joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ce60
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x516cd3
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00404c30
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.00404c30
mov byte [esp + 0x18], 1
mov eax, dword [esi + 0x30]
mov dword [edi + 0x30], eax
mov ax, word [esi + 0x34]
mov word [edi + 0x34], ax
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x46cf10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x516d19
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov esi, dword [esp + 0x20]
xor eax, eax
push 0xffffffffffffffff
push eax
mov dword [edi + 0x14], 7
mov dword [edi + 0x10], 0
push esi
mov word [edi], ax
call fcn.00404c30
mov dword [esp + 0x18], 0
lea ecx, [edi + 0x18]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x18]
push eax
call fcn.00404c30
mov byte [esp + 0x18], 1
lea ecx, [edi + 0x30]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x30]
push eax
call fcn.00404c30
mov byte [esp + 0x18], 2
lea ecx, [edi + 0x48]
xor eax, eax
mov dword [ecx + 0x14], 7
push 0xffffffffffffffff
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [esi + 0x48]
push eax
call fcn.00404c30
mov dword [esp + 0x18], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4
Function at 0x46d540
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x516dff
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov dword [esp + 0x14], eax
mov dword [esi + 0x2c], 7
mov dword [esi + 0x28], eax
mov word [esi + 0x18], ax
mov byte [esp + 0x14], 1
mov dword [esi + 0x44], 7
mov dword [esi + 0x40], eax
mov word [esi + 0x30], ax
mov byte [esp + 0x14], 2
mov dword [esi + 0x5c], 7
mov dword [esi + 0x58], eax
mov word [esi + 0x48], ax
mov byte [esp + 0x14], 3
mov dword [esi + 0x74], 7
mov dword [esi + 0x70], eax
mov word [esi + 0x60], ax
mov byte [esp + 0x14], 4
mov dword [esi + 0x8c], 7
mov dword [esi + 0x88], eax
mov word [esi + 0x78], ax
mov byte [esp + 0x14], 5
push 0x35c
push eax
lea eax, [esi + 0x98]
push eax
call sub.MSVCR120.dll_memset
add esp, 0xc
xor eax, eax
mov dword [esi + 0x90], eax
mov word [esi + 0x94], ax
mov dword [esp + 0x14], 0xffffffff
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret

Function at 0x46e090
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x517059
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov edx, dword [esp + 0x38]
lea eax, [esp + 0x14]
push eax
mov ecx, esi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], 0
call fcn.0046de50
add esp, 4
lea edx, [esp + 0x14]
mov ecx, edi
call fcn.0046df20
mov dword [esp + 0x30], 0
mov dword [esp + 0xc], 1
mov eax, edi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00505b1e
add esp, 0x28
ret
Function at 0x46fcb0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push edi
mov edi, dword [esp + 0x10]
cmp eax, 0xffffffff
jne 0x46fcde
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00505b1e
add esp, 8
ret 4
push esi
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x46fd19
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x46fd19
pop esi
xor al, al
pop edi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00505b1e
add esp, 8
ret 4
mov ecx, dword [esp + 8]
xor eax, eax
add eax, esi
mov dword [edi], eax
mov al, 1
adc ecx, 0
mov dword [edi + 4], ecx
mov ecx, dword [esp + 0xc]
pop esi
pop edi
xor ecx, esp
call fcn.00505b1e
add esp, 8
ret 4
Function at 0x4709f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x517597
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, ecx
mov dword [edi], vtable.RC::RCFileHash.0
mov dword [edi + 4], 0
mov dword [esp + 0x14], edi
mov byte [edi + 8], 0
mov dword [esp + 0x38], 0
mov dword [edi], vtable.RC::RCFileHashCalc.0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [esp + 0x38], 2
