joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460cbe
Capabilities:
Create pipe
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov edi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 2
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call esi
push eax
push dword [ebp - 0x14]
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
mov edx, edi
push ebx
xor esi, esi
call fcn.00453b91
test al, al
je 0x460de7
mov ecx, 0x104
call fcn.00444a72
mov edi, eax
mov byte [ebp - 1], bl
jmp 0x460da3
cmp dword [ebp - 8], ebx
jne 0x460d6a
cmp byte [ebp - 1], bl
jne 0x460db8
push 0xc8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
je 0x460da3
mov byte [ebp - 1], 1
jmp 0x460da3
push ebx
lea eax, [ebp - 8]
push eax
mov eax, 0x103
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x460d8d
cmp dword [ebp - 8], ebx
jne 0x460da0
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
je 0x460db8
cmp esi, 0x103
je 0x460db8
add esi, dword [ebp - 8]
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
test eax, eax
jne 0x460d45
mov ecx, edi
mov byte [esi + edi], bl
call fcn.0043ad6c
mov ecx, edi
mov esi, eax
call fcn.004444fe
cmp dword [ebp + 0xc], ebx
je 0x460ddc
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x460df1
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x460df1
or dword [eax], 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x460fd5
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x497e20
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, reloc.WS2_32.dll_accept
call fcn.00458383
test al, al
je 0x46105f
cmp dword [ebp + 8], 0
je 0x46105d
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x46100e
sub eax, edx
sar eax, 1
cmp word [ebp - 0x208], 0x22
push esi
mov esi, eax
jne 0x461058
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x206]
push eax
call sub.MSVCRT.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x461058
movzx eax, word [ebp + esi*2 - 0x206]
test ax, ax
je 0x461058
cmp ax, 0x22
jne 0x461058
xor eax, eax
inc eax
jmp 0x46105a
xor eax, eax
pop esi
jmp 0x46105f
mov al, 1
leave
ret 4
Function at 0x461063
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
xor eax, eax
push esi
cmp cl, al
je 0x4610c0
push 0x22
pop ecx
mov word [ebp - 0x21c], cx
push 0x104
lea ecx, [ebp - 0x21a]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, eax
lea eax, [ebp - 0x21a]
push eax
call fcn.00460fd5
test al, al
jne 0x4610d5
lea eax, [esi + esi]
push 0x22
pop ecx
mov word [ebp + eax - 0x21a], cx
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x21c]
push eax
push 0x497e20
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, reloc.WS2_32.dll_accept
call fcn.00458461
pop esi
leave
ret

Function at 0x4611ac
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 2], 1
mov byte [ebp - 1], bl
call fcn.0042cd8e
test eax, eax
jge 0x4611d5
call fcn.0042cdb9
jmp 0x461301
push esi
lea eax, [ebp - 8]
push eax
push 0x4b2328
push 1
push ebx
mov esi, 0x4b2318
push esi
call dword [0x4c5d6c]
test eax, eax
jl 0x4611f7
cmp dword [ebp - 8], ebx
jne 0x46121e
lea eax, [ebp - 8]
push eax
push 0x4b2308
push 1
push ebx
push esi
mov byte [ebp - 2], bl
call dword [0x4c5d6c]
test eax, eax
jl 0x4612fb
cmp dword [ebp - 8], ebx
je 0x4612fb
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x49dc60
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov eax, dword [eax]
call dword [eax]
test eax, eax
jl 0x4612d5
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x4612d5
mov ecx, dword [ebp + 0xc]
mov esi, dword [eax]
push ebx
call fcn.0043ae11
push eax
push dword [ebp - 0xc]
call dword [esi + 0x14]
mov esi, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x4612d5
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 4
cmp byte [ebp - 2], bl
je 0x461297
lea edx, [ebp - 0x568]
push edx
push 0x104
lea edx, [ebp - 0x318]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4612d2
lea eax, [ebp - 0x318]
jmp 0x4612bf
lea edx, [ebp - 0x250]
push edx
push 0x104
lea edx, [ebp - 0x110]
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x110]
mov esi, eax
call fcn.0043adb2
cmp esi, ebx
jl 0x4612d2
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
