joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fcc9
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
xor eax, eax
push esi
cmp cl, al
je 0x45fd26
push 0x22
pop ecx
mov word [ebp - 0x21c], cx
push 0x104
lea ecx, [ebp - 0x21a]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, eax
lea eax, [ebp - 0x21a]
push eax
call fcn.0045fc3b
test al, al
jne 0x45fd3b
lea eax, [esi + esi]
push 0x22
pop ecx
mov word [ebp + eax - 0x21a], cx
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x21c]
push eax
push 0x495ce8
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, reloc.WS2_32.dll_accept
call fcn.00457187
pop esi
leave
ret

Function at 0x45fe12
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 2], 1
mov byte [ebp - 1], bl
call fcn.0042bf01
test eax, eax
jge 0x45fe3b
call fcn.0042bf2c
jmp 0x45ff67
push esi
lea eax, [ebp - 8]
push eax
push 0x4affc8
push 1
push ebx
mov esi, 0x4affb8
push esi
call dword [0x4c2c34]
test eax, eax
jl 0x45fe5d
cmp dword [ebp - 8], ebx
jne 0x45fe84
lea eax, [ebp - 8]
push eax
push 0x4affa8
push 1
push ebx
push esi
mov byte [ebp - 2], bl
call dword [0x4c2c34]
test eax, eax
jl 0x45ff61
cmp dword [ebp - 8], ebx
je 0x45ff61
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x49bb80
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov eax, dword [eax]
call dword [eax]
test eax, eax
jl 0x45ff3b
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x45ff3b
mov ecx, dword [ebp + 0xc]
mov esi, dword [eax]
push ebx
call fcn.00439d57
push eax
push dword [ebp - 0xc]
call dword [esi + 0x14]
mov esi, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x45ff3b
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 4
cmp byte [ebp - 2], bl
je 0x45fefd
lea edx, [ebp - 0x568]
push edx
push 0x104
lea edx, [ebp - 0x318]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x45ff38
lea eax, [ebp - 0x318]
jmp 0x45ff25
lea edx, [ebp - 0x250]
push edx
push 0x104
lea edx, [ebp - 0x110]
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x110]
mov esi, eax
call fcn.00439cf8
cmp esi, ebx
jl 0x45ff38
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
mov byte [ebp - 1], 1
test eax, eax
je 0x45ff3b
mov byte [ebp - 1], bl
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x45ff61
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ebx
push dword [ebp + 0xc]
push 5
pop edx
push 4
pop ecx
call fcn.00467af6
call fcn.0042bf2c
pop esi
pop ebx
leave
ret 8
Function at 0x460043
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
mov eax, ecx
lea edx, [ebp - 0x66c]
push 2
mov dword [ebp - 4], eax
sub edx, eax
pop ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x46005f
lea edi, [ebp - 0x66c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x460075
mov esi, 0x49cff8
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x25c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x66c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x4601d1
lea edx, [ebp - 0x464]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x4600ba
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x4600bd
lea edi, [ebp - 0x464]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x4600d3
mov esi, 0x49bc48
lea eax, [ebp - 0x230]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x4600ec
sub eax, edx
lea edi, [ebp - 0x464]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x460100
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [ebp - 0x25c], 0x10
rep movsb byte es:[edi], byte [esi]
jne 0x460131
lea ecx, [ebp - 0x464]
call fcn.00414294
jmp 0x4601b0
mov ecx, 0x497660
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x460162
test dx, dx
je 0x46015e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x460162
add eax, 4
add ecx, 4
test dx, dx
jne 0x46013c
xor eax, eax
jmp 0x460167
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4601b0
mov ecx, 0x497664
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x46019c
test dx, dx
je 0x460198
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x46019c
add eax, 4
add ecx, 4
test dx, dx
jne 0x460176
xor eax, eax
jmp 0x4601a1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4601b0
lea ecx, [ebp - 0x464]
call fcn.00460043
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4600b7
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x460292
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_FindWindowW]
push esi
push edi
xor ebx, ebx
jmp 0x4602f2
lea eax, [esp + 0x14]
push eax
push 0x7530
push 1
push ebx
push ebx
push 0x16
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x4602f2
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 0x10]
push ebx
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, ebx
je 0x460309
cmp edi, ebx
je 0x460309
push ebx
push 0x4b7890
call ebp
mov esi, eax
cmp esi, ebx
