joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ee4
Capabilities:
Delete file

Disassembly:
push 0x64
mov eax, 0x510745
call fcn.004d18f8
lea eax, [ebp - 0x70]
add ecx, 0x8a0
push eax
call fcn.00404e16
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.0040d130
mov ecx, eax
call fcn.0040d60a
push esi
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.004066c5
pop ecx
lea ecx, [ebp - 0x58]
call fcn.004020b1
lea ecx, [ebp - 0x70]
mov byte [ebp - 4], 4
call fcn.004020b1
lea eax, [ebp - 0x40]
push 0
push eax
call fcn.0040d130
mov ecx, eax
call fcn.0040d60a
mov byte [ebp - 4], 5
lea edx, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x28]
cmovae edx, dword [ebp - 0x40]
cmp dword [ebp - 0x14], 8
cmovae ecx, dword [ebp - 0x28]
push ecx
call fcn.004080ba
xor ebx, ebx
test eax, eax
pop ecx
sete bl
test eax, eax
jne 0x405f8b
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
cmovae ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x40]
call fcn.004020b1
lea ecx, [ebp - 0x28]
call fcn.004020b1
mov eax, ebx
call fcn.004d18a2
ret

Function at 0x407bb3
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
mov esi, edx
push eax
push eax
push 3
push eax
push eax
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
lea eax, [ebp - 0x14]
push eax
push esi
shr esi, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_DosDateTimeToFileTime]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFileTimeToFileTime]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d04d5
leave
ret

Function at 0x407c35
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x105
xor esi, esi
lea eax, [ebp - 0x10c]
push esi
push eax
mov ebx, ecx
call fcn.004e8520
add esp, 0xc
mov al, byte [esi + 0x55c980]
mov byte [ebp + esi - 0x10c], al
inc esi
test al, al
jne 0x407c64
mov esi, ebx
mov al, byte [ebx]
inc ebx
test al, al
jne 0x407c78
lea edi, [ebp - 0x10c]
sub ebx, esi
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x407c88
mov ecx, ebx
lea eax, [ebp - 0x10c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push eax
call fcn.004f5175
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d04d5
leave
ret
Function at 0x4080ba
Capabilities:
Check if file exists

Disassembly:
push 0x70
mov eax, 0x51099a
call fcn.004d18f8
mov dword [ebp - 0x44], edx
mov edi, ecx
xor esi, esi
test edi, edi
je 0x4081a5
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4081a5
push edi
lea ecx, [ebp - 0x5c]
call fcn.00401ea5
push esi
lea edx, [ebp - 0x5c]
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x40]
call fcn.00401ca0
pop ecx
push 2
pop ebx
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], bl
call fcn.004020b1
push dword [ebp - 0x44]
lea ecx, [ebp - 0x7c]
call fcn.00401ea5
push esi
lea edx, [ebp - 0x7c]
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x28]
call fcn.00401ca0
pop ecx
lea ecx, [ebp - 0x7c]
mov byte [ebp - 4], 5
call fcn.004020b1
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov edx, 0x55c980
cmovae ecx, dword [ebp - 0x28]
sub edx, ecx
mov al, byte [ecx]
mov byte [edx + ecx], al
inc ecx
test al, al
jne 0x408145
lea ecx, [ebp - 0x64]
call fcn.00403724
cmp dword [ebp - 0x2c], 0x10
lea ecx, [ebp - 0x40]
lea edx, [ebp - 0x64]
cmovae ecx, dword [ebp - 0x40]
call fcn.004040f8
mov esi, eax
test esi, esi
jne 0x408182
lea ecx, [ebp - 0x28]
call fcn.0040217b
lea ecx, [ebp - 0x40]
call fcn.0040217b
jmp 0x4081b3
push ecx
push ecx
mov ecx, esi
call fcn.0040801e
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
mov ebx, eax
call fcn.0040217b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.0040217b
jmp 0x4081a8
xor ebx, ebx
inc ebx
test esi, esi
je 0x4081b3
mov ecx, esi
call fcn.00404136
mov eax, ebx
call fcn.004d18a2
ret

Function at 0x408ceb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
and dword [edi], 0
add eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push edx
lea eax, [ebp - 8]
push eax
push 0
push esi
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408d42
cmp dword [ebp - 8], 1
je 0x408d39
cmp dword [ebp - 8], 2
je 0x408d39
push 0xd
pop eax
jmp 0x408d42
mov eax, dword [ebp - 0xc]
shr eax, 1
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d04d5
leave
ret 0xc
Function at 0x4092f8
Capabilities:
Get system firmware table

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
xor eax, eax
push esi
push eax
push eax
push eax
push 0x52534d42
mov dword [ebp - 0x110], ecx
call ebx
mov esi, eax
test esi, esi
je 0x409442
push edi
push esi
call fcn.004f014a
mov edi, eax
pop ecx
test edi, edi
je 0x409441
push esi
push edi
push 0
push 0x52534d42
call ebx
mov ebx, dword [edi + 4]
lea ecx, [edi + 8]
add ebx, ecx
jmp 0x409382
cmp al, 0x7f
jne 0x409364
cmp byte [ecx + 1], 4
je 0x40943a
movzx eax, byte [ecx + 1]
add ecx, eax
jmp 0x40936e
mov ecx, edx
lea edx, [ecx + 1]
mov al, byte [edx]
or al, byte [ecx]
jne 0x40936c
add ecx, 2
cmp ecx, ebx
jae 0x40943a
mov al, byte [ecx]
mov esi, ecx
cmp al, 1
jne 0x409356
cmp byte [esi + 1], 8
jbe 0x40943a
push 0x105
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.004e8520
movzx eax, byte [esi + 0x17]
push eax
movzx eax, byte [esi + 0x16]
push eax
movzx eax, byte [esi + 0x15]
push eax
movzx eax, byte [esi + 0x14]
push eax
movzx eax, byte [esi + 0x13]
push eax
movzx eax, byte [esi + 0x12]
push eax
movzx eax, byte [esi + 0x11]
push eax
movzx eax, byte [esi + 0x10]
push eax
movzx eax, byte [esi + 0xe]
push eax
movzx eax, byte [esi + 0xf]
push eax
movzx eax, byte [esi + 0xc]
push eax
movzx eax, byte [esi + 0xd]
push eax
movzx eax, byte [esi + 8]
push eax
movzx eax, byte [esi + 9]
push eax
movzx eax, byte [esi + 0xa]
push eax
movzx eax, byte [esi + 0xb]
push eax
push str._02X_02X_02X_02X__02X_02X__02X_02X__02X_02X__02X_02X_02X_02X_02X_02X
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push 0x104
push eax
call fcn.004082c8
lea ecx, [ebp - 0x10c]
add esp, 0x5c
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40941b
sub ecx, edx
lea eax, [ebp - 0x10c]
push ecx
mov ecx, dword [ebp - 0x110]
push eax
add ecx, 0x30
call fcn.00402321
push edi
call fcn.004f0145
pop ecx
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.004d04d5
leave
ret
Function at 0x40bcd2
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [0x55c97c], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.0046a4c0
mov dword [0x55c978], eax
test eax, eax
jne 0x40bd09
push 2
pop eax
jmp 0x40be6a
cmp dword [esi + 0x14], 0x10
jb 0x40bd11
mov esi, dword [esi]
push esi
push 0x2712
push eax
call fcn.0046d500
xor esi, esi
push esi
push 0x4e2c
push dword [0x55c978]
call fcn.0046d500
push esi
push 0x40
push dword [0x55c978]
call fcn.0046d500
push 1
push 0x3a
push dword [0x55c978]
call fcn.0046d500
push 1
push 0x34
push dword [0x55c978]
call fcn.0046d500
push 5
push 0x44
push dword [0x55c978]
call fcn.0046d500
add esp, 0x48
push 1
push 0x63
push dword [0x55c978]
call fcn.0046d500
push str.Mozilla_5.0__Windows_NT__x86__x64__AppleWebKit_100.0__KHTML__like_Gecko__Chrome_100.0_Safari_135.3_October_1.0
push 0x2722
push dword [0x55c978]
call fcn.0046d500
push 0x1e
push 0x4e
push dword [0x55c978]
call fcn.0046d500
mov eax, dword [0x55c978]
add esp, 0x24
cmp dword [edi + 0x14], 8
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 2
mov dword [ebp - 0x10], eax
jb 0x40bdbe
mov edi, dword [edi]
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push ecx
push 0x2711
push eax
call fcn.0046d500
push 0x40bb86
push 0x4e2b
push dword [0x55c978]
call fcn.0046d500
mov ecx, dword [0x55c978]
mov eax, dword [ebp + 0xc]
push esi
push 0x2b
push ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], eax
call fcn.0046d500
push 0x40bbe8
push 0x4efb
push dword [0x55c978]
call fcn.0046d500
lea eax, [ebp - 0x20]
push eax
push 0x2749
push dword [0x55c978]
call fcn.0046d500
push dword [0x55c978]
call fcn.0046a660
add esp, 0x40
mov esi, eax
push dword [0x55c978]
call fcn.0046a480
and dword [0x55c978], 0
cmp dword [ebp - 0xc], 0
pop ecx
je 0x40be5b
push dword [ebp - 0xc]
call fcn.004ef848
pop ecx
cmp esi, 0x17
jne 0x40be68
xor eax, eax
cmp dword [ebp - 8], eax
cmove esi, eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d04d5
leave
ret
Function at 0x40bf93
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0xf4
mov eax, 0x510f49
call fcn.004d18f8
push 0x84
lea eax, [ebp - 0xb4]
mov dword [0x557ec4], 4
push 0
push eax
call fcn.004e8520
add esp, 0xc
lea ecx, [ebp - 0xb4]
call fcn.0041478d
and dword [ebp - 4], 0
mov eax, dword [0x557ec4]
sub eax, 1
je 0x40c088
sub eax, 3
jne 0x40c152
mov ecx, dword [ebp - 0xb4]
call fcn.004148a5
mov eax, dword [0x55ca9c]
test eax, eax
push 0x53b2f8
cmove eax, dword [0x55ca98]
push 0x96
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40c152
mov ecx, dword [0x55ca9c]
test ecx, ecx
push edi
cmove ecx, dword [0x55ca98]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40c07c
mov ecx, dword [0x55ca9c]
test ecx, ecx
push edi
cmove ecx, dword [0x55ca98]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40c07c
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, edi
mov ecx, eax
call fcn.00414905
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.0040bf19
mov ecx, eax
call fcn.0042b170
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
jmp 0x40c152
push dword [ebp - 0xb4]
lea ecx, [ebp - 0x2c]
call fcn.00401ea5
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 1
call fcn.0040beac
push eax
mov edx, 0x53b2dc
mov byte [ebp - 4], 2
lea ecx, [ebp - 0xe8]
call fcn.0040c228
mov byte [ebp - 4], 3
mov ecx, eax
mov dword [esp], 0x53b2d8
call fcn.00402154
push eax
lea ecx, [ebp - 0xd0]
call fcn.00401e72
mov byte [ebp - 4], 4
lea eax, [ebp - 0xd0]
cmp dword [ebp - 0xbc], 8
lea ecx, [ebp - 0x2c]
push dword [ebp - 0xc0]
cmovae eax, dword [ebp - 0xd0]
push eax
call fcn.00402455
lea ecx, [ebp - 0xd0]
call fcn.004020b1
lea ecx, [ebp - 0xe8]
call fcn.004020b1
lea ecx, [ebp - 0x100]
mov byte [ebp - 4], 1
call fcn.004020b1
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x2c]
cmovae ecx, dword [ebp - 0x2c]
call fcn.004148a5
push ecx
push ecx
mov eax, esp
mov dword [eax], str.res.xml
call fcn.0040bf19
mov ecx, eax
call fcn.0042b170
lea ecx, [ebp - 0x2c]
call fcn.004020b1
lea ecx, [ebp - 0xb4]
call fcn.0041a4f5
call fcn.004d18a2
ret
Function at 0x40c163
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