mov byte [ebp - 1], 1
test eax, eax
je 0x4612d5
mov byte [ebp - 1], bl
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x4612fb
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ebx
push dword [ebp + 0xc]
push 5
pop edx
push 4
pop ecx
call fcn.00469098
call fcn.0042cdb9
pop esi
pop ebx
leave
ret 8
Function at 0x4613dd
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
mov eax, ecx
lea edx, [ebp - 0x66c]
push 2
mov dword [ebp - 4], eax
sub edx, eax
pop ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x4613f9
lea edi, [ebp - 0x66c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x46140f
mov esi, 0x49f0e0
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x25c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x66c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x46156b
lea edx, [ebp - 0x464]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x461454
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x461457
lea edi, [ebp - 0x464]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x46146d
mov esi, 0x49dd28
lea eax, [ebp - 0x230]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x461486
sub eax, edx
lea edi, [ebp - 0x464]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x46149a
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [ebp - 0x25c], 0x10
rep movsb byte es:[edi], byte [esi]
jne 0x4614cb
lea ecx, [ebp - 0x464]
call fcn.00414939
jmp 0x46154a
mov ecx, 0x4997c4
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4614fc
test dx, dx
je 0x4614f8
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4614fc
add eax, 4
add ecx, 4
test dx, dx
jne 0x4614d6
xor eax, eax
jmp 0x461501
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46154a
mov ecx, 0x4997c8
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x461536
test dx, dx
je 0x461532
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x461536
add eax, 4
add ecx, 4
test dx, dx
jne 0x461510
xor eax, eax
jmp 0x46153b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x46154a
lea ecx, [ebp - 0x464]
call fcn.004613dd
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x461451
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46162c
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_FindWindowW]
push esi
push edi
xor ebx, ebx
jmp 0x46168c
lea eax, [esp + 0x14]
push eax
push 0x7530
push 1
push ebx
push ebx
push 0x16
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x46168c
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 0x10]
push ebx
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, ebx
je 0x4616a3
cmp edi, ebx
je 0x4616a3
push ebx
push 0x4ba8f0
call ebp
mov esi, eax
cmp esi, ebx
jne 0x46163c
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push edi
push esi
push str.TerminateSessionClientInstances_failed__hp:0x_X_result:_d_n
call fcn.0043faf7
add esp, 0xc
xor al, al
jmp 0x46169c

Function at 0x461ca9
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_GetVersion]
push 0x11c
lea edi, [esi + 4]
push 0
lea ebx, [esi + 0x124]
and dword [ebx], 0
push edi
mov dword [esi], eax
mov byte [esi + 0x120], 0
call sub.MSVCRT.dll_memset
movzx eax, byte [esi]
add esp, 0xc
cmp eax, 5
jb 0x461cf9
push edi
mov dword [edi], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
setne al
mov byte [esi + 0x120], al
movzx eax, byte [esi]
cmp eax, 6
jb 0x461d24
mov edx, str.GetProductInfo
mov ecx, 0x491fb0
call fcn.00445bf9
test eax, eax
je 0x461d24
movzx ecx, byte [esi + 1]
push ebx
push 0
push 0
push ecx
movzx ecx, byte [esi]
push ecx
call eax
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x46230d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push edx
mov ebx, ecx
push ebx
xor esi, esi
push str.__s___s
mov dword [ebp - 4], esi
call fcn.0043c769
push 0x44
pop edi
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x5c]
push esi
push eax
call sub.MSVCRT.dll_memset
mov dword [ebp - 0x5c], edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push 0x10
push 1
push esi
push esi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x46236c
leave
ret
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x46362f
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [0x4c8bb8]
