joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bdb0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x47bdc3
mov ax, 0x10
pop edi
pop esi
ret 0x14
push esi
call fcn.0047e970
mov edi, eax
mov ax, word [edi]
cmp ax, 0x7243
jne 0x47be0f
mov word [edi], 0x7242
push edi
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
push esi
call fcn.0047fd50
push eax
call fcn.0047b7c0
mov word [edi + 6], ax
add esp, 8
mov word [edi], 0x7243
mov ax, word [edi + 6]
pop edi
pop esi
ret 0x14
cmp ax, 0x7242
jne 0x47be3e
mov eax, dword [esp + 0x1c]
push edi
mov ecx, dword [esp + 0x1c]
push eax
mov edx, dword [esp + 0x1c]
push ecx
mov eax, dword [esp + 0x1c]
push edx
push eax
push esi
call fcn.0047fd50
push eax
call fcn.0047b7c0
add esp, 8
pop edi
pop esi
ret 0x14
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
push esi
call fcn.00480ab0
pop edi
pop esi
ret 0x14

Function at 0x47bf20
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x47bf33
mov ax, 0x10
pop edi
pop esi
ret 0xc
push esi
call fcn.0047e970
mov edi, eax
mov ax, word [edi]
cmp ax, 0x7243
jne 0x47bf75
mov word [edi], 0x7242
push edi
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push esi
call fcn.0047fdb0
push eax
call fcn.0047b7c0
mov word [edi + 6], ax
add esp, 8
mov word [edi], 0x7243
mov ax, word [edi + 6]
pop edi
pop esi
ret 0xc
cmp ax, 0x7242
jne 0x47bf9a
mov eax, dword [esp + 0x14]
push edi
mov ecx, dword [esp + 0x14]
push eax
push ecx
push esi
call fcn.0047fdb0
push eax
call fcn.0047b7c0
add esp, 8
pop edi
pop esi
ret 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call fcn.00480eb0
pop edi
pop esi
ret 0xc

Function at 0x47c140
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push edi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x47c153
mov ax, 0x10
pop edi
pop esi
ret 0xc
push esi
call fcn.0047e970
mov edi, eax
mov ax, word [edi]
cmp ax, 0x7243
jne 0x47c192
mov word [edi], 0x7242
push 0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push esi
call fcn.0047fc30
mov word [edi + 6], ax
test ax, ax
je 0x47c189
mov word [edi], 0x7243
mov ax, word [edi + 6]
pop edi
pop esi
ret 0xc
cmp ax, 0x7242
jne 0x47c1af
mov eax, dword [esp + 0x14]
push 1
mov ecx, dword [esp + 0x14]
push eax
push ecx
push esi
call fcn.0047fc30
pop edi
pop esi
ret 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push eax
push ecx
push esi
call fcn.00481b40
pop edi
pop esi
ret 0xc

Function at 0x47c200
Capabilities:
Parse pe header

Disassembly:
mov eax, dword [esp + 4]
cmp word [eax], 0x5a4d
jne 0x47c236
mov ecx, dword [eax + 0x3c]
mov eax, dword [ecx + eax]
cmp ax, 0x454e
je 0x47c232
cmp ax, 0x454c
je 0x47c232
sub eax, 0x4550
cmp eax, 1
sbb eax, eax
and eax, 0xffffeb03
add eax, 0x5a4d
ret
movzx eax, ax
ret
xor eax, eax
ret
Function at 0x47c420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, 0x65
mov ecx, 0x72
push ebx
xor ebx, ebx
mov byte [esp + 5], al
mov byte [esp + 4], 0x54
mov byte [esp + 7], 0x6d
mov byte [esp + 8], 0x69
mov byte [esp + 9], 0x6e
mov byte [esp + 0xa], 0x61
mov byte [esp + 6], cl
mov byte [esp + 0xe], al
mov byte [esp + 0xb], 0x6c
mov byte [esp + 0xf], cl
mov byte [esp + 0x11], al
mov byte [esp + 0x12], cl
mov byte [esp + 0x13], bl
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], 0x53
mov byte [esp + 0x10], 0x76
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
jne 0x47c4aa
cmp al, 4
lea eax, [esp + 4]
push eax
jbe 0x47c4a0
call fcn.0047c4c0
add esp, 4
mov ebx, eax
mov eax, ebx
pop ebx
add esp, 0x10
ret
call fcn.0047c4c0
add esp, 4
mov ebx, eax
mov eax, ebx
pop ebx
add esp, 0x10
ret

