joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b7d0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [ebp - 0x10], eax
xor eax, eax
cmp dword [esi + 4], 0
setne al
mov ebx, ecx
sar ebx, 0x1f
add eax, eax
add eax, 4
push dword [ebp + 0xc]
push ecx
push ebx
mov dword [ebp - 0x30], eax
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x44b847
call fcn.00478e90
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push dword [ebp - 0x30]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], edi
test edi, edi
jne 0x44b847
call fcn.00478e90
mov eax, dword [ebp + 0x10]
mov edi, dword [eax]
test edi, edi
je 0x44b87e
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 0x2c]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [ebp - 0x20]
sub ecx, edi
add ecx, dword [ebp - 0x28]
test eax, eax
cmove ecx, eax
mov dword [esi], ecx
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe871
mov eax, ebx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
xor ebx, ebx
jmp 0x44b868

Function at 0x44b9d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
test ebx, ebx
je 0x44ba49
mov ecx, dword [ebp + 0xc]
cmp ebx, 1
jne 0x44b9ec
xor esi, esi
jmp 0x44ba2e
and ebx, 0xfffffffe
xor esi, esi
nop word cs:[eax + eax]
nop dword [eax + eax]
movzx edi, al
movzx edx, byte [ecx + esi]
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x53364c]
movzx edx, al
movzx edi, byte [ecx + esi + 1]
xor edi, edx
shr eax, 8
xor eax, dword [edi*4 + 0x53364c]
add esi, 2
cmp ebx, esi
jne 0x44ba00
mov edx, dword [ebp + 0x10]
test dl, 1
je 0x44ba49
movzx edx, al
movzx ecx, byte [ecx + esi]
xor ecx, edx
shr eax, 8
xor eax, dword [ecx*4 + 0x53364c]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x44bec0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x1408
call fcn.004fed80
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [0x57ffb8]
cmp eax, 0xffffffff
je 0x44c016
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test bl, 3
je 0x44c016
and ebx, 0xfffffffc
lea eax, [ebp - 0x810]
push 0x800
push ebx
push eax
call fcn.00501dd0
add esp, 0xc
mov ecx, dword [0x57ffb8]
lea eax, [ebp - 0x80f]
push eax
mov dword [ebp - 0x1414], ecx
push ecx
call fcn.00479550
add esp, 8
test ebx, ebx
je 0x44bf3b
push ebx
call fcn.004fe86c
add esp, 4
mov eax, dword [0x582a2c]
mov ecx, dword [0x581ddc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44c02b
mov esi, dword [0x582a28]
mov ecx, esi
call fcn.00434410
lea eax, [ebp - 0x1410]
push 0xc00
push 0x581e28
push eax
call fcn.00501dd0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov edi, 0x100
mov al, 1
jmp 0x44bfaa
lea ecx, [edi - 1]
cmp edi, 2
mov edi, ecx
jb 0x44c006
test al, 1
je 0x44c006
xor eax, eax
lea esi, [ebp - 0x1408]
xor ebx, ebx
jmp 0x44bfce
add ebx, 1
add esi, 0xc
cmp ebx, 0x100
je 0x44bfa0
mov ecx, dword [ebp + ebx*8 - 0x810]
test ecx, ecx
je 0x44bfc0
cmp dword [esi - 8], 0
je 0x44bfc0
mov edx, dword [ebp + ebx*8 - 0x80c]
cmp edx, dword [esi]
jne 0x44bfc0
mov edx, dword [esi - 4]
test edx, edx
je 0x44bfc0
mov dword [ebp + ebx*8 - 0x810], 0
push ecx
call edx
add esp, 4
mov al, 1
jmp 0x44bfc0
push 2
push dword [ebp - 0x1414]
call fcn.00479550
add esp, 8
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe871
add esp, 0x1408
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x582a2c
call fcn.004fe8b7
add esp, 4
cmp dword [0x582a2c], 0xffffffff
