joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46ffb4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00405848
xor eax, eax
push ebp
push 0x470059
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebp - 8]
call fcn.00468bd8
mov esi, dword [ebx + 0x1c]
mov dword [esi + 0x53c], ebx
mov dword [esi + 0x538], 0x46ff1c
mov dword [esi + 0x544], ebx
mov dword [esi + 0x540], 0x46ff7c
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x46ff34
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 4], eax
push ebp
call fcn.0046ff90
pop ecx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 0xc], 0
je 0x470043
mov eax, ebx
call fcn.0046fe18
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470060
lea eax, [ebp - 8]
call fcn.004053c8
ret

Function at 0x471688
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov dword [0x48fbd0], 0xffffffff
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov ebx, 0xff
jmp 0x4716cc
cmp dword [0x48fbd0], 0
je 0x4716de
mov eax, edi
call fcn.004715f4
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, ebp
jbe 0x4716cc
mov ebx, 0x102
jmp 0x4716de
cmp ebx, 0xff
jne 0x4716de
mov eax, dword [0x6349ec]
cmp byte [eax], 0
je 0x4716a8
xor eax, eax
mov dword [0x48fbd0], eax
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x474c78
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
or ebp, 0xffffffff
cmp dword [esp], 0x32
jne 0x474d58
mov esi, ebx
movzx eax, word [esi + 2]
cmp ax, 0x2417
jbe 0x474d58
cmp ax, 0x241d
jae 0x474d58
push 0x32
call fcn.004070d8
pop ecx
mov esi, eax
mov ecx, 0x32
mov edx, ebx
mov eax, esi
call fcn.00408390
movzx ebp, word [esi + 2]
sub ebp, 0x2012
sub ebp, 6
sub ebp, 0x400
dec ebp
cmp ebp, 0xffffffff
jne 0x474d2d
mov dword [esp + 4], 4
mov ebx, 0x63d8cc
mov eax, dword [ebx]
call fcn.00474a50
push 0x32
call fcn.004070d8
pop ecx
mov edi, eax
mov ecx, 0x32
mov edx, esi
mov eax, edi
call fcn.00408390
mov eax, dword [ebx]
mov edx, edi
call fcn.004240d0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
mov dword [edx + 4], eax
add ebx, 4
dec dword [esp + 4]
jne 0x474ce9
push esi
call fcn.004070e8
pop ecx
jmp 0x474d58
mov eax, ebp
sub eax, 4
jae 0x474d53
mov eax, dword [ebp*4 + 0x63d8cc]
mov edx, esi
call fcn.004240d0
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp*4 + 0x63d8cc]
mov dword [edx + 4], eax
jmp 0x474d58
mov ebp, 0xfffffffe
mov eax, ebp
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x476860
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48fc58], ax
cmp byte [0x48fc54], 0
jne 0x476875
xor ebx, ebx
jmp 0x4768d8
call fcn.00476824
push esp
push 0
push 0
push 0x476380
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x4768cc
cmp dword [0x48fc50], 0
je 0x4768ad
push 0x64
mov eax, dword [0x48fc50]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x476893
cmp dword [0x48fc64], 0
jbe 0x4768be
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48fc64]
jmp 0x4768d8
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.00475f68
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x477c70
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48fd40], ax
cmp byte [0x48fd3c], 0
jne 0x477c85
xor ebx, ebx
jmp 0x477ce8
call fcn.00477c34
push esp
push 0
push 0
push 0x477790
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x477cdc
cmp dword [0x48fd38], 0
je 0x477cbd
push 0x64
mov eax, dword [0x48fd38]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x477ca3
cmp dword [0x48fd4c], 0
jbe 0x477cce
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48fd4c]
jmp 0x477ce8
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.00477378
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x478460
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47861c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 0
xor eax, eax
push ebp
push 0x4785ec
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x478438]
call fcn.004068bc
add esp, 4
test esi, esi
je 0x4784e3
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00478bc4
jmp 0x478528
mov ebx, 0x41
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004055b0
lea eax, [ebp - 0x14]
mov edx, 0x478634
call fcn.00405694
mov esi, dword [ebp - 0x14]
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x478522
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00478bc4
inc ebx
cmp ebx, 0x5b
jne 0x4784e8
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 0
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x478577
inc esi
xor ebx, ebx
mov edx, dword [0x4783a0]
xor eax, eax
call fcn.00423fc8
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + ebx*4], edi
mov eax, dword [ebp - 8]
mov dword [edi + 0x6c], eax
lea eax, [edi + 0x30]
push eax
push 4
push edi
push 0x4783dc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*4]
mov dword [edx + 0x20], eax
inc ebx
dec esi
jne 0x47853a
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x478598
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.004252c8
push 1
call sub.kernel32.dll_Sleep_1
inc ebx
dec esi
jne 0x478582
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4785bd
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00425320
