joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429b70
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x484966
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.00401690
xor ebx, ebx
lea ecx, [esi + 0x32a0]
mov dword [esp + 0x18], ebx
mov dword [esi], 0x490454
call fcn.00402860
lea ecx, [esi + 0x34bc]
mov byte [esp + 0x18], 1
call fcn.00402860
xorps xmm0, xmm0
movss xmm1, dword [0x4904a0]
movss dword [esi + 0xe8], xmm1
movss dword [esi + 0xec], xmm0
movss dword [esi + 0xf0], xmm0
movss dword [esi + 0xf4], xmm0
movss dword [esi + 0xf8], xmm0
movss dword [esi + 0xfc], xmm0
movss dword [esi + 0x100], xmm0
mov dword [esi + 0x130], ebx
mov dword [esi + 0x10c], ebx
mov dword [esi + 0x12c], ebx
movss dword [esi + 0x1bf8], xmm0
movss dword [esi + 0x1bfc], xmm0
mov dword [esi + 0x1c00], ebx
mov dword [esi + 0x1c04], ebx
movss xmm1, dword [0x488190]
mov eax, 1
mov dword [esi + 0x104], eax
mov dword [0x1b2eac4], ebx
movss dword [esi + 0x11c], xmm1
mov dword [esi + 0x30], eax
movss xmm1, dword [0x4876ac]
or eax, 0xffffffff
mov byte [esi + 0x118], bl
mov dword [esi + 0x3298], ebx
mov dword [esi + 0x110], ebx
mov dword [esi + 0x1c], ebx
movss dword [esi + 0x120], xmm1
movss dword [esi + 0x124], xmm0
movss dword [esi + 0x128], xmm0
mov dword [esi + 0x38], 4
mov dword [esi + 0x34], ebx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov dword [esi + 0xd8], eax
xor eax, eax
lea edi, [esi + 0x134]
mov ecx, 0x492
rep stosd dword es:[edi], eax
lea edi, [esi + 0x1cd8]
mov ecx, 0x16
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esi + 0x3230]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
lea edi, [esi + 0x3248]
mov ecx, 0x12
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x10]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x439f03
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 0x7c]
push edi
xor edi, edi
test eax, eax
jle 0x43a0d3
push ebx
xor ebx, ebx
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*8]
add edx, edx
cvtsi2ss xmm0, ebx
subss xmm0, dword [esi + 0xc4]
cvtsi2ss xmm1, edx
comiss xmm0, xmm1
jbe 0x439f46
lea ecx, [eax + eax*2]
lea edx, [eax + ecx*8]
add edx, edx
add edx, edx
cvtsi2ss xmm1, edx
subss xmm0, xmm1
lea ecx, [eax*4]
sub ecx, eax
neg ecx
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, eax
add ecx, ecx
cvtsi2ss xmm1, ecx
comiss xmm1, xmm0
jbe 0x439f79
lea edx, [eax + eax*2]
lea eax, [eax + edx*8]
add eax, eax
add eax, eax
cvtsi2ss xmm1, eax
addss xmm1, xmm0
movaps xmm0, xmm1
mulss xmm0, dword [0x487f68]
movss xmm1, dword [0x48dc00]
comiss xmm1, xmm0
movss dword [esp + 0x10], xmm0
jbe 0x43a0c1
comiss xmm0, dword [0x4939ec]
jbe 0x43a0c1
movss xmm1, dword [0x48dbfc]
comiss xmm1, xmm0
jbe 0x439fcd
comiss xmm0, dword [0x48fd5c]
jbe 0x439fcd
cvttss2si eax, xmm0
cdq
xor eax, edx
sub eax, edx
mov edx, 0xff
sub edx, eax
jmp 0x439fd2
mov edx, 0x9b
comiss xmm0, dword [0x4904c8]
jae 0x43a032
movss xmm1, dword [0x491cac]
comiss xmm1, xmm0
jae 0x43a032
comiss xmm0, dword [0x488798]
movaps xmm1, xmm0
mulss xmm1, dword [0x487f74]
jb 0x43a018
addss xmm1, dword [0x487644]
movss xmm2, dword [0x491ab4]
divss xmm2, xmm1
movss dword [esp + 0xc], xmm2
jmp 0x43a040
movss xmm2, dword [0x487644]
subss xmm2, xmm1
movss xmm1, dword [0x491ab4]
divss xmm1, xmm2
jmp 0x43a03a
movss xmm1, dword [0x491ca8]
movss dword [esp + 0xc], xmm1
