joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2e89
Capabilities:
Copy file

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xbc
mov eax, dword [ebp + 0x78]
and dword [eax], 0
push ebx
push esi
push dword [ebp + 0x7c]
mov esi, edx
mov dword [ebp + 0x68], esi
mov dword [ebp + 0x6c], ecx
call fcn.004a4a93
mov ebx, eax
test ebx, ebx
je 0x4a2fb5
cmp byte [ebx], 0x64
push edi
jne 0x4a2fb2
cmp dword [esi], 0x39
jb 0x4a2fb2
push 0x11
pop ecx
mov edi, str.d10:.fileguard40:
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x4a2eed
push 0x11
pop ecx
mov edi, str.d10:file_guard40:
mov esi, ebx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
jne 0x4a2fb2
push 0xa
pop ecx
lea esi, [ebx + 0x11]
lea edi, [ebp + 0x28]
rep movsd dword es:[edi], dword [esi]
push 1
push 0x28
lea edx, [ebp + 0x28]
lea ecx, [ebp + 0x54]
mov byte [ebp + 0x50], 0
call fcn.00422553
test al, al
jne 0x4a2f16
mov eax, str.malformed_guard
jmp 0x4a2f73
mov esi, dword [ebp + 0x68]
add dword [esi], 0xffffffc8
mov eax, dword [esi]
dec eax
push eax
lea eax, [ebx + 0x39]
push eax
lea eax, [ebx + 1]
push eax
call sub.MSVCRT.dll_memmove
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.004e676c
push dword [esi]
lea ecx, [ebp - 0x4c]
push ebx
call fcn.004e7a53
push 5
mov edi, eax
pop ecx
lea esi, [ebp + 0x54]
xor eax, eax
repe cmpsd dword [esi], dword es:[edi]
jne 0x4a2f66
push dword [ebp + 0x6c]
call fcn.004448e5
add esp, 4
lea ecx, [ebp - 0x4c]
call fcn.004e6791
jmp 0x4a2fb2
lea ecx, [ebp - 0x4c]
call fcn.004e6791
mov eax, str.hash_doesnt_match
push dword [ebp + 0x6c]
push eax
push str.Warning:_file_integrity_check_failed___s_:__s
call fcn.0041ffc1
push str.Ignore_this_warning_if_you_switched_to_1.6.1_or_older_and_back
call fcn.0041ffc1
mov ecx, dword [ebp + 0x6c]
add esp, 0x10
mov edx, 0x50d8c8
call fcn.004a2ba3
push 0
push eax
push dword [ebp + 0x6c]
mov dword [ebp + 0x78], eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
lea ecx, [ebp + 0x78]
call fcn.0048db07
mov eax, ebx
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret 8

Function at 0x4a3161
Capabilities:
Check if file exists
Copy file
Get file attributes
Set file attributes

Disassembly:
push esi
push edi
mov esi, edx
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4a3196
xor ecx, ecx
cmp dword [esp + 0x10], ecx
je 0x4a317c
inc ecx
cmp dword [esp + 0x14], 0
je 0x4a3186
or ecx, 2
test eax, ecx
je 0x4a3196
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
push dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
pop edi
pop esi
ret 0xc

Function at 0x4a348e
Capabilities:
Get common file path

Disassembly:
cmp byte [0x54b0aa], 0
je 0x4a34ce
cmp byte [0x54afdc], 0
je 0x4a34b9
mov ecx, dword [0x54b0b4]
call fcn.004a3b17
test al, al
je 0x4a34b9
mov ecx, 0x54b0b4
call fcn.004a3373
mov ecx, dword [0x54b0b4]
test ecx, ecx
je 0x4a34ce
cmp word [ecx], 0
sete al
test al, al
je 0x4a34d3
jmp fcn.0047259a
jmp fcn.004221f4
Function at 0x4a3982
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push esi
push edi
push str.ReplaceFileW
push 0x4f55c4
mov edi, edx
mov dword [ebp - 8], ecx
xor esi, esi
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [ebp - 4], eax
test eax, eax
je 0x4a3a42
push dword [0x548aa8]
call sub.MSVCRT.dll_srand
call sub.MSVCRT.dll_rand
push eax
push edi
push str._s._u.tmp
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0048d59f
push edi
push str._s.new
lea eax, [ebp - 0x418]
push esi
push eax
call fcn.0048d59f
add esp, 0x28
push 0
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
push 0
push 0
push 2
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push edi
call dword [ebp - 4]
mov esi, eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
test eax, eax
jne 0x4a3a42
push 4
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileExW]
xor eax, eax
test esi, esi
pop edi
setne al
pop esi
leave
ret

