joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], ecx
xor ebx, ebx
mov dword [ebp - 0x24], esi
push edi
mov dword [ebp - 0x10], 0
mov eax, dword [esi + 4]
lea edi, [esi + 0x38]
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax + 0x34]
mov edx, dword [eax + 8]
mov dword [ebp - 0x20], ecx
mov ecx, dword [eax + 0xc]
mov eax, dword [esi + 0x34]
mov dword [ebp - 8], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0xc], eax
cmp eax, 4
jg 0x450deb
cmp eax, 2
setle bl
add ebx, 2
jmp 0x450df1
cmp eax, 0x10
setle bl
push ecx
mov ecx, ebx
mov eax, 1
shl eax, cl
dec edx
add edx, eax
shr edx, cl
mov ecx, esi
call fcn.00450ab0
add esp, 4
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x450f61
mov eax, dword [ebp - 8]
cdq
mov ecx, eax
mov dword [ebp - 0x14], edx
or eax, edx
mov dword [ebp - 0x10], ecx
je 0x450e4b
push edx
push ecx
push 0x100
push 0
call fcn.004f64a0
test edx, edx
jb 0x450e5b
ja 0x450e3e
cmp eax, 1
jb 0x450e5b
mov ecx, dword [ebp - 0x10]
cmp ecx, ecx
jne 0x450e5b
cmp dword [ebp - 0x14], 0
jne 0x450e5b
push ecx
call fcn.00497d2b
add esp, 4
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x450e67
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [esi + 8]
mov ecx, dword [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
push dword [ebp - 0x18]
mov ebx, dword [ebp - 0xc]
push dword [ebp - 8]
push ebx
push edi
push dword [esi + 0x14]
push dword [eax + 0x38]
call fcn.00450b90
mov ecx, dword [ebp - 4]
mov edx, 1
push 1
call fcn.0045e980
mov ecx, dword [ebp - 4]
add esp, 0x24
mov edx, 2
push 3
call fcn.0045e980
mov ecx, dword [ebp - 4]
lea eax, [ebx - 1]
add esp, 4
mov edx, 8
push eax
call fcn.0045e980
dec ebx
add esp, 4
cmp ebx, 1
jl 0x450f28
mov esi, dword [edi + ebx*4 - 4]
mov eax, esi
mov edi, dword [edi + ebx*4]
and eax, 0xff00ff00
mov edx, edi
mov ecx, edi
and edx, 0xff00
and ecx, 0xffff00ff
sub edx, eax
and edi, 0xff00ff00
mov eax, esi
sub edx, 0xff01
and eax, 0xff00ff
and esi, 0xff00ff00
sub ecx, eax
sub edi, esi
mov esi, dword [ebp - 0x24]
add ecx, 0xff00
xor edx, ecx
add edi, 0xff00ff
and edx, 0xff00ff
xor edx, edi
lea edi, [esi + 0x38]
mov dword [edi + ebx*4], edx
dec ebx
cmp ebx, 1
jge 0x450ec6
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
lea eax, [esi + 0x438]
push 1
push dword [ebp - 0xc]
mov edx, edi
push eax
lea eax, [esi + 0x468]
push eax
call fcn.00450040
add esp, 0x14
mov esi, eax
push dword [ebp - 0x10]
call fcn.00497724
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
call fcn.00497724
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45f020
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movdqa xmm0, xmmword [0x55a170]
mov edx, ecx
paddd xmm0, xmmword [0x55a130]
push ebx
mov ebx, 1
mov dword [ebp - 0x18], edx
mov eax, dword [edx + 0x18]
mov dword [ebp - 4], eax
push edi
mov edi, ebx
mov dword [ebp - 0x10], edi
movdqu xmmword [ebp - 0x28], xmm0
cmp eax, ebx
jle 0x45f16a
push esi
lea ecx, [edx + 0x474]
lea esi, [edx + 0x720]
mov dword [ebp - 8], ecx
mov dword [ebp - 0x14], esi
lea ecx, [ecx]
xor edx, edx
mov dword [ebp - 0xc], 0
test ebx, ebx
jle 0x45f0af
mov eax, dword [ebp - 0x18]
mov ecx, dword [esi - 4]
add eax, 0x444
cmp ecx, dword [eax - 4]
jne 0x45f096
mov ecx, dword [esi]
cmp ecx, dword [eax]
je 0x45f0a2
mov ecx, dword [esi - 4]
inc edx
add eax, 0x2dc
cmp edx, ebx
jl 0x45f088
jmp 0x45f0a9
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc], 0
mov dword [ebp + edi*4 - 0x28], edx
