joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470627
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.PM_Requirement_InstallAfter_Begin_r_n
push 0x4eee98
mov edi, ecx
call fcn.004738c9
mov eax, dword [edi + 0x44]
sub eax, 0x10
push eax
call fcn.00406c4d
lea esi, [eax + 0x10]
xor ebx, ebx
add esp, 0xc
mov dword [ebp - 0x50], esi
cmp dword [esi - 0xc], ebx
jne 0x470676
lea eax, [edi + 0x58]
push eax
lea ecx, [ebp - 0x50]
call fcn.00406bd9
mov esi, dword [ebp - 0x50]
push esi
push str.PM_Requirement_InstallAfter_Pid_ws_r_n
push 0x4eee98
call fcn.004738c9
add esp, 0xc
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0046fc98
mov ecx, edi
call fcn.0046cc58
test eax, eax
je 0x4706b5
mov ecx, edi
call fcn.0046de3c
test eax, eax
jne 0x4706b5
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0046f894
lea eax, [ebp - 0x54]
push eax
push 0x4c2294
push str.3.9.23.0000
push dword [edi + 0x4c]
mov dword [ebp - 0x54], ebx
call fcn.00465cac
add esp, 0x10
test eax, eax
je 0x4707bb
cmp dword [ebp - 0x54], ebx
jne 0x4706ee
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0046ffd8
jmp 0x4707bb
push 0x4eb630
lea ecx, [ebp - 0x50]
call fcn.004044ee
lea eax, [edi + 0x20]
push eax
lea ecx, [ebp - 0x50]
call fcn.00406bd9
lea eax, [ebp - 0x50]
push eax
call fcn.00468709
mov ebx, str.Local_State
push ebx
call fcn.0040481a
pop ecx
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x50]
call fcn.0041e1c3
push dword [ebp - 0x50]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
xor ebx, ebx
test eax, eax
jne 0x4707b0
push 0x10
mov dword [ebp - 8], 0xf
mov dword [ebp - 0xc], ebx
mov byte [ebp - 0x1c], bl
call fcn.00449b05
pop ecx
test eax, eax
je 0x470758
mov ecx, eax
call fcn.0047be18
jmp 0x47075a
mov eax, ebx
lea ecx, [ebp - 0x1c]
push ecx
push eax
call fcn.0047e94e
pop ecx
pop ecx
push dword [ebp - 0x50]
lea ecx, [ebp - 0x34]
call fcn.0040513a
cmp dword [ebp - 8], 0x10
push dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0047a0b4
push eax
call fcn.0047b4f6
add esp, 0xc
lea ecx, [ebp - 0x4c]
call fcn.0047a0fe
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00405ac5
lea ecx, [ebp - 0x1c]
call fcn.004073c4
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
cmp dword [edi + 0x70], ebx
je 0x4707cb
lea eax, [ebp - 0x50]
push eax
mov ecx, edi
call fcn.0046fffc
cmp dword [edi + 0x28], ebx
jne 0x4707d7
mov ecx, edi
call fcn.0046fcc0
cmp dword [edi + 0x70], ebx
je 0x4707e3
mov ecx, edi
call fcn.00472119
mov ecx, edi
call fcn.00472062
mov ecx, edi
call fcn.0047218b
push str.PM_Requirement_InstallAfter_End_r_n
push 0x4eee98
call fcn.004738c9
pop ecx
pop ecx
lea ecx, [esi - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
Function at 0x4708db
Capabilities:
Create thread

Disassembly:
push esi
push edi
xor edi, edi
push edi
push edi
mov esi, ecx
push esi
push 0x47090b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi + 0x78], eax
xor eax, eax
inc eax
cmp dword [esi + 0x30], edi
cmove edi, eax
mov eax, edi
pop edi
pop esi
ret

Function at 0x470c4d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push dword [esi + 8]
mov ebx, ecx
push dword [esi + 4]
mov dword [ebp - 8], ebx
push dword [esi]
push str.RunImmediately_bEnableSetDuba123_d_bRestoreLastSession_d_bReportEIcon_d_r_n
push 0x4eee98
call fcn.004738c9
add esp, 0x14
lea ecx, [ebp + 8]
push 0x4eb630
call fcn.004044ee
mov eax, dword [0x4eee50]
xor edi, edi
and dword [ebp - 0x10], edi
and dword [ebp - 0xc], edi
mov dword [ebp - 0x14], edi
cmp dword [eax - 0xc], edi
jne 0x470cc5
cmp dword [esi + 4], edi
je 0x470cd5
push str.__restore_last_session
lea ecx, [ebp - 4]
call fcn.00406b6a
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
call fcn.00457f33
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
jmp 0x470cd2
push 0x4eee50
lea ecx, [ebp - 0x14]
call fcn.004236d6
mov edi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x470d13
cmp dword [ebx + 0xc8], 0
jne 0x470d13
cmp dword [ebx + 0xb4], 0
