joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4761d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x4761e5
mov esi, dword [eax]
test esi, esi
jne 0x4761e5
xor eax, eax
pop esi
ret 8
push edi
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x476201
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x476208
pop edi
xor eax, eax
pop esi
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, ebx
pop ebx
pop edi
pop esi
ret 8
Function at 0x476540
Capabilities:
Set file attributes

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
mov esi, eax
mov eax, dword [ebp + 0x130]
mov edx, dword [eax + 0x18]
lea edi, [ebp + 0x130]
push esi
push ebx
mov ecx, edi
call edx
test al, al
jne 0x476590
mov ecx, ebx
call fcn.00470820
push 0x5554d8
push 0x551604
push eax
call fcn.0046adf0
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
push edi
push ebx
lea ecx, [ebp + 0x344]
call fcn.0046b330
test al, al
je 0x47656a
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x18]
push ecx
xor edi, edi
push eax
push ebx
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x28], edi
mov dword [ebp + 8], eax
call fcn.004762d0
add esp, 0x14
test al, al
jne 0x47661a
cmp byte [esi + 0x11c], al
je 0x4765e0
add esi, 0xc
jmp 0x4765e3
mov esi, dword [esi + 8]
mov ecx, ebx
call fcn.00470820
push 0x5643a4
mov edi, eax
push 0x551604
push edi
call fcn.0046adf0
add esi, 4
push esi
push 0x551604
push edi
call fcn.0046adf0
add esp, 0x18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
mov ebx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
push edi
push 0x80
push ebx
push edi
push edx
push eax
mov ecx, esi
call fcn.0046adb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp + 4], eax
mov edi, 1
jne 0x4766c0
jmp 0x476650
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
mov dword [esp + 0x24], eax
jne 0x476672
cmp edi, 3
jge 0x47670e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x476693
cmp eax, 5
jne 0x4766d5
cmp edi, 3
jge 0x47670e
push 0x80
mov ecx, esi
call fcn.0046adb0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x10]
push 0
push 0x80
push ebx
push 0
push ecx
push edx
mov ecx, esi
call fcn.0046adb0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
add edi, 1
cmp eax, 0xffffffff
mov dword [ebp + 4], eax
je 0x476650
push esi
lea ecx, [ebp + 0xc]
call fcn.0046e160
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0xc
test eax, eax
jne 0x47670e
cmp byte [esi + 0x11c], al
je 0x4766e6
add esi, 0xc
jmp 0x4766e9
mov esi, dword [esi + 8]
mov ecx, dword [esp + 0x20]
add esi, 4
push esi
push 0x5643b4
call fcn.00401000
mov ecx, eax
call fcn.00471770
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
cmp byte [esi + 0x11c], 0
lea ebx, [esi + 0xc]
jne 0x47671d
mov ebx, dword [esi + 8]
mov ebp, dword [esp + 0x20]
mov ecx, ebp
call fcn.00470820
mov edi, dword [esp + 0x24]
mov esi, eax
call fcn.00471650
mov ecx, ebp
call fcn.00470820
add ebx, 4
push ebx
push 0x5643a4
mov ecx, eax
call fcn.00471770
mov ecx, eax
call fcn.00471770
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 8
ret 0xc
Function at 0x4767f0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov ebx, eax
mov edi, ecx
mov esi, edx
call ebp
test edi, edi
jne 0x476819
test ebx, ebx
je 0x47680f
mov dword [ebx], edi
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
pop ecx
ret 8
mov ecx, dword [esp + 0x1c]
mov edx, dword [esi + 4]
push 0
lea eax, [esp + 0x14]
push eax
