joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x18104f5c
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
mov ecx, 0x596b279d
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x4f90370a
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, edx
push 0xe
mov dword [ebp - 4], ecx
and dword [edi], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x4f903761
push dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov ecx, esi
call fcn.4f9035a8
mov esi, eax
test esi, esi
je 0x4f903757
push 0
push dword [ebp - 4]
push ebx
push esi
call fcn.4f903540
test eax, eax
je 0x4f903757
push esi
call fcn.4f903030
xor esi, esi
mov dword [edi], esi
test esi, esi
je 0x4f903761
xor eax, eax
jmp 0x4f903764
push 4
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4f903a00
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
test ecx, ecx
jne 0x4f903a15
push 7
pop eax
jmp 0x4f903a32
push 0
lea edx, [ebp - 4]
call fcn.4f903ecd
test eax, eax
jne 0x4f903a27
push 4
jmp 0x4f903a12
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
leave
ret 4

Function at 0x4f903d02
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 2
mov edi, edx
and dword [esi], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x4f903d3b
push dword [ebp + 0x10]
mov edx, ebx
push dword [ebp + 8]
push edi
push ecx
mov ecx, eax
call fcn.4f903d45
mov dword [esi], eax
test eax, eax
je 0x4f903d3b
xor eax, eax
jmp 0x4f903d3e
push 4
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x4f904ee1
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4f918454]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
lea eax, [ebp - 0x204]
push 0x100
push eax
movzx eax, word [esi + 0x3e]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
test eax, eax
je 0x4f905093
cmp dword [esi + 0x40], 0
mov byte [ebp - 0x104], 0x20
je 0x4f904f49
push 0xff
lea eax, [ebp - 0x103]
push eax
movzx eax, word [esi + 0x3a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
neg eax
sbb al, al
and byte [ebp - 0x103], al
jmp 0x4f904fa1
push 0x4f901714
mov edx, 0xff
lea ecx, [ebp - 0x103]
call fcn.4f904112
cmp dword [esi + 0x44], 0
mov edi, 0xf000
je 0x4f904f96
mov eax, dword [esi + 0x4c]
and eax, edi
cmp eax, 0x3000
jne 0x4f904f96
push 0xf2
lea eax, [ebp - 0xf7]
push eax
movzx eax, word [esi + 0x3a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
neg eax
sbb al, al
and byte [ebp - 0xf7], al
mov ecx, dword [esi + 0x4c]
test ecx, 0x400
je 0x4f904fa6
push 2
pop esi
jmp 0x4f904fc2
xor esi, esi
inc esi
test cl, 5
jne 0x4f904fc2
mov eax, esi
mov esi, ecx
and esi, edi
sub esi, 0x1000
neg esi
sbb esi, esi
not esi
and esi, eax
push ecx
lea eax, [ebp - 0x204]
mov edi, 0x200
push eax
push ecx
mov edx, edi
lea ecx, [ebp - 0x404]
call fcn.4f9041b0
test eax, eax
js 0x4f905093
lea eax, [ebp - 0x104]
mov edx, edi
push eax
lea ecx, [ebp - 0x404]
call fcn.4f904145
test eax, eax
js 0x4f905093
push esi
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
sbb ecx, ecx
not ecx
and ecx, eax
jne 0x4f90508f
lea ecx, [ebp - 0x204]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4f905023
sub ecx, edx
lea eax, [ebp - 0x204]
add eax, ecx
jmp 0x4f905046
cmp cl, 0x3a
je 0x4f90504d
lea ecx, [ebp - 0x204]
cmp eax, ecx
je 0x4f905093
dec eax
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x4f905036
inc eax
lea ecx, [ebp - 0x404]
push eax
mov edx, edi
call fcn.4f904112
test eax, eax
js 0x4f905093
lea eax, [ebp - 0x104]
mov edx, edi
push eax
lea ecx, [ebp - 0x404]
call fcn.4f904145
test eax, eax
js 0x4f905093
push esi