jne 0x44bf5c
push 4
call fcn.004fe808
add esp, 4
mov esi, eax
mov ecx, eax
call fcn.00434400
mov dword [0x582a28], esi
push 0x582a2c
call fcn.004fe92d
add esp, 4
jmp 0x44bf5c

Function at 0x44c070
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x57ffb8]
cmp eax, 0xffffffff
je 0x44c092
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
and eax, 3
add eax, 0xffffffff
cmp eax, 2
setb al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x44c0a0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov eax, dword [0x57ffb8]
cmp eax, 0xffffffff
je 0x44c0bd
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x44c0c2
call fcn.0044c1d0
mov eax, dword [0x582a2c]
mov ecx, dword [0x581ddc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x44c179
mov edi, dword [0x582a28]
mov ecx, edi
call fcn.00434410
mov eax, dword [0x581e24]
add eax, 1
mov ecx, 0x100
nop dword [eax]
movzx edx, al
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x581e28], 0
je 0x44c12d
lea edx, [eax + 1]
movzx edx, dl
lea ebx, [edx + edx*2]
cmp dword [ebx*4 + 0x581e28], 0
je 0x44c12d
add eax, 2
add ecx, 0xfffffffe
jne 0x44c100
jmp 0x44c15d
lea eax, [ebx*4 + 0x581e28]
mov dword [eax], 1
lea eax, [edx*4]
mov ecx, dword [ebp + 8]
mov dword [eax + eax*2 + 0x581e2c], ecx
mov dword [0x581e24], edx
mov dword [esi], edx
mov eax, dword [eax + eax*2 + 0x581e30]
mov dword [esi + 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x44c1be
cmp eax, 0x100
jge 0x44c1c1
pop esi
pop edi
pop ebx
pop ebp
ret 4
push 0x582a2c
call fcn.004fe8b7
add esp, 4
cmp dword [0x582a2c], 0xffffffff
jne 0x44c0e3
push 4
call fcn.004fe808
add esp, 4
mov edi, eax
mov ecx, eax
call fcn.00434400
mov dword [0x582a28], edi
push 0x582a2c
call fcn.004fe92d
add esp, 4
jmp 0x44c0e3
int3
int3

Function at 0x44c1d0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x808
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov eax, dword [0x57ffb8]
mov dword [ebp - 0x810], eax
cmp eax, 0xffffffff
jne 0x44c26e
lea esi, [ebp - 0x810]
push esi
call fcn.00479520
add esp, 4
test al, al
je 0x44c2ef
mov ecx, dword [ebp - 0x810]
cmp ecx, 0xffffffff
jne 0x44c245
push esi
call fcn.00479520
add esp, 4
test al, al
je 0x44c2f2
cmp dword [ebp - 0x810], 0xffffffff
je 0x44c2f2
push 0xffffffffffffffff
call fcn.00479540
add esp, 4
mov ecx, dword [ebp - 0x810]
mov eax, 0xffffffff
lock cmpxchg dword [0x57ffb8], ecx
mov eax, dword [ebp - 0x810]
je 0x44c26e
push eax
call fcn.00479540
add esp, 4
mov eax, dword [0x57ffb8]
mov dword [ebp - 0x810], eax
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test al, 3
jne 0x44c2ec
lea edi, [ebp - 0x80c]
push 0x800
push 0
push edi
call fcn.00502350
add esp, 0xc
lea eax, [ebp - 0x809]
push eax
push dword [ebp - 0x810]
call fcn.00479550
add esp, 8
push 0x800
call fcn.004fe863
add esp, 4
mov esi, eax
push 0x800
push edi
push eax
call fcn.00501dd0
add esp, 0xc
mov eax, esi
or eax, 3
push eax
push dword [ebp - 0x810]
call fcn.00479550
add esp, 8
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004fe871
mov eax, esi
add esp, 0x808
pop esi
pop edi
pop ebp
ret
int3
int3
int3
Function at 0x4535d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x50
mov esi, ecx
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [esp + 0x48], eax
mov edi, esp
push 0x1b
push str..._.._base_files_memory_mapped_file_win.cc