push edi
push ecx
push edx
mov dword [esp + 0x24], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47689d
cmp byte [esi + 0x128], al
lea ebx, [esi + 0x18]
jne 0x47684a
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00470820
mov esi, eax
call fcn.00471650
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00470820
push 0x5643d4
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add ebx, 4
push ebx
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
test ebx, ebx
mov eax, dword [esp + 0x10]
je 0x4768a7
mov dword [ebx], eax
test eax, eax
jne 0x47680f
cmp byte [esi + 0x128], al
je 0x4768bc
add esi, 0x18
jmp 0x4768bf
mov esi, dword [esi + 0x14]
mov ecx, dword [esp + 0x18]
call fcn.00470820
push 0x5643e4
mov edi, eax
push 0x551604
push edi
call fcn.0046adf0
add esi, 4
push esi
push 0x551604
push edi
call fcn.0046adf0
add esp, 0x18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8

Function at 0x476900
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
push 0
mov edi, eax
mov esi, ecx
call ebp
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push 0
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push ecx
push edx
push eax
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x47699b
cmp byte [esi + 0x128], al
push ebx
lea ebx, [esi + 0x18]
jne 0x476948
mov ebx, dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x18]
mov edi, eax
call fcn.00470820
mov esi, eax
call fcn.00471650
push 0
call ebp
mov ecx, dword [esp + 0x18]
call fcn.00470820
push 0x564404
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add ebx, 4
push ebx
push 0x551604
push esi
call fcn.0046adf0
add esp, 0x18
pop ebx
pop edi
pop esi
xor al, al
pop ebp
pop ecx
ret 0xc
test edi, edi
je 0x4769a5
mov ecx, dword [esp + 0xc]
mov dword [edi], ecx
pop edi
pop esi
mov al, 1
pop ebp
pop ecx
ret 0xc

Function at 0x476a10
Capabilities:
Get file size

Disassembly:
push ecx
mov ecx, dword [ecx + 4]
push esi
lea eax, [esp + 4]
push eax
push ecx
mov dword [esp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x476a3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x476a3f
xor eax, eax
pop esi
pop ecx
ret
mov eax, esi
pop esi
pop ecx
ret
Function at 0x4789b0
Capabilities:
Get file size

Disassembly:
push 0xffffffffffffffff
push 0x52181b
mov eax, dword fs:[0]
push eax
sub esp, 0x368
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x364], eax
push ebp
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x378]
mov dword fs:[0], eax
mov eax, dword [esp + 0x38c]
mov ebp, dword [esp + 0x388]
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 4]
xor esi, esi
cmp eax, esi
je 0x478a17
push eax
call fcn.004fdda1
add esp, 4
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
lea edi, [esp + 0x1c]
call fcn.004763d0
mov edi, vtable.t_fileRead.0
mov dword [esp + 0x1c], edi
mov dword [esp + method.t_fileRead.1.virtual_0], vtable.t_fileRead.1.0
mov dword [esp + 0x36c], esi
mov dword [esp + 0x370], esi
mov ecx, dword [esp + 0x14]
push ecx
push ebx
lea ecx, [esp + 0x24]
mov dword [esp + 0x388], esi
call fcn.004759b0
test al, al
jne 0x478a86
mov dword [esp + 0x380], 0xffffffff
mov dword [esp + 0x1c], edi
lea ecx, [esp + 0x1c]
mov dword [esp + method.t_byteStreamRead.virtual_0], vtable.t_byteStreamRead.0
call fcn.00476480
xor al, al
jmp 0x478bfb
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x18]
push edx
push eax
mov dword [esp + 0x20], esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x478aab
