joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4513f0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x94], 0
je 0x451425
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403cb8
jmp 0x45142f
mov eax, esi
mov edx, dword [ebx + 0x7c]
call fcn.00403c24
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4523f4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x74]
test esi, esi
je 0x45242c
mov eax, esi
call fcn.0043996c
test al, al
je 0x45242c
mov eax, dword [ebx + 0x74]
call fcn.00439670
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45242c
push 0
mov eax, dword [ebx + 0x74]
call fcn.00439670
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x461c5c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x461d34
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4bd870], 0
jne 0x461d18
lea eax, [ebp - 4]
mov edx, 0x461d4c
call fcn.00403c68
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00404014
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x461d18
mov eax, ebx
call fcn.00402730
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x461d11
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x461cfb
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x461d5c
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x461cfb
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4bd870], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461d18
mov eax, dword [ebp - 0xc]
call fcn.00402748
ret
mov ebx, dword [0x4bd870]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461d3b
lea eax, [ebp - 4]
call fcn.00403bd0
ret

Function at 0x4750d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00404014
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x4750e9
test al, 0x10
jne 0x4750ed
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x475a50
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
mov ebx, eax
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov dword [ebx + 0x42c], esi
inc esi
jne 0x475a82
push 0x475ae0
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, ebx
call fcn.00475eac
pop esi
pop ebx
ret
mov dl, 1
mov eax, ebx
call fcn.00475dc4
push 0x33
push 0x401
mov eax, dword [ebx + 0x4e8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
push 0x10
lea eax, [ebx + 0x434]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_connect
test eax, eax
je 0x475ad3
push 0x475af4
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, ebx
call fcn.00475eac
pop esi
pop ebx
ret

Function at 0x475bbc
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
cmp byte [esi + 0x460], 0
jne 0x475c82
mov eax, esi
call fcn.00475898
test al, al
jne 0x475c82
push 0
push 1
push 2
call sub.wsock32.dll_socket
mov edi, eax
mov dword [esi + 0x42c], edi
inc edi
jne 0x475c0c
push 0x475c90
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, esi
call fcn.00475eac
jmp 0x475c82
push 8
push 0x401
mov eax, dword [esi + 0x4e8]
push eax
mov eax, dword [esi + 0x42c]
push eax
call sub.wsock32.dll_WSAAsyncSelect
xor edx, edx
mov eax, esi
call fcn.00475dc4
push 0x10
lea eax, [esi + 0x434]
push eax
mov eax, dword [esi + 0x42c]
push eax
call sub.wsock32.dll_bind
test eax, eax
je 0x475c5f
push 0x475ca0
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, esi
call fcn.00475eac
jmp 0x475c82
push 5
mov eax, dword [esi + 0x42c]
push eax
call sub.wsock32.dll_listen
test eax, eax
sete bl
test bl, bl
jne 0x475c82
mov edx, 2
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, ebx
pop edi
pop esi
pop ebx
ret

Function at 0x475dfc
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov esi, edx
mov ebx, eax
mov eax, esi
mov edx, 0x475e58
call fcn.00403c24
cmp dword [ebx + 0x42c], 0xffffffff
je 0x475e49