push str.7550D547_348E_421E_80C8_45D50FD18087
xor edi, edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c193
or edi, 0xffffffff
jmp 0x40c216
push ecx
call fcn.0040d130
mov ecx, eax
call fcn.0040d195
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [ebp + 8]
mov dword [0x55ca98], eax
call fcn.0040bf93
push 0xa30
call fcn.004d06e6
mov dword [esp], 0xa30
mov esi, eax
push edi
push esi
call fcn.004e8520
add esp, 0xc
mov ecx, esi
call fcn.0040da7a
mov esi, eax
test esi, esi
je 0x40c21f
push ecx
push edi
push edi
push edi
push edi
push edi
push 0x96c80000
push 0x53b358
push edi
mov ecx, esi
call fcn.0041b163
mov ecx, esi
call fcn.0041b24e
push ecx
push edi
mov ecx, esi
call fcn.0041b205
call fcn.004178ec
call fcn.0040d130
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40cfd8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x64], edx
mov dword [ebp - 0x70], eax
push esi
push edi
cmp ebx, 4
jbe 0x40d11f
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x53b660
call esi
push str.Kernel32.dll
mov dword [ebp - 0x60], eax
call esi
cmp dword [ebp - 0x60], 0
mov edi, eax
je 0x40d11f
test edi, edi
je 0x40d11f
push ebx
xor ebx, ebx
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
movaps xmm0, xmmword [0x545fe0]
mov esi, eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0x68], esi
push eax
push dword [ebp - 0x60]
movups xmmword [ebp - 0x40], xmm0
mov dword [ebp - 0x30], 0x72506e6f
mov dword [ebp - 0x2c], 0x7365636f
mov word [ebp - 0x28], 0x73
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x60], eax
test eax, eax
je 0x40d118
movaps xmm0, xmmword [0x545ff0]
lea eax, [ebp - 0x24]
push eax
push edi
movups xmmword [ebp - 0x24], xmm0
mov dword [ebp - 0x14], 0x67616d49
mov dword [ebp - 0x10], 0x6d614e65
mov word [ebp - 0xc], 0x5765
mov byte [ebp - 0xa], bl
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x6c], eax
test eax, eax
je 0x40d118
push ebx
push 0x18
lea eax, [ebp - 0x5c]
mov edi, ebx
push eax
push ebx
push esi
call dword [ebp - 0x60]
test eax, eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x60], eax
js 0x40d111
mov edi, dword [ebp - 0x48]
cmp dword [ebp - 0x64], ebx
je 0x40d111
push edi
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40d0f6
lea eax, [ebp - 0x44]
mov dword [ebp - 0x44], 0x200
push eax
push dword [ebp - 0x64]
push ebx
push esi
call dword [ebp - 0x6c]
cmp eax, 1
je 0x40d0fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [ebp - 0x70]
mov dword [eax], ebx
test esi, esi
je 0x40d10b
push esi
call dword [ebp - 0x60]
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x68]
push esi
call eax
mov eax, edi
jmp 0x40d121
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d04d5
leave
ret
Function at 0x40d41a
Capabilities:
Create shortcut via ishelllink
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x62c]
mov dword [ebp - 0x62c], ebx
push eax
push 0x525cf4
push 1
push ebx
push 0x525d74
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40d574
mov ecx, dword [ebp - 0x62c]
test ecx, ecx
je 0x40d574
mov eax, dword [ecx]
push esi
push ecx
call dword [eax + 0x50]
push 0x20a
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004e8520
push esi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.004f560c
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x62c]
lea edx, [ebp - 0x210]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 0x62c]
lea edx, [ebp - 0x630]
push edx
mov dword [ebp - 0x630], ebx