jne 0x470d13
push str.__set_default_homepage_123duba
lea ecx, [ebp - 4]
call fcn.00406b6a
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0x14]
call fcn.00457f33
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x10]
sub esi, edi
sar esi, 2
xor ebx, ebx
test esi, esi
je 0x470d56
test ebx, ebx
jne 0x470d29
mov eax, dword [edi]
jmp 0x470d45
push 0x4be474
call fcn.0040481a
pop ecx
push eax
push 0x4be474
lea ecx, [ebp + 8]
call fcn.0041e1c3
mov eax, dword [edi + ebx*4]
push dword [eax - 0xc]
lea ecx, [ebp + 8]
push eax
call fcn.0041e1c3
inc ebx
cmp ebx, esi
jb 0x470d21
push 0x4eb630
lea ecx, [ebp - 4]
call fcn.004044ee
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
call fcn.0046bff3
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
push edi
push esi
push str.RunImmediately_ShellExecute__ws_strCmdLine_ws_r_n
mov ebx, 0x4eee98
push ebx
call fcn.004738c9
add esp, 0x10
push 5
push 0
push edi
push esi
push 0x4d3ae8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push eax
push str.ShellExecute_ret0x_x_r_n
push ebx
call fcn.004738c9
add esp, 0xc
lea ecx, [esi - 0x10]
call fcn.00404f8d
lea ecx, [ebp - 0x14]
call fcn.004237e3
lea ecx, [edi - 0x10]
call fcn.00404f8d
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 4
Function at 0x470dcd
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
push dword [esi + 0x114]
mov ecx, dword [esi + 0x118]
call fcn.00474389
mov edi, eax
test edi, edi
js 0x470e87
mov ecx, dword [esi + 0x1c]
sub ecx, 0x10
push ebx
push ecx
call fcn.00406c4d
add eax, 0x10
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
call fcn.00468709
mov ebx, str.install.dat
push ebx
call fcn.0040481a
add esp, 0xc
lea ecx, [ebp - 0x20]
push eax
push ebx
call fcn.0041e1c3
push dword [0x4eee30]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
call ebx
test eax, eax
je 0x470e4a
push dword [0x4eee30]
jmp 0x470e56
push dword [ebp - 0x20]
call ebx
test eax, eax
je 0x470e7b
push dword [ebp - 0x20]
lea ecx, [ebp - 0x1c]
call fcn.0040513a
mov ecx, dword [esi + 0x118]
lea eax, [ebp - 0x1c]
push eax
call fcn.00475c3a
push 0
push 1
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.00405ac5
mov ecx, dword [ebp - 0x20]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
pop ebx
xor eax, eax
test edi, edi
setns al
mov dword [esi + 0x110], eax
test eax, eax
je 0x470ea3
mov ecx, dword [esi + 0x114]
call fcn.0042ef09
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0x110]
pop edi
xor ecx, ebp
pop esi
call fcn.0048f059
leave
ret
Function at 0x470ff7
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push 0x4c2904
mov dword [ebp - 4], ecx
call esi
push str.oleacc.dll
mov edi, eax
call esi
push str.winmm.dll
mov dword [ebp - 8], eax
call esi
push 0x4c294c
mov dword [ebp - 0xc], eax
call esi
push str.netapi32.dll
mov dword [ebp - 0x10], eax
call esi
xor ebx, ebx
xor ecx, ecx
test edi, edi
je 0x471055
cmp dword [ebp - 8], ecx
je 0x471055
cmp dword [ebp - 0xc], ecx
je 0x471055
cmp dword [ebp - 0x10], ecx
je 0x471055
test eax, eax
lea eax, [ecx + 1]
jne 0x471057
mov eax, ebx
push eax
push str.StartInstall_LoadLibrary_:_d
push 0x4eee98
call fcn.004738c9
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 4]
mov eax, dword [edi]
add esp, 0xc
cmp dword [eax - 0xc], ebx
je 0x471085
cmp dword [esi + 0x70], ebx
jne 0x471085
push edi
lea ecx, [esi + 4]
call fcn.00406bd9
cmp dword [edi + 0x18], ebx
je 0x471194
cmp dword [esi + 0x70], ebx
je 0x471194
push dword [esi + 4]
call fcn.004670f6
pop ecx
test eax, eax
jne 0x471194
push str.bIsNewOverOld__false__return_r_n
push 0x4eee98
call fcn.004738c9
push 0xc
call fcn.00449b05
add esp, 0xc
test eax, eax
je 0x4710d0
mov ecx, eax
call fcn.0046a3b2
mov edi, eax
jmp 0x4710d2
mov edi, ebx
push ebx
lea esi, [edi + 4]
push 0x4d5ea8
mov ecx, esi
mov dword [edi], 0x1b
call fcn.0040ddf6
push 0x12
push str.reportver2.0.0.0
mov ecx, esi
call fcn.0041e2ec
push 0xc
push 0x4c29d4
mov ecx, esi
call fcn.0041e2ec
