joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473290
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x400
push ebx
push esi
push 2
push eax
xor ebx, ebx
call dword [sym.imp.MSVCRT.dll__open]
mov esi, eax
add esp, 8
cmp esi, ebx
jle 0x47333d
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x10]
push ecx
push esi
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__read]
mov edx, dword [esp + 0x420]
lea eax, [esp + 0x18]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 0x14
cmp eax, ebx
je 0x473327
lea ecx, [esp + 0xc]
push ebx
sub eax, ecx
push eax
push esi
call dword [sym.imp.MSVCRT.dll__lseek]
mov edx, dword [esp + 0x424]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.MSVCRT.dll__write]
add esp, 0x18
mov ebx, 1
push esi
call dword [sym.imp.MSVCRT.dll__close]
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebx
add esp, 0x400
ret
mov eax, ebx
pop esi
pop ebx
add esp, 0x400
ret

Function at 0x4733f0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0xa004
call fcn.0051c710
push ebx
push ebp
push esi
push edi
mov ecx, 0x27ff
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0xa018]
push 0x56c118
push eax
or ebx, 0xffffffff
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x4734f0
push esi
push 0xa000
lea ecx, [esp + 0x1c]
push 1
push ecx
call dword [sym.imp.MSVCRT.dll_fread]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
lea edx, [esp + 0x28]
add esp, 0x14
test edx, edx
lea eax, [esp + 0x14]
je 0x4734f0
mov cl, byte [esp + 0x14]
test cl, cl
je 0x4734f0
mov ebx, dword [esp + 0xa020]
mov ebp, dword [esp + 0xa024]
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0xa01c]
push edi
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov edx, eax
add esp, 8
test edx, edx
je 0x4734e1
cmp byte [edx], 0
je 0x4734e1
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0xa020]
not ecx
dec ecx
add edx, ecx
test eax, eax
je 0x4734cd
mov ecx, ebp
mov esi, edx
mov eax, ecx
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
lea eax, [edx + ebp]
inc ecx
add ebx, 0x100
mov dword [esp + 0x10], ecx
jmp 0x473485
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa004
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xa004
ret

Function at 0x473d20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
or eax, 0xffffffff
mov edx, ecx
dec ecx
test edx, edx
je 0x473d57
push ebx
push esi
lea esi, [ecx + 1]
mov ecx, dword [esp + 0xc]
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x53b644]
xor eax, edx
inc ecx
dec esi
jne 0x473d37
pop esi
pop ebx
not eax
ret
Function at 0x476a40
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
push 0
mov ecx, dword [0x659a18]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [0x659a18]
push edx
push 1
push 4
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
pop esi
ret 4

Function at 0x477f20
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [0x659958]
push ebp
cmp eax, 0x1a
mov dword [esp + 4], ecx
jl 0x477f93
mov ebp, dword [esp + 0x10]
cmp ebp, 0xa0
ja 0x477f93
test ebp, ebp
jbe 0x477f8e
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_fseek]
push esi
push edi
mov edi, dword [esp + 0x18]
lea esi, [ecx + 8]
mov eax, dword [edi]
mov ecx, dword [0x659a18]
push 0
push eax
push ecx
call ebx
mov edx, dword [0x659a18]
push edx
push 1
push 0x4c
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
mov ecx, esi
call fcn.00477a80
mov byte [esi + 0x48], 0
add edi, 4
add esi, 0x4c
dec ebp
jne 0x477f50
mov ecx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
call fcn.00478f70
