joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e5d4
Capabilities:
Terminate process

Disassembly:
test byte [ebx + 4], 4
jne 0x46e5df
jmp fcn.0046e4aa
mov dword ds:[ebp - 0x68], esi
mov dword ds:[ebp - 0x64], edi
pop dword ds:[ebp - 0x6c]
pop eax
pop ax
xor ah, ah
pop cx
cmp cl, byte [ebx + 6]
call fcn.0046e6fb
pop edx
cmp edx, dword [ebx + 0x14]
call fcn.0046e6fb
movzx ecx, ch
mov esi, ecx
shl esi, 1
add esi, ecx
shl esi, 2
lea edi, [ebx + esi + 0x10]
pop dword ds:[ebp - 0x60]
push dword [edi]
pop edx
cmp edx, dword [ebx + esi + 0x10]
call fcn.0046e6fb
pop edx
cmp edx, dword [ebx + esi + 0xc]
call fcn.0046e6fb
sub esi, 0xc
jne 0x46e619
or ah, ah
jne 0x46e6e8
cmp cl, byte [ebx + 7]
jne 0x46e6e8
mov edx, dword ds:[ebp - 0x60]
cmp edx, dword [edi - 4]
jl 0x46e6e8
mov byte [ebx + 4], al
mov ecx, dword [edi]
sub ecx, edx
jle 0x46e67e
cmp byte [ebx + 7], 1
je 0x46e663
imul ecx, dword [edi - 8]
push edi
mov al, byte [ebx + 6]
mov esi, ecx
mov edi, dword [ebx]
push dword [ebx + 8]
sub dword [esp], ecx
pop ecx
imul ecx, dword [ebx + 0x14]
add edi, ecx
call fcn.0046e7ec
pop edi
push dword [ebx + 8]
push dword [ebx + 0xc]
movzx ecx, byte [ebx + 7]
xor esi, esi
mov dword [edi], edx
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
dec ecx
je 0x46e6b1
add esi, 0xc
mov dword [ebx + esi + 0x14], eax
mov eax, dword [ebx + esi + 0x1c]
sub eax, dword [ebx + esi + 0x18]
inc eax
mul dword [ebx + esi + 0x14]
dec ecx
ja 0x46e698
jb 0x46e6de
mov dword [ebx + 8], eax
mul dword [ebx + 0x14]
jb 0x46e6de
mov ecx, eax
xchg dword [ebx + 0xc], eax
mov edx, eax
mov eax, dword [ebx]
call fcn.0046e700
jb 0x46e6e0
add esp, 8
mov dword [ebx], eax
or byte [ebx + 4], 4
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
notrack jmp dword ds:[ebp - 0x6c]
mov al, 9
pop dword [ebx + 0xc]
pop dword [ebx + 8]
mov dx, 0x9b0
mov al, 9
mov esi, dword ds:[ebp - 0x68]
mov edi, dword ds:[ebp - 0x64]
push dword ds:[ebp - 0x6c]
jmp fcn.0046dc8c

Function at 0x46e774
Capabilities:
Terminate process

Disassembly:
call fcn.0046e781
jb 0x46e77c
ret
jmp fcn.0046dc8c

Function at 0x46e9ae
Capabilities:
Terminate process

Disassembly:
call 0x46e9b4
and bl, byte [esi - 0x46]
mov edx, 1

Function at 0x46e9b4
Capabilities:
Terminate process

Disassembly:
call 0x46e9b4
and bl, byte [esi - 0x46]
mov edx, 1

Function at 0x46e9b5
Capabilities:
Terminate process

Disassembly:
call 0x46e9b4
and bl, byte [esi - 0x46]
mov edx, 1

Function at 0x46e9ba
Capabilities:
Terminate process

Disassembly:
call fcn.0047851e
jae 0x46e9cf
pop eax
jmp 0x46e9d3
ret
pop edi
pop esi
jmp fcn.0046dc8c