xorps xmm0, xmm0
movq qword [esp + 0x18], xmm0
mov dword [esp + 0x20], 0
mov dword [edi], vtable.RC::RCMD5.0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov byte [esp + 0x38], 3
push 8
movq qword [esp + 0x28], xmm0
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
add esp, 4
mov dword [esp + 0x10], eax
mov byte [esp + 0x38], 4
test eax, eax
je 0x470ac5
xorps xmm0, xmm0
mov ecx, eax
movq qword [eax], xmm0
call fcn.00459d00
jmp 0x470ac7
xor eax, eax
mov byte [esp + 0x38], 3
lea ecx, [esp + 0x24]
push eax
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
call fcn.0042c770
mov byte [esp + 0x38], 5
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x1c]
call fcn.00470d70
lea eax, [esp + 0x18]
push eax
lea ecx, [edi + 0xc]
call fcn.0047a7f0
mov byte [esp + 0x38], 3
mov esi, dword [esp + 0x28]
test esi, esi
je 0x470b38
or ebx, 0xffffffff
lea ecx, [esi + 4]
mov eax, ebx
lock xadd dword [ecx], eax
jne 0x470b38
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lea eax, [esi + 8]
lock xadd dword [eax], ebx
dec ebx
jne 0x470b38
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov byte [esp + 0x38], 2
mov esi, dword [esp + 0x18]
test esi, esi
je 0x470b77
push dword [esp + 0x10]
mov edx, dword [esp + 0x20]
push ecx
mov ecx, esi
call fcn.00465910
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 0xc
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x38], 0xffffffff
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00505b1e
add esp, 0x2c
ret
Function at 0x476f30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x518318
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, edx
mov dword [esp + 0xc], eax
mov edi, ecx
mov ecx, eax
mov dword [esp + 0x20], 0
sub ecx, edi
mov eax, 0x81848da9
imul ecx
xorps xmm0, xmm0
movdqu xmmword [esp + 0x10], xmm0
mov dword [esp + 0x10], 0
add edx, ecx
mov dword [esp + 0x14], 0
sar edx, 9
mov esi, edx
mov dword [esp + 0x18], 0
shr esi, 0x1f
add esi, edx
lea eax, [esi + 1]
cdq
sub eax, edx
sar eax, 1
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x10]
mov dword [esp + 0x20], eax
mov dword [esp + 0x30], 0
mov ecx, edi
push dword [esp + 0x40]
mov edx, dword [esp + 0x10]
push eax
push esi
call fcn.004771d0
add esp, 0xc
mov dword [esp + 0x30], 0xffffffff
mov esi, dword [esp + 0x10]
test esi, esi
je 0x477011
cmp esi, dword [esp + 0x18]
je 0x477007
mov edi, edi
mov ecx, esi
call fcn.0046d810
add esi, 0x3f4
cmp esi, dword [esp + 0x18]
jne 0x476ff0
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00505b1e
add esp, 0x28
ret
Function at 0x478380
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x518600
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov dword [esp + 0x1c], edx
mov ebp, ecx
mov ebx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
mov edi, dword [esp + 0x54]
mov esi, dword [esp + 0x50]
mov dword [esp + 0x20], eax
test ebx, ebx
je 0x478550
test esi, esi
je 0x478550
cmp ebx, esi
jg 0x478481
mov ecx, edi
call fcn.004775a0
cmp ebx, eax
jg 0x478481
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 0
mov esi, dword [esp + 0x30]
push esi
mov dword [esp + 0x58], 0xffffffff
mov edx, ebp
lea ecx, [esp + 0x3c]
call fcn.00478140
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.00477170
push dword [esp + 0x18]
mov ebx, dword [esp + 0x24]
mov ecx, esi
push ebp
mov edx, ebx
call fcn.00478f60
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebx
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00478e50
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ecx, edi
call fcn.004775a0
cmp esi, eax
jg 0x478529
mov ecx, dword [edi + 0x10]
sub esp, 0x14
mov dword [esp + 0x2c], esp
mov eax, dword [ecx]
mov dword [ecx + 4], eax