cvttss2si ecx, xmm0
lea eax, [ecx + 0x34c]
test eax, eax
jge 0x43a055
mov eax, 0xfffffcb4
sub eax, ecx
movss xmm0, dword [0x48dc0c]
mov ecx, dword [esp + 0xc]
movss xmm2, dword [0x491ca4]
push edx
mov edx, dword [esp + 0x14]
and eax, 0x3ff
movss xmm1, dword [eax*4 + 0x4a6228]
push ecx
mulss xmm1, xmm0
subss xmm2, xmm1
subss xmm2, xmm0
addss xmm2, dword [0x4876ac]
subss xmm2, dword [0x491ca0]
addss xmm2, dword [0x491abc]
push ecx
movss dword [esp], xmm2
push edx
mov ecx, esi
call fcn.00434d70
fsub dword [0x491ab8]
push ecx
mov ecx, esi
fstp dword [esp]
push edi
call fcn.00431ae0
mov eax, dword [esi + 0x7c]
add edi, 1
add ebx, 0x64
cmp edi, eax
jl 0x439f17
pop ebx
mov ecx, esi
call fcn.00438d30
lea ecx, [esi + 0xbccc8]
call fcn.00403940
mov eax, dword [esi + 0x84]
lea ecx, [eax*8]
sub ecx, eax
shl ecx, 4
sub ecx, eax
add ecx, ecx
sub ecx, eax
mov edx, dword [esi + ecx*4 + 0x49c]
mov eax, dword [esi + edx*4 + 0xbff74]
push eax
push 0
lea edi, [esi + 0xbe8d8]
push 1
mov ecx, edi
call fcn.00402910
mov ecx, edi
call fcn.00402970
test eax, eax
mov ecx, edi
je 0x43a13d
push 0x78
call fcn.00402d60
mov ecx, edi
pop edi
pop esi
add esp, 8
jmp fcn.00403940
pop edi
pop esi
add esp, 8
jmp fcn.00403940
Function at 0x45cbb0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x485bea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x4afca0]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x114], eax
mov dword [esp + 0xc], esi
call fcn.00401690
xor ebx, ebx
lea ecx, [esi + 0x1c0]
mov dword [esp + 0x120], ebx
mov dword [esi], 0x499df0
call fcn.0040b180
push fcn.00402880
push fcn.00402860
push 0xa
push 0x21c
lea eax, [esi + 0x1006a0]
push eax
mov byte [esp + 0x134], 1
call fcn.0047a06b
mov dword [esi + 0x102118], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x698], ebx
mov dword [esi + 0x20], ebx
mov dword [0x1b2ea14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
xor eax, eax
push 0x38fba882
mov ecx, 0x28
lea edi, [esi + 0x102078]
rep stosd dword es:[edi], eax
push 0x3e99999a
lea ecx, [esi + 0x101bb8]
mov dword [esi + 0xa8], ebx
push ecx
mov ecx, dword [0x1b2f054]
mov byte [esp + 0x12c], 2
call fcn.00406620
mov dword [esi + 0x102074], ebx
mov ecx, dword [0x1b2f054]
push ebx
call fcn.0040a470
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [0x1b2eb6c], ebx
jne 0x45ccc8
mov ecx, esi
call fcn.0045c470
push eax
mov ecx, esi
call fcn.0045c470
push eax
lea eax, [esp + 0x18]
push eax
push str._sVideo_s_s.spv
lea ecx, [esi + 0xb8]
push ecx
jmp 0x45cce3
push 0x1b2eb80
push 0x1b2eb80
lea edx, [esp + 0x18]
push edx
push str._sVideo_s_s.spv
lea eax, [esi + 0xb8]
push eax
call fcn.004788cf
mov ecx, dword [esp + 0x12c]
add esp, 0x14
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10c]
pop ebx
call fcn.0047882f
add esp, 0x118
ret
Function at 0x45cbd1
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x485bea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x4afca0]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x114], eax
mov dword [esp + 0xc], esi
call fcn.00401690
xor ebx, ebx
lea ecx, [esi + 0x1c0]
mov dword [esp + 0x120], ebx
mov dword [esi], 0x499df0
call fcn.0040b180
push fcn.00402880
push fcn.00402860
push 0xa
push 0x21c
lea eax, [esi + 0x1006a0]
push eax
mov byte [esp + 0x134], 1
call fcn.0047a06b