Function at 0x46e9c4
Capabilities:
Terminate process

Disassembly:
mov ax, word [ebp - 0x46]
call fcn.00473d2d
jb 0x46e9d0
pop eax
mov al, 0x34
Function at 0x46ee9e
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov ax, word [ebp - 0x46]
call fcn.00473cef
jb 0x46eeb5
call fcn.00478578
jb 0x46eeb5
pop edi
pop esi
ret
pop edi
pop esi
jmp fcn.0046dc8c

Function at 0x46ef4f
Capabilities:
Terminate process

Disassembly:
push 0
call dword [sym.imp.OLE32.DLL_CoInitialize]
call fcn.0046dd54
jb 0x46ef5f
ret
jmp fcn.0046dc8c

Function at 0x46ef64
Capabilities:
Terminate process

Disassembly:
call dword [sym.imp.OLE32.DLL_CoUninitialize]
call fcn.0046dd8d
jb 0x46ef5f
ret

Function at 0x46efbe
Capabilities:
Terminate process

Disassembly:
push eax
push ebx
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00473c77
or ecx, ecx
je 0x46f094
mov ebx, esi
mov edx, 3
mov al, byte [ebx]
cmp al, 0x22
jne 0x46eff5
inc ebx
dec ecx
je 0x46f012
cmp byte [ebx], 0x22
jne 0x46efe7
inc ebx
loop 0x46efe1
jmp 0x46f012
cmp al, 0x5c
jne 0x46f002
inc ebx
dec ecx
je 0x46f012
inc ebx
loop 0x46efe1
jmp 0x46f012
cmp al, 0x3b
je 0x46f00b
inc ebx
loop 0x46efe1
jmp 0x46f012
push ebx
dec edx
je 0x46f016
inc ebx
loop 0x46efe1
push ebx
dec edx
jne 0x46f012
pop edx
pop ecx
pop ebx
ftst
wait
fnstsw ax
sahf
jb 0x46f036
jne 0x46f032
cmp ecx, edx
je 0x46f032
inc ecx
cmp ecx, edx
je 0x46f032
mov eax, edx
mov esi, ecx
jmp 0x46f045
mov eax, ebx
jmp 0x46f045
cmp ebx, ecx
je 0x46f032
inc ebx
cmp ebx, edx
je 0x46f032
mov eax, ecx
mov esi, ebx
fchs
cmp eax, esi
jbe 0x46f094
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x46f04e
push esp
push esi
push esi
push eax
mov ecx, eax
sub ecx, esi
call fcn.0046f0bc
call fcn.00478ddd
pop ecx
mov esi, esp
push ecx
call fcn.004788e0
jb 0x46f082
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
mov edx, eax
add esp, 0x10000
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0046dc81
mov ecx, 0x10
sub esp, 0x1000
mov dword [esp], eax
loop 0x46f099
mov esi, esp
call fcn.00478ac9
call fcn.00478ddd
dec edx
cmp byte [esi], 0x20
jne 0x46f0b8
dec edx
inc esi
mov ecx, edx
jmp 0x46f06f

Function at 0x46fe17
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
push ebp
add ebp, dword [ebp - 0x88]
mov esi, dword [ebp - 0x6c]
call fcn.00473c77
jecxz 0x46fe59
call fcn.00473c1b
jb 0x46fea5
cld
test eax, eax
je 0x46fe44
lodsb al, byte [esi]
call fcn.0046ff70
stosb byte es:[edi], al
loop 0x46fe37
mov esi, edx
jmp 0x46fe51
push edi
push ecx
push edi
cld
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.USER32.DLL_CharLowerBuffA]
pop esi
xchg dword [ebp - 0x6c], esi
call fcn.00473c4f
pop ebp
pop edi
pop esi
pop ecx
ret
mov edx, eax
pop ebp
pop edi
pop esi
pop ecx
jmp fcn.0046dc81
Function at 0x4700ad
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edx, ecx
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00473c77
test eax, eax
jns 0x4700c6
add eax, ecx
test edx, edx
je 0x470106
jns 0x4700d1
add edx, ecx
js 0x470106
inc edx
dec edx
add esi, edx
sub ecx, edx
jae 0x4700da
xor ecx, ecx
cmp ecx, eax
jb 0x4700e0
mov ecx, eax
call fcn.00473c1b
jb 0x47010a
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00474661
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
ret
xor edx, edx
jmp 0x4700f4
pop edi
pop esi
jmp fcn.0046dc8c

