joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e1f6
Capabilities:
Connect to http server

Disassembly:
push edi
push 0x41a8b2
call fcn.0041115b
call fcn.0040da7a
cmp eax, 0xffffffff
jne 0x40e186
xor eax, eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call dword [sym.imp.WININET.dll_InternetConnectA]
push esi
push edx
push dword [esp - 0x1c]
push dword [esp + 0x6c]
call 0x40e230
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41a08e
push eax
mov eax, dword [esp + 0x10]
lea esp, [esp + 0x10]
mov esi, dword [esp + 8]
push 0xffffffffffffffd8
push dword [esp + 0xb]
push ebx
push 0x405590
push 0x403410
call 0x40e25e
add byte [eax], al
add byte [ebx - 0x535ef314], al
push es
add al, 0x10
push esi
mov dword [esp + 0xc], eax
lea esp, [esp + 0x18]
add dword [esp + 4], esi
push 0x403798
push ebp
push ebp
push 0x404800
call 0x40e291
push 0xffffffffffffffff
push 0x41b195
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
lea esp, [esp + 0x14]
pop esi
ret 0xc

Function at 0x40e3db
Capabilities:
Read file on windows

Disassembly:
pop ebx
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [eax + 8]
test edi, edi
push edx
push 0xfffffffffffffffa
push ebp
push 0xffffffffffffffab
call fcn.0040e40a
mov edx, dword [ebp + 8]
stosw word es:[edi], ax
mov eax, dword [ecx]
push edx
call dword [eax + 0x14]
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RtlUnwind]

Function at 0x40e40a
Capabilities:
Read file on windows

Disassembly:
lea esp, [esp + 0x10]
mov edx, dword [esp + 8]
push dword [esp - 0xd]
call 0x40e422
push eax
call dword [sym.imp.USER32.dll_EndDialog]
lea esp, [esp + 8]
add dword [esp + 4], edx
push eax
push 0x402318
push dword [esp + 0x34]
call fcn.0040e447
push ecx
jmp dword [sym.imp.KERNEL32.dll_ReadFile]

Function at 0x40e422
Capabilities:
Read file on windows

Disassembly:
lea esp, [esp + 0x10]
mov edx, dword [esp + 8]
push dword [esp - 0xd]
call 0x40e422
push eax
call dword [sym.imp.USER32.dll_EndDialog]
lea esp, [esp + 8]
add dword [esp + 4], edx
push eax
push 0x402318
push dword [esp + 0x34]
call fcn.0040e447
push ecx
jmp dword [sym.imp.KERNEL32.dll_ReadFile]

Function at 0x40e4b1
Capabilities:
Log keystrokes via polling
Query or enumerate registry key

Disassembly:
je 0x40e4a5
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov esi, eax
push ebx
push 0xffffffffffffffc6
push 0x400987
push 0xffffffffffffffb4
push 0x403ac6
call fcn.00403650
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], edx
mov dword [esp + 0x48], edx
mov dword [esp + 0x3c], ebx
test edi, edi
je 0x40e453
push edi
push edx
push 0x4028a0
push ecx
call fcn.0040e4d2
mov edx, dword [esi + 0x14]
mov dword [esp + 0x1c], 1
mov eax, dword [edx + 0x14]
mov ecx, dword [eax]

Function at 0x40e4d2
Capabilities:
Log keystrokes via polling

Disassembly:
lea esp, [esp + 0xc]
mov edx, dword [esp + 8]
push dword [esp - 0x6f]
push dword [esp - 0xa]
push eax
push dword [esp + 0x4c]
call 0x40e4fc
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call fcn.0040f0db
lea esp, [esp + 0x14]
add dword [esp + 4], edx
push 0x23
call 0x40e510
test cl, 2
jne 0x40e556
lea esp, [esp + 8]
pop edx
ret 0xc
Function at 0x40e4fc
Capabilities:
Log keystrokes via polling

Disassembly:
lea esp, [esp + 0xc]
mov edx, dword [esp + 8]
push dword [esp - 0x6f]
push dword [esp - 0xa]
push eax
push dword [esp + 0x4c]
call 0x40e4fc
mov eax, dword [esp + 4]
push esi
push eax
mov esi, ecx
call fcn.0040f0db
lea esp, [esp + 0x14]
add dword [esp + 4], edx
push 0x23
call 0x40e510
test cl, 2
jne 0x40e556
lea esp, [esp + 8]
pop edx
ret 0xc