push dword [0x4eee38]
lea ecx, [ebp + 8]
call fcn.004301a0
mov eax, dword [eax]
mov ecx, esi
push dword [eax - 0xc]
push eax
call fcn.0041e2ec
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404f8d
push 0xd
push str.vermoreless
mov ecx, esi
call fcn.0041e2ec
push 1
push 0x4c25a0
mov ecx, esi
call fcn.0041e2ec
push ebx
push ebx
push edi
push 0x4709a1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x47118f
push 0xbb8
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x471180
push str.Report_timeout
push 0x4eee98
call fcn.004738c9
pop ecx
pop ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x471210
push edi
lea ecx, [esi + 0xac]
call fcn.0046a5da
push dword [esi + 0xc4]
mov eax, dword [edi + 0x20]
push dword [esi + 0xc0]
mov dword [esi + 0xd0], eax
push dword [esi + 0xbc]
push dword [esi + 0xb4]
push dword [esi + 0xb0]
push str.bSyn_d_bSlient_d_bSetDefaultBrowser_d_bInstallAfterIsRun_d_bVerCheck_d_r_n
push 0x4eee98
call fcn.004738c9
add esp, 0x1c
cmp dword [edi + 4], ebx
je 0x4711e9
mov ecx, esi
call fcn.00471217
mov ebx, eax
jmp 0x47120e
push ebx
push ebx
push esi
push 0x46cc49
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x34], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x34], ebx
push 1
mov dword [esi + 0x78], eax
pop eax
cmove ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x471ccd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.liebao.exe
mov ebx, ecx
call fcn.00467269
xor edi, edi
pop ecx
mov dword [ebx + 0xa4], eax
mov esi, 0x4eee98
test eax, eax
je 0x471dc0
cmp dword [ebx + 0xb4], edi
jne 0x471dc0
cmp dword [ebx + 0xc8], edi
jne 0x471dc0
push str.TerminationAllProcess_CMessageBox_Begin_r_n
push esi
call fcn.004738c9
pop ecx
pop ecx
mov esi, 0x4d3c88
push esi
lea ecx, [ebp - 0x84]
call fcn.0040513a
push esi
lea ecx, [ebp - 0x9c]
call fcn.0040513a
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x6c], 0x4bd798
call fcn.0042f7fb
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0x6c]
push 1
push 0x4bdca4
push 0x4c2a84
push dword [ebx + 0xb8]
lea ecx, [ebp - 0x6c]
call dword [eax]
lea ecx, [ebp - 0x68]
mov esi, eax
call fcn.0042f889
push edi
push 1
lea ecx, [ebp - 0x9c]
call fcn.00405ac5
push edi
push 1
lea ecx, [ebp - 0x84]
call fcn.00405ac5
cmp esi, 2
jne 0x471dae
cmp dword [ebx + 0x28], edi
je 0x471e0d
push str.TerminationAllProcess_CMessageBox_End_r_n
mov esi, 0x4eee98
push esi
call fcn.004738c9
pop ecx
pop ecx
push str.TerminationAllProcess_Begin_r_n
push esi
call fcn.004738c9
pop ecx
pop ecx
mov ecx, ebx
call fcn.00471f4f
test eax, eax
je 0x471ded
mov ecx, ebx
call fcn.00471ed0
test eax, eax
je 0x471ded
mov ecx, ebx
call fcn.00471e14
xor edi, edi
inc edi
push edi
push str.TerminationAllProcess_End_bRet_d_r_n
push esi
call fcn.004738c9
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret
push edi
call fcn.00495a71
int3

Function at 0x471fd9
Capabilities:
Check if file exists
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x118]
call fcn.004747bd
mov eax, dword [esi + 0x118]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esi + 0x114]
and dword [esi + 0x118], 0
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
and dword [esi + 0x114], 0
cmp dword [esi + 0x30], 0
je 0x47202b
push 0
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x30], 0
cmp dword [esi + 0x28], 0
je 0x47204f
cmp dword [esi + 0x34], 0
je 0x47204f
push 0
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 0x34], 0
lea ecx, [esi + 0x80]
call fcn.00473586
mov ecx, esi
pop esi
jmp fcn.0046a8ea
Function at 0x472062
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push 0x705
mov eax, dword [edi]
call dword [eax + 4]
push str.UpRegVer_Begin_r_n
mov ebx, 0x4eee98
push ebx
call fcn.004738c9
pop ecx
pop ecx
mov ecx, dword [edi + 0x4c]
mov eax, dword [ecx - 0xc]
lea eax, [eax*2 + 2]
push eax
push ecx
push 1
push 0x4d6420
push str.SOFTWAREliebao
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov esi, eax
push esi
push dword [edi + 0x4c]
push str.UpRegVer__ver_ws__hr0x_x_r_n
push ebx
call fcn.004738c9
mov edx, dword [edi]
add esp, 0x10
xor ebx, ebx
test esi, esi
setns bl
push esi
mov ecx, edi
push ebx
push 0x705
call dword [edx + 8]
pop edi
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x472fb2
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x38], eax
xor edi, edi
call fcn.0045a0c4
mov dword [ebp - 0x28], eax
test eax, eax
je 0x473122
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocStringLen
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
jne 0x47302f
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadImageToMem_CreateFile_error:_d__path:_ws
push 0x4eee98
call fcn.004738c9
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov ebx, dword [ebp - 0x20]
add esp, 0x10
jmp 0x473117
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
push eax
push edi
push 2
push edi
push esi
mov dword [ebp - 0x30], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 0x2c], eax
test esi, esi
jne 0x473067
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileByMem_CreateFileMapping_error:_d__path:_ws
push 0x4eee98
call fcn.004738c9
jmp 0x473024
push dword [ebp - 0x30]
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
jne 0x473099
push dword [ebp - 0x34]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileByMem_MapViewOfFile_error:_d__path:_ws
push 0x4eee98
call fcn.004738c9
add esp, 0x10
jmp 0x473117
push 0x4c5480
push 0x4eee98
call fcn.004738c9
pop ecx
pop ecx
push dword [ebp - 0x38]
mov ecx, dword [ebp - 0x28]
push dword [ebp - 0x30]
mov eax, dword [ecx]
push ebx
push ecx
call dword [eax]
mov esi, eax
xor eax, eax
test esi, esi
sete al
push eax
push str.Extract_return:_d
push 0x4eee98
call fcn.004738c9
add esp, 0xc
test esi, esi
je 0x473111
mov ecx, dword [ebp - 0x28]
lea edx, [ebp - 0x1c]
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x10]
mov esi, eax
cmp dword [esi + 0x14], 8
jb 0x4730f0
mov esi, dword [esi]
push esi
call fcn.0040481a
pop ecx
mov ecx, dword [ebp - 0x24]
push eax
push esi
add ecx, 0x1c
call fcn.004047a1
push edi
push 1
lea ecx, [ebp - 0x1c]
call fcn.00405ac5
jmp 0x473114
xor edi, edi
inc edi
mov esi, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x28]
push ecx
mov eax, dword [ecx]
call dword [eax + 0xc]
jmp 0x47312e
mov eax, dword [ebp - 0x24]
mov esi, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
cmp esi, 0xffffffff
je 0x47313a
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x473145
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x2c]
cmp eax, 0xffffffff
je 0x473154
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 8
Function at 0x473220
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
xor ebx, ebx
push 0x4eb630
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
call fcn.004044ee
push esi
push str.GetPacketData__d
push 0x4eee98
call fcn.004738c9
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push esi
mov ecx, edi
call fcn.004733bd
mov esi, eax
push esi
push str.GetPacketData_return:_d
push 0x4eee98
mov dword [ebp - 0x30], esi
call fcn.004738c9
add esp, 0xc
test esi, esi
mov esi, dword [ebp - 0x2c]
je 0x47332f
call fcn.0045a0c4
mov dword [edi + 0x18], eax
test eax, eax
je 0x47332f
push 0x4c5480
push 0x4eee98
call fcn.004738c9
mov eax, dword [edi + 0x18]
pop ecx
pop ecx
push dword [ebp - 0x34]
mov ecx, dword [eax]
push dword [ebp - 0x24]
push dword [ebp - 0x30]
push eax
call dword [ecx]
xor ecx, ecx
mov edi, eax
test edi, edi
sete cl
push ecx
push str.Extract_return:_d
push 0x4eee98
call fcn.004738c9
add esp, 0xc
test edi, edi
je 0x473325
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
mov eax, dword [eax + 0x18]
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x10]
mov edi, eax
cmp dword [edi + 0x14], 8
jb 0x473304
mov edi, dword [edi]
push edi
call fcn.0040481a
pop ecx
mov ecx, dword [ebp - 0x20]
push eax
push edi
lea ecx, [ecx + 0x1c]
call fcn.004047a1