push str.MapImageToMemory
push edi
call fcn.00424a20
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push edi
call fcn.0042ec60
mov ecx, esi
call fcn.004334f0
test al, al
je 0x453693
mov ecx, esi
call fcn.00433500
sub esp, 0x18
movaps xmm0, xmmword [0x5341c0]
movups xmmword [esp + 4], xmm0
mov dword [esp], eax
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
cmp dword [esi + 0x24], eax
je 0x45368b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi + 0x24]
add eax, 1
cmp eax, 2
jb 0x45366f
call fcn.00424a50
push dword [esi + 0x24]
call fcn.00435200
add esp, 4
mov dword [esi + 0x24], 0
mov eax, edi
add eax, 1
cmp eax, 2
jb 0x453681
mov dword [esi + 0x24], edi
call fcn.00424a50
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi + 0x24]
lea eax, [edi + 1]
cmp eax, 2
jae 0x4536b5
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.0042ed80
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004fe871
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 4
sub esp, 0x14
movaps xmm0, xmmword [0x52b3a0]
movups xmmword [esp + 4], xmm0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x453693
mov dword [esp], 0x534224
mov dword [esp + 4], eax
mov ecx, esp
call fcn.0047c6bc
mov eax, dword [eax + 0x50]
mov dword [esi + 0x20], eax
mov bl, 1
jmp 0x453695
Function at 0x4536f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x60
mov esi, ecx
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [esp + 0x58], eax
lea edi, [esp + 0x10]
push 0x3a
push str..._.._base_files_memory_mapped_file_win.cc
push str.MapFileRegionToMemory
push edi
call fcn.00424a20
add esp, 0x10
lea ecx, [esp + 0x20]
push 0
push edi
call fcn.0042ec60
mov ecx, esi
call fcn.004334f0
xor ebx, ebx
test al, al
je 0x4537ee
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
cmp eax, 3
ja case.default.0x45374a
jmp dword [eax*4 + 0x53422c]
mov edi, 2
jmp 0x453779
mov edi, 4
jmp 0x453779
mov ebx, dword [ecx + 8]
mov edi, 4
jmp 0x453779
sub esp, 4
mov ecx, esi
call fcn.004535d0
mov ebx, eax
jmp 0x4537ee
xor edi, edi
mov ecx, esi
call fcn.00433500
push 0
push ebx
push 0
push edi
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov ebx, eax
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x4537e4
mov dword [esp + 4], edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi + 0x24]
add eax, 1
cmp eax, 2
jb 0x4537c6
call fcn.00424a50
push dword [esi + 0x24]
call fcn.00435200
add esp, 4
mov dword [esi + 0x24], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x4537d6
mov dword [esi + 0x24], ebx
call fcn.00424a50
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi + 0x24]
mov edi, dword [esp + 4]
add eax, 1
cmp eax, 2
jae 0x45380e
xor ebx, ebx
lea ecx, [esp + 0x20]
call fcn.0042ed80
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004fe871
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov dword [esp + 0xc], 0
mov ebx, dword [ebp + 8]
mov ecx, ebx
push 0x534240
call fcn.00453940
test al, al
je 0x45384b
mov ecx, esi
call fcn.00433a10
xor ebx, ebx
cmp eax, 1
mov ecx, edx
sbb ecx, 0
jl 0x4537ee
test edx, edx
jne 0x4537ee
mov dword [esi + 0x20], eax
xor ecx, ecx
xor eax, eax
xor edx, edx
jmp 0x4538a6
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
push eax
push ecx
lea eax, [esp + 0x18]
push eax
push dword [ebx + 8]
push dword [ebx + 4]
push dword [ebx]
call fcn.00453af0
add esp, 0x18
