joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d680
Capabilities:
Connect to http server
Create http request

Disassembly:
push 0xffffffffffffffff
push 0x4b1988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov ebx, ecx
push 0
push 0
push 0
push 0
push 0x4d5428
mov dword [esp + 0x28], 0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, dword [esp + 0x1c]
test eax, eax
mov dword [esi], eax
jne 0x45d6e5
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a6b19
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
push edi
mov edi, dword [sym.imp.WININET.dll_InternetSetOptionA]
lea ecx, [esp + 0xc]
push 4
push ecx
push 2
push eax
mov dword [esp + 0x1c], 0x1388
call edi
mov eax, dword [esi]
lea edx, [esp + 0xc]
push 4
push edx
push 5
push eax
call edi
mov edx, dword [esi]
lea ecx, [esp + 0xc]
push 4
push ecx
push 6
push edx
call edi
mov ecx, dword [esi]
lea eax, [esp + 0xc]
push 4
push eax
push 7
push ecx
call edi
mov eax, dword [esi]
lea edx, [esp + 0xc]
push 4
push edx
push 8
push eax
call edi
mov eax, dword [0x4d4b6c]
mov ecx, dword [esp + 0x28]
mov edx, dword [ebx + 4]
mov edi, eax
and eax, 0xffff
push eax
push ecx
push str.Connecting_Ftp_:__s__d
push edx
call fcn.0044f8c0
push eax
call fcn.0044fb50
mov eax, dword [esp + 0x3c]
add esp, 0x14
mov ecx, dword [esi]
push 0
push 0
push 1
push 0x4dca10
push str.anonymous
push edi
push eax
push ecx
call dword [sym.imp.WININET.dll_InternetConnectA]
mov edx, dword [esp + 0x24]
pop edi
test eax, eax
mov dword [edx], eax
jne 0x45d7ba
mov eax, dword [esi]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a6b19
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 4]
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
lea ecx, [esp + 0x24]
mov dword [esp + 0x14], 0xffffffff
call fcn.004a6b19
mov ecx, dword [esp + 0xc]
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0xc
Function at 0x466440
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x408
lea eax, [esp]
push esi
push eax
push 0xf003f
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x466473
xor eax, eax
pop esi
add esp, 0x408
ret 0x14
mov ecx, dword [esp + 0x41c]
lea eax, [esp + 0x420]
push eax
mov eax, dword [esp + 0x41c]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x4664d6
push 0
lea eax, [esp + 0x10]
push 0x400
push eax
push 0
push esi
push 0
push 0x1000
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
xor eax, eax
pop esi
add esp, 0x408
ret 0x14
mov eax, 1
pop esi
add esp, 0x408
ret 0x14

Function at 0x4664f0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push edi
lea eax, [esp + 0xc]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov edx, dword [esp + 0x14]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 1
push eax
mov eax, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop edi
je 0x466544
xor eax, eax
ret 0x10
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret 0x10
Function at 0x46c8d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b1ddf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4d8cb8]
push esi
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 4]
push edx
push eax
push ecx
lea edx, [esp + 0x10]
push str._d_x__d_x__d
push edx
mov dword [esp + 0x28], 1
call fcn.004a1aae
mov esi, dword [esp + 0x30]
add esp, 0x14
lea eax, [esp + 4]
mov ecx, esi
push eax
call fcn.004a688e
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.004a6b19
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 4
Function at 0x46c960
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b1e28
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov eax, dword [0x4d8cb8]
mov dword [esp + 0x1c], 0
mov dword [esp + 8], eax
lea ecx, [esp + 0x24]
mov bl, 1
push ecx
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], bl
call fcn.004a6c52
push 0x78
lea ecx, [esp + 0xc]
call fcn.004a6fe0
push eax
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [esp + 0x14]
call fcn.004a161a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 2
call fcn.004a6c52
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.004a6b19