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x475e49
push dword [esp + 8]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
mov eax, esi
call fcn.00403d88
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x475e64
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
or esi, 0xffffffff
cmp dword [ebx + 0x42c], 0xffffffff
je 0x475ea2
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_getsockname
test eax, eax
jne 0x475ea2
mov ax, word [esp + 6]
push eax
call sub.wsock32.dll_ntohs
movzx esi, ax
mov eax, esi
add esp, 0x14
pop esi
pop ebx
ret
Function at 0x4764ec
Capabilities:
Download and write a file
Receive and write data from server to client
Receive data
Receive data on socket
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov esi, eax
xor eax, eax
push ebp
push 0x476611
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [esi + 0x4dc], 0
je 0x4765e6
mov eax, esi
call fcn.00476458
mov edi, eax
cmp edi, 0xffffffff
je 0x4765f6
mov eax, edi
call fcn.00402730
mov dword [ebp - 8], eax
push 0
push edi
mov eax, dword [ebp - 8]
push eax
mov eax, dword [esi + 0x42c]
push eax
call sub.wsock32.dll_recv
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x47658a
push 0x476628
lea edx, [ebp - 0x10]
mov eax, edi
call fcn.00408b74
push dword [ebp - 0x10]
push 0x476644
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403f10
mov eax, dword [ebp - 0xc]
push eax
call sub.wsock32.dll_WSAGetLastError
mov edx, eax
mov cl, 1
mov eax, esi
call fcn.00475eac
jmp 0x4765d1
test ebx, ebx
jle 0x4765d1
push 0
lea eax, [ebp - 4]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
mov eax, dword [esi + 0x4dc]
push eax
call sub.kernel32.dll_WriteFile_1
test eax, eax
jne 0x4765b2
mov eax, esi
call fcn.00476a04
jmp 0x4765f6
cmp word [esi + 0x4ca], 0
je 0x4765d1
push ebx
mov ecx, dword [esi + 0x4e0]
mov edx, esi
mov eax, dword [esi + 0x4cc]
call dword [esi + 0x4c8]
mov eax, dword [ebp - 8]
call fcn.00402748
test ebx, ebx
jle 0x4765f6
inc ebx
jne 0x47651a
jmp 0x4765f6
push 0x476650
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00475eac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476618
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00403bf4
ret

Function at 0x479624
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, dword [esi + 0x508]
call fcn.00408e18
test al, al
je 0x4796a3
push 0x80
mov eax, dword [esi + 0x508]
call fcn.00404014
push eax
call sub.kernel32.dll_SetFileAttributesA
test bl, bl
je 0x479686
mov ecx, 1
mov edx, dword [esi + 0x508]
mov eax, esi
call fcn.00476664
mov ebx, eax
test bl, bl
je 0x4796a5
mov edx, dword [esi + 0x508]
mov eax, esi
call fcn.0047947c
mov dword [esi + 0x520], eax
mov dword [esi + 0x524], edx
jmp 0x4796a5
mov eax, dword [esi + 0x508]
call fcn.00408f74
mov eax, dword [esi + 0x508]
call fcn.00408e18
mov ebx, eax
xor bl, 1
jmp 0x4796a5
mov bl, 1
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x47bca4
Capabilities:
Send data
Send data on socket

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
mov byte [ebx + 0x649], 1
cmp byte [ebx + 0x658], 7
jne 0x47bcc7
mov dl, 1
mov eax, dword [ebx + 0x65c]
call fcn.004769c4
mov eax, dword [0x47bd40]
mov dword [esp], eax
mov ax, word [0x47bd44]
mov word [esp + 4], ax
mov al, byte [0x47bd46]
mov byte [esp + 6], al
push 0
push 2
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_send
mov eax, dword [0x47bd48]
mov dword [esp], eax
mov ax, word [0x47bd4c]
mov word [esp + 4], ax
mov al, byte [0x47bd4e]
mov byte [esp + 6], al
push 1
push 2
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x42c]
push eax
call sub.wsock32.dll_send
mov edx, 0x47bd58
mov eax, ebx
call fcn.00479c68
pop ecx
pop edx
pop ebx
ret

Function at 0x47d510