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x20
sbb ecx, ecx
not ecx
and ecx, eax
mov eax, ecx
jmp 0x4f905095
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.4f9158d0
leave
ret

Function at 0x4f9056d0
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x44]
test ecx, ecx
jne 0x4f9056e4
push 7
pop eax
jmp 0x4f9056ff
push 2
pop edx
call fcn.4f90fa96
test eax, eax
jne 0x4f9056f4
push 4
jmp 0x4f9056e1
push eax
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop ebp
ret 4
Function at 0x4f9059e8
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
push 8
mov esi, edx
mov edi, ecx
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x4f905a04
push 4
pop eax
jmp 0x4f905a1c
push dword [ebp + 0x10]
mov edx, edi
push dword [ebp + 8]
push esi
push ecx
mov ecx, eax
call fcn.4f90575a
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x4f906e30
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi + 0x40]
test ecx, ecx
jne 0x4f906e45
push 7
pop eax
jmp 0x4f906e63
push 2
pop edx
call fcn.4f90fa96
test eax, eax
jne 0x4f906e55
push 4
jmp 0x4f906e42
push eax
movzx eax, word [esi + 0x38]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x4f907125
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov si, word [ebp + 0x14]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
and dword [edi], 0
test si, si
jne 0x4f907146
push 0xc
jmp 0x4f907185
movzx eax, si
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x4f907183
push dword [ebp + 0x18]
mov edx, dword [ebp - 4]
push dword [ebp + 8]
push ebx
push ecx
mov ecx, eax
call fcn.4f906fe1
mov dword [edi], eax
test eax, eax
je 0x4f907183
push dword [ebp + 0x10]
mov word [eax + 0x38], si
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, dword [edi]
mov word [ecx + 0x3a], ax
xor eax, eax
jmp 0x4f907186
push 4
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x14

Function at 0x4f9078f0
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 0x40], ebx
je 0x4f907909
push 0xd
pop eax
jmp 0x4f9079b9
mov ecx, dword [esi + 0x94]
push edi
sub ecx, 0x10
push 2
pop edi
cmp ecx, 5
ja 0x4f90792d
mov ecx, esi
call fcn.4f90b373
cmp eax, edi
jne 0x4f90792d
mov eax, edi
jmp 0x4f9079b8
cmp dword [esi + 0x10], edi
jne 0x4f90794f
mov ecx, dword [esi + 0x70]
mov edx, edi
call fcn.4f90fa96
test eax, eax
je 0x4f907963
push eax
movzx eax, word [0x4f9187ec]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, esi
call fcn.4f9088c9
mov edx, edi
mov ecx, eax
call fcn.4f90fa96
test eax, eax
jne 0x4f907968
push 4
pop eax
jmp 0x4f9079b8
push eax
movzx eax, word [0x4f9187f8]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
cmp dword [esi + 0x10], 1
jne 0x4f90799d
cmp word [esi + 0x5c], bx
je 0x4f90799d
mov ecx, esi
call fcn.4f908d7d
test eax, eax
je 0x4f90799d
push eax
movzx eax, word [0x4f918804]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
mov ecx, dword [esi + 0x64]
test ecx, ecx
je 0x4f9079b6
mov eax, dword [ecx]
push ecx
mov esi, dword [eax + 0x40]
mov ecx, esi
call dword [0x4f91a33c]
call esi
jmp 0x4f9079b8
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x4f908711
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, word [0x4f9187f8]
and dword [ebp - 4], 0
push ebx
push esi
push edi
push 4
pop edi
mov esi, edx
mov ebx, ecx
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x4f908747
push 0xb
pop eax
jmp 0x4f9087e0
mov edx, dword [ebp + 8]
mov ecx, esi
push 2
call fcn.4f907f56
mov esi, eax
test esi, esi
je 0x4f9087de
cmp dword [0x4f918814], 0
mov dword [esi + 0xc], ebx
je 0x4f9087d8
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.4f9087e7