lea ecx, [esp + 8]
call fcn.004a1b56
lea ecx, [esp + 8]
call fcn.004a1c4d
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 0xa
push eax
push ecx
mov dword [esp + 0x18], 0
call fcn.004923c6
mov edx, dword [esp + 0x30]
add esp, 0xc
mov dword [esi + 4], eax
lea ecx, [esp + 0x24]
mov eax, dword [edx - 8]
push eax
push 0x78
call fcn.004a6fe0
inc eax
lea ecx, [esp + 0x28]
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004a161a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 3
call fcn.004a6c52
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.004a6b19
push 0x78
lea ecx, [esp + 0xc]
call fcn.004a6fe0
push eax
lea ecx, [esp + 0x14]
push 0
push ecx
lea ecx, [esp + 0x14]
call fcn.004a161a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 4
call fcn.004a6c52
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.004a6b19
lea ecx, [esp + 8]
call fcn.004a1b56
lea ecx, [esp + 8]
call fcn.004a1c4d
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 0xa
push edx
push eax
call fcn.004923c6
mov ecx, dword [esp + 0x30]
add esp, 0xc
mov dword [esi + 8], eax
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x24]
push eax
push 0x78
call fcn.004a6fe0
inc eax
lea edx, [esp + 0x14]
push eax
push edx
lea ecx, [esp + 0x30]
call fcn.004a161a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 5
call fcn.004a6c52
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.004a6b19
mov eax, dword [esp + 8]
lea ecx, [esp + 8]
mov eax, dword [eax - 8]
push eax
push 0x78
call fcn.004a6fe0
inc eax
lea ecx, [esp + 0x14]
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.004a161a
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], 6
call fcn.004a6c52
lea ecx, [esp + 0x10]
mov byte [esp + 0x1c], bl
call fcn.004a6b19
lea ecx, [esp + 8]
call fcn.004a1b56
lea ecx, [esp + 8]
call fcn.004a1c4d
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 0xa
push edx
push eax
call fcn.004923c6
add esp, 0xc
lea ecx, [esp + 8]
mov dword [esi + 0xc], eax
mov byte [esp + 0x1c], 0
call fcn.004a6b19
lea ecx, [esp + 0x24]
mov dword [esp + 0x1c], 0xffffffff
call fcn.004a6b19
mov ecx, dword [esp + 0x14]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x46f22b
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4b1f78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [str.LauncherMessage.ini]
push esi
mov esi, ecx
push ecx
mov ecx, esp
mov dword [esp + 8], esp
push eax
call fcn.004a6b87
lea ecx, [esp + 8]
push ecx
call fcn.00411130
add esp, 8
mov ecx, eax
mov dword [esp + 0x10], 0
call fcn.00414f10
push eax
push 0
push 0x4d68fc
push str.SERVER_OPEN_PLAN
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 4]
mov byte [esi + 0x1b85], al
mov dword [esp + 0x10], 0xffffffff
call fcn.004a6b19
mov ecx, dword [esp + 8]
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4754a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b23e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x30]
push ebx
push esi
mov esi, ecx
push eax
lea ecx, [esp + 0xc]
call fcn.004a6b87
mov ecx, dword [0x4d8cb8]
mov dl, byte [esp + 0x40]
mov dword [esp + 0xc], ecx
lea ecx, [esp + 8]
mov byte [esp + 0x10], dl
mov dword [esp + 0x24], 0
call fcn.00473440
mov eax, dword [esp + 0x3c]
mov ecx, dword [esp + 0x44]
mov edx, dword [esp + 0x48]
mov dword [esp + 0x14], eax
lea eax, [esp + 8]
mov dword [esp + 0x18], ecx
push eax
mov ecx, esi
mov dword [esp + 0x34], 0
mov dword [esp + 0x24], edx
call fcn.004755b0
mov bl, al
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 1
call fcn.004a6b19
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.004a6b19
mov ecx, dword [esp + 0x28]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14

Function at 0x476370
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push eax
mov ecx, dword [esi + 0x198]
push ecx
mov ecx, esi
call fcn.004765e0
mov edx, dword [esi + 0x19c]
mov dword [esi + 0x198], eax
and eax, 0xff
mov ecx, esi
add eax, edx
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x19c], eax
shr eax, 0x18
mov byte [esp + 8], al
mov eax, dword [esi + 0x1a0]
mov edx, dword [esp + 8]