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xffffffc4
mov ebx, eax
mov esi, esp
mov eax, esi
xor ecx, ecx
mov edx, 0x3c
call fcn.00402b9c
mov dword [esi], 0x3c
mov dword [esi + 4], 0x44c
call sub.user32.dll_GetDesktopWindow
mov dword [esi + 8], eax
mov eax, 0x47d57c
mov dword [esi + 0xc], eax
mov eax, ebx
call fcn.00404014
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
xor eax, eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x1c], 1
xor eax, eax
mov dword [esi + 0x20], eax
xor eax, eax
mov dword [esi + 0x24], eax
push esi
call sub.shell32.dll_ShellExecuteExA
neg eax
sbb eax, eax
neg eax
add esp, 0x3c
pop esi
pop ebx
ret
Function at 0x48164c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x481821
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [esi + 0x2c], 0
jne 0x481808
mov eax, dword [esi + 0x24]
call fcn.00403e50
test eax, eax
jne 0x4816a1
mov eax, dword [esi + 0x28]
call fcn.00403e50
test eax, eax
jne 0x4816a1
mov eax, esi
call fcn.004818c0
jmp 0x481808
cmp dword [esi + 0x94], 0
jne 0x4816d8
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x24]
call fcn.00409430
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4bdaa8]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x94], eax
cmp dword [esi + 0x98], 0
jne 0x48170f
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0x28]
call fcn.00409430
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4bdaa8]
mov eax, dword [eax + 0x38]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [esi + 0x98], eax
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.00481900
mov ebx, eax
test bl, bl
jne 0x4817bd
mov eax, dword [esi + 0x24]
call fcn.00403e50
test eax, eax
jne 0x481747
mov eax, dword [esi + 0xb0]
call fcn.00403e50
test eax, eax
je 0x4817bd
mov eax, dword [esi + 0xb0]
call fcn.00403e50
test eax, eax
je 0x481769
lea eax, [ebp - 0x101]
mov edx, dword [esi + 0xb0]
call fcn.00409430
jmp 0x481795
push dword [esi + 0x24]
push 0x48183c
push dword [esi + 0x28]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.00403f10
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00409430
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x4817bd
mov ecx, dword [esi + 0x98]
mov edx, dword [esi + 0x94]
mov eax, esi
call fcn.00481900
mov ebx, eax
test bl, bl
jne 0x4817ca
mov eax, esi
call fcn.004818c0
jmp 0x481808
mov eax, dword [esi + 0x4c]
test eax, eax
je 0x4817d9
mov dword [esi + 0x9c], eax
jmp 0x4817e3
mov dword [esi + 0x9c], 1
mov eax, esi
call fcn.00481978
test al, al
je 0x481808
mov eax, esi
mov bx, 0xffef
call fcn.004030e4
xor ecx, ecx
xor edx, edx
mov eax, esi
call fcn.00481ac4
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481828
lea eax, [ebp - 0x108]
call fcn.00403bd0
ret

Function at 0x483f6c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00483bd0
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404014
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x483fca
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4bc30c]
mov dl, 1
mov eax, dword [0x483ac8]
call fcn.0040bf80
call fcn.004036a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x483fd4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404014
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x48402c
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4bc564]
mov dl, 1
mov eax, dword [0x483ac8]
call fcn.0040bf80
call fcn.004036a0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00483c00
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x489050
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 0x114], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x48920b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
test byte [eax + 0x20], 0x10
