joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455300
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
mov eax, 0x1840
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x183c], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.user32.dll_GetDlgItem]
push edi
push 0x29e0
push dword [0x4def88]
call esi
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
mov edi, eax
push 0
push 0
push 0x1009
push edi
call ebx
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x54], ax
lea eax, [esp + 0x56]
push eax
call fcn.0048e770
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x860], ax
lea eax, [esp + 0x862]
push eax
call fcn.0048e770
push 0x7fc
lea eax, [esp + 0x106c]
mov dword [esp + 0x1068], 0x30
push 0
push eax
call fcn.0048e770
add esp, 0x24
lea eax, [esp + 0x4c]
xor ebp, ebp
push 0x4ded80
push 0x400
push eax
push ebp
lea eax, [esp + 0x105c]
push eax
push 0x4b5170
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x4554c7
movzx esi, word [esp + 0x4c]
inc ebp
push 0
push 0
push 0x1004
push edi
call ebx
push 0x4db71c
push 0
mov dword [0x4db720], eax
lea eax, [esp + 0x56]
push 0x104d
push edi
mov dword [0x4db738], 0
mov dword [0x4db730], eax
call ebx
cmp esi, 0x31
jne 0x455427
lea eax, [esp + 0x10]
mov dword [esp + 0x20], 0xf000
push eax
push dword [0x4db720]
mov dword [esp + 0x24], 0x2000
push 0x102b
push edi
call ebx
lea eax, [esp + 0x4e]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, 0x4b5168
mov edx, 0x4ad8c0
cmp eax, 0xffffffff
je 0x455446
mov edx, 0x4ad8e8
call fcn.004773a0
push eax
lea eax, [esp + 0x850]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [esp + 0x84c]
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
push dword [0x4db720]
push 0x1074
push edi
call ebx
push 0xa
push 0xa
lea eax, [esp + 0x1054]
push eax
push ebp
call fcn.0048f5fe
add esp, 0x10
lea eax, [esp + 0x4c]
push 0x4ded80
push 0x400
push eax
push 0
lea eax, [esp + 0x105c]
push eax
push 0x4b5170
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
test eax, eax
jne 0x4553c6
mov esi, dword [sym.imp.user32.dll_GetDlgItem]
push 0
push 0
push 0x1004
push edi
call ebx
test eax, eax
jne 0x455504
push eax
push 0x29de
push dword [0x4def88]
call esi
mov esi, dword [sym.imp.user32.dll_EnableWindow]
push eax
call esi
push 0
push 0x29df
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call esi
mov ecx, dword [esp + 0x184c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x1840
ret
Function at 0x458ec0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1004
call fcn.004a5d20
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x1000], eax
mov edx, 0x4adc30
mov ecx, 0x4ae00c
call fcn.004773a0
push eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4ded80
push 0x400
lea eax, [esp + 0x808]
push eax
push 0
push 0x4ae018
push 0x4b51b8
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x800]
push eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCatW]
lea eax, [esp]
push eax
push 0
push 0xc
push 0x29f1
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
push eax
call dword [sym.imp.user32.dll_SendMessageW]
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0048d815
add esp, 0x1004
ret
Function at 0x45cdf0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x828
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x824], eax
push ebx
push ebp
mov ebp, dword [esp + 0x834]
lea eax, [esp + 0x18]
push esi
push edi
mov ebx, ecx
mov dword [esp + 0x18], edx
push eax
push ebx
call dword [sym.imp.version.dll_GetFileVersionInfoSizeW]
mov edi, eax
test edi, edi
je 0x45cf47
push edi
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x45cf47
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x38], ax
lea eax, [esp + 0x3a]
push eax
call fcn.0048e770
add esp, 0xc
