joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469588
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 2], 1
mov byte [ebp - 1], bl
call fcn.004812aa
test eax, eax
jge 0x4695b1
call fcn.004812d7
jmp 0x4696dc
push esi
lea eax, [ebp - 8]
push eax
push 0x54d2d0
push 1
push ebx
mov esi, 0x54d2c0
push esi
call dword [0x88d058]
test eax, eax
jl 0x4695d3
cmp dword [ebp - 8], ebx
jne 0x4695fa
lea eax, [ebp - 8]
push eax
push 0x54d2b0
push 1
push ebx
push esi
mov byte [ebp - 2], bl
call dword [0x88d058]
test eax, eax
jl 0x4696d6
cmp dword [ebp - 8], ebx
je 0x4696d6
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x51e730
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov eax, dword [eax]
call dword [eax]
test eax, eax
jl 0x4696b1
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x4696b1
mov ecx, dword [ebp + 0xc]
mov esi, dword [eax]
push ebx
call fcn.0049e627
push eax
push dword [ebp - 0xc]
call dword [esi + 0x14]
mov esi, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x4696b1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 4
cmp byte [ebp - 2], bl
je 0x469673
lea edx, [ebp - 0x568]
push edx
push 0x104
lea edx, [ebp - 0x318]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x4696ae
lea eax, [ebp - 0x318]
jmp 0x46969b
lea edx, [ebp - 0x250]
push edx
push 0x104
lea edx, [ebp - 0x110]
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x110]
mov esi, eax
call fcn.0049e604
cmp esi, ebx
jl 0x4696ae
push dword [ebp + 8]
push eax
call sub.msvcrt.dll__wcsicmp
pop ecx
pop ecx
mov byte [ebp - 1], 1
test eax, eax
je 0x4696b1
mov byte [ebp - 1], bl
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x4696d6
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push dword [ebp + 0xc]
push 5
push 4
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
call fcn.004812d7
pop esi
pop ebx
leave
ret 8

Function at 0x469784
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x410]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x208]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4697f9
push esi
lea eax, [ebp - 0x208]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
lea eax, [ebp - 0x208]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4697cd
sub eax, edx
sar eax, 1
cmp eax, 0xa
jbe 0x4697f9
lea edx, [ebp - 0x208]
lea ecx, [ebp - 0x410]
call fcn.0049fbbd
test al, al
je 0x4697f9
mov al, 1
jmp 0x4697fb
xor al, al
pop esi
leave
ret
Function at 0x4697fe
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push esi
push edi
mov edi, ecx
push edi
lea eax, [ebp - 8]
push 0x511330
push eax
call fcn.004a1618
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4698cd
lea eax, [ebp - 0x22c]
push eax
push edi
lea eax, [ebp - 4]
push 0x513098
push eax
call fcn.004a1618
add esp, 0x10
test byte [ebp - 0x258], 0x10
jne 0x469871
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov ecx, eax
call fcn.00428b54
jmp 0x4698a8
mov ecx, 0x51132c
lea eax, [ebp - 0x22c]
call fcn.0042a25c
test eax, eax
je 0x4698a8
mov ecx, 0x511324
lea eax, [ebp - 0x22c]
call fcn.0042a25c
test eax, eax
je 0x4698a8
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov ecx, eax
call fcn.004697fe
lea ecx, [ebp - 4]
call fcn.004a0c7d
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x46983e
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 8]
call fcn.004a0c7d
pop edi
pop esi
leave
ret

Function at 0x469932
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0
push 0x26
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x469995
mov eax, esi