Function at 0x47c4c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
xor ebx, ebx
push ebp
xor esi, esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], ebx
push eax
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [esp + 0x1c], ebx
push 0x475428
mov dword [esp + 0x1c], ebx
push reloc.WSOCK32.dll_bind
call ebp
test eax, eax
jne 0x47c584
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
push ebx
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ecx
push ebx
push 0x475418
push edx
call edi
test eax, eax
jne 0x47c584
cmp dword [esp + 0x14], ebx
je 0x47c584
mov eax, dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_LocalAlloc]
push eax
push 0x40
call ebp
mov esi, eax
test esi, esi
je 0x47c58f
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x10]
push eax
push esi
push ecx
push ebx
push 0x475418
push edx
call edi
test eax, eax
jne 0x47c584
cmp dword [esp + 0x18], 7
jne 0x47c584
mov ebp, esi
cmp byte [esi], bl
je 0x47c584
mov edi, dword [esp + 0x20]
push edi
push ebp
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x47c57f
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [eax + ebp + 1]
cmp byte [ebp], 0
jne 0x47c560
jmp 0x47c584
mov ebx, 1
test esi, esi
je 0x47c58f
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [esp + 0x10], 0
je 0x47c5a3
mov eax, dword [esp + 0x10]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebp
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x47cd10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x14
mov dword [esp], 0x10
push esi
push edi
push 0x4e8
push 5
push 6
call fcn.004826f0
add esp, 0xc
mov esi, eax
cmp esi, 0xffffffff
je 0x47cda8
mov edx, dword [esp + 8]
lea edi, [esp + 0xc]
xor eax, eax
mov ecx, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov word [esp + 0xc], 6
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
push edx
push eax
push esi
call sub.WSOCK32.dll_bind
cmp eax, 0xffffffff
je 0x47cda8
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
call sub.WSOCK32.dll_getsockname
cmp eax, 0xffffffff
je 0x47cda8
lea eax, [esp + 0xc]
push eax
call fcn.0047cc90
add esp, 4
push eax
mov eax, dword [esp + 0x24]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
push esi
call sub.WSOCK32.dll_closesocket
xor eax, eax
pop edi
pop esi
add esp, 0x14
ret
mov eax, dword [esp + 0x20]
push 0x4754c8
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
mov eax, 1
pop edi
pop esi
add esp, 0x14
ret

Function at 0x47cee0
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
xor esi, esi
push ebp
call fcn.0047c3a0
test eax, eax
mov eax, dword [esp + 0x14]
push eax
jne 0x47cf10
mov ecx, dword [esp + 0x1c]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
cmp eax, esi
mov ebx, eax
jne 0x47cf2a
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
test ebx, ebx
jne 0x47cf2a
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
mov ebp, dword [esp + 0x20]
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ebp
push ebx
call edi
test eax, eax
je 0x47cf5d
cmp eax, 0x102
jne 0x47cf6a
inc esi
cmp esi, dword [esp + 0x24]
jle 0x47cf34
push ebx
call fcn.0047cfe0
add esp, 4
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
ret
mov eax, dword [esp + 0x1c]
pop ebp
pop edi
pop esi
mov dword [eax], ebx
xor eax, eax
pop ebx
ret
mov eax, 0x73
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x47cf80
Capabilities:
Check mutex on windows

