joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4769e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x476a37
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0045762c
test al, al
je 0x476a37
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0045715c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x476a37
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0045715c
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret

Function at 0x47ad04
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47ad79
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00404bd4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404a48
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00404848
push eax
call sub.kernel32.dll_GetTempPathA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00404bd4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0047abd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ad80
lea eax, [ebp - 0xc]
call fcn.0040456c
ret

Function at 0x4819d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404a38
xor eax, eax
push ebp
push 0x481a80
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403038
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], 1
xor eax, eax
push ebp
push 0x481a57
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x30
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404a48
push eax
push 0
call sub.kernel32.dll_CreateProcessA
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x481a6a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x481a87
lea eax, [ebp - 4]
call fcn.0040456c
ret
Function at 0x482cfc
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x482e8b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x490ff4], 0
jne 0x482e70
test ebx, ebx
je 0x482e70
lea eax, [ebp - 4]
push eax
push 0x32
push 0
call sub.msacm32.dll_acmMetrics
mov eax, dword [ebp - 4]
call fcn.0040270c
mov esi, eax
mov edx, esi
mov eax, ebx
mov ecx, dword [ebp - 4]
call fcn.00402914
movzx eax, word [ebx + 0xc]
add eax, eax
mov dword [0x490ff0], eax
mov eax, 4
call fcn.0040270c
mov dword [0x490ff4], eax
push 0x10004
push 0
mov eax, edi
call fcn.0045715c
push eax
push esi
push 0
mov eax, dword [0x490ff4]
push eax
call sub.winmm.dll_waveInOpen
mov esi, eax
test esi, esi
je 0x482db6
lea edx, [ebp - 0xc]
mov eax, esi
call fcn.00408abc
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 0x482ea4
call fcn.00404894
mov eax, dword [ebp - 8]
call fcn.0043a6d8
jmp 0x482e70
mov byte [0x490fec], 0
mov edi, 3
mov eax, 0x20
call fcn.0040270c
mov eax, 1
call fcn.0040270c
mov eax, dword [0x490ff0]
call fcn.0040270c
mov esi, eax
mov eax, 0x20
call fcn.0040270c
mov ebx, eax
mov dword [ebx], esi
mov eax, dword [0x490ff0]
mov dword [ebx + 4], eax
xor eax, eax
mov dword [ebx + 8], eax
xor eax, eax
mov dword [ebx + 0xc], eax
xor eax, eax
mov dword [ebx + 0x10], eax
xor eax, eax
mov dword [ebx + 0x14], eax
push 0x20
push ebx
mov eax, dword [0x490ff4]
mov eax, dword [eax]
push eax
call sub.winmm.dll_waveInPrepareHeader
mov esi, eax
test esi, esi
je 0x482e2c
mov eax, 0x482ecc
call fcn.0043a6d8
push 0x20
push ebx
mov eax, dword [0x490ff4]
mov eax, dword [eax]
push eax
call sub.winmm.dll_waveInAddBuffer
mov esi, eax
test esi, esi
je 0x482e4c
mov eax, 0x482ee8
call fcn.0043a6d8
dec edi
jne 0x482dc2
mov eax, dword [0x490ff4]
mov eax, dword [eax]
push eax
call sub.winmm.dll_waveInStart
mov esi, eax
test esi, esi
je 0x482e70
mov eax, 0x482f04
call fcn.0043a6d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x482e92
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404590
ret
Function at 0x40a22555
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
and dword [esi], 0
push 0xe
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x40a22572
push 4
pop eax
jmp 0x40a22592
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
call fcn.40a22514
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop esi
pop ebp
ret 0x14

Function at 0x40a22c60
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
test eax, eax
jne 0x40a22c74
push 7
pop eax
jmp 0x40a22c93
push 0
lea ecx, [ebp + 8]
push ecx
push eax
call fcn.40a229af
test eax, eax
jne 0x40a22c88
push 4
jmp 0x40a22c71
push eax
push 2
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop ebp
ret 4