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x469948
sub eax, ecx
sar eax, 1
lea ecx, [eax + eax]
lea eax, [ecx + esi]
je 0x46997b
lea edx, [eax - 2]
cmp word [edx], 0x5c
jne 0x46997b
mov eax, edx
xor edx, edx
mov word [eax], dx
jmp 0x46997b
lea edx, [eax - 2]
cmp word [edx], 0x5c
je 0x46997f
mov eax, edx
cmp eax, esi
jne 0x469970
sub ecx, eax
lea ecx, [ecx + esi + 2]
sar ecx, 1
add ecx, ecx
push ecx
push eax
push esi
call sub.msvcrt.dll_memmove
add esp, 0xc
ret
push esi
mov eax, 0x5207ac
call fcn.004c9d65
ret
Function at 0x4699a1
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
push 0
push 0x559fc8
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
je 0x469a48
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, 0x7530
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea eax, [esp + 0x18]
push eax
push ebp
push 1
push 0
push 0
push 0x16
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x469a1b
push dword [esp + 0x10]
push eax
push 1
call edi
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov dword [esp + 0x18], eax
call ebx
test esi, esi
je 0x469a52
cmp dword [esp + 0x14], 0
je 0x469a52
push dword [esp + 0x10]
push 0
push 0x100000
call edi
mov esi, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call ebx
push 0
push 0x559fc8
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
jne 0x4699d0
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push dword [esp + 0x14]
push esi
push 0x5207c8
call fcn.00466ca2
add esp, 0xc
xor al, al
jmp 0x469a4a
Function at 0x46a7e8
Capabilities:
Create process on windows
Delete file
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
call fcn.0047cff8
xor esi, esi
cmp edi, esi
jne 0x46a94e
push 0x520b64
lea ecx, [ebp - 0xc]
call fcn.004a0fd9
mov dword [ebx + 0x10], 0x64
cmp dword [ebp + 8], esi
je 0x46a899
mov eax, dword [ebp + 0xc]
or eax, dword [ebp + 0x10]
je 0x46a899
push esi
lea edi, [ebx + 4]
push 0x80
mov ecx, edi
call fcn.004a0ff9
push 6
pop edx
mov ecx, eax
call fcn.00482361
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x46a887
push esi
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x46a86f
mov eax, dword [ebp - 4]
xor ecx, ecx
cmp eax, dword [ebp + 0xc]
jne 0x46a86f
cmp ecx, dword [ebp + 0x10]
je 0x46a87c
mov ecx, dword [ebp + 8]
mov dl, 1
call fcn.00479b79
mov dword [ebp + 8], esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x46a8b1
mov ecx, dword [ebp + 8]
mov dl, 1
call fcn.00479b79
mov dword [ebp + 8], esi
jmp 0x46a946
lea edi, [ebx + 4]
push esi
mov ecx, edi
call fcn.004a0ff9
lea edx, [ebp + 0xc]
mov ecx, eax
call fcn.004b93d7
mov dword [ebp + 8], eax
cmp dword [ebp + 8], esi
je 0x46a946
mov ecx, dword [0x556c94]
push esi
push 0x520080
call fcn.0040b40a
mov ecx, dword [ebp + 0xc]
cdq
cmp ecx, eax
jne 0x46a946
mov eax, dword [ebp + 0x10]
cmp eax, edx
jne 0x46a946
lea ecx, [ebp - 0x84]
call fcn.00501c46
push dword [ebp + 0xc]
lea ecx, [ebp - 0x84]
push dword [ebp + 8]
call fcn.00502f43
mov ecx, dword [0x556c94]
push esi
push 0x5200a4
mov dword [ebp - 8], eax
call fcn.0040b398
cmp eax, esi
je 0x46a93b
mov ecx, dword [ebp - 8]
push eax
call fcn.004ba452
test al, al
je 0x46a93b
push 1
push esi
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
push eax
mov ecx, edi
call fcn.004a0ff9
push eax
push 0x510edc
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x84]
call fcn.00501c70
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
lea edi, [ebx + 4]
mov ecx, edi
mov dword [ebp - 4], esi
call fcn.004a0ff9
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x46a97e
