joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406a60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4ee490
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [esp + 0x48]
push ebx
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x1c]
xor esi, esi
push eax
push ecx
mov word [esp + 0x24], si
call ebx
cmp eax, esi
jge 0x406aa5
mov word [esp + 0x1c], 0xa
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0x50]
lea eax, [esp + 0x2c]
push edx
push eax
mov dword [esp + 0x4c], esi
mov word [esp + 0x34], si
call ebx
cmp eax, esi
jge 0x406ac9
mov word [esp + 0x2c], 0xa
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x1c]
mov eax, dword [edi]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x58]
push esi
push esi
push ecx
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x5c]
push 1
push 0x400
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], esi
mov edx, dword [eax]
push 0x4fc6bc
push ecx
push eax
mov byte [esp + 0x68], 1
call dword [edx + 0x18]
mov edi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea edx, [esp + 0x2c]
push edx
mov esi, eax
call edi
lea eax, [esp + 0x1c]
push eax
call edi
mov ecx, dword [esp + 0x3c]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 0x10
Function at 0x414b50
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x10]
mov eax, dword [esi + 0xc60]
test eax, eax
je 0x414c01
mov eax, dword [eax]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x414c01
test edi, edi
jne 0x414be4
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], edi
push ecx
mov ecx, dword [esi + 0xc60]
push 0x4fc71c
call fcn.00426f30
test eax, eax
jl 0x414bb8
mov eax, dword [esp + 0x10]
test eax, eax
je 0x414bb8
mov edx, dword [eax]
push eax
call dword [edx + 0x38]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x414bb8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [esp + 0x10], edi
mov edx, dword [esi + 0xc60]
push 0
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [esi + 0xc60]
mov ecx, dword [edi]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
test eax, eax
je 0x414c05
mov dword [edi], 0
jmp 0x414c05
cmp edi, 1
jne 0x414c01
mov edx, dword [esi + 0xc60]
push 5
mov eax, dword [edx]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, edi
pop edi
pop esi
ret 0x10
test edi, edi
jne 0x414c2c
mov eax, dword [esi + 0xc60]
test eax, eax
je 0x414c4e
push eax
call fcn.004de3a6
add esp, 4
mov dword [esi + 0xc60], 0
mov eax, 1
pop edi
pop esi
ret 0x10
cmp edi, 2
jne 0x414c4e
mov ecx, esi
call fcn.004135e0
test eax, eax
je 0x414c4e
mov ecx, dword [esi + 4]
push 0
push edi
push 0x57e
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x41ef90
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc38], 2
je 0x41f089
test byte [esp + 0xc], 8
je 0x41f000
cmp dword [esi + 0xe4], 1
je 0x41efd0
mov eax, dword [esi + 4]
push 0
push 0x519
push 0x111
push eax
mov dword [esi + 0xe4], 0
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esi + 0xcec]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x20]
lea ecx, [esi + 0x20]
push 0
push 0
push 0
push 0
mov dword [esi + 0xd08], 0
call dword [edx + 0x64]
xor eax, eax
pop esi
ret 0x10
mov eax, dword [0x5258dc]
test eax, eax
je 0x41f06d
mov eax, dword [esi + 0xb8]
cmp eax, 0x31
je 0x41f02d
cmp eax, 0x10
je 0x41f02d
cmp eax, 0x51
je 0x41f02d
cmp eax, 0x52
je 0x41f02d
cmp eax, 0x53
je 0x41f02d
cmp eax, 0x54
jne 0x41f06d
mov eax, dword [esi + 0xbc]
cmp eax, 2
jne 0x41f043
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
call dword [eax + 4]
jmp 0x41f051
cmp eax, 3
jne 0x41f051
mov edx, dword [esi + 0x20]
lea ecx, [esi + 0x20]
call dword [edx + 8]
mov ecx, dword [esi + 0x198]
test ecx, ecx
je 0x41f06d
mov edx, dword [esi + 0xbc]
mov eax, dword [ecx]
push 0
push edx
push 0x521
call dword [eax]
mov ecx, dword [esi + 0x198]
test ecx, ecx
je 0x41f089
mov edx, dword [esi + 0xd0]
mov eax, dword [ecx]
push 0
push edx
push 0x579
call dword [eax]
xor eax, eax
pop esi
ret 0x10

Function at 0x41fc50
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 4]