Function at 0x4a451e
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x174
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
lea edi, [ebx + 4]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edx, str.UuidCreateSequential
mov ecx, 0x50c958
stosd dword es:[edi], eax
call fcn.004a3fa7
test eax, eax
je 0x4a455e
lea ecx, [ebp + 0x60]
push ecx
call eax
test eax, eax
jne 0x4a455e
lea esi, [ebp + 0x6a]
lea edi, [ebx + 4]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
push edi
push edi
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x70]
push eax
lea eax, [ebx + 0xa]
push eax
push edi
push edi
push 0x50e2b4
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
lea ecx, [ebp - 0xfc]
call fcn.004e676c
push 0xe
push ebx
lea ecx, [ebp - 0xfc]
call fcn.004e7a53
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.004e676c
push 0xa
push esi
lea ecx, [ebp - 0x14]
call fcn.004e7a53
lea esi, [ebx + 4]
push eax
mov ecx, esi
call fcn.00407922
lea ecx, [ebp - 0x88]
call fcn.004e676c
push 4
push ebx
lea ecx, [ebp - 0x88]
call fcn.004e7a53
xor ecx, ecx
mov edx, dword [ecx + eax]
add dword [esi + ecx], edx
add ecx, 4
cmp ecx, 0x14
jne 0x4a45cf
lea ecx, [ebp - 0x88]
call fcn.004e6791
lea ecx, [ebp - 0x14]
call fcn.004e6791
lea ecx, [ebp - 0xfc]
call fcn.004e6791
pop edi
pop esi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x4a472a
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.0046e5dd
push 0x21c
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
mov ebx, eax
mov dword [ebp - 8], ebx
call fcn.004a46dd
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edi, edi
test al, al
je 0x4a47a2
mov eax, str.Sysnative..explorer.exe
lea edx, [ebp + ebx*2 - 0x440]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x4a4774
push 1
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x440]
push eax
push edi
push edi
call esi
xor ebx, ebx
cmp eax, 0x20
setle bl
cmp ebx, edi
je 0x4a47d7
mov ebx, dword [ebp - 8]
mov eax, str.explorer.exe
lea edx, [ebp + ebx*2 - 0x440]
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
cmp cx, di
jne 0x4a47b0
push 1
push edi
push dword [ebp - 4]
lea eax, [ebp - 0x440]
push eax
push edi
push edi
call esi
xor ebx, ebx
cmp eax, 0x20
setle bl
call fcn.0046e5c1
xor eax, eax
cmp ebx, edi
pop edi
pop esi
sete al
pop ebx
leave
ret

Function at 0x4a4b1e
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov edi, ecx
call fcn.00472429
movzx ebx, al
mov eax, 0x4f1b50
test ebx, ebx
je 0x4a4b49
mov eax, str..new
push eax
push edi
push 0x4f1b60
lea eax, [ebp - 0x210]
push 0x104
push eax
call fcn.0048d59f
add esp, 0x14
push 0
push 0x80
push 7
pop edx
lea ecx, [ebp - 0x210]
call fcn.0047267a
mov esi, eax
cmp esi, 0xffffffff
jne 0x4a4b84
xor al, al
jmp 0x4a4bec
push dword [ebp + 8]
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.004a3c4b
push esi
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor esi, esi
cmp ebx, esi
je 0x4a4bd7
mov edx, edi
lea ecx, [ebp - 0x210]
call fcn.004a3982
movzx eax, al
mov dword [ebp - 4], eax
cmp eax, esi
jne 0x4a4bd7
push esi
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
cmp dword [ebp + 8], esi
jne 0x4a4bea
cmp dword [ebp - 4], esi
jne 0x4a4be5
cmp ebx, esi
jne 0x4a4bea
xor eax, eax
inc eax
jmp 0x4a4bec
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4a4bf3
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a4c01
sub eax, edx
sar eax, 1
mov edi, eax
lea eax, [edi + 1]
test eax, eax
js 0x4a4c25
lea eax, [edi + edi + 2]
call fcn.00401000
mov esi, esp
jmp 0x4a4c38
call dword [sym.imp.KERNEL32.DLL_GetLastError]
xor esi, esi
mov dword [0x54f634], eax
mov dword [0], esi
lea eax, [edi + edi + 2]
push eax
push ebx
push esi
mov dword [ebp - 4], esi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0x5c
pop ebx
cmp word [esi], bx
jne 0x4a4c6a
cmp word [esi + 2], bx
jne 0x4a4c6a
lea eax, [esi + 4]
cmp word [eax], 0x3f
jne 0x4a4c7d
cmp word [esi + 6], bx
jne 0x4a4c7d
add esi, 8
cmp edi, 3
jl 0x4a4c79
cmp word [esi + 2], 0x3a
jne 0x4a4c79
add esi, 6
mov ecx, esi
jmp 0x4a4cc3
push 2
pop ecx
mov esi, eax
movzx eax, word [esi]
inc esi
inc esi
cmp ax, bx
jne 0x4a4c8f
dec ecx
je 0x4a4c79
test ax, ax
jne 0x4a4c82
xor al, al
jmp 0x4a4cd2
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x4a4cb4
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xb7
jne 0x4a4c94
cmp word [esi], 0
mov eax, ebx
mov word [esi - 2], ax
je 0x4a4cd0
lea ecx, [esi + 2]
mov edx, ebx
call fcn.0042229c
mov esi, eax
test esi, esi
jne 0x4a4c98
mov al, 1
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a5059
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
push edi
lea eax, [ebp - 4]
xor edi, edi
push eax
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edi
call esi
mov ebx, dword [sym.imp.KERNEL32.DLL_GetLastError]
mov dword [ebp - 0xc], eax
cmp eax, edi
jne 0x4a50c6
call ebx
cmp eax, 0xea
jne 0x4a50c6
mov ecx, dword [ebp - 4]
lea ecx, [ecx + ecx + 2]
call fcn.0046b3f1
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
call esi
test eax, eax
jne 0x4a50cd
call ebx
mov dl, 1
mov ecx, edi
call fcn.0046b3e9
mov ecx, dword [ebp - 8]
push 0x4f3a58
call fcn.0048ea2a
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
call ebx
cmp dword [ebp - 0xc], edi
je 0x4a50a8
test edi, edi
je 0x4a50a8
mov eax, dword [ebp - 8]
mov dword [eax], edi
jmp 0x4a50c1

Function at 0x4a50d8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push 0
mov esi, edx
mov ebx, ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4a50ee
xor al, al
jmp 0x4a513e
push edi
add esi, esi
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
xor ecx, ecx
push ebx
push eax
mov word [esi + eax], cx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
pop edi
pop esi
pop ebx
ret
Function at 0x4a8d37
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x25
mov edi, ecx
call esi
push 0x27
movsx ebx, ax
call esi
cwde
push 0x26
mov dword [ebp - 8], eax
call esi
cwde
push 0x28
mov dword [ebp - 0xc], eax
call esi
cmp byte [edi + 0x14], 1
cwde
mov dword [ebp - 4], eax
jne 0x4a8dad
test bl, 1
je 0x4a8d7d
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.004a866c
test byte [ebp - 8], 1
je 0x4a8d8e
push 0
push 1
mov ecx, edi
call fcn.004a866c
test byte [ebp - 0xc], 1
je 0x4a8d9d
push 1
mov ecx, edi
call fcn.004a8633
test byte [ebp - 4], 1
jne 0x4a8da9
cmp dword [ebp - 4], 0
jge 0x4a8dad
mov byte [edi + 0x15], 0xa
cmp byte [edi + 0x16], 0
jne 0x4a8dc7
inc byte [edi + 0x15]
cmp byte [edi + 0x15], 0xa
jb 0x4a8dc7
mov ecx, edi
mov byte [edi + 0x15], 0
call fcn.004a8c9e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4a95f7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
call fcn.004a3d45
push dword [esi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x34]
mov dword [esi + 0x24], edx
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x10]
mov edi, eax
mov eax, dword [esi]
push ecx
push edi
mov ecx, esi
call dword [eax + 0x10]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [esi + 0xe4], 0
je 0x4a968e
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x4a966a
mov edi, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
jne 0x4a966a
xor byte [esi + 0x102], 1
lea ecx, [esi + 0xec]
call fcn.004a8d37
mov ecx, dword [esi + 0x104]
lea eax, [esi + 0xe8]
cmp ecx, dword [eax]
je 0x4a968e
mov dword [eax], ecx
mov ecx, esi
call fcn.004a908c
pop edi
pop esi
leave
ret 4

Function at 0x4a98d1
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x54ae44]
test eax, eax
je 0x4a98e4
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x1a8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4a98ff
mov ecx, eax
call fcn.004a986d
mov esi, eax
jmp 0x4a9901
xor esi, esi
push 0
push 0x1e
mov ecx, esi
call fcn.00468602
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x4a9eb2
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, 0x4fa38c
call fcn.0048c22b
push 1
mov edi, eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4a9f33
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4a9f33
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4a9f2d
push 4
push 0x4f19fc
push esi
call sub.MSVCRT.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x4a9f0f
push 4
push 0x4f19bc
push esi
call sub.MSVCRT.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x4a9f2d
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4a9f14
sub eax, edx
cmp eax, 0x12c
jae 0x4a9f2d
mov ecx, esi
call fcn.0048c22b
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 0xffffffffffffffff
push edi
call fcn.004a9e49
pop edi
pop esi
ret
Function at 0x4ab5b1
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0x60
mov esi, edx
mov edi, ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4ab5d8
push dword [esp + 0x10]
mov ecx, eax
push dword [esp + 0x10]
push esi
push edi
call fcn.004ab519
mov esi, eax
jmp 0x4ab5da
xor esi, esi
mov al, byte [esp + 0x14]
movzx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0x646
mov byte [esi + 0x41], al
mov word [0x537690], cx
xor ecx, ecx
test al, al
sete cl
push 0
dec ecx
and ecx, 0xfa
add ecx, 0x29
push ecx
mov ecx, esi
call fcn.00468602
cmp byte [0x54b2f8], 0
jne 0x4ab620
mov ecx, esi
call fcn.004aa0aa
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [0x54b2f8], 0
je 0x4ab640
push 0x54b2f0
mov ecx, esi
call fcn.00467b35
pop edi
pop esi
ret 0xc

Function at 0x4abcf1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0x30
mov edi, ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
test eax, eax
je 0x4abd11
push edi
mov ecx, eax
call fcn.004abc11
mov ecx, eax
jmp 0x4abd13
xor ecx, ecx
push 0
push 0x134
mov dword [0x54ae5c], ecx
call fcn.00468602
push 0
push dword [0x54bccc]
call dword [sym.imp.USER32.dll_GetParent]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
mov eax, dword [0x54ae5c]
push 5
push dword [eax + 4]
call esi
mov eax, dword [0x54ae5c]
push 3
push dword [eax + 4]
call esi
mov eax, dword [edi]
push 0x4f3aa8
lea ecx, [eax + 0x24]
call fcn.0048ea50
push eax
lea eax, [ebp - 4]
push 0x50f008
push eax
call fcn.0048f08b
mov eax, dword [0x54ae5c]
mov esi, dword [eax + 4]
add esp, 0x10
lea ecx, [ebp - 4]
call fcn.0048ea50
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x54ae5c]
mov esi, dword [eax + 0x28]
lea ecx, [ebp - 4]
call fcn.0048e75f
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x4acb07
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov byte [ebp - 4], 0
je 0x4acb32
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4acb2e
mov byte [ebp - 4], 1
test al, 0x10
jne 0x4acb32
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.00467d99
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.00467d99
pop esi
leave
ret 4
Function at 0x4b314f
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0x3c]
call fcn.0048ea75
or dword [esi + 0x40], 0xffffffff
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x24]
call fcn.004b2ee6
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
pop esi
test eax, eax
je 0x4b3196
push 0
push 0
push 0x8068
push dword [0x54bccc]
call dword [sym.imp.USER32.dll_SendMessageW]
ret

Function at 0x4b3542
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
call fcn.004b32fc
test al, al
je 0x4b3559
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 4
Function at 0x4b37dd
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0xc]
dec eax
push esi
push edi
mov dword [ebp - 4], ecx
je 0x4b393e
dec eax
je 0x4b393a
sub eax, 0xffff
je 0x4b38a5
dec eax
jne 0x4b393a
cmp dword [ebx + 0x24], 3
jne 0x4b393a
lea eax, [ebp - 0x14]
push eax
push 0
push 0x41a
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
dec dword [ebp - 8]
dec dword [ebp - 0xc]
inc dword [ebp - 0x14]
inc dword [ebp - 0x10]
lea esi, [ebp - 0x14]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x34]
push eax
push 0
movsd dword es:[edi], dword [esi]
push 0x419
push dword [ebx]
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x34]
mov esi, dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 0x666666
mov dword [ebp - 0x1c], eax
call esi
mov edi, dword [sym.imp.USER32.dll_FillRect]
push eax
mov dword [ebp + 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x10]
call edi
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x3f8500
call esi
mov esi, eax
push esi
lea eax, [ebp - 0x24]
push eax
push dword [ebx + 0x10]
call edi
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 4
jmp 0x4b3940
mov eax, dword [ebx + 0x24]
cmp eax, 2
jne 0x4b3931
lea eax, [ebx + 0x14]
mov esi, eax
mov edi, 0x54aea4
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x42
mov ecx, 0x54b00c
movsd dword es:[edi], dword [esi]
call fcn.0045bf56
mov edi, eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 8]
xor esi, esi
sub eax, dword [ebp - 0x14]
add eax, dword [ebp - 0xc]
cdq
sub eax, edx
sar eax, 1
push eax
push esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push 3
push esi
push esi
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push dword [ebx + 0x10]
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
jmp 0x4b389e
cmp eax, 3
jne 0x4b393a
push 0x14
jmp 0x4b3940
xor eax, eax
jmp 0x4b3941
push 0x30
pop eax
mov ecx, dword [ebp - 4]
or dword [ecx + 8], 0x40
pop edi
pop esi
mov dword [0x548894], eax
pop ebx
leave
ret 4
Function at 0x4b4d5e
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
push ebx
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
push edi
mov ebx, edx
call sub.MSVCRT.dll__waccess
pop ecx
pop ecx
test eax, eax
je 0x4b4d84
xor al, al
jmp 0x4b4e22
cmp ebx, esi
je 0x4b4e02
push 0x230
lea eax, [ebp - 0x230]
push esi
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push pe_nt_image_headers32
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea eax, [ebp + eax*2 - 0x230]
push eax
mov eax, str.hh.exe
call fcn.00494088
push ebx
push edi
push str.ms_its:_s::_s
lea eax, [ebp - 0x668]
push 0x438
push eax
call fcn.0048d59f
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x230]
push eax
call fcn.004448e5
add esp, 0x1c
push 1
push esi
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x230]
push eax
jmp 0x4b4e07
push 1
push esi
push esi
push edi
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
mov eax, ecx
xor ecx, ecx
cmp eax, esi
sete cl
mov al, cl
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4b52bf
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x260
push ebx
push ebp
push esi
movzx esi, byte [0x54b0aa]
xor ebx, ebx
neg esi
push edi
mov edi, ecx
mov ecx, dword [0x54b1bc]
sbb esi, esi
mov byte [esp + 0x13], bl
and esi, 4
mov dword [esp + 0x14], ebx
call fcn.00488a27
mov ebp, eax
mov dword [esp + 0x18], ebp
call fcn.00490034
mov ecx, eax
call fcn.0048ff8b
mov edx, eax
mov ecx, ebp
call fcn.004a2286
test al, al
je 0x4b5332
push str.Torrent_storage_folder_cant_be_the_same_as_the_autoload_folder_
call fcn.0041ffc1
pop ecx
mov ecx, dword [esp + 0x18]
mov dl, 1
call fcn.0046b3e9
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x260
ret 4
lea eax, [esp + 0x20]
push eax
mov edx, 0x510edc
mov ecx, ebp
call fcn.004a327a
mov ecx, eax
call fcn.0048c329
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x4b5408
test byte [esp + 0x20], 0x10
jne 0x4b53e0
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x4c]
call fcn.004a327a
push ebx
push ebx
push 3
push ebx
push ebx
mov ebp, eax
push 0xc0000000
push ebp
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
je 0x4b53c2
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
inc byte [edi + 0x85]
push ebx
push 2
push ebx
push ebx
push ebx
mov ecx, ebp
call fcn.004221f4
push eax
push 0x4b5241
push ebx
mov edx, esi
push ebx
or edx, 0x100
mov ecx, ebp
call fcn.00420a6a
inc dword [esp + 0x14]
jmp 0x4b53c7
mov byte [esp + 0x13], 1
mov dl, 1
mov ecx, ebp
call fcn.0046b3e9
cmp byte [edi + 0x85], 0x19
jb 0x4b53f9
cmp dword [esp + 0x14], 0x64
jb 0x4b53f9
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4b535e
jmp 0x4b53fe
mov byte [esp + 0x13], 1
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov bl, byte [esp + 0x13]
jmp 0x4b5318