jne 0x45f0e0
cmp ebx, edi
je 0x45f0d6
mov edi, dword [ebp - 8]
add esi, 0xfffffd54
mov ecx, 0xb7
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
inc ebx
add ecx, 0x2dc
mov dword [ebp - 8], ecx
inc edi
add esi, 0x2dc
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], esi
cmp edi, eax
jl 0x45f070
cmp ebx, eax
jge 0x45f169
mov edi, dword [ebp - 0x18]
mov esi, dword [edi + 0x2c]
imul esi, dword [edi + 0x28]
test esi, esi
jle 0x45f139
jmp 0x45f110
mov eax, dword [edi + 0x5558]
dec esi
mov ecx, dword [eax + esi*8]
lea edx, [eax + esi*8]
mov eax, ecx
shr eax, 5
and eax, 3
mov eax, dword [ebp + eax*4 - 0x28]
shl eax, 5
xor eax, ecx
and eax, 0x60
xor eax, ecx
mov dword [edx], eax
test esi, esi
jg 0x45f110
imul eax, ebx, 0x2dc
mov dword [edi + 0x18], ebx
lea edx, [eax + edi]
add eax, 0x198
add eax, edi
sub dword [ebp - 4], ebx
nop
mov edi, eax
lea esi, [edx - 0x144]
mov ecx, 0xb7
add eax, 0x2dc
dec dword [ebp - 4]
rep movsd dword es:[edi], dword [esi]
jne 0x45f150
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4669d0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9136
mov eax, dword fs:[0]
push eax
sub esp, 0x854
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [ebp - 0x858]
mov dword [ebp - 0x858], esi
push eax
lea eax, [ebp - 0x85c]
push eax
call fcn.004675b0
mov eax, dword [ebp - 0x85c]
cmp eax, dword [0x5c9e00]
je 0x466a39
add eax, 0x14
cmp dword [eax + 0x14], 8
jb 0x466b17
mov eax, dword [eax]
jmp 0x466b17
push 0x400
lea eax, [ebp - 0x820]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x820], 0
je 0x466b28
lea eax, [ebp - 0x820]
push eax
lea ecx, [ebp - 0x838]
call fcn.00466fc0
push eax
lea eax, [ebp - 0x858]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x854]
call fcn.00468570
push eax
mov byte [ebp - 4], 1
call fcn.00468ac0
push eax
add eax, 0x10
push eax
push ecx
lea eax, [ebp - 0x860]
push eax
call fcn.00468af0
cmp dword [ebp - 0x83c], 8
jb 0x466ab9
push dword [ebp - 0x850]
call fcn.0049494e
add esp, 4
xor eax, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x824], 8
mov dword [ebp - 0x83c], 7
mov dword [ebp - 0x840], 0
mov word [ebp - 0x850], ax
jb 0x466af4
push dword [ebp - 0x838]
call fcn.0049494e
add esp, 4
xor eax, eax
mov dword [ebp - 0x824], 7
mov word [ebp - 0x838], ax
lea eax, [ebp - 0x820]
mov dword [ebp - 0x828], 0
push eax
call fcn.004667c0
add esp, 4
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 0x466b80
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
Function at 0x46a3c0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, ecx
mov ebx, edx
test edi, edi
je 0x46a473
test ebx, ebx
je 0x46a473
push esi
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 4], eax
test eax, eax
je 0x46a467
push eax
call fcn.0046c16c
mov esi, eax
add esp, 4
test esi, esi
jne 0x46a40a
pop esi
pop edi
mov eax, 0x8007000e
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push dword [ebp - 4]
push 0
push edi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x46a45e
lea eax, [ebp - 4]
mov dword [ebp - 8], 0
push eax
lea eax, [ebp - 8]
push eax
push 0x559ed0
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x46a45e
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x46a45e
mov eax, dword [ecx + 8]
mov dword [ebx + 4], eax
mov eax, dword [ecx + 0xc]
push esi
mov dword [ebx], eax
call fcn.00496c20
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call fcn.00496c20
add esp, 4
pop esi
pop edi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
mov eax, 0x80070057
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46a4b0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
test esi, esi
jne 0x46a4de
mov eax, 0x80070057
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x120]
mov dword [ebp - 0x120], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x46a51e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x46a591
movzx eax, ax
or eax, 0x80070000
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x11c]
cmp eax, 6
ja 0x46a589
jne 0x46a55a
cmp dword [ebp - 0x118], 1
jae 0x46a589
mov eax, dword [ebp - 0x114]
cmp eax, 0x1772
ja 0x46a589
jae 0x46a573
mov dword [esi], 3
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
jae 0x46a534
mov dword [esi], 1
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
push 0x559ed4
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x46a5a0
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [esi], 0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x144]
test eax, eax
je 0x46a5bd
cmp eax, 9
jne 0x46a55c
mov ecx, dword [ebp - 4]
xor eax, eax
mov dword [esi], 2
xor ecx, ebp
pop esi
call fcn.0049493f
mov esp, ebp
pop ebp
ret
Function at 0x46b5e0
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions
Get cpu information
Query or enumerate registry value

Disassembly:
sub esp, 0x34
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
mov ebx, ecx
push eax
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46b6b3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [esp + 0x10]
push eax
lea esi, [ebx + 0x658]
mov dword [esp + 0x14], 4
push esi
push 0
push 0
push str.MHz
push dword [esp + 0x28]
call edi
test eax, eax
je 0x46b676
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0
push str.Mhz
push dword [esp + 0x28]
call edi
test eax, eax
je 0x46b676
lea eax, [esp + 0x10]
push eax
push esi
push 0
push 0
push str.mhz
push dword [esp + 0x28]
call edi
test eax, eax
je 0x46b676
mov dword [esi], 0
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x100
push eax
lea esi, [ebx + 0x458]
push esi
push 0
push 0
push str.ProcessorNameString
push dword [esp + 0x28]
call edi
test eax, eax
je 0x46b6a9
push 0x5506e8
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x48], 0
je 0x46b7ab
cmp dword [ebx + 0x440], 0
je 0x46b7ab
lea eax, [esp + 0x3c]
mov dword [ebx + 0x43c], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x46b7ab
mov ebp, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x34]
push eax
call ebp
test eax, eax
je 0x46b7ab
pushaw
cpuid
rdtsc
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edx
popaw
lea eax, [esp + 0x1c]
push eax
call ebp
test eax, eax
je 0x46b7ab
lea esp, [esp]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x38]
cmp edx, eax
jl 0x46b7ab
mov esi, dword [esp + 0x34]
mov ecx, dword [esp + 0x1c]
jg 0x46b73a
cmp ecx, esi
jb 0x46b7ab
sub ecx, esi
mov esi, dword [esp + 0x3c]
sbb edx, eax
mov eax, dword [esp + 0x40]
shrd esi, eax, 2
sar eax, 2
cmp edx, eax
jg 0x46b76c
jl 0x46b757
cmp ecx, esi
jae 0x46b76c
lea eax, [esp + 0x1c]
push eax
call ebp
test eax, eax
jne 0x46b720
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
pushaw
cpuid
rdtsc
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], edx
popaw
mov ecx, dword [esp + 0x24]
sub ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
sbb eax, dword [esp + 0x30]
push 0
shld eax, ecx, 2
push 0xf4240
shl ecx, 2
push eax
push ecx
call fcn.00496ab0
mov ecx, dword [esp + 0x18]
mov dword [ecx + 0x43c], eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret 4
Function at 0x46b7c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x240
lea eax, [ecx + 0x41c]
mov dword [ebp - 4], ecx
xorps xmm0, xmm0
mov dword [0x5c25f8], 0
push 0
push eax
movdqu xmmword [0x5c2604], xmm0
call fcn.00496b90
add esp, 0xc
pushaw
pushfd
pop eax
mov ecx, eax
xor eax, 0x40000
push eax
popfd
pushfd
pop eax
xor eax, ecx
mov dword [0x5c25f4], 1
je 0x46b884
push ecx
popfd
mov dword [0x5c25f4], 2
mov eax, ecx
xor eax, 0x200000
push eax
popfd
pushfd
pop eax
xor eax, ecx
je 0x46b884
mov dword [0x5c25f8], 1
mov eax, 0
cpuid
mov dword [0x5c2604], ebx
mov dword [0x5c2608], edx
mov dword [0x5c260c], ecx
cmp eax, 1
jb 0x46b884
mov eax, 1
cpuid
mov dword [0x5c25f4], eax
mov dword [0x5c25fc], edx
mov eax, 0x80000000
cpuid
cmp eax, 0x80000001
jb 0x46b884
mov eax, 0x80000001
cpuid
mov dword [0x5c2600], edx
popaw
mov ebx, dword [ebp - 4]
mov ecx, 0x5c2604
lea edx, [ebx + 0x42c]
sub edx, ecx
mov al, byte [ecx]
lea ecx, [ecx + 1]
mov byte [edx + ecx - 1], al
test al, al
jne 0x46b896
cmp dword [0x5c25f8], 0
jne 0x46b8bc
mov eax, dword [0x5c25f4]
mov dword [ebx + 0x41c], eax
jmp 0x46b95f
mov dword [ebx + 0x440], 1
mov eax, dword [0x5c25fc]
test eax, 0x800000
je 0x46b8e1
mov dword [ebx + 0x444], 1
mov eax, dword [0x5c25fc]
test eax, 0x8000
je 0x46b8f7
mov dword [ebx + 0x448], 1
mov eax, dword [0x5c25fc]
test eax, 0x2000000
je 0x46b908
mov dword [ebx + 0x44c], 1
test dword [0x5c2600], 0x80000000
je 0x46b91e
mov dword [ebx + 0x450], 1
mov eax, dword [0x5c25f4]
shr eax, 0xc
and eax, 3
mov dword [ebx + 0x41c], eax
mov eax, dword [0x5c25f4]
shr eax, 8
and eax, 0xf
mov dword [ebx + 0x420], eax
mov eax, dword [0x5c25f4]
shr eax, 4
and eax, 0xf
mov dword [ebx + 0x424], eax
mov eax, dword [0x5c25f4]
and eax, 0xf
mov dword [ebx + 0x428], eax
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x14]
mov ecx, ebx
push dword [ebp + 8]
mov dword [ebx + 0x454], eax
call fcn.0046b5e0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x46c5c0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebp
ret

Function at 0x46d1e0
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
jne 0x46d1ff
push str.kcFile_:
call fcn.0046c180
add esp, 4
or eax, 0xffffffff
pop esi
pop ecx
ret 8
test byte [esi + 4], 1
jne 0x46d21d
lea eax, [esi + 0xc]
push eax
push 0x4feb1c
call fcn.0046c360
add esp, 8
mov byte [0], 0
push 0
lea eax, [esp + 8]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x46d257
call fcn.0046f0b0
lea eax, [esi + 0xc]
push eax
push str.Read_file_failed_:__d
call fcn.0046c210
add esp, 8
or eax, 0xffffffff
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
add dword [esi + 0x20c], eax
pop esi
pop ecx
ret 8

Function at 0x46d2c0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
cmp dword [esi + 8], 0xffffffff
je 0x46d31a
test byte [esi + 4], 2
jne 0x46d2e8
lea eax, [esi + 0xc]
push eax
push 0x4feb7c
call fcn.0046c360
add esp, 8
mov byte [0], 0
push 0
lea eax, [esp + 8]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x46d322
call fcn.0046f0b0
lea eax, [esi + 0xc]
push eax
push str.Write_file_failed_:__d
call fcn.0046c210
add esp, 8
or eax, 0xffffffff
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
add dword [esi + 0x20c], eax
pop esi
pop ecx
ret 8
Function at 0x472d00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x10], eax
lea eax, [esi + 4]
push eax
push 0
push esi
push 0x472d40
push 0
push 0
call fcn.00496f92
xor ecx, ecx
mov dword [esi], eax
add esp, 0x18
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop esi
pop ebp
ret 8
Function at 0x474010
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x50
lea eax, [esp + 0x10]
push esi
mov esi, dword [sym.imp.USER32.dll_SetRectEmpty]
push edi
push eax
mov edi, ecx
call esi
lea eax, [esp + 0x38]
push eax
call esi
lea eax, [esp + 8]
push eax
call esi
lea eax, [esp + 0x28]
push eax
call esi
lea eax, [esp + 0x48]
push eax
call esi
mov esi, dword [esp + 0x64]
mov eax, dword [esi + 0x18]
cmp eax, dword [edi + 0x18]
je 0x474056
pop edi
xor eax, eax
pop esi
add esp, 0x50
ret 0x1c
mov ecx, dword [esp + 0x68]
mov eax, dword [esp + 0x70]
add eax, ecx
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x74]
add eax, ecx
mov dword [esp + 0x1c], ecx
mov ecx, dword [esi + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esi + 4]
push ebx
mov ebx, dword [sym.imp.USER32.dll_IntersectRect]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
lea eax, [esp + 0x34]
mov dword [esp + 0x18], 0
push eax
mov dword [esp + 0x24], ecx
call ebx
test eax, eax
jne 0x4740bd
pop ebx
pop edi
pop esi
add esp, 0x50
ret 0x1c
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x60]
sub eax, edx
add eax, ecx
mov dword [esp + 0x3c], ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x44], eax
mov eax, dword [esp + 0x38]
push ebp
mov ebp, dword [esp + 0x34]
sub eax, ebp
add eax, ecx
mov dword [esp + 0x6c], edx
mov dword [esp + 0x4c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 8]
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x48], ecx
push eax
lea eax, [esp + 0x58]
mov dword [esp + 0x18], 0
push eax
mov dword [esp + 0x20], 0
call ebx
test eax, eax
jne 0x47412f
pop ebp
pop ebx
pop edi
pop esi
add esp, 0x50
ret 0x1c
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov ebx, dword [esp + 0x54]
sub eax, edx
mov dword [esp + 0x78], eax
mov eax, dword [esp + 0x5c]
sub eax, ebx
mov dword [esp + 0x74], edx
mov dword [esp + 0x70], eax
je 0x4741b7
cmp edx, dword [edi + 4]
jae 0x47416e
cmp ebx, dword [edi + 8]
jae 0x47416e
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
imul ecx, ebx
imul eax, edx
add ecx, eax
add ecx, dword [edi + 0xc]
jmp 0x474170
xor ecx, ecx
mov eax, dword [esp + 0x6c]
cmp eax, dword [esi + 4]
jae 0x474193
cmp ebp, dword [esi + 8]
jae 0x474193
mov edx, dword [esi + 0x14]
mov eax, dword [esi + 0x18]
imul eax, dword [esp + 0x6c]
imul edx, ebp
add edx, eax
add edx, dword [esi + 0xc]
jmp 0x474195
xor edx, edx
mov eax, dword [edi + 0x18]
imul eax, dword [esp + 0x78]
push eax
push edx
push ecx
call fcn.00479080
mov edx, dword [esp + 0x80]
add esp, 0xc
inc ebx
inc ebp
dec dword [esp + 0x70]
jne 0x474151
pop ebp
pop ebx
pop edi
mov eax, 1
pop esi
add esp, 0x50
ret 0x1c
Function at 0x474950
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x58], 1
jne 0x47499f
push ebx
xor ebx, ebx
cmp dword [esi + 8], ebx
jbe 0x474997
push edi
mov eax, dword [esi + 0x14]
xor edi, edi
imul eax, ebx
add eax, dword [esi + 0xc]
cmp dword [esi + 4], edi
jbe 0x474990
movzx edx, byte [eax + 2]
inc edi
movzx ecx, byte [eax]
xor ecx, edx
mov byte [eax], cl
movzx ecx, cl
xor ecx, edx
xor byte [eax], cl
mov byte [eax + 2], cl
add eax, dword [esi + 0x18]
cmp edi, dword [esi + 4]
jb 0x474972
inc ebx
cmp ebx, dword [esi + 8]
jb 0x474962
pop edi
mov dword [esi + 0x58], 0
pop ebx
pop esi
ret

Function at 0x47a550
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
mov eax, dword [0x58f080]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
mov ebp, dword [esp + 0x224]
mov ebx, 1
push esi
push edi
mov edi, dword [esp + 0x230]
cmp ebp, 0xb
ja case.default.0x47a584
jmp dword [ebp*4 + 0x47a6d0]
mov esi, 0x10
jmp 0x47a5f1
mov esi, 0x19
jmp 0x47a5f1
mov esi, 0xb
jmp 0x47a5f1
mov esi, 2
jmp 0x47a5f1
mov esi, 0x17
jmp 0x47a5f1
mov esi, 5
jmp 0x47a5f1
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x47a6b2
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47a6b2
mov esi, 0x23
jmp 0x47a5f1
mov esi, 0x1a
jmp 0x47a5f1
mov esi, 0x26
jmp 0x47a5f1
mov esi, 0x27
push edi
push 0
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jns 0x47a6b2
push 0
push esi
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jns 0x47a6b2
jmp dword [ebp*4 + 0x47a700]
xor ebx, ebx
mov ecx, dword [esp + 0x224]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049493f
add esp, 0x218
ret

Function at 0x47d430
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x804
mov eax, dword [0x58f080]
xor eax, esp
mov dword [esp + 0x800], eax
mov eax, dword [esp + 0x808]
push esi
push edi
mov edi, dword [esp + 0x814]
mov esi, ecx
push eax
lea eax, [esp + 0xc]
push eax
mov dword [edi], 1
call fcn.0047a490
add esp, 8
lea eax, [esp + 8]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi], eax
test eax, eax
je 0x47d49b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x47d49b
cmp eax, 6
mov eax, esi
je 0x47d49d
mov dword [edi], 0
jmp 0x47d49d
mov eax, esi
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.0049493f
add esp, 0x804
ret 8
Function at 0x483830
Capabilities:
Get disk information

Disassembly:
sub esp, 0x24
mov eax, dword [0x58f080]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov esi, ecx
mov ecx, dword [esp + 0x2c]
mov eax, dword [esi]
test ecx, ecx
je 0x48384d
shr eax, cl
test al, 1
jne 0x483865
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0049493f
add esp, 0x24
ret 4
lea eax, [esp + 4]
push eax
push ecx
mov ecx, esi
call fcn.00483750
test eax, eax
je 0x483851
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
push eax
mov ecx, esi
call fcn.004837d0
mov ecx, dword [esp + 0x24]
pop esi
xor ecx, esp
call fcn.0049493f
add esp, 0x24
ret 4

Function at 0x485c80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa454
mov eax, dword fs:[0]
push eax
mov eax, 0x1314
call fcn.00496b60
mov eax, dword [0x58f080]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x1110]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push esi
lea eax, [ebp - 0x1110]
push eax
lea eax, [ebp - 0x910]
push 2
push eax
call fcn.00479620
add esp, 0x10
lea ecx, [ebp - 0x1320]
call fcn.0046cdd0
push 0x101
lea eax, [ebp - 0x910]
mov dword [ebp - 4], 0
push eax
lea ecx, [ebp - 0x1320]
call fcn.0046d0b0
test eax, eax
je 0x485d63
lea ecx, [ebp - 0x1320]
call fcn.0046d010
mov esi, eax
lea eax, [ebp - 0x110]
push 0x100
push eax
call fcn.00479960
add esp, 8
lea eax, [ebp - 0x110]
lea ecx, [ebp - 0x1320]
push esi
push eax
call fcn.0046d1e0
cmp eax, esi
jne 0x485d63
lea eax, [ebp - 0x110]
lea edx, [edi + 0x41a]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx + eax - 1], cl
test cl, cl
jne 0x485d56
lea ecx, [ebp - 0x1320]
mov dword [ebp - 4], 0xffffffff
call fcn.0046ce10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0049493f
mov esp, ebp
pop ebp
ret 4