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jne 0x478aad
mov esi, edi
lea ecx, [esi + 4]
push ecx
call fcn.004fdc99
mov edi, eax
add esp, 4
test edi, edi
jne 0x478b15
mov eax, dword [esp + 0x14]
cmp byte [eax + 0x11c], 0
lea edi, [eax + 0xc]
jne 0x478ad2
mov edi, dword [eax + 8]
mov ecx, ebx
call fcn.00470820
push 0x5645a4
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add edi, 4
push edi
push 0x551604
push esi
call fcn.0046adf0
mov dword [esp + 0x398], 0xffffffff
add esp, 0x18
mov dword [esp + 0x1c], vtable.t_fileRead.0
jmp 0x478a6b
push esi
push edi
push ebx
lea ecx, [esp + 0x374]
call fcn.00475a10
test al, al
jne 0x478b7e
mov eax, dword [esp + 0x14]
cmp byte [eax + 0x11c], 0
lea edi, [eax + 0xc]
jne 0x478b3b
mov edi, dword [eax + 8]
mov ecx, ebx
call fcn.00470820
push 0x5643a4
mov esi, eax
push 0x551604
push esi
call fcn.0046adf0
add edi, 4
push edi
push 0x551604
push esi
call fcn.0046adf0
mov dword [esp + 0x398], 0xffffffff
add esp, 0x18
mov dword [esp + 0x1c], vtable.t_fileRead.0
jmp 0x478a6b
lea ecx, [esp + 0x1c]
call fcn.00476760
push esi
push edi
push ebx
push ebp
mov word [edi + esi + 2], 0
mov word [edi + esi], 0
call fcn.00478d80
test al, al
jne 0x478be5
mov eax, dword [esp + 0x14]
cmp byte [eax + 0x11c], 0
je 0x478bb3
add eax, 0xc
jmp 0x478bb6
mov eax, dword [eax + 8]
add eax, 4
push eax
push 0x5643a4
mov ecx, ebx
call fcn.00401000
mov ecx, eax
call fcn.00471770
lea ecx, [esp + 0x1c]
mov dword [esp + 0x380], 0xffffffff
call fcn.00475990
xor al, al
jmp 0x478bfb
lea ecx, [esp + 0x1c]
mov dword [esp + 0x380], 0xffffffff
call fcn.00475990
mov al, 1
mov ecx, dword [esp + 0x378]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x364]
xor ecx, esp
call fcn.004fe05a
add esp, 0x374
ret 8
Function at 0x479a30
Capabilities:
Encode data using base64

Disassembly:
push esi
push edi
mov edi, eax
cmp edi, 3
mov esi, edx
jl 0x479abd
mov eax, 0xaaaaaaab
mul edi
shr edx, 1
lea eax, [edx + edx*2]
sub edi, eax
push ebx
mov edi, edi
movzx eax, byte [esi]
shr eax, 2
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi]
movzx ebx, byte [esi + 1]
and eax, 3
shl eax, 4
shr ebx, 4
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx + 1], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi + 2]
add ecx, 1
and eax, 0xf
add eax, eax
add eax, eax
shr ebx, 6
or eax, ebx
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 1
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
movzx eax, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
add ecx, 1
mov byte [ecx], al
add ecx, 1
add esi, 3
sub edx, 1
jne 0x479a50
pop ebx
test edi, edi
jle 0x479b29
movzx edx, byte [esi]
shr edx, 2
movzx eax, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
mov al, byte [esi]
and al, 3
add ecx, 1
shl al, 4
cmp edi, 1
jle 0x479ae7
mov dl, byte [esi + 1]
shr dl, 4
or al, dl
movzx eax, al
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], dl
add ecx, 1
cmp edi, 2
jge 0x479b0f
mov eax, 0x3d
mov byte [ecx], al
add ecx, 1
mov byte [ecx], al
add ecx, 1
pop edi
mov byte [ecx], 0
pop esi
ret
movzx eax, byte [esi + 1]
and eax, 0xf
movsx eax, byte [eax*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
add ecx, 1
mov byte [ecx], 0x3d
add ecx, 1
pop edi
mov byte [ecx], 0
pop esi
ret
Function at 0x47a750
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x5c
push ebx
push esi
mov esi, eax
xor eax, eax
cmp esi, eax
