joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405241
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047aba0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4052ae
push 0x2a
push 0x4080b25
push 6
call fcn.0047912a
add esp, 0xc
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4052be
push ebx
call fcn.00479124
add esp, 4
cmp dword [ebp - 4], 0
jg 0x4052cf
mov dword [ebp - 4], 0x100
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x184
call fcn.0047bd80
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x405302
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push 1
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameExA]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40533b
push 0x125
push 0x4080b25
push 6
call fcn.0047912a
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x40534e
mov eax, 0x48e230
push eax
push 1
mov ebx, 0x174
call fcn.0047bef0
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x405378
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 8], eax
push 0x48e230
push dword [ebp - 8]
call fcn.00401560
add esp, 8
cmp eax, 0
jne 0x4053b5
call fcn.004053ec
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4053b1
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x4053d1
push eax
mov ebx, eax
call fcn.00401499
inc eax
push eax
call fcn.0047911e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4053d6
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4053e7
push ebx
call fcn.00479124
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x4066f6
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push VariantCopy
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x9dc
call fcn.0047be10
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x406740
mov eax, 0
jmp 0x4067a9
mov dword [ebp - 0xc], esp
push dword [ebp + 0x24]
push dword [ebp + 0x1c]
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40677f
push 0x100
push 0x40808bd
push 6
call fcn.0047912a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp + 0x18], 0
jne 0x406799
push dword [ebp - 8]
call fcn.00403175
jmp 0x4067a1
mov eax, dword [ebp - 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov eax, dword [ebp - 8]
jmp 0x4067a9
mov esp, ebp
pop ebp
ret 0x24
Function at 0x40ce21
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x40ce51
mov edx, 0xffffffff
mov eax, 0xffffffff
jmp 0x40ce8c
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40ce81
push 0xa0
push 0x4080555
push 6
call fcn.0047912a
add esp, 0xc
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
jmp 0x40ce8c
mov esp, ebp
pop ebp
ret 4

Function at 0x40ebf8
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x40ec23
mov eax, 0x48e2f9
jmp 0x40ed85
cmp dword [ebp + 0xc], 0
jg 0x40ec7b
mov dword [ebp - 0xc], esp
mov eax, dword [ebp + 0xc]
cdq
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], edx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40ec67
push 0xe2
push 0x4080554
push 6
call fcn.0047912a
add esp, 0xc
cmp dword [ebp + 0xc], 0
jg 0x40ec7b
mov eax, 0x48e2f9
jmp 0x40ed85
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.0040ed9d
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40ecb2
mov eax, 0x48e2f9
jmp 0x40ed85
mov dword [ebp - 0xc], esp
push 0
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40ecec
push 0x2a4
push 0x4080554
push 6
call fcn.0047912a
add esp, 0xc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x40ed03
mov eax, 0x48e2f9
jmp 0x40ed85
push 0x80000301
push 0
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.0047bcc0
add esp, 0x1c
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40ed42
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
push 0
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0
push 0
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.0040ee2a
mov eax, dword [ebp - 8]
test eax, eax
je 0x40ed80
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.0047911e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40ed85
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40ed96
push ebx
call fcn.00479124
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x413974
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword fs:[0x18]
mov dword [ebp - 4], eax
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
je 0x4139c3
cmp dword [ebp - 8], 0
je 0x4139c3
xor eax, eax
jmp 0x4139c8
mov eax, 1
test eax, eax
je 0x4139da
mov eax, 0
jmp 0x413c1d
cmp dword [ebp - 8], 0
jne 0x413ae6
mov dword [ebp - 8], 0x530000
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x48eb69]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004019ad
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.0047d260
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x413a3d
mov eax, 1
jmp 0x413c1d
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x48eb71]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004019ad
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.0047d260
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x413a8f
mov eax, 2
jmp 0x413c1d
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x48eb79]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004019ad
push 0x80000301
push 0
push eax
push 1
mov ebx, 0xa5c
call fcn.0047d260
add esp, 0x10
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x20], eax
jne 0x413ae1
mov eax, 3
jmp 0x413c1d
jmp 0x413c13
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + 0xa8]
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0xa4]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jne 0x413b14