Function at 0x470111
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00473c77
test eax, eax
jns 0x470129
add eax, ecx
cmp eax, ecx
jae 0x470155
xchg ecx, eax
call fcn.00473c1b
jb 0x470159
sub eax, ecx
add esi, eax
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00474661
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
ret
pop edi
pop esi
pop ecx
jmp fcn.0046dc8c

Function at 0x47017b
Capabilities:
Terminate process

Disassembly:
call fcn.00470205
push 0
push edx
mov edx, dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
call fcn.00478df6
jb 0x470197
add esp, 0x114
ret
add esp, 0x114
jmp fcn.0046dc81

Function at 0x470205
Capabilities:
Terminate process

Disassembly:
pop ecx
sub esp, 0x114
mov edx, esp
call fcn.00470062
test ah, ah
jne 0x470219
jmp ecx
add esp, 0x114
mov edx, 0x4c
jmp fcn.0046dc81

Function at 0x473932
Capabilities:
Terminate process

Disassembly:
push edi
xchg ecx, ebx
call fcn.00473c1b
jb 0x473952
call fcn.00478899
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
ret
call fcn.00478897
pop edi
jmp fcn.0046dc8c

Function at 0x47395d
Capabilities:
Terminate process

Disassembly:
push eax
push esi
push edi
xchg ecx, ebx
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x6c]
call fcn.00473c8a
mov al, 0
je 0x473977
mov al, byte [edi]
call fcn.00474661
call fcn.00473c1b
jb 0x47399a
mov dword [ebp + esi - 0x6c], edx
cld
mov ah, al
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
xchg ecx, ebx
pop edi
pop esi
pop eax
ret
mov dword [ebp + esi - 0x6c], 0
mov edx, eax
pop edi
pop esi
pop eax
jmp fcn.0046dc81

Function at 0x4746c3
Capabilities:
Terminate process

Disassembly:
call fcn.0047898b
jb 0x4746cb
ret
jmp fcn.0046dc8c
Function at 0x475b5c
Capabilities:
Terminate process

Disassembly:
sub esp, 0x330
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push ebx
push ebp
push esi
push edi
mov ebp, esp
call fcn.00475c7e
call fcn.00475ecb
test ebx, ebx
je 0x475c5c
lea eax, [ebp + 0x6c]
push eax
push 0x800
mov eax, dword [ebp + 0x64]
inc eax
push eax
lea eax, [ebp + 0x300]
push eax
lea eax, [ebp + 0x20]
push eax
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x14]
call fcn.00475fa7
js 0x475c5c
mov eax, 0xfffffffd
xchg dword [ebp + 0x6c], eax
mov dword [ebp + 0x68], eax
cmp dword [ebp + 0x390], 2
jbe 0x475c06
sub dword [ebp + 0x5c], 4
inc dword [ebp + 0x60]
inc dword [ebp + 0x64]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
push 0
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x68]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
dec dword [ebp + 0x64]
dec dword [ebp + 0x60]
jmp 0x475c39
mov ecx, dword [ebp + 0x388]
jecxz 0x475c11
lea ecx, [ebp + 0x10]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp + 0x30]
push eax
push ecx
lea eax, [ebp + 0x58]
push eax
push dword [ebp + 0x390]
push 0x800
lea eax, [ebp + 0x20]
push eax
push dword [ebp + 0x68]
mov ebx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebx]
call dword [ebx + 0x18]
call fcn.00475fa7
js 0x475c5c
call fcn.00475d97
call fcn.00475ee3
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
jmp edx
call fcn.00475d97
call fcn.00475ee3
mov al, 0x63
mov ecx, dword [ebp + 0x54]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x374
pop edx
add esp, ecx
push edx
jmp fcn.0046dc8c