mov eax, dword [esp + 0x14]
test eax, eax
js 0x4537ec
mov dword [esp + 4], edi
mov edi, dword [ebx + 8]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
add edx, edi
mov dword [esi + 0x20], edi
mov edi, dword [esp + 4]
and edi, 2
add edi, 2
push edx
push ecx
push eax
push edi
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [esi + 0x1c], eax
test eax, eax
je 0x4537ec
add eax, dword [esp + 0xc]
mov dword [esi + 0x1c], eax
mov bl, 1
jmp 0x4537ee
Function at 0x454f70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x160
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [esp + 0x158], eax
mov eax, dword [0x582abc]
mov ecx, dword [0x581ddc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x454fc5
mov ecx, dword [esp + 0x158]
xor ecx, ebp
call fcn.004fe871
mov eax, 0x582ab8
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
push 0x582abc
call fcn.004fe8b7
add esp, 4
cmp dword [0x582abc], 0xffffffff
jne 0x454faa
lea eax, [esp + 0x40]
push 0x118
push 0
push eax
call fcn.00502350
add esp, 0xc
mov dword [esp + 0x3c], 0x11c
lea edi, [esp + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x50]
push dword [esp + 0x50]
call dword [sym.imp.KERNEL32.dll_GetProductInfo]
push 0x50
call fcn.004fe808
add esp, 4
mov esi, eax
mov ebx, dword [esp + 0xc]
mov eax, dword [0x582afc]
mov ecx, dword [0x581ddc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x455074
mov ecx, esi
push ebx
push 0x582ad8
push edi
call fcn.004551d0
mov dword [0x582ab8], esi
push 0x582abc
call fcn.004fe92d
add esp, 4
jmp 0x454faa
push 0x582afc
call fcn.004fe8b7
add esp, 4
cmp dword [0x582afc], 0xffffffff
jne 0x45504e
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x10], xmm0
mov dword [esp + 0x30], 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x30]
mov dword [0x582af8], eax
movaps xmm0, xmmword [esp + 0x10]
movaps xmm1, xmmword [esp + 0x20]
movups xmmword [0x582ae8], xmm1
movups xmmword [0x582ad8], xmm0
push 0x582afc
call fcn.004fe92d
add esp, 4
jmp 0x45504e

Function at 0x4550f0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff0
sub esp, 0x40
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [esp + 0x30], eax
mov eax, dword [0x582afc]
mov ecx, dword [0x581ddc]
mov edx, dword fs:[0x2c]
mov ecx, dword [edx + ecx*4]
cmp eax, dword [ecx + 4]
jg 0x455164
movzx eax, word [0x582ad8]
cmp eax, 0xc
ja case.0x455130.1
xor esi, esi
jmp dword [eax*4 + 0x534330]
mov esi, 2
jmp case.0x455130.0
mov esi, 4
jmp case.0x455130.0
mov esi, 1
jmp case.0x455130.0
mov esi, 3
mov ecx, dword [esp + 0x30]
xor ecx, ebp
call fcn.004fe871
mov eax, esi
lea esp, [ebp - 4]
pop esi
pop ebp
ret
push 0x582afc
call fcn.004fe8b7
add esp, 4
cmp dword [0x582afc], 0xffffffff
jne 0x455122
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
movaps xmmword [esp], xmm0
mov dword [esp + 0x20], 0
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 0x20]
mov dword [0x582af8], eax
movaps xmm0, xmmword [esp]
movaps xmm1, xmmword [esp + 0x10]
movups xmmword [0x582ae8], xmm1
movups xmmword [0x582ad8], xmm0
push 0x582afc
call fcn.004fe92d
add esp, 4
jmp 0x455122
Function at 0x460060
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [0x57ffac]
xor ecx, ebp
mov dword [ebp - 8], ecx
cmp eax, 3
jne 0x46011e
mov dword [ebp - 0x14], 0x460140
lea eax, [ebp - 0x14]
push 0
push eax
push 0x460040
push 0x582ba0