test eax, eax
je 0x4f9087d8
mov ecx, esi
call fcn.4f9089a3
movzx eax, word [0x4f9187ec]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
push 2
pop edx
mov ecx, eax
call fcn.4f90fa96
mov dword [esi + 0x70], eax
test eax, eax
je 0x4f9087d8
mov edx, dword [ebp - 8]
lea ebx, [esi + 0x64]
mov ecx, dword [ebp - 0xc]
push 5
push dword [ebp - 4]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call fcn.4f90bf25
mov edi, eax
test edi, edi
jne 0x4f9087d8
mov ecx, esi
call fcn.4f907feb
mov ecx, dword [ebp + 0xc]
mov dword [ecx], esi
mov ecx, dword [ebx]
test ecx, ecx
je 0x4f9087de
mov dword [ecx + 0x34], esi
jmp 0x4f9087de
push esi
call sym.OLECLI32.dll_OleDelete
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4f908c54
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x94]
mov dword [esi + 0x9c], edi
cmp eax, 0xf
je 0x4f908cc7
cmp eax, 0xd
jne 0x4f908c7a
cmp dword [esi + 0xa0], edi
je 0x4f908cc7
mov eax, dword [esi + 0xa0]
dec eax
cmp eax, 7
ja case.default.0x4f908c86
jmp dword [eax*4 + 0x4f908cfc]
pop edi
pop esi
jmp fcn.4f90738c
pop edi
pop esi
jmp fcn.4f909837
pop edi
pop esi
jmp fcn.4f909017
pop edi
pop esi
jmp fcn.4f90939e
pop edi
pop esi
jmp fcn.4f909c27
pop edi
pop esi
jmp fcn.4f90a23f
pop edi
pop esi
jmp fcn.4f90b0df
pop edi
xor edx, edx
pop esi
jmp fcn.4f907bc5
mov eax, dword [esi + 0xac]
mov dword [esi + 0x98], 1
mov dword [esi + 0xa8], eax
call fcn.4f908baf
cmp dword [esi + 0xb8], edi
je case.default.0x4f908c86
mov dword [esi + 0xb8], edi
mov ecx, esi
pop edi
pop esi
jmp fcn.4f90522c
pop edi
pop esi
ret
Function at 0x4f90c062
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x4f918454]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x114], eax
mov ebx, edx
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x110], eax
movzx eax, word [0x4f918810]
push edi
push eax
mov dword [ebp - 0x118], ecx
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x4f90c117
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x4f90c117
cmp dword [ebp + 0x18], 1
jne 0x4f90c0e6
push esi
mov esi, 0x106
lea ecx, [ebp - 0x10c]
mov edx, esi
call fcn.4f904112
push 0x4f9019b8
mov edx, esi
lea ecx, [ebp - 0x10c]
call fcn.4f904145
lea esi, [ebp - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 0x118]
mov edx, str.Package
push 2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x110]
push dword [ebp - 0x114]
push ebx
push 0
push esi
call fcn.4f909ee2
jmp 0x4f90c11a
push 0xb
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4f9158d0
leave
ret 0x14

Function at 0x4f90c9af
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, ecx
push edi
push 3
mov edi, edx
and dword [esi], 0
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
je 0x4f90c9e9
push dword [ebp + 0x10]
mov edx, ebx
mov ecx, eax
push dword [ebp + 8]
push edi
push 0
call fcn.4f90c60c
mov dword [esi], eax
test eax, eax
je 0x4f90c9e9
xor eax, eax
jmp 0x4f90c9ec
push 4
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x4f90c9f3
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push 0x10
mov esi, ecx
mov dword [ebp - 4], edx
push 2
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4f90ca58
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4f90ca51
mov ecx, dword [ebp - 4]
add esi, 0x3c
push edi
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
test ecx, ecx
je 0x4f90ca36
mov dword [eax + 0xc], ecx
jmp 0x4f90ca3d
mov eax, dword [ebp - 8]
and dword [eax + 0x48], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 3
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
