joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441be5
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00460350
push esi
mov eax, edx
push edi
mov edi, ecx
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x441bfb
sub eax, esi
sar eax, 1
mov esi, eax
mov eax, 0x7d0
cmp esi, eax
jl 0x441c16
mov esi, eax
lea eax, [esi + 1]
push eax
lea ecx, [ebp - 0x2000]
call fcn.0040f153
lea edx, [esi + esi]
mov eax, 0x46ae50
lea ecx, [ebp + edx - 0x2000]
sub ecx, eax
movzx esi, word [eax]
mov word [ecx + eax], si
inc eax
inc eax
test si, si
jne 0x441c36
push 0x82d
lea eax, [ebp + edx - 0x1ffa]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x2000]
push eax
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
pop edi
pop esi
leave
ret

Function at 0x442025
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x814
mov edi, edx
call fcn.00434e42
push 0x800
mov esi, eax
push ebx
push esi
call sub.MSVCRT.dll_strncpy
mov eax, ebx
add esp, 0xc
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x442050
sub eax, ecx
inc dword [0x484480]
mov dword [esi + 0x800], eax
mov eax, dword [ebp + 8]
mov dword [esi + 0x80c], eax
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x808], eax
mov eax, dword [ebp + 0xc]
push str.http:__download.yandex.ru_yandex_pack_utorrent_YandexPackSetup_utorrent_20090724.exe
push ebx
mov dword [esi + 0x804], edi
mov dword [esi + 0x810], eax
call sub.MSVCRT.dll__stricmp
pop ecx
pop ecx
test eax, eax
je 0x4420d4
push str.http:__download.yandex.ru_yandex_pack_utorrent_YandexPackSetup.exe
push ebx
call sub.MSVCRT.dll__stricmp
pop ecx
pop ecx
test eax, eax
je 0x4420d4
push str.http:___s_offers_tb_ask_1.5.1.0.exe
push ebx
call fcn.00441cfb
test al, al
jne 0x4420c8
push str.http:__download.utorrent.com_offers_tb_ask_1.5.1.0.exe
push ebx
call sub.MSVCRT.dll__stricmp
pop ecx
pop ecx
test eax, eax
jne 0x4420db
mov dword [0x47aed0], 1
jmp 0x4420db
and dword [0x47aed0], 0
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push esi
push 0x441fc4
push eax
push eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4428ac
Capabilities:
Create pipe
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
mov edi, edx
mov dword [ebp - 8], ecx
mov dword [ebp - 0x24], 0xc
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 1
call dword [sym.imp.KERNEL32.DLL_CreatePipe]
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 2
push ebx
push ebx
lea eax, [ebp - 0xc]
push eax
call esi
push eax
push dword [ebp - 0x14]
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
mov edx, edi
push ebx
xor esi, esi
call fcn.0043f50c
test al, al
je 0x4429d5
mov ecx, 0x104
call fcn.00434e42
mov edi, eax
mov byte [ebp - 1], bl
jmp 0x442991
cmp dword [ebp - 8], ebx
jne 0x442958
cmp byte [ebp - 1], bl
jne 0x4429a6
push 0xc8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_WaitForSingleObject]
cmp eax, 0x102
je 0x442991
mov byte [ebp - 1], 1
jmp 0x442991
push ebx
lea eax, [ebp - 8]
push eax
mov eax, 0x103
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
je 0x44297b
cmp dword [ebp - 8], ebx
jne 0x44298e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x6d
je 0x4429a6
cmp esi, 0x103
je 0x4429a6
add esi, dword [ebp - 8]
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_PeekNamedPipe]
test eax, eax
jne 0x442933
mov ecx, edi
mov byte [esi + edi], bl
call fcn.0042d2db
mov ecx, edi
mov esi, eax
call fcn.0043492c
cmp dword [ebp + 0xc], ebx
je 0x4429ca
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_GetExitCodeProcess]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x4429df
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x4429df
or dword [eax], 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x442bc1
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
push ebx
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 2], 1
mov byte [ebp - 1], bl
call fcn.00421a27
test eax, eax
jge 0x442bea
call fcn.00421a52
jmp 0x442d16
push esi
lea eax, [ebp - 8]
push eax
push 0x4770b8
push 1
push ebx
mov esi, 0x4770a8
push esi
call dword [0x482e30]
test eax, eax
jl 0x442c0c
cmp dword [ebp - 8], ebx
jne 0x442c33
lea eax, [ebp - 8]
push eax
push 0x477098
push 1
push ebx
push esi
