joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4087f9
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x410]
sub esp, 0x490
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp + 0x40c], eax
push ebx
push esi
push edi
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x204], ax
mov edi, edx
lea eax, [ebp + 0x206]
mov esi, ecx
push ebx
push eax
call fcn.004162b0
add esp, 0xc
lea eax, [ebp + 0x204]
push 0x443950
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.TempRun_NonElevated.cmd
lea eax, [ebp + 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.w__ccsUTF_8
lea eax, [ebp + 0x204]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00419312
add esp, 0xc
test eax, eax
jne 0x4089b6
cmp dword [ebp - 8], ebx
je 0x4088ab
push str.chcp_65001_n
push dword [ebp - 8]
call fcn.0040b400
push edi
push esi
push str.chcp_65001_nsubst__s:___s__n
push dword [ebp - 8]
call fcn.0040b400
push dword [ebp - 8]
call fcn.004193d0
add esp, 0x1c
mov eax, dword [0x44437c]
xorps xmm0, xmm0
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x204]
mov dword [ebp - 0x30], eax
mov eax, dword [0x444380]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], str.Explorer
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0xc], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
je 0x408919
push 0xffffffffffffffff
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x204
lea eax, [ebp]
mov dword [ebp - 4], 0x30
push 0
push eax
call fcn.004162b0
push edi
push esi
push str._s:___s_
lea eax, [ebp - 4]
push 0x104
push eax
call fcn.0040b4a0
push 0x3c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.004162b0
mov eax, dword [0x44437c]
lea esi, [ebp - 0x80]
add esp, 0x2c
lea edi, [ebp - 0x44]
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c], eax
xor ecx, ecx
lea eax, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x30], eax
mov eax, dword [0x444380]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], str.Subst
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0xc], 0
je 0x4089b6
push 0xffffffffffffffff
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x40c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00415673
add ebp, 0x410
leave
ret
Function at 0x4089ce
Capabilities:
Create process on windows
Delete file
Schedule task via schtasks

Disassembly:
push ebp
lea ebp, [esp - 0x5dc]
sub esp, 0x65c
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp + 0x5d8], eax
push esi
push edi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp + 0x3d0], ax
lea eax, [ebp + 0x3d2]
push esi
push eax
call fcn.004162b0
add esp, 0xc
lea eax, [ebp + 0x3d0]
push 0x443950
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.ExtraDisksMount.exe
lea eax, [ebp + 0x3d0]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.w__ccsUTF_8
mov edi, 0x443b58
lea eax, [ebp - 0x44]
push edi
push eax
call fcn.00419312
add esp, 0xc
test eax, eax
jne 0x408b17
cmp dword [ebp - 0x44], esi
je 0x408a72
lea eax, [ebp + 0x3d0]
push eax
push str.schtasks__create__tn__ExtraDisksMount___tr___s___sc_ONLOGON__RL_HIGHEST__n
push dword [ebp - 0x44]
call fcn.0040b450
push dword [ebp - 0x44]
call fcn.004193d0
add esp, 0x10
xor eax, eax
push 0x40e
mov word [ebp - 0x40], ax
lea eax, [ebp - 0x3e]
push esi
push eax
call fcn.004162b0
push edi
push str._ExecutionPolicy_Bypass__Command____s_
lea eax, [ebp - 0x40]
push 0x208
push eax
call fcn.0040b4a0
mov eax, dword [0x44437c]
add esp, 0x1c
mov dword [ebp - 0x78], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x40]
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x6c], eax
mov eax, dword [0x444380]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x80]
push eax
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], str.PowerShell.exe
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x48], esi
je 0x408b07
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x443d60
call esi
push edi
call esi
mov ecx, dword [ebp + 0x5d8]
pop edi
xor ecx, ebp
pop esi
call fcn.00415673
