdqa xmm1, xmmword [eax]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x18]
movdqa xmm0, xmmword [edi]
pxor xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
pxor xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
pxor xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pxor xmm1, xmm0
movdqa xmmword [esi], xmm1
cmp ebx, 1
jbe 0x408e94
add edi, 0x10
dec ebx
lea esp, [esp]
movdqa xmm0, xmmword [edi]
movdqa xmm1, xmmword [eax]
aesenc xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenc xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenc xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
add edi, 0x10
dec ebx
aesenc xmm1, xmm0
movdqa xmmword [esi], xmm1
jne 0x408e50
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
movdqa xmm1, xmmword [eax]
add ebx, ebx
movdqa xmm0, xmmword [edi + ebx*8]
aesenclast xmm1, xmm0
movdqa xmmword [eax], xmm1
movdqa xmm1, xmmword [ecx]
aesenclast xmm1, xmm0
movdqa xmmword [ecx], xmm1
movdqa xmm1, xmmword [edx]
aesenclast xmm1, xmm0
movdqa xmmword [edx], xmm1
movdqa xmm1, xmmword [esi]
pop edi
aesenclast xmm1, xmm0
movdqa xmmword [esi], xmm1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a4b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4caa30
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x4ff5d0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
mov eax, dword [0x4ff5d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ecx]
push 1
push 0x501434
mov dword [esp + 0x28], edx
xor edx, edx
push edx
push eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x20], edx
push eax
mov eax, dword [esi + 0x80]
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.CryptoPP::ArraySink.0
mov dword [esp + 0x30], vtable.CryptoPP::ArraySink.1.0
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00493f43
mov esp, ebp
pop ebp
ret 8
Function at 0x40aba0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ca6f6
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4ff5d0]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push esi
mov eax, dword [0x4ff5d0]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea esi, [edi + 0x10]
mov ecx, 0x100
mov dword [esp + 0x20], edi
mov dword [edi + 0xc], 0xffffffff
mov dword [edi], vtable.CryptoPP::MessageQueue.0
mov dword [edi + 4], vtable.CryptoPP::MessageQueue.1.0
call fcn.00409a20
mov dword [esp + 0x48], 2
xor ebx, ebx
lea esi, [edi + 0x38]
push 8
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], esi
mov dword [esi], ebx
call fcn.00493dba
add esp, 4
cmp eax, ebx
je 0x40ace0
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea ecx, [esp + 0x14]
push ecx
push esi
mov byte [esp + 0x50], 3
call fcn.0040b0b0
mov byte [esp + 0x48], 4
lea esi, [edi + 0x50]
push 8
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], esi
mov dword [esi], ebx
call fcn.00493dba
add esp, 4
cmp eax, ebx
je 0x40acb7
mov dword [esi], eax
xor edx, edx
mov dword [eax + 4], edx
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esi]
mov dword [edx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
lea eax, [esp + 0x1c]
push eax
push esi
mov byte [esp + 0x50], 5
call fcn.0040b440
mov eax, edi
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.00493f43
add esp, 0x40
ret
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0x28]
mov dword [esp + 0x10], ebx
call fcn.00493b21
push 0x4f92a4
lea edx, [esp + 0x28]
push edx
mov dword [esp + 0x2c], vtable.std::bad_alloc.0
call fcn.004937a7
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ebx
call fcn.00493b21
push 0x4f92a4
lea ecx, [esp + 0x34]
push ecx
mov dword [esp + 0x38], vtable.std::bad_alloc.0
call fcn.004937a7
int3
Function at 0x40dab1
Capabilities:
Get user security identifier

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x4ff5d0]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp edi, ebx