jne 0x4602a2
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push edi
push esi
push str.TerminateSessionClientInstances_failed__hp:0x_X_result:_d_n
call fcn.00447082
add esp, 0xc
xor al, al
jmp 0x460302
Function at 0x46213e
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [0x4c5a78]
mov eax, SysReAllocString
and esi, eax
cmp esi, eax
pop esi
jne 0x462154
mov al, 1
ret
jmp fcn.0046176d
Function at 0x46367f
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [0x4c5a34], 1
call fcn.0045f68c
call fcn.00445313
mov ecx, eax
call fcn.0043a258
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x4636a1
mov ebx, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub eax, ecx
mov dword [ebp - 4], eax
cmp byte [0x4c3bb0], dl
je 0x4636f0
mov eax, dword [0x4c3bb4]
cmp eax, 0xffffffff
je 0x4636f0
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x4636f2
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c3bb4]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
jmp 0x4636f2
xor esi, esi
mov eax, dword [ebp - 4]
inc eax
mov dword [esi + 0x14], eax
cmp byte [0x4c3bb0], 0
mov esi, dword [0x4c3bb4]
je 0x463740
cmp esi, 0xffffffff
je 0x463740
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x463736
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c3bb4]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, esi
mov esi, dword [0x4c3bb4]
jmp 0x463742
xor eax, eax
mov eax, dword [eax + 0x14]
call section..text
cmp byte [0x4c3bb0], 0
mov dword [ebp - 4], esp
je 0x463786
cmp esi, 0xffffffff
je 0x463786
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x463788
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c3bb4]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
jmp 0x463788
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], eax
cmp byte [0x4c3bb0], 0
mov eax, dword [0x4c3bb4]
je 0x4637d4
cmp eax, 0xffffffff
je 0x4637d4
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x4637ca
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c3bb4]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, dword [0x4c3bb4]
mov dword [ebp - 4], esi
jmp 0x4637d8
and dword [ebp - 4], 0
cmp byte [0x4c3bb0], 0
je 0x463813
cmp eax, 0xffffffff
je 0x463813
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x46380f
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c3bb4]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov edi, esi
jmp 0x463815
xor edi, edi
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
call fcn.00445313
mov ecx, eax
call fcn.0043a258
mov ecx, dword [edi + 0x18]
push esi
push eax
push ecx
call sub.MSVCRT.dll_memcpy
push dword [0x4c5a30]
push eax
push str.http:__utorrent.com_download_langpacks_dl.php_build23774refclientclientutorrentsys_l_ssel_l_d
call fcn.0043b7af
movzx ecx, byte [ebp + 8]
add esp, 0x18
push 0x4b5800
push 0
push ecx
mov edx, 0x46361a
mov ecx, eax
call fcn.0045e938
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4646c1
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, edx
cmp word [eax], 0
push esi
push edi
mov dword [ebp - 4], ecx
je 0x46470c
lea esi, [ebp - 0x20c]
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4646df
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x4646f5
push 7
pop ecx
mov esi, 0x49e264
rep movsd dword es:[edi], dword [esi]
jmp 0x464720
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test dword [ebp + 8], 0x800
je 0x46477e
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x414], cx
inc eax
inc eax
test cx, cx
jne 0x46472b
lea ecx, [ebp - 0x414]
call fcn.00442552
xor ecx, ecx
mov word [eax], cx
mov esi, str.settings.dat
mov edx, esi
lea ecx, [ebp - 0x414]
call fcn.00443dff
mov ecx, esi
mov edi, eax
call fcn.00442f79
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov ecx, edi
call fcn.004433ab
mov esi, dword [ebp + 8]
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.0046099e
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00462960
mov eax, 0x2000
test eax, esi
je 0x4647c9
lea ecx, [ebp - 0x20c]
call fcn.0041fdc7
test eax, eax
jge 0x4647d8
lea eax, [ebp - 0x20c]
push eax
push str.INSTALLDEBUG:_Unable_to_create_firewall_rules_for_path___s__n
call fcn.00447082
add esp, 8
jmp 0x4647d8
push esi
push eax
push str.INSTALLDEBUG:_Firewall_flag___X__not_present__flags___X__n
call fcn.00447082
add esp, 0xc
pop edi
test esi, 0x200
pop esi
je 0x4647e7
call fcn.00463b92
mov ecx, dword [ebp - 4]
push str.SoftwareBitTorrentuTorrent
push reloc.WS2_32.dll_accept
call fcn.0045707d
mov ecx, dword [ebp - 4]
push 0x5cde
push str.Revision
call fcn.0045627d
leave
ret 4

Function at 0x4673a8
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4c5cf8], 0
jne 0x4673c6
mov edx, str.SHGetFileInfoW
mov ecx, 0x49769c
call fcn.00444ab7
pop ebp
jmp eax
pop ebp
jmp fcn.004672f2