mov dword [esi + 0x102118], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x698], ebx
mov dword [esi + 0x20], ebx
mov dword [0x1b2ea14], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
xor eax, eax
push 0x38fba882
mov ecx, 0x28
lea edi, [esi + 0x102078]
rep stosd dword es:[edi], eax
push 0x3e99999a
lea ecx, [esi + 0x101bb8]
mov dword [esi + 0xa8], ebx
push ecx
mov ecx, dword [0x1b2f054]
mov byte [esp + 0x12c], 2
call fcn.00406620
mov dword [esi + 0x102074], ebx
mov ecx, dword [0x1b2f054]
push ebx
call fcn.0040a470
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [0x1b2eb6c], ebx
jne 0x45ccc8
mov ecx, esi
call fcn.0045c470
push eax
mov ecx, esi
call fcn.0045c470
push eax
lea eax, [esp + 0x18]
push eax
push str._sVideo_s_s.spv
lea ecx, [esi + 0xb8]
push ecx
jmp 0x45cce3
push 0x1b2eb80
push 0x1b2eb80
lea edx, [esp + 0x18]
push edx
push str._sVideo_s_s.spv
lea eax, [esi + 0xb8]
push eax
call fcn.004788cf
mov ecx, dword [esp + 0x12c]
add esp, 0x14
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10c]
pop ebx
call fcn.0047882f
add esp, 0x118
ret
Function at 0x462870
Capabilities:
Access peb ldr_data
Get common file path
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x485d2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
mov eax, dword [0x4afca0]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x110], eax
mov dword [esp + 0xc], esi
call fcn.00401690
xor ebx, ebx
lea ecx, [esi + 0x309c]
mov dword [esp + 0x11c], ebx
mov dword [esi], 0x49a498
call fcn.00402860
lea ecx, [esi + 0x32b8]
mov byte [esp + 0x11c], 1
call fcn.00402860
mov dword [esi + 0xf8], ebx
mov dword [esi + 0x1acc], ebx
mov byte [esi + 0xe4], bl
mov dword [esi + 0x18], ebx
mov dword [esi + 0x34], 4
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], ebx
or eax, 0xffffffff
xorps xmm0, xmm0
movss dword [esi + 0x1ac4], xmm0
movss dword [esi + 0x1ac8], xmm0
movss dword [esi + 0xf0], xmm0
movss dword [esi + 0xf4], xmm0
movss xmm1, dword [0x488190]
movss dword [esi + 0xe8], xmm1
movss xmm1, dword [0x4876ac]
movss dword [esi + 0xec], xmm1
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0x48], eax
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], eax
mov dword [esi + 0x58], eax
mov dword [esi + 0x5c], eax
mov dword [esi + 0x60], eax
mov dword [esi + 0x64], eax
mov dword [esi + 0x68], eax
mov dword [esi + 0x6c], eax
mov dword [esi + 0x70], eax
mov dword [esi + 0x74], eax
mov dword [esi + 0x78], eax
mov dword [esi + 0x7c], eax
mov dword [esi + 0x80], eax
mov dword [esi + 0x84], eax
mov dword [esi + 0x88], eax
mov dword [esi + 0x8c], eax
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], eax
mov dword [esi + 0xa4], eax
mov dword [esi + 0xa8], eax
mov dword [esi + 0xac], eax
mov dword [esi + 0xb0], eax
mov dword [esi + 0xb4], eax
mov dword [esi + 0xb8], eax
mov dword [esi + 0xbc], eax
mov dword [esi + 0xc0], eax
mov dword [esi + 0xc4], eax
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], eax
mov dword [esi + 0xd0], eax
mov dword [esi + 0xd4], eax
mov ecx, 0x492
xor eax, eax
lea edi, [esi + 0xfc]
mov byte [esp + 0x11c], 2
rep stosd dword es:[edi], eax
mov ecx, 0x16
lea edi, [esi + 0x1af4]
rep stosd dword es:[edi], eax
xor ecx, ecx
lea edx, [esi + 0x3030]
mov dword [edx], ecx
mov dword [edx + 4], ecx
mov dword [edx + 8], ecx
mov dword [edx + 0xc], ecx
mov dword [edx + 0x10], ecx
