joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45ddbc
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x680051
call fcn.006313fc
sub esp, 0x444
mov eax, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
mov esi, 0x104
mov dword [ebp - 0x10], edi
test eax, eax
jne 0x45ddf3
lea eax, [ebp - 0x450]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x450]
lea ecx, [ebp - 0x248]
push ecx
push edi
push 0x69399c
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameW]
test eax, eax
jne 0x45de2c
call fcn.00637f73
push eax
call fcn.00637f73
push eax
push str.c:_u_u.tmp
lea eax, [ebp - 0x248]
push esi
push eax
call fcn.00471625
add esp, 0x14
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
lea eax, [ebp - 0x248]
push eax
lea ecx, [ebp - 0x28]
call fcn.004249e7
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], edi
test esi, esi
je 0x45dea9
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x45de57
sub ecx, edx
mov eax, 0x103
sar ecx, 1
sub eax, ecx
lea ecx, [ebp - 0x28]
push eax
push edi
lea eax, [ebp - 0x40]
push eax
call fcn.0043d03a
push esi
mov byte [ebp - 4], 1
call fcn.004236bc
pop ecx
push eax
push esi
lea ecx, [ebp - 0x40]
call fcn.004234f9
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.00422ed9
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.0042341c
jmp 0x45deb5
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
call fcn.00422ed9
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0042341c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45df1f
Capabilities:
Create directory

Disassembly:
mov eax, 0x66e836
call fcn.006313fc
sub esp, 0x30
push ebx
push esi
mov esi, dword [esp + 0x4c]
push edi
push 8
pop ebx
cmp dword [esi + 0x14], ebx
jb 0x45df3f
mov eax, dword [esi]
jmp 0x45df41
mov eax, esi
push 0x5c
push eax
call fcn.00637ecd
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x45df70
cmp dword [esi + 0x14], ebx
jb 0x45df5a
mov eax, dword [esi]
jmp 0x45df5c
mov eax, esi
push 0x2f
push eax
call fcn.00637ecd
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x45dffe
cmp dword [esi + 0x14], ebx
jb 0x45df79
mov eax, dword [esi]
jmp 0x45df7b
mov eax, esi
sub edi, eax
sar edi, 1
cmp dword [esi + 0x14], ebx
jb 0x45df88
mov eax, dword [esi]
jmp 0x45df8a
mov eax, esi
push ebp
push eax
lea ecx, [esp + 0x2c]
call fcn.004249e7
xor eax, eax
mov dword [esp + 0x24], 7
xor ebp, ebp
mov word [esp + 0x10], ax
push edi
push ebp
lea eax, [esp + 0x30]
mov dword [esp + 0x50], ebp
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x2c], ebp
call fcn.0042358a
push 1
lea eax, [esp + 0x14]
mov byte [esp + 0x4c], 1
push eax
call fcn.0045df1f
push ebp
push 1
lea ecx, [esp + 0x18]
call fcn.0042341c
push ebp
push 1
lea ecx, [esp + 0x30]
call fcn.0042341c
cmp byte [esp + 0x58], 0
je 0x45dffd
cmp dword [esi + 0x14], ebx
jb 0x45dff5
mov esi, dword [esi]
push ebp
push esi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
pop ebp
mov ecx, dword [esp + 0x3c]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x45e704
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, 0x66dc17
call fcn.006313fc
sub esp, 0x280
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x3c]
push str._s.
push eax
call fcn.0047224d
add esp, 0xc
mov eax, dword [ebp - 0x3c]
xor ebx, ebx
cmp dword [ebp - 0x28], 8
mov dword [ebp - 4], ebx
jae 0x45e73b
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x28c]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45e7f7
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x24]
push 0x68f938
push eax
call fcn.0047224d
add esp, 0x10
test byte [ebp - 0x28c], 0x10
mov byte [ebp - 4], 1
jne 0x45e790
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x45e788
lea eax, [ebp - 0x24]
push eax
call fcn.0046b083
jmp 0x45e7cc
push 0x6939c4
lea eax, [ebp - 0x260]
push eax
call fcn.0045f39d
test eax, eax
je 0x45e7cc
push 0x6939bc
lea eax, [ebp - 0x260]
push eax
call fcn.0045f39d
test eax, eax
je 0x45e7cc
cmp dword [ebp - 0x10], 8
mov eax, dword [ebp - 0x24]
jae 0x45e7c6
lea eax, [ebp - 0x24]
push eax
call fcn.0045e704
push ebx
push 1
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.0042341c
lea eax, [ebp - 0x28c]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45e754
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.0042341c
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x45e908
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e920
test al, 0x10
je 0x45e920
xor eax, eax
inc eax
jmp 0x45e922
xor eax, eax
ret 4

