joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460b99
Capabilities:
Create pipe
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov edi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 2
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call esi
push eax
push dword [ebp - 0x14]
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
mov edx, edi
push ebx
xor esi, esi
call fcn.00453bba
test al, al
je 0x460cc2
mov ecx, 0x104
call fcn.00444a95
mov edi, eax
mov byte [ebp - 1], bl
jmp 0x460c7e
cmp dword [ebp - 8], ebx
jne 0x460c45
cmp byte [ebp - 1], bl
jne 0x460c93
push 0xc8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
je 0x460c7e
mov byte [ebp - 1], 1
jmp 0x460c7e
push ebx
lea eax, [ebp - 8]
push eax
mov eax, 0x103
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x460c68
cmp dword [ebp - 8], ebx
jne 0x460c7b
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
je 0x460c93
cmp esi, 0x103
je 0x460c93
add esi, dword [ebp - 8]
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
test eax, eax
jne 0x460c20
mov ecx, edi
mov byte [esi + edi], bl
call fcn.0043ad2a
mov ecx, edi
mov esi, eax
call fcn.00444521
cmp dword [ebp + 0xc], ebx
je 0x460cb7
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x460ccc
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x460ccc
or dword [eax], 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8

Function at 0x460eb0
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x496e20
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, reloc.WS2_32.dll_accept
call fcn.00458372
test al, al
je 0x460f3a
cmp dword [ebp + 8], 0
je 0x460f38
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x460ee9
sub eax, edx
sar eax, 1
cmp word [ebp - 0x208], 0x22
push esi
mov esi, eax
jne 0x460f33
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x206]
push eax
call sub.MSVCRT.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x460f33
movzx eax, word [ebp + esi*2 - 0x206]
test ax, ax
je 0x460f33
cmp ax, 0x22
jne 0x460f33
xor eax, eax
inc eax
jmp 0x460f35
xor eax, eax
pop esi
jmp 0x460f3a
mov al, 1
leave
ret 4
Function at 0x460f3e
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
xor eax, eax
push esi
cmp cl, al
je 0x460f9b
push 0x22
pop ecx
mov word [ebp - 0x21c], cx
push 0x104
lea ecx, [ebp - 0x21a]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, eax
lea eax, [ebp - 0x21a]
push eax
call fcn.00460eb0
test al, al
jne 0x460fb0
lea eax, [esi + esi]
push 0x22
pop ecx
mov word [ebp + eax - 0x21a], cx
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x21c]
push eax
push 0x496e20
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, reloc.WS2_32.dll_accept
call fcn.00458450
pop esi
leave
ret