Function at 0x40e54e
Capabilities:
Log keystrokes via polling

Disassembly:
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e589
mov edx, dword [0x41a859]
mov eax, dword [edx]
push 0x41ac6d
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], esp

Function at 0x40e5cc
Capabilities:
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41b068
push eax
mov eax, dword [esp + 0x10]
push esi
push 0x38
push 0x401348
push 0x405b10
push eax
push 0x404578
call 0x40e5cc
sbb eax, eax
neg eax
lea esp, [esp + 0x18]
mov esi, dword [esp + 8]
push 0x4035a0
push dword [esp + 0x6e]
call 0x40e5ef
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
mov ecx, dword [esp + 0x18]
lea esp, [esp + 0xc]
add dword [esp + 4], esi
push dword [esp - 0x16]
push 0x11
push ebp
push 0x404368
call 0x40e60e
push edi
mov edi, ecx
lea esp, [esp + 0x14]
pop esi
ret 4

Function at 0x40e76c
Capabilities:
Accept command line arguments
Move file
Parse url

Disassembly:
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffffe
cmp ecx, 5
mov eax, 0x41b173
ja 0x40993c
push 0
push 1

Function at 0x40e856
Capabilities:
Access the windows event log
Encrypt or decrypt via wincrypt

Disassembly:
push edx
mov ecx, esi
call fcn.0040e78b
push edx
shl edx, 7
mov edx, 0xdaafdd27
xor dword [esp + 4], edx
pop edx
push dword [esp + 8]
push dword [esp + 8]
push 0xffffffffffffffca
push 0x3ffcea
call fcn.0040379d
push 0x41b146
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
push ebp
push 0x4007b2
push 0x400303
push 0x400280
push 0x3fca29
call fcn.0040335f
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x458], 5
call dword [sym.imp.KERNEL32.dll_HeapCreate]
lea ecx, [esp + 0x14]
mov byte [esp + 0x454], bl
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
lea ecx, [esp + 0x18]
push 1
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0040f19c
cmp eax, 0xffffffff
je 0x40d290
mov edx, dword [esp + 0xc]
mov eax, dword [edx + 4]

Function at 0x40e8b4
Capabilities:
Access the windows event log

Disassembly:
push eax
push dword [esp - 0x46]
push dword [esp - 0x74]
call 0x40e8d6
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [edx + 0x74]
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push dword [esp - 0x27]
push 0x401168
push 0x405200
push dword [esp - 0x7a]
call 0x40e901
lea ecx, [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
lea ecx, [ebp - 0x18]
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push dword [esp - 0xf4]
push 0x403090
push ecx
push 0x404b28
call 0x40e939
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov esi, dword [0x41af89]
lea eax, [esp + 4]
push eax
call esi
push 0x41a2b0
lea esp, [esp + 0x14]
pop eax
ret 4
Function at 0x40e8d6
Capabilities:
Access the windows event log

Disassembly:
push eax
push dword [esp - 0x46]
push dword [esp - 0x74]
call 0x40e8d6
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [edx + 0x74]
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push dword [esp - 0x27]
push 0x401168
push 0x405200
push dword [esp - 0x7a]
call 0x40e901
lea ecx, [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
lea ecx, [ebp - 0x18]
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push dword [esp - 0xf4]
push 0x403090
push ecx
push 0x404b28
call 0x40e939
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov esi, dword [0x41af89]
lea eax, [esp + 4]
push eax
call esi
push 0x41a2b0
lea esp, [esp + 0x14]
pop eax
ret 4

Function at 0x40e901
Capabilities:
Access the windows event log

Disassembly:
push eax
push dword [esp - 0x46]
push dword [esp - 0x74]
call 0x40e8d6
lea ecx, [esp + 0xc]
push ecx
lea ecx, [esp + 0xc]
push ecx
push eax
call dword [edx + 0x74]
lea esp, [esp + 0xc]
mov eax, dword [esp + 8]
push dword [esp - 0x27]
push 0x401168
push 0x405200
push dword [esp - 0x7a]
call 0x40e901
lea ecx, [ebp - 0x10]
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
lea ecx, [ebp - 0x18]
lea esp, [esp + 0x14]
add dword [esp + 4], eax
push dword [esp - 0xf4]
push 0x403090
push ecx
push 0x404b28
call 0x40e939
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov esi, dword [0x41af89]
lea eax, [esp + 4]
push eax
call esi
push 0x41a2b0
lea esp, [esp + 0x14]
pop eax
ret 4