push esi
push edi
push 0
push ebx
call dword [sym.imp.version.dll_GetFileVersionInfoW]
mov edi, dword [sym.imp.version.dll_VerQueryValueW]
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x2c]
push eax
push 0x4ad2c0
push esi
call edi
test eax, eax
je 0x45cf40
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x18]
push eax
push 0x4b95ac
push esi
call edi
test eax, eax
je 0x45cf40
mov ecx, dword [esp + 0x14]
push 0x4b95e0
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x4b9600
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.0040a370
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
push esi
call edi
test eax, eax
je 0x45cf40
push dword [esp + 0x10]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push dword [esp + 0x1c]
call ebx
mov ecx, dword [esp + 0x14]
push 0x4b9638
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push 0x4b9600
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.0040a370
add esp, 0x18
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
push esi
call edi
test eax, eax
je 0x45cf40
push dword [esp + 0x10]
push ebp
call ebx
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
mov eax, 1
jmp 0x45cf49
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
xor eax, eax
mov ecx, dword [esp + 0x834]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x828
ret
Function at 0x45d770
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
mov ebx, ecx
mov esi, edx
push ebx
push esi
call edi
cmp word [esi], 0x22
jne 0x45d7a2
lea eax, [ebx + 2]
push eax
push esi
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push 0x4adcd0
push esi
call ebx
test eax, eax
je 0x45d7ba
xor ecx, ecx
mov word [eax + 8], cx
cmp word [esi], 0x25
jne 0x45d80d
xor eax, eax
push 0x7fe
push eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x16]
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0xc]
push esi
push eax
call edi
push 0x400
push esi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.kernel32.dll_ExpandEnvironmentStringsW]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x800]
xor ecx, esp
call fcn.0048d815
add esp, 0x804
ret
push 0x4ae754
push esi
call ebx
test eax, eax
je 0x45d820
add eax, 0xfffffffe
push eax
push esi
call edi
mov ecx, dword [esp + 0x80c]
mov eax, 1
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x804
ret
Function at 0x467260
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
mov ebx, ecx
push ebx
push 0x2738
push dword [0x4def88]
call edi
mov esi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call esi
push ebx
push 0x2739
push dword [0x4def88]
call edi
push eax
call esi
push ebx
push 0x273a
push dword [0x4def88]
call edi
push eax
call esi
push ebx
push 0x273b
push dword [0x4def88]
call edi
push eax
call esi
push ebx
push 0x273c
push dword [0x4def88]
call edi
push eax
call esi
pop edi
pop esi
mov ecx, ebx
pop ebx
jmp fcn.00466cd0

Function at 0x4673d0
Capabilities:
Create thread

Disassembly:
sub esp, 0x21c
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
mov ebp, dword [sym.imp.user32.dll_GetDlgItem]
push esi
push edi
push 0
push 0
push 0x130b
push 0x271c
push dword [0x4def88]
call ebp
mov ebx, dword [sym.imp.user32.dll_SendMessageW]
push eax
call ebx
cmp eax, 3
ja case.default.0x467416
jmp dword [eax*4 + 0x467608]
mov edx, 0x4ae300
mov ecx, 0x4ad090
call fcn.004773a0
push eax
push 0
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call ebx
push 0x4ad29c
push 1
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call ebx
jmp case.default.0x467416
mov edx, 0x4ae308
mov ecx, 0x4ad090
call fcn.004773a0
push eax
push 0
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call ebx
xor eax, eax
push 0x206
push eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x22]
push eax
call fcn.0048e770