Function at 0x461088
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 2], 1
mov byte [ebp - 1], bl
call fcn.0042cdce
test eax, eax
jge 0x4610b1
call fcn.0042cdf9
jmp 0x4611dd
push esi
lea eax, [ebp - 8]
push eax
push 0x4b1298
push 1
push ebx
mov esi, 0x4b1288
push esi
call dword [0x4c4d6c]
test eax, eax
jl 0x4610d3
cmp dword [ebp - 8], ebx
jne 0x4610fa
lea eax, [ebp - 8]
push eax
push 0x4b1278
push 1
push ebx
push esi
mov byte [ebp - 2], bl
call dword [0x4c4d6c]
test eax, eax
jl 0x4611d7
cmp dword [ebp - 8], ebx
je 0x4611d7
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x49cc60
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov eax, dword [eax]
call dword [eax]
test eax, eax
jl 0x4611b1
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x4611b1
mov ecx, dword [ebp + 0xc]
mov esi, dword [eax]
push ebx
call fcn.0043adcf
push eax
push dword [ebp - 0xc]
call dword [esi + 0x14]
mov esi, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x4611b1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 4
cmp byte [ebp - 2], bl
je 0x461173
lea edx, [ebp - 0x568]
push edx
push 0x104
lea edx, [ebp - 0x318]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4611ae
lea eax, [ebp - 0x318]
jmp 0x46119b
lea edx, [ebp - 0x250]
push edx
push 0x104
lea edx, [ebp - 0x110]
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x110]
mov esi, eax
call fcn.0043ad70
cmp esi, ebx
jl 0x4611ae
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
mov byte [ebp - 1], 1
test eax, eax
je 0x4611b1
mov byte [ebp - 1], bl
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x4611d7
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ebx
push dword [ebp + 0xc]
push 5
pop edx
push 4
pop ecx
call fcn.00468e55
call fcn.0042cdf9
pop esi
pop ebx
leave
ret 8
Function at 0x4612b9
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
mov eax, ecx
lea edx, [ebp - 0x66c]
push 2
mov dword [ebp - 4], eax
sub edx, eax
pop ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x4612d5
lea edi, [ebp - 0x66c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x4612eb
mov esi, 0x49e0e0
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x25c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x66c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x461447
lea edx, [ebp - 0x464]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x461330
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x461333
lea edi, [ebp - 0x464]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x461349
mov esi, 0x49cd28
lea eax, [ebp - 0x230]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x461362
sub eax, edx
lea edi, [ebp - 0x464]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x461376
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [ebp - 0x25c], 0x10
rep movsb byte es:[edi], byte [esi]
jne 0x4613a7
lea ecx, [ebp - 0x464]
call fcn.00414931
jmp 0x461426
mov ecx, 0x4987c4
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4613d8
test dx, dx
je 0x4613d4
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4613d8
add eax, 4
add ecx, 4
test dx, dx
jne 0x4613b2
xor eax, eax
jmp 0x4613dd
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x461426
mov ecx, 0x4987c8
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x461412
test dx, dx
je 0x46140e
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x461412
add eax, 4
add ecx, 4
test dx, dx
jne 0x4613ec
xor eax, eax
jmp 0x461417
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x461426
lea ecx, [ebp - 0x464]
call fcn.004612b9
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x46132d
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x461508
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_FindWindowW]
push esi
push edi
xor ebx, ebx
jmp 0x461568
lea eax, [esp + 0x14]
push eax
push 0x7530
push 1
push ebx
push ebx
push 0x16
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x461568
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 0x10]
push ebx
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, ebx
je 0x46157f
cmp edi, ebx
je 0x46157f
push ebx
push 0x4b98f0
call ebp
mov esi, eax
cmp esi, ebx
jne 0x461518
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push edi
push esi
push str.TerminateSessionClientInstances_failed__hp:0x_X_result:_d_n
call fcn.0043fb2d
add esp, 0xc
xor al, al
jmp 0x461578