mov dword [esi + 0xc20], 1
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [esp + 0xc]
mov ecx, dword [0x5258dc]
shr eax, 3
and eax, 1
test ecx, ecx
je 0x41fcc8
test eax, eax
jne 0x41fccc
mov eax, dword [esi + 0xbc]
cmp eax, 2
jne 0x41fc95
mov edx, dword [esi + 0x20]
lea ecx, [esi + 0x20]
call dword [edx + 4]
jmp 0x41fca3
cmp eax, 3
jne 0x41fca3
mov eax, dword [esi + 0x20]
lea ecx, [esi + 0x20]
call dword [eax + 8]
mov ecx, dword [esi + 0x198]
test ecx, ecx
je 0x41fcbf
mov eax, dword [esi + 0xbc]
mov edx, dword [ecx]
push 0
push eax
push 0x521
call dword [edx]
mov eax, 1
pop esi
ret 0x10
test eax, eax
je 0x41fcbf
mov eax, dword [esi + 0xbc]
cmp eax, 3
je 0x41fcdc
cmp eax, 2
jne 0x41fcbf
mov eax, dword [esi + 0xb8]
cmp eax, 0x31
je 0x41fcf6
cmp eax, 0x10
je 0x41fcf6
cmp eax, 0x51
je 0x41fcf6
cmp eax, 0x52
jne 0x41fcbf
cmp dword [esi + 0xb4], 1
jne 0x41fcbf
mov eax, dword [esi + 0xd08]
test eax, eax
jne 0x41fcbf
mov ecx, dword [esi + 0xcec]
push edi
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0xcec]
push 3
push 0
push 0
push 0
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
lea edi, [esi + 0xd0c]
mov dword [esi + 0xd08], 1
push edi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esi + 4]
push edi
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ecx, dword [esi + 0xd14]
push ecx
call dword [sym.imp.USER32.dll_SetCursor]
pop edi
mov eax, 1
pop esi
ret 0x10
Function at 0x421600
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x19c]
test ecx, ecx
je 0x421632
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
push edx
call fcn.00495de0
push esi
push 0
push fcn.00418a50
call fcn.004df750
add esp, 0xc
xor eax, eax
pop esi
ret 8
mov eax, 1
pop esi
ret 8
Function at 0x42fb80
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [esp + 0x18]
test esi, esi
jle 0x42fbc4
mov ebx, dword [esp + 0x14]
mov ebp, dword [sym.imp.WS2_32.dll_send]
push 0
push esi
push edi
push ebx
call ebp
cmp eax, 0xffffffff
je 0x42fbb4
test eax, eax
jle 0x42fbba
sub esi, eax
add edi, eax
test esi, esi
jle 0x42fbc4
jmp 0x42fb9a
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
Function at 0x42fbd0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ecx
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x14]
push 0
push esi
push edi
push eax
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x42fbf7
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret 0x10
lea ecx, [eax + edi]
sub esi, eax
mov eax, ecx
mov dword [esp + 0x18], ecx
sub eax, edi
mov dword [esp + 8], esi
test eax, eax
jg 0x42fc15
pop edi
or eax, 0xffffffff
pop esi
pop ecx
ret 0x10
push str.Content_Length:
push edi
mov byte [eax + edi], 0
call fcn.004df6d0
push str.200_OK_r_n
push edi
mov esi, eax
call fcn.004df6d0
add esp, 0x10
test eax, eax
je 0x42fd6e
test esi, esi
je 0x42fd6e
mov edi, str.Content_Length:
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ebp
add esi, ecx
push 0x510bac
push esi
call fcn.004df6d0
mov ecx, 1
mov ebx, eax
sub ecx, esi
add ebx, ecx
push ebx
call fcn.004de48f
mov ecx, ebx
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
push ebp
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
lea ecx, [ebx - 1]
mov edi, ebp
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004dfbc5
add esp, 0x10
mov edi, eax
test ebp, ebp
je 0x42fcb4
push ebp
call fcn.004de3a6
add esp, 4
mov ebp, dword [esp + 0x1c]
push str._r_n_r_n
push ebp
call fcn.004df6d0
mov ecx, dword [esp + 0x2c]
mov esi, eax
mov eax, dword [esp + 0x28]
add esi, 4
sub eax, esi
push 0x50ddc4
mov ebx, eax
push ecx
sub edi, ebx
mov dword [esp + 0x2c], edi
call fcn.004deb38
mov edi, eax
add esp, 0x10
test edi, edi
je 0x42fcff
test ebx, ebx
jle 0x42fcff
push edi
push ebx
push 1
push esi
call fcn.004df481
add esp, 0x10
mov ebx, dword [esp + 0x1c]
test ebx, ebx
jle 0x42fd57
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x42fd57
mov edx, dword [esp + 0x18]
push 0
push eax
push ebp
push edx
call dword [sym.imp.WS2_32.dll_recv]