mov byte [ebp - 2], bl
call dword [0x482e30]
test eax, eax
jl 0x442d10
cmp dword [ebp - 8], ebx
je 0x442d10
mov eax, dword [ebp - 8]
lea ecx, [ebp - 0xc]
push ecx
push 0x46b418
push dword [ebp - 8]
mov dword [ebp - 0xc], ebx
mov eax, dword [eax]
call dword [eax]
test eax, eax
jl 0x442cea
mov eax, dword [ebp - 0xc]
cmp eax, ebx
je 0x442cea
mov ecx, dword [ebp + 0xc]
mov esi, dword [eax]
push ebx
call fcn.0042d346
push eax
push dword [ebp - 0xc]
call dword [esi + 0x14]
mov esi, eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp esi, ebx
jl 0x442cea
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 4
cmp byte [ebp - 2], bl
je 0x442cac
lea edx, [ebp - 0x568]
push edx
push 0x104
lea edx, [ebp - 0x318]
push edx
push eax
call dword [ecx + 0xc]
test eax, eax
jl 0x442ce7
lea eax, [ebp - 0x318]
jmp 0x442cd4
lea edx, [ebp - 0x250]
push edx
push 0x104
lea edx, [ebp - 0x110]
push edx
push eax
call dword [ecx + 0xc]
lea ecx, [ebp - 0x110]
mov esi, eax
call fcn.0042d321
cmp esi, ebx
jl 0x442ce7
push dword [ebp + 8]
push eax
call sub.MSVCRT.dll__wcsicmp
pop ecx
pop ecx
mov byte [ebp - 1], 1
test eax, eax
je 0x442cea
mov byte [ebp - 1], bl
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp byte [ebp - 1], bl
je 0x442d10
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
push ebx
push dword [ebp + 0xc]
push 5
pop edx
push 4
pop ecx
call fcn.00448aec
call fcn.00421a52
pop esi
pop ebx
leave
ret 8
Function at 0x442df2
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x66c
push ebx
push esi
push edi
mov eax, ecx
lea edx, [ebp - 0x66c]
push 2
mov dword [ebp - 4], eax
sub edx, eax
pop ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x442e0e
lea edi, [ebp - 0x66c]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x442e24
mov esi, 0x46b740
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x25c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x66c]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x442f82
lea edx, [ebp - 0x464]
sub edx, dword [ebp - 4]
mov dword [ebp - 0xc], edx
jmp 0x442e69
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, ebx
test cx, cx
jne 0x442e6c
lea edi, [ebp - 0x464]
dec edi
dec edi
mov ax, word [edi + 2]
add edi, ebx
test ax, ax
jne 0x442e82
mov esi, 0x46b450
lea eax, [ebp - 0x230]
movsd dword es:[edi], dword [esi]
mov edx, eax
mov cx, word [eax]
add eax, ebx
test cx, cx
jne 0x442e9b
sub eax, edx
lea edi, [ebp - 0x464]
dec edi
dec edi
mov cx, word [edi + 2]
add edi, ebx
test cx, cx
jne 0x442eaf
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [ebp - 0x25c], 0x10
rep movsb byte es:[edi], byte [esi]
jne 0x442ee2
lea eax, [ebp - 0x464]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
jmp 0x442f61
mov ecx, 0x469210
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442f13
test dx, dx
je 0x442f0f
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442f13
add eax, 4
add ecx, 4
test dx, dx
jne 0x442eed
xor eax, eax
jmp 0x442f18
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442f61
mov ecx, 0x469214
lea eax, [ebp - 0x230]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x442f4d
test dx, dx
je 0x442f49
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x442f4d
add eax, 4
add ecx, 4
test dx, dx
jne 0x442f27
xor eax, eax
jmp 0x442f52
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x442f61
lea ecx, [ebp - 0x464]
call fcn.00442df2
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x442e66
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x443043
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_FindWindowW]
push esi
push edi
xor ebx, ebx
jmp 0x4430a3
lea eax, [esp + 0x14]
push eax
push 0x7530
push 1
push ebx
push ebx
push 0x16
push esi
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x4430a3
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [esp + 0x10]
push ebx
push 1
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp esi, ebx
je 0x4430ba
cmp edi, ebx
je 0x4430ba
push ebx
push 0x47bf28
call ebp
mov esi, eax
cmp esi, ebx
jne 0x443053
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
push edi
push esi
push str.TerminateClientInstances_failed__hp:0x_X_result:_d_n
call fcn.0044348b
add esp, 0xc
xor al, al
jmp 0x4430b3