jmp 0x4f90ca5b
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 4
pop eax
pop esi
pop ebx
leave
ret
Function at 0x4f90cb00
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4f918454]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x100
mov dword [ebp - 0x10c], eax
cmp dword [esi + 0x10], 2
je 0x4f90cbdd
push eax
lea eax, [ebp - 0x104]
push eax
movzx eax, word [esi + 0x3a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
test eax, eax
jne 0x4f90cb4d
push 7
pop eax
jmp 0x4f90cbdf
cmp byte [ebp - 0x103], 0x3a
jne 0x4f90cbee
mov al, byte [ebp - 0x104]
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x108]
push 1
push eax
mov word [ebp - 0x107], 0x3a
call dword [sym.imp.USER32.dll_CharUpperBuffA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x4f90cbf7
cmp eax, 4
jne 0x4f90cbee
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MPR.dll_WNetGetConnectionA]
test eax, eax
jne 0x4f90cbf7
mov al, byte [ebp - 0x108]
mov byte [esi + 0x5e], al
movzx eax, word [esi + 0x5c]
test ax, ax
je 0x4f90cbcc
push eax
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [esi + 0x5c], ax
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.4f9158d0
leave
ret 4
mov ecx, esi
call fcn.4f90d135
jmp 0x4f90cbdd
push 0x1b
jmp 0x4f90cb47

Function at 0x4f90cd50
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x4f918454]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
mov eax, 0x100
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10c], eax
cmp byte [edi], 0
jne 0x4f90cd92
push eax
movzx eax, word [esi + 0x5c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
test eax, eax
je 0x4f90cdfc
mov word [ebp - 0x107], 0x3a
jmp 0x4f90cdf5
inc eax
mov dword [ebx], eax
add al, 0x41
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x4f90cdf5
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x100
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.MPR.dll_WNetGetConnectionA]
test eax, eax
jne 0x4f90cdf5
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x4f90ce0f
mov eax, dword [ebx]
cmp eax, 0x1a
jl 0x4f90cd9d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4f9158d0
leave
ret 0xc
mov al, byte [ebp - 0x108]
mov ecx, esi
mov byte [esi + 0x5e], al
call fcn.4f90ce21
jmp 0x4f90cdfe
Function at 0x4f90cf00
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x4f918454]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x14]
sub eax, 0x110
je 0x4f90d05f
sub eax, 1
jne 0x4f90d080
mov ecx, dword [ebp + 0x10]
mov ebx, str.NetName
movzx eax, cx
sub eax, 1
je 0x4f90cf88
sub eax, 1
je 0x4f90d03b
sub eax, 0x1f4
jne 0x4f90d080
shr ecx, 0x10
mov eax, 0x200
cmp cx, ax
jne 0x4f90d080
push ebx
push esi
call dword [sym.imp.USER32.dll_GetPropA]
push eax
push 0
push 0xc
push 0x1f6
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x4f90d080
push 3
lea eax, [ebp - 0xe8]
push eax
push 0x1f4
push esi
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x1f5
push esi
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push ebx
push esi
call dword [sym.imp.USER32.dll_GetPropA]
lea ecx, [ebp - 0xe8]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.MPR.dll_WNetAddConnectionA]
mov edi, eax
test edi, edi
jne 0x4f90cfee
push ebx
push esi
call dword [sym.imp.USER32.dll_RemovePropA]
movsx eax, byte [ebp - 0xe8]
push eax
push esi
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
inc eax
jmp 0x4f90d082
push 0x40
lea eax, [ebp - 0x64]
push eax
push 0x258
push dword [0x4f919038]
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x80
lea eax, [ebp - 0xe4]
push eax
push 0x259