je 0x40db61
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40db61
push 0xff
lea eax, [ebp - 0x6f]
push ebx
push eax
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], bl
call fcn.00493d40
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
push ebx
push edi
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameA]
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], 0x100
mov dword [ebp - 0x7c], 8
call esi
cmp dword [ebp - 0x78], ebx
je 0x40db5c
push dword [ebp - 0x78]
call fcn.00491370
pop ecx
lea ecx, [ebp - 0x7c]
push ecx
lea ecx, [ebp - 0x80]
push ecx
lea ecx, [ebp - 0x70]
push ecx
lea ecx, [ebp - 0x78]
push ecx
push eax
push edi
push ebx
mov dword [ebp - 0x74], eax
call esi
test eax, eax
jne 0x40db5c
push dword [ebp - 0x74]
call fcn.0049333b
pop ecx
mov dword [ebp - 0x74], ebx
mov eax, dword [ebp - 0x74]
jmp 0x40db63
xor eax, eax
mov ecx, dword [ebp + 0x90]
pop esi
xor ecx, ebp
pop ebx
call fcn.00493f43
add ebp, 0x94
leave
ret

Function at 0x40dc21
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x4ff5d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov ecx, 0x104
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x110], ecx
test eax, eax
jne 0x40dc63
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x40dc74
push ecx
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004944d0
add esp, 0xc
mov ecx, edi
lea edi, [ebp - 0x10c]
call fcn.0040dab1
mov edi, eax
test edi, edi
je 0x40dca5
push dword [esi + 0x24]
call fcn.0049333b
pop ecx
push 0
mov dword [esi + 0x24], edi
push edi
add esi, 0x10
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
xor eax, eax
inc eax
jmp 0x40dca7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00493f43
leave
ret 8
Function at 0x40de04
Capabilities:
Query or enumerate registry key

Disassembly:
push 0x10
mov eax, 0x4bc037
call fcn.004943c6
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 8]
xor eax, eax
xor ebx, ebx
cmp byte [ebp + 0x14], bl
lea ecx, [ebp - 0x10]
setne al
push ecx
dec eax
and eax, 0xffffff00
add eax, 0x20119
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
je 0x40de4a
xor eax, eax
jmp 0x40deed
mov dword [ebp + 0x14], ebx
lea ecx, [ebp - 0x1c]
call fcn.00472090
push 0x104
push 0x105
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
call fcn.00472db0
push eax
push dword [ebp + 0x14]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
inc dword [ebp + 0x14]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.00472e40
cmp edi, ebx
jne 0x40decd
lea ecx, [ebp - 0x1c]
call fcn.0040d59a
test al, al
jne 0x40decd
push 8
call fcn.00493dba
pop ecx
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov byte [ebp - 4], 1
cmp ecx, ebx
je 0x40deb4
call fcn.00472090
mov esi, eax
jmp 0x40deb6
xor esi, esi
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.004723d0
mov ecx, dword [ebp + 0x10]
push esi
call fcn.004735f0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00472320
cmp edi, ebx
je 0x40de4d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
call fcn.0049449e
ret

Function at 0x40def3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00493d40
mov ax, word [ebp + 0xc]
push 0x10
mov word [ebp - 0x24], ax
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
call fcn.00493d40
mov ecx, dword [ebp + 8]
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call fcn.00472db0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40df61
mov eax, dword [ebp + 0x10]
cmp eax, esi
je 0x40df5c
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
xor eax, eax
inc eax
jmp 0x40df63
xor eax, eax
pop esi
leave
ret
Function at 0x40df9f
Capabilities:
Compare security identifiers
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x1e4
mov eax, dword [0x4ff5d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push 0x98