add ebp, 0x5dc
leave
ret
Function at 0x408b2e
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x44], ax
lea eax, [ebp - 0x42]
push esi
push eax
call fcn.004162b0
push str._Command__schtasks__delete__tn__ExtraDisksMount___f_
lea eax, [ebp - 0x44]
push 0x104
push eax
call fcn.0040b4a0
mov eax, dword [0x44437c]
add esp, 0x18
mov dword [ebp - 0x78], eax
xorps xmm0, xmm0
lea eax, [ebp - 0x44]
movlpd qword [ebp - 0x5c], xmm0
mov dword [ebp - 0x6c], eax
mov eax, dword [0x444380]
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x80]
push eax
movlpd qword [ebp - 0x54], xmm0
movlpd qword [ebp - 0x4c], xmm0
mov dword [ebp - 0x80], 0x3c
mov dword [ebp - 0x7c], 0x440
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x70], str.PowerShell.exe
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x64], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0x48], 0
pop esi
je 0x408be2
push 0xffffffffffffffff
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x1c4]
xor ecx, ebp
call fcn.00415673
add ebp, 0x1c8
leave
ret
Function at 0x408bf7
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x410]
sub esp, 0x490
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp + 0x40c], eax
push esi
push edi
xor eax, eax
movzx esi, cx
push 0x206
mov word [ebp + 0x204], ax
xor edi, edi
lea eax, [ebp + 0x206]
push edi
push eax
call fcn.004162b0
add esp, 0xc
lea eax, [ebp + 0x204]
push 0x443950
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.TempRun_NonElevated.cmd
lea eax, [ebp + 0x204]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push str.w__ccsUTF_8
lea eax, [ebp + 0x204]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00419312
add esp, 0xc
test eax, eax
jne 0x408db0
cmp dword [ebp - 8], edi
je 0x408ca6
push str.chcp_65001_n
push dword [ebp - 8]
call fcn.0040b400
push esi
push str.chcp_65001_nsubst__C:__D_n
push dword [ebp - 8]
call fcn.0040b400
push dword [ebp - 8]
call fcn.004193d0
add esp, 0x18
mov eax, dword [0x44437c]
xorps xmm0, xmm0
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x204]
mov dword [ebp - 0x30], eax
mov eax, dword [0x444380]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
movlpd qword [ebp - 0x20], xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x10], xmm0
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x34], str.Explorer
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0xc], edi
je 0x408d12
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x204
lea eax, [ebp]
mov dword [ebp - 4], 0x30
push edi
push eax
call fcn.004162b0
push esi
push str._C:__D
lea eax, [ebp - 4]
push 0x104
push eax
call fcn.0040b4a0
push 0x3c
lea eax, [ebp - 0x80]
push edi
push eax
call fcn.004162b0
mov eax, dword [0x44437c]
lea esi, [ebp - 0x80]
add esp, 0x28
lea edi, [ebp - 0x44]
push 0xf
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x3c], eax
xor ecx, ecx
lea eax, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x30], eax
mov eax, dword [0x444380]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x40], 0x440
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x34], str.Subst
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp dword [ebp - 0xc], 0
je 0x408db0
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 0x40c]
pop edi
xor ecx, ebp
pop esi
call fcn.00415673
add ebp, 0x410
leave
ret
Function at 0x4096bb
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x468
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x464], eax
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, ecx
push edi
xor edi, edi
push edi
push edi
push 0x1009
push ebx
call ebp
push 0x204
lea eax, [esp + 0x270]
mov dword [esp + 0x26c], 0x30
push edi
push eax
call fcn.004162b0
add esp, 0xc
mov dword [esp + 0xc], edi
lea eax, [esp + 0x60]
push 0x444170
push 0x104
push eax
push edi
lea eax, [esp + 0x278]
push eax
push str.ENC_DISK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4098d9
push esi
push edi
push edi
push 0x1004
push ebx
call ebp
mov dword [0x43cf7c], edi