push edx
push eax
call fcn.004765e0
mov dword [esi + 0x1a0], eax
pop esi
ret 4
Function at 0x476e10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b2725
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov eax, dword [esp + 0x38]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push eax
lea ecx, [esp + 0x44]
mov dword [esp + 0xc], ebx
call fcn.004a6b87
mov eax, dword [esp + 0x48]
mov dword [esp + 0x30], 1
test eax, eax
jne 0x476e54
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0x10]
call fcn.004a6b87
mov ecx, dword [esp + 0xc]
mov byte [esp + 0x30], 2
mov eax, dword [ecx - 8]
test eax, eax
jne 0x476e8b
mov esi, dword [esp + 0x38]
lea edx, [esp + 0x40]
push edx
mov ecx, esi
call fcn.004a688e
mov dword [esp + 8], 1
jmp 0x476fb9
mov eax, dword [esp + 0x40]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x476eb4
push 0x4d6c24
lea ecx, [esp + 0x44]
call fcn.004a1ac1
mov cl, byte [0x4b7870]
push ecx
lea ecx, [esp + 0x44]
call fcn.004a6f1c
push 0x4d6c24
lea ecx, [esp + 0x10]
call fcn.004a1ac1
mov eax, dword [0x4d8cb8]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push edx
mov byte [esp + 0x34], 7
mov dword [esp + 0x14], 0x4b782c
call fcn.0047f130
mov al, byte [esp + 0x44]
mov byte [esp + 0x30], 8
test al, al
je 0x476f2e
mov al, byte [esi + 4]
test al, al
je 0x476f28
lea eax, [esp + 0x48]
lea ecx, [esp + 0x10]
push eax
call fcn.0047f330
mov ebx, 2
mov dword [esp + 8], ebx
mov byte [esp + 0x30], 9
jmp 0x476f50
lea eax, [esp + 0xc]
jmp 0x476f50
lea ecx, [esp + 0x10]
lea edx, [esp + 0x44]
push ecx
push edx
mov ecx, esi
call fcn.00476a70
mov ebx, 4
mov dword [esp + 8], ebx
mov dword [esp + 0x30], 0xa
push eax
lea ecx, [esp + 0x44]
call fcn.004a6f31
test bl, 4
mov dword [esp + 0x30], 9
je 0x476f77
and ebx, 0xfffffffb
lea ecx, [esp + 0x44]
mov dword [esp + 8], ebx
call fcn.004a6b19
test bl, 2
mov dword [esp + 0x30], 8
je 0x476f94
and ebx, 0xfffffffd
lea ecx, [esp + 0x48]
mov dword [esp + 8], ebx
call fcn.004a6b19
mov esi, dword [esp + 0x38]
lea eax, [esp + 0x40]
push eax
mov ecx, esi
call fcn.004a688e
or ebx, 1
lea ecx, [esp + 0x10]
mov dword [esp + 8], ebx
mov byte [esp + 0x30], 2
call fcn.0047f0b0
lea ecx, [esp + 0xc]
mov byte [esp + 0x30], 1
call fcn.004a6b19
lea ecx, [esp + 0x40]
mov byte [esp + 0x30], 0
call fcn.004a6b19
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0x14
Function at 0x4777e0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4b27a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebp
push esi
mov esi, ecx
push edi
mov ecx, dword [esi + 0xa0]
mov edi, dword [esi + 0x144]
mov eax, dword [ecx]
call dword [eax + 0xc]
mov edx, dword [esp + 0x30]
mov ecx, eax
sub ecx, edi
mov edi, dword [esp + 0x34]
lea eax, [edx + 1]
mov edx, dword [esi + 0x10c]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
mov eax, dword [edx + eax*4]
mov eax, dword [eax + 0x28]
mov dword [esp + 0x30], eax
sub eax, ecx
sub edi, eax
je 0x47795e
lea ecx, [esp + 0x1c]
push ecx
push 0x400
lea ecx, [esi + 8]
call fcn.00477da0
test eax, eax
je 0x477861
mov ebp, dword [eax + 0xc]
mov dword [ebp + 8], 0x400
jmp 0x477863
xor ebp, ebp
mov ecx, dword [esi + 0xa0]
push ebx
mov edx, dword [ecx]
call dword [edx + 0x14]
mov ecx, dword [esi + 0x144]
mov ebx, eax
sub ebx, ecx
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x4778cb
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.004762d0
mov eax, dword [eax]
mov edx, dword [ebp]
push eax
mov eax, dword [esp + 0x40]
push eax
mov ecx, ebp
mov dword [esp + 0x34], 0
call dword [edx + 4]
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004a6b19
mov ecx, dword [esp + 0x34]
mov edx, dword [ebp]
mov eax, ebx
sub eax, ecx
mov ecx, ebp
push eax
call dword [edx + 8]
mov eax, dword [esp + 0x10]
test edi, edi
setg cl
test cl, cl
mov byte [esp + 0x38], cl
je 0x4778e6
mov ecx, dword [esi + 0xa0]
add eax, edi
push eax
mov edx, dword [ecx]
call dword [edx + 0x18]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push eax
mov eax, edi
cdq
xor eax, edx
push ebp
sub eax, edx
push eax
push ebx
push ecx
mov ecx, esi
