joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464620
Capabilities:
Read data from internet
Receive data

Disassembly:
mov eax, dword [eax]
sub esp, 8
test eax, eax
push ebx
push edi
jne 0x464636
or eax, 0xffffffff
pop edi
pop ebx
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push ecx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x46462b
mov edx, dword [esp + 0xc]
add dword [esi + 0xc], edx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
cmp edi, dword [esi + 4]
je 0x4646ca
mov ecx, edi
sub ecx, dword [esi + 0x18]
cmp ecx, 0x3e8
jbe 0x46469c
mov ebx, dword [esi + 0xc]
mov eax, ebx
sub eax, dword [esi + 0x1c]
xor edx, edx
div ecx
test eax, eax
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
jge 0x464693
fadd qword [0x61cde0]
fstp qword [esi + 0x10]
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], ebx
mov eax, dword [esi + 0xc]
fild dword [esi + 0xc]
test eax, eax
jge 0x4646ac
fadd qword [0x61cde0]
mov ecx, edi
sub ecx, dword [esi]
test ecx, ecx
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
jge 0x4646c2
fadd qword [0x61cde0]
fdivp st(1)
mov dword [esi + 4], edi
fstp qword [esi + 0x20]
mov eax, dword [esp + 0xc]
pop edi
pop ebx
add esp, 8
ret 4
Function at 0x46fbc0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5ddb7e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov dword [esp + 0xc], esi
mov ecx, esi
mov dword [esp + 0x18], 1
call fcn.005b8659
lea ecx, [esi + 0x10]
mov dword [esi], vtable.GameMgr::GMRegException.0
xor ebx, ebx
mov dword [ecx + 0x18], 7
mov dword [ecx + 0x14], ebx
mov word [ecx + 4], bx
lea edi, [esi + 0x2c]
mov dword [edi + 0x18], 7
mov dword [edi + 0x14], ebx
mov word [edi + 4], bx
mov eax, dword [esp + 0x20]
mov dl, byte [esp + 0x24]
mov byte [esp + 0x18], 4
push 0xffffffffffffffff
mov dword [esi + 0x50], eax
push ebx
lea eax, [esp + 0x30]
mov byte [esi + 0x4c], dl
call fcn.00402580
push 0xffffffffffffffff
push ebx
lea eax, [esp + 0x4c]
mov ecx, edi
call fcn.00402580
mov eax, dword [esp + 0x60]
mov edi, 8
cmp dword [esp + 0x40], edi
mov dword [esi + 0x48], eax
mov byte [esi + 0xc], bl
jb 0x46fc6f
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0059b877
add esp, 4
cmp dword [esp + 0x5c], edi
mov dword [esp + 0x40], 7
mov dword [esp + 0x3c], ebx
mov word [esp + 0x2c], bx
jb 0x46fc93
mov edx, dword [esp + 0x48]
push edx
call fcn.0059b877
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x10
ret 0x44

Function at 0x46fce0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5eb490
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [edi + 0x10], ebx
push ebx
sub esp, 0x1c
mov dword [esp + 0x40], ebx
mov esi, esp
mov dword [esp + 0x30], esp
push ebx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x6190bc
mov word [esi + 4], bx
call fcn.00402770
sub esp, 0x1c
mov esi, esp
mov dword [esp + 0x50], esp
mov byte [esp + 0x5c], 1
push ebx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], ebx
push 0x6190bc
mov word [esi + 4], bx
call fcn.00402770
push ebx
push ebx
lea esi, [edi + 0x14]
mov byte [esp + 0x64], bl
call fcn.0046fbc0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 4
Function at 0x471270
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x5f36c2
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x64c874]
xor eax, esp
mov dword [esp + 0x78], eax
push ebx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x90]
mov dword fs:[0], eax
mov edi, ecx
mov esi, edx
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], esi
call fcn.00457180