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00405ac5
jmp 0x47334e
mov edi, dword [ebp - 0x20]
mov dword [ebp - 0x28], 1
cmp dword [esi - 0xc], ebx
je 0x47333b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x47334b
mov eax, dword [ecx]
push ecx
call dword [eax + 0xc]
mov dword [edi + 0x18], ebx
mov ebx, dword [ebp - 0x28]
lea ecx, [esi - 0x10]
call fcn.00404f8d
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 8
Function at 0x473470
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push esi
push eax
mov ebx, ecx
call fcn.004921d0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push 0x80
push 3
push esi
push 1
push SysReAllocStringLen
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x473501
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadImageToMem_CreateFile_error:_d__path:_ws
push 0x4eee98
call fcn.004738c9
add esp, 0x10
jmp 0x473575
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
push eax
push esi
push 2
push esi
push edi
mov dword [ebx + 8], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebx], eax
test edi, edi
jne 0x473534
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileByMem_CreateFileMapping_error:_d__path:_ws
jmp 0x47355c
push dword [ebx + 8]
push esi
push esi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebx + 4], eax
test eax, eax
jne 0x47356b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.CreateFileByMem_MapViewOfFile_error:_d__path:_ws
push 0x4eee98
call fcn.004738c9
add esp, 0x10
jmp 0x47356e
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret

Function at 0x473744
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
xor esi, esi
push esi
push 0x80
push 3
push esi
push 3
push SysReAllocStringLen
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47376f
xor eax, eax
jmp 0x47378a
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
push edi
cmove esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebp
ret 4
Function at 0x473790
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xec
mov eax, dword [0x4eb664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov ebx, ecx
xor ecx, ecx
mov byte [ebp - 0xec], cl
mov esi, dword [ebp + 8]
lea edi, [ebp - 0xeb]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
push 0xc6
mov word [ebp - 0xcc], ax
push ecx
lea eax, [ebp - 0xca]
push eax
mov dword [ebp - 0xd8], ecx
mov dword [ebp - 0xd4], ecx
mov dword [ebp - 0xd0], ecx
call fcn.004921d0
push esi
call fcn.0040481a
add esp, 0x10
lea ecx, [ebx + 0x14]
push eax
push esi
call fcn.004047a1
mov ecx, ebx
call fcn.004736d7
xor edi, edi
inc edi
push edi
lea eax, [ebp - 0xec]
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
push edi
lea eax, [ebp - 0xec]
push eax
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea eax, [ebp - 0xec]
mov dword [ebp - 0xd4], eax
lea eax, [ebx + 0x18]
push eax
mov dword [ebp - 0xd8], 0xc
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0xcc]
push str.GlobalBFD88F2D_0990_4de4_AD0F_764F5894389A__d
push eax
call fcn.0049333f
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
add esp, 0xc
lea eax, [ebp - 0xcc]
push eax
push edi
push edi
lea eax, [ebp - 0xd8]
push eax
call esi
push 0
push 0
push edi
xor edi, edi
push edi
mov dword [ebx + 8], eax
call esi
mov dword [ebx + 0xc], eax
cmp dword [ebx + 8], edi
je 0x4738b6
test eax, eax
je 0x4738b6
push edi
push edi
push ebx
push 0x473a25
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
test eax, eax
setne cl
mov dword [ebx + 0x10], eax
mov eax, ecx
jmp 0x4738b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f059
leave
ret 4

Function at 0x473a34
Capabilities:
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
pop ebp
ret 8

Function at 0x473c00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 4], 0
je 0x473c30
push dword [esi + 4]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.00495c3e
push dword [esi + 4]
push 2
push 1
push 0x4c55c8
call fcn.00495c3e
add esp, 0x20
pop esi
pop ebp
ret 8