pop ebp
pop ecx
ret 8
Function at 0x478910
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x50
push ebp
push esi
mov esi, ecx
push edi
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
mov ebp, 1
push eax
call fcn.004794a0
add esp, 4
mov dword [esp + 0xc], eax
test eax, eax
jne 0x478961
lea ecx, [esp + 0x14]
test ecx, ecx
je 0x478957
mov cl, byte [esp + 0x14]
test cl, cl
jne 0x478961
mov ebp, 2
jmp 0x4789f4
lea edx, [esp + 0x14]
push edx
push eax
call fcn.004797a0
mov ecx, eax
call fcn.00479680
test eax, eax
mov dword [esp + 0x10], eax
je 0x47899f
lea eax, [esp + 0x10]
push 2
push eax
push 0x23ea
call fcn.00487160
mov ecx, eax
call fcn.00483980
pop edi
pop esi
mov eax, 2
pop ebp
add esp, 0x50
ret
mov ecx, esi
call fcn.004787f0
test eax, eax
jl 0x4789f4
lea ecx, [eax + eax*8]
lea edx, [eax + ecx*2]
lea edi, [esi + edx*4 + 8]
mov ecx, edi
call fcn.00477da0
test eax, eax
jne 0x4789f1
call fcn.004797a0
test byte [eax], 4
je 0x478a31
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.00477c10
test eax, eax
je 0x478a31
push 1
push 0x23ed
call fcn.00487160
mov ecx, eax
call fcn.004838b0
or ebp, 0xffffffff
lea edx, [esp + 0xc]
mov dword [esp + 0xc], 0
push edx
push 0x251e
call fcn.00487160
mov ecx, eax
call fcn.00483bc0
lea eax, [esp + 0xc]
push eax
push 0x2526
call fcn.00487160
mov ecx, eax
call fcn.00483bc0
pop edi
mov eax, ebp
pop esi
pop ebp
add esp, 0x50
ret
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
mov ecx, edi
call fcn.00477b90
mov ecx, esi
call fcn.00478f70
mov ecx, 0x65
push 0x14
mov word [esp + 0x42], cx
mov word [esp + 0x4a], cx
mov ecx, 0x72
mov edi, 0x61
mov word [esp + 0x4c], cx
mov word [esp + 0x5c], cx
lea ecx, [esp + 0x38]
mov edx, 0x20
mov eax, 0x73
push ecx
mov ecx, esi
mov word [esp + 0x3c], 0x43
mov word [esp + 0x3e], 0x68
mov word [esp + 0x40], di
mov word [esp + 0x42], 0x6e
mov word [esp + 0x44], 0x67
mov word [esp + 0x48], dx
mov word [esp + 0x4a], 0x75
mov word [esp + 0x4c], ax
mov word [esp + 0x52], dx
mov word [esp + 0x54], 0x70
mov word [esp + 0x56], di
mov word [esp + 0x58], ax
mov word [esp + 0x5a], ax
mov word [esp + 0x5c], 0x77
mov word [esp + 0x5e], 0x6f
mov word [esp + 0x62], 0x64
call fcn.00479100
xor ebp, ebp
jmp 0x4789f4
Function at 0x478d30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x94
push ebx
push ebp
push esi
mov ebx, ecx
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [esp + 0x65]
mov byte [esp + 0x64], 0
mov dword [esp + 0x10], 1
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x64]
push eax
push 0x252a
call fcn.00487160
mov ecx, eax
call fcn.004839e0
push eax
mov ecx, ebx
call fcn.004793a0
test eax, eax
jge 0x478d8c
lea ecx, [esp + 0x64]
push ecx
call fcn.00487160
mov ecx, eax
call fcn.00485010
lea edx, [esp + 0x64]
push 0x40
push edx
call fcn.00471b50
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x4d]
mov byte [esp + 0x4c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x4c]
push eax
call fcn.00479420
mov edi, dword [ebx + 0x2f90]
add esp, 0xc
cmp edi, 0xa0
mov dword [esp + 0x14], eax
jae 0x478f3e
lea ecx, [edi + edi*8]
lea edx, [edi + ecx*2]
lea ebp, [ebx + edx*4 + 0xc]
lea ecx, [ebp - 4]
call fcn.00477a30
test eax, eax
je 0x478e19
mov esi, ebp
lea eax, [esp + 0x64]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x478e10
test cl, cl
je 0x478e0c
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x478e10
add eax, 2
add esi, 2
test cl, cl
jne 0x478dec
xor eax, eax
jmp 0x478e15
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x478e2a
inc edi