add esp, 0xc
push 0
push 0
push 0x1004
push 0x2744
push dword [0x4def88]
call ebp
push eax
call ebx
push 0
push 0
push 0x1004
push 0x2743
push dword [0x4def88]
mov esi, eax
call ebp
push eax
call ebx
push 0
push 0
push 0x1004
push 0x2742
push dword [0x4def88]
add esi, eax
call ebp
push eax
call ebx
push 0
push 0
push 0x1004
push 0x2741
push dword [0x4def88]
add esi, eax
call ebp
push eax
call ebx
add eax, esi
push eax
push 0
push 0
push 0x1004
push 0x2740
push dword [0x4def88]
call ebp
push eax
call ebx
push eax
push 0
push 0
push 0x1004
push 0x2745
push dword [0x4def88]
call ebp
push eax
call ebx
push eax
mov edx, 0x4ad560
mov ecx, 0x4ad090
call fcn.004773a0
push eax
lea eax, [esp + 0x28]
push 0x104
push eax
call fcn.0040a370
add esp, 0x18
lea eax, [esp + 0x18]
push eax
push 1
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call ebx
jmp case.default.0x467416
mov edx, 0x4ae310
jmp 0x467422
mov edx, 0x4b0bd8
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push 0
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call ebx
cmp dword [0x4d0b88], 0
jne 0x4675a3
call fcn.0041a520
jmp 0x4675c2
mov edx, 0x4ae8a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push 1
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call ebx
cmp dword [0x4dddec], 0
jne case.default.0x467416
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x41c770
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x4dddec], 1
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0048d815
add esp, 0x21c
ret
Function at 0x4689d0
Capabilities:
Create thread

Disassembly:
sub esp, 8
push esi
push 0
push 0
push 0x130b
push 0x27ad
push dword [0x4def88]
call dword [sym.imp.user32.dll_GetDlgItem]
mov esi, dword [sym.imp.user32.dll_SendMessageW]
push eax
call esi
cmp eax, 5
ja case.default.0x468a00
jmp dword [eax*4 + 0x468b50]
mov edx, 0x4af214
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push 0
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
push 0x4d0388
push 1
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
pop esi
add esp, 8
ret
mov edx, 0x4b0bd0
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push 0
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
pop esi
add esp, 8
jmp fcn.0041a450
mov edx, 0x4b0bd8
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push 0
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
cmp dword [0x4d0b88], 0
jne 0x468a96
call fcn.0041a520
jmp 0x468ab5
mov edx, 0x4ae8a4
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push 1
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
cmp dword [0x4dddec], 0
jne case.default.0x468a00
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x41c770
push 0
push 0
call dword [sym.imp.kernel32.dll_CreateThread]
mov dword [0x4dddec], 1
pop esi
add esp, 8
ret
mov edx, 0x4af7a8
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push 0
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
pop esi
add esp, 8
jmp fcn.0041a620
mov edx, 0x4af880
jmp 0x468b1d
mov edx, 0x4af888
mov ecx, 0x4ad9cc
call fcn.004773a0
push eax
push 0
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
push 0x4ad29c
push 1
push 0x40b
push dword [reloc.kernel32.dll_InitializeSListHead]
call esi
pop esi
add esp, 8
ret
Function at 0x46f590
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.user32.dll_GetDlgItem]
mov ebx, ecx
push edi
push ebx
push 0x2910
push dword [0x4def88]
call esi
mov edi, dword [sym.imp.user32.dll_ShowWindow]
push eax
call edi
push ebx
push 0x2911
push dword [0x4def88]
call esi
push eax
call edi
push ebx
push 0x2912
push dword [0x4def88]
call esi
push eax
call edi
push ebx
push 0x2913
push dword [0x4def88]
call esi
push eax
call edi
push ebx
push 0x2914
push dword [0x4def88]
call esi