Function at 0x45e93a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x45e952
test al, 0x10
jne 0x45e952
xor eax, eax
inc eax
jmp 0x45e954
xor eax, eax
ret 4
Function at 0x45ea15
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x66d22c
call fcn.006313fc
sub esp, 0x29c
push ebx
push esi
push edi
push 0x693aec
lea ecx, [ebp - 0x40]
call fcn.004249e7
push 1
lea eax, [ebp - 0x40]
xor edi, edi
push eax
sub esp, 0x18
mov dword [ebp - 4], edi
mov eax, esp
push dword [ebp + 0xc]
push eax
call fcn.004243aa
lea eax, [ebp - 0x28]
push eax
call fcn.0045dbfb
push edi
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0042341c
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45ea72
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x2a8]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x45eadf
mov bl, byte [ebp + 0x10]
test bl, bl
jne 0x45ea98
cmp word [ebp - 0x27c], 0x2e
je 0x45eac6
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x58]
call fcn.004249e7
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x58]
push eax
mov byte [ebp - 4], 3
call fcn.0043c4d1
push edi
push 1
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 2
call fcn.0042341c
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45ea8a
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.0042341c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x45eb0b
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x66d257
call fcn.006313fc
mov eax, dword [esp + 0x1c]
sub esp, 0x29c
push ebx
push ebp
xor ebp, ebp
push esi
mov esi, ebp
cmp dword [esp + 0x2c4], esi
jne 0x45eb34
mov eax, 0x693aec
push eax
lea ecx, [esp + 0x2c]
call fcn.004249e7
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x2b4], ebp
push eax
sub esp, 0x18
mov eax, esp
push dword [esp + 0x2e0]
push eax
call fcn.004243aa
lea eax, [esp + 0x30]
push eax
call fcn.0045dbfb
push ebp
push 1
lea ecx, [esp + 0x30]
mov byte [esp + 0x2b8], 2
call fcn.0042341c
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x45eb8b
lea eax, [esp + 0x10]
lea ecx, [esp + 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x45eba2
mov esi, ebp
jmp 0x45ec11
lea eax, [esp + 0x84]
push eax
lea eax, [esp + 0x44]
push eax
call fcn.004243aa
mov ecx, dword [esp + 0x2bc]
push eax
mov byte [esp + 0x2b4], 3
call fcn.0043c4d1
push ebp
push 1
lea ecx, [esp + 0x48]
mov byte [esp + 0x2b8], 2
call fcn.0042341c
lea eax, [esp + 0x58]
inc esi
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45eba2
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [esp + 0x2c0]
push dword [esp + 0x2c8]
push esi
push str.Found__d_entries_using_filter__s_in_directory__s
call fcn.00409edb
add esp, 0x10
push ebp
push 1
lea ecx, [esp + 0x18]
call fcn.0042341c
mov ecx, dword [esp + 0x2a8]
mov eax, esi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x45ec66
Capabilities:
Get common file path