add ebp, 0x4c
cmp edi, 0xa0
jb 0x478dda
jmp 0x478f3e
mov ecx, ebx
call fcn.004790a0
mov ebp, eax
lea eax, [edi + edi*8]
lea edx, [esp + 0x44]
lea ecx, [edi + eax*2]
mov eax, dword [esp + 0x14]
push edx
push eax
lea esi, [ebx + ecx*4]
lea ecx, [esi + 8]
call fcn.00477c10
test eax, eax
jne 0x478e72
test ebp, ebp
je 0x478e65
mov ecx, 0x675aa8
call fcn.004a1700
test dword [ebp + 0x28], eax
jne 0x478e72
mov dword [esp + 0x10], 2
jmp 0x478f3e
push 0x2524
call fcn.00487160
mov ecx, eax
call fcn.00483aa0
mov ecx, ebx
mov dword [esi + 0x34], eax
call fcn.00478f70
mov ecx, 0x20
push 0x16
mov word [esp + 0x28], cx
mov word [esp + 0x32], cx
mov ecx, 0x63
mov esi, 0x61
mov word [esp + 0x34], cx
mov word [esp + 0x3a], cx
lea ecx, [esp + 0x1c]
mov edx, 0x6e
mov eax, 0x65
push ecx
mov ecx, ebx
mov word [esp + 0x20], 0x43
mov word [esp + 0x22], 0x68
mov word [esp + 0x24], si
mov word [esp + 0x26], dx
mov word [esp + 0x28], 0x67
mov word [esp + 0x2a], ax
mov word [esp + 0x2e], 0x75
mov word [esp + 0x30], 0x73
mov word [esp + 0x32], ax
mov word [esp + 0x34], 0x72
mov word [esp + 0x3a], si
mov word [esp + 0x3c], dx
mov word [esp + 0x40], ax
mov word [esp + 0x42], 0x6c
mov word [esp + 0x44], 0x74
mov word [esp + 0x46], 0x69
mov word [esp + 0x48], 0x6d
mov word [esp + 0x4a], ax
call fcn.00479100
mov dword [esp + 0x10], 0
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0
push edx
push 0x251e
call fcn.00487160
mov ecx, eax
call fcn.00483bc0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x94
ret
Function at 0x479620
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x479679
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
push ecx
push 1
push 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
lea edx, [esi + 4]
push edx
push 0x252b
call fcn.00487160
mov ecx, eax
call fcn.00483a40
add esi, 6
push esi
push 0x252c
call fcn.00487160
mov ecx, eax
call fcn.00483a40
pop esi
ret 4

Function at 0x4797b0
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x4797df
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
push ecx
push 1
push 0x1c
push esi
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
pop esi
ret 4

Function at 0x479800
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
je 0x4798ed
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x659a18]
push eax
call ebp
mov ecx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 2
push edi
call esi
mov edx, dword [0x659a18]
lea ebx, [edi + 2]
push edx
push 1
push 2
push ebx
call esi
mov eax, dword [0x659a18]
lea ecx, [esp + 0x50]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x60], 0
call esi
mov edx, dword [esp + 0x60]
mov eax, dword [0x659a18]
push 0
push edx
push eax
call ebp
add esp, 0x48
mov ecx, edi
call fcn.00479900
test eax, eax
pop ebp
je 0x4798ca
mov ecx, dword [0x659a18]
lea edx, [esp + 0xc]
push ecx
push 1
push 0x10
push edx
call esi
push 0x24
call fcn.00470250
add esp, 0x14
test eax, eax
je 0x4798bc
lea ecx, [esp + 0xc]
push 1
push ecx
mov ecx, eax
call fcn.00489020
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
xor eax, eax
mov dword [edi + 8], eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
xor edx, edx
mov dx, word [ebx]
push edx
call fcn.00470b90
mov dword [edi + 4], eax
mov ecx, dword [0x659a18]
xor edx, edx
push ecx
mov dx, word [ebx]
push edx
push 1
push eax
call esi
add esp, 0x14
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
Function at 0x479a00
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
push ebx
push esi
push edi
mov edi, ecx
je 0x479ae2