mov edx, dword [edi + 0xc]
cmp edx, 8
jb 0x4713fd
mov eax, dword [edi + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
xor esi, esi
cmp ecx, esi
mov dword [esp + 0x18], ecx
je 0x4712eb
cmp eax, esi
je 0x4712eb
add edx, 0xfffffff8
cmp edx, eax
jb 0x4713fd
cmp ecx, esi
mov ebx, dword [edi + 8]
mov edi, 8
mov dword [esp + 0x10], esi
ja 0x471322
mov al, 1
mov ecx, dword [esp + 0x90]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x78]
xor ecx, esp
call fcn.005b88a9
mov esp, ebp
pop ebp
ret
xor esi, esi
push esi
mov dword [esp + 0x38], esi
mov word [esp + 0x28], si
push 0x6190bc
lea esi, [esp + 0x28]
mov dword [esp + 0x40], 7
call fcn.00402770
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x40]
xor esi, esi
push ecx
mov edx, reloc.WS2_32.dll_accept
mov dword [esp + 0xa0], esi
call fcn.004745b0
mov byte [esp + 0x98], 2
cmp dword [esp + 0x38], 8
jb 0x47137b
mov edx, dword [esp + 0x24]
push edx
call fcn.0059b877
add esp, 4
mov eax, dword [edi + ebx]
mov ecx, dword [esp + 0x1c]
mov ecx, dword [ecx + 0xc]
add edi, 4
mov dword [esp + 0x34], esi
mov word [esp + 0x24], si
lea esi, [eax + edi]
cmp esi, ecx
mov dword [esp + 0x38], 7
lea ecx, [esp + 0x3c]
ja 0x4713ec
push eax
add edi, ebx
push edi
call fcn.00474f40
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
mov edi, esi
call fcn.00459880
lea eax, [esp + 0x3c]
push eax
mov dword [esp + 0x9c], 0xffffffff
call fcn.00474630
mov eax, dword [esp + 0x10]
add eax, 1
cmp eax, dword [esp + 0x18]
mov dword [esp + 0x10], eax
jb 0x471320
jmp 0x4712fb
push ecx
mov dword [esp + 0x9c], 0xffffffff
call fcn.00474630
xor al, al
jmp 0x4712fd
Function at 0x473cd0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x5dc818
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esp + 0x34]
xor edi, edi
mov dword [esp + 0x2c], edi
cmp dword [eax + 0x18], 8
jb 0x473d0e
mov eax, dword [eax + 4]
jmp 0x473d11
add eax, 4
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
je 0x473ddc
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
lea edi, [esp + 0x18]
lea eax, [esp + 0x14]
call fcn.00431680
test al, al
je 0x473dd5
mov ebp, dword [esp + 0x18]
mov eax, ebp
or eax, dword [esp + 0x1c]
je 0x473dd5
lea edi, [ebp + 3]
call fcn.0042dd60
mov eax, dword [esi + 4]
cmp ebp, eax
ja 0x473d71
mov eax, ebp
mov dword [esi + 0xc], eax
mov eax, dword [esi + 8]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x34], edi
je 0x473dd5
push edi
lea ecx, [esp + 0x38]
push ecx
push ebp
push eax
push ebx
mov dword [esp + 0x48], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x473dd5
mov ecx, dword [esp + 0x34]
cmp ecx, edi
seta al
test al, al
je 0x473dd5
cmp ecx, ebp
jne 0x473dd5
mov eax, dword [esi + 8]
xor ecx, ecx
add eax, ebp
mov word [eax], cx
lea esi, [esp + 0x14]
mov byte [eax + 2], cl
call fcn.004315a0
mov al, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
Function at 0x474a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5eb3b8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
mov edi, ecx
push 1
push edi
lea ecx, [esp + 0x30]
call fcn.00474790
cmp dword [esp + 0x40], 8
mov eax, dword [eax + 0x14]
lea eax, [eax + eax + 0xc]
mov dword [esp + 0x24], eax
jb 0x474a64
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0059b877
add esp, 4
xor ebp, ebp
xor esi, esi
mov dword [esp + 0x20], ebp
xor ebx, ebx
mov edi, edi
mov eax, dword [edi + 0x14]
cmp eax, ebp
je 0x474ad5
mov ecx, dword [edi + 0x18]
sub ecx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jae 0x474ad5