mov esi, str.__C:_
lea edi, [esp + 0x50]
mov dword [0x43cf64], eax
mov ax, word [esp + 0x64]
push 0x43cf60
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor edi, edi
mov word [esp + 0x58], ax
push edi
push 0x104d
lea eax, [esp + 0x5c]
mov dword [esp + 0x68], edi
push ebx
mov dword [esp + 0x70], edi
mov dword [0x43cf74], eax
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x64]
push 0x444170
push 0x104
push eax
push edi
lea eax, [esp + 0x27c]
push eax
push str.ENC_LABEL
call esi
lea eax, [esp + 0x64]
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push dword [0x43cf64]
push 0x1074
push ebx
call ebp
push 0x444170
push 0x104
lea eax, [esp + 0x6c]
push eax
push edi
lea eax, [esp + 0x27c]
push eax
push str.ENC_SIZE
call esi
lea eax, [esp + 0x64]
mov dword [esp + 0x1c], 2
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push dword [0x43cf64]
push 0x1074
push ebx
call ebp
push 0x444170
push 0x104
lea eax, [esp + 0x6c]
push eax
push edi
lea eax, [esp + 0x27c]
push eax
push str.ENC_PATH
call esi
lea eax, [esp + 0x64]
mov dword [esp + 0x1c], 3
mov dword [esp + 0x28], eax
lea eax, [esp + 0x14]
push eax
push dword [0x43cf64]
push 0x1074
push ebx
call ebp
push 0x444170
push 1
lea eax, [esp + 0x274]
push eax
push str.ENC_CHECK
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
je 0x409890
lea eax, [esp + 0x14]
mov dword [esp + 0x24], 0xf000
push eax
push dword [0x43cf64]
mov dword [esp + 0x28], 0x2000
push 0x102b
push ebx
call ebp
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x26c]
push 0xa
push 0x104
inc eax
push ecx
push eax
mov dword [esp + 0x20], eax
call fcn.0041a581
add esp, 0x10
lea eax, [esp + 0x64]
push 0x444170
push 0x104
push eax
push edi
lea eax, [esp + 0x27c]
push eax
push str.ENC_DISK
call esi
test eax, eax
jne 0x409737
pop esi
push 0x414e42
push 1
push 0x1051
push ebx
mov dword [0x4449d8], edi
mov dword [0x4449d4], ebx
call ebp
mov ecx, dword [esp + 0x470]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415673
add esp, 0x468
ret
Function at 0x40b4ed
Capabilities:
Create thread
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x43b004]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push esi
push eax
call fcn.004162b0
add esp, 0xc
lea eax, [ebp - 0x7c]
push 0x443950
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push str.Updates.ini
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [ebp - 0x7c]
push eax
push esi
push str.AppVersion
push str.WINTOOLS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x5a3d
jle 0x40b578
cmp dword [0x43cfa4], esi
jne 0x40b578
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x40b4bb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.00415673
add ebp, 0x190
leave
ret
Function at 0x40b58e
Capabilities:
Create thread
Delete file
Download url
Read .ini file
Receive data

Disassembly:
sub esp, 0x620
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x257
push dword [0x44437c]
call edi
mov ecx, eax
call fcn.0040bdcf
mov ebx, 0x252
push ebx
push dword [0x44437c]
call edi
mov ecx, eax
call fcn.0040bdcf
xor ebp, ebp
push ebp
push ebx
push dword [0x44437c]
mov dword [0x43cfa4], ebp
call edi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
xor eax, eax
push 0x206
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push ebp
push eax
call fcn.004162b0
add esp, 0xc
lea eax, [esp + 0x14]
mov esi, str.http:__www.extradisks.com_extradisks.ini
push ebp
push 0x10
push 0x104
push eax
push esi
push ebp
call dword [sym.imp.urlmon.dll_URLDownloadToCacheFileW]
mov ebp, dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x14]
push 0x443950
push eax
call ebp
push str.Updates.ini
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x10
lea eax, [esp + 0x1c]
push eax
push esi
xor esi, esi
push esi
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
jne 0x40b6f4
lea eax, [esp + 0x14]
push eax
push esi
push str.AppVersion
push str.WINTOOLS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, 0x5a3d
jle 0x40b6c8
push esi
push 0x40b75e
push dword [0x44437c]
push str.IDD_UPDATEBOX
push dword [0x444380]
call dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp dword [0x43cfa4], esi
jne 0x40b733
lea eax, [esp + 0x10]
push eax
push esi
push esi
push 0x40b4bb
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x40b733
mov esi, 0x435f1c
mov edx, 0x435f54
mov ecx, esi
call fcn.00414a37
push eax
lea eax, [esp + 0x220]
push eax
call ebp
push 0x40
lea eax, [esp + 0x220]
mov edx, 0x435f34
jmp 0x40b71e
mov esi, 0x435f1c
mov edx, 0x435f64
mov ecx, esi
call fcn.00414a37
push eax
lea eax, [esp + 0x428]
push eax
call ebp
push 0x10
lea eax, [esp + 0x428]
mov edx, 0x4362d4
push eax
mov ecx, esi
call fcn.00414a37
push eax
push dword [0x44437c]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 1
push 0x252
push dword [0x44437c]
call edi
push eax
call ebx
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415673
add esp, 0x620
ret

Function at 0x40e124
Capabilities:
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
or esi, 0xffffffff
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, eax
jmp 0x40e14c
movzx eax, word [edi]
dec ecx
xor eax, esi
lea edi, [edi + 2]
movzx eax, al
shr esi, 8
xor esi, dword [eax*4 + 0x436958]
test ecx, ecx
jg 0x40e136
not esi
pop edi
mov eax, esi
pop esi
ret
Function at 0x40f610
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x14
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
mov dword [esp + 0x14], edx
push eax
mov esi, ecx
mov dword [esp + 0x1c], 8
mov dword [esp + 0x20], 0x42ff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov dword [0x444380], esi
call fcn.004102bc
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push 0x444388
push 0xc8
push str.Edition
push str.OPTIONS
call ebp
push 2
push 0x32
mov dword [0x43b8c0], eax
call fcn.0041ff54
pop ecx
pop ecx
mov dword [0x444940], eax
call fcn.004138a5
call fcn.004139da
xor edi, edi
xor ebx, ebx
inc edi
test eax, eax
jne 0x40f6c0
push ebx
push 0x413c9f
push dword [0x44437c]
push str.NAGSCREEN
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamW]
test eax, eax
je 0x40f6c0
mov dword [0x44493c], edi
mov dword [0x444938], edi
mov dword [0x444934], edi
push ebx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xca0000
push 0x444868
push 0x4447a0
push ebx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov edi, eax
test edi, edi
je 0x40f883
mov edx, esi
mov dword [0x44437c], edi
call fcn.004137c4
mov ebx, eax
mov edx, 0x435920
mov ecx, 0x435f1c
mov dword [esp + 0x10], ebx
call fcn.00414a37
push eax
push 0
push 0xc
push ebx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x43b8c0]
push 0x64
pop esi
sub eax, esi
je 0x40f757
sub eax, esi
je 0x40f731
sub eax, esi
jne 0x40f767
push str.Premium
jmp 0x40f75c
push str.Professional
push 0x444868
call dword [sym.imp.SHLWAPI.dll_StrCatW]
mov dword [0x43b8c8], 0x3ea
mov dword [0x43b8c4], 0x294
jmp 0x40f767
push str.Home
push 0x444868
call dword [sym.imp.SHLWAPI.dll_StrCatW]
push 0x444868
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0x444388
push 5
push str.Transparent
push str.OPTIONS
call ebp
sub esi, eax
mov ecx, edi
mov edx, esi
call fcn.004148a8
push 1
push 0
push edi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ebx, dword [sym.imp.USER32.dll_UpdateWindow]
push edi
call ebx
call fcn.004152a5
call fcn.00410443
call fcn.004139da
test eax, eax
je 0x40f7eb
mov esi, dword [sym.imp.USER32.dll_EnableMenuItem]
push 1
push 0x2733
push dword [0x44479c]
call esi
push 1
push 0x273f
push dword [0x44479c]
call esi
push 1
push 0x2744
push dword [0x44479c]
call esi
push ecx
mov edx, 0x437344
mov ecx, 0x4355f8
call fcn.00414a37
mov edx, eax
call fcn.00410108
pop ecx
call fcn.004101b9
mov edx, 0x435edc
mov ecx, 0x435f1c
call fcn.00414a37
mov esi, dword [esp + 0x10]
push eax
push 0
push 0xc
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
call fcn.00401000
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
call fcn.00415130
push 0x444388
push 0
push str.Magnet
push str.OPTIONS
call ebp
cmp dword [0x43b8c0], 0xc8
mov dword [0x444384], eax
jne 0x40f861
call fcn.00410daf
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [0x443740]
call esi
push dword [esp + 0x14]
push edi
call esi
push edi
call ebx
call fcn.0040b4ed
xor eax, eax
inc eax
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00415673
add esp, 0x14
ret
Function at 0x4102bc
Capabilities:
Check if file exists
Create directory
Get common file path
Read .ini file

Disassembly:
sub esp, 0x214
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
push 0x104
mov ebp, 0x443950
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0
push ebp
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
sub eax, ebp
and eax, 0xfffffffe
cmp eax, 0x208
jae 0x41043d
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
xor ecx, ecx
push edi
push ebp
mov edi, 0x444388
mov word [eax + 0x443950], cx
push edi
call esi
push str.extrasubst.ini
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCatW]
call edi
push ebp
mov ebx, 0x444170
push ebx
call esi
push str.extradisks.ini
push ebx
call edi
push ebp
mov ebx, 0x443d60
push ebx
call esi
push str._tempdiskpart.txt
push ebx
call edi
push ebp
mov ebx, 0x443b58
push ebx
call esi
push str._temppowershell.ps1
push ebx
call edi
push ebp
mov ebx, 0x444590
push ebx
call esi
push str.langdefault.lng
push ebx
call edi
push ebp
mov ebp, 0x443f68
push ebp
call esi
push str.help_
push ebp
call edi
push ebx
push 0x104
lea eax, [esp + 0x20]
xor esi, esi
push eax
push esi
push 0x435658
push str.LANGUAGE
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x18]
push eax
push ebp
call edi
lea eax, [esp + 0x14]
push eax
push 0x23
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x410424
mov ebx, 0x444170
push ebx
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
cmp eax, 1
jne 0x410424
push 0x4374c8
push ebx
call edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push str.extradisks.ini
push ebx
call edi
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x410424
push str.w__ccsUTF_16LE
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.00419312
add esp, 0xc
test eax, eax
jne 0x410424
cmp dword [esp + 0x10], esi
je 0x410424
push str._OPTIONS__n
push dword [esp + 0x14]
call fcn.0040b400
push dword [esp + 0x18]
call fcn.004193d0
add esp, 0xc
mov ecx, dword [esp + 0x220]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.00415673
add esp, 0x214
ret
call fcn.004157a3
int3
Function at 0x4138a5
Capabilities:
Get disk information
Read .ini file

Disassembly:
sub esp, 0x628
mov eax, dword [0x43b004]
xor eax, esp
mov dword [esp + 0x624], eax
push ebx
push edi
mov edi, 0x444388
xor ebx, ebx
push edi
push ebx
push 0x437574
push str.OPTIONS
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
test eax, eax
jne 0x4139c3
push ebp
push esi
mov esi, 0x206
mov word [esp + 0x1c], ax
push esi
lea eax, [esp + 0x22]
push ebx
push eax
call fcn.004162b0
xor eax, eax
push esi
mov word [esp + 0x234], ax
lea eax, [esp + 0x236]
push ebx
push eax
call fcn.004162b0
xor eax, eax
push esi
mov word [esp + 0x448], ax
lea eax, [esp + 0x44a]
push ebx
push eax
call fcn.004162b0
add esp, 0x24
lea eax, [esp + 0x14]
mov esi, 0x104
push ebx
push ebx
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x20]
push eax
push esi
lea eax, [esp + 0x444]
push eax
push 0x436eac
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [esp + 0x10]
lea eax, [esp + 0x20]
push 0x43757c
push esi
push eax
call fcn.0040b4a0
add esp, 0x10
lea eax, [esp + 0x224]
mov ebx, str.Data
mov ebp, str.SYSFILES
push edi
push esi
push eax
mov esi, 0x4355cc
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x224]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x4139c1
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
push 0x4375a4
push 0x4375a8
call esi
push edi
lea eax, [esp + 0x20]
push eax
push ebx
push ebp
call esi
pop esi
pop ebp
mov ecx, dword [esp + 0x62c]
pop edi
pop ebx
xor ecx, esp
call fcn.00415673
add esp, 0x628
ret