mov eax, 4
jmp 0x413c1d
cmp dword [ebp - 8], 5
jne 0x413b6e
cmp dword [ebp - 4], 0
jne 0x413b37
mov eax, 5
jmp 0x413c1d
cmp dword [ebp - 4], 1
jne 0x413b50
mov eax, 6
jmp 0x413c1d
cmp dword [ebp - 4], 2
jne 0x413b69
mov eax, 7
jmp 0x413c1d
jmp 0x413c13
cmp dword [ebp - 8], 6
jne 0x413bfa
cmp dword [ebp - 4], 0
jne 0x413b91
mov eax, 8
jmp 0x413c1d
cmp dword [ebp - 4], 1
jne 0x413baa
mov eax, 9
jmp 0x413c1d
cmp dword [ebp - 4], 2
jne 0x413bc3
mov eax, 0xa
jmp 0x413c1d
cmp dword [ebp - 4], 3
jne 0x413bdc
mov eax, 0xb
jmp 0x413c1d
cmp dword [ebp - 4], 4
jne 0x413bf5
mov eax, 0xc
jmp 0x413c1d
jmp 0x413c13
cmp dword [ebp - 8], 0xa
jne 0x413c13
mov eax, 0xc
jmp 0x413c1d
mov eax, 0
jmp 0x413c1d
mov esp, ebp
pop ebp
ret
Function at 0x41b42d
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0xc], 0
jne 0x41b447
mov dword [ebp + 8], 1
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp + 8]
push 2
mov ebx, 0xc8
call fcn.0047b940
add esp, 0x1c
mov dword [ebp - 4], eax
push 0x80000301
push 0
push SysReAllocString
push 0x80000301
push 0
push 3
push 0x80000301
push 0
push 0x20000
push 3
mov ebx, 0xc8
call fcn.0047b940
add esp, 0x28
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
nop
nop
cmp dword [ebp - 0xc], esp
je 0x41b4da
push 0xdd
push 0x4080ada
push 6
call fcn.0047912a
add esp, 0xc
jmp 0x41b4df
mov esp, ebp
pop ebp
ret 8

Function at 0x41b79c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x41b7b9
mov eax, 0
jmp 0x41b7ed
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
cmp dword [ebp - 4], esp
je 0x41b7e8
push 0xac
push 0x4080b0c
push 6
call fcn.0047912a
add esp, 0xc
jmp 0x41b7ed
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c98d
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [ebp + 8], 0
jne 0x41c9aa
mov eax, 0
jmp 0x41c9f5
mov dword [ebp - 4], esp
push dword [ebp + 0xc]
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x41c9d9
push 0xac
push 0x4080897
push 6
call fcn.0047912a
add esp, 0xc
test eax, eax
je 0x41c9eb
mov eax, 1
jmp 0x41c9f5
mov eax, 0
jmp 0x41c9f5
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41d0d9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
push 0x48e230
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.00401560
add esp, 8
cmp eax, 0
jne 0x41d141
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047aba0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41d13b
push ebx
call fcn.00479124
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
push 0x48e230
mov ebx, dword [ebp + 0x10]
push dword [ebx]
call fcn.00401560
add esp, 8
cmp eax, 0
jne 0x41d199
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047aba0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41d193
push ebx
call fcn.00479124
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
cmp dword [ebp + 0x1c], 0
jne 0x41d1aa
mov dword [ebp + 0x18], 1
mov ebx, dword [ebp + 0x28]
mov eax, dword [ebx]
test eax, eax
je 0x41d1c8
push eax
mov ebx, eax
call fcn.00401499
inc eax
push eax
call fcn.0047911e
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d1d9
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x48e230
push dword [ebp - 4]
call fcn.00401560
add esp, 8
cmp eax, 0
jne 0x41d210
mov eax, str.open
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d20c
push ebx
call fcn.00479124
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x48e230
mov ebx, dword [ebp + 0x30]
push dword [ebx]
call fcn.00401560
add esp, 8
cmp eax, 0
jne 0x41d268
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.0047aba0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp + 0x30]
mov ebx, dword [ebx]
test ebx, ebx
je 0x41d262
push ebx
call fcn.00479124
add esp, 4
pop eax
mov ebx, dword [ebp + 0x30]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp + 0x18]
mov ebx, dword [ebp + 0x30]
push dword [ebx]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
push dword [ebp + 0x20]
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 8], esp
je 0x41d2a9
push 0x35e
push 0x4080a4c
push 6
call fcn.0047912a
add esp, 0xc
jmp 0x41d2ae
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x41d2bf
push ebx
call fcn.00479124
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x30
Function at 0x46212e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 0x11
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x462173
push 0x59
push 0x4079b58
push 6
call fcn.0047912a
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0047f320
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4621d6
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0047b940
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x10
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x462204
push 0xfb
push 0x4079b58
push 6
call fcn.0047912a
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0047f320
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x462267
push 0x80000301
push 0
push 2
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0047b940
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x12
xor eax, eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop
nop
cmp dword [ebp - 8], esp
je 0x462295
push 0x19d
push 0x4079b58
push 6
call fcn.0047912a
add esp, 0xc
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 0x8000
push 0x80000301
push 0
push dword [ebp - 0xc]
push 2
mov ebx, 0xc4
call fcn.0047f320
add esp, 0x1c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4622f8
push 0x80000301
push 0
push 4
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0xc8
call fcn.0047b940
add esp, 0x1c
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x462300
mov esp, ebp
pop ebp
ret
Function at 0x47b670
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
lea ecx, [esp + 0x18]
call fcn.00480b50
lea eax, [esp + 0x10]
mov dword [esp + 0x18], 0x48b614
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
mov dword [esp + 0x14], edi
je 0x47b732
mov ecx, dword [esp + 0x10]
mov eax, 1
cmp ecx, eax
mov dword [esp + 0xc], eax
jle 0x47b72b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ebx, [edi + 4]
mov ecx, dword [ebx]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push ecx
push 0
push 0x3a8
call ebp
mov esi, eax
test esi, esi
jle 0x47b716
lea edx, [esi + 1]
push edx
call fcn.0047a800
mov edi, eax
add esp, 4
test edi, edi
je 0x47b708
mov eax, dword [ebx]
push 0
push 0
push esi
push edi
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call ebp
mov byte [eax + edi], 0
push edi
lea ecx, [esp + 0x20]
call fcn.00480de0
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
inc eax
add ebx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
jl 0x47b6c2
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ebx, dword [esp + 0x34]
mov eax, dword [ebx]
test eax, eax
je 0x47b745
push eax
call fcn.00480f80
add esp, 4
mov edi, dword [esp + 0x28]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.0047a800
mov dword [eax], 1
mov edx, dword [esp + 0x2c]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x2c]
mov ecx, dword [esp + 0x24]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
mov dword [ebx], eax
mov dword [esp + 0x18], 0x48b610
call fcn.00480d50
pop edi
pop esi
pop ebx
add esp, 0x20
ret

Function at 0x47b830
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.004818f3
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x47b89a
push esi
lea edi, [eax + 0x400]
call fcn.004818e8
push edi
call fcn.004818f3
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x47b86a
push esi
xor edi, edi
call dword [0x4930bc]
add esp, 4
test eax, eax
je 0x47b8b6
push eax
push esi
call fcn.00480fe0
add esp, 8
mov edi, eax
push esi
call fcn.004818e8
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47b8d0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x47b939
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0047a800
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x47c150
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret
Function at 0x47ce30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x47ce4e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x47ce43
pop esi
ret
Function at 0x47d280
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x47d2c1.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x47d2c1.2
jmp dword [eax*4 + 0x47d34c]
mov word [esp + 0x48], di
jmp 0x47d2fa
mov word [esp + 0x48], 2
jmp 0x47d2fa
mov word [esp + 0x48], 3
jmp 0x47d2fa
mov word [esp + 0x48], 4
jmp 0x47d2fa
mov word [esp + 0x48], 7
jmp 0x47d2fa
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x47d344
cmp dword [esp + 0x70], edi
je 0x47d330
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x47e5b0
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x47e5da
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x47e5da
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
ret

Function at 0x47e630
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x47e6c2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x47e6b4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x47e6ac
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x47e675
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x47e940
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x47e94d
xor eax, eax
pop esi
ret
push esi
call dword [0x4930bc]
add esp, 4
test eax, eax
jne 0x47e95d
pop esi
ret
cmp eax, 1
jne 0x47e96b
cmp byte [esi], 0x5c
jne 0x47e96b
xor eax, eax
pop esi
ret
push esi
call fcn.0047e6f0
add esp, 4
test eax, eax
je 0x47e97f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x47edb0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x140
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
mov esi, dword [ebx]
push edi
mov edi, dword [esp + 0x154]
xor ebp, ebp
test edi, edi
je 0x47ee30
push edi
call dword [0x4930bc]
add esp, 4
test eax, eax
jbe 0x47ee30
test esi, esi
je 0x47edee
cmp esi, 0xffffffff
je 0x47edee
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebx], esi
je 0x47ee72
mov eax, dword [esp + 0x15c]
test eax, eax
je 0x47ee1c
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
je 0x47ee30
jmp 0x47ee2b
mov edx, dword [esp + 0x158]
mov eax, dword [esp + 0x10]
test edx, eax
je 0x47ee30
mov ebp, 1
test esi, esi
je 0x47ee72
cmp esi, 0xffffffff
je 0x47ee72
test ebp, ebp
jne 0x47eea9
mov eax, dword [esp + 0x15c]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x10]
push eax
push esi
je 0x47ee7f
call edi
test eax, eax
je 0x47ee72
mov ecx, dword [esp + 0x10]
and ecx, 0x10
cmp cl, 0x10
jne 0x47eea9
lea edx, [esp + 0x10]
push edx
push esi
call edi
test eax, eax
jne 0x47ee5a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x140
ret
call edi
test eax, eax
je 0x47ee72
mov ebx, dword [esp + 0x158]
test dword [esp + 0x10], ebx
jne 0x47eea9
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
jne 0x47ee8c
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret
lea edx, [esp + 0x3c]
push edx
call dword [0x4930bc]
inc eax
push eax
call fcn.0047a800
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x140
ret