mov esi, eax
test esi, esi
je 0x42fd57
jge 0x42fd40
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x42fd40
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x42fd53
test edi, edi
je 0x42fd51
push edi
push esi
push 1
push ebp
call fcn.004df481
add esp, 0x10
sub ebx, esi
test ebx, ebx
jg 0x42fd07
pop ebp
pop ebx
test edi, edi
je 0x42fd66
push edi
call fcn.004dea4e
add esp, 4
pop edi
xor eax, eax
pop esi
pop ecx
ret 0x10
push str.404_Not_Found_r_n
push edi
call fcn.004df6d0
add esp, 8
test eax, eax
je 0x42fd8b
pop edi
mov eax, 0xfffffffe
pop esi
pop ecx
ret 0x10
push str.304_Not_Modified_r_n
push edi
call fcn.004df6d0
add esp, 8
neg eax
sbb eax, eax
pop edi
add eax, 0xfffffffd
pop esi
pop ecx
ret 0x10
Function at 0x430690
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
dec eax
push 0
push eax
push esi
push ecx
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x4306b4
or eax, 0xffffffff
pop esi
ret 0xc
mov byte [eax + esi], 0
xor eax, eax
pop esi
ret 0xc
Function at 0x430a60
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 0
mov dword [esp + 0x18], 0
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
je 0x430aad
mov edi, str.00_00_00_00_00_00
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
or eax, 0xffffffff
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [esp + 0x10]
mov ebx, eax
push ecx
push ebx
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
je 0x430b0e
mov edi, str.00_00_00_00_00_00
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
test ebx, ebx
jne 0x430b4c
mov edi, str.00_00_00_00_00_00
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x20]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret 4
xor ecx, ecx
xor edx, edx
mov cl, byte [ebx + 0x199]
mov dl, byte [ebx + 0x198]
xor eax, eax
push ecx
mov al, byte [ebx + 0x197]
push edx
xor ecx, ecx
push eax
mov cl, byte [ebx + 0x196]
xor edx, edx
mov dl, byte [ebx + 0x195]
xor eax, eax
mov al, byte [ebx + 0x194]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push eax
push str._02X__02X__02X__02X__02X__02X
push ecx
call fcn.004df42f
add esp, 0x20
push ebx
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret 4

Function at 0x431700
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0x5209fc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
ret 0x10

Function at 0x431730
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [ecx + 4]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
ret 0xc
Function at 0x432760
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, dword [0x524ee4]
sub esp, 0x458
test eax, eax
push ebp
push edi
je 0x432780
mov al, byte [esp + 0x468]
test al, al
je 0x43286d
push 0x208
mov dword [0x524ee4], 1
call fcn.004de48f
mov ebp, eax
mov ecx, 0x82
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x468]
push eax
push str._s.dll
push ebp
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 8]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4327e5
test ebp, ebp
je 0x43286d
push ebp
call fcn.004de3a6
add esp, 4
pop edi
pop ebp
add esp, 0x458
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push esi
test byte [esp + 0x10], 0x10
jne 0x43284b
lea edx, [esp + 0x260]
push 0
push edx
push 0
lea eax, [esp + 0x48]
push 0
push eax
call fcn.004e00fc
mov esi, 0x511358
add esp, 0x14
mov ecx, esi
test ecx, ecx
je 0x43284b
cmp word [0x511358], 0
je 0x43284b
mov eax, dword [esi + 0xc]
lea edx, [esp + 0x260]
push edx
push eax
call fcn.004dfe9e
add esp, 8
test eax, eax
je 0x432847
add esi, 0x1c
cmp word [esi], 0
jne 0x432824
jmp 0x43284b
mov byte [esi + 8], 1
lea ecx, [esp + 0x10]
push ecx
push edi
call ebx
test eax, eax
jne 0x4327ed
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
test ebp, ebp
je 0x43286d
push ebp
call fcn.004de3a6
add esp, 4
pop edi
pop ebp
add esp, 0x458
ret
Function at 0x438a68
Capabilities:
Capture screenshot

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f0bb8
push eax
mov dword fs:[0], esp
sub esp, 0x18
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0xb0], edi