push dword [0x4f919038]
call dword [sym.imp.USER32.dll_LoadStringA]
push 5
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xe4]
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x4f90d047
push ebx
push esi
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
jmp 0x4f90cfdf
cmp edi, 0x55
jne 0x4f90d053
mov ecx, esi
call fcn.4f90d093
push 0x4f918812
push 0x1f5
jmp 0x4f90d079
push edi
push str.NetName
push esi
call dword [sym.imp.USER32.dll_SetPropA]
mov ecx, esi
call fcn.4f90d093
push edi
push 0x1f6
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4f9158d0
leave
ret 0x10
Function at 0x4f90d740
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
sub esp, 0xc
call fcn.4f905de2
test eax, eax
jne 0x4f90d75c
push 0x12
pop eax
jmp 0x4f90d8bb
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
push edi
call fcn.4f9040c5
test eax, eax
je 0x4f90d8b6
mov ecx, dword [ebp + 0xc]
xor edx, edx
call fcn.4f9040c5
test eax, eax
je 0x4f90d8b6
mov edi, dword [ebp + 0x18]
xor edx, edx
inc edx
mov ecx, edi
call fcn.4f9040c5
test eax, eax
je 0x4f90d8b6
mov esi, dword [ebp + 0x14]
xor edx, edx
mov ecx, esi
call fcn.4f9040c5
test eax, eax
je 0x4f90d8b6
cmp byte [esi], 0
jne 0x4f90d7b7
push 0x1d
jmp 0x4f90d8b8
and dword [edi], 0
push 0xffffffffffffffff
push 0x4f901728
push 0xffffffffffffffff
push dword [ebp + 8]
push 1
push 0x7f
call dword [sym.imp.KERNEL32.dll_CompareStringA]
cmp eax, 2
je 0x4f90d7dc
push 0xf
jmp 0x4f90d8b8
movzx eax, word [0x4f918810]
push eax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x4f90d808
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push 1
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push edi
push esi
call fcn.4f90c062
jmp 0x4f90d8b9
movzx eax, word [0x4f9187f4]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [0x4f918814], eax
test eax, eax
je 0x4f90d8b2
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4f90d8b2
mov ecx, eax
call fcn.4f90bc38
push dword [0x4f918814]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x20]
mov eax, dword [ebp - 4]
push dword [ebp + 0x1c]
push edi
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
cmp eax, 0xffffffff
jne 0x4f90d86a
call sym.OLECLI32.dll_DefCreateLinkFromClip
mov ecx, eax
jmp 0x4f90d8a7
imul eax, eax, 0x2c
mov dword [ebp - 0xc], eax
mov ecx, dword [eax + 0x4f918b08]
mov esi, dword [eax + 0x4f918b14]
mov dword [ebp - 8], ecx
mov ecx, esi
call dword [0x4f91a33c]
call esi
mov ecx, eax
cmp ecx, 1
jle 0x4f90d89f
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
dec eax
mov dword [edx + 0x4f918b08], eax
jmp 0x4f90d8a7
mov eax, dword [edi]
mov edx, dword [ebp - 4]
mov dword [eax + 0x20], edx
and dword [0x4f918814], 0
mov eax, ecx
jmp 0x4f90d8b9
push 0xb
jmp 0x4f90d8b8
push 0x10
pop eax
pop edi
pop esi
leave
ret 0x1c
Function at 0x4f90ffa2
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x4f918454]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
push esi
mov ebx, eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4f910037
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4f910037
push eax
mov edx, 0x100
lea ecx, [ebp - 0x104]
call fcn.4f904112
test eax, eax
js 0x4f910030
push 0x4f901a00
mov edx, 0x100
lea ecx, [ebp - 0x104]
call fcn.4f904145
test eax, eax
js 0x4f910030
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x104]
call fcn.4f913cfe
test eax, eax
jne 0x4f910030
push dword [ebp - 0x108]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
test ebx, ebx
je 0x4f910041
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4f9158d0
leave
ret