mov eax, SysReAllocString
and esi, eax
cmp esi, eax
pop esi
jne 0x463645
mov al, 1
ret
jmp fcn.00462c37
Function at 0x464bac
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [0x4c8b74], 1
call fcn.00460a26
call fcn.00446452
mov ecx, eax
call fcn.0043b312
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x464bce
mov ebx, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub eax, ecx
mov dword [ebp - 4], eax
cmp byte [0x4c6ce8], dl
je 0x464c1d
mov eax, dword [0x4c6cec]
cmp eax, 0xffffffff
je 0x464c1d
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464c1f
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
jmp 0x464c1f
xor esi, esi
mov eax, dword [ebp - 4]
inc eax
mov dword [esi + 0x14], eax
cmp byte [0x4c6ce8], 0
mov esi, dword [0x4c6cec]
je 0x464c6d
cmp esi, 0xffffffff
je 0x464c6d
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x464c63
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, esi
mov esi, dword [0x4c6cec]
jmp 0x464c6f
xor eax, eax
mov eax, dword [eax + 0x14]
call section..text
cmp byte [0x4c6ce8], 0
mov dword [ebp - 4], esp
je 0x464cb3
cmp esi, 0xffffffff
je 0x464cb3
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x464cb5
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
jmp 0x464cb5
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], eax
cmp byte [0x4c6ce8], 0
mov eax, dword [0x4c6cec]
je 0x464d01
cmp eax, 0xffffffff
je 0x464d01
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464cf7
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, dword [0x4c6cec]
mov dword [ebp - 4], esi
jmp 0x464d05
and dword [ebp - 4], 0
cmp byte [0x4c6ce8], 0
je 0x464d40
cmp eax, 0xffffffff
je 0x464d40
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464d3c
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov edi, esi
jmp 0x464d42
xor edi, edi
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
call fcn.00446452
mov ecx, eax
call fcn.0043b312
mov ecx, dword [edi + 0x18]
push esi
push eax
push ecx
call sub.MSVCRT.dll_memcpy
push dword [0x4c8b70]
push eax
push str.xxxx:__utorrent.xxx_download_langpacks_dl.xxx_build00002refclientclientutorrentsys_l_ssel_l_d
call fcn.0043c869
movzx ecx, byte [ebp + 8]
add esp, 0x18
push 0x4b8858
push 0
push ecx
mov edx, 0x464b47
mov ecx, eax
call fcn.0045fcf1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x465bfc
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, edx
cmp word [eax], 0
push esi
push edi
mov dword [ebp - 4], ecx
je 0x465c47
lea esi, [ebp - 0x20c]
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x465c1a
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x465c30
push 7
pop ecx
mov esi, 0x4a035c
rep movsd dword es:[edi], dword [esi]
jmp 0x465c5b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test dword [ebp + 8], 0x800
je 0x465cb9
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x414], cx
inc eax
inc eax
test cx, cx
jne 0x465c66
lea ecx, [ebp - 0x414]
call fcn.004436a5
xor ecx, ecx
mov word [eax], cx
mov esi, str.settings.dat
mov edx, esi
lea ecx, [ebp - 0x414]
call fcn.00444f25
mov ecx, esi
mov edi, eax
call fcn.004440cc
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov ecx, edi
call fcn.004444fe
mov esi, dword [ebp + 8]
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00461d52
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00463e5d
mov eax, 0x2000
test eax, esi
je 0x465d04
lea ecx, [ebp - 0x20c]
call fcn.00420b48
test eax, eax
jge 0x465d13
lea eax, [ebp - 0x20c]
push eax
push str.INSTALLDEBUG:_Unable_to_create_firewall_rules_for_path___s__n
call fcn.0043faf7
add esp, 8
jmp 0x465d13
push esi
push eax
push str.INSTALLDEBUG:_Firewall_flag___X__not_present__flags___X__n
call fcn.0043faf7
add esp, 0xc
pop edi
test esi, 0x200
pop esi
je 0x465d22
call fcn.004650cd
mov ecx, dword [ebp - 4]
push str.SoftwareBitTorrentuTorrent
push reloc.WS2_32.dll_accept
call fcn.00458357
mov ecx, dword [ebp - 4]
push 0x62d6
push str.Revision
call fcn.00457555
leave
ret 4

Function at 0x46894a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4c8e40], 0
jne 0x468968
mov edx, str.SHGetFileInfoW
mov ecx, 0x499800
call fcn.00445bf9
pop ebp
jmp eax
pop ebp