Function at 0x40eda5
Capabilities:
Get file attributes

Disassembly:
mov eax, dword [esp + 0x14]
push eax
push ebx
push 0x41b263
mov ecx, dword [esp + 0x14]
push ecx
push esi
push dword [esp - 0x32]
push dword [esp + 0x68]
push 0xd
push 0x404658
push 0x404580
call 0x40ed88
add byte [eax], al
sub esp, 0xc
mov eax, dword [str.BKCLDVDEngi]
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.WINMM.dll_PlaySoundA]
push 7
lea ecx, [esp + 8]
lea esp, [esp + 0x18]
mov esi, dword [esp + 8]
push dword [esp + 0x52]
push dword [esp - 0x39]
call 0x40eda5
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
lea esp, [esp + 0xc]
add dword [esp + 4], esi
push dword [esp + 9]
push ecx
call fcn.0040edd1
jmp dword [sym.imp.KERNEL32.dll_GetFileAttributesW]

Function at 0x40f2cd
Capabilities:
Move file

Disassembly:
push edi
push dword [esp + 0x70]
push dword [esp + 0x35]
call fcn.0040f2f2
mov bl, al
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressA]
test eax, eax
je fcn.0040f2a8
xor eax, eax
pop ebx
mov eax, dword [esp + 0xc]

Function at 0x40f3ed
Capabilities:
Move file

Disassembly:
lea ecx, [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
pop ebx
xor eax, eax
pop esi
shl eax, 8
push 0xffffffffffffffce
push esp
push 0x4000ef
push 0x4030db
call fcn.0040379d
mov ecx, dword [esp + 4]
call fcn.0040d3c6
Function at 0x40f419
Capabilities:
Move file

Disassembly:
pop esi
mov eax, dword [0x41a7a3]
cmp dword [ebp + 0xc], 0x58
jne fcn.00409b32
push dword [ebp + 8]
push dword [esp + 8]
push edx
push 0x4004da
push 0x3fd8b8
call fcn.004031d1
sub esp, 8
mov ecx, dword [esp + 0x10]
lea eax, [esp]
push eax
push 0x41adbb
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov esi, dword [esp + 0x3c]
lea edx, [esp + 0xc]
push edx
mov ecx, esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
lea ecx, [esp + 0xc]

Function at 0x40f480
Capabilities:
Move file

Disassembly:
push 0x41adee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]

Function at 0x40f49c
Capabilities:
Move file

Disassembly:
push ebx
push ebx
call 0x40f4b0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
add esi, 4
push esi
lea ecx, [ebp + 4]
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push dword [esp - 0x61]
push 1
call 0x40f4e5
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
mov eax, dword [esi + 0x14]
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0xc], 0
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push dword [esp - 0x47]
call 0x40f502
pop esi

Function at 0x40f4b0
Capabilities:
Move file

Disassembly:
push ebx
push ebx
call 0x40f4b0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
add esi, 4
push esi
lea ecx, [ebp + 4]
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push dword [esp - 0x61]
push 1
call 0x40f4e5
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
mov eax, dword [esi + 0x14]
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0xc], 0
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push dword [esp - 0x47]
call 0x40f502
pop esi

Function at 0x40f4e5
Capabilities:
Move file

Disassembly:
push ebx
push ebx
call 0x40f4b0
call dword [sym.imp.KERNEL32.dll_MoveFileA]
add esi, 4
push esi
lea ecx, [ebp + 4]
lea esp, [esp + 8]
mov ebx, dword [esp + 8]
push dword [esp - 0x61]
push 1
call 0x40f4e5
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
mov eax, dword [esi + 0x14]
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x20]
mov dword [esp + 0xc], 0
lea esp, [esp + 0xc]
add dword [esp + 4], ebx
push dword [esp - 0x47]
call 0x40f502
pop esi
Function at 0x40f881
Capabilities:
Get common file path