Function at 0x476332
Capabilities:
Terminate process

Disassembly:
push esi
push edi
push ecx
mov esi, edx
mov ecx, dword [esi - 4]
shl ecx, 1
je 0x47634f
call fcn.00473c1b
jb 0x476353
cld
xor eax, eax
shr ecx, 1
lodsb al, byte [esi]
stosw word es:[edi], ax
loop 0x47634a
pop ecx
pop edi
pop esi
ret
pop ecx
pop edi
pop esi
jmp fcn.0046dc8c

Function at 0x476484
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00473c77
je 0x4764cb
mov al, 0x20
cmp byte [esi], al
je 0x4764a5
jmp 0x4764cb
cmp byte [esi], al
jne 0x4764a8
inc esi
loop 0x4764a1
call fcn.00473c1b
jb 0x4764d0
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00474661
mov esi, dword [ebp - 0x88]
mov dword [ebp + esi - 0x6c], edx
pop edi
pop esi
pop ecx
pop eax
ret
mov edx, eax
pop edi
pop esi
pop ecx
pop eax
jmp fcn.0046dc81

Function at 0x4764db
Capabilities:
Terminate process

Disassembly:
push eax
push ecx
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00473c77
je 0x4764cb
lea edi, [esi - 1]
add edi, ecx
mov al, 0x20
cmp byte [edi], al
je 0x476501
jmp 0x4764cb
cmp byte [edi], al
jne 0x4764a8
dec edi
loop 0x4764fd
jmp 0x4764a8
Function at 0x476506
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.004765e8
jb 0x476560
cmp ecx, edx
ja 0x476560
mov eax, esi
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x476528
mov eax, esi
sub edx, ebx
jl 0x476528
mov ecx, ebx
mov edi, ebp
jmp 0x476518
or edx, edx
jns 0x47652e
xor edx, edx
mov esi, eax
mov ecx, edx
pop ebp
call fcn.00473c1b
jb 0x476568
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00478ddd
call fcn.00474661
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
pop eax
ret
pop ebp
call fcn.00478ddd
jmp 0x47655a
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
pop eax
jmp fcn.0046dc81

Function at 0x476574
Capabilities:
Terminate process

Disassembly:
push eax
call fcn.004765e8
jb 0x476560
cmp ecx, edx
ja 0x476560
mov eax, esi
add esi, edx
sub esi, ecx
mov ebx, ecx
mov ebp, edi
repe cmpsb byte [esi], byte es:[edi]
jne 0x476528
sub esi, ebx
sub esi, ebx
sub edx, ebx
jl 0x476528
mov ecx, ebx
mov edi, ebp
jmp 0x47658a
Function at 0x476612
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.00473c8a
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x5c], edx
push dword [ebp + esi - 0x6c]
mov esi, dword [ebp + esi - 0x64]
call fcn.00473c77
pop edi
call fcn.00473c8a
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x64], edx
jecxz 0x476646
jne 0x476699
mov esi, dword [ebp - 0x6c]
mov ecx, dword [ebp - 0x64]
call fcn.00473c1b
jb 0x47667e
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00478ddd
call fcn.00478ddd
call fcn.00474661
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
ret
mov al, 5
pop edi
pop esi
call fcn.00478ddd
call fcn.00478ddd
call fcn.00478ddd
call fcn.00478897
jmp fcn.0046dc8c
mov ebx, edi
mov dword [ebp - 0x54], ecx
sub edx, ecx
jb 0x476646
add ebx, edx
inc ebx
mov edx, esi
mov dword [ebp - 0x58], 0
cld
call fcn.00476755
jb 0x4766c2
inc dword [ebp - 0x58]
add edi, dword [ebp - 0x54]
mov esi, edx
cmp edi, ebx
jb 0x4766af
mov ecx, dword [ebp - 0x58]
test ecx, ecx
je 0x476646
mov esi, edx
mov eax, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x54]
imul ecx
jno 0x4766db
jmp 0x47667c
mov ecx, dword [ebp - 0x64]
add ecx, eax
js 0x4766d9
mov eax, dword [ebp - 0x6c]
add dword [ebp - 0x64], eax
call fcn.00473c1b
jb 0x47667e
mov dword [ebp - 0x68], edi
push edx
mov edi, dword [ebp - 0x6c]
mov edx, esi
call fcn.00476755
jb 0x476738
mov esi, dword [ebp - 0x6c]
mov ecx, edi
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push esi
mov esi, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov dword [ebp - 0x68], edi
mov edi, dword [ebp - 0x54]
add edi, esi
mov dword [ebp - 0x6c], edi
mov esi, edx
jmp 0x4766f8
mov ecx, dword [ebp - 0x64]
mov esi, dword [ebp - 0x6c]
sub ecx, esi
mov edi, dword [ebp - 0x68]
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edx
jmp 0x476660