call fcn.00477980
mov al, byte [esp + 0x38]
test al, al
jne 0x47791b
mov ecx, dword [esi + 0xa0]
mov eax, dword [esp + 0x10]
add eax, edi
mov edx, dword [ecx]
push eax
call dword [edx + 0x18]
mov ecx, dword [esi + 0xa0]
mov eax, dword [esp + 0x18]
push 0
push eax
mov edx, dword [ecx]
call dword [edx + 0x10]
mov edx, dword [esi + 0x110]
mov eax, dword [esp + 0x1c]
cmp eax, edx
jge 0x477951
mov ecx, dword [esi + 0x10c]
mov ecx, dword [ecx + eax*4]
mov ebx, dword [ecx + 0x28]
add ebx, edi
inc eax
cmp eax, edx
mov dword [ecx + 0x28], ebx
jl 0x47793b
test ebp, ebp
pop ebx
je 0x47795e
mov edx, dword [ebp]
mov ecx, ebp
call dword [edx + 0xc]
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x20
ret 0xc
Function at 0x47b330
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4b2e10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
mov ecx, dword [ecx + 0x1c]
lea edx, [esp]
push edx
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, dword [esp]
mov dword [esp + 0x28], 0
mov eax, dword [ecx - 8]
test eax, eax
jne 0x47b38a
lea ecx, [esp]
mov dword [esp + 0x28], 0xffffffff
call fcn.004a6b19
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
add esp, 0x2c
ret
mov eax, dword [0x4d8cb8]
push esi
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push ecx
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], 5
mov dword [esp + 0x10], 0x4b782c
call fcn.0047f130
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
mov byte [esp + 0x30], 6
call fcn.00474de0
mov eax, dword [eax]
mov byte [esp + 0x2c], 7
push eax
call fcn.0047b8f0
add esp, 4
lea ecx, [esp + 8]
mov esi, eax
mov byte [esp + 0x2c], 6
call fcn.004a6b19
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.0047f0b0
lea ecx, [esp + 4]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004a6b19
mov ecx, dword [esp + 0x24]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x2c
ret

Function at 0x47b420
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4b2e60
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x1c
push esi
push edi
mov edi, eax
mov esi, ecx
and edi, 0xffff
test ax, ax
mov dword [esi + 0x50], edi
je 0x47b549
mov ecx, dword [esi + 0x1c]
lea edx, [esp + 0x34]
push edx
mov eax, dword [ecx]
call dword [eax + 0x24]
mov eax, dword [esi + 0x20]
mov dword [esp + 0x2c], 0
cmp eax, 3
jne 0x47b48a
mov eax, dword [esp + 0x34]
push eax
call fcn.0047bdc0
add esp, 4
neg al
sbb eax, eax
add eax, 2
mov dword [esi + 0x20], eax
jmp 0x47b491
mov dword [esi + 0x20], 2
cmp dword [esi + 0x20], 1
jne 0x47b4a9
mov eax, dword [esi + 0x24]
test eax, eax
jne 0x47b4ac
push 0x67
mov ecx, esi
call fcn.0047ab30
jmp 0x47b4ac
mov dword [esi + 0x28], edi
mov eax, dword [0x4d8cb8]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x34]
mov byte [esp + 0x2c], 5
push ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0x4b782c
call fcn.0047f130
lea edx, [esp + 8]
lea ecx, [esp + 0xc]
push edx
mov byte [esp + 0x30], 6
call fcn.0047b570
push eax
lea ecx, [esi + 0x2c]
mov byte [esp + 0x30], 7
call fcn.004a6c52
lea ecx, [esp + 8]
mov byte [esp + 0x2c], 6
call fcn.004a6b19
lea ecx, [esi + 0x3c]
call fcn.00478140
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.0047f0b0
lea ecx, [esp + 0x34]
mov dword [esp + 0x2c], 0xffffffff
call fcn.004a6b19
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x20], 0
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x28
ret 4
Function at 0x47b8f0
Capabilities:
Access peb ldr_data
Get disk size

Disassembly:
push 0xffffffffffffffff
push 0x4b2ed8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
mov eax, dword [0x4d8cb8]
push esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x3c], 0
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x44]
lea ecx, [esp + 0x1c]
push eax
mov byte [esp + 0x40], 4
mov dword [esp + 0x20], 0x4b782c
call fcn.0047f130
lea ecx, [esp + 0x44]
mov dword [esp + 0x3c], 5
push ecx
lea ecx, [esp + 0x20]
call fcn.0047ba40
mov esi, dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
mov byte [esp + 0x50], 6
call esi
test eax, eax
jne 0x47b9f3
push 0x4d6c24