Disassembly:
int3
call edi
push ebp
call edi
cmp eax, 0xffffffff
jne 0x40a007
xor eax, eax
mov eax, dword [esp + 4]
lea esp, [esp + 8]
add dword [esp + 4], esi
push dword [esp - 0x56]
push 0x405798
push dword [esp - 0x4a]
push dword [esp - 0x17]
call 0x40a074
add byte [eax], al
sub esp, 0xc
mov eax, dword [0x41aa76]
push esi
lea esp, [esp + 0x14]
pop esi
ret 4
push 0
push 0
call fcn.0040f291
mov ebx, eax
sub ebx, ecx
mov ecx, dword [ebp + 8]
push ecx
push esi
push eax
cmp dword [edx], 0
je 0x411b9d
add dword [edx], eax
push edx
push edx
push 0x65
push 0x4022f0
call fcn.00403091
push ecx
push eax
call dword [edx + 0x64]
push ebx
push ebx
push 3
call fcn.004052a8
push dword [esp + 4]
push ecx
push 0x5f
push 0x3f4bb0
call fcn.0040335f
lea edx, [esp + 4]
push 1
push edx
call fcn.0040c6c5
cmp eax, 0xffffffff
push 0xffffffffffffffac
push 0x11
call fcn.00403eb1
push eax
lea ecx, [esp + 0x20]
mov dword [esi + 0x14], eax
call fcn.0040a76b
mov ebx, dword [esp + 0x1c]
call fcn.0040dfa0
push ecx
push 0x1e
call fcn.0040cd4a
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00406b46
mov eax, dword [esi + 0x14]
test eax, eax
mov dword [esp + 0x10], 0
je 0x411c7c
mov ecx, dword [esp + 0x18]
push esp
push 0x75
push ebx
push 0xa
push sym.imp.KERNEL32.dll_GetProcessHeap
call fcn.0040b1ac
push 0xfffffffffffffff1
push dword [esp + 8]
push 0x4003d6
push 0x3fac42
call fcn.004034ec
lea eax, [ebp - 0x20]
push eax
push 0x19b4
push 0x57
push 0x44
push 0x2d
push 0x15ff
call fcn.0040d110
push 0x62
push 0xfffffffffffffff3
push sym.imp.WININET.dll_HttpAddRequestHeadersA
push 0x41ae5f
push 0xffffffffffffffb0
push ebp
push 0x41a371
call fcn.0040bfaa
push 0x40094f
push 0xffffffffffffffdc
push 0xffffffffffffffe5
push 0x3f67b5
call fcn.00402f20
dec ecx
test ecx, ecx
jg 0x411c1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov ecx, esi
mov dword [esp + 0x18], 0xffffffff
push 0xffffffffffffffba
push 0x1c
call fcn.0040d1b7
mov eax, dword [esi + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x88]
mov edi, eax
push 0
push 0
push 0x41a8e1
push 0x41b0d0
push 0xcb3
push 0xfc4
push sym.imp.GDI32.dll_GetKerningPairsA
push esi
call fcn.00410589
push esi
push 0x6b
push 0x18
call fcn.0040b40f
call fcn.00405bff
test eax, eax
je 0x4020d2
mov eax, dword [esi + 0x14]
cmp eax, edi
je 0x40a03a
push sym.imp.USER32.dll_CreateWindowExW
push 0xffffffffffffffc8
push 0x61
push 0xea5
push 0x41a5d1
push 0x1feb
call fcn.004091a7
push 0x1b
call fcn.004067ff
call fcn.0040e78b
add esp, 8
cmp eax, 0xffffffff
jne 0x411d74
xor eax, eax
add esp, 0x10
ret
mov eax, dword [ebp - 0x24]
push ecx
push esi
push 0x41a87c
push 0xff0
push edx
call fcn.00407e4d
push sym.imp.USER32.dll_SetWindowsHookExA
push sym.imp.KERNEL32.dll_InitializeCriticalSection
push sym.imp.USER32.dll_ReleaseCapture
push 0xffffffffffffff99
push 0x5e
push 0x28e
push 0x3f
call fcn.0040bb36
push eax
push 0xdc0
push 0x1a
call fcn.00408391
call dword [sym.imp.USER32.dll_ClientToScreen]
add esp, 4
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret
Function at 0x40fb9a
Capabilities:
Set registry value

Disassembly:
add byte [eax], al
add byte [ebx - 0x535ef314], al
push es
add al, 0x10
push esi
mov dword [esp + 0xc], eax
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 7
push edi
push 0x404760
push 0xfffffffffffffffd
call fcn.0040fbc7
lea ecx, [esi + 0x74]
mov dword [edi + 4], ebx

Function at 0x40fc68
Capabilities:
Extract resource via kernel32 functions

Disassembly:
call edi
pop edi
push ecx
push eax
push dword [esp - 0x57]
call 0x40fc81
call fcn.00405b79
cmp eax, 0xffffffff
lea esp, [esp + 0xc]
mov ecx, dword [esp + 8]
push dword [esp - 0xa7]
push esp
push dword [esp - 0x4a]
call 0x40fcb4
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x14
lea ecx, [esp + 0x4c]
push 0x41abb9
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0xa
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push 0x404fd0
push 0xffffffffffffffb5
push dword [esp + 0x47]
push dword [esp + 8]
push 0x401ae0
call 0x40fced
lea ecx, [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov byte [ebp - 4], 5
lea esp, [esp + 0x18]
pop ecx
ret 0xc

Function at 0x40fc81
Capabilities:
Extract resource via kernel32 functions

Disassembly:
call edi
pop edi
push ecx
push eax
push dword [esp - 0x57]
call 0x40fc81
call fcn.00405b79
cmp eax, 0xffffffff
lea esp, [esp + 0xc]
mov ecx, dword [esp + 8]
push dword [esp - 0xa7]
push esp
push dword [esp - 0x4a]
call 0x40fcb4
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
push 0x14
lea ecx, [esp + 0x4c]
push 0x41abb9
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0xa
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push 0x404fd0
push 0xffffffffffffffb5
push dword [esp + 0x47]
push dword [esp + 8]
push 0x401ae0
call 0x40fced
lea ecx, [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov byte [ebp - 4], 5
lea esp, [esp + 0x18]
pop ecx
ret 0xc

Function at 0x40ff50
Capabilities:
Move file

Disassembly:
call dword [edx + 4]
push 0x18
call fcn.004109ca
test eax, eax
je 0x40ffd8
mov dword [eax], eax
mov ebp, esp
push 0x23
push dword [esp + 8]
push 0x400720
push 0x4027d9
call fcn.0040379d
push edi
mov dword [esp + 0xc], 0
mov esi, dword [esp + 0x28]
test esi, esi
mov edi, dword [0x41aab8]

Function at 0x40ffcd
Capabilities:
Move file

Disassembly:
mov edi, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax + 4]
cmp eax, ecx
je 0x40ffd6
push ecx
Function at 0x40ffdb
Capabilities:
Move file

Disassembly:
push ecx
push 0xffffffffffffff9b
push 0x38
push 0x4050a0
push dword [esp - 0xea]
push dword [esp + 1]
call 0x41000b
mov ecx, 0x41a213
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
lea esp, [esp + 0x18]
mov ecx, dword [esp + 8]
push 0x4030e8
push 0x11
push eax
call 0x410028
pop edi
mov dword fs:[0], ecx
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push eax
push dword [esp - 0xc6]
push dword [esp - 0x87]
call 0x410066
push edi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebp, dword [esp + 0x5c]
mov eax, dword [esp + 0x14]
push eax
push ebx
push 0x41ae83
mov ecx, dword [esp + 0x14]
lea esp, [esp + 0x10]
pop ecx
ret 0xc

Function at 0x41000b
Capabilities:
Move file

Disassembly:
push ecx
push 0xffffffffffffff9b
push 0x38
push 0x4050a0
push dword [esp - 0xea]
push dword [esp + 1]
call 0x41000b
mov ecx, 0x41a213
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
lea esp, [esp + 0x18]
mov ecx, dword [esp + 8]
push 0x4030e8
push 0x11
push eax
call 0x410028
pop edi
mov dword fs:[0], ecx
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push eax
push dword [esp - 0xc6]
push dword [esp - 0x87]
call 0x410066
push edi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebp, dword [esp + 0x5c]
mov eax, dword [esp + 0x14]
push eax
push ebx
push 0x41ae83
mov ecx, dword [esp + 0x14]
lea esp, [esp + 0x10]
pop ecx
ret 0xc