call dword [sym.imp.KERNEL32.dll_InitOnceExecuteOnce]
test eax, eax
je 0x460130
cmp dword [0x582ba4], 0
jne 0x46011e
push dword [0x582ba8]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x46011e
mov esi, eax
push 0x582bac
call dword [sym.imp.KERNEL32.dll_AcquireSRWLockExclusive]
mov eax, dword [0x582bb8]
mov dword [ebp - 0xc], eax
movsd xmm0, qword [0x582bb0]
movsd qword [ebp - 0x14], xmm0
push 0x582bac
call dword [sym.imp.KERNEL32.dll_ReleaseSRWLockExclusive]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x4600f7
push dword [esi]
call eax
add esp, 4
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x460106
push dword [esi + 4]
call eax
add esp, 4
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x460115
push dword [esi + 8]
call eax
add esp, 4
push esi
call fcn.0043e990
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004fe871
add esp, 0x10
pop esi
pop ebp
ret 0xc
call fcn.00510edd
int3
Function at 0x471d00
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov ebx, ecx
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x24], edx
push edx
push ecx
push edi
call fcn.0042de10
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x471d2f
mov edi, dword [ebp - 0x1c]
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
cmp byte [ebp - 0x11], 0
jns 0x471d4d
push dword [ebp - 0x1c]
call fcn.004fe838
add esp, 4
cmp dword [ebp + 8], 0
je 0x471e2c
test esi, esi
je 0x471e2c
mov dword [ebp - 0x20], esi
add esi, esi
mov ecx, 0xffffffff
cmovae ecx, esi
push ecx
call fcn.004fe863
add esp, 4
mov edi, eax
lea esi, [ebp - 0x1c]
push dword [ebp - 0x24]
push ebx
push esi
call fcn.0042de10
add esp, 0xc
cmp byte [ebp - 0x11], 0
jns 0x471d90
mov esi, dword [ebp - 0x1c]
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp byte [ebp - 0x11], 0
jns 0x471dac
push dword [ebp - 0x1c]
call fcn.004fe838
add esp, 4
cmp word [edi], 0
mov esi, dword [ebp + 8]
je 0x471dcf
xor ecx, ecx
nop word [eax + eax]
lea eax, [ecx + 1]
cmp word [edi + ecx*2 + 2], 0
mov ecx, eax
jne 0x471dc0
jmp 0x471dd1
xor eax, eax
lea ecx, [ebp - 0x1c]
push eax
push edi
push ecx
call fcn.0042e290
add esp, 0xc
cmp byte [esi + 0xb], 0
js 0x471dee
mov byte [esi], 0
mov byte [esi + 0xb], 0
jmp 0x471e11
mov eax, dword [esi]
mov byte [eax], 0
mov dword [esi + 4], 0
cmp byte [esi + 0xb], 0
jns 0x471e11
push dword [esi]
call fcn.004fe838
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [ebp - 0x14]
mov dword [esi + 8], eax
movsd xmm0, qword [ebp - 0x1c]
movsd qword [esi], xmm0
push edi
call fcn.004fe86c
add esp, 4
mov esi, dword [ebp - 0x20]
test esi, esi
setne bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004fe871
mov eax, ebx
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4748e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x20
mov eax, dword [0x57ffac]
xor eax, ebp
mov dword [esp + 0x18], eax
mov edi, dword [ecx + 0x38]
test edi, edi
jne 0x474983
mov esi, ecx
mov dword [esp + 0x10], 0
mov byte [esp + 0x13], 9
mov dword [esp + 0xc], 0x65647261
mov dword [esp + 8], 0x63736964
mov word [esp + 0x10], 0x64
push 0x40
call fcn.004fe808
add esp, 4
mov ebx, eax
lea eax, [esp + 8]
mov edi, esp
mov ecx, esi
push eax
push edi
call fcn.004747f0
mov ecx, ebx
push edi
push dword [esi + 0x28]
lea eax, [esp + 0x10]
push eax
call fcn.00474d30
mov edi, dword [esi + 0x38]
mov dword [esi + 0x38], ebx
test edi, edi