mov dword [edx + 0x14], ecx
mov ecx, 0x12
lea edi, [esi + 0x3048]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call fcn.00412e60
push 1
push str.SystemBattleMode_
call fcn.00412dd0
add esp, 8
push ebx
push ebx
mov dword [esi + 0x10], ebx
mov byte [esi + 0x34d4], bl
mov ecx, dword [0x1b2eae4]
push str.newdj.wav
call fcn.0040e3c0
mov dword [esi + 0x3098], eax
call fcn.00412e60
lea ecx, [esp + 0x10]
push 1
push ecx
call fcn.00412dd0
mov ecx, dword [esp + 0x11c]
add esp, 8
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x108]
pop ebx
call fcn.0047882f
add esp, 0x114
ret
Function at 0x46b820
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4861da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x4afca0]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x114], eax
mov dword [esp + 0xc], esi
call fcn.00401690
xor ebx, ebx
lea ecx, [esi + 0x1b8]
mov dword [esp + 0x120], ebx
mov dword [esi], 0x49d708
call fcn.0040b180
push fcn.00402880
push fcn.00402860
push 0xa
push 0x21c
lea eax, [esi + 0x100694]
push eax
mov byte [esp + 0x134], 1
call fcn.0047a06b
mov dword [esi + 0x10210c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x690], ebx
mov dword [esi + 0x18], ebx
mov dword [0x1b2ea14], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
xor eax, eax
push 0x38fba882
mov ecx, 0x28
lea edi, [esi + 0x10206c]
rep stosd dword es:[edi], eax
push 0x3e99999a
lea ecx, [esi + 0x101bac]
mov dword [esi + 0xa0], ebx
push ecx
mov ecx, dword [0x1b2f054]
mov byte [esp + 0x12c], 2
call fcn.00406620
mov dword [esi + 0x102068], ebx
mov ecx, dword [0x1b2f054]
push ebx
call fcn.0040a470
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [0x1b2eb6c], ebx
jne 0x46b93e
mov ecx, esi
call fcn.0046aba0
push eax
mov ecx, esi
call fcn.0046aba0
push eax
lea eax, [esp + 0x18]
push eax
push str._sVideo_s_s.spv
lea ecx, [esi + 0xb4]
push ecx
jmp 0x46b959
push 0x1b2eb80
push 0x1b2eb80
lea edx, [esp + 0x18]
push edx
push str._sVideo_s_s.spv
lea eax, [esi + 0xb4]
push eax
call fcn.004788cf
mov ecx, dword [esp + 0x12c]
add esp, 0x14
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10c]
pop ebx
call fcn.0047882f
add esp, 0x118
ret
Function at 0x46b841
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4861da
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10c
mov eax, dword [0x4afca0]
push ebx
push esi
mov esi, ecx
push edi
mov dword [esp + 0x114], eax
mov dword [esp + 0xc], esi
call fcn.00401690
xor ebx, ebx
lea ecx, [esi + 0x1b8]
mov dword [esp + 0x120], ebx
mov dword [esi], 0x49d708
call fcn.0040b180
push fcn.00402880
push fcn.00402860
push 0xa
push 0x21c
lea eax, [esi + 0x100694]
push eax
mov byte [esp + 0x134], 1
call fcn.0047a06b
mov dword [esi + 0x10210c], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x690], ebx
mov dword [esi + 0x18], ebx
mov dword [0x1b2ea14], ebx
mov dword [esi + 0xac], ebx
mov dword [esi + 0xb0], ebx
xor eax, eax
push 0x38fba882
mov ecx, 0x28
lea edi, [esi + 0x10206c]
rep stosd dword es:[edi], eax
push 0x3e99999a
lea ecx, [esi + 0x101bac]
mov dword [esi + 0xa0], ebx
push ecx
mov ecx, dword [0x1b2f054]
mov byte [esp + 0x12c], 2
call fcn.00406620
mov dword [esi + 0x102068], ebx
mov ecx, dword [0x1b2f054]
push ebx
call fcn.0040a470
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp dword [0x1b2eb6c], ebx
jne 0x46b93e