mov eax, dword [edi + 0x14]
cmp eax, ebp
je 0x474ab2
mov ecx, dword [edi + 0x18]
sub ecx, eax
mov eax, 0x78787879
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp esi, eax
jb 0x474ab7
call fcn.005b8b18
mov ecx, dword [edi + 0x14]
add ecx, ebx
call fcn.00474a10
mov edx, dword [esp + 0x20]
lea eax, [edx + eax + 4]
add esi, 1
mov dword [esp + 0x20], eax
add ebx, 0x44
jmp 0x474a70
xor esi, esi
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.00428ee0
test eax, eax
jbe 0x474bbb
mov dword [esp + 0x28], vtable.GameMgr::GMBuffer_unsigned_char_.0
mov dword [esp + 0x1c], esi
mov eax, dword [edi + 4]
test eax, eax
je 0x474b1b
mov ecx, dword [edi + 8]
sub ecx, eax
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp dword [esp + 0x18], eax
jb 0x474b20
call fcn.005b8b18
mov ebx, dword [edi + 4]
add ebx, dword [esp + 0x1c]
lea esi, [esp + 0x44]
mov eax, ebx
call fcn.0046bd30
cmp dword [esp + 0x5c], 8
mov eax, dword [eax + 0x14]
lea esi, [ebp + eax*2 + 6]
jb 0x474b4d
mov ecx, dword [esp + 0x48]
push ecx
call fcn.0059b877
add esp, 4
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
lea edx, [esp + 0x28]
mov dword [esp + 0x68], eax
push edx
mov eax, ebx
call fcn.0046ba40
mov eax, dword [esp + 0x34]
mov dword [esp + 0x68], 0xffffffff
lea ebp, [esi + eax + 4]
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0x28], vtable.GameMgr::GMBuffer_unsigned_char_.0
je 0x474b9c
push eax
call fcn.0059b877
add esp, 4
mov dword [esp + 0x30], 0
mov esi, dword [esp + 0x18]
add dword [esp + 0x1c], 0x70
add esi, 1
mov ecx, edi
mov dword [esp + 0x18], esi
call fcn.00428ee0
cmp esi, eax
jb 0x474af6
mov ecx, dword [esp + 0x20]
lea eax, [ecx + ebp]
add eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x58
ret
Function at 0x4758c0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
cmp dword [edi + 0x18], 8
push ebx
push esi
lea esi, [edi + 4]
jb 0x4758d2
mov eax, dword [esi]
jmp 0x4758d4
mov eax, esi
lea ecx, [esp + 0x10]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
mov dword [esp + 0xc], eax
jne 0x4758ef
xor al, al
pop esi
pop ebx
add esp, 0x10
ret
push eax
call fcn.0059b872
add esp, 4
cmp dword [edi + 0x18], 8
mov ebx, eax
jb 0x475902
mov esi, dword [esi]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push ebx
push edx
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4758e7
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
push 0x60a6b4
push ebx
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0x14]
movzx ecx, word [eax + 0xc]
movzx edx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
push edx
movzx edx, word [eax + 0xa]
push ecx
mov ecx, dword [esp + 0x28]
push edx
push 0x610fa0
call fcn.0042b990
add esp, 0x14
push ebx
call fcn.0059b877
add esp, 4
pop esi
mov al, 1
pop ebx
add esp, 0x10
ret
Function at 0x476f10
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, 0x101c
call fcn.005c0da0
mov eax, dword [0x64c874]
xor eax, esp
mov dword [esp + 0x1018], eax
mov eax, dword [esp + 0x1020]
push ebp
mov ebp, dword [esp + 0x102c]
push esi
lea edx, [esp + 0xc]
push edi
mov esi, ecx
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x476f41
lea edx, [esp + 0x810]
mov eax, esi
sub edx, esi
jmp 0x476f60
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x476f60
mov ax, word [esp + 0x1030]
push 0
push 0
lea ecx, [esp + 0x18]
push ecx
push 0x476be0
push 0
push 0
mov word [esp + 0x1028], ax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
push 0x14d
push esi
call edi
cmp eax, 0x102
jne 0x476fd0
mov edi, edi