jne 0x47a762
mov esi, 0x5b9ed8
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x60], eax
mov eax, dword [esp + 0x68]
push eax
mov eax, dword [esp + 0x70]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x67452301
mov dword [esp + 0x14], 0xefcdab89
mov dword [esp + 0x18], 0x98badcfe
mov dword [esp + 0x1c], 0x10325476
call fcn.00479ca0
add esp, 8
lea ebx, [esp + 8]
mov eax, esi
call fcn.00479f80
mov eax, esi
pop esi
pop ebx
add esp, 0x5c
ret
Function at 0x47b040
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
mov eax, ebx
call fcn.0047ab50
test eax, eax
jl 0x47b27a
mov edx, dword [ebx + 0xf0]
add edx, edx
push esi
add edx, edx
xor esi, esi
test edx, edx
push edi
jle 0x47b0ad
lea ecx, [ebx + edx*4 + 8]
lea eax, [ebx + 8]
push ebp
lea esp, [esp]
mov ebp, dword [ecx - 8]
mov edi, dword [eax - 8]
mov dword [eax - 8], ebp
mov ebp, dword [ecx - 4]
mov dword [ecx - 8], edi
mov edi, dword [eax - 4]
mov dword [eax - 4], ebp
mov ebp, dword [ecx]
mov dword [ecx - 4], edi
mov edi, dword [eax]
mov dword [eax], ebp
mov ebp, dword [ecx + 4]
mov dword [ecx], edi
mov edi, dword [eax + 4]
mov dword [eax + 4], ebp
mov dword [ecx + 4], edi
add esi, 4
sub edx, 4
add eax, 0x10
sub ecx, 0x10
cmp esi, edx
jl 0x47b070
pop ebp
mov edx, 1
cmp dword [ebx + 0xf0], edx
jle 0x47b276
lea eax, [ebx + 2]
mov ecx, dword [eax + 0xe]
movzx edi, byte [eax + 0xf]
mov edi, dword [edi*4 + 0x55f220]
add eax, 0x10
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x55f220]
and esi, 0xff
mov esi, dword [esi*4 + 0x55fe20]
and edi, 0xff
xor esi, dword [edi*4 + 0x560620]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55f220]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x560a20]
movzx ecx, byte [eax]
mov ecx, dword [ecx*4 + 0x55f220]
movzx edi, byte [eax + 3]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x560220]
mov ecx, dword [eax + 2]
mov dword [eax - 2], esi
mov edi, dword [edi*4 + 0x55f220]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x55f220]
and esi, 0xff
mov esi, dword [esi*4 + 0x55fe20]
and edi, 0xff
xor esi, dword [edi*4 + 0x560620]
movzx edi, byte [eax + 4]
mov edi, dword [edi*4 + 0x55f220]
and edi, 0xff
xor esi, dword [edi*4 + 0x560220]
movzx edi, byte [eax + 7]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55f220]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x560a20]
mov ecx, dword [eax + 6]
mov dword [eax + 2], esi
mov edi, dword [edi*4 + 0x55f220]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x55f220]
and esi, 0xff
mov esi, dword [esi*4 + 0x55fe20]
and edi, 0xff
xor esi, dword [edi*4 + 0x560620]
movzx edi, byte [eax + 8]
mov edi, dword [edi*4 + 0x55f220]
and edi, 0xff
xor esi, dword [edi*4 + 0x560220]
movzx edi, byte [eax + 0xb]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55f220]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x560a20]
mov ecx, dword [eax + 0xa]
mov dword [eax + 6], esi
mov edi, dword [edi*4 + 0x55f220]
mov esi, ecx
shr esi, 0x18
mov esi, dword [esi*4 + 0x55f220]
and esi, 0xff
mov esi, dword [esi*4 + 0x55fe20]
and edi, 0xff
xor esi, dword [edi*4 + 0x560620]
movzx edi, byte [eax + 0xc]
mov edi, dword [edi*4 + 0x55f220]
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x55f220]
and edi, 0xff
xor esi, dword [edi*4 + 0x560220]
and ecx, 0xff
xor esi, dword [ecx*4 + 0x560a20]
add edx, 1
mov dword [eax + 0xa], esi
cmp edx, dword [ebx + 0xf0]
jl 0x47b0c1
pop edi
xor eax, eax
pop esi
ret
Function at 0x47c030