je 0x489099
mov eax, dword [ebp - 8]
mov edx, 0x489224
call fcn.00403c24
jmp 0x489198
mov esi, 0x489238
lea edi, [ebp - 0x110]
mov ecx, 0x40
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x150], 0
jne 0x4890d0
push 0xff
lea eax, [ebp - 0x110]
push eax
mov eax, dword [0x4bd4dc]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
jmp 0x4890e4
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0x150]
lea eax, [ebp - 0x110]
call fcn.00409430
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
jne 0x48910c
mov eax, dword [ebp - 8]
mov edx, 0x489340
call fcn.00403c24
jmp 0x489198
lea eax, [ebx + 1]
call fcn.004095a8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x489191
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
push 0
lea eax, [ebp - 0x110]
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
jne 0x48914b
mov eax, dword [ebp - 8]
mov edx, 0x489360
call fcn.00403c24
jmp 0x48917b
mov eax, dword [ebp - 4]
cmp byte [eax + 0x138], 9
jne 0x48916a
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00488c60
jmp 0x48917b
mov eax, dword [ebp - 8]
push eax
mov ecx, ebx
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00488e14
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489198
mov eax, dword [ebp - 0x10]
call fcn.004095f4
ret
lea edx, [ebp - 0x114]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004089c0
mov edx, dword [ebp - 0x114]
mov eax, dword [ebp - 8]
call fcn.00403c24
mov eax, dword [ebp - 4]
cmp byte [eax + 0x140], 0
je 0x4891ed
lea edx, [ebp - 0x118]
mov eax, dword [ebp - 4]
call fcn.00489464
push dword [ebp - 0x118]
push 0x48938c
mov eax, dword [ebp - 8]
push dword [eax]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.00403f10
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x489212
lea eax, [ebp - 0x118]
mov edx, 2
call fcn.00403bf4
ret
Function at 0x4895e4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x4bdb9c
cmp dword [edi], 0
jne 0x489660
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x4bdba0]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4bbfbc
mov ecx, 2
call fcn.00402848
mov edx, 0x4895c4
lea eax, [esi + 5]
call fcn.004895bc
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.004895bc
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x489635
mov dword [0x4bdba0], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x48f148
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x48f1d1
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x109]
call fcn.00409594
mov edx, dword [ebp - 0x110]
mov ecx, esi
mov eax, ebx
call fcn.00497b08
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_ILFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f1d8
lea eax, [ebp - 0x110]
call fcn.00403bd0
ret

Function at 0x48f1e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
xor edx, edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
xor eax, eax
push ebp
push 0x48f2c7
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x105]
call fcn.00409594
push dword [ebp - 0x110]
push 0x48f2e0
push 0x48f2ec
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.00403f10
mov eax, dword [ebp - 0x10c]
call fcn.00408e18
test al, al
jne 0x48f2a7
lea edx, [ebp - 0x118]
lea eax, [ebp - 0x105]
call fcn.00409594
push dword [ebp - 0x118]
push 0x48f2e0
push 0x48f304
lea eax, [ebp - 0x114]
mov edx, 3
call fcn.00403f10
mov eax, dword [ebp - 0x114]
call fcn.00408e18
test al, al
jne 0x48f2a7
xor ebx, ebx
jmp 0x48f2a9
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48f2ce
lea eax, [ebp - 0x118]
mov edx, 4
call fcn.00403bf4
ret
Function at 0x48faf4
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffe8
mov edi, ecx
mov esi, edx
mov ebp, eax
push 0x48fbb8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
test ebx, ebx
je 0x48fb20
push 0x48fbc8
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov ebx, eax
jmp 0x48fb22
xor ebx, ebx
test ebx, ebx
je 0x48fb50
push edi
push esi
lea eax, [esp + 0x18]
push eax
push ebp
call ebx
test eax, eax
jne 0x48fbae
mov dword [esi], 1
mov dword [esi + 4], 0
mov dword [edi], 1
mov dword [edi + 4], 0
jmp 0x48fbae
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
push ebp
call sub.kernel32.dll_GetDiskFreeSpaceA
test eax, eax
je 0x48fb94
mov eax, dword [esp + 0xc]
imul dword [esp]
imul dword [esp + 4]
xor edx, edx
mov dword [esi], eax
mov dword [esi + 4], edx
mov eax, dword [esp + 8]
imul dword [esp]
imul dword [esp + 4]
xor edx, edx
mov dword [edi], eax
mov dword [edi + 4], edx
jmp 0x48fbae
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [edi], 0
mov dword [edi + 4], 0
add esp, 0x18
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x495c70
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 1], dl
mov esi, eax
xor eax, eax
push ebp
push 0x495ecd
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, byte [0x4bdbd9]
mov byte [0x4bdbd9], 0xe
mov byte [0x4bdbda], 0
mov eax, esi
call fcn.004a1f74
mov cl, 1
mov edx, dword [esi + 0x714]
mov eax, esi
call fcn.004965c4
mov eax, dword [0x4bc388]
mov eax, dword [eax]
mov edx, dword [0x4bdcfc]
call fcn.00451438
lea edx, [ebp - 8]
mov eax, dword [0x4bc388]
mov eax, dword [eax]
call fcn.004513f0
mov edx, dword [ebp - 8]
mov eax, 0x4bdd1c
mov ecx, 0x3f
call fcn.00409454
push 0x4bdd04
push 1
call sub.shell32.dll_Shell_NotifyIconA
mov ecx, dword [0x4bdc64]
mov edx, dword [0x4bdc5c]
mov eax, esi
call fcn.0049c604
mov eax, dword [0x4bdbcc]
mov edx, dword [0x4bdcdc]
call fcn.00403f60
je 0x495d35
mov eax, 0x4bdbcc
mov edx, dword [0x4bdcdc]
call fcn.00403c24
mov eax, esi
call fcn.00496758
jmp 0x495d4a
cmp bl, 5
je 0x495d43
cmp byte [esi + 0x90c], 0
je 0x495d4a
mov eax, esi
call fcn.00496758
cmp byte [esi + 0x91d], 0
je 0x495d5c
mov dl, 1
mov eax, esi
call fcn.00498430
cmp byte [0x4bdd7c], 0
jne 0x495df9
cmp dword [esi + 0x918], 0
jle 0x495df9
mov dl, 1
mov eax, esi
call fcn.0049c6b0
mov eax, dword [esi + 0x918]
sub eax, 2
je 0x495d97
dec eax
je 0x495dca
dec eax
je 0x495dd9
dec eax
jne 0x495eb2
xor ecx, ecx
mov edx, 0x495ee4
mov eax, esi
call fcn.00497ff0
xor edx, edx
mov eax, esi
call fcn.00498430
cmp dword [esi + 0x918], 5
jne 0x495eb2
mov eax, dword [0x4bdbc4]
call fcn.0044e670
jmp 0x495eb2
mov eax, dword [0x4bdbc4]
call fcn.0044e670
jmp 0x495eb2
push 0
push 0xc
call sub.user32.dll_ExitWindowsEx
test eax, eax
je 0x495eb2
mov eax, dword [0x4bdbc4]
call fcn.0044e670
jmp 0x495eb2
lea ecx, [ebp - 0xc]
mov edx, dword [0x4bdbd0]
mov eax, esi
call fcn.00497b08
mov eax, dword [ebp - 0xc]
mov edx, dword [0x4bdce0]
call fcn.00403f60
jne 0x495e3e
cmp byte [ebp - 1], 0
jne 0x495e3e
cmp bl, 6
je 0x495e3e
cmp bl, 5
jne 0x495e51
mov eax, dword [esi + 0x5f8]
mov eax, dword [eax + 0x20c]
call fcn.0046838c
test eax, eax
jne 0x495e51
mov edx, dword [0x4bdce0]
mov eax, dword [esi + 0x724]
call fcn.00479b04
jmp 0x495eb2
mov eax, dword [0x4bdbd0]
call fcn.00403e50
dec eax
jle 0x495eab
mov eax, dword [esi + 0x5f8]
mov eax, dword [eax + 0x20c]
call fcn.0046838c
test eax, eax
jle 0x495eab
mov eax, dword [esi + 0x5f8]
mov eax, dword [eax + 0x20c]
xor edx, edx
call fcn.004683bc
mov eax, dword [eax + 0x24]
mov edx, 0x495f00
call fcn.00403f60
je 0x495eab
mov eax, dword [esi + 0x5f8]
call fcn.0047207c
mov edx, esi
mov eax, esi
call fcn.0049b63c
jmp 0x495eb2
mov eax, esi
call fcn.0049c238
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x495ed4
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403bf4
ret