cmp dword [ebp - 4], 0x14
jge 0x46a985
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc dword [ebp - 4]
mov ecx, edi
call fcn.004a0ff9
push eax
call esi
test eax, eax
je 0x46a963
call fcn.0047cfd9
mov ecx, 0x55a6c4
call fcn.004a0cb3
mov ecx, dword [ebp + 8]
mov dl, 1
call fcn.00479b79
test ebx, ebx
je 0x46a9b0
mov ecx, ebx
call fcn.00467ca4
push ebx
call sub.msvcrt.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x24

Function at 0x46bd8c
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [0x56bb50]
mov eax, 0x80000000
and esi, eax
cmp esi, eax
pop esi
jne 0x46bda2
mov al, 1
ret
jmp fcn.0046b9c8
Function at 0x46bf39
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
mov edi, ecx
call fcn.004c9f38
test al, al
je 0x46bf62
cmp dword [0x56bb50], 0x80000000
mov dword [ebp - 4], fcn.0046b9c8
jb 0x46bf69
mov dword [ebp - 4], fcn.004510a5
push 0x104
push edi
push 0x51eb40
mov edx, 0x51e7f8
mov ecx, 0x80000002
call fcn.0044f8a9
mov ebx, 0xc0000000
test al, al
je 0x46bfaa
mov edx, ebx
mov ecx, edi
call dword [ebp - 4]
test al, al
je 0x46bfaa
push edi
push 0x521590
call fcn.00466ca2
add esp, 8
jmp 0x46c048
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0
push 0x26
push edi
push 0
call esi
test eax, eax
je 0x46bfd1
mov edx, ebx
mov ecx, edi
call dword [ebp - 4]
test al, al
je 0x46bfd1
push edi
push 0x521540
jmp 0x46c02c
push 0
push 0x28
push edi
push 0
call esi
test eax, eax
je 0x46c00e
push edi
push 0x5214d8
call fcn.00466ca2
add esp, 8
lea esi, [ebp - 0x20c]
call fcn.00469932
mov eax, 0x515b7c
mov ecx, edi
call fcn.004068fc
mov eax, esi
mov ecx, edi
call fcn.004068fc
jmp 0x46c034
mov esi, 0x5214b0
mov edx, ebx
mov ecx, esi
call dword [ebp - 4]
test al, al
je 0x46c042
push edi
mov eax, esi
call fcn.004c9d65
push edi
push 0x521438
call fcn.00466ca2
add esp, 8
mov eax, 0x521424
mov ecx, edi
call fcn.004068fc
jmp 0x46c047
xor eax, eax
mov word [edi], ax
pop esi
pop edi
pop ebx
leave
ret

Function at 0x46c5d5
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, 0x521a00
call fcn.00468e30
push 0x10
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
mov eax, 0x5219dc
jl 0x46c5ff
mov eax, 0x5219cc
movzx ecx, byte [0x56bb50]
push esi
cmp ecx, 6
jb 0x46c66c
push ebx
push 1
push 0
push 1
push eax
lea eax, [ebp - 0xc]
push 0x521990
push eax
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
mov ecx, dword [ebp - 4]
mov edx, eax
call fcn.0046bda7
lea ecx, [ebp - 0xc]
mov bl, al
call fcn.004a0c7d
test bl, bl
pop ebx
je 0x46c657
mov ecx, 0x521988
call fcn.0042876e
and dword [ebp - 8], 0
mov esi, eax
jmp 0x46c69f
mov ecx, 0x521968
call fcn.0042876e
mov esi, eax
mov dword [ebp - 8], 1
jmp 0x46c69f
lea ecx, [ebp - 8]
push ecx
push 0
push eax
lea eax, [ebp - 0xc]
push 0x521918
push eax
call fcn.004a1618
add esp, 0xc
mov ecx, eax
call fcn.004a0ff9
mov ecx, dword [ebp - 4]
mov edx, eax
call fcn.00468ce9
lea ecx, [ebp - 0xc]
mov esi, eax
call fcn.004a0c7d
mov ecx, dword [ebp - 4]
mov dl, 1
call fcn.00479b79
test esi, esi
je 0x46c6c0
cmp dword [ebp - 8], 0
jne 0x46c6c0
mov dl, 1
mov ecx, esi
call fcn.00479b79
mov al, 1
jmp 0x46c6d8
push esi
push 0x5218c0
call fcn.004263e6
pop ecx
pop ecx
mov dl, 1
mov ecx, esi
call fcn.00479b79
xor al, al
pop esi
leave
ret

Function at 0x46c740
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
call fcn.0047cfd9
call fcn.0047297c
mov bl, al
call fcn.0047cff8
test bl, bl
pop ebx
je 0x46c75a
mov al, 1
ret
movzx eax, byte [0x56bb50]
cmp eax, 6
jb 0x46c76b
jmp fcn.0046c5d5
jmp fcn.0046c6db
Function at 0x46c7d1
Capabilities:
Create directory