Disassembly:
mov eax, 0x66d279
call fcn.006313fc
sub esp, 0x64
push esi
push edi
xor edi, edi
mov dword [ebp - 0x2c], 7
xor eax, eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x30], edi
mov word [ebp - 0x40], ax
mov dword [ebp - 4], edi
cmp byte [0x7637b6], al
je 0x45eca7
push str.downloads
push dword [ebp + 8]
call fcn.0046e937
jmp 0x45edb7
push 0x693b70
push 0x68fd44
call fcn.004617d7
mov dword [ebp - 0x28], 0x374de290
mov dword [ebp - 0x24], 0x4565123f
mov dword [ebp - 0x20], 0xc4396491
mov dword [ebp - 0x1c], 0x7b465e92
test eax, eax
je 0x45ed43
lea ecx, [ebp - 0x10]
push ecx
push edi
push 0x8000
lea ecx, [ebp - 0x28]
push ecx
call eax
test eax, eax
js 0x45ed43
push dword [ebp - 0x10]
lea ecx, [ebp - 0x58]
call fcn.004249e7
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0043d0b6
push eax
lea ecx, [ebp - 0x40]
call fcn.0044dbe6
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.0042341c
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.0042341c
push 2
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
js 0x45ed3b
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x45edab
push 2
push 0x118
call fcn.0045d8f0
push 1
push 5
mov esi, eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x45edab
push 0x693b88
lea ecx, [ebp - 0x58]
call fcn.004249e7
push 1
lea eax, [ebp - 0x58]
mov byte [ebp - 4], 2
push eax
sub esp, 0x18
mov ecx, esp
push esi
call fcn.004249e7
lea eax, [ebp - 0x70]
push eax
call fcn.0045dbfb
push eax
lea ecx, [ebp - 0x40]
call fcn.0044dbe6
push edi
push 1
lea ecx, [ebp - 0x70]
call fcn.0042341c
push edi
push 1
lea ecx, [ebp - 0x58]
call fcn.0042341c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x40]
push eax
call fcn.00422ed9
push edi
push 1
lea ecx, [ebp - 0x40]
call fcn.0042341c
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x45ee27
Capabilities:
Move file

Disassembly:
push 3
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
ret 8

Function at 0x45f0c6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
xor eax, eax
mov esi, dword [ebp + 0x10]
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp + 0x18]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x45f109
call dword [sym.imp.KERNEL32.DLL_GetLastError]
jmp 0x45f12b
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp + 0x18]
test ecx, ecx
je 0x45f115
mov dword [ecx], eax
cmp eax, esi
je 0x45f129
sub esi, eax
add eax, edi
push esi
push 0
push eax
call fcn.00635a30
add esp, 0xc
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x45f186
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x50]
push 0x22
pop eax
cmp word [edi], ax
jne 0x45f1a3
add edi, 2
push eax
lea eax, [edi + 2]
push eax
jmp 0x45f1a6
push 0x20
push edi
call fcn.006328b7
mov esi, eax
xor ebx, ebx
mov ebp, ebx
pop ecx
pop ecx
test esi, esi
je 0x45f1c2
movzx ebp, word [esi]
xor ecx, ecx
mov word [esi], cx
add esi, 2
push edi
call fcn.0045e93a
test al, al
jne 0x45f1d4
push 2
pop eax
jmp 0x45f263
push 0x3c
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.00635a30
add esp, 0xc
mov dword [esp + 0x20], edi
xor edi, edi
mov dword [esp + 0x10], 0x3c
lea eax, [esp + 0x10]
mov dword [esp + 0x24], esi
inc edi
mov dword [esp + 0x14], 0x540
push eax
mov dword [esp + 0x30], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, edi
jne 0x45f259
cmp dword [esp + 0x48], ebx
je 0x45f259
push 0x493e0
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
test eax, eax
jne 0x45f244
lea eax, [esp + 0x50]
push eax
push dword [esp + 0x4c]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
test eax, eax
je 0x45f24f
mov ebx, dword [esp + 0x50]
jmp 0x45f24f
mov ecx, 0x102
cmp eax, ecx
jne 0x45f24f
mov ebx, ecx
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x45f261
mov word [esi - 2], bp
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 4

