joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464b5c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov byte [0x4c8b94], 1
call fcn.00460a99
call fcn.00446420
mov ecx, eax
call fcn.0043b2f1
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x464b7e
mov ebx, dword [sym.imp.KERNEL32.DLL_TlsGetValue]
sub eax, ecx
mov dword [ebp - 4], eax
cmp byte [0x4c6d08], dl
je 0x464bcd
mov eax, dword [0x4c6d0c]
cmp eax, 0xffffffff
je 0x464bcd
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464bcf
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6d0c]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
jmp 0x464bcf
xor esi, esi
mov eax, dword [ebp - 4]
inc eax
mov dword [esi + 0x14], eax
cmp byte [0x4c6d08], 0
mov esi, dword [0x4c6d0c]
je 0x464c1d
cmp esi, 0xffffffff
je 0x464c1d
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x464c13
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6d0c]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, esi
mov esi, dword [0x4c6d0c]
jmp 0x464c1f
xor eax, eax
mov eax, dword [eax + 0x14]
call section..text
cmp byte [0x4c6d08], 0
mov dword [ebp - 4], esp
je 0x464c63
cmp esi, 0xffffffff
je 0x464c63
push esi
call ebx
mov esi, eax
test esi, esi
jne 0x464c65
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6d0c]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
jmp 0x464c65
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [esi + 0x18], eax
cmp byte [0x4c6d08], 0
mov eax, dword [0x4c6d0c]
je 0x464cb1
cmp eax, 0xffffffff
je 0x464cb1
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464ca7
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6d0c]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov eax, dword [0x4c6d0c]
mov dword [ebp - 4], esi
jmp 0x464cb5
and dword [ebp - 4], 0
cmp byte [0x4c6d08], 0
je 0x464cf0
cmp eax, 0xffffffff
je 0x464cf0
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x464cec
push 0x20
call sub.MSVCRT.dll_malloc
pop ecx
push 8
mov esi, eax
pop ecx
xor eax, eax
mov edi, esi
push esi
rep stosd dword es:[edi], eax
push dword [0x4c6d0c]
call dword [sym.imp.KERNEL32.DLL_TlsSetValue]
mov edi, esi
jmp 0x464cf2
xor edi, edi
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
call fcn.00446420
mov ecx, eax
call fcn.0043b2f1
mov ecx, dword [edi + 0x18]
push esi
push eax
push ecx
call sub.MSVCRT.dll_memcpy
push dword [0x4c8b90]
push eax
push str.http:__utorrent.com_download_langpacks_dl.php_build25130refclientclientutorrentsys_l_ssel_l_d
call fcn.0043c848
movzx ecx, byte [ebp + 8]
add esp, 0x18
push 0x4b8858
push 0
push ecx
mov edx, 0x464af7
mov ecx, eax
call fcn.0045fd46
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x465bac
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, edx
cmp word [eax], 0
push esi
push edi
mov dword [ebp - 4], ecx
je 0x465bf7
lea esi, [ebp - 0x20c]
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x465bca
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x465be0
push 7
pop ecx
mov esi, 0x4a0364
rep movsd dword es:[edi], dword [esi]
jmp 0x465c0b
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test dword [ebp + 8], 0x800
je 0x465c69
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x414], cx
inc eax
inc eax
test cx, cx
jne 0x465c16
lea ecx, [ebp - 0x414]
call fcn.00443673
xor ecx, ecx
mov word [eax], cx
mov esi, str.settings.dat
mov edx, esi
lea ecx, [ebp - 0x414]
call fcn.00444ef3
mov ecx, esi
mov edi, eax
call fcn.0044409a
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov ecx, edi
call fcn.004444cc
mov esi, dword [ebp + 8]
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00461dc5
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00463e3d
mov eax, 0x2000
test eax, esi
je 0x465cb4
lea ecx, [ebp - 0x20c]
call fcn.00420b82
test eax, eax
jge 0x465cc3
lea eax, [ebp - 0x20c]
push eax
push str.INSTALLDEBUG:_Unable_to_create_firewall_rules_for_path___s__n
call fcn.00458e5e
add esp, 8
jmp 0x465cc3
push esi
push eax
push str.INSTALLDEBUG:_Firewall_flag___X__not_present__flags___X__n
call fcn.00458e5e
add esp, 0xc
pop edi
test esi, 0x200
pop esi
je 0x465cd2
call fcn.0046507d
mov ecx, dword [ebp - 4]
push str.SoftwareBitTorrentuTorrent
push reloc.WS2_32.dll_accept
call fcn.0045836a
mov ecx, dword [ebp - 4]
push 0x622a
push str.Revision
call fcn.00457568
leave
ret 4