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00423fe8
inc ebx
dec esi
jne 0x4785a3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4785f3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00478c2c
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 1
ret
Function at 0x479260
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47947d
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x479494
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x14c]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x479452
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
cmp dword [ebp - 0x150], 0
jne 0x47934c
push dword [ebp - 4]
push 0x4794a4
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 8]
call fcn.00479190
jmp 0x47938b
push dword [ebp - 4]
push 0x4794a4
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 8]
call fcn.00479190
push 0x20
mov eax, dword [ebp - 8]
call fcn.00405858
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x148]
call fcn.00479230
test al, al
je 0x4793b6
mov eax, dword [ebp - 8]
call fcn.00479260
jmp 0x4793bc
push ebx
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4792ec
push esi
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x4793f7
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x479452
lea eax, [ebp - 0x164]
mov ecx, 0x4794a4
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x164]
call fcn.00405858
call fcn.00423070
test al, al
je 0x479452
lea eax, [ebp - 0x168]
mov ecx, 0x4794a4
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x168]
call fcn.00405858
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479484
lea eax, [ebp - 0x168]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x4795b4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x479632
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004030d0
mov esi, 0x42
mov ebx, 0x48fd6c
push dword [ebp - 4]
push 0x479648
lea eax, [ebp - 0xc]
mov edx, dword [ebx]
call fcn.004055c0
push dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 8]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
add ebx, 4
dec esi
jne 0x4795e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479639
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053ec
ret
Function at 0x47a290
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, 0x63d974
push 0xffffffffffffffff
push 0xffffffffffffffff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetProcessWorkingSetSize
mov eax, dword [0x634bf4]
mov eax, dword [eax]
call fcn.00425bc8
cmp dword [esi], 0
je 0x47a336
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x634974]
sub eax, dword [edx]
cmp eax, 0xea60
jbe 0x47a324
mov eax, dword [0x6349ec]
mov byte [eax], 1
nop
mov eax, dword [0x634d40]
mov byte [eax], 0
mov eax, dword [0x6349f0]
mov eax, dword [eax]
mov byte [eax + 0x1c], 0
mov eax, dword [0x63514c]
mov byte [eax], 1
push 0
mov eax, dword [0x634f60]
mov eax, dword [eax]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x30
push 0x47a33c
push 0x47a344
push ebx
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x63514c]
mov byte [eax], 0
push 1
mov eax, dword [esi]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x47a299
pop esi
pop ebx
ret

Function at 0x47a3e0
Capabilities:
Copy file
Create thread
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47a51e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x634d48]
cmp dword [eax], 0
je 0x47a422
mov eax, dword [ebp - 4]
call fcn.00405858
call fcn.004230a4
test al, al
jne 0x47a489
mov eax, 0x7d0
call fcn.0040344c
lea edx, [ebp - 0xc]
call fcn.00422580
mov edx, dword [ebp - 0xc]
mov eax, dword [0x634d48]
mov ecx, 0x47a534
call fcn.004056e0
push 0x20
mov eax, dword [0x634d48]
mov eax, dword [eax]
call fcn.00405858
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [0x634d48]
mov eax, dword [eax]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
mov eax, dword [0x634d48]
mov eax, dword [eax]
call fcn.00405858
push eax
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x63d974], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x63d978], eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x634d48]
mov eax, dword [eax]
push eax
push 0x47a0cc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
test eax, eax
je 0x47a500
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x63d978], 0
je 0x47a4f9
mov eax, dword [0x634bf4]
mov eax, dword [eax]
call fcn.00425bc8
push 0x64
mov eax, dword [0x63d978]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x47a4d3
movzx ebx, byte [0x48fe74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a525
lea eax, [ebp - 0xc]
call fcn.004053c8
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x47a53c
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47a6fe
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x47a714
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x14c]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47a6d3
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
cmp dword [ebp - 0x150], 0
jne 0x47a626
push dword [ebp - 4]
push 0x47a724
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 8]
call fcn.00464f3c
jmp 0x47a665
push dword [ebp - 4]