mov ecx, esi
call fcn.0046aba0
push eax
mov ecx, esi
call fcn.0046aba0
push eax
lea eax, [esp + 0x18]
push eax
push str._sVideo_s_s.spv
lea ecx, [esi + 0xb4]
push ecx
jmp 0x46b959
push 0x1b2eb80
push 0x1b2eb80
lea edx, [esp + 0x18]
push edx
push str._sVideo_s_s.spv
lea eax, [esi + 0xb4]
push eax
call fcn.004788cf
mov ecx, dword [esp + 0x12c]
add esp, 0x14
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov ecx, dword [esp + 0x10c]
pop ebx
call fcn.0047882f
add esp, 0x118
ret

Function at 0x46c440
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x168]
test ecx, ecx
je 0x46c452
mov eax, dword [ecx]
call dword [eax + 0x28]
mov ecx, dword [0x1b2ef98]
test ecx, ecx
je 0x46c496
mov eax, dword [esi + 0x168]
test eax, eax
je 0x46c47c
mov edx, dword [ecx]
push eax
call dword [edx + 0x20]
mov dword [esi + 0x168], 0
mov ecx, dword [0x1b2ef98]
mov eax, dword [esi + 0x164]
test eax, eax
je 0x46c496
mov edx, dword [ecx]
push eax
call dword [edx + 0x14]
mov dword [esi + 0x164], 0
mov ecx, dword [esi + 0x16c]
test ecx, ecx
je 0x46c4b1
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x16c], 0
add esi, 0x40
mov ecx, esi
call fcn.00414930
mov ecx, esi
pop esi
jmp fcn.004148b0
Function at 0x47a1f3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x47a213
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047d621
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x47a236
test byte [esp + 8], 2
je 0x47a236
call fcn.0047d60f
mov dword [eax], 0xd
call fcn.0047d618
mov dword [eax], 5
jmp 0x47a20f
xor eax, eax
ret

Function at 0x47a36c
Capabilities:
Accept command line arguments
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x4a0390
call fcn.0047a928
mov edi, 0x94
mov eax, edi
call fcn.00479240
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x37e0ee0], ecx
mov eax, dword [esi + 4]
mov dword [0x37e0eec], eax
mov edx, dword [esi + 8]
mov dword [0x37e0ef0], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x37e0ee4], esi
cmp ecx, 2
je 0x47a3cc
or esi, 0x8000
mov dword [0x37e0ee4], esi
shl eax, 8
add eax, edx
mov dword [0x37e0ee8], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x47a407
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47a407
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x47a41f
cmp eax, 0x20b
je 0x47a40c
mov dword [ebp - 0x1c], esi
jmp 0x47a433
cmp dword [ecx + 0x84], 0xe
jbe 0x47a407
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x47a42d
cmp dword [ecx + 0x74], 0xe
jbe 0x47a407
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push 1
call fcn.004801b8
pop ecx
test eax, eax
jne 0x47a447
push 0x1c
call fcn.0047a348
pop ecx
call fcn.0047ae9e
test eax, eax
jne 0x47a458
push 0x10
call fcn.0047a348
pop ecx
call fcn.00480116
mov dword [ebp - 4], esi
call fcn.0047e280
test eax, eax
jge 0x47a471
push 0x1b
call fcn.0047a323
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x37e2710], eax
call fcn.0047fff4
mov dword [0x37e0eac], eax
call fcn.0047ff52
test eax, eax
jge 0x47a497
push 8
call fcn.0047a323
pop ecx
call fcn.0047fd1f
test eax, eax
jge 0x47a4a8
push 9
call fcn.0047a323
pop ecx
push 1
call fcn.0047c9bd
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x47a4be
push eax
call fcn.0047a323
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
call fcn.0047fcc2
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x47a4df