je 0x438a8b
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
mov eax, dword [esi + 4]
push ebx
push ebp
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x68]
push eax
push ecx
push ebx
mov dword [esp + 0x3c], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ecx, dword [esi + 0x68]
mov edx, dword [esi + 0x6c]
mov ebp, eax
push ebx
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], edx
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
push ebp
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [esp + 0x10], eax
mov eax, dword [esi + 0x64]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
mov ebp, eax
lea ecx, [esp + 0x18]
push ebp
push ecx
push edi
call dword [sym.imp.USER32.dll_FillRect]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
mov ecx, dword [esi + 0x5c]
test ecx, ecx
je 0x438b16
push 0
call fcn.004d72c0
mov ecx, dword [esi + 0x5c]
push edi
mov edx, dword [ecx]
call dword [edx + 4]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x68]
push 0xcc0020
push 0
push 0
push edi
push eax
push ecx
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push edi
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esi + 4]
push ebx
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov ecx, dword [esp + 0x44]
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [ecx], 1
je 0x438b66
push eax
call ebp
mov ecx, dword [esp + 0x28]
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10
Function at 0x44d030
Capabilities:
Get geographical location

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov esi, ecx
push ebx
call dword [sym.imp.USER32.dll_GetMenuItemCount]
mov ebp, eax
mov eax, dword [esp + 0x28]
xor edi, edi
mov dword [esp + 0x14], ebp
cmp eax, edi
je 0x44d196
push ebx
mov ecx, esi
call fcn.00448410
cmp dword [esp + 0x20], 0x2bd
jne 0x44d0e2
push 0x14
call fcn.004de48f
add esp, 4
cmp eax, edi
je 0x44d088
or ebp, 0xffffffff
mov dword [eax + 0xc], edi
mov dword [eax + 4], ebp
mov dword [eax], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0x10], edi
jmp 0x44d08d
xor eax, eax
or ebp, 0xffffffff
mov esi, dword [sym.imp.USER32.dll_AppendMenuW]
push eax
push 0x2bd
push 0x100
push ebx
mov dword [eax], 0x2bd
mov dword [eax + 4], 0x20d
call esi
push 0x14
call fcn.004de48f
add esp, 4
cmp eax, edi
je 0x44d0cc
mov dword [eax + 4], ebp
mov dword [eax], ebp
mov dword [eax + 8], ebp
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
jmp 0x44d0ce
xor eax, eax
push eax
push edi
push 0x900
push ebx
mov dword [eax], edi
call esi
mov dword [esp + 0x20], 0x2be
mov eax, dword [esp + 0x18]
mov dword [esp + 0x14], edi
cmp eax, edi
jle 0x44d21a
mov eax, dword [esp + 0x1c]
mov edi, dword [eax]
test edi, edi
je 0x44d16f
push 0x208
call fcn.004de48f
add esp, 4
mov esi, eax
mov ebp, 0x100
push 0x104
push esi
push 2
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x44d16f
push 0x14
call fcn.004de48f
xor edx, edx
add esp, 4
cmp eax, edx
je 0x44d146
or ecx, 0xffffffff
mov dword [eax + 0xc], edx
mov dword [eax + 4], ecx
mov dword [eax], ecx
mov dword [eax + 8], ecx
mov dword [eax + 0x10], edx
jmp 0x44d148
xor eax, eax
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x20]
mov dword [eax + 0xc], esi
mov esi, dword [esp + 0x24]
add ecx, edx
dec esi
cmp edx, esi
mov dword [eax], ecx
jne 0x44d165
mov ebp, 0x108
push eax
push ecx
push ebp
push ebx
call dword [sym.imp.USER32.dll_AppendMenuW]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edx
jl 0x44d0f2
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp dword [esp + 0x20], 0x2bd
jne 0x44d1f3
mov ebp, dword [esp + 0x24]
mov edx, ebp
inc edx
neg edx
sbb edx, edx
and edx, 0xfffffff8
add edx, 0x408
push edx
push edi
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
push ebx
call edi
mov eax, dword [esp + 0x14]
mov esi, 2
cmp eax, esi
jle 0x44d21a
add ebp, 2
cmp ebp, esi
jne 0x44d1da
push 0x408
jmp 0x44d1df
push 0x400
push esi
push ebx
call edi
mov eax, dword [esp + 0x14]
inc esi
cmp esi, eax
jl 0x44d1cf