Function at 0x461b85
Capabilities:
Check os version

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_GetVersion]
push 0x11c
lea edi, [esi + 4]
push 0
lea ebx, [esi + 0x124]
and dword [ebx], 0
push edi
mov dword [esi], eax
mov byte [esi + 0x120], 0
call sub.MSVCRT.dll_memset
movzx eax, byte [esi]
add esp, 0xc
cmp eax, 5
jb 0x461bd5
push edi
mov dword [edi], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
setne al
mov byte [esi + 0x120], al
movzx eax, byte [esi]
cmp eax, 6
jb 0x461c00
mov edx, str.GetProductInfo
mov ecx, 0x490fb0
call fcn.00445c1c
test eax, eax
je 0x461c00
movzx ecx, byte [esi + 1]
push ebx
push 0
push 0
push ecx
movzx ecx, byte [esi]
push ecx
call eax
pop edi
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4621cd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push edx
mov ebx, ecx
push ebx
xor esi, esi
push str.__s___s
mov dword [ebp - 4], esi
call fcn.0043c727
push 0x44
pop edi
push edi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x5c]
push esi
push eax
call sub.MSVCRT.dll_memset
mov dword [ebp - 0x5c], edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0x18
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push 0x10
push 1
push esi
push esi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x46222c
leave
ret
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x4634ef
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [0x4c7bb8]
mov eax, SysReAllocString
and esi, eax
cmp esi, eax
pop esi
jne 0x463505
mov al, 1
ret
jmp fcn.00462af7
Function at 0x464a35
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [0x4c7b74], 1
call fcn.00460901
call fcn.00446475
mov ecx, eax
call fcn.0043b2d0
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x464a57
mov ebx, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub eax, ecx
mov dword [ebp - 4], eax
cmp byte [0x4c5ce8], dl
je 0x464aa6
mov eax, dword [0x4c5cec]
cmp eax, 0xffffffff
je 0x464aa6
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464aa8
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c5cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
jmp 0x464aa8
xor esi, esi
mov eax, dword [ebp - 4]
inc eax
mov dword [esi + 0x14], eax
cmp byte [0x4c5ce8], 0
mov esi, dword [0x4c5cec]
je 0x464af6
cmp esi, 0xffffffff
je 0x464af6
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x464aec
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c5cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, esi
mov esi, dword [0x4c5cec]
jmp 0x464af8
xor eax, eax
mov eax, dword [eax + 0x14]
call section..text
cmp byte [0x4c5ce8], 0
mov dword [ebp - 4], esp
je 0x464b3c
cmp esi, 0xffffffff
je 0x464b3c
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x464b3e
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c5cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
jmp 0x464b3e
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], eax
cmp byte [0x4c5ce8], 0
mov eax, dword [0x4c5cec]
je 0x464b8a
cmp eax, 0xffffffff
je 0x464b8a
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464b80
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c5cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, dword [0x4c5cec]
mov dword [ebp - 4], esi
jmp 0x464b8e
and dword [ebp - 4], 0
cmp byte [0x4c5ce8], 0
je 0x464bc9
cmp eax, 0xffffffff
je 0x464bc9
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464bc5
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c5cec]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov edi, esi
jmp 0x464bcb
xor edi, edi
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
call fcn.00446475
mov ecx, eax
call fcn.0043b2d0
mov ecx, dword [edi + 0x18]
push esi
push eax
push ecx
call sub.MSVCRT.dll_memcpy
push dword [0x4c7b70]
push eax
push str.http:__utorrent.com_download_langpacks_dl.php_build25534refclientclientutorrentsys_l_ssel_l_d
call fcn.0043c827
movzx ecx, byte [ebp + 8]
add esp, 0x18
push 0x4b7858
push 0
push ecx
mov edx, 0x4649d0
mov ecx, eax
call fcn.0045fced
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x465a10
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, edx
cmp word [eax], 0
push esi
push edi
mov dword [ebp - 4], ecx
je 0x465a5b
lea esi, [ebp - 0x20c]
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x465a2e
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x465a44
push 7
pop ecx
mov esi, 0x49f35c
rep movsd dword es:[edi], dword [esi]
jmp 0x465a6f
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test dword [ebp + 8], 0x800
je 0x465acd
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x414], cx
inc eax
inc eax
test cx, cx
jne 0x465a7a
lea ecx, [ebp - 0x414]
call fcn.004436c8
xor ecx, ecx
mov word [eax], cx
mov esi, str.settings.dat
mov edx, esi
lea ecx, [ebp - 0x414]
call fcn.00444f48
mov ecx, esi
mov edi, eax
call fcn.004440ef
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov ecx, edi
call fcn.00444521
mov esi, dword [ebp + 8]
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00461c2e
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00463d1d
mov eax, 0x2000
test eax, esi
je 0x465b18
lea ecx, [ebp - 0x20c]
call fcn.00420b5a
test eax, eax
jge 0x465b27
lea eax, [ebp - 0x20c]
push eax
push str.INSTALLDEBUG:_Unable_to_create_firewall_rules_for_path___s__n
call fcn.0043fb2d
add esp, 8
jmp 0x465b27
push esi
push eax
push str.INSTALLDEBUG:_Firewall_flag___X__not_present__flags___X__n
call fcn.0043fb2d
add esp, 0xc
pop edi
test esi, 0x200
pop esi
je 0x465b36
call fcn.00464f56
mov ecx, dword [ebp - 4]
push str.SoftwareBitTorrentuTorrent
push reloc.WS2_32.dll_accept
call fcn.00458346
mov ecx, dword [ebp - 4]
push 0x63be
push str.Revision
call fcn.0045757d
leave
ret 4