Function at 0x40a22e8c
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
and dword [esi], 0
push 2
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x40a22ea9
push 4
pop eax
jmp 0x40a22ec9
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
call fcn.40a22e04
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop esi
pop ebp
ret 0x14
Function at 0x40a23cf4
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x40a3306c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
push 0x100
lea eax, [ebp - 0x204]
push eax
movzx eax, word [esi + 0x3e]
push eax
mov dword [ebp - 0x408], 1
call edi
test eax, eax
je 0x40a23ea7
cmp dword [esi + 0x40], 0
push ebx
mov byte [ebp - 0x104], 0x20
lea eax, [ebp - 0x103]
je 0x40a23d70
push 0xff
push eax
movzx eax, word [esi + 0x3a]
push eax
mov dword [ebp - 0x408], 2
call edi
test eax, eax
jne 0x40a23dde
mov byte [ebp - 0x103], al
jmp 0x40a23dde
push 0x40a23eb8
push 0xff
push eax
call fcn.40a239ce
cmp dword [esi + 0x44], 0
mov ebx, 0xf000
je 0x40a23db4
mov eax, dword [esi + 0x4c]
and eax, ebx
cmp eax, 0x3000
jne 0x40a23db4
push 0xf2
lea eax, [ebp - 0xf7]
push eax
movzx eax, word [esi + 0x3a]
push eax
call edi
test eax, eax
jne 0x40a23db4
mov byte [ebp - 0xf7], al
mov eax, dword [esi + 0x4c]
test eax, 0x400
je 0x40a23dca
mov dword [ebp - 0x408], 2
jmp 0x40a23dde
test al, 5
jne 0x40a23dde
and eax, ebx
cmp eax, 0x1000
je 0x40a23dde
and dword [ebp - 0x408], 0
lea eax, [ebp - 0x204]
push eax
mov ebx, 0x200
push ebx
lea eax, [ebp - 0x404]
push eax
call fcn.40a239ce
test eax, eax
jl 0x40a23ea4
lea eax, [ebp - 0x104]
push eax
push ebx
lea eax, [ebp - 0x404]
push eax
call fcn.40a23a08
test eax, eax
jl 0x40a23ea4
movzx edi, word [ebp - 0x408]
mov esi, dword [sym.imp.KERNEL32.dll_WinExec]
push edi
lea eax, [ebp - 0x404]
push eax
call esi
cmp eax, 0x20
jae 0x40a23e39
xor eax, eax
test eax, eax
jne 0x40a23ea6
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x204]
jmp 0x40a23e63
cmp cl, 0x3a
je 0x40a23e6a
lea ecx, [ebp - 0x204]
cmp eax, ecx
je 0x40a23ea4
dec eax
mov cl, byte [eax]
cmp cl, 0x5c
jne 0x40a23e53
inc eax
push eax
push ebx
lea eax, [ebp - 0x404]
push eax
call fcn.40a239ce
test eax, eax
jl 0x40a23ea4
lea eax, [ebp - 0x104]
push eax
push ebx
lea eax, [ebp - 0x404]
push eax
call fcn.40a23a08
test eax, eax
jl 0x40a23ea4
push edi
lea eax, [ebp - 0x404]
push eax
call esi
cmp eax, 0x20
jae 0x40a23ea6
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.40a214d8
leave
ret 4

Function at 0x40a24529
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x44]
test eax, eax
jne 0x40a2453d
push 7
pop eax
jmp 0x40a24558
push 2
push eax
call fcn.40a2e787
test eax, eax
jne 0x40a2454d
push 4
jmp 0x40a2453a
push eax
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop ebp
ret 4

Function at 0x40a248f4
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x40a2490a
push 4
pop eax
jmp 0x40a24925
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
call fcn.40a248b3
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
xor eax, eax
pop ebp
ret 0x14
Function at 0x40a25d98
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x40]
test eax, eax
jne 0x40a25dad
push 7
pop eax
jmp 0x40a25dcb
push 2
push eax
call fcn.40a2e787
test eax, eax
jne 0x40a25dbd
push 4
jmp 0x40a25daa
push eax
movzx eax, word [esi + 0x38]
push eax
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop esi
pop ebp
ret 4

Function at 0x40a26203
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
and dword [esi], 0
push edi
mov di, word [ebp + 0x1c]
test di, di
jne 0x40a2621e
push 0xc
pop eax
jmp 0x40a2625f
movzx eax, di
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x40a26230
push 4
jmp 0x40a2621b
push dword [ebp + 0x20]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
call fcn.40a261b6
mov dword [esi], eax
test eax, eax
je 0x40a2622c
push dword [ebp + 0x18]
mov word [eax + 0x38], di
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov ecx, dword [esi]
mov word [ecx + 0x3a], ax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x1c