je 0x47496d
mov ecx, edi
call fcn.00474d80
push edi
call fcn.004fe838
add esp, 4
cmp byte [esp + 0x13], 0
jns 0x474980
push dword [esp + 8]
call fcn.004fe838
add esp, 4
mov edi, dword [esi + 0x38]
mov ecx, dword [esp + 0x18]
xor ecx, ebp
call fcn.004fe871
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47c1d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor eax, eax
cmp dword [ebp + 0xc], 0
sete al
xor ecx, ecx
cmp dword [ebp + 8], 0
sete cl
push 0
push eax
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], 0
test eax, eax
je 0x47c259
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
add eax, 1
cmp eax, 2
jb 0x47c229
call fcn.00424a50
push dword [esi]
call fcn.00435200
add esp, 4
mov dword [esi], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x47c238
mov dword [esi], edi
call fcn.00424a50
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 1
add eax, 1
cmp eax, 1
jbe 0x47c256
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
int3
mov byte [esi + 4], 1
int3

Function at 0x47c700
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + 0x3c]
movzx edx, word [ecx + eax + 6]
test edx, edx
je 0x47c74d
add eax, ecx
movzx esi, word [eax + 0x14]
lea edi, [eax + esi]
add edi, 0x18
xor ebx, ebx
xor esi, esi
test edi, edi
je 0x47c74d
mov eax, dword [edi + ebx + 0xc]
test eax, eax
je 0x47c73a
add eax, ecx
cmp eax, dword [ebp + 8]
jbe 0x47c73c
jmp 0x47c745
xor eax, eax
add eax, dword [edi + ebx + 8]
cmp eax, dword [ebp + 8]
ja 0x47c756
inc esi
add ebx, 0x28
cmp esi, edx
jb 0x47c725
xor eax, eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
add edi, ebx
mov eax, edi
jmp 0x47c74f
Function at 0x47c7fa
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x47c8dc
mov ebx, ecx
mov eax, dword [ecx + 4]
mov edx, dword [eax + 0x3c]
cmp dword [eax + edx + 0x74], 0
je 0x47c8dc
cmp word [eax + edx + 0x14], 0x68
jb 0x47c8dc
mov esi, dword [ebx]
mov ecx, ebx
push dword [eax + edx + 0x78]
call dword [esi + 4]
test eax, eax
je 0x47c8dc
mov esi, eax
mov eax, dword [ebp + 8]
cmp eax, 0xffff
ja 0x47c854
mov word [edi], ax
jmp 0x47c909
mov eax, dword [ebx]
mov ecx, ebx
push dword [esi + 0x20]
call dword [eax + 4]
mov edx, eax
mov eax, dword [esi + 0x18]
lea ecx, [eax*4]
test ecx, ecx
je 0x47c8dc
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ebx
lea edi, [edx + eax*4]
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], edx
mov ebx, edx
mov eax, edi
sub eax, ebx
mov ecx, eax
sar ecx, 2
shr eax, 0x1f
add eax, ecx
and eax, 0xfffffffe
lea esi, [ebx + eax*2]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
push dword [esi]
call dword [eax + 4]
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
test cl, cl
je 0x47c8b9
mov edx, dword [ebp - 0x1c]
cmp cl, byte [eax]
jne 0x47c8bb
inc eax
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x47c8ad
xor ecx, ecx
movzx ecx, cl
movzx eax, byte [eax]
mov edx, ecx
sub edx, eax
test edx, edx
lea edx, [esi + 4]
cmovg ebx, edx
cmovle edi, esi
cmp ecx, eax
je 0x47c8e8
xor eax, eax
cmp ebx, edi
jne 0x47c883
jmp 0x47c8de
xor eax, eax
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx]
mov edi, dword [ebp - 0x18]
push dword [edi + 0x24]
call dword [eax + 4]
sub esi, dword [ebp - 0x14]
sar esi, 1
movzx eax, word [eax + esi]
add ax, word [edi + 0x10]
mov ecx, dword [ebp + 0xc]
mov word [ecx], ax
mov al, 1
jmp 0x47c8de