push 0x47a724
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 8]
call fcn.00464f3c
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.004227c0
mov edx, dword [ebp - 0x164]
mov eax, 0x47a730
call fcn.004059a4
test eax, eax
jne 0x47a6b8
push 0x20
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x47a5c6
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a705
lea eax, [ebp - 0x168]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x47afa8
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x47b014
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x24
mov ebx, 0x53342c
push 0x20
lea eax, [ebp - 8]
mov edx, dword [ebx]
call fcn.004055c0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x47b02c
call fcn.004056e0
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_SetFileAttributesA
add ebx, 4
dec esi
jne 0x47afc9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b01b
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x47c1e4
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403aec
ret

Function at 0x47c318
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47c466
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.0047c1e4
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x47c445
xor eax, eax
push ebp
push 0x47c43e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x47c427
xor eax, eax
push ebp
push 0x47c420
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47c409
xor eax, eax
push ebp
push 0x47c402
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.0047c21c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c409
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c427
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c445
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0047c2a0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c46d
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x47c5e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x47c5e9
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47c6c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x634f50]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.004037a0
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00403c90
call fcn.00403148
test eax, eax
jne 0x47c6a0
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.00403908
movzx edx, word [ebp - 8]
test dx, dx
jbe 0x47c69a
lea eax, [ebp - 0x10145]
movzx ecx, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x533514]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x47c677
cmp dword [ebp - 8], 0
jne 0x47c64e
lea eax, [ebp - 0x154]
call fcn.00403948
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c6ca
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x47c744
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47c808
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47c7d8
xor eax, eax
push ebp
push 0x47c7d1
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c7d8
mov eax, dword [ebp - 0x14]
call fcn.00425698
ret
cmp dword [ebp - 0xc], 0
jne 0x47c7f2
cmp dword [ebp - 0x10], 0xffffffff
jne 0x47c7f2
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c80f
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x47ce74
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 0xd], cl
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
mov edi, 0x63d9a4
xor eax, eax
push ebp
push 0x47cfe0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [0x63d988], eax
mov eax, dword [0x63d984]
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x47ce48]
call fcn.004068bc
add esp, 4
mov eax, dword [ebp - 0xc]
push eax
mov eax, edi
mov ecx, 1
mov edx, dword [0x47c5b4]
call fcn.004068bc
add esp, 4
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x47cf83
inc esi
xor ebx, ebx
mov eax, 8
call fcn.00402ec8
mov edx, dword [edi]
mov dword [edx + ebx*4], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov edx, dword [edi]
mov edx, dword [edx + ebx*4]
mov dword [edx], eax
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
mov dword [edx + ebx*4], eax
cmp byte [ebp - 0xd], 0
je 0x47cf44
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
lea edx, [eax + 4]
push edx
push 0
push eax
push 0x47c904
push 0
push 0
call sub.kernel32.dll_CreateThread_1
jmp 0x47cf5e
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
lea edx, [eax + 4]
push edx
push 0
push eax
push 0x47cb20
push 0
push 0
call sub.kernel32.dll_CreateThread_1
test eax, eax
je 0x47cf6a
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x47cf7b
mov eax, dword [edi]
mov eax, dword [eax + ebx*4]
call fcn.00402ee4
mov eax, dword [edi]
xor edx, edx
mov dword [eax + ebx*4], edx
inc ebx
dec esi
jne 0x47cef2
mov eax, dword [0x634bf4]
mov eax, dword [eax]
call fcn.00425bc8
push 0x68
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForMultipleObjects
test eax, eax
jne 0x47cf83
cmp byte [ebp - 0xd], 0
je 0x47cfb4
mov eax, dword [ebp - 8]
call fcn.0047cd18
jmp 0x47cfbc
mov eax, dword [ebp - 8]
call fcn.0047cdec
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ebx, dword [eax + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cfe7
lea eax, [ebp - 4]
mov edx, dword [0x47ce48]
call fcn.004068c8
ret