Function at 0x4430e2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x443116
inc eax
cmp dword [ebp + 0x10], eax
je 0x443118
cmp dword [ebp + 0x10], 2
je 0x443118
xor eax, eax
leave
ret 0xc

Function at 0x44311c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
lea edx, [eax + 2]
push esi
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x443126
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 0xc]
push 1
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop esi
test eax, eax
je 0x443164
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push str.RegKey:_Could_not_write_string_valuename__s_value__s__Error__d_n
call fcn.0044348b
add esp, 0x10
pop ebp
ret 8

Function at 0x44319e
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4431cf
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.RegKey:_Could_not_write_DWORD_valuename__s_value__d__Error__d_n
call fcn.0044348b
add esp, 0x10
ret 8

Function at 0x4431d2
Capabilities:
Delete registry value

Disassembly:
push dword [esp + 4]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x4431f4
push dword [esp + 4]
push eax
push str.RegKey:_Could_not_delete_value__d:__s_n
call fcn.0044348b
add esp, 0xc
ret 4

Function at 0x4431f7
Capabilities:
Delete registry key

Disassembly:
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x44321b
push dword [esp + 8]
push eax
push str.RegKey:_Could_not_delete_subkey__d:__s_n
call fcn.0044348b
add esp, 0xc
ret 8
Function at 0x4434d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004403fe
mov ecx, 0x804
mov ebx, eax
call fcn.00434e42
mov edi, 0x800
push edi
mov esi, eax
push str.http:__update.utorrent.com_installstats.php
push esi
call sub.MSVCRT.dll_strncpy
push 0x30b4406
push str._v_d
lea eax, [esi + 0x2b]
push 0x7d5
push eax
mov dword [esi + 0x800], 0x2b
call fcn.0042e794
add dword [esi + 0x800], eax
mov eax, dword [esi + 0x800]
push ebx
mov ecx, edi
sub ecx, eax
push str.h_s
push ecx
add eax, esi
push eax
call fcn.0042e794
add dword [esi + 0x800], eax
mov ebx, dword [esi + 0x800]
add esp, 0x2c
call dword [sym.imp.KERNEL32.DLL_GetVersion]
push eax
mov eax, edi
sub eax, ebx
push str.w_X
push eax
add ebx, esi
push ebx
call fcn.0042e794
add dword [esi + 0x800], eax
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0x800]
add esp, 0x10
xor ebx, ebx
cmp ecx, 8
ja case.default.0x443585
jmp dword [ecx*4 + 0x443714]
push str.showinstall
push 0x464330
jmp 0x4436d8
push str.showwarning
jmp 0x443591
push dword [ebp + 0xc]
push str.installresult_d
mov ecx, edi
sub ecx, eax
push ecx
add eax, esi
push eax
call fcn.0042e794
push dword [ebp + 0x10]
push str.exit_d
add dword [esi + 0x800], eax
mov eax, dword [esi + 0x800]
sub edi, eax
add eax, esi
push edi
push eax
call fcn.0042e794
add esp, 0x20
jmp 0x4436e6
push dword [ebp + 0xc]
push str.warningresult_d
jmp 0x4435aa
push dword [ebp + 0x18]
push str.tbexiststb_d
jmp 0x4436d8
push dword [ebp + 0x18]
push str.tboffertb_d
jmp 0x4436d8
push dword [ebp + 0xc]
mov ecx, edi
sub ecx, eax
push str.tbofferresult_d
push ecx
add eax, esi
push eax
call fcn.0042e794
add dword [esi + 0x800], eax
push dword [ebp + 0x10]
mov eax, dword [esi + 0x800]
mov ecx, edi
sub ecx, eax
push str.exit_d
push ecx
add eax, esi
push eax
call fcn.0042e794
add dword [esi + 0x800], eax
push dword [ebp + 0x18]
mov eax, dword [esi + 0x800]
sub edi, eax
push str.tb_d
add eax, esi
push edi
push eax
call fcn.0042e794
add esp, 0x30
jmp 0x4436e6
push dword [ebp + 0xc]
mov ecx, edi
sub ecx, eax
push str.tbinstallresult_d
push ecx
add eax, esi
push eax
call fcn.0042e794
add dword [esi + 0x800], eax
push dword [ebp + 0x10]
mov eax, dword [esi + 0x800]
mov ecx, edi
sub ecx, eax
push str.error_d
push ecx
add eax, esi
push eax
call fcn.0042e794
add dword [esi + 0x800], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi + 0x800]
add esp, 0x20
cmp ecx, ebx
jne 0x4436b0