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x556d6c]
sub esp, 0x28
push ebx
push esi
call fcn.00483b8e
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x46ca1b
mov ecx, esi
call fcn.004fa250
test al, al
jne 0x46c807
mov ecx, esi
call fcn.004fa058
jmp 0x46ca1b
push edi
mov ecx, 0x512b3c
call fcn.0049a53c
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [ebp - 4]
call fcn.004a0e93
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], ebx
cmp dword [esi + 0x18], ebx
je 0x46c9e7
mov dword [ebp - 0x14], ebx
mov ebx, 0x51e114
mov eax, dword [esi + 0x10]
mov ecx, dword [ebp - 0x14]
mov edi, dword [ecx + eax]
mov ecx, edi
call fcn.0049e604
push eax
lea ecx, [ebp - 8]
call fcn.004a0fd9
lea ecx, [ebp - 8]
call fcn.004a0ff9
mov edx, ebx
mov ecx, eax
call fcn.0049fc6f
test al, al
je 0x46c985
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.0049e604
mov edx, eax
mov ecx, esi
call fcn.004fa290
xor edx, edx
mov ecx, ebx
mov edi, eax
call fcn.0048245f
push eax
lea ecx, [ebp - 4]
call fcn.004a0c86
push dword [ebp - 0x20]
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov edx, edi
mov ecx, eax
call fcn.004b9462
test al, al
je 0x46c964
lea ecx, [ebp - 0x10]
call fcn.004a0e93
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov edx, eax
lea ecx, [ebp - 0x24]
call fcn.00408336
push eax
lea ecx, [ebp - 0x1c]
call fcn.00423839
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x46c8e4
call fcn.00406bc3
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x46c93b
mov edx, dword [eax + 0x34]
lea ecx, [ebp - 0xc]
call fcn.00422f63
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x46c931
lea ecx, [ebp - 0xc]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
push 0x521b18
call fcn.004263e6
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
jmp 0x46c95a
lea ecx, [ebp - 0x10]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
push 0x521ac8
call fcn.004263e6
add esp, 0xc
lea ecx, [ebp - 0x10]
call fcn.004a0c7d
jmp 0x46c9be
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
lea ecx, [ebp - 8]
call fcn.004a0ff9
push eax
push 0x516420
call fcn.004263e6
add esp, 0xc
jmp 0x46c9be
push 0x521ab4
lea ecx, [ebp - 8]
call fcn.004a1101
test al, al
je 0x46c9c7
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.0049e604
mov edx, eax
mov ecx, esi
call fcn.004fa290
mov edx, dword [ebp - 0x28]
mov edi, eax
test edx, edx
je 0x46c9be
test edi, edi
je 0x46c9be
mov ecx, edi
call fcn.00469ac7
mov dl, 1
mov ecx, edi
call fcn.00479b79
lea ecx, [ebp - 8]
call fcn.004a0c7d
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], 0x14
cmp eax, dword [esi + 0x18]
jne 0x46c83b
mov edi, dword [ebp - 0x1c]
xor ebx, ebx
mov ecx, esi
call fcn.004fa058
cmp edi, ebx
je 0x46ca01
mov ecx, dword [edi + 0x34]
call fcn.0042897a
mov dword [0x890408], eax
jmp 0x46ca07
mov dword [0x890408], ebx
cmp edi, ebx
je 0x46ca12
mov ecx, edi
call fcn.00406bc3
lea ecx, [ebp - 4]
call fcn.004a0c7d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x46ca9f
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
push edi
mov eax, edx
xor edi, edi
mov dword [ebp - 8], ecx
cmp word [eax], di
je 0x46cad4
lea ecx, [ebp - 0x210]
push ecx
call fcn.004c9d65
mov eax, 0x521ccc
lea ecx, [ebp - 0x210]
call fcn.004068fc
jmp 0x46cae7
push 0x104
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, dword [ebp + 8]
test ebx, 0x800
je 0x46cb93
push esi
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
call fcn.004c9d65
lea ecx, [ebp - 0x418]
call fcn.004b696a
xor ecx, ecx
mov word [eax], cx
mov esi, 0x51e918