mov ecx, dword [ebx + 0x2694]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
call eax
test eax, eax
jne 0x476ff1
push 0x14d
push esi
call edi
cmp eax, 0x102
je 0x476fb0
lea ecx, [esp + 0xc]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0xc], 0
je 0x477008
mov eax, 0xe0000005
jmp 0x47701e
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xe000000a
jmp 0x47701e
mov eax, dword [esp + 0x101c]
mov edx, dword [esp + 0x1018]
mov dword [ebp + 4], eax
mov dword [ebp], edx
xor eax, eax
mov ecx, dword [esp + 0x1024]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.005b88a9
add esp, 0x101c
ret 0xc
Function at 0x477670
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x10
push edi
mov edi, eax
cmp dword [edi + 0x2694], 0
jne 0x477688
xor al, al
pop edi
add esp, 0x10
ret 0xc
mov ecx, dword [edi + 0x2694]
mov eax, dword [ecx]
mov eax, dword [eax + 0x24]
lea edx, [esp + 8]
push edx
call eax
test eax, eax
jne 0x47767f
mov ecx, dword [edi + 0x2678]
push ebx
mov ebx, dword [esp + 0xc]
shl ebx, 0xa
test ecx, ecx
je 0x4776b8
mov eax, ebx
xor edx, edx
div ecx
mov ebx, eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esp + 0x28]
sub eax, dword [ecx]
mov ebp, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
je 0x47778a
mov edx, ebp
sub edx, dword [esi]
sbb ecx, dword [esi + 4]
test eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], ecx
fild qword [esp + 0x14]
mov dword [esp + 0x14], eax
fild dword [esp + 0x14]
jge 0x4776f8
fadd qword [0x61cde0]
fdivp st(1)
fmul qword [0x61ce00]
fnstcw word [esp + 0xe]
movzx eax, word [esp + 0xe]
or eax, 0xc00
mov dword [esp + 0x14], eax
fldcw word [esp + 0x14]
fistp qword [esp + 0x14]
mov edi, dword [esp + 0x14]
cmp edi, ebx
mov dword [esp + 0x14], edi
fldcw word [esp + 0xe]
jle 0x4777c8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x28]
sub edi, ebx
mov dword [esp + 0x28], edi
fild dword [esp + 0x28]
mov dword [edx], eax
mov eax, dword [esp + 0x24]
fnstcw word [esp + 0x28]
fidiv dword [esp + 0x14]
mov dword [esi + 4], eax
movzx eax, word [esp + 0x28]
or eax, 0xc00
mov dword [esp + 0x20], eax
mov dword [esi], ebp
fmul qword [0x61ce00]
fldcw word [esp + 0x20]
fistp qword [esp + 0x20]
mov ecx, dword [esp + 0x20]
push ecx
fldcw word [esp + 0x2c]
call sub.KERNEL32.dll_Sleep
pop ebp
pop ebx
mov al, 1
pop edi
add esp, 0x10
ret 0xc
mov edi, ebp
sub edi, dword [esi]
mov eax, ebx
sbb ecx, dword [esi + 4]
cdq
cmp ecx, edx
jl 0x4777c8
jg 0x47779e
cmp edi, eax
jbe 0x4777c8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [esp + 0x28]
mov dword [edx], eax
mov eax, dword [esp + 0x24]
push 0x3e8
mov dword [esi], ebp
mov dword [esi + 4], eax
call sub.KERNEL32.dll_Sleep
pop ebp
pop ebx
mov al, 1
pop edi
add esp, 0x10
ret 0xc
pop ebp
pop ebx
xor al, al
pop edi
add esp, 0x10
ret 0xc
Function at 0x478600
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
lea ebx, [ebp + ebp*4]
add ebx, ebx
add ebx, ebx
push 0
add ebx, ebx
lea eax, [ebx + 0x2678]
push 0
push eax
mov eax, dword [esp + 0x30]
lea esi, [esp + 0x18]
call fcn.004316d0
test al, al
jne 0x47863b
xor al, al
pop esi
pop ebp
pop ebx
add esp, 8
ret 0x10
mov ecx, dword [edi + 0x2690]
mov edx, dword [ebx + ecx]
add edx, dword [esp + 0x1c]
mov esi, dword [ebx + ecx + 4]
lea eax, [ebx + ecx]
mov ecx, dword [esp + 0x20]
adc esi, ecx
mov dword [eax + 0x10], edx
mov dword [eax + 0x14], esi
mov eax, dword [edi + 0x2690]
mov edx, dword [eax + ebx + 8]
mov esi, dword [eax + ebx + 0xc]
add eax, ebx
sub edx, dword [esp + 0x1c]
push 0