mov ecx, esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [edi + 0x10]
mov dword [ecx + 0x10], eax
mov dword [esp + 0x54], 1
mov ebx, dword [esp + 0x34]
push ebx
mov dword [esp + 0x58], 0xffffffff
lea ecx, [esp + 0x3c]
mov edx, dword [esp + 0x34]
call fcn.00478140
add esp, 0x18
lea ecx, [esp + 0x24]
call fcn.00477170
push dword [esp + 0x18]
mov edx, dword [esp + 0x20]
mov ecx, ebp
push ebx
call fcn.00478e50
mov eax, dword [edi + 0x10]
push dword [esp + 0x20]
push ebp
mov edx, dword [eax + 4]
mov ecx, dword [eax]
call fcn.00478f60
add esp, 0x10
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
mov ebx, dword [esp + 0x20]
mov ecx, ebp
mov edx, dword [esp + 0x1c]
push ebx
call fcn.00478bb0
add esp, 4
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
imul eax, esi, 0x3f4
add eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x478730
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x5186d9
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, edx
mov eax, ecx
mov dword [esp + 0x1c], eax
mov esi, dword [esp + 0x4c]
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], 0
mov dword [esp + 0x40], 1
mov ebp, dword [esp + 0x48]
mov ebx, dword [esp + 0x50]
cmp edi, ebp
je 0x4787b7
cmp esi, ebx
je 0x4787b7
push edi
mov ecx, esi
call fcn.0046db20
lea ecx, [esp + 0x54]
test al, al
je 0x4787a7
push esi
call fcn.00478d80
add esi, 0x3f4
cmp esi, ebx
jmp 0x4787b5
push edi
call fcn.00478d80
add edi, 0x3f4
cmp edi, ebp
jne 0x478787
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 2
push ebp
mov byte [esp + 0x58], 1
mov edx, edi
lea ecx, [esp + 0x3c]
call fcn.00478140
add esp, 0x18
mov byte [esp + 0x40], 3
mov eax, dword [eax + 0x10]
mov dword [esp + 0x64], eax
mov byte [esp + 0x40], 1
mov edi, dword [esp + 0x24]
mov ebp, dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
test edi, edi
je 0x47883d
cmp edi, dword [esp + 0x2c]
je 0x478837
mov ecx, edi
call fcn.0046d810
add edi, 0x3f4
cmp edi, dword [esp + 0x2c]
jne 0x478820
mov edi, dword [esp + 0x24]
push edi
call ebp
add esp, 4
sub esp, 0x14
mov ecx, esp
mov dword [esp + 0x2c], esp
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
mov eax, dword [esp + 0x78]
mov dword [ecx + 0x10], eax
mov byte [esp + 0x54], 4
push ebx
mov byte [esp + 0x58], 1
mov edx, esi
mov edi, dword [esp + 0x34]
mov ecx, edi
call fcn.00478140
add esp, 0x18
mov dword [esp + 0x14], 1
mov byte [esp + 0x40], 0
mov esi, dword [esp + 0x54]
test esi, esi
je 0x4788bd
cmp esi, dword [esp + 0x5c]
je 0x4788b7
mov edi, edi
mov ecx, esi
call fcn.0046d810
add esi, 0x3f4
cmp esi, dword [esp + 0x5c]
jne 0x4788a0
mov esi, dword [esp + 0x54]
push esi
call ebp
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
Function at 0x47ad50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x80
push esi
mov dword [esp + 4], 0x10d040e
xor esi, esi
mov dword [esp + 8], 0x80b0f02
mov dword [esp + 0xc], 0xc060a03
mov dword [esp + 0x10], 0x7000905
mov dword [esp + 0x14], 0xe08010f
mov dword [esp + 0x18], 0x4030b06
mov dword [esp + 0x1c], 0xd020709
mov dword [esp + 0x20], 0xa05000c
mov dword [esp + 0x24], 0xe09000a
mov dword [esp + 0x28], 0x50f0306
mov dword [esp + 0x2c], 0x70c0d01
mov dword [esp + 0x30], 0x802040b
mov dword [esp + 0x34], 0x30e0d07
mov dword [esp + 0x38], 0xa090600
mov dword [esp + 0x3c], 0x5080201
mov dword [esp + 0x40], 0xf040c0b
mov dword [esp + 0x44], 0x1040c02
mov dword [esp + 0x48], 0x60b0a07
mov dword [esp + 0x4c], 0xf030508
mov dword [esp + 0x50], 0x90e000d
mov dword [esp + 0x54], 0xf0a010c
mov dword [esp + 0x58], 0x8060209
mov dword [esp + 0x5c], 0x4030d00
mov dword [esp + 0x60], 0xb05070e
mov dword [esp + 0x64], 0xe020b04
mov dword [esp + 0x68], 0xd08000f
mov dword [esp + 0x6c], 0x7090c03