mov ecx, 0x462087
push ecx
mov ecx, edi
sub ecx, eax
push str.msg_U
push ecx
add eax, esi
push eax
call fcn.0042e794
push dword [ebp + 0x18]
push str.tb_d
jmp 0x4435bf
push dword [ebp + 0x14]
push str.cancellastpage_s
sub edi, eax
add eax, esi
push edi
push eax
call fcn.0042e794
add esp, 0x10
add dword [esi + 0x800], eax
inc dword [0x484480]
lea eax, [ebp - 4]
push eax
push ebx
push esi
push 0x443495
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x443adb
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], esi
mov edi, 0x2712
mov dword [ebp - 8], 0x4652b0
test edx, edx
je 0x443b06
mov dword [ebp - 8], edx
jmp 0x443c76
push ebx
call fcn.0041e612
mov ebx, esi
and bl, 1
dec bl
neg bl
sbb bl, bl
mov eax, esi
and al, 4
inc bl
cmp al, 4
sete byte [ebp - 1]
mov eax, esi
and al, 2
cmp al, 2
sete byte [ebp - 2]
call fcn.0040d11d
mov edx, eax
push 0xff
lea ecx, [ebp - 0x21c]
mov dword [ebp - 0xc], edx
call fcn.0040f153
lea edi, [ebp - 0x21c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x443b4f
mov ecx, dword [ebp - 0xc]
mov esi, 0x46aa68
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
call fcn.0043492c
push dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x21c]
mov edi, 0x2713
call fcn.004361c3
test al, al
je 0x443c70
mov ecx, dword [0x47aed0]
mov eax, 0x462087
cmp ecx, 1
jne 0x443bd0
cmp byte [ebp - 2], 0
je 0x443bb7
cmp byte [ebp - 1], 0
mov eax, str._tbr
je 0x443bb7
push eax
push str._s_sa
call fcn.0042ea48
pop ecx
pop ecx
test bl, bl
je 0x443bc8
push eax
push str._s_hpr
call fcn.0042ea48
pop ecx
pop ecx
push eax
push str._s_verysilent_toolbarUT2V5
jmp 0x443c21
test ecx, ecx
jne 0x443c28
cmp byte [ebp - 2], cl
je 0x443c28
xor cl, cl
mov eax, str._quiet__msicl
cmp byte [ebp - 1], cl
je 0x443bf4
push eax
push str._s__YAQSEARCHy
call fcn.0042ea48
pop ecx
pop ecx
mov cl, 1
test bl, bl
je 0x443c17
test cl, cl
mov ecx, 0x4673d0
jne 0x443c06
mov ecx, 0x46c00c
push ecx
push eax
push str._s_sYAHOMEPAGEy
call fcn.0042ea48
add esp, 0xc
mov cl, 1
test cl, cl
je 0x443c28
push eax
push 0x46bff4
call fcn.0042ea48
pop ecx
pop ecx
push 1
xor ebx, ebx
push ebx
mov ecx, eax
call fcn.0042d321
push eax
lea eax, [ebp - 0x21c]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.KERNEL32.DLL_DeleteFileW]
mov edi, eax
jmp 0x443c63
cmp ebx, 0x14
jge 0x443c70
push 0x1f4
call dword [sym.imp.KERNEL32.DLL_Sleep]
inc ebx
lea eax, [ebp - 0x21c]
push eax
call esi
test eax, eax
je 0x443c52
call fcn.0041e600
pop ebx
mov ecx, dword [ebp + 8]
call fcn.0043492c
push dword [0x47aed0]
mov ecx, dword [ebp - 8]
call fcn.0042d726
push eax
push edi
push dword [ebp - 0x14]
push 7
call fcn.004434d4
cmp dword [0x47aed0], 1
pop edi
pop esi
mov eax, str.binasktoolbar
je 0x443cad
mov eax, str.binyandextoolbar
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
push eax
push 0x484c88
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004420fe
leave
ret 0x10

Function at 0x444973
Capabilities:
Get disk information

Disassembly:
push esi
mov esi, dword [0x484488]
mov eax, bind
and esi, eax
cmp esi, eax
pop esi
jne 0x444989
mov al, 1
ret
jmp fcn.004445ad
Function at 0x446197
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push 0x104
lea eax, [ebp - 0x208]
push eax
push 0x467fd0
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, reloc.WS2_32.dll_accept
call fcn.00444859
test al, al
je 0x446221
cmp dword [ebp + 8], 0
je 0x44621f
mov eax, dword [ebp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4461d0
sub eax, edx
sar eax, 1
cmp word [ebp - 0x208], 0x22
push esi
mov esi, eax
jne 0x44621a
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x206]
push eax
call sub.MSVCRT.dll__wcsnicmp
add esp, 0xc
test eax, eax
jne 0x44621a
movzx eax, word [ebp + esi*2 - 0x206]
test ax, ax
je 0x44621a
cmp ax, 0x22
jne 0x44621a
xor eax, eax
inc eax
jmp 0x44621c
xor eax, eax
pop esi
jmp 0x446221
mov al, 1
leave
ret 4

Function at 0x446225
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
xor eax, eax
push esi
cmp cl, al
je 0x446282
push 0x22
pop ecx
mov word [ebp - 0x21c], cx
push 0x104
lea ecx, [ebp - 0x21a]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, eax
lea eax, [ebp - 0x21a]
push eax
call fcn.00446197
test al, al
jne 0x446297
lea eax, [esi + esi]
push 0x22
pop ecx
mov word [ebp + eax - 0x21a], cx
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
lea eax, [ebp - 0x21c]
push eax
push 0x467fd0
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, reloc.WS2_32.dll_accept
call fcn.00444904
pop esi
leave
ret
Function at 0x446a69
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, edx
cmp word [eax], 0
push esi
push edi
mov dword [ebp - 4], ecx
je 0x446ab4
lea esi, [ebp - 0x20c]
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
inc eax
inc eax
test cx, cx
jne 0x446a87
lea edi, [ebp - 0x20c]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x446a9d
push 7
pop ecx
mov esi, 0x46bedc
rep movsd dword es:[edi], dword [esi]
jmp 0x446ac8
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
test dword [ebp + 8], 0x800
je 0x446b26
xor eax, eax
movzx ecx, word [ebp + eax - 0x20c]
mov word [ebp + eax - 0x414], cx
inc eax
inc eax
test cx, cx
jne 0x446ad3
lea ecx, [ebp - 0x414]
call fcn.00433ba7
xor ecx, ecx
mov word [eax], cx
mov esi, str.settings.dat
mov edx, esi
lea ecx, [ebp - 0x414]
call fcn.0043511e
mov ecx, esi
mov edi, eax
call fcn.004344f6
push 0
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileW]
mov ecx, edi
call fcn.0043492c
mov esi, dword [ebp + 8]
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.00443a70
mov edx, esi
lea ecx, [ebp - 0x20c]
call fcn.004468e3
mov eax, 0x2000
test eax, esi
je 0x446b71
lea ecx, [ebp - 0x20c]
call fcn.0041866a
test eax, eax
jge 0x446b80
lea eax, [ebp - 0x20c]
push eax
push str.INSTALLDEBUG:_Unable_to_create_firewall_rules_for_path___s__n
call fcn.0044348b
add esp, 8
jmp 0x446b80
push esi
push eax
push 0x46efd0
call fcn.0044348b
add esp, 0xc
pop edi
test esi, 0x200
pop esi
je 0x446b8f
call fcn.00442abd
mov ecx, dword [ebp - 4]
push str.SoftwareBitTorrentuTorrent
push reloc.WS2_32.dll_accept
call fcn.0044482d
mov ecx, dword [ebp - 4]
push 0x4406
push str.Revision
call fcn.0044319e
leave
ret 4

Function at 0x44839e
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x484594], 0
jne 0x4483bc
mov edx, str.SHGetFileInfoW
mov ecx, str.shell32.dll
call fcn.00435c3b
pop ebp
jmp eax
pop ebp
jmp fcn.004482e8

Function at 0x448a0a
Capabilities:
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
xor ebx, ebx
cmp dword [0x484594], ebx
push esi
sete byte [ebp - 1]
push edi
mov edi, edx
mov esi, ecx
mov edx, str.SHGetFolderPathW
cmp byte [ebp - 1], bl
jne 0x448a35
mov edx, str.SHGetFolderPathA
mov ecx, str.shfolder.dll
call fcn.00435c3b
cmp eax, ebx
jne 0x448a47
xor eax, eax
jmp 0x448aa8
cmp byte [ebp - 1], bl
jne 0x448a7e
lea ecx, [ebp - 0x108]
push ecx
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x448a43
push 0x104
push edi
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
neg eax
sbb eax, eax
neg eax
jmp 0x448aa8
push edi
push ebx
push ebx
push dword [ebp + 8]
push esi
call eax
test eax, eax
jl 0x448a43
cmp dword [ebp + 0xc], ebx
je 0x448aa5
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
test al, 0x10
jne 0x448aa5
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x448aa8
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 8