Function at 0x45f74f
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
cmp ax, si
jne 0x45f75d
sub edi, ecx
sar edi, 1
lea eax, [edi + 1]
test eax, eax
js 0x45f783
lea eax, [edi*2 + 2]
call fcn.00637fb0
mov esi, esp
jmp 0x45f794
call dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [0x7637b0], eax
mov dword [0], esi
lea eax, [edi*2 + 2]
mov dword [ebp - 4], esi
push eax
push dword [ebp + 8]
push esi
call fcn.00631810
add esp, 0xc
push 0x5c
pop edx
cmp word [esi], dx
jne 0x45f7c9
cmp word [esi + 2], dx
jne 0x45f7c9
cmp word [esi + 4], 0x3f
jne 0x45f82e
cmp word [esi + 6], dx
jne 0x45f82e
add esi, 8
cmp edi, 3
jl 0x45f7d8
cmp word [esi + 2], 0x3a
jne 0x45f7d8
add esi, 6
push edx
push esi
call fcn.00478a87
mov esi, eax
test esi, esi
je 0x45f821
mov edi, dword [ebp - 4]
xor eax, eax
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x45f803
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x45f847
push 0x5c
xor ecx, ecx
pop eax
mov word [esi - 2], ax
cmp word [esi], cx
je 0x45f821
push eax
lea eax, [esi + 2]
push eax
call fcn.00478a87
mov esi, eax
test esi, esi
jne 0x45f7e8
mov al, 1
lea esp, [ebp - 0xc]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
push 2
pop ecx
add esi, 4
movzx eax, word [esi]
add esi, 2
cmp ax, dx
jne 0x45f842
dec ecx
je 0x45f7d8
test ax, ax
jne 0x45f834
xor al, al
jmp 0x45f823
Function at 0x45feb7
Capabilities:
Get common file path

Disassembly:
mov eax, 0x66d348
call fcn.006313fc
push ecx
push ebp
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], ebp
push esi
mov esi, dword [esp + 0x20]
push edi
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebp
mov word [esi], ax
push ebp
push ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x14], 1
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
mov edi, eax
test edi, edi
je 0x45ff56
push ebp
push edi
mov ecx, esi
call fcn.0043c638
cmp dword [esi + 0x14], 8
jb 0x45ff0b
mov eax, dword [esi]
jmp 0x45ff0d
mov eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetCurrentDirectoryW]
test eax, eax
jne 0x45ff2f
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebp
jb 0x45ff26
mov eax, dword [esi]
jmp 0x45ff28
mov eax, esi
xor ecx, ecx
mov word [eax], cx
jmp 0x45ff56
cmp dword [esi + 0x14], 8
jb 0x45ff39
mov ecx, dword [esi]
jmp 0x45ff3b
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bp
jne 0x45ff3e
sub ecx, edx
sar ecx, 1
push ebp
push ecx
mov ecx, esi
call fcn.0043c638
cmp dword [esi + 0x10], ebp
jne 0x45ff70
mov edi, 0x6939c4
push edi
call fcn.004236bc
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00434a57
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
leave
ret 4

Function at 0x460528
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
lea eax, [ebp - 0x410]
push ebx
push esi
push edi
mov ebx, 0x104
or esi, 0xffffffff
push ebx
push eax
push dword [ebp + 8]
mov edi, SysReAllocString
call fcn.0046ca28
test al, al
je 0x4605d0
push ebx
xor ebx, ebx
lea eax, [ebp - 0x208]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
je 0x4605d0
push str.FATE
lea eax, [ebp - 0x208]
push eax
call fcn.0047a370
test al, al
jne 0x4605d0
push str.FAT32
lea eax, [ebp - 0x208]
push eax
call fcn.0047a370
test al, al
jne 0x4605ce
push 0x6942c8
lea eax, [ebp - 0x208]
push eax
call fcn.0047a370
test al, al
jne 0x4605c9
push str.FAT16
lea eax, [ebp - 0x208]
push eax
call fcn.0047a370
test al, al
je 0x4605d0
mov esi, 0x7ffa8000
mov edi, ebx
push dword [ebp + 8]
push edi
push esi
push str.GetMaxFileSize___returning__Ld_for___s_
call fcn.00409edb
add esp, 0x10
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4609c8
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
lea eax, [ebp - 0x438]
push ebx
push esi
push 0x21c
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov esi, eax
call fcn.00472e4e
xor ebx, ebx
test al, al
je 0x460a32
lea edx, [ebp - 0x438]
mov ecx, str.Sysnative..explorer.exe
lea edx, [edx + esi*2]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x460a02
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
test ecx, ecx
je 0x460a6e
lea edx, [ebp - 0x438]
mov ecx, 0x69441c
lea edx, [edx + esi*2]
sub edx, ecx
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x460a42
push 1
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
xor eax, eax
test ecx, ecx
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x460c8f
Capabilities:
Get disk information