jmp fcn.00468894

Function at 0x468fb6
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
cmp dword [0x4c8e40], ebx
push esi
sete byte [ebp - 1]
push edi
mov edi, edx
mov esi, ecx
mov edx, str.SHGetFolderPathW
cmp byte [ebp - 1], bl
jne 0x468fe1
mov edx, str.SHGetFolderPathA
mov ecx, str.shfolder.dll
call fcn.00445bf9
cmp eax, ebx
jne 0x468ff3
xor eax, eax
jmp 0x469054
cmp byte [ebp - 1], bl
jne 0x46902a
lea ecx, [ebp - 0x108]
push ecx
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x468fef
push 0x104
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
neg eax
sbb eax, eax
neg eax
jmp 0x469054
push edi
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x468fef
cmp dword [ebp + 0xc], ebx
je 0x469051
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test al, 0x10
jne 0x469051
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x469054
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x469168
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push str.GetDiskFreeSpaceExW
mov edi, ecx
xor ebx, ebx
push 0x491fb0
mov dword [ebp - 8], edi
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, dword [0x4c8e40]
cmp eax, ebx
je 0x4691a0
cmp ecx, ebx
je 0x4691fb
cmp edi, ebx
je 0x4691e4
cmp ecx, ebx
jne 0x4691ab
xor ecx, ecx
inc ecx
mov eax, edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x4691b0
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
imul esi, ecx
mov ecx, esi
call fcn.00444a72
push ebx
push ebx
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [edi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov byte [ebp - 1], 1
push str.GetDiskFreeSpaceExA
push 0x491fb0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
je 0x46921c
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push edi
call eax
mov esi, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x46924c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mul dword [ebp - 0x14]
push ebx
push dword [ebp - 0x1c]
push edx
push eax
call fcn.00401270
mov esi, eax
mov dword [ebp - 0x1c], edx
cmp byte [ebp - 1], bl
je 0x469258
mov ecx, edi
call fcn.004444fe
cmp dword [ebp - 8], ebx
je 0x469264
mov edx, dword [ebp - 0x1c]
mov eax, esi
jmp 0x469269
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4694e8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push edi
push 0
mov edi, edx
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x469503
xor al, al
jmp 0x4695a0
mov eax, dword [0x4c8e40]
push ebx
push ebp
push esi
test eax, eax
jne 0x469543
lea esi, [edi + edi]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0xd
pop esi
jmp 0x46957b
lea esi, [edi + 1]
imul esi, eax
push esi
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ebx, eax
xor eax, eax
push eax
push eax
dec esi
push esi
push ebx
push edi
push dword [esp + 0x24]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
xor esi, esi
mov byte [eax + ebx], 0
inc esi
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebp
push esi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
mov al, bl
pop ebx
pop edi
pop ecx
ret

Function at 0x4695a3
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 3
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4695c5
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esi + esi + 4]
call section..text
mov eax, dword [ebp + 8]
mov edx, esp
mov edi, edx
sub edi, eax
movzx ecx, word [eax]
mov word [edi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4695e7
xor eax, eax
mov word [edx + esi*2 + 2], ax
mov eax, 0x454
mov word [ebp - 0x10], ax
mov eax, dword [0x4c8e40]
mov ebx, edx
mov dword [ebp - 0x18], ebx
test eax, eax
jne 0x469636
mov edx, str.SHFileOperationW
mov ecx, str.shell32
call fcn.00445bf9
test eax, eax
je 0x46962e
lea ecx, [ebp - 0x20]
push ecx
call eax
jmp 0x469678
mov ebx, dword [ebp - 0x18]
mov eax, dword [0x4c8e40]
xor ecx, ecx
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x469638
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x469638
lea esi, [ecx + 1]
imul eax, esi
mov edi, eax
call section..text
mov eax, esp
xor ecx, ecx
push ecx
push ecx
push edi
push eax
push esi
push ebx
push ecx
push ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret 4