push 0x525d24
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
js 0x40d568
cmp dword [ebp - 0x630], ebx
je 0x40d568
mov esi, 0x20a
lea eax, [ebp - 0x41c]
push esi
push ebx
push eax
call fcn.004e8520
add esp, 0xc
lea eax, [ebp - 0x41c]
push ebx
push 0x10
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
lea eax, [ebp - 0x628]
push ebx
push eax
call fcn.004e8520
push edi
lea eax, [ebp - 0x41c]
push eax
push str._s_s
push 0xffffffffffffffff
lea eax, [ebp - 0x628]
push 0x104
push eax
call fcn.0040146e
mov eax, dword [ebp - 0x630]
lea edx, [ebp - 0x628]
add esp, 0x24
mov ecx, dword [eax]
push ebx
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x630]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x62c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d04d5
leave
ret 0xc

Function at 0x40d662
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x1c]
push eax
call fcn.0040d6ab
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push 0
cmovae eax, dword [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.004020b1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004d04d5
leave
ret
Function at 0x40d6ff
Capabilities:
Check if file exists
Get common file path
Query environment variable

Disassembly:
push 0x218
mov eax, 0x511112
call fcn.004d18f8
mov edi, ecx
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x220], esi
lea eax, [ebp - 0x224]
mov dword [ebp - 4], ebx
push eax
push 0x20019
push ebx
push str.SoftwareCS
push reloc.WS2_32.dll_accept
mov dword [ebp - 0x224], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d7a6
mov eax, dword [ebp - 0x224]
push 0x20a
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.004e8520
add esp, 0xc
mov dword [ebp - 0x224], 0x104
lea eax, [ebp - 0x224]
lea ecx, [ebp - 0x220]
push eax
lea eax, [ebp - 0x21c]
push eax
push str.DownPath
call fcn.00408ceb
test eax, eax
jne 0x40d7a0
lea eax, [ebp - 0x21c]
lea ecx, [edi + 0x28]
push eax
call fcn.004020df
mov esi, dword [ebp - 0x220]
cmp dword [edi + 0x38], ebx
je 0x40d7c1
lea eax, [edi + 0x28]
cmp dword [eax + 0x14], 8
jb 0x40d7b6
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d833
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.004e8520
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x104
push eax
push str._USERPROFILE_Downloads
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x40d817
push 0x20a
lea eax, [ebp - 0x21c]
push ebx
push eax
call fcn.004e8520
add esp, 0xc
lea eax, [ebp - 0x21c]
push ebx
push 0x10
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
lea eax, [ebp - 0x21c]
lea ecx, [edi + 0x28]
push eax
call fcn.004020df
test esi, esi
je 0x40d83e
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.004d18a2
ret

Function at 0x40d9ee
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x5111ab
call fcn.004d18f8
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jb 0x40da0a
mov eax, dword [eax]
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40da2b
or esi, eax
jmp 0x40da70
mov edx, ebx
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x30]
call fcn.0040168e
push esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x18]
cmp dword [ebp - 0x1c], 0x10
lea eax, [ebp - 0x30]
push ecx
push dword [ebp - 0x20]
cmovae eax, dword [ebp - 0x30]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
test eax, eax
jne 0x40da64
push 0xfffffffffffffffe
pop esi
call fcn.0040217b
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.004d18a2