Function at 0x40a26f2a
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x40], 0
je 0x40a26f41
push 0xd
pop eax
jmp 0x40a26fdd
mov eax, dword [esi + 0x94]
cmp eax, 0x10
jb 0x40a26f5f
cmp eax, 0x15
ja 0x40a26f5f
push esi
call fcn.40a28eaf
cmp eax, 2
jne 0x40a26f5f
push eax
jmp 0x40a26f3b
cmp dword [esi + 0x10], 2
push edi
mov edi, dword [sym.imp.USER32.dll_SetClipboardData]
jne 0x40a26f85
push 2
push dword [esi + 0x70]
call fcn.40a2e787
test eax, eax
je 0x40a26f97
push eax
movzx eax, word [0x40a33030]
push eax
call edi
push esi
call fcn.40a26b5f
push 2
push eax
call fcn.40a2e787
test eax, eax
jne 0x40a26f9c
push 4
pop eax
jmp 0x40a26fdc
push eax
movzx eax, word [0x40a33024]
push eax
call edi
cmp dword [esi + 0x10], 1
jne 0x40a26fc9
cmp word [esi + 0x5c], 0
je 0x40a26fc9
push esi
call fcn.40a26d3a
test eax, eax
je 0x40a26fc9
push eax
movzx eax, word [0x40a3303c]
push eax
call edi
cmp dword [esi + 0x64], 0
je 0x40a26fda
mov esi, dword [esi + 0x64]
mov eax, dword [esi]
push esi
call dword [eax + 0x40]
jmp 0x40a26fdc
xor eax, eax
pop edi
pop esi
pop ebp
ret 4
Function at 0x40a2714e
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
push ebx
push esi
push edi
push 0xd0
push 0x42
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40a272c1
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
jne 0x40a27193
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40a272c1
push dword [ebp + 0x10]
or dword [esi + 0x20], 0xffffffff
and dword [esi + 0x50], 0
push esi
push dword [ebp + 0xc]
xor ebx, ebx
inc ebx
mov byte [esi + 4], 0x4c
mov byte [esi + 5], 0x45
mov dword [esi + 0x10], ebx
mov dword [esi], sym.OLECLI32.dll_LeQueryProtocol
mov dword [esi + 8], edi
call fcn.40a24ac5
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
cmp dword [0x40a33d38], 0
je 0x40a272bb
movzx eax, word [ebp + 0x20]
mov edi, dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
push eax
call edi
test eax, eax
jne 0x40a271e5
mov dword [esi + 0x40], ebx
lea eax, [ebp - 8]
push eax
push dword [0x40a33d38]
push esi
call fcn.40a26a7f
test eax, eax
je 0x40a272bb
push esi
call sym.OLECLI32.dll_SetNetName
mov dword [ebp - 4], eax
test eax, eax
je 0x40a2725e
movzx eax, word [0x40a3303c]
push eax
call edi
test eax, eax
je 0x40a272bb
movzx eax, word [0x40a3303c]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov ebx, eax
test ebx, ebx
je 0x40a272bb
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
je 0x40a272bb
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [esi + 0x5c], ax
test ax, ax
je 0x40a272bb
push esi
call fcn.40a26cd1
push 5
push dword [ebp - 8]
lea edi, [esi + 0x64]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.40a2aece
mov dword [ebp - 4], eax
test eax, eax
jne 0x40a272bb
push esi
call fcn.40a2677a
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov edi, dword [edi]
test edi, edi