Function at 0x4767fd
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
xor edx, edx
call fcn.0047685a
pop ecx
jb 0x476855
ret
jmp fcn.0046dc81

Function at 0x47681c
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 7
mov edx, 0x80000000
call fcn.0047685a
pop ecx
jb 0x476855
ret

Function at 0x476830
Capabilities:
Terminate process

Disassembly:
push ecx
mov ecx, 0xf
mov edx, 0x80000000
call fcn.0047685a
pop ecx
jb 0x476855
ret
Function at 0x4768b7
Capabilities:
Terminate process

Disassembly:
push esi
push edi
sub esp, 0x254
lea edx, [esp + 0x140]
call fcn.00477c78
or eax, eax
je 0x476964
mov esi, edx
mov ebx, edx
add esi, eax
mov al, byte [esi - 1]
cmp al, 0x3a
je 0x4768e4
cmp al, 0x5c
jne 0x4768f2
mov word [esi], 0x2e2a
mov word [esi + 2], 0x2a
add esi, 4
lea eax, [esp]
push eax
push ebx
mov edx, dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
call fcn.00478df6
jb 0x47697d
mov dword [ebp - 0x6c], eax
mov edi, esi
cmp ebx, edi
je 0x47691b
mov al, byte [edi - 1]
cmp al, 0x3a
je 0x47691b
cmp al, 0x5c
je 0x47691b
dec edi
jmp 0x476909
test dword [esp], 0x1e
jne 0x47693d
lea esi, [esp + 0x2c]
push edi
call fcn.0046dc01
pop edi
push ebx
mov edx, dword [sym.imp.KERNEL32.DLL_DeleteFileA]
call fcn.00478df6
jb 0x47696d
lea eax, [esp]
push eax
push dword [ebp - 0x6c]
mov edx, dword [sym.imp.KERNEL32.DLL_FindNextFileA]
call fcn.00478df6
jae 0x47691b
cmp dl, 0x35
jne 0x47696d
push dword [ebp - 0x6c]
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.00478df6
add esp, 0x254
pop edi
pop esi
ret
push edx
push dword [ebp - 0x6c]
mov edx, dword [sym.imp.KERNEL32.DLL_FindClose]
call fcn.00478df6
pop edx
add esp, 0x254
mov al, dl
pop edi
pop esi
jmp fcn.0046dc8c