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x659a18]
push eax
call ebp
mov ecx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 2
push edi
call esi
mov edx, dword [0x659a18]
lea ebx, [edi + 2]
push edx
push 1
push 2
push ebx
call esi
mov eax, dword [0x659a18]
lea ecx, [esp + 0x50]
push eax
push 1
push 4
push ecx
mov dword [esp + 0x60], 0
call esi
mov edx, dword [esp + 0x60]
mov eax, dword [0x659a18]
push 0
push edx
push eax
call ebp
add esp, 0x48
mov ecx, edi
call fcn.00479900
test eax, eax
pop ebp
je 0x479aca
mov ecx, dword [0x659a18]
lea edx, [esp + 0xc]
push ecx
push 1
push 0x10
push edx
call esi
push 0x24
call fcn.00470250
add esp, 0x14
test eax, eax
je 0x479abc
lea ecx, [esp + 0xc]
push 1
push ecx
mov ecx, eax
call fcn.00489020
mov dword [edi + 0xc], eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
xor eax, eax
mov dword [edi + 0xc], eax
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4
mov edx, dword [0x659a18]
xor eax, eax
mov ax, word [ebx]
push edx
push eax
add edi, 4
push 1
push edi
call esi
add esp, 0x10
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x479c90
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
push edi
mov edi, ecx
je 0x479d4c
push esi
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push edi
call esi
mov edx, dword [0x659a18]
lea eax, [esp + 0x24]
push edx
push 2
push 4
push eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call esi
mov eax, dword [esp + 0x34]
add esp, 0x2c
test eax, eax
pop esi
je 0x479d1c
push 0x10
call fcn.00470250
add esp, 4
test eax, eax
je 0x479d0b
mov ecx, eax
call fcn.004799c0
jmp 0x479d0d
xor eax, eax
mov ecx, dword [esp + 4]
mov dword [edi + 4], eax
push ecx
mov ecx, eax
call fcn.00479a00
mov eax, dword [esp + 8]
test eax, eax
je 0x479d4c
push 0x10
call fcn.00470250
add esp, 4
test eax, eax
je 0x479d3b
mov ecx, eax
call fcn.004799c0
jmp 0x479d3d
xor eax, eax
mov edx, dword [esp + 8]
mov ecx, eax
push edx
mov dword [edi + 8], eax
call fcn.00479a00
pop edi
add esp, 8
ret 4
Function at 0x47a420
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 8
test eax, eax
push edi
mov edi, ecx
je 0x47a4c9
push esi
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
mov esi, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push edi
call esi
mov edx, dword [0x659a18]
lea eax, [esp + 0x24]
push edx
push 1
push 8
push eax
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
call esi
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 0x30
test eax, eax
pop esi
je 0x47a490
mov ecx, eax
call fcn.00479c30
jmp 0x47a492
xor eax, eax
mov ecx, dword [esp + 4]
mov dword [edi + 4], eax
push ecx
mov ecx, eax
call fcn.00479800
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 4
test eax, eax
je 0x47a4b8
mov ecx, eax
call fcn.00479c30
jmp 0x47a4ba
xor eax, eax
mov edx, dword [esp + 8]
mov ecx, eax
push edx
mov dword [edi + 8], eax
call fcn.00479800
pop edi
add esp, 8
ret 4

Function at 0x47a580
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x708
test eax, eax
push ebx
push ebp
push esi
push edi
mov ebx, ecx
je 0x47a6cd
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 0
push eax
mov eax, dword [0x659a18]
push eax
call edi
mov ecx, dword [0x659a18]
mov ebp, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push ebx
call ebp
add esp, 0x1c
mov ecx, ebx
call fcn.0049d440
mov edx, dword [0x659a18]
lea eax, [ebx + 4]
push edx
push 1
push 4
push eax
call ebp
mov ecx, dword [0x659a18]
lea esi, [ebx + 8]
push ecx
push 1
push 4
push esi
call ebp
mov edx, dword [0x659a18]