movzx eax, word [ebp - 0x40]
jmp 0x47a4e2
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.004015e0
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x47a500
push edi
call fcn.0047caea
call fcn.0047cb0c
jmp 0x47a532
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.0047a963
ret
Function at 0x47ca27
Capabilities:
Terminate process

Disassembly:
push 8
push 0x4a0950
call fcn.0047a928
push 8
call fcn.0048035c
pop ecx
xor edi, edi
mov dword [ebp - 4], edi
xor esi, esi
inc esi
cmp dword [0x37e0f20], esi
jne 0x47ca5b
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [0x37e0f1c], esi
mov al, byte [ebp + 0x10]
mov byte [0x37e0f18], al
cmp dword [ebp + 0xc], edi
jne 0x47caa5
cmp dword [0x37e2708], edi
je 0x47ca95
mov eax, dword [0x37e2704]
sub eax, 4
mov dword [0x37e2704], eax
cmp eax, dword [0x37e2708]
jb 0x47ca95
mov eax, dword [eax]
cmp eax, edi
je 0x47ca76
call eax
jmp 0x47ca76
push 0x4a50b8
mov eax, 0x4a50b0
call fcn.0047c9a5
pop ecx
push 0x4a50c4
mov eax, 0x4a50bc
call fcn.0047c9a5
pop ecx
or dword [ebp - 4], 0xffffffff
call 0x47cad6
cmp dword [ebp + 0x10], edi
jne 0x47cae4
mov dword [0x37e0f20], esi
push dword [ebp + 8]
call fcn.0047c963
xor edi, edi
xor esi, esi
inc esi
cmp dword [ebp + 0x10], edi
je 0x47cae3
push 8
call fcn.004802a7
pop ecx
ret
call fcn.0047a963
ret
Function at 0x47d7b3
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x47d987
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x37e13a0]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x47d987
test cl, 0x48
je 0x47d81e
cmp byte [eax + 5], 0xa
je 0x47d81e
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47d870
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x47d858
call fcn.0047d60f
mov dword [eax], 9
call fcn.0047d618
mov dword [eax], esi
jmp 0x47d868
cmp eax, 0x6d
je 0x47d987
push eax
call fcn.0047d621
pop ecx
or eax, 0xffffffff
jmp 0x47d989
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x47d982
test eax, eax
je 0x47d897
cmp byte [ebx], 0xa
jne 0x47d897
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x47d8a0
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x47d97c
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x47d96c
cmp al, 0xd
je 0x47d8d2
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x47d95e
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x47d8ec
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x47d8e7
add dword [ebp + 0x10], 2
jmp 0x47d940
mov dword [ebp + 0x10], eax
jmp 0x47d95a
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x47d914
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47d95a
cmp dword [ebp - 0xc], 0
je 0x47d95a
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x47d935
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x47d940
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x47d95d
cmp ebx, dword [ebp + 0xc]
jne 0x47d945
cmp byte [ebp - 1], 0xa
jne 0x47d945
mov byte [ebx], 0xa
jmp 0x47d95d
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0047d694
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x47d95e
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x47d8b6
jmp 0x47d97c
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x47d97c
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x47d989
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret