joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479190
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.0040fa47
add esp, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, 1
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0040f98e
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.0041071d
add esp, 8
mov byte [ebp - 1], 1
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
jmp 0x4791fa
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 8]
jg 0x479268
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
movzx ecx, word [eax + edx*2]
cmp ecx, 0x5c
jne 0x479266
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov cx, word [eax + edx*2]
mov word [ebp - 0x18], cx
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0xc]
mov word [eax + edx*2], 0
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47924f
push 0
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x47924f
mov byte [ebp - 1], 0
jmp 0x479268
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dx, word [ebp - 0x18]
mov word [ecx + eax*2], dx
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x4791f1
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.00410b2a
add esp, 4
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret
Function at 0x479460
Capabilities:
Check if file exists
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x479486
jmp 0x479618
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47949e
jmp 0x479618
mov word [ebp - 0x210], 0
push 0x206
push 0
lea edx, [ebp - 0x20e]
push edx
call fcn.004101c0
add esp, 0xc
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.004101c0
add esp, 0xc
lea ecx, [ebp - 0x420]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.004792d0
add esp, 8
mov dword [ebp - 0x214], 0
mov dword [ebp - 0x424], 0
mov ecx, 1
test ecx, ecx
je 0x479618
mov dword [ebp - 0x428], 1
mov word [ebp - 0x630], 0
push 0x206
push 0
lea edx, [ebp - 0x62e]
push edx
call fcn.004101c0
add esp, 0xc
cmp dword [ebp - 0x424], 0
jne 0x479578
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x420]
push ecx
push str._s_s.del
lea edx, [ebp - 0x630]
push edx
call fcn.00410930
add esp, 0x10
jmp 0x4795a1
mov eax, dword [ebp - 0x424]
push eax
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x420]
push edx
push str._s_s.del_d
lea eax, [ebp - 0x630]
push eax
call fcn.00410930
add esp, 0x14
lea ecx, [ebp - 0x630]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4795c5
lea edx, [ebp - 0x630]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
jne 0x4795ed
cmp dword [ebp - 0x424], 0xa
jl 0x4795d9
jmp 0x479618
mov eax, dword [ebp - 0x424]
add eax, 1
mov dword [ebp - 0x424], eax
jmp 0x479515
lea ecx, [ebp - 0x630]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.004141e8
add esp, 8
push 5
push 0
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x479618
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret
Function at 0x479890
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x28], ecx
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x4798bb
xor al, al
jmp 0x479929
push str.SHGetKnownFolderPath
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4798d7
xor al, al
jmp 0x479929
lea ecx, [ebp - 0x18]
push ecx
push str.A520A1A4_1780_4FF6_BD18_167343C5AF16
call dword [sym.imp.ole32.dll_CLSIDFromString]
lea edx, [ebp - 4]
push edx
push 0
push 0x400
lea eax, [ebp - 0x18]
push eax
call dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jge 0x479905
xor al, al
jmp 0x479929
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041071d
add esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x479927
xor al, al
jmp 0x479929
mov al, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret 8

Function at 0x479940
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x49fa24
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x479985
push str.AppDataLocalLow
mov edx, dword [ebp + 8]
push edx
call fcn.004106f3
add esp, 8
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x479981
xor al, al
jmp 0x479987
mov al, 1
jmp 0x479987
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x479990
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x12c], ecx
push 0x11c
push 0
lea eax, [ebp - 0x128]
push eax
call fcn.004101c0
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea ecx, [ebp - 0x128]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jne 0x479a01
cmp dword [ebp - 0x120], 0
je 0x4799f1
cmp dword [ebp - 0x120], 1
jne 0x479a01
movzx edx, byte [ebp - 0xe]
cmp edx, 1
jne 0x479a01
mov eax, 1
jmp 0x479a03
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret
Function at 0x479ae0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x62c], ecx
mov word [ebp - 0x420], 0
push 0x206
push 0
lea eax, [ebp - 0x41e]
push eax
call fcn.004101c0
add esp, 0xc
push 0x49fb3c
lea ecx, [ebp - 0x420]
push ecx
call fcn.0041071d
add esp, 8
push 0x49fb50
lea edx, [ebp - 0x420]
push edx
call fcn.004106f3
add esp, 8
mov ecx, dword [ebp - 0x62c]
add ecx, 0x3c
call fcn.00401210
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.0041071d
add esp, 8
mov ecx, dword [ebp - 0x62c]
add ecx, 0x20
call fcn.00401210
push eax
lea ecx, [ebp - 0x628]
push ecx
call fcn.0041071d
add esp, 8
lea edx, [ebp - 4]
push edx
push 2
push 0
lea eax, [ebp - 0x420]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x479be3
push 0x104
lea ecx, [ebp - 0x210]
push ecx
push 1
push 0
push 0x49fb70
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x104
lea eax, [ebp - 0x628]
push eax
push 1
push 0
push 0x49fb88
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret

Function at 0x479c70
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
call fcn.004788d0
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
call fcn.004786c0
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
call fcn.00478960
mov ecx, dword [ebp - 4]
mov dword [ecx + 0xc], eax
call fcn.004786e0
mov edx, dword [ebp - 4]
mov dword [edx + 0x10], eax
call fcn.004787c0
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x14], eax
call fcn.00478750
mov edx, dword [ebp - 4]
mov dword [edx + 0x18], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [eax + 4], edx
mov eax, dword [ebp - 4]
add eax, 0x110
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 4]
add ecx, 0x128
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
add edx, 0x118
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 4]
add eax, 0x158
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 4]
add ecx, 0x138
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edx, dword [ebp - 4]
add edx, 0x148
push edx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [ebp - 4]
mov ecx, dword [0x4be51c]
mov dword [eax + 0x100], ecx
mov esp, ebp
pop ebp
ret
Function at 0x479db0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004101c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x21c]
call fcn.00479c00
movzx edx, al
test edx, edx
jne 0x479e44
push 0
push 0x1a
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
setne cl
mov byte [ebp - 0x215], cl
lea edx, [ebp - 0x210]
push edx
call fcn.0040fa47
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x479e44
jmp 0x479eb5
push 0x49fb08
lea eax, [ebp - 0x210]
push eax
call fcn.004106f3
add esp, 8
push 0x49fb0c
lea ecx, [ebp - 0x210]
push ecx
call fcn.004106f3
add esp, 8
push 0x49fb38
lea edx, [ebp - 0x210]
push edx
call fcn.004106f3
add esp, 8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x479ea0
lea ecx, [ebp - 0x210]
push ecx
call fcn.00479190
add esp, 4
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x21c]
add ecx, 0x20
call fcn.004011d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret

Function at 0x479ed0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004101c0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x218]
call fcn.00479c00
movzx edx, al
test edx, edx
jne 0x479f59
push 0
push 0x1a
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x210]
push ecx
call fcn.0040fa47
add esp, 4
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x479f59
jmp 0x479fca
push 0x49fae0
lea edx, [ebp - 0x210]
push edx
call fcn.004106f3
add esp, 8
push 0x49fae4
lea eax, [ebp - 0x210]
push eax
call fcn.004106f3
add esp, 8
push 0x49fb04
lea ecx, [ebp - 0x210]
push ecx
call fcn.004106f3
add esp, 8
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x479fb5
lea eax, [ebp - 0x210]
push eax
call fcn.00479190
add esp, 4
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x218]
add ecx, 0x3c
call fcn.004011d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret
Function at 0x47a810
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x49f750
mov ecx, dword [ebp - 0x214]
add ecx, 0x3c
call fcn.00401210
push eax
push str._s_s_
lea eax, [ebp - 0x210]
push eax
call fcn.00410930
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47a871
lea edx, [ebp - 0x210]
push edx
call fcn.00479190
add esp, 4
push str.Related.ini
lea eax, [ebp - 0x210]
push eax
call fcn.004106f3
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0xac
call fcn.004011d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret

Function at 0x47a8b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], ecx
push 0x49f71c
mov ecx, dword [ebp - 0x214]
add ecx, 0x3c
call fcn.00401210
push eax
push 0x49f72c
lea eax, [ebp - 0x210]
push eax
call fcn.00410930
add esp, 0x10
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47a911
lea edx, [ebp - 0x210]
push edx
call fcn.00479190
add esp, 4
push str.Config.ini
lea eax, [ebp - 0x210]
push eax
call fcn.004106f3
add esp, 8
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x214]
add ecx, 0x58
call fcn.004011d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret
Function at 0x47b8e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0xc], 0
jne 0x47b8f4
jmp 0x47b927
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0xc], 0
mov esp, ebp
pop ebp
ret

Function at 0x47bda0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004101c0
add esp, 0xc
mov word [ebp - 0x418], 0
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.004101c0
add esp, 0xc
mov ecx, dword [ebp - 0x41c]
add ecx, 0x280
call fcn.00401210
push eax
push 0x104
lea edx, [ebp - 0x210]
push edx
push 0x49fd94
push 0x49fd98
push 0x49fda0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 0x41c]
add ecx, 0x280
call fcn.00401210
push eax
push 0x104
lea eax, [ebp - 0x418]
push eax
push 0x49fdb4
push str.MinVer
push 0x49fdc8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x41c]
add ecx, 0x300
call fcn.004011d0
lea edx, [ebp - 0x418]
push edx
mov ecx, dword [ebp - 0x41c]
add ecx, 0x31c
call fcn.004011d0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret
Function at 0x47e740
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x214], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.004101c0
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 4], 0
lea edx, [ebp - 0x210]
push edx
mov ecx, dword [ebp - 0x214]
add ecx, 0x338
call fcn.004011d0
call fcn.00409a60
mov ecx, eax
call fcn.004805b0
push eax
mov ecx, dword [ebp - 0x214]
add ecx, 0x280
call fcn.004011d0
mov ecx, dword [ebp - 0x214]
call fcn.0047bda0
mov ecx, dword [ebp - 0x214]
call fcn.0047e6b0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47e826
call fcn.00409a60
mov ecx, eax
call fcn.004805d0
cmp eax, 1
jne 0x47e816
push 0
push 0
push 0x464
call fcn.00409af0
mov ecx, eax
call dword [sym.imp.DuiLib32.dll_public:_struct_HWND______thiscall_DuiLib::CWindowWnd::GetHWND_void_const]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x47e822
call fcn.00409af0
mov ecx, eax
call fcn.0047f180
xor eax, eax
jmp 0x47e843
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 0x214]
mov dword [eax + 8], 1
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret

Function at 0x47e8a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x10
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x47e880
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0xc], eax
mov esp, ebp
pop ebp
ret
Function at 0x47ee30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480f18
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x124], ecx
lea eax, [ebp - 0x9c]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [edx]
mov eax, dword [edx + 4]
call eax
mov dword [ebp - 4], 0
mov ecx, dword [str.close]
push ecx
lea ecx, [ebp - 0x9c]
call dword [sym.imp.DuiLib32.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
movzx edx, al
test edx, edx
jne 0x47eebb
mov eax, dword [str.close_ex]
push eax
lea ecx, [ebp - 0x9c]
call dword [sym.imp.DuiLib32.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
movzx ecx, al
test ecx, ecx
je 0x47eee0
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
jmp 0x47efaa
mov edx, dword [str.minmize]
push edx
lea ecx, [ebp - 0x9c]
call dword [sym.imp.DuiLib32.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
movzx eax, al
test eax, eax
je 0x47ef17
push 0
push 0xf020
push 0x112
mov ecx, dword [ebp - 0x124]
call dword [sym.imp.DuiLib32.dll_public:_long_int___thiscall_DuiLib::CWindowWnd::SendMessageW_unsigned_int__unsigned_int__long_int_]
jmp 0x47ef97
mov ecx, dword [str.website]
push ecx
lea ecx, [ebp - 0x9c]
call dword [sym.imp.DuiLib32.dll_public:_bool___thiscall_DuiLib::CDuiString::operator_wchar_t_const__const]
movzx edx, al
test edx, edx
je 0x47ef97
lea eax, [ebp - 0x120]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x108]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x108]
mov edx, dword [edx]
mov eax, dword [edx + 0x28]
call eax
mov dword [ebp - 0x128], eax
mov ecx, dword [ebp - 0x128]
mov dword [ebp - 0x12c], ecx
mov byte [ebp - 4], 1
push 5
push 0
push 0
mov ecx, dword [ebp - 0x12c]
call dword [sym.imp.DuiLib32.dll_public:_wchar_t_const____thiscall_DuiLib::CDuiString::operator_wchar_t_const__void_const]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x120]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x9c]
call dword [sym.imp.DuiLib32.dll_public:_void___thiscall_DuiLib::CDuiString::destructor_void_]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret 4
Function at 0x480010
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x300], 0xffffffff
je 0x480031
mov ecx, dword [ebp - 8]
cmp dword [ecx + 0x300], 1
jne 0x480059
push 0
push 0
mov edx, dword [ebp - 8]
push edx
push 0x47fd20
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x48005c
or eax, 0xffffffff
mov esp, ebp
pop ebp
ret

Function at 0x4800e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x480f4b
mov eax, dword fs:[0]
push eax
sub esp, 0x474
mov eax, dword [0x4a71b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x480], ecx
cmp dword [ebp + 8], 0
jne 0x48011e
xor eax, eax
jmp 0x4802d8
mov byte [ebp - 0x214], 0
push 0xff
push 0
lea eax, [ebp - 0x213]
push eax
call fcn.004101c0
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.0040fe10
add esp, 8
mov dword [ebp - 0x218], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040fd80
add esp, 4
mov dword [ebp - 0x474], eax
lea ecx, [ebp - 0x470]
call fcn.00401d30
mov dword [ebp - 4], 0
mov byte [ebp - 0x114], 0
push 0xff
push 0
lea ecx, [ebp - 0x113]
push ecx
call fcn.004101c0
add esp, 0xc
mov edx, dword [ebp - 0x474]
movsx eax, byte [ebp + edx - 0x215]
cmp eax, 0x5c
je 0x4801ba
mov ecx, dword [ebp - 0x474]
mov byte [ebp + ecx - 0x214], 0x5c
mov edx, dword [ebp - 0x218]
movsx eax, byte [ebp + edx - 0x214]
test eax, eax
je 0x4802b6
mov ecx, dword [ebp - 0x218]
movsx edx, byte [ebp + ecx - 0x214]
cmp edx, 0x3a
jne 0x4801f4
mov eax, dword [ebp - 0x218]
add eax, 2
mov dword [ebp - 0x218], eax
jmp 0x4801ba
mov ecx, dword [ebp - 0x218]
movsx edx, byte [ebp + ecx - 0x214]
cmp edx, 0x5c
jne 0x4802a2
mov eax, dword [ebp - 0x218]
push eax
lea ecx, [ebp - 0x214]
push ecx
lea edx, [ebp - 0x114]
push edx
call fcn.00410330
add esp, 0xc
mov eax, dword [ebp - 0x218]
mov byte [ebp + eax - 0x114], 0
lea ecx, [ebp - 0x114]
push ecx
lea ecx, [ebp - 0x470]
call fcn.00401d70
lea edx, [ebp - 0x46c]
push edx
lea ecx, [ebp - 0x470]
call fcn.004097f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x4802a2
push 0
lea ecx, [ebp - 0x470]
call fcn.004097f0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4802a2
mov dword [ebp - 0x478], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.00401d50
mov eax, dword [ebp - 0x478]
jmp 0x4802d8
mov eax, dword [ebp - 0x218]
add eax, 1
mov dword [ebp - 0x218], eax
jmp 0x4801ba
mov dword [ebp - 0x47c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x470]
call fcn.00401d50
mov eax, dword [ebp - 0x47c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040fd10
mov esp, ebp
pop ebp
ret 4
Function at 0x405d9a
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c574], 0
push esi
jne 0x405dd1
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405dab
mov dword [ecx*4 + 0x42c570], eax
inc ecx
cmp ecx, 0x100
jl 0x405da6
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405e02
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c570]
xor eax, esi
inc ecx
dec edx
jne 0x405de4
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219