sbb esi, ecx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], esi
call fcn.005b8b28
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x369c]
mov dword [esp + 0x24], edx
mov edx, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
lea eax, [eax + ebp*8]
add esp, 4
cmp ecx, dword [eax + 4]
jl 0x4786e1
jg 0x4786a5
cmp edx, dword [eax]
jbe 0x4786e1
mov edx, dword [edi + 0x2690]
mov eax, dword [ebx + edx + 0x20]
mov ecx, dword [edi + 0x369c]
sub eax, dword [ecx + ebp*8]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
add ecx, eax
mov eax, dword [edi + 0x2690]
mov dword [ebx + eax + 0x20], ecx
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x20]
mov eax, dword [edi + 0x369c]
mov dword [eax + ebp*8], ecx
mov dword [eax + ebp*8 + 4], edx
mov eax, dword [edi + 0x2690]
add eax, ebx
je 0x478630
mov ecx, dword [esp + 0x24]
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x478630
push 0
lea edx, [esp + 0x1c]
push edx
push 0x28
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x478630
cmp dword [esp + 0x18], 0x28
jne 0x478630
cmp byte [edi], 0
je 0x47872a
mov byte [edi], 0
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 8
ret 0x10
Function at 0x47a990
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
sub esp, 0x34
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x18]
mov dword [esp + 0x20], eax
mov eax, dword [ebp + 0x14]
xor edx, edx
cmp eax, edx
push edi
mov edi, dword [ebp + 0x10]
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x20], 0x47a490
mov dword [esp + 0x34], 0x47a680
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x28], 0x47a320
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], esi
mov dword [esp + 0x10], edx
je 0x47a9ef
cmp esi, edx
je 0x47a9ef
lea eax, [esp + 0x28]
mov dword [esp + 0x10], eax
lea eax, [ebx + 0x18]
cmp eax, edx
mov dword [esp + 0x1c], edx
je 0x47aa13
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x47aa13
push edx
lea edx, [esp + 0x20]
push edx
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
mov eax, dword [esp + 0x1c]
add dword [edi], eax
lea ecx, [esp + 0x20]
adc dword [edi + 4], edx
mov edi, dword [ebx + 0x14]
lea edx, [esp + 0x34]
mov eax, edi
mov dword [edi + 0x1d0], ecx
mov dword [edi + 0x3bd10], 1
mov dword [edi + 0x3bcd4], edx
call fcn.00480a40
test eax, eax
jne 0x47aa53
mov ebx, dword [esp + 0x10]
mov ecx, edi
call fcn.00480ad0
xor ebx, ebx
cmp eax, ebx
je 0x47aa64
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
cmp dword [esp + 0x10], ebx
je 0x47ab05
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov eax, edx
or eax, edi
jne 0x47aa83
fld qword [0x61ce18]
fld st(0)
jmp 0x47aaef
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
adc eax, dword [esi + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x14], eax
fild qword [esp + 0x10]
and ecx, 0x80000000
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
fild qword [esp + 0x10]
mov eax, edi
mov ecx, edi
and eax, 0x7fffffff
fchs
mov dword [esp + 0x10], edx
faddp st(1)
mov dword [esp + 0x14], eax
fld qword [0x61ce18]
and ecx, 0x80000000
fmul st(1), st(0)
fild qword [esp + 0x10]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x10], ebx
fild qword [esp + 0x10]
fchs
faddp st(1)
fdivp st(2)
fxch st(1)
mov ecx, dword [ebp + 0x14]
fxch st(1)
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
sub esp, 0x10
fstp qword [esp + 8]
fstp qword [esp]
call eax
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x47ab10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
push 0xffffffffffffffff