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
xor esi, esi
cmp ebp, edi
jle 0x44d21a
mov edi, dword [sym.imp.USER32.dll_CheckMenuItem]
cmp dword [esp + 0x24], esi
jne 0x44d20c
push 0x408
jmp 0x44d211
push 0x400
push esi
push ebx
call edi
inc esi
cmp esi, ebp
jl 0x44d1ff
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
Function at 0x456cf0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xdd0]
test eax, eax
jne 0x456d23
mov eax, dword [esi + 4]
push esi
push 0x456d30
push eax
push 0xad
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [esi + 0xdd0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x458380
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f1acb
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
push esi
mov esi, ecx
push edi
mov dword [0x525120], esi
mov dword [0x525124], eax
mov edi, dword [esi + 0x7a8]
test edi, edi
mov dword [esi + 0xdc4], 0
je 0x4583d6
mov ecx, edi
call fcn.0048f850
push edi
call fcn.004de3a6
add esp, 4
mov dword [esi + 0x7a8], 0
push 0x20
call fcn.004de48f
add esp, 4
mov dword [esp + 0x18], eax
test eax, eax
mov dword [esp + 0x10], 0
je 0x4583f9
mov ecx, eax
call fcn.0048f830
jmp 0x4583fb
xor eax, eax
push 0x525120
push 0
push 0x458440
mov dword [esi + 0x7a8], eax
call fcn.004df750
mov ecx, dword [esi + 0xdcc]
add esp, 0xc
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
pop esi
add esp, 0xc
ret 4

Function at 0x458860
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov eax, dword [esp + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
jne 0x458884
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop ebx
ret
push ebp
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalSize]
mov ecx, dword [esp + 0x18]
cmp eax, ecx
jb 0x4588a2
lea eax, [ecx - 1]
mov esi, dword [esp + 0x14]
xor ebp, ebp
test eax, eax
jbe 0x4588bf
mov edx, edi
mov ecx, esi
sub edx, esi
mov edi, eax
mov ebp, eax
mov al, byte [edx + ecx]
mov byte [ecx], al
inc ecx
dec edi
jne 0x4588b6
push ebx
mov byte [esi + ebp], 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x467bc0
Capabilities:
Get common file path
Get disk size

Disassembly:
sub esp, 0x228
push ebx
push ebp
mov ebp, dword [esp + 0x234]
push esi
test ebp, ebp
push edi
je 0x467d55
mov eax, dword [esp + 0x240]
test eax, eax
je 0x467d55
mov ecx, ebp
xor eax, eax
mov dword [esp + 0x12], eax
push 0x104
mov dx, word [ecx]
mov word [esp + 0x1a], ax
mov word [esp + 0x14], dx
mov al, byte [ecx + 2]
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x1a], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0x43
mov dx, word [esp + 0x10]
cmp word [esp + 0x30], dx
je 0x467c50
mov eax, dword [esp + 0x10]
and eax, 0xffff
push eax
call fcn.004e0584
mov ecx, dword [esp + 0x34]
add esp, 4
and ecx, 0xffff
mov esi, 0x20000000
cmp ecx, eax
jne 0x467c55
mov esi, SysReAllocStringLen
lea edx, [esp + 0x18]
lea eax, [esp + 0x20]
push edx
lea ecx, [esp + 0x2c]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x467c8c
mov ecx, dword [esp + 0x1c]
xor eax, eax
cmp ecx, eax
ja 0x467cb9
jb 0x467c85
cmp dword [esp + 0x18], esi
ja 0x467cb9
inc word [esp + 0x10]
jmp 0x467caa
cmp word [esp + 0x10], bx
je 0x467d55
call edi
cmp eax, 0x15
jne 0x467ca5
inc word [esp + 0x10]
jmp 0x467caa
mov word [esp + 0x10], bx
mov ax, word [esp + 0x10]
cmp ax, word [ebp]
jne 0x467c1f
mov ax, word [ebp]
mov dx, word [esp + 0x10]
cmp dx, ax
jne 0x467ced
mov edi, dword [esp + 0x1c]
xor ecx, ecx
cmp edi, ecx
ja 0x467ce8
jb 0x467cd9
cmp dword [esp + 0x18], esi
ja 0x467ce8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x228
ret 8
cmp dx, ax
je 0x467d32
mov esi, dword [esp + 0x10]
and eax, 0xffff
push eax
and esi, 0xffff
call fcn.004e0584
add esp, 4
cmp esi, eax
je 0x467d32
mov ecx, dword [esp + 0x240]
push esi
push str._C:Media_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x228
ret 8
mov edx, dword [esp + 0x240]
push ebp
push edx
call fcn.004df3e0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x228
ret 8
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x228
ret 8