mov edx, esi
lea ecx, [ebp - 0x418]
call fcn.004b7a3f
mov ecx, esi
mov dword [ebp - 4], eax
call fcn.0049a53c
push eax
lea ecx, [ebp + 8]
call fcn.004a0fd9
lea ecx, [ebp + 8]
call fcn.004a0ff9
mov ecx, eax
call fcn.00482110
pop esi
test al, al
jne 0x46cb6a
lea ecx, [ebp - 4]
call fcn.004a0ff9
mov ecx, eax
call fcn.00482110
test al, al
jne 0x46cb6a
call fcn.0049b96a
push edi
lea ecx, [ebp - 4]
call fcn.004a0ff9
push eax
lea ecx, [ebp + 8]
call fcn.004a0ff9
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp + 8]
call fcn.004a0c7d
lea ecx, [ebp - 4]
call fcn.004a0c7d
cmp byte [0x88f7d0], 0
jne 0x46cc52
call fcn.004c9f32
cmp eax, 2
jne 0x46cbb2
test ebx, 0x8000
je 0x46cbbf
mov edx, ebx
lea ecx, [ebp - 0x210]
call fcn.0046a702
mov edx, ebx
lea ecx, [ebp - 0x210]
call fcn.0046c04c
test ebx, 0x400
je 0x46cbe4
push 0x521cb4
lea edi, [ebp - 0x210]
call fcn.004693be
mov eax, 0x2000
test eax, ebx
je 0x46cc12
lea ecx, [ebp - 0x210]
call fcn.0044bd7b
test eax, eax
jge 0x46cc21
lea eax, [ebp - 0x210]
push eax
push 0x521c38
call fcn.00466ca2
add esp, 8
jmp 0x46cc21
push ebx
push eax
push 0x521bc0
call fcn.00466ca2
add esp, 0xc
test ebx, 0x200
je 0x46cc2e
call fcn.0046c740
mov ecx, dword [ebp - 8]
push 0x51e948
push 0x80000001
call fcn.0044f824
mov ecx, dword [ebp - 8]
push 0x7021
push 0x51e934
call fcn.0044e747
pop edi
pop ebx
leave
ret 4
Function at 0x46ef4f
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push ebp
lea ecx, [esi + 0x28]
call fcn.00431d25
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x55d
push eax
call edi
push 0x19
mov ecx, esi
mov dword [esp + 0x18], eax
call fcn.00466c0e
mov eax, dword [esi + 4]
push 0x55e
push eax
call edi
push 1
push eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov eax, dword [esi + 0x80]
shl ebp, 5
cmp dword [eax + ebp + 0x10], 0xf0
jne 0x46efb8
push dword [0x896110]
jmp 0x46efe6
push dword [esp + 0x1c]
mov ecx, esi
call fcn.0046e2f8
cmp eax, 0xffffffff
jne 0x46efe0
cmp byte [0x56baf5], bl
jne 0x46efd8
push dword [0x89612c]
jmp 0x46efe6
push dword [0x896124]
jmp 0x46efe6
push dword [0x896138]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [esi + 0x80]
cmp dword [eax + ebp + 0x10], 0x116
jne 0x46f060
mov ecx, dword [0x56bb0c]
mov eax, dword [ecx]
call dword [eax + 0x24]
test al, al
je 0x46f02b
push 1
push 0x69e
mov ecx, esi
call fcn.0047624a
push 1
push 0x69f
mov ecx, esi
call fcn.0047624a
mov eax, dword [esi + 4]
push ebx
push 0x55a
push eax
call edi
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebp
mov eax, dword [esi + 4]
push ebx
push 0x55b
push eax
call edi
push eax
call ebp
mov eax, dword [esi + 4]
push ebx
push 0x542
push eax
call edi
push eax
call ebp
jmp 0x46f0df
push ebx
push 0x69e
mov ecx, esi
call fcn.0047624a
push ebx
push 0x69f
mov ecx, esi
call fcn.0047624a
mov eax, dword [esi + 4]
push 1
push 0x55a
push eax
call edi
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call ebp
mov eax, dword [esi + 4]
push 1
push 0x55b
push eax
call edi
push eax
call ebp
mov eax, dword [esi + 4]
push 1
mov ebx, 0x542
push ebx
push eax
call edi
push eax
call ebp
mov eax, dword [esi + 4]
push 0
push 0x55a
push eax
call edi
push eax
call ebp
mov eax, dword [esi + 4]
push 0
push 0x55b
push eax
call edi
push eax
call ebp
mov eax, dword [esi + 4]
push 0
push ebx
push eax
call edi
push eax
call ebp
xor ebx, ebx
push dword [esp + 0x1c]
mov ecx, esi
call fcn.00467cb8
xor ecx, ecx
test eax, eax
setge cl
push ecx
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_EnableWindow]
push dword [esp + 0x1c]
mov ecx, esi
call fcn.00467cb8
test eax, eax
jl 0x46f10e
push 5
pop ebx
push ebx
push dword [esp + 0x18]
call ebp
push 1
push dword [esp + 0x14]
push 0x28
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x472a81
Capabilities:
Reference l3 dns server

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
mov ebx, edx
cmp cl, 2
jne 0x472ac1
test byte [0x56be94], 1
jne 0x472ab2
or dword [0x56be94], 1
push 0x5241dc
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [0x56be90], eax
push ebx
push dword [0x56be90]
call dword [0x56be68]
jmp 0x472b0e
cmp dword [0x56be6c], 0
jne 0x472ad1
mov eax, 0x2741
jmp 0x472b0e
test byte [0x56be94], 2
push esi
mov esi, 0x56be7c
jne 0x472af5
or dword [0x56be94], 2
push 0
mov edx, 0x5241c8
mov ecx, esi
call fcn.0049cd07
push 0
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.004729f6
push ebx
lea eax, [ebp - 0x80]
push eax
call dword [0x56be6c]
pop esi
pop ebx
leave
ret

Function at 0x472b11
Capabilities:
Get hostname
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push edi
mov edi, ecx
mov bl, dl
mov dword [ebp - 4], edi
call fcn.00472659
test al, al
je 0x472b6e
lea edx, [ebp - 8]
mov cl, bl
call fcn.00472a81
test eax, eax
jne 0x472b6e
push dword [ebp - 8]
mov dl, bl
lea ecx, [ebp - 0x1c]
call fcn.0047282a
lea ecx, [ebp - 0x1c]
call fcn.0040e0b5
test al, al
jne 0x472b6e
lea ecx, [ebp - 0x1c]
call fcn.0049cb80
test al, al
jne 0x472b6e
mov eax, dword [ebp - 4]
push esi
push 5
pop ecx
lea esi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
pop esi
jmp 0x472bcb
cmp bl, 2
jne 0x472bc2
push 0x100
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x472bc2
cmp word [eax + 8], 2
jne 0x472bc2
cmp word [eax + 0xa], 4
jne 0x472bc2
mov eax, dword [eax + 0xc]
cmp dword [eax], 0
je 0x472bc2
mov eax, dword [eax]
push 0
push dword [eax]
call dword [sym.imp.WS2_32.dll_htonl]
push eax
mov ecx, edi
call fcn.0049ca27
jmp 0x472bc9
mov ecx, edi
call fcn.0049c9ec
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x473ff2
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
movzx eax, byte [esi + 0xf5]
neg eax
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
sbb eax, eax
and eax, ebx
push eax
push dword [esi + 0x110]
call edi
movzx eax, byte [esi + 0xf6]
neg eax
sbb eax, eax
and eax, ebx
push eax
push dword [esi + 0x114]
call edi
push ebx
push dword [esi + 0x104]
call edi
movzx eax, byte [esi + 0xf7]
neg eax
sbb eax, eax
and eax, ebx
push eax
push dword [esi + 0x108]
call edi
push 0
push dword [esi + 0x10c]
call edi
mov edi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push dword [esi + 0x104]
call edi
push 1
push dword [esi + 0x108]
call edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x4741df
Capabilities:
Hide graphical window

Disassembly:
call fcn.00474144
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x475139
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov esi, ecx
push 0
mov byte [esi + 0xf5], 0
call fcn.00473ff2
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push dword [esi + 0x110]
call edi
push 5
push dword [esi + 0x10c]
call edi
push 0x524708
lea ecx, [ebp - 4]
call fcn.004a0fd9
cmp byte [0x56bf48], 0
je 0x4751b8
push 0x510424
lea ecx, [ebp - 8]
call fcn.004a0fd9
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
call fcn.00474ae7
push dword [eax]
lea ecx, [ebp - 4]
call fcn.004a101e
lea ecx, [ebp - 0xc]
call fcn.004a0c7d
lea ecx, [ebp - 8]
call fcn.004a0c7d
lea eax, [ebp - 4]
push eax
mov ecx, esi
call fcn.00474e84
lea ecx, [ebp - 4]
call fcn.004a0c7d
pop edi
pop esi
leave
ret