xor ebx, ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
call fcn.00493d40
add esp, 0xc
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x30], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40e18a
cmp dword [ebp - 0x20], 2
jne 0x40e18a
push esi
push edi
push ebx
push 0xf
xor esi, esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x40e0c7
push 0x124
lea eax, [ebp - 0x154]
push ebx
push eax
call fcn.00493d40
add esp, 0xc
lea eax, [ebp - 0x158]
push eax
mov esi, 0x128
push edi
mov dword [ebp - 0x158], esi
call sub.KERNEL32.dll_Process32First
jmp 0x40e0bd
lea eax, [ebp - 0x134]
push eax
push str.explorer.exe
call fcn.00494774
pop ecx
pop ecx
test eax, eax
jne 0x40e0aa
push dword [ebp - 0x150]
push 1
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, ebx
je 0x40e0aa
lea ecx, [ebp - 0x168]
push ecx
push 8
push eax
mov dword [ebp - 0x168], ebx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40e0aa
lea eax, [ebp - 0x16c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp + 0x6c]
push eax
mov dword [ebp + 0x6c], ebx
mov word [ebp + 0x70], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x40e0d0
lea eax, [ebp - 0x158]
push eax
push edi
mov dword [ebp - 0x158], esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40e035
mov esi, ebx
pop edi
mov eax, esi
pop esi
jmp 0x40e18d
mov eax, dword [ebp - 0x16c]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea ecx, [ebp - 0x15c]
push ecx
push ebx
push ebx
mov dword [ebp - 0x164], eax
mov eax, dword [ebp - 0x168]
push 2
push eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x15c], ebx
call esi
cmp dword [ebp - 0x15c], ebx
jne 0x40e10e
xor esi, esi
jmp 0x40e0c7
push dword [ebp - 0x15c]
call fcn.00491370
mov edi, eax
pop ecx
cmp edi, ebx
je 0x40e10a
lea eax, [ebp - 0x15c]
push eax
push dword [ebp - 0x15c]
push edi
push 2
push dword [ebp - 0x160]
call esi
test eax, eax
jne 0x40e145
push edi
call fcn.00493e3a
pop ecx
jmp 0x40e10a
mov dword [ebp - 0x160], ebx
cmp dword [edi], ebx
jbe 0x40e178
lea esi, [edi + 4]
push dword [ebp - 0x164]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x40e16e
inc ebx
add esi, 8
cmp ebx, dword [edi]
jb 0x40e152
jmp 0x40e178
mov dword [ebp - 0x160], 1
push edi
call fcn.00493e3a
mov esi, dword [ebp - 0x160]
pop ecx
jmp 0x40e0c7
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
pop ebx
call fcn.00493f43
add ebp, 0x78
leave
ret
Function at 0x40e228
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x1a8]
sub esp, 0x228
mov eax, dword [0x4ff5d0]
xor eax, ebp
mov dword [ebp + 0x1a4], eax
mov eax, dword [ebp + 0x1b0]
push ebx
push esi
mov esi, dword [ebp + 0x1c0]
push edi
push str.Shell32.dll
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x78], esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor ebx, ebx
mov dword [ebp - 0x6c], eax
mov edi, 0x207
cmp eax, ebx
je 0x40e34d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SHGetSpecialFolderLocation
push eax
call esi
push str.SHGetPathFromIDListW
push dword [ebp - 0x6c]
mov dword [ebp - 0x68], eax
call esi
push str.SHGetMalloc
push dword [ebp - 0x6c]
mov dword [ebp - 0x74], eax
call esi
mov dword [ebp - 0x80], eax
cmp dword [ebp - 0x68], ebx
je 0x40e341
cmp dword [ebp - 0x74], ebx
je 0x40e341
cmp eax, ebx
je 0x40e341
lea eax, [ebp - 0x70]
push eax
push dword [ebp + 0x1b4]
mov dword [ebp - 0x70], ebx
push ebx
call dword [ebp - 0x68]
test eax, eax
jne 0x40e341
push 0x104
push ebx
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
push esi
push dword [ebp - 0x70]
call dword [ebp - 0x74]
push edi
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.00493d40
add esp, 0xc
push ebx
push ebx
push 0x208
lea eax, [ebp - 0x64]
push eax
push 0xffffffffffffffff
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
push eax
call fcn.00472470
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x68], ebx