Function at 0x476e7a
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov ebx, eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.00473c8a
mov esi, dword [ebp + esi - 0x6c]
call fcn.00473c77
jecxz 0x476eb5
test ebx, ebx
jns 0x476eae
push edx
push edi
push ebx
call fcn.00476ab2
pop ebx
add ebx, eax
add ebx, 2
pop edi
pop edx
call fcn.00476fb2
jmp 0x476f0b
test ebx, ebx
jns 0x476ec9
push ecx
push edi
push ebx
call fcn.00476e50
pop eax
add ebx, eax
add ebx, 2
pop edi
pop ecx
call fcn.00476f52
jmp 0x476f0b
call fcn.00473c1b
jb 0x476f42
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.00478ddd
call fcn.00474661
mov edi, dword [ebp - 0x88]
mov dword [ebp + edi - 0x6c], edx
pop edi
pop esi
pop ecx
pop ebx
ret
call fcn.00478ddd
mov edx, eax
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0046dc81
Function at 0x4772c5
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov eax, dword [ebx]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebx + 8]
mov dword [ebp - 0x68], eax
mov esi, dword [ebp - 0x88]
mov edi, dword [ebp + esi - 0x68]
call fcn.00473c8a
mov esi, dword [ebp + esi - 0x6c]
call fcn.00473c77
jecxz 0x47730f
push ebx
push ecx
push esi
push edi
call fcn.00476adb
pop eax
pop esi
pop ecx
pop ebx
add edi, ecx
sub edx, ecx
jae 0x477301
xor edx, edx
push edx
push edi
push ecx
push esi
sub edi, ecx
mov ecx, edi
sub ecx, eax
mov esi, eax
jmp 0x477319
call fcn.00476d99
push edx
push edi
push 0
push esi
mov edx, dword [ebx + 0x14]
mov edi, dword [ebp - 0x6c]
add dword [ebp - 0x6c], edx
mov al, byte [ebx + 6]
cmp al, 0x2c
je 0x477347
cmp al, 0x2e
je 0x47736f
ja 0x477378
dec edx
cmp ecx, edx
jb 0x477336
mov ecx, edx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov byte [edi], cl
jmp 0x47737f
cmp ecx, edx
jb 0x47734d
mov ecx, edx
sub edx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, edx
mov eax, 0x20202020
shr ecx, 1
rep stosw word es:[edi], ax
adc cl, 0
rep stosb byte es:[edi], al
jmp 0x47737f
call fcn.00477223
jae 0x47737f
jmp 0x477399
call fcn.00477243
jb 0x477399
pop esi
pop ecx
pop edi
pop edx
dec dword [ebp - 0x68]
jne 0x4772ea
call fcn.00478ddd
call fcn.00478ddd
pop edi
pop esi
ret
pop esi
pop ecx
pop edi
pop edx
call fcn.00478ddd
call fcn.00478ddd
pop edi
pop esi
jmp fcn.0046dc8c

Function at 0x4779f9
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
test esi, 1
je 0x477a19
and esi, 0xfffffffe
jne 0x477a23
xchg dword [ebx], esi
call fcn.00473c4f
pop edi
pop esi
ret
call fcn.00473c77
mov edi, dword [ebx]
or edi, edi
je 0x477a33
cmp ecx, dword [edi - 4]
je 0x477a53
call fcn.00473c1b
jb 0x477a63
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
xchg dword [ebx], edx
mov esi, edx
call fcn.00473c4f
pop edi
pop esi
ret
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
ret
xchg dword [ebx], edx
mov esi, edx
call fcn.00473c4f
pop edi
pop esi
jmp fcn.0046dc8c

Function at 0x477a73
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x477a90
mov dword [ebx], eax
ret
push esi
push edi
mov esi, eax
call fcn.00473c77
call fcn.00473c1b
jb 0x477ab2
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov dword [ebx], edx
pop edi
pop esi
ret
mov dword [ebx], edx
pop edi
pop esi
jmp fcn.0046dc8c
Function at 0x477abb
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [ebp - 0x88]
mov eax, dword [ebp + esi - 0x6c]
add dword [ebp - 0x88], 4
pop esi
test eax, 1
jne 0x477adb
mov dword [ebx], eax
pop edx
push eax
push edx
ret
push esi
push edi
mov esi, eax
call fcn.00473c77
call fcn.00473c1b
jb 0x477b00
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
mov dword [ebx], edx
pop eax
push edx
push eax
ret
pop edi
pop esi
mov dword [ebx], edx
pop ebx
push edx
push ebx
jmp fcn.0046dc8c