ret 8
Function at 0x40f30c
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0x494
mov eax, 0x511518
call fcn.004d18f8
mov esi, dword [ecx + 0x8f4]
mov eax, dword [ecx + 0x8f8]
cmp esi, eax
je 0x40f4e3
mov ecx, dword [ebp + 0xc]
cmp dword [esi], ecx
je 0x40f345
add esi, 0x90
cmp esi, eax
jne 0x40f332
jmp 0x40f4e3
lea eax, [esi + 0x18]
xor edi, edi
push eax
lea ecx, [ebp - 0x470]
mov dword [ebp - 0x460], edi
mov dword [ebp - 0x45c], edi
call fcn.00406530
lea eax, [ebp - 0x488]
mov dword [ebp - 4], edi
push edi
push eax
call fcn.0040d130
mov ecx, eax
call fcn.0040d60a
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 1
push ecx
mov edx, eax
lea ecx, [ebp - 0x458]
call fcn.004066c5
pop ecx
lea ecx, [ebp - 0x488]
call fcn.004020b1
lea ecx, [ebp - 0x470]
mov byte [ebp - 4], 4
call fcn.004020b1
lea eax, [ebp - 0x440]
push edi
push eax
call fcn.0040d130
mov ecx, eax
call fcn.0040d60a
push 8
pop ebx
mov byte [ebp - 4], 5
lea eax, [esi + 0x48]
cmp dword [esi + 0x5c], ebx
jb 0x40f3d2
mov eax, dword [esi + 0x48]
push dword [esi + 0x58]
lea ecx, [ebp - 0x440]
push eax
call fcn.00402455
cmp dword [ebp - 0x42c], ebx
lea eax, [ebp - 0x440]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmovae eax, dword [ebp - 0x440]
push eax
call esi
test eax, eax
je 0x40f456
push 0x412
lea eax, [ebp - 0x428]
push edi
push eax
call fcn.004e8520
add esp, 0xc
lea eax, [ebp - 0x440]
cmp dword [ebp - 0x42c], ebx
cmovae eax, dword [ebp - 0x440]
push eax
push str._select____s_
push 0xffffffffffffffff
lea eax, [ebp - 0x428]
push 0x208
push eax
call fcn.0040146e
add esp, 0x14
lea eax, [ebp - 0x428]
push 0xa
push edi
push eax
push str.explorer
jmp 0x40f488
cmp dword [ebp - 0x444], ebx
lea eax, [ebp - 0x458]
cmovae eax, dword [ebp - 0x458]
push eax
call esi
test eax, eax
je 0x40f496
cmp dword [ebp - 0x444], ebx
lea eax, [ebp - 0x458]
push 0xa
cmovae eax, dword [ebp - 0x458]
push eax
push edi
push edi
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40f4cd
lea eax, [ebp - 0x4a0]
push edi
push eax
call fcn.0040d130
mov ecx, eax
call fcn.0040d60a
cmp dword [eax + 0x14], ebx
jb 0x40f4b1
mov eax, dword [eax]
push 0xa
push eax
push edi
push edi
push str.open
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x4a0]
call fcn.004020b1
lea ecx, [ebp - 0x440]
call fcn.004020b1
lea ecx, [ebp - 0x458]
call fcn.004020b1
call fcn.004d18a2
ret 8
Function at 0x40f4eb
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x55747c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.0040d130
mov ecx, eax
call fcn.0040d662
cmp eax, 5
jne 0x40f516
push 2
pop eax
jmp 0x40f59a
xor edi, edi
lea eax, [ebp - 0x30]
push edi
push eax
call fcn.0040d130
mov ecx, eax
call fcn.0040d60a
cmp dword [ebp - 0x1c], 8
lea eax, [ebp - 0x30]
push 2
cmovae eax, dword [ebp - 0x30]
push eax
push 3
pop esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push esi
push eax
mov word [ebp - 8], di
call fcn.004f573d
add esp, 0x10
lea eax, [ebp - 0x18]
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
push eax
push edi
push edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40f58e
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.004d15c0
mulsd xmm0, qword [0x545e48]
call fcn.004d14a0
cmp dword [ebp - 0x14], edx
ja 0x40f58e
jb 0x40f590
cmp dword [ebp - 0x18], eax
jb 0x40f590
mov esi, edi
lea ecx, [ebp - 0x30]
call fcn.004020b1
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004d04d5
leave
ret 8