Function at 0x467a14
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
cmp dword [0x4c5cf8], ebx
push esi
sete byte [ebp - 1]
push edi
mov edi, edx
mov esi, ecx
mov edx, str.SHGetFolderPathW
cmp byte [ebp - 1], bl
jne 0x467a3f
mov edx, str.SHGetFolderPathA
mov ecx, str.shfolder.dll
call fcn.00444ab7
cmp eax, ebx
jne 0x467a51
xor eax, eax
jmp 0x467ab2
cmp byte [ebp - 1], bl
jne 0x467a88
lea ecx, [ebp - 0x108]
push ecx
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x467a4d
push 0x104
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
neg eax
sbb eax, eax
neg eax
jmp 0x467ab2
push edi
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x467a4d
cmp dword [ebp + 0xc], ebx
je 0x467aaf
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test al, 0x10
jne 0x467aaf
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x467ab2
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x467bc6
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push str.GetDiskFreeSpaceExW
mov edi, ecx
xor ebx, ebx
push 0x48ffa0
mov dword [ebp - 8], edi
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, dword [0x4c5cf8]
cmp eax, ebx
je 0x467bfe
cmp ecx, ebx
je 0x467c59
cmp edi, ebx
je 0x467c42
cmp ecx, ebx
jne 0x467c09
xor ecx, ecx
inc ecx
mov eax, edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x467c0e
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
imul esi, ecx
mov ecx, esi
call fcn.0044394c
push ebx
push ebx
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [edi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov byte [ebp - 1], 1
push str.GetDiskFreeSpaceExA
push 0x48ffa0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
je 0x467c7a
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push edi
call eax
mov esi, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x467caa
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mul dword [ebp - 0x14]
push ebx
push dword [ebp - 0x1c]
push edx
push eax
call fcn.00401270
mov esi, eax
mov dword [ebp - 0x1c], edx
cmp byte [ebp - 1], bl
je 0x467cb6
mov ecx, edi
call fcn.004433ab
cmp dword [ebp - 8], ebx
je 0x467cc2
mov edx, dword [ebp - 0x1c]
mov eax, esi
jmp 0x467cc7
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x467f46
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push edi
push 0
mov edi, edx
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x467f61
xor al, al
jmp 0x467ffe
mov eax, dword [0x4c5cf8]
push ebx
push ebp
push esi
test eax, eax
jne 0x467fa1
lea esi, [edi + edi]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0xd
pop esi
jmp 0x467fd9
lea esi, [edi + 1]
imul esi, eax
push esi
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ebx, eax
xor eax, eax
push eax
push eax
dec esi
push esi
push ebx
push edi
push dword [esp + 0x24]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
xor esi, esi
mov byte [eax + ebx], 0
inc esi
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebp
push esi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
mov al, bl
pop ebx
pop edi
pop ecx
ret