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5208a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dl, byte [esp + 0x3c]
mov byte [esi + 0xc], dl
mov dl, byte [esp + 0x40]
mov byte [esi + 0xd], dl
mov edx, dword [esp + 0x44]
mov dword [esi + 0x10], edx
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov edx, dword [esp + 0x38]
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
mov dword [esi], vtable.t_envEntry_int_.0
mov edx, dword [edx]
lea eax, [esp + 0x18]
push eax
mov dword [esi + 0x14], edx
mov dword [esp + 0x40], esi
mov dword [esp + 0x14], ecx
call fcn.0047beb0
lea ebx, [esp + 0x40]
lea edi, [esp + 0x14]
call fcn.0047c3e0
mov ecx, ebx
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0047bdb0
mov ebx, edi
call fcn.0047c370
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x18

Function at 0x47c0e0
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5208a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dl, byte [esp + 0x3c]
mov byte [esi + 0xc], dl
mov dl, byte [esp + 0x40]
mov byte [esi + 0xd], dl
mov edx, dword [esp + 0x44]
mov dword [esi + 0x10], edx
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov edx, dword [esp + 0x38]
mov dword [esp + 0x28], 0
mov dword [esi], vtable.t_envEntry_bool_.0
movzx edx, byte [edx]
mov dword [esp + 0x14], eax
lea eax, [esp + 0x18]
push eax
mov byte [esi + 0x14], dl
mov dword [esp + 0x40], esi
mov dword [esp + 0x14], ecx
call fcn.0047beb0
lea ebx, [esp + 0x40]
lea edi, [esp + 0x14]
call fcn.0047c3e0
mov ecx, ebx
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0047bdb0
mov ebx, edi
call fcn.0047c370
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x18
Function at 0x47c190
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x5208a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dl, byte [esp + 0x3c]
mov byte [esi + 0xc], dl
mov dl, byte [esp + 0x40]
mov byte [esi + 0xd], dl
mov edx, dword [esp + 0x44]
mov dword [esi + 0x10], edx
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov edx, dword [esp + 0x38]
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
mov dword [esi], vtable.t_envEntry_wchar_t_const__.0
mov edx, dword [edx]
lea eax, [esp + 0x18]
push eax
mov dword [esi + 0x14], edx
mov dword [esp + 0x40], esi
mov dword [esp + 0x14], ecx
call fcn.0047beb0
lea ebx, [esp + 0x40]
lea edi, [esp + 0x14]
call fcn.0047c3e0
mov ecx, ebx
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0047bdb0
mov ebx, edi
call fcn.0047c370
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x18

Function at 0x47c240
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x5208a8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x589560]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov eax, dword [esp + 0x34]
mov esi, dword [esp + 0x30]
mov dl, byte [esp + 0x3c]
mov byte [esi + 0xc], dl
mov dl, byte [esp + 0x40]
mov byte [esi + 0xd], dl
mov dword [esi + 0x10], 0xffffffff
mov dword [esi + 4], ecx
mov dword [esi + 8], eax
mov edx, dword [esp + 0x38]
mov dword [esp + 0x28], 0
mov dword [esp + 0x14], eax
mov dword [esi], vtable.t_envEntry_unsigned_long_int_.0
mov edx, dword [edx]
lea eax, [esp + 0x18]
push eax
mov dword [esi + 0x14], edx
mov dword [esp + 0x40], esi
mov dword [esp + 0x14], ecx
call fcn.0047beb0
lea ebx, [esp + 0x40]
lea edi, [esp + 0x14]
call fcn.0047c3e0
mov ecx, ebx
push ecx
lea edx, [esp + 0x1c]
push edx
call fcn.0047bdb0
mov ebx, edi
call fcn.0047c370
mov eax, esi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret 0x14
Function at 0x47d1f0
Capabilities:
Create directory

Disassembly:
sub esp, 0x248
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x240], eax
push esi
push 0x206
lea eax, [esp + 0x3e]
push 0
push eax
mov esi, ecx
mov word [esp + 0x44], 0
call fcn.005002f0
add esp, 0xc
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x47d231
mov eax, dword [esi + 8]
add eax, 4
push eax
lea ecx, [esp + 0x3c]
push 0x104
push ecx
call fcn.004fe07f
lea edx, [esp + 0x44]
push 0x5c
push edx
call fcn.00501fad
add esp, 0x14
test eax, eax
jne 0x47d28f
cmp byte [esi + 0x11c], al
je 0x47d264
add esi, 0xc
jmp 0x47d267
mov esi, dword [esi + 8]
add esi, 4
push esi
push 0x566854
push edi
call fcn.004708d0
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004fe05a
add esp, 0x248
ret
mov word [eax], 0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x3c]
push ecx
call fcn.0050266c
add esp, 8
test eax, eax
je 0x47d304
push 0
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x47d2e4
lea eax, [esp + 0x38]
push eax
push 0x566868
push edi
call fcn.004708d0
add esp, 0xc
pop esi
mov ecx, dword [esp + 0x240]
xor ecx, esp
call fcn.004fe05a
add esp, 0x248
ret
push 0x10000000
lea ecx, [esp + 0x3c]
push 1
push ecx
call fcn.00476a50
lea edx, [esp + 0x44]
push 1
push edx
call fcn.00476d30
add esp, 0x14
mov ecx, dword [esp + 0x244]
pop esi
xor ecx, esp
mov al, 1
call fcn.004fe05a
add esp, 0x248
ret
Function at 0x482940
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x804
mov eax, dword [0x589560]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, dword [esp + 0x818]
push ebp
mov ebp, dword [esp + 0x818]
push esi
mov esi, dword [esp + 0x814]
push edi
push 0x7fe
lea eax, [esp + 0x16]
push 0
push eax
mov word [esp + 0x1c], 0
call fcn.005002f0
push esi
push str._s.
lea edx, [esp + 0x24]
call fcn.0046c100
add esp, 0x14
push 0x5be308
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x482ad3
mov ecx, 0x5543b8
mov eax, 0x5be334
lea esp, [esp]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4829e6
test dx, dx
je 0x4829e2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4829e6
add eax, 4
add ecx, 4
test dx, dx
jne 0x4829c0
xor eax, eax
jmp 0x4829eb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x482ab8
mov ecx, 0x562920
mov eax, 0x5be334
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x482a26
test dx, dx
je 0x482a22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x482a26
add eax, 4
add ecx, 4
test dx, dx
jne 0x482a00
xor eax, eax
jmp 0x482a2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x482ab8
push esi
lea edx, [esp + 0x14]
push 0x400
push edx
call fcn.004fe07f
push 0x54ea84
lea eax, [esp + 0x20]
push 0x400
push eax
call fcn.004fe162
push 0x5be334
lea ecx, [esp + 0x2c]
push 0x400
push ecx
call fcn.004fe162
lea edx, [esp + 0x34]
push 0x5be2d8
push edx
call fcn.0050266c
add esp, 0x2c
test eax, eax
jne 0x482ab8
test word [0x5be2de], 0x4000
je 0x482aa9
mov eax, dword [esp + 0x81c]
test al, al
je 0x482ab8
push ebx
push ebp
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.00482940
add esp, 0x10
jmp 0x482ab4
lea ecx, [esp + 0x10]
push ebx
push ecx
call ebp
add esp, 8
test eax, eax
je 0x482af1
push 0x5be308
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4829b2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004fe05a
add esp, 0x804
ret
xor eax, eax
jmp 0x482ad8