Function at 0x477cbd
Capabilities:
Terminate process

Disassembly:
push ebx
push ecx
push esi
push edi
mov edi, dword [ebp - 0x88]
mov esi, dword [ebp + edi - 0x6c]
call fcn.00473c77
mov ebx, ecx
push esi
mov esi, dword [ebp + edi - 0x68]
call fcn.00473c77
jecxz 0x477d33
test ebx, ebx
je 0x477d3b
add ebx, ecx
xchg ecx, ebx
call fcn.00473c1b
jb 0x477d48
xchg ecx, ebx
sub ebx, ecx
cld
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov ecx, ebx
push ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
pop ecx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp - 0x88]
mov esi, edx
xchg dword [ebp + edi - 0x68], esi
call fcn.00473c4f
mov esi, dword [ebp + edi - 0x6c]
call fcn.00473c4f
add dword [ebp - 0x88], 4
pop edi
pop esi
pop ecx
pop ebx
ret
mov esi, dword [ebp + edi - 0x6c]
mov dword [ebp + edi - 0x68], esi
add dword [ebp - 0x88], 4
pop esi
pop edi
pop esi
pop ecx
pop ebx
ret
pop esi
pop edi
pop esi
pop ecx
pop ebx
jmp fcn.0046dc8c

Function at 0x477e55
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push esi
push edi
push eax
mov esi, dword [ebp - 0x88]
mov esi, dword [ebp + esi - 0x6c]
call fcn.00473c77
push 0
call dword [sym.imp.USER32.DLL_OpenClipboard]
test eax, eax
je 0x477ed2
mov eax, dword [esi - 4]
inc eax
push eax
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x477ecc
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
mov edi, eax
test edi, edi
je 0x477ec5
cld
mov ecx, dword [esi - 4]
rep movsb byte es:[edi], byte [esi]
xor al, al
stosb byte es:[edi], al
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
pop eax
push eax
push ebx
push eax
call dword [sym.imp.USER32.DLL_SetClipboardData]
test eax, eax
je 0x477ec5
call dword [sym.imp.USER32.DLL_CloseClipboard]
call fcn.00478ddd
pop edi
pop edi
pop esi
mov eax, 0xffffffff
ret
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
call dword [sym.imp.USER32.DLL_CloseClipboard]
call fcn.00478ddd
pop edi
pop edi
pop esi
xor eax, eax
ret
Function at 0x4786f6
Capabilities:
Terminate process

Disassembly:
push eax
push edx
push esi
mov ebx, dword [ebp - 0x84]
sub ebx, 0xa
mov esi, dword [ebx]
sub ebx, 4
shr esi, 1
jb 0x478723
je 0x47871f
shr esi, 1
jae 0x478744
shl esi, 2
mov esi, dword [ebp + esi]
call fcn.00473c4f
jmp 0x478702
pop esi
pop edx
pop eax
ret
shr esi, 1
jb 0x478755
push ebx
shl esi, 2
lea ebx, [ebp + esi]
mov eax, 1
call fcn.0046e781
pop ebx
jae 0x478702
pop esi
pop edx
pop eax
jmp fcn.0046dc8c
shl esi, 2
mov ecx, dword [ebp + esi]
jecxz 0x478702
push ecx
mov ecx, dword [ecx]
call dword [ecx + 8]
jmp 0x478702
lea ecx, [ebp + esi*4]
push ecx
call dword [sym.imp.OLEAUT32.DLL_VariantClear]
jmp 0x478702