Function at 0x4688e6
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x4c8e60], 0
jne 0x468904
mov edx, str.SHGetFileInfoW
mov ecx, 0x499808
call fcn.00445bc7
pop ebp
jmp eax
pop ebp
jmp fcn.00468830

Function at 0x468f52
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
cmp dword [0x4c8e60], ebx
push esi
sete byte [ebp - 1]
push edi
mov edi, edx
mov esi, ecx
mov edx, str.SHGetFolderPathW
cmp byte [ebp - 1], bl
jne 0x468f7d
mov edx, str.SHGetFolderPathA
mov ecx, str.shfolder.dll
call fcn.00445bc7
cmp eax, ebx
jne 0x468f8f
xor eax, eax
jmp 0x468ff0
cmp byte [ebp - 1], bl
jne 0x468fc6
lea ecx, [ebp - 0x108]
push ecx
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x468f8b
push 0x104
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
neg eax
sbb eax, eax
neg eax
jmp 0x468ff0
push edi
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x468f8b
cmp dword [ebp + 0xc], ebx
je 0x468fed
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test al, 0x10
jne 0x468fed
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x468ff0
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x469104
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push str.GetDiskFreeSpaceExW
mov edi, ecx
xor ebx, ebx
push 0x491fb0
mov dword [ebp - 8], edi
mov byte [ebp - 1], bl
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov ecx, dword [0x4c8e60]
cmp eax, ebx
je 0x46913c
cmp ecx, ebx
je 0x469197
cmp edi, ebx
je 0x469180
cmp ecx, ebx
jne 0x469147
xor ecx, ecx
inc ecx
mov eax, edi
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
cmp si, bx
jne 0x46914c
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
imul esi, ecx
mov ecx, esi
call fcn.00444a40
push ebx
push ebx
push esi
mov edi, eax
push edi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [edi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov byte [ebp - 1], 1
push str.GetDiskFreeSpaceExA
push 0x491fb0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
cmp eax, ebx
je 0x4691b8
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x20]
push ecx
push edi
call eax
mov esi, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
jmp 0x4691e8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mul dword [ebp - 0x14]
push ebx
push dword [ebp - 0x1c]
push edx
push eax
call fcn.00401270
mov esi, eax
mov dword [ebp - 0x1c], edx
cmp byte [ebp - 1], bl
je 0x4691f4
mov ecx, edi
call fcn.004444cc
cmp dword [ebp - 8], ebx
je 0x469200
mov edx, dword [ebp - 0x1c]
mov eax, esi
jmp 0x469205
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x469484
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ecx
push edi
push 0
mov edi, edx
mov dword [esp + 8], ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x46949f
xor al, al
jmp 0x46953c
mov eax, dword [0x4c8e60]
push ebx
push ebp
push esi
test eax, eax
jne 0x4694df
lea esi, [edi + edi]
lea eax, [esi + 2]
push eax
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push dword [esp + 0x14]
xor ecx, ecx
push eax
mov word [esi + eax], cx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 0xd
pop esi
jmp 0x469517
lea esi, [edi + 1]
imul esi, eax
push esi
push 0x2002
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebp, eax
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov ebx, eax
xor eax, eax
push eax
push eax
dec esi
push esi
push ebx
push edi
push dword [esp + 0x24]
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
xor esi, esi
mov byte [eax + ebx], 0
inc esi
push ebp
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
call dword [sym.imp.USER32.dll_EmptyClipboard]
push ebp
push esi
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne bl
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
mov al, bl
pop ebx
pop edi
pop ecx
ret

Function at 0x46953f
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 3
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x469561
sub eax, edx
sar eax, 1
mov esi, eax
lea eax, [esi + esi + 4]
call section..text
mov eax, dword [ebp + 8]
mov edx, esp
mov edi, edx
sub edi, eax
movzx ecx, word [eax]
mov word [edi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x469583
xor eax, eax
mov word [edx + esi*2 + 2], ax
mov eax, 0x454
mov word [ebp - 0x10], ax
mov eax, dword [0x4c8e60]
mov ebx, edx
mov dword [ebp - 0x18], ebx
test eax, eax
jne 0x4695d2
mov edx, str.SHFileOperationW
mov ecx, str.shell32
call fcn.00445bc7
test eax, eax
je 0x4695ca
lea ecx, [ebp - 0x20]
push ecx
call eax
jmp 0x469614
mov ebx, dword [ebp - 0x18]
mov eax, dword [0x4c8e60]
xor ecx, ecx
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x4695d4
mov dx, word [ebx + ecx*2]
inc ecx
test dx, dx
jne 0x4695d4
lea esi, [ecx + 1]
imul eax, esi
mov edi, eax
call section..text
mov eax, esp
xor ecx, ecx
push ecx
push ecx
push edi
push eax
push esi
push ebx
push ecx
push ecx
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x469906
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, edx
call fcn.00444cbc
and dword [ebp - 4], 0
mov edi, eax
jmp 0x469966
inc dword [ebp - 4]
cmp dword [ebp - 4], 5
jl 0x46995b
cmp dword [0x4c9214], 0
jne 0x46995b
push edi
push dword [0x4d0094]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 0x32
call fcn.00450a1d
add esp, 0xc
cmp eax, 5
je 0x469975
cmp eax, 3
je 0x46999c
push 0xc8
call dword [sym.imp.KERNEL32.DLL_Sleep]
push edi
mov ecx, ebx
call fcn.00404708
mov esi, eax
cmp esi, 3
je 0x46991e
cmp esi, 1
jne 0x469988
push edi
push dword [0x4d0098]
call fcn.004890f7
pop ecx
pop ecx
mov ecx, edi
call fcn.004444cc
xor eax, eax
pop edi
cmp esi, 1
pop esi
setle al
pop ebx
leave
ret
push 1
call dword [sym.imp.KERNEL32.DLL_ExitProcess]

Function at 0x46b4a6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push edi
push 0x25
mov edi, ecx
call esi
push 0x27
movsx ebx, ax
call esi
cwde
push 0x26
mov dword [ebp - 8], eax
call esi
cwde
push 0x28
mov dword [ebp - 0xc], eax
call esi
cmp byte [edi + 0x14], 1
cwde
mov dword [ebp - 4], eax
jne 0x46b51c
test bl, 1
je 0x46b4ec
push 0
push 0xffffffffffffffff
mov ecx, edi
call fcn.0046ac7d
test byte [ebp - 8], 1
je 0x46b4fd
push 0
push 1
mov ecx, edi
call fcn.0046ac7d
test byte [ebp - 0xc], 1
je 0x46b50c
push 1
mov ecx, edi
call fcn.0046ac44
test byte [ebp - 4], 1
jne 0x46b518
cmp dword [ebp - 4], 0
jge 0x46b51c
mov byte [edi + 0x15], 0xa
cmp byte [edi + 0x16], 0
jne 0x46b536
inc byte [edi + 0x15]
cmp byte [edi + 0x15], 0xa
jb 0x46b536
mov ecx, edi
mov byte [edi + 0x15], 0
call fcn.0046b40d
pop edi
pop esi
pop ebx
leave
ret

Function at 0x46b990
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
push dword [esi + 4]
and dword [ebp - 0x10], 0
and dword [ebp - 0xc], 0
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [esi + 0x30]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetDC]
lea ecx, [ebp - 0x10]
mov edi, eax
mov eax, dword [esi]
push ecx
push edi
mov ecx, esi
call dword [eax + 0xc]
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [esi + 0xd4], 0
je 0x46ba25
push 0x50
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x46ba01
mov edi, dword [esi + 4]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, edi
jne 0x46ba01
xor byte [esi + 0xf2], 1
lea ecx, [esi + 0xdc]
call fcn.0046b4a6
mov ecx, dword [esi + 0xf4]
lea eax, [esi + 0xd8]
cmp ecx, dword [eax]
je 0x46ba25
mov dword [eax], ecx
mov ecx, esi
call fcn.0046b670
pop edi
pop esi
leave
ret 4
Function at 0x46bbe2
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c9090]
test eax, eax
je 0x46bbf5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x198
call fcn.00444d13
mov esi, eax
pop ecx
test esi, esi
je 0x46bc16
mov ecx, esi
call fcn.0044ee9d
mov dword [esi], 0x4a41c8
jmp 0x46bc18
xor esi, esi
push 0
push 0x1e
mov ecx, esi
call fcn.0044fa27
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x46c0d3
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0x2c
call fcn.00444d13
pop ecx
test eax, eax
je 0x46c0f3
push dword [esp + 0xc]
mov ecx, eax
push dword [esp + 0xc]
call fcn.0046c086
mov esi, eax
jmp 0x46c0f5
xor esi, esi
push 0
push 0xe9
mov ecx, esi
call fcn.0044fa27
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret 8

Function at 0x46c124
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push esi
mov esi, ecx
push edi
mov ecx, str.http:__
call fcn.0043ad91
push 1
mov edi, eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x46c1a5
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x46c1a5
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x46c19f
push 4
push 0x49073c
push esi
call sub.MSVCRT.dll__strnicmp
add esp, 0xc
test eax, eax
je 0x46c181
push 4
push 0x496890
push esi
call sub.MSVCRT.dll__strnicmp
add esp, 0xc
test eax, eax
jne 0x46c19f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x46c186
sub eax, edx
cmp eax, 0x12c
jae 0x46c19f
mov ecx, esi
call fcn.0043ad91
mov edi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0xffffffffffffffff
push edi
call fcn.0046c0d3
pop edi
pop esi
ret
Function at 0x46cf7e
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
push 0x54
mov esi, edx
mov edi, ecx
call fcn.00444d13
pop ecx
test eax, eax
je 0x46cfa5
push dword [esp + 0x10]
mov ecx, eax
push dword [esp + 0x10]
push esi
push edi
call fcn.0046cc41
mov esi, eax
jmp 0x46cfa7
xor esi, esi
push 0
push 0x29
mov ecx, esi
call fcn.0044fa27
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
ret 8

Function at 0x46e047
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x34]
mov dword [esi], 0x4a43c4
call fcn.004444cc
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [esi + 0x38]
call fcn.004444cc
mov ecx, dword [esi + 0x3c]
call fcn.004444cc
cmp byte [esi + 0x78], 0
je 0x46e081
mov ecx, dword [esi + 0x74]
call fcn.004444cc
mov ecx, esi
pop esi
jmp fcn.0044eeae

Function at 0x46e5b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
mov byte [ebp - 4], 0
je 0x46e5e3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46e5df
mov byte [ebp - 4], 1
test al, 0x10
jne 0x46e5e3
mov byte [ebp - 4], 0
push dword [ebp - 4]
mov ecx, esi
push 0x51d
call fcn.0044f25d
push dword [ebp - 4]
mov ecx, esi
push 0x51e
call fcn.0044f25d
pop esi
leave
ret 4
Function at 0x470e24
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
push ebx
xor ebx, ebx
push ebx
push ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], ecx
call sub.MSVCRT.dll__waccess
pop ecx
pop ecx
test eax, eax
je 0x470e4a
xor al, al
jmp 0x470eef
cmp dword [ebp - 8], ebx
je 0x470ecd
push esi
push edi
mov edi, 0x230
push edi
lea eax, [ebp - 0x238]
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
lea eax, [ebp - 0x238]
push eax
mov esi, str.hh.exe
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryW]
lea eax, [ebp + eax*2 - 0x238]
sub eax, esi
movzx ecx, word [esi]
mov word [eax + esi], cx
inc esi
inc esi
cmp cx, bx
jne 0x470e83
push dword [ebp - 8]
lea eax, [ebp - 0x670]
push dword [ebp - 4]
push str.ms_its:_s::_s
push 0x438
push eax
call fcn.0043c67f
add esp, 0x14
push 1
push ebx
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop edi
pop esi
jmp 0x470edc
push 1
push ebx
push ebx
push dword [ebp - 4]
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setle cl
mov eax, ecx
xor ecx, ecx
cmp eax, ebx
sete cl
mov al, cl
pop ebx
leave
ret

Function at 0x47151f
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x4714df
call dword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
cmp dword [ebp - 4], 2
setle al
leave
ret

Function at 0x471f55
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
and dword [esi + 0x2c], 0
cmp dword [esp + 8], 0
je 0x471fa4
push edi
push dword [esp + 0xc]
call fcn.0046d650
lea edi, [esi + 0x48]
mov ecx, edi
call fcn.004019ad
test eax, eax
je 0x471f8d
mov edi, dword [edi]
test edi, edi
jne 0x471f86
mov edi, 0x4945b8
push edi
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push esi
push 0
push 0x8017
push dword [0x4c9ba8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
jmp 0x471fb8
push esi
push 0
push 0x801c
push dword [0x4c9ba8]
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
ret 4
Function at 0x472d24
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push edi
mov edi, ecx
xor ebx, ebx
cmp edi, ebx
jne 0x472d3f
xor eax, eax
pop edi
pop ebx
leave
ret 8
mov eax, dword [edi + 0x10]
push esi
mov esi, eax
cmp eax, ebx
jne 0x472d4e
mov esi, 0x4945b8
mov ecx, dword [0x4c3a38]
call fcn.00419735
mov edx, esi
mov ecx, eax
call fcn.00444ef3
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov byte [ebp - 1], bl
mov byte [ebp - 2], bl
mov esi, 0x49013b
cmp eax, ebx
jne 0x472d79
mov eax, esi
lea ecx, [ebp - 1]
push ecx
push ebx
push eax
lea ecx, [ebp - 0x68]
call fcn.0040dcd8
lea eax, [ebp - 2]
push eax
push ebx
push str.http:__apps.bittorrent.com_store_store.btapp
lea ecx, [ebp - 0xa0]
call fcn.0040dcd8
xor al, al
cmp byte [ebp - 1], al
je 0x472dc7
mov ecx, dword [ebp - 0x68]
mov edx, str.bittorrent.com
call fcn.0043a931
test al, al
jne 0x472dc5
mov ecx, dword [ebp - 0x68]
mov edx, str.utorrent.com
call fcn.0043a931
test al, al
je 0x472dc7
mov al, 1
cmp byte [ebp + 0xc], bl
je 0x472e63
test al, al
jne 0x472e63
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x2c], 4
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 1
cmp dword [ebp - 0x68], ebx
je 0x472e0b
push dword [ebp - 0x68]
push dword [0x4cef70]
call fcn.0043c7bb
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00439f99
mov ecx, dword [edi + 0x5c]
cmp ecx, ebx
je 0x472e1b
call fcn.0043b5b2
mov ebx, eax
jmp 0x472e1d
mov ebx, esi
mov ecx, dword [edi + 0x50]
mov esi, dword [0x4cef7c]
call fcn.0043b5b2
mov ecx, dword [edi + 0x44]
push eax
push ebx
call fcn.0043b5b2
push eax
push 0x491b48
lea eax, [ebp - 0x30]
push esi
push eax
call fcn.00450a1d
add esp, 0x18
cmp byte [ebp - 0xc], 0
mov esi, eax
je 0x472e58
mov ecx, dword [ebp - 0x10]
call fcn.004444cc
cmp esi, 6
jne 0x472f0d
xor ebx, ebx
mov ecx, dword [0x4c3a38]
push ebx
call fcn.00419735
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
mov eax, dword [edi + 8]
cmp eax, ebx
jne 0x472e82
mov eax, 0x4945b8
mov ecx, eax
mov eax, dword [ebp - 8]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x472ead
cmp dx, bx
je 0x472ea9
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x472ead
add eax, 4
add ecx, 4
cmp dx, bx
jne 0x472e87
xor eax, eax
jmp 0x472eb2
sbb eax, eax
sbb eax, 0xffffffff
cmp eax, ebx
je 0x472f19
mov eax, dword [edi + 8]
cmp eax, ebx
jne 0x472ec2
mov eax, 0x4945b8
mov edx, dword [ebp - 8]
xor esi, esi
inc esi
push esi
push esi
push ebx
mov ecx, eax
call fcn.004445ac
test eax, eax
jne 0x472f19
mov ecx, dword [0x4c3a38]
mov dword [ebp - 0x30], esi
mov esi, dword [0x4cef6c]
mov dword [ebp - 0x2c], 0x10
call fcn.00419735
mov ecx, dword [edi + 0x44]
push eax
call fcn.0043b5b2
push eax
push 0x495b68
lea eax, [ebp - 0x30]
push esi
push eax
call fcn.00450a1d
add esp, 0x14
lea ecx, [ebp - 8]
call fcn.0043b2e5
xor esi, esi
jmp 0x472f1c
mov esi, dword [ebp - 8]
lea ecx, [ebp - 0xa0]
call fcn.004064a4
lea ecx, [ebp - 0x68]
call fcn.004064a4
mov eax, esi
pop esi
jmp 0x472d39
Function at 0x473bae
Capabilities:
Persist via run registry key

Disassembly:
cmp byte [0x4c9354], 0
je 0x473bcb
mov ecx, dword [0x4c9350]
call fcn.004450ae
mov ecx, eax
call fcn.0043b350
jmp 0x473bcd
xor eax, eax
push eax
mov ecx, 0x4c8f6c
call fcn.0044fe4e
mov ecx, dword [0x4c90b8]
test ecx, ecx
je 0x473bfb
push esi
mov esi, ecx
call fcn.00471320
push 0
mov ecx, esi
call fcn.0047393a
mov ecx, esi
call fcn.0047172d
pop esi
mov cl, byte [0x4c933b]
jmp fcn.004610d9