lea eax, [esp + 0x34]
push edx
push 1
push 4
push eax
mov dword [esp + 0x44], 0
call ebp
mov ecx, dword [esp + 0x44]
mov edx, dword [0x659a18]
push 0
push ecx
push edx
call edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x358]
mov dword [esp + 0x354], 0
rep stosd dword es:[edi], eax
mov eax, dword [0x659a18]
mov ecx, dword [esi]
push eax
push ecx
lea edx, [esp + 0x35c]
push 4
push edx
call ebp
mov eax, dword [esi]
add esp, 0x4c
lea eax, [eax + eax*2]
shl eax, 2
push eax
call fcn.00470b90
mov dword [ebx + 0xc], eax
mov eax, dword [esi]
add esp, 4
xor edi, edi
test eax, eax
jle 0x47a6cd
lea ecx, [esp + 0x318]
xor ebp, ebp
mov dword [esp + 0x10], ecx
mov edx, dword [esp + 0x10]
mov ecx, dword [ebx + 0xc]
add ecx, ebp
mov eax, dword [edx]
push eax
call fcn.0047a420
lea ecx, [esp + 0x1a]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [ebx + 0xc]
push edx
add ecx, ebp
call fcn.0047a540
test eax, eax
je 0x47a6b8
lea eax, [esp + 0x1a]
lea ecx, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x220]
push str.pg_ctl_register__U__s__P__s
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
inc edi
add edx, 4
add ebp, 0xc
cmp edi, eax
mov dword [esp + 0x10], edx
jl 0x47a66f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x708
ret 4
Function at 0x47a780
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x47a7e8
push edi
push 0
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
push ecx
push 1
push 0xc
push esi
call dword [sym.imp.MSVCRT.dll_fread]
push 0xc
call sub.MFC42u.DLL_operatornew
add esp, 0x20
test eax, eax
je 0x47a7d7
mov ecx, eax
call fcn.00479c30
mov edx, dword [esi + 8]
mov edi, eax
push edx
mov ecx, edi
call fcn.00479800
mov dword [esi + 8], edi
pop edi
pop esi
ret 4
mov edx, dword [esi + 8]
xor edi, edi
push edx
mov ecx, edi
call fcn.00479800
mov dword [esi + 8], edi
pop edi
pop esi
ret 4
Function at 0x47a870
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
xor eax, eax
xor ecx, ecx
push edi
mov cl, byte [esi + 5]
cmp ecx, 4
ja case.default.0x47a88e
jmp dword [ecx*4 + 0x47aa34]
mov dword [esp + 0x10], eax
mov ax, word [esi + 6]
mov esi, dword [ebp + 8]
mov ecx, eax
and ecx, 0xffff
lea edi, [esp + 0x10]
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
cmp ax, 2
rep movsb byte es:[edi], byte [esi]
movsx eax, word [esp + 0x10]
je 0x47a8c9
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push 0x56c390
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
lea edi, [esp + 0x10]
mov cx, word [esi + 6]
mov esi, dword [ebp + 8]
mov edx, ecx
mov dword [esp + 0x10], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
push 0x56c62c
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
lea edi, [esp + 0x10]
mov cx, word [esi + 6]
mov esi, dword [ebp + 8]
mov edx, ecx
mov dword [esp + 0x10], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, dword [ebp + 0xc]
and ecx, 3
sub esp, 8
rep movsb byte es:[edi], byte [esi]
fld dword [esp + 0x18]
fstp qword [esp]
push 0x56c6c8
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
xor ecx, ecx
lea edi, [esp + 0x10]
mov cx, word [esi + 6]
mov esi, dword [ebp + 8]
mov edx, ecx
mov dword [esp + 0x10], 0
shr ecx, 2
mov dword [esp + 0x14], 0
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
call fcn.00472a80
fstp qword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov ecx, dword [ebp + 0xc]
push edx
push eax
push 0x56c63c
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x18
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [esi]
mov edi, dword [ebp + 8]
test ah, 0x20
je 0x47a9e9
xor edx, edx
mov dx, word [esi + 6]
push edx
push edi
call fcn.00471a80
add esp, 8
mov ebx, dword [ebp + 0xc]
mov byte [ebx], 0x27
mov eax, dword [esi]
test ah, 0x10
je 0x47aa0a
lea eax, [ebx + 1]
push 0x400
push eax
push edi
call fcn.004b7b00
add esp, 0xc
jmp 0x47aa17
lea ecx, [ebx + 1]
push ecx
push edi
call fcn.00471ff0
add esp, 8
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [ecx + ebx], 0x27
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47ac50
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x44c
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
je 0x47ae43
push ebx
push ebp
push edi
push eax
mov eax, dword [0x659a18]
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov ecx, dword [0x659a18]
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push ecx
push 1
push 4
push esi
call ebx
mov edx, dword [0x659a18]
lea eax, [esi + 4]
push edx
push 1
push 4
push eax
call ebx
mov ecx, dword [0x659a18]
lea edx, [esp + 0x44]
push ecx
push 1
push 4
push edx
mov dword [esp + 0x54], edi
call ebx
mov eax, dword [0x659a18]
lea ebp, [esi + 0xc]
push eax
push 1
push 4
push ebp
call ebx
mov ecx, dword [0x659a18]
add esp, 0x4c
lea edx, [esp + 0x14]
mov dword [esp + 0x14], edi
push ecx
push 1
push 4
push edx
call ebx
mov eax, dword [0x659a18]
lea ecx, [esp + 0x2c]
push eax
push 4
push 0x10
push ecx
call ebx
push 0x24
call fcn.00470250
add esp, 0x24
cmp eax, edi
je 0x47ad0b
lea edx, [esp + 0x1c]
push 1
push edx
mov ecx, eax
call fcn.00489020
jmp 0x47ad0d
xor eax, eax
push 0x24
mov dword [esi + 0x14], eax
call fcn.00470250
add esp, 4
cmp eax, edi
je 0x47ad2e
lea ecx, [esp + 0x2c]
push 1
push ecx
mov ecx, eax
call fcn.00489020
jmp 0x47ad30
xor eax, eax
push 0x24
mov dword [esi + 0x18], eax
call fcn.00470250
add esp, 4
cmp eax, edi
je 0x47ad51
lea edx, [esp + 0x3c]
push 1
push edx
mov ecx, eax
call fcn.00489020
jmp 0x47ad53
xor eax, eax
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x50]
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x20]
push 0xc
mov dword [eax], ecx
mov ecx, dword [esp + 0x58]
mov dword [eax + 4], edx
mov edx, dword [esp + 0x5c]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
call sub.MFC42u.DLL_operatornew
add esp, 4
cmp eax, edi
je 0x47ad8b
mov ecx, eax
call fcn.00479c30
jmp 0x47ad8d
xor eax, eax
mov ecx, dword [esp + 0x18]
mov dword [esi + 8], eax
push ecx
mov ecx, eax
call fcn.00479800
mov edx, dword [esp + 0x14]
mov eax, dword [0x659a18]
push edi
push edx
push eax
call dword [sym.imp.MSVCRT.dll_fseek]
mov edx, dword [ebp]
mov dword [esp + 0x68], edi
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x6c]
rep stosd dword es:[edi], eax
mov ecx, dword [0x659a18]
lea eax, [esp + 0x68]
push ecx
push edx
push 4
push eax
call ebx
mov eax, dword [ebp]
lea ecx, [eax + eax*2]
shl ecx, 2
push ecx
call fcn.00470b90
mov dword [esi + 0x10], eax
mov eax, dword [ebp]
xor edx, edx
add esp, 0x20
xor edi, edi
cmp eax, edx
jle 0x47ae24
mov dword [esp + 0x10], edx
lea ebx, [esp + 0x5c]
mov edx, dword [ebx]
mov ecx, dword [esp + 0x10]
push edx
mov edx, dword [esi + 0x10]
add ecx, edx
call fcn.0047a780
mov ecx, dword [esp + 0x10]
mov eax, dword [ebp]
inc edi
add ebx, 4
add ecx, 0xc
cmp edi, eax
mov dword [esp + 0x10], ecx
jl 0x47adfb
xor edx, edx
mov ecx, 7
xor eax, eax
lea edi, [esi + 0x44]
pop ebp
rep stosd dword es:[edi], eax
lea ecx, [esi + 0x3c]
pop ebx
mov dword [ecx], eax
mov dword [ecx + 4], eax
mov dword [esi + 0x34], edx
mov dword [esi + 0x38], edx
mov dword [esi + 0x30], edx
pop edi
pop esi
add esp, 0x44c
ret 4