push eax
call edi
push ebx
push 0x4e9b
push dword [0x4def88]
call esi
push eax
call edi
push 0
push 0
push 0x130b
push 0x290f
push dword [0x4def88]
call esi
push eax
call dword [sym.imp.user32.dll_SendMessageW]
sub eax, 0
je 0x46f6d6
sub eax, 1
je 0x46f68a
sub eax, 1
jne 0x46f71f
xor ecx, ecx
call fcn.0046f730
xor ecx, ecx
call fcn.0046f890
push 0
push 0x2a2b
push dword [0x4def88]
call esi
push eax
call edi
push 0
push 0x2a2c
push dword [0x4def88]
call esi
push eax
call edi
push ebx
push 0x2916
push dword [0x4def88]
call esi
push eax
call edi
mov ecx, ebx
call fcn.0046fa90
jmp 0x46f71f
xor ecx, ecx
call fcn.0046f730
xor ecx, ecx
call fcn.0046fa90
push 0
push 0x2a2b
push dword [0x4def88]
call esi
push eax
call edi
push 0
push 0x2a2c
push dword [0x4def88]
call esi
push eax
call edi
push ebx
push 0x2916
push dword [0x4def88]
call esi
push eax
call edi
mov ecx, ebx
call fcn.0046f890
jmp 0x46f71f
xor ecx, ecx
call fcn.0046fa90
xor ecx, ecx
call fcn.0046f890
push 0
push 0x2916
push dword [0x4def88]
call esi
push eax
call edi
push ebx
push 0x2a2b
push dword [0x4def88]
call esi
push eax
call edi
push ebx
push 0x2a2c
push dword [0x4def88]
call esi
push eax
call edi
mov ecx, ebx
call fcn.0046f730
pop edi
pop esi
test ebx, ebx
pop ebx
jne fcn.0046fc40
ret
Function at 0x470d10
Capabilities:
Encode data using xor
Hash data with crc32
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
push 0x4bbf60
push 0x4ddef0
call esi
push 0x4bbf6c
push 0x4ddea8
call esi
mov eax, dword [0x4c5198]
cmp eax, 0x64
je 0x470d67
cmp eax, 0x12c
jne 0x470d7f
push 0x4bbfac
push 0x4ddef0
call esi
push 0x4bbfb8
jmp 0x470d78
push 0x4bbf84
push 0x4ddef0
call esi
push 0x4bbf94
push 0x4ddea8
call esi
call fcn.00470f40
test eax, eax
jmp 0x470dba
push ebx
push edi
push dword [0x4ddf34]
call fcn.0048f63e
push 2
push 0x32
call fcn.0048f633
add esp, 0xc
mov dword [0x4ddf34], eax
push 0x4ded80
push 0x32
push eax
push 0x4ad29c
push 0x4bbf58
push 0x4bbf5c
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
test eax, eax
nop
nop
nop
nop
nop
nop
mov edi, dword [0x4ddf34]
mov ecx, edi
movzx eax, word [ecx]
test ax, ax
je 0x470e24
mov edx, eax
nop
xor edx, 1
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x470e10
mov ebx, dword [sym.imp.kernel32.dll_lstrlenW]
push edi
call ebx
cmp eax, 0x14
nop
nop
nop
nop
nop
nop
push ebp
xor eax, eax
push 0x206
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.0048e770
add esp, 0xc
lea eax, [esp + 0x10]
push dword [0x4ddf34]
push eax
call esi
push dword [0x4ddf34]
call ebx
mov edi, dword [0x4ddf34]
sub eax, 0x10
or esi, 0xffffffff
lea ebp, [eax + eax]
add edi, ebp
push edi
call ebx
test eax, eax
jle 0x470e9a
nop
movzx ecx, word [edi]
lea edi, [edi + 2]
xor ecx, esi
dec eax
movzx ecx, cl
shr esi, 8
xor esi, dword [ecx*4 + 0x4b4d68]
test eax, eax
jg 0x470e80
cmp ebp, 0x208
nop
nop
nop
nop
nop
nop
xor eax, eax
mov word [esp + ebp + 0x10], ax
lea eax, [esp + 0x10]
push eax
call fcn.0049370f
not esi
add esp, 4
cmp esi, eax
nop
nop
mov dword [0x4dde90], 0xe8
mov eax, 1
mov dword [0x4dde94], 0x157
mov dword [0x4dde98], 0x2e9
mov dword [0x4ddea0], 0xea
mov dword [0x4ddea4], 0x34f
mov dword [0x4dde8c], 0x3b3
pop ebp
pop edi
pop ebx
pop esi
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0048d815
add esp, 0x20c
ret

Function at 0x470f40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0x810], eax
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
push 0
push 0x20019
push 0
push 0
push 0
push 0x4bbff0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x470fe6
lea eax, [esp + 4]
mov dword [esp + 4], 0x400
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x4ddef0
push dword [esp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x470fdd
lea eax, [esp + 0x10]
push esi