call dword [ebp - 0x80]
test eax, eax
js 0x40e341
mov eax, dword [ebp - 0x68]
push dword [ebp - 0x70]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0x68]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 0x6c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, dword [ebp - 0x78]
mov ecx, esi
call fcn.0040d59a
test al, al
je 0x40e38c
push edi
lea eax, [ebp - 0x63]
push ebx
push eax
mov byte [ebp - 0x64], bl
call fcn.00493d40
add esp, 0xc
push ebx
push dword [ebp + 0x1b4]
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40e38c
lea eax, [ebp - 0x64]
push eax
mov ecx, esi
call fcn.00472470
mov ecx, esi
call fcn.0040d59a
test al, al
jne 0x40e3c0
mov ecx, esi
call fcn.004720a0
cmp byte [esi + 7], 0xff
mov ecx, esi
jne 0x40e3a8
mov ecx, dword [esi]
cmp byte [ecx + eax - 1], 0x5c
je 0x40e3bb
push 0x4d19a0
mov ecx, esi
call fcn.004727a0
xor eax, eax
inc eax
jmp 0x40e3c2
xor eax, eax
mov ecx, dword [ebp + 0x1a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493f43
add ebp, 0x1a8
leave
ret
Function at 0x40e5e0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x3dc]
sub esp, 0x45c
mov eax, dword [0x4ff5d0]
xor eax, ebp
mov dword [ebp + 0x3d8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x3e4]
mov esi, 0x104
xor ebx, ebx
push esi
lea eax, [ebp + 0xc9]
push ebx
push eax
mov byte [ebp + 0xc8], bl
call fcn.00493d40
add esp, 0xc
push esi
lea eax, [ebp + 0xc8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
dec esi
push esi
lea eax, [ebp + 0x2d5]
push ebx
push eax
mov byte [ebp + 0x2d4], bl
call fcn.00493d40
push esi
lea eax, [ebp + 0x1d1]
push ebx
push eax
mov byte [ebp + 0x1d0], bl
call fcn.00493d40
push edi
call fcn.00494920
add esp, 0x1c
cmp byte [eax + edi - 1], 0x5c
push edi
lea eax, [ebp + 0x1d0]
push eax
je 0x40e69c
call fcn.00494820
lea eax, [ebp + 0x1d0]
push 0x4d1a20
push eax
call fcn.00494830
lea eax, [ebp + 0x2d4]
push edi
push eax
call fcn.00494820
push 0x4d19a0
jmp 0x40e6c4
call fcn.00494820
lea eax, [ebp + 0x1d0]
push 0x4d1a1c
push eax
call fcn.00494830
lea eax, [ebp + 0x2d4]
push edi
push eax
call fcn.00494820
push 0x4d1a1a
lea eax, [ebp + 0x2d4]
push eax
call fcn.00494830
add esp, 0x20
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x1d0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
jne 0x40e6f3
xor eax, eax
jmp 0x40e80e
lea eax, [ebp + 0x2d4]
push eax
lea eax, [ebp + 0x1d0]
push eax
mov dword [ebp - 0x80], 1
call fcn.00494820
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
pop ecx
pop ecx
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40e7e7
lea eax, [ebp - 0x4c]
push 0x4d1a18
push eax
call fcn.00493a00
pop ecx
pop ecx
test eax, eax
je 0x40e7f5
lea eax, [ebp - 0x4c]
push 0x4d1a14
push eax
call fcn.00493a00
pop ecx
pop ecx
test eax, eax
je 0x40e7f5
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp + 0x2d4]
push eax
call fcn.00494830
test byte [ebp - 0x78], 0x10
pop ecx
pop ecx
je 0x40e781
lea eax, [ebp + 0x2d4]
push eax
call fcn.0040e5e0
pop ecx
jmp 0x40e7c0
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x2d4]
push eax
call fcn.00494774
pop ecx
pop ecx
test eax, eax
je 0x40e7f5
test byte [ebp - 0x78], 1
je 0x40e7b3
lea eax, [ebp + 0x2d4]
push 0x80
push eax
call fcn.004947bb
pop ecx
pop ecx
lea eax, [ebp + 0x2d4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40e7d0
push 4
push ebx
lea eax, [ebp + 0x2d4]
push eax
call esi
lea eax, [ebp + 0x1d0]
push eax
lea eax, [ebp + 0x2d4]
push eax
call fcn.00494820
pop ecx
pop ecx
jmp 0x40e7f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x40e826
mov dword [ebp - 0x80], ebx
cmp dword [ebp - 0x80], ebx
jne 0x40e715
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp + 0x3d8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00493f43
add ebp, 0x3dc
leave
ret
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x40e6ec