Function at 0x468707
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4c7e20], 0
jne 0x468725
mov edx, str.SHGetFileInfoW
mov ecx, 0x498800
call fcn.00445c1c
pop ebp
jmp eax
pop ebp
jmp fcn.00468651

Function at 0x468d73
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
cmp dword [0x4c7e20], ebx
push esi
sete byte [ebp - 1]
push edi
mov edi, edx
mov esi, ecx
mov edx, str.SHGetFolderPathW
cmp byte [ebp - 1], bl
jne 0x468d9e
mov edx, str.SHGetFolderPathA
mov ecx, str.shfolder.dll
call fcn.00445c1c
cmp eax, ebx
jne 0x468db0
xor eax, eax
jmp 0x468e11
cmp byte [ebp - 1], bl
jne 0x468de7
lea ecx, [ebp - 0x108]
push ecx
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x468dac
push 0x104
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
neg eax
sbb eax, eax
neg eax
jmp 0x468e11
push edi
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x468dac
cmp dword [ebp + 0xc], ebx
je 0x468e0e
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test al, 0x10
jne 0x468e0e
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x468e11
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x468f25
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push str.GetDiskFreeSpaceExW
mov edi, ecx
xor ebx, ebx
push 0x490fb0
mov dword [ebp - 8], edi
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, dword [0x4c7e20]
cmp eax, ebx
je 0x468f5d
cmp ecx, ebx
je 0x468fb8
cmp edi, ebx
je 0x468fa1
cmp ecx, ebx
jne 0x468f68
xor ecx, ecx
inc ecx
mov eax, edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x468f6d
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
imul esi, ecx
mov ecx, esi
call fcn.00444a95
push ebx
push ebx
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [edi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov byte [ebp - 1], 1
push str.GetDiskFreeSpaceExA
push 0x490fb0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
je 0x468fd9
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push edi
call eax
mov esi, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x469009
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mul dword [ebp - 0x14]
push ebx
push dword [ebp - 0x1c]
push edx
push eax
call fcn.00401270
mov esi, eax
mov dword [ebp - 0x1c], edx
cmp byte [ebp - 1], bl
je 0x469015
mov ecx, edi
call fcn.00444521
cmp dword [ebp - 8], ebx
je 0x469021
mov edx, dword [ebp - 0x1c]
mov eax, esi
jmp 0x469026
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4692a5
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push edi
push 0
mov edi, edx
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4692c0
xor al, al
jmp 0x46935d
mov eax, dword [0x4c7e20]
push ebx
push ebp
push esi
test eax, eax
jne 0x469300
lea esi, [edi + edi]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0xd
pop esi
jmp 0x469338
lea esi, [edi + 1]
imul esi, eax
push esi
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ebx, eax
xor eax, eax
push eax
push eax
dec esi
push esi
push ebx
push edi
push dword [esp + 0x24]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
xor esi, esi
mov byte [eax + ebx], 0
inc esi
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebp
push esi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
mov al, bl
pop ebx
pop edi
pop ecx
ret

Function at 0x469360
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 3
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x469382
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esi + esi + 4]
call section..text
mov eax, dword [ebp + 8]
mov edx, esp
mov edi, edx
sub edi, eax
movzx ecx, word [eax]
mov word [edi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4693a4
xor eax, eax
mov word [edx + esi*2 + 2], ax
mov eax, 0x454
mov word [ebp - 0x10], ax
mov eax, dword [0x4c7e20]
mov ebx, edx
mov dword [ebp - 0x18], ebx
test eax, eax
jne 0x4693f3
mov edx, str.SHFileOperationW
mov ecx, str.shell32
call fcn.00445c1c
test eax, eax
je 0x4693eb
lea ecx, [ebp - 0x20]
push ecx
call eax
jmp 0x469435
mov ebx, dword [ebp - 0x18]
mov eax, dword [0x4c7e20]
xor ecx, ecx
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x4693f5
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x4693f5
lea esi, [ecx + 1]
imul eax, esi
mov edi, eax
call section..text
mov eax, esp
xor ecx, ecx
push ecx
push ecx
push edi
push eax
push esi
push ebx
push ecx
push ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret 4