Function at 0x410028
Capabilities:
Move file

Disassembly:
push ecx
push 0xffffffffffffff9b
push 0x38
push 0x4050a0
push dword [esp - 0xea]
push dword [esp + 1]
call 0x41000b
mov ecx, 0x41a213
lea edi, [ebp - 0x228]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x22c]
lea esp, [esp + 0x18]
mov ecx, dword [esp + 8]
push 0x4030e8
push 0x11
push eax
call 0x410028
pop edi
mov dword fs:[0], ecx
lea esp, [esp + 0x10]
add dword [esp + 4], ecx
push eax
push dword [esp - 0xc6]
push dword [esp - 0x87]
call 0x410066
push edi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov ebp, dword [esp + 0x5c]
mov eax, dword [esp + 0x14]
push eax
push ebx
push 0x41ae83
mov ecx, dword [esp + 0x14]
lea esp, [esp + 0x10]
pop ecx
ret 0xc

Function at 0x4101f1
Capabilities:
Write file on windows

Disassembly:
lea eax, [esp]
push eax
lea ecx, [esp + 8]
push ecx

Function at 0x41096e
Capabilities:
Check if file exists

Disassembly:
push 0x41a965
lea ecx, [esp + 0x14]
push ecx
test eax, eax
jne 0x4132db
inc eax
push 0x3b
push dword [esp + 8]
push eax
push 0x4028f7
call fcn.00402e08
push eax
push 0x41a614
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
Function at 0x410a7b
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push edi
push dword [esp - 0xde]
push 0x401ec0
call 0x410aad
pop edi
pop esi
pop ebx
lea esp, [esp + 0xc]
mov edi, dword [esp + 8]
push 0x404d30
push 0xffffffffffffffa5
push 0x404188
push 0x7a
call 0x410ae0
mov dword [esp], eax
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x14]
mov eax, dword [eax + 0x14]
mov ecx, dword [eax]
push 0x41a11c
lea edx, [esp + 4]
lea esp, [esp + 0x14]
add dword [esp + 4], edi
push 0x2b
push 0x404018
push dword [esp + 0xe]
push eax
push dword [esp + 0x60]
call 0x410b24
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x410acb
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push 1
lea esp, [esp + 0x18]
pop edi
ret 0xc

Function at 0x410aad
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push edi
push dword [esp - 0xde]
push 0x401ec0
call 0x410aad
pop edi
pop esi
pop ebx
lea esp, [esp + 0xc]
mov edi, dword [esp + 8]
push 0x404d30
push 0xffffffffffffffa5
push 0x404188
push 0x7a
call 0x410ae0
mov dword [esp], eax
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x14]
mov eax, dword [eax + 0x14]
mov ecx, dword [eax]
push 0x41a11c
lea edx, [esp + 4]
lea esp, [esp + 0x14]
add dword [esp + 4], edi
push 0x2b
push 0x404018
push dword [esp + 0xe]
push eax
push dword [esp + 0x60]
call 0x410b24
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x410acb
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push 1
lea esp, [esp + 0x18]
pop edi
ret 0xc

Function at 0x410ae0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10
mov edx, dword [esp + 0x18]
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp], eax
mov dword [esp + 4], eax
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push edi
push dword [esp - 0xde]
push 0x401ec0
call 0x410aad
pop edi
pop esi
pop ebx
lea esp, [esp + 0xc]
mov edi, dword [esp + 8]
push 0x404d30
push 0xffffffffffffffa5
push 0x404188
push 0x7a
call 0x410ae0
mov dword [esp], eax
mov dword [esp + 4], eax
mov eax, dword [ecx + 0x14]
mov eax, dword [eax + 0x14]
mov ecx, dword [eax]
push 0x41a11c
lea edx, [esp + 4]
lea esp, [esp + 0x14]
add dword [esp + 4], edi
push 0x2b
push 0x404018
push dword [esp + 0xe]
push eax
push dword [esp + 0x60]
call 0x410b24
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x410acb
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push 1
lea esp, [esp + 0x18]
pop edi
ret 0xc