je 0x40a27296
mov dword [edi + 0x34], esi
push 0
push esi
call fcn.40a234d9
test eax, eax
je 0x40a272c4
push 2
push 2
push esi
mov dword [esi + 0x4c], 0x18
call fcn.40a26c52
push esi
call fcn.40a29b77
jmp 0x40a272c4
push esi
call sym.OLECLI32.dll_OleDelete
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x1c
Function at 0x40a27af3
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, word [0x40a33024]
and dword [ebp - 4], 0
push eax
mov dword [ebp - 8], 4
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
jne 0x40a27b1f
push 0xb
pop eax
jmp 0x40a27c06
push edi
push 0xd0
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x40a27c02
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
jne 0x40a27b51
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40a27c01
push dword [ebp + 0x10]
or dword [esi + 0x20], 0xffffffff
push esi
push dword [ebp + 0xc]
mov byte [esi + 4], 0x4c
mov byte [esi + 5], 0x45
mov dword [esi + 0x10], 2
mov dword [esi], sym.OLECLI32.dll_LeQueryProtocol
mov dword [esi + 0x50], 3
mov dword [esi + 8], edi
call fcn.40a24ac5
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
mov eax, dword [0x40a33d38]
test eax, eax
je 0x40a27bfb
lea ecx, [ebp - 4]
push ecx
push eax
push esi
call fcn.40a26a7f
test eax, eax
je 0x40a27bfb
push esi
call fcn.40a272d0
movzx eax, word [0x40a33030]
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
push 2
push eax
call fcn.40a2e787
mov dword [esi + 0x70], eax
test eax, eax
je 0x40a27bfb
push 5
push dword [ebp - 4]
lea edi, [esi + 0x64]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.40a2aece
mov dword [ebp - 8], eax
test eax, eax
jne 0x40a27bfb
push esi
call fcn.40a2677a
mov eax, dword [ebp + 0x14]
mov dword [eax], esi
mov edi, dword [edi]
test edi, edi
je 0x40a27c01
mov dword [edi + 0x34], esi
jmp 0x40a27c01
push esi
call sym.OLECLI32.dll_OleDelete
pop esi
mov eax, dword [ebp - 8]
pop edi
leave
ret 0x18
Function at 0x40a2b3f8
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x40a3306c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x110], eax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x114], eax
movzx eax, word [0x40a33038]
push edi
push eax
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x40a2b4a5
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x40a2b4a5
cmp dword [ebp + 0x20], 1
jne 0x40a2b477
push esi
mov esi, 0x106
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.40a239ce
push 0x40a21d9c
push esi
lea eax, [ebp - 0x10c]
push eax
call fcn.40a23a08
lea esi, [ebp - 0x10c]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 2
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp - 0x114]
push dword [ebp - 0x110]
push dword [ebp + 0xc]
push 0
push esi
push str.Package
push ebx
call fcn.40a3bc36
jmp 0x40a2b4a8
push 0xb
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.40a214d8
leave
ret 0x1c

Function at 0x40a2b839
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push 0x10
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x40a2b895
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x40a2b88e
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push esi
push edi
lea esi, [ecx + 0x3c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
test edx, edx
je 0x40a2b876
mov dword [eax + 0xc], edx
jmp 0x40a2b87a
and dword [ecx + 0x48], 0
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
push 3
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
jmp 0x40a2b898
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push 4
pop eax
pop ebx
pop ebp
ret 8

Function at 0x40a2be00
Capabilities:
Read clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
and dword [esi], 0
push 3
call dword [sym.imp.USER32.dll_GetClipboardData]
test eax, eax
jne 0x40a2be1d
push 4
pop eax
jmp 0x40a2be3d
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
push eax
call fcn.40a2bdbf
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
pop esi
pop ebp
ret 0x14
Function at 0x40a2bece
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x1f4
push dword [ebp + 8]
mov dword [ebp - 4], 3
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
push ebx
push ebx
mov edi, eax
push 0x14b
push edi
call esi
mov byte [ebp + 0xa], bl
mov byte [ebp + 9], 0x3a
mov al, byte [ebp - 4]
add al, 0x41
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
jne 0x40a2bf2b
lea eax, [ebp + 8]
push eax
push ebx
push 0x143
push edi
call esi
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x1a
jl 0x40a2bf07
push ebx
push ebx
push 0x14e
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a2bfa1
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x40a3306c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 2
mov eax, 0x100
mov dword [ebp - 0x10c], eax
je 0x40a2c08e
push eax
lea eax, [ebp - 0x104]
push eax
movzx eax, word [esi + 0x3a]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
test eax, eax
jne 0x40a2bfee
push 7
pop eax
jmp 0x40a2c090
cmp byte [ebp - 0x103], 0x3a
jne 0x40a2c088
mov al, byte [ebp - 0x104]
mov byte [ebp - 0x108], al
push 1
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 0x106], 0
mov byte [ebp - 0x107], 0x3a
call dword [sym.imp.USER32.dll_CharUpperBuffA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
jne 0x40a2c039
push 0x1b
jmp 0x40a2bfe8
cmp eax, 4
jne 0x40a2c088
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.MPR.dll_WNetGetConnectionA
test eax, eax
jne 0x40a2c035
mov al, byte [ebp - 0x108]
mov byte [esi + 0x5e], al
movzx eax, word [esi + 0x5c]
test ax, ax
je 0x40a2c075
push eax
call dword [sym.imp.KERNEL32.dll_GlobalDeleteAtom]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
mov word [esi + 0x5c], ax
jmp 0x40a2c08e
push esi
call fcn.40a2bf74
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.40a214d8
leave
ret 4
Function at 0x40a2c0a4
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x40a3306c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp byte [edi], 0
mov ebx, 0x100
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x10c], ebx
jne 0x40a2c0ec
movzx eax, word [eax + 0x5c]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameA]
test eax, eax
je 0x40a2c155
mov byte [ebp - 0x106], 0
mov byte [ebp - 0x107], 0x3a
jmp 0x40a2c150
inc dword [esi]
mov al, byte [esi]
add al, 0x41
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 4
jne 0x40a2c150
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x10c], ebx
call sub.MPR.dll_WNetGetConnectionA
test eax, eax
jne 0x40a2c150
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40a2c168
cmp dword [esi], 0x1a
jl 0x40a2c0fc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.40a214d8
leave
ret 0xc
mov eax, dword [ebp - 0x110]
mov cl, byte [ebp - 0x108]
push eax
mov byte [eax + 0x5e], cl
call fcn.40a2be47
jmp 0x40a2c157
Function at 0x40a2c184
Capabilities:
Connect network resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xe8
mov eax, dword [0x40a3306c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sub eax, 0x110
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
je 0x40a2c2d9
dec eax
jne 0x40a2c2f9
mov ecx, dword [ebp + 0x10]
movzx eax, cx
dec eax
mov ebx, 0x40a33d1c
je 0x40a2c206
dec eax
je 0x40a2c2b5
sub eax, 0x1f4
jne 0x40a2c2f9
shr ecx, 0x10
mov eax, 0x200
cmp cx, ax
jne 0x40a2c2f9
push ebx
push edi
call dword [sym.imp.USER32.dll_GetPropA]
push eax
push 0
push 0xc
push 0x1f6
push edi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x40a2c2f9
mov esi, dword [sym.imp.USER32.dll_GetDlgItemTextA]
push 3
lea eax, [ebp - 0xe8]
push eax
push 0x1f4
push edi
call esi
push 0x20
lea eax, [ebp - 0x24]
push eax
push 0x1f5
push edi
call esi
push ebx
push edi
call dword [sym.imp.USER32.dll_GetPropA]
lea ecx, [ebp - 0xe8]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push eax
call sub.MPR.dll_WNetAddConnectionA
mov dword [ebp + 0x10], eax
test eax, eax
jne 0x40a2c26a
push ebx
push edi
call dword [sym.imp.USER32.dll_RemovePropA]
movsx eax, byte [ebp - 0xe8]
push eax
push edi
call dword [sym.imp.USER32.dll_EndDialog]
xor eax, eax
inc eax
jmp 0x40a2c2fb
mov esi, dword [sym.imp.USER32.dll_LoadStringA]
push 0x40
lea eax, [ebp - 0x64]
push eax
push 0x258
push dword [0x40a33050]
call esi
push 0x80
lea eax, [ebp - 0xe4]
push eax
push 0x259
push dword [0x40a33050]
call esi
push 5
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xe4]
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 2
jne 0x40a2c2c1
push ebx
push edi
call dword [sym.imp.USER32.dll_RemovePropA]
push 0
jmp 0x40a2c25b
cmp dword [ebp + 0x10], 0x55
jne 0x40a2c2cd
push edi
call fcn.40a2bece
push 0x40a33d34
push 0x1f5
jmp 0x40a2c2f2
push esi
push 0x40a33d1c
push edi
call dword [sym.imp.USER32.dll_SetPropA]
push edi
call fcn.40a2bece
push esi
push 0x1f6
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.40a214d8
leave
ret 0x10