push eax
call fcn.004936e5
add esp, 4
mov esi, eax
push dword [esp + 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov ecx, dword [esp + 0x810]
xor ecx, esp
call fcn.0048d815
add esp, 0x814
ret
push dword [esp]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x810]
xor eax, eax
xor ecx, esp
call fcn.0048d815
add esp, 0x814
ret
Function at 0x471000
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
push eax
lea eax, [esp + 8]
mov esi, edx
push eax
push 0
push 0x20006
push 0
push 0
push 0
push 0x4bbff0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x47105d
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
add eax, eax
push eax
push esi
push 1
push 0
push 0x4ddef0
push dword [esp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [esp + 4]
test eax, eax
je 0x471064
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 8
ret
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
add esp, 8
ret
Function at 0x471930
Capabilities:
Create directory
Delete file
Encode data using xor
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa14
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0xa10], eax
push ebx
push esi
push edi
push dword [0x4ddf34]
call fcn.0048f63e
push 2
push 0x32
call fcn.0048f633
add esp, 0xc
mov dword [0x4ddf34], eax
push 0x4ded80
push 0x32
push eax
push 0x4ad29c
push 0x4bbf58
push 0x4bbf5c
call dword [sym.imp.kernel32.dll_GetPrivateProfileStringW]
test eax, eax
je 0x471b5a
push dword [0x4ddf34]
mov esi, dword [sym.imp.kernel32.dll_lstrlenW]
call esi
cmp eax, 0x14
jl 0x471b5a
push dword [0x4ddf34]
call esi
push 0x1ac
mov ebx, eax
lea edi, [esp + 0x21c]
lea eax, [esp + 0x870]
mov ecx, 0x195
mov esi, 0x4bc068
push 0
rep movsd dword es:[edi], dword [esi]
push eax
call fcn.0048e770
mov esi, dword [sym.imp.SHLWAPI.dll_StrCpyW]
add esp, 0xc
push 0x4bbf60
push 0x4ddef0
call esi
push 0x4bbf6c
push 0x4ddea8
call esi
mov eax, dword [0x4c5198]
cmp eax, 0x64
je 0x471a27
cmp eax, 0x12c
jne 0x471a4e
push 0x4bbfac
push 0x4ddef0
call esi
push 0x4bbfb8
push 0x4ddea8
call esi
push 0x4bcd10
jmp 0x471a44
push 0x4bbf84
push 0x4ddef0
call esi
push 0x4bbf94
push 0x4ddea8
call esi
push 0x4bc6c0
lea eax, [esp + 0x21c]
push eax
call esi
mov ax, word [esp + 0x218]
lea ecx, [esp + 0x218]
test ax, ax
je 0x471a79
movzx edx, ax
xor edx, 1
lea ecx, [ecx + 2]
mov word [ecx - 2], dx
movzx eax, word [ecx]
mov edx, eax
test ax, ax
jne 0x471a65
mov eax, dword [0x4ddf34]
lea eax, [eax + ebx*2]
add eax, 0xffffffe8
push eax
lea eax, [esp + 0x21c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x471af8
call fcn.00470f40
test eax, eax
je 0x471af1
mov dword [0x4dde90], 1
mov dword [0x4dde94], 1
mov dword [0x4dde98], 1
mov dword [0x4ddea0], 1
mov dword [0x4ddea4], 1
mov dword [0x4dde8c], 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa10]
xor ecx, esp
call fcn.0048d815
mov esp, ebp
pop ebp
ret
mov edx, 0x4ad0a4
jmp 0x471b55
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
test eax, eax
jne 0x471b39
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push 0x4bc040
lea eax, [esp + 0x14]
push eax
call esi
push 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
push 0x4ddea8
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
mov edx, 0x4ad0e0
call fcn.00471000
mov ecx, dword [esp + 0xa1c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0048d815
mov esp, ebp
pop ebp
ret
Function at 0x471b70
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
sub esp, 0x4c
push ebx
push esi
call fcn.00472fc0
test eax, eax
je 0x471cd1
mov eax, 1
push ebx
cpuid
pop ebx
mov dword [esp + 0xc], edx
test byte [esp + 0xc], 0x10
je 0x471cd1
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.kernel32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x471cd1
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov esi, eax
mov dword [esp + 0x14], esi
call dword [sym.imp.kernel32.dll_GetCurrentThread]
mov ebx, eax
push esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.kernel32.dll_GetPriorityClass]
push ebx
mov dword [esp + 0x24], eax
call dword [sym.imp.kernel32.dll_GetThreadPriority]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.kernel32.dll_GetProcessAffinityMask]
push 0x100
push esi
call dword [sym.imp.kernel32.dll_SetPriorityClass]
push 0xf
push ebx
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push 1
push esi
call dword [sym.imp.kernel32.dll_SetProcessAffinityMask]
cpuid
mov esi, dword [sym.imp.kernel32.dll_QueryPerformanceCounter]
lea eax, [esp + 0x40]
push eax
call esi
rdtsc
mov dword [esp + 0x34], edx
mov dword [esp + 0x30], eax
push 0x32
call dword [sym.imp.kernel32.dll_Sleep]
lea eax, [esp + 0x38]
push eax
call esi
rdtsc
mov dword [esp + 0x2c], edx
mov dword [esp + 0x28], eax
push dword [esp + 0x10]
mov esi, dword [esp + 0x18]
push esi
call dword [sym.imp.kernel32.dll_SetProcessAffinityMask]
push dword [esp + 0x18]
push dword [esp + 0x20]
call dword [sym.imp.kernel32.dll_SetThreadPriority]
push dword [esp + 0x20]
push esi
call dword [sym.imp.kernel32.dll_SetPriorityClass]
mov ecx, dword [esp + 0x28]
sub ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
sbb edx, dword [esp + 0x34]
call fcn.004a61f0
mov ecx, dword [esp + 0x38]
sub ecx, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
sbb edx, dword [esp + 0x44]
movsd qword [esp + 0x30], xmm0
call fcn.004a61f0
mov edx, dword [esp + 0x4c]
mov ecx, dword [esp + 0x48]
movsd qword [esp + 0x40], xmm0
call fcn.004a61f0
movsd xmm1, qword [esp + 0x40]
divsd xmm1, xmm0
movsd xmm0, qword [esp + 0x30]
divsd xmm0, xmm1
call fcn.004a60f0
mov dword [0x4ddf38], eax
mov dword [0x4ddf3c], edx
pop esi
pop ebx
add esp, 0x4c
ret
pop esi
xor eax, eax
xor edx, edx
pop ebx
add esp, 0x4c
ret
Function at 0x474390
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.kernel32.dll_OpenProcess]
mov ebx, ecx
push ebx
push 0
push 0x1fffff
call edi
mov esi, eax
test esi, esi
je 0x474435
push 1
push esi
call dword [sym.imp.kernel32.dll_TerminateProcess]
push esi
test eax, eax
jne 0x474426
call dword [sym.imp.kernel32.dll_CloseHandle]
push ebx
push 0
push 0x100001
call edi
mov edi, eax
test edi, edi
jne 0x4743db
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebx
ret
push ebx
push 0x474350
call dword [sym.imp.user32.dll_EnumWindows]
push 0xbb8
push edi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x474414
push 0
push edi
call dword [sym.imp.kernel32.dll_TerminateProcess]
neg eax
push edi
sbb esi, esi
and esi, 2
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
ret
push edi
mov esi, 1
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebx
ret
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
mov eax, 1
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret

Function at 0x474440
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xd8
mov eax, dword [0x4c4004]
xor eax, esp
mov dword [esp + 0xd4], eax
push esi
push edi
push 0
call fcn.004926bc
add esp, 4
push 0
push 0x15180
push edx
push eax
call fcn.004a5a40
push 0x4ded80
push 0
push 0x4bf5a8
push 0x4ad35c
mov esi, eax
call dword [sym.imp.kernel32.dll_GetPrivateProfileIntW]
mov edi, eax
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.0048e770
push 0xa
push 0x64
lea eax, [esp + 0x24]
push eax
push esi
call fcn.0048f5fe
add esp, 0x1c
lea eax, [esp + 0x10]
push 0x4ded80
push eax
push 0x4bf5a8
push 0x4ad35c
call dword [sym.imp.kernel32.dll_WritePrivateProfileStringW]
mov ecx, dword [esp + 0xdc]
xor eax, eax
test edi, edi
pop edi
sete al
pop esi
xor ecx, esp
call fcn.0048d815
mov esp, ebp
pop ebp
ret