Disassembly:
mov eax, 0x669323
call fcn.006313fc
sub esp, 0x2c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x38]
push 0x104
push 0
push eax
call fcn.0043d03a
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 8
mov eax, dword [ebp - 0x38]
jae 0x460cbf
lea eax, [ebp - 0x38]
push ebx
push 0xa
lea ecx, [ebp - 0x20]
push ecx
push eax
call fcn.0046ca28
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 2
lea ecx, [ebp - 0x38]
push 0
push 1
sete bl
call fcn.0042341c
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x460d74
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
push str.ReplaceFileW
xor ebx, ebx
push 0x68986c
mov esi, ebx
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov edi, eax
test edi, edi
je 0x460e33
push dword [0x762f20]
call fcn.00637f94
call fcn.00637f73
push eax
push dword [ebp + 0xc]
mov esi, 0x104
lea eax, [ebp - 0x208]
push str._s._u.tmp
push esi
push eax
call fcn.00471625
push dword [ebp + 0xc]
lea eax, [ebp - 0x410]
push str._s.new
push esi
push eax
call fcn.00471625
add esp, 0x28
lea eax, [ebp - 0x410]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push ebx
push ebx
push 2
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x410]
push eax
push dword [ebp + 0xc]
call edi
mov esi, eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x460e33
push 4
push ebx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
xor eax, eax
test esi, esi
pop edi
pop esi
setne al
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x46111c
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push dword [esp + 0x220]
xor ebx, ebx
mov esi, ebx
call fcn.0045e93a
movzx ebp, al
test al, al
mov eax, 0x689954
je 0x461146
mov eax, str..new
push eax
push dword [esp + 0x224]
lea eax, [esp + 0x1c]
push 0x68a834
push 0x104
push eax
call fcn.00471625
add esp, 0x14
lea eax, [esp + 0x14]
push 0x80
push 7
push eax
call fcn.0045eeaa
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
jne 0x461183
xor al, al
jmp 0x4611f4
push dword [esp + 0x228]
push dword [esp + 0x228]
push eax
call fcn.0045f311
mov dword [esp + 0xc], eax
lea eax, [esp + 0x10]
push eax
call fcn.0045ee3a
test ebp, ebp
je 0x4611e1
push dword [esp + 0x220]
lea eax, [esp + 0x18]
push eax
call fcn.00460d74
movzx esi, al
test al, al
jne 0x4611e1
push ebx
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x228]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov esi, eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [esp + 0xc], ebx
jne 0x4611f2
test esi, esi
jne 0x4611ef
test ebp, ebp
jne 0x4611f2
xor ebx, ebx
inc ebx
mov al, bl
pop esi
pop ebp
pop ebx
add esp, 0x210
ret 0xc

Function at 0x461299
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4612a9
xor al, al
jmp 0x461305
mov eax, dword [esp + 8]
push ebx
push esi
push edi
lea esi, [eax + eax]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call fcn.00631810
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
mov al, bl
pop ebx
ret 8

Function at 0x461781
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
and dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0x10
push eax
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
test eax, eax
jne 0x4617c2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
push str.Cant_get_computer_name____d__d
call fcn.00479036
add esp, 0xc
push 0x694458
jmp 0x4617c6
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.004249e7
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4