mov dword [esp + 0x70], 0x1060a05
mov dword [esp + 0x74], 0x408020d
mov dword [esp + 0x78], 0x10b0f06
mov dword [esp + 0x7c], 0xe03090a
mov dword [esp + 0x80], 0x70c0005
lea esp, [esp]
mov ecx, esi
mov edx, esi
sar ecx, 4
and edx, 0xf
movzx eax, byte [esp + ecx + 4]
shl al, 4
or al, byte [esp + edx + 0x14]
mov byte [esi + 0x569240], al
movzx eax, byte [esp + ecx + 0x24]
shl al, 4
or al, byte [esp + edx + 0x34]
mov byte [esi + 0x569340], al
movzx eax, byte [esp + ecx + 0x44]
shl al, 4
or al, byte [esp + edx + 0x54]
mov byte [esi + 0x569440], al
movzx eax, byte [esp + ecx + 0x64]
shl al, 4
or al, byte [esp + edx + 0x74]
mov byte [esi + 0x569140], al
inc esi
cmp esi, 0x100
jl 0x47ae60
pop esi
add esp, 0x80
ret
Function at 0x47e550
Capabilities:
Get file size
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x518f18
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [esp + 0x5c]
mov esi, dword [esp + 0x50]
mov eax, dword [esp + 0x58]
mov dword [esp + 0x14], esi
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x47e5a6
mov dword [ecx], 0
mov dword [eax], 0
cmp dword [edi], 0xffffffff
je 0x47e72b
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x100000
mov eax, dword [esp + 0x54]
push 0
mov ebx, eax
mov dword [esp + 0x34], 0
cmp eax, 0x100000
lea eax, [esp + 0x34]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x47e6f0
test eax, eax
je 0x47e6f0
mov ecx, dword [esp + 0x30]
jmp 0x47e610
cmp ecx, ebx
jae 0x47e6f4
call ebp
mov ecx, dword [edi]
mov dword [esp + 0x18], eax
cmp ecx, 0xffffffff
je 0x47e653
lea eax, [esp + 0x38]
mov dword [esp + 0x38], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47e646
call ebp
test eax, eax
jne 0x47e653
mov eax, dword [esp + 0x38]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x47e664
xorps xmm0, xmm0
movlpd qword [esp + 0x24], xmm0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x24]
push 0
push dword [esp + 0x1c]
push eax
push ecx
sub esp, 0x18
xor eax, eax
mov ecx, esp
mov dword [esp + 0x40], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [edi + 4]
push eax
call fcn.00404c30
mov dword [esp + 0x70], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [esp + 0x70], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [esp + 0x14]
test eax, eax
jne 0x47e6f0
push eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x38]
push eax
mov eax, dword [esp + 0x38]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x30]
neg eax
sbb eax, eax
add ecx, dword [esp + 0x34]
and eax, 0x7fffbffb
mov dword [esp + 0x30], ecx
add eax, 0x80004005
jne 0x47e610
jmp 0x47e6f4
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x20]
add dword [edx], ecx
test eax, eax
jne 0x47e721
test ecx, ecx
je 0x47e71d
mov eax, dword [esp + 0x54]
add esi, ecx
sub eax, ecx
mov dword [esp + 0x14], esi
mov dword [esp + 0x54], eax
mov ecx, 0x100000
jne 0x47e5c4
mov al, 1
jmp 0x47e72d
mov ecx, dword [esp + 0x1c]
test ecx, ecx
je 0x47e72b
mov dword [ecx], eax
xor al, al
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.00505b1e
add esp, 0x38
ret 0x10
Function at 0x47e7b0
Capabilities:
Clear file content

Disassembly:
push 0xffffffffffffffff
push 0x518f48
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [esp + 0x1c]
xorps xmm0, xmm0
push eax
push 1
push 0
push 0
movlpd qword [esp + 0x2c], xmm0
xor bl, bl
call fcn.0046fd40
mov ebp, dword [esp + 0x44]
test al, al
lea eax, [esp + 0x24]
movzx ecx, bl
mov ebx, dword [esp + 0x48]
mov edx, 1
push eax
push 0
cmovne ecx, edx
xorps xmm0, xmm0
push ebx
mov dword [esp + 0x24], ecx
mov ecx, edi
push ebp
movlpd qword [esp + 0x34], xmm0
call fcn.0046fd40
test al, al
je 0x47e94c
cmp dword [esp + 0x24], ebp
jne 0x47e94c
cmp dword [esp + 0x28], ebx
jne 0x47e94c
mov ebp, dword [esp + 0x4c]