Disassembly:
push esi
call fcn.0047c3a0
test eax, eax
mov eax, dword [esp + 8]
push eax
push 0
jne 0x47cfa9
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x47cfbe
mov eax, 1
pop esi
ret
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
jne 0x47cfbe
mov eax, 1
pop esi
ret
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x47cfd5
mov eax, dword [esp + 0x10]
mov dword [eax], esi
xor eax, eax
pop esi
ret
mov eax, 0x73
pop esi
ret
Function at 0x47e440
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x58
push ebx
push esi
mov esi, dword [esp + 0x64]
push edi
push ebp
test esi, esi
jne 0x47e45d
mov ax, 0x10
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x58
ret 4
mov eax, dword [esi + 0x54]
test eax, eax
je 0x47e491
mov ecx, dword [0x477c18]
push ecx
push eax
call fcn.0047f770
add esp, 8
test eax, eax
je 0x47e486
mov ax, 0x4b
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x58
ret 4
push 0x404
push esi
call fcn.0047e410
call fcn.0047ee50
mov bx, ax
push 0x1a4
movzx eax, bx
mov ebp, dword [sym.imp.MSVCRT.dll_malloc]
mov dword [esi + 0x54], eax
call ebp
add esp, 4
mov ebp, eax
test ebp, ebp
jne 0x47e4c3
mov ax, 0x40
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x58
ret 4
mov edi, ebp
xor eax, eax
mov ecx, 0x69
rep stosd dword es:[edi], eax
lea edi, [esp + 0x28]
mov ecx, 0x10
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
xor esi, esi
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
mov dword [eax + 0xc], esi
mov dword [eax + 0x10], esi
mov word [eax + 0x14], si
mov word [ebp + 0x5a], 0xffff
mov word [ebp], bx
call sub.MSVCRT.dll__getpid
mov dword [ebp + 0x6c], eax
mov dword [ebp + 0x60], 0x78
mov word [ebp + 0x74], 1
call fcn.004823b0
push 0x46c860
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
mov edi, eax
test edi, edi
jne 0x47e536
mov al, byte [0x475414]
mov byte [ebp + 2], al
jmp 0x47e5f7
push 0x46c86c
push edi
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x47e556
mov al, byte [0x475414]
mov byte [ebp + 2], al
jmp 0x47e5f7
lea eax, [esp + 0x28]
push 0x40
push eax
push edi
call fcn.004829d0
add esp, 0xc
test eax, eax
jge 0x47e57f
push ebp
push 0x4a
call fcn.0047f610
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x58
ret 4
lea edi, [esp + 0x28]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp + 2]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x28]
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 0x11
ja 0x47e5f7
lea eax, [esp + 0x28]
lea ecx, [esp + 0x10]
push eax
push 0x4761cc
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea edi, [esp + 0x1c]
add esp, 0xc
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
shr ecx, 2
mov esi, edi
lea edi, [ebp + 0x18d]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp bx, 1
jne 0x47e60a
push 0x477c18
call fcn.0047ec80
add esp, 4
push ebp
push 0x477c18
call fcn.0047ec90
add esp, 8
push ebp
push 0
call fcn.0047f610
add esp, 8
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x58
ret 4
Function at 0x47f350
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x200
push ebx
push esi
push edi
mov ebx, 4
push ebp
mov ebp, dword [esp + 0x21c]
cmp byte [ebp], 0
je 0x47f38f
mov edi, ebp
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
lea edi, [esp + 0x18]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push 0x476234
mov byte [ebp], 0
call dword [sym.imp.MSVCRT.dll_getenv]
add esp, 4
test eax, eax
je 0x47f3b8
jbe 0x47f3b8
push eax
call dword [sym.imp.MSVCRT.dll_atoi]
mov word [esp + 0x14], ax
add esp, 4
jmp 0x47f3bf
mov word [esp + 0x10], 0xa
mov eax, dword [esp + 0x214]
cmp word [eax + 0x74], 4
jne 0x47f3d2
mov ebx, 2
lea eax, [esp + 0x10]
lea ecx, [esp + 0xbc]
mov edx, dword [esp + 0x218]
push eax
push ecx
push edx
push ebx
call fcn.0047c1d0
mov word [esp + 0x12], ax
test ax, ax
jne 0x47f52f
mov dword [esp + 0x14], 0
mov word [esp + 0x12], 3
cmp word [esp + 0x10], 0
jbe 0x47f52f
lea ebx, [esp + 0xbc]
cmp word [ebx + 0x20], 0
jbe 0x47f515
mov edi, ebp
xor eax, eax
mov ecx, 0x10
push 0x476214
rep stosd dword es:[edi], eax
lea eax, [esp + 0x5c]
mov edi, ebx
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
mov eax, dword [esp + 0x21c]
add esp, 8
push ebx
push eax
call fcn.0047ed60
add esp, 8
mov ecx, 0xffffffff
sub eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
shr ecx, 2
mov esi, edi
mov edi, ebp
push 0x476214
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x5c]
push ecx
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x60]
add esp, 8
push 0x476214
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [esp + 0x20]
add esp, 8
push 0x46c824
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x47f4cc
lea eax, [esp + 0x18]
push 0x4744fc
push eax
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x47f4df
push 0x4761d4
push ebp
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x47f515
mov eax, dword [esp + 0x218]
push ebp
mov ecx, dword [esp + 0x218]
push eax
push ecx
call fcn.0047ee60
mov word [esp + 0x1e], ax
add esp, 0xc
test ax, ax
je 0x47f52f
lea eax, [esp + 0x58]
push 0x476214
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 8
add ebx, 0x22
mov eax, dword [esp + 0x10]
and eax, 0xffff
inc dword [esp + 0x14]
cmp eax, dword [esp + 0x14]
jg 0x47f41d
cmp word [esp + 0x12], 0x45
mov ax, 3
je 0x47f53f
mov eax, dword [esp + 0x12]
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x200
ret
Function at 0x47f830
Capabilities:
Create thread