Function at 0x468001
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 3
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x468023
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esi + esi + 4]
call section..text
mov eax, dword [ebp + 8]
mov edx, esp
mov edi, edx
sub edi, eax
movzx ecx, word [eax]
mov word [edi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x468045
xor eax, eax
mov word [edx + esi*2 + 2], ax
mov eax, 0x454
mov word [ebp - 0x10], ax
mov eax, dword [0x4c5cf8]
mov ebx, edx
mov dword [ebp - 0x18], ebx
test eax, eax
jne 0x468094
mov edx, str.SHFileOperationW
mov ecx, str.shell32
call fcn.00444ab7
test eax, eax
je 0x46808c
lea ecx, [ebp - 0x20]
push ecx
call eax
jmp 0x4680d6
mov ebx, dword [ebp - 0x18]
mov eax, dword [0x4c5cf8]
xor ecx, ecx
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x468096
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x468096
lea esi, [ecx + 1]
imul eax, esi
mov edi, eax
call section..text
mov eax, esp
xor ecx, ecx
push ecx
push ecx
push edi
push eax
push esi
push ebx
push ecx
push ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4683b6
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, edx
call fcn.00443bc8
and dword [ebp - 4], 0
mov edi, eax
jmp 0x468416
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x46840b
cmp dword [0x4c60ac], 0
jne 0x46840b
push edi
push dword [0x4cca3c]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x32
call fcn.0044f78b
add esp, 0xc
cmp eax, 5
je 0x468425
cmp eax, 3
je 0x46844c
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
mov ecx, ebx
call fcn.00404797
mov esi, eax
cmp esi, 3
je 0x4683ce
cmp esi, 1
jne 0x468438
push edi
push dword [0x4cca40]
call fcn.004875bd
pop ecx
pop ecx
mov ecx, edi
call fcn.004433ab
xor eax, eax
pop edi
cmp esi, 1
pop esi
setle al
pop ebx
leave
ret
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x469f03
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x25
mov edi, ecx
call esi
push 0x27
movsx ebx, ax
call esi
cwde
push 0x26
mov dword [ebp - 8], eax
call esi
cwde
push 0x28
mov dword [ebp - 0xc], eax
call esi
cmp byte [edi + 0x14], 1
cwde
mov dword [ebp - 4], eax
jne 0x469f79
test bl, 1
je 0x469f49
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.004696da
test byte [ebp - 8], 1
je 0x469f5a
push 0
push 1
mov ecx, edi
call fcn.004696da
test byte [ebp - 0xc], 1
je 0x469f69
push 1
mov ecx, edi
call fcn.004696a1
test byte [ebp - 4], 1
jne 0x469f75
cmp dword [ebp - 4], 0
jge 0x469f79
mov byte [edi + 0x15], 0xa
cmp byte [edi + 0x16], 0
jne 0x469f93
inc byte [edi + 0x15]
cmp byte [edi + 0x15], 0xa
jb 0x469f93
mov ecx, edi
mov byte [edi + 0x15], 0
call fcn.00469e6a
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46a3ed
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push dword [esi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x10]
mov edi, eax
mov eax, dword [esi]
push ecx
push edi
mov ecx, esi
call dword [eax + 0xc]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [esi + 0xd4], 0
je 0x46a482
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x46a45e
mov edi, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
jne 0x46a45e
xor byte [esi + 0xf2], 1
lea ecx, [esi + 0xdc]
call fcn.00469f03
mov ecx, dword [esi + 0xf4]
lea eax, [esi + 0xd8]
cmp ecx, dword [eax]
je 0x46a482
mov dword [eax], ecx
mov ecx, esi
call fcn.0046a0cd
pop edi
pop esi
leave
ret 4
Function at 0x46a63f
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c5f28]
test eax, eax
je 0x46a652
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x198
call fcn.00443c1f
mov esi, eax
pop ecx
test esi, esi
je 0x46a673
mov ecx, esi
call fcn.0044dc0e
mov dword [esi], 0x4a2040
jmp 0x46a675
xor esi, esi
push 0
push 0x1e
mov ecx, esi
call fcn.0044e795
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x46ab30
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0x2c
call fcn.00443c1f
pop ecx
test eax, eax
je 0x46ab50
push dword [esp + 0xc]
mov ecx, eax
push dword [esp + 0xc]
call fcn.0046aae3
mov esi, eax
jmp 0x46ab52
xor esi, esi
push 0
push 0xe9
mov ecx, esi
call fcn.0044e795
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 8

Function at 0x46ab81
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, str.http:__
call fcn.00439cf8
push 1
mov edi, eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x46ac02
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46ac02
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x46abfc
push 4
push 0x48e73c
push esi
call sub.MSVCRT.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x46abde
push 4
push 0x4947a0
push esi
call sub.MSVCRT.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x46abfc
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46abe3
sub eax, edx
cmp eax, 0x12c
jae 0x46abfc
mov ecx, esi
call fcn.00439cf8
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0xffffffffffffffff
push edi
call fcn.0046ab30
pop edi
pop esi
ret
Function at 0x46b9bd
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0x50
mov esi, edx
mov edi, ecx
call fcn.00443c1f
pop ecx
test eax, eax
je 0x46b9e4
push dword [esp + 0x10]
mov ecx, eax
push dword [esp + 0x10]
push esi
push edi
call fcn.0046b683
mov esi, eax
jmp 0x46b9e6
xor esi, esi
push 0
push 0x29
mov ecx, esi
call fcn.0044e795
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 8

Function at 0x46ca86
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x34]
mov dword [esi], 0x4a223c
call fcn.004433ab
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x38]
call fcn.004433ab
mov ecx, dword [esi + 0x3c]
call fcn.004433ab
cmp byte [esi + 0x78], 0
je 0x46cac0
mov ecx, dword [esi + 0x74]
call fcn.004433ab
mov ecx, esi
pop esi
jmp fcn.0044dc1f

Function at 0x46cff7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov byte [ebp - 4], 0
je 0x46d022
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46d01e
mov byte [ebp - 4], 1
test al, 0x10
jne 0x46d022
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.0044dfcb
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.0044dfcb
pop esi
leave
ret 4