push 0x5f4c88
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
push ebx
push esi
push edi
mov eax, dword [0x64c874]
xor eax, esp
push eax
lea eax, [esp + 0xb8]
mov dword fs:[0], eax
mov dword [esp + 0x44], ecx
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x6c]
push eax
mov dword [esp + 0x6c], 0x47a4f0
call fcn.0040fb20
xor ebx, ebx
mov dword [esp + 0x7c], ebx
mov dword [esp + 0x80], ebx
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x18]
mov dword [esp + 0xc0], ebx
mov eax, dword [esp + 0x44]
add eax, 0x18
cmp eax, ebx
mov dword [esp + 0x50], 0x47a680
mov dword [esp + 0x54], ecx
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], 0x47a320
mov dword [esp + 0x60], edx
mov dword [esp + 0x64], esi
mov dword [esp + 0x40], ebx
je 0x47abc1
mov ecx, dword [ecx]
cmp ecx, 0xffffffff
je 0x47abc1
push ebx
lea edx, [esp + 0x44]
push edx
push 5
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x40]
add dword [edi], eax
mov ecx, dword [esp + 0x44]
lea eax, [esp + 0x50]
adc dword [edi + 4], ebx
mov edi, dword [ecx + 0x14]
lea edx, [esp + 0x68]
mov dword [edi + 0x3bcd4], eax
mov eax, edi
mov dword [edi + 0x1d0], edx
mov dword [edi + 0x3bd10], 1
call fcn.00480a40
cmp eax, ebx
jne 0x47ac0b
lea ebx, [esp + 0x5c]
mov ecx, edi
call fcn.00480ad0
xor ebx, ebx
cmp eax, ebx
je 0x47ac4b
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x47ac31
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0x74]
push ecx
call fcn.00412b40
mov edx, dword [esp + 0x74]
add esp, 4
push edx
call fcn.0059b877
add esp, 4
xor al, al
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [esi]
mov edi, dword [esi + 4]
mov eax, edx
or eax, edi
jne 0x47ac60
fld qword [0x61ce18]
fld st(0)
jmp 0x47accc
mov ecx, dword [esi + 0x10]
add ecx, dword [esi + 8]
mov eax, dword [esi + 0x14]
adc eax, dword [esi + 0xc]
mov dword [esp + 0x44], ecx
mov ecx, eax
and eax, 0x7fffffff
mov dword [esp + 0x48], eax
fild qword [esp + 0x44]
and ecx, 0x80000000
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], ebx
fild qword [esp + 0x44]
mov eax, edi
mov ecx, edi
fchs
and eax, 0x7fffffff
faddp st(1)
mov dword [esp + 0x44], edx
fld qword [0x61ce18]
mov dword [esp + 0x48], eax
and ecx, 0x80000000
fmul st(1), st(0)
fild qword [esp + 0x44]
mov dword [esp + 0x48], ecx
mov dword [esp + 0x44], ebx
fild qword [esp + 0x44]
fchs
faddp st(1)
fdivp st(2)
fxch st(1)
mov ecx, dword [ebp + 0x14]
fxch st(1)
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
sub esp, 0x10
fstp qword [esp + 8]
fstp qword [esp]
call eax
mov eax, dword [esp + 0x70]
cmp eax, ebx
je 0x47ad08
mov ecx, dword [esp + 0x44]
mov edi, dword [esp + 0x74]
push ecx
call fcn.00412b40
mov edx, dword [esp + 0x74]
add esp, 4
push edx
call fcn.0059b877
add esp, 4
mov al, 1
mov ecx, dword [esp + 0xb8]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x47da80
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x47da90
pop edi
pop ebx
ret

Function at 0x47dac0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x47dad0
pop esi
pop ebp
pop ebx
ret

Function at 0x47dc40
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov esi, eax
mov edi, ecx
xor eax, eax
test edi, edi
lea edx, [eax + 1]
je 0x47dc82
push ebx
push ebp
mov ebx, dword [esp + 0x14]
movzx ebx, word [ebx + edx*2]
mov ecx, esi
and ecx, 1
mov ebp, ecx
neg ebp
sar ebp, 4
and ebp, 0x7f
shr ebx, 4
xor ebx, ebp
mov ebp, dword [esp + 0x18]
add eax, dword [ebp + ebx*4]
add edx, edx
shr esi, 1
or edx, ecx
sub edi, 1
jne 0x47dc51
pop ebp
pop ebx
pop edi
pop esi
ret