Disassembly:
sub esp, 0x14
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
push ebp
test esi, esi
je 0x47fa28
mov bx, word [esp + 0x2c]
test bx, bx
je 0x47fa28
cmp bx, 0xffff
jne 0x47f866
mov ax, 3
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
push esi
call fcn.0047e970
cmp word [eax], 0x7242
mov edi, eax
jne 0x47fa1a
test byte [edi + 0x12], 4
jne 0x47f893
mov ax, 2
pop ebp
mov word [edi + 6], 2
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov word [edi + 0x30], 3
push edi
call fcn.0047e340
mov bp, word [edi + 0x36]
mov ax, word [edi + 0x38]
mov word [esp + 0x12], ax
cmp bp, 0xff
je 0x47f8d1
test bp, bp
je 0x47f8d1
cmp bp, bx
je 0x47f8d1
mov ax, 0x48
pop ebp
mov word [edi + 6], 0x48
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
push ebx
push esi
call fcn.004869f0
mov bx, ax
test bx, bx
jne 0x47fa2c
mov ax, word [esp + 0x12]
cmp word [edi + 0x36], ax
jne 0x47f909
cmp word [edi + 0x34], bp
jne 0x47f909
mov ax, 3
pop ebp
mov word [edi + 6], 3
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
test bx, bx
jne 0x47fa0d
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x47f935
mov ax, 0x46
pop ebp
mov word [edi + 6], 0x46
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
cmp word [esp + 0x30], 1
jne 0x47fa0d
cmp word [0x476270], 0
jne 0x47f9c5
lea eax, [esp + 0x18]
push eax
call fcn.0047c3c0
add esp, 4
test eax, eax
je 0x47f970
mov ax, 0x4a
pop ebp
mov word [edi + 6], 0x4a
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
lea eax, [esp + 0x18]
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x476278], eax
test eax, eax
jne 0x47f99c
mov ax, 0x4a
pop ebp
mov word [edi + 6], 0x4a
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
lea eax, [esp + 0x14]
push eax
push 0
push 0
push 0x47da30
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov word [0x476270], 1
add esp, 0x18
mov dword [0x47627c], eax
mov ax, word [edi + 0x36]
push 1
mov cx, word [edi + 0x34]
push 1
push eax
push ecx
push edi
call fcn.0047fe00
add esp, 0x14
test ax, ax
je 0x47fa00
push 0x404
push esi
call fcn.004867f0
push esi
call fcn.00486850
mov ax, 0x46
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov ax, bx
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov ax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
mov ax, 0x10
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x14
ret 0xc
Function at 0x47fe00
Capabilities:
Create thread

Disassembly:
sub esp, 8
push ebx
push esi
mov ebx, dword [esp + 0x20]
push edi
mov di, word [esp + 0x20]
push ebp
mov si, word [esp + 0x20]
push 0
mov ebp, dword [esp + 0x30]
push ebp
push ebx
push edi
push esi
call fcn.0047d3b0
add esp, 0x14
test eax, eax
jne 0x47fe41
mov eax, dword [esp + 0x1c]
pop ebp
mov word [eax + 6], 0x48
mov ax, 0x48
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp word [0x47626c], 0
jne 0x47ff33
lea eax, [esp + 0x14]
lea ecx, [esp + 0x12]
push eax
push 0
push ecx
push 0x47d2d0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov dword [0x476fa0], eax
push 0x1b58
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x47ff21
cmp word [esp + 0x12], 2
jne 0x47fec7
cmp ebx, 0xffffffff
jne 0x47fea0
cmp ebp, 0xffffffff
jne 0x47fea0
push 2
push 0xffffffffffffffff
push 0xffffffffffffffff
jmp 0x47fea6
push 2
push 1
push 1
push edi
push esi
call fcn.0047d3b0
add esp, 0x14
mov eax, dword [0x476fa0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp word [esp + 0x12], 0
jne 0x47fee6
mov eax, dword [0x476fa0]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp ebx, 1
jne 0x47feee
cmp ebp, 1
push 1
push 1
push 1
push edi
push esi
call fcn.0047d3b0
mov eax, dword [esp + 0x30]
add esp, 0x14
mov word [eax + 6], 0x46
mov ecx, dword [0x476fa0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x46