lea ecx, [esp + 0x48]
call fcn.004a1ac1
mov cl, byte [0x4b7870]
push ecx
lea ecx, [esp + 0x48]
call fcn.004a6f1c
lea edx, [esp + 0x10]
lea eax, [esp + 0xc]
push edx
lea ecx, [esp + 0xc]
push eax
mov eax, dword [esp + 0x4c]
lea edx, [esp + 0xc]
push ecx
push edx
push eax
call esi
test eax, eax
jne 0x47b9f3
lea ecx, [esp + 0x44]
mov byte [esp + 0x3c], 5
call fcn.004a6b19
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0047f0b0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
add esp, 0x3c
ret
mov esi, dword [esp + 4]
lea ecx, [esp + 0x44]
imul esi, dword [esp + 8]
imul esi, dword [esp + 0xc]
mov dword [esp + 0x18], 0
mov byte [esp + 0x3c], 5
call fcn.004a6b19
lea ecx, [esp + 0x1c]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0047f0b0
mov ecx, dword [esp + 0x34]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x3c
ret

Function at 0x47ba60
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
push 0
push 0
push 3
push 0
push 1
push bind
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
jne 0x47ba87
pop edi
xor al, al
pop esi
ret
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
jne 0x47baa3
pop edi
xor al, al
pop esi
ret
mov ecx, dword [esp + 0x10]
mov al, 1
mov dword [ecx], edi
pop edi
pop esi
ret
Function at 0x47bab0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b2f17
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov al, byte [0x4dca10]
mov ecx, dword [0x4d8cb8]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x18], ebx
mov byte [esp + 0x13], al
mov dword [esp + 0x14], ecx
mov eax, dword [esp + 0x30]
mov edi, dword [esp + 0x34]
mov ebp, 1
cmp eax, ebx
mov dword [esp + 0x24], ebp
je 0x47bb1e
push eax
lea ecx, [esp + 0x18]
call fcn.004a6ca2
mov edx, dword [esp + 0x14]
push edx
call fcn.0047b8f0
add esp, 4
cmp eax, edi
setb al
cmp al, bl
je 0x47bbb6
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push ebx
push ebx
call ebp
mov esi, eax
cmp esi, ebx
jne 0x47bb4b
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x13]
push eax
mov ecx, esi
call fcn.004a6b87
mov dword [esp + 0x18], 1
jmp 0x47bc28
push esi
lea ecx, [esp + 0x18]
call fcn.004a6f49
push eax
push esi
call ebp
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call fcn.004a6f98
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0047b8f0
add esp, 4
cmp eax, edi
jae 0x47bbb1
lea edx, [esp + 0x14]
push edx
call fcn.0047bc50
add esp, 4
test al, al
je 0x47bb97
mov eax, dword [esp + 0x14]
push eax
call fcn.0047b8f0
add esp, 4
cmp eax, edi
jae 0x47bbb1
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x13]
push ecx
mov ecx, esi
call fcn.004a6b87
mov dword [esp + 0x18], 1
jmp 0x47bc28
mov ebp, 1
mov edx, dword [0x4d8cb8]
mov dword [esp + 0x30], edx
mov esi, dword [esp + 0x14]
push 0x104
lea ecx, [esp + 0x34]
mov byte [esp + 0x28], 2
call fcn.004a6f49
push eax
push ebx
push 0x4d6c68
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x47bbfb
mov esi, dword [esp + 0x2c]
lea eax, [esp + 0x13]
push eax
mov ecx, esi
call fcn.004a6b87
jmp 0x47bc16
push 0xffffffffffffffff
lea ecx, [esp + 0x34]
call fcn.004a6f98
mov esi, dword [esp + 0x2c]
lea ecx, [esp + 0x30]
push ecx
mov ecx, esi
call fcn.004a688e
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], ebp
mov byte [esp + 0x24], 1
call fcn.004a6b19
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], bl
call fcn.004a6b19
mov ecx, dword [esp + 0x1c]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret

Function at 0x47bc50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push esi
push 0
push 0
call ebp
mov esi, eax
test esi, esi
jne 0x47bc69
pop esi
xor al, al
pop ebp
ret
push ebx
push edi
push esi
call fcn.004a685a
add esp, 4
mov edi, eax
mov bl, 1
push edi
push esi
call ebp
test eax, eax
jne 0x47bc92
push edi
xor bl, bl
call fcn.004a6883
add esp, 4
mov al, bl
pop edi
pop ebx
pop esi
pop ebp
ret
mov ecx, dword [esp + 0x14]
push edi
call fcn.004a6ca2
push edi
call fcn.004a6883
add esp, 4
mov al, bl
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x47bcb0
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
neg eax
ret