mov eax, dword [edi]
test ebp, ebp
jne 0x47e881
cmp eax, 0xffffffff
jne 0x47e864
xor al, al
xor ecx, ecx
test al, al
mov esi, 0x80004005
cmovne esi, ecx
jmp 0x47e922
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
mov esi, 0x80004005
setne al
xor ecx, ecx
test al, al
cmovne esi, ecx
jmp 0x47e922
mov ebx, dword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 0xffffffff
jne 0x47e890
xor al, al
jmp 0x47e898
push eax
call ebx
test eax, eax
setne al
xor ecx, ecx
mov esi, 0x80004005
test al, al
cmovne esi, ecx
test esi, esi
je 0x47e922
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
push eax
push dword [esp + 0x50]
xor eax, eax
push dword [esp + 0x50]
sub esp, 0x18
mov ecx, esp
mov dword [esp + 0x74], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], 7
mov dword [ecx + 0x10], 0
push eax
mov word [ecx], ax
lea eax, [edi + 4]
push eax
call fcn.00404c30
mov dword [esp + 0x64], 0
mov eax, dword [ebp]
mov dword [esp + 0x64], 0xffffffff
mov ecx, ebp
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jne 0x47e922
mov eax, dword [edi]
cmp eax, 0xffffffff
jne 0x47e90a
xor al, al
jmp 0x47e912
push eax
call ebx
test eax, eax
setne al
xor ecx, ecx
mov esi, 0x80004005
test al, al
cmovne esi, ecx
test esi, esi
jne 0x47e8a8
cmp byte [esp + 0x18], 0
je 0x47e948
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x50], xmm0
push dword [esp + 0x28]
call fcn.0046fd40
mov eax, esi
jmp 0x47e977
cmp byte [esp + 0x18], 0
je 0x47e972
lea eax, [esp + 0x44]
xorps xmm0, xmm0
push eax
push 0
push dword [esp + 0x28]
mov ecx, edi
movlpd qword [esp + 0x50], xmm0
push dword [esp + 0x28]
call fcn.0046fd40
mov eax, 0x80004005
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc
Function at 0x480e70
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x519568
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x18], eax
push ebx
push esi
push edi
mov eax, dword [section..data]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x480ff9
cmp dword [eax], 0
je 0x480ff9
push 1
push 0x539204
lea ecx, [ebx + 0x10]
call fcn.00439a90
mov ecx, dword [ebx + 0x20]
test ecx, ecx
je 0x480efc
cmp dword [ebx + 0x24], 0x10
jb 0x480ee1
mov eax, dword [ebx + 0x10]
jmp 0x480ee4
lea eax, [ebx + 0x10]
mov al, byte [eax + ecx - 1]
cmp al, 0x20
je 0x480f0c
cmp al, 0xa
je 0x480efc
push 0xa
push 1
lea ecx, [ebx + 0x10]
call fcn.00439b70
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x28]
push eax
lea ecx, [ebx + 0x10]
call fcn.004399e0
push 0
lea eax, [esp + 0x14]
mov ecx, esi
push eax
call fcn.0048bd30
mov dword [esp + 0x38], 0
lea esi, [esp + 0x10]
cmp dword [esp + 0x24], 0x10
cmovae esi, dword [esp + 0x10]
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x20]
cmovae ecx, dword [esp + 0x10]
add eax, ecx
lea ecx, [ebx + 0x10]
cmp esi, eax
je 0x480fbc
movzx eax, byte [esi]
push eax
push 1
call fcn.00439b70
cmp byte [esi], 0xa
jne 0x480fb6
cmp dword [esp + 0x24], 0x10
lea ecx, [esp + 0x10]
mov eax, dword [esp + 0x20]
cmovae ecx, dword [esp + 0x10]
add eax, ecx
cmp esi, eax
je 0x480fb6
cmp byte [esi + 1], 0x2f
jne 0x480fb6
mov eax, dword [ebx + 0x20]
test eax, eax
je 0x480fa6
cmp dword [ebx + 0x24], 0x10
jb 0x480f8b
mov ecx, dword [ebx + 0x10]
jmp 0x480f8e
lea ecx, [ebx + 0x10]
mov al, byte [ecx + eax - 1]
cmp al, 0x20
je 0x480fb6
cmp al, 0xa
je 0x480fa6
push 0xa
push 1
lea ecx, [ebx + 0x10]
call fcn.00439b70
push 0xffffffffffffffff
push 0
lea eax, [ebx + 0x28]
push eax
lea ecx, [ebx + 0x10]
call fcn.004399e0
inc esi
jmp 0x480f30
push 1
push 0x539204
call fcn.00439a90
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x480fe4
push dword [esp + 0x10]
call dword [sym.imp.MSVCR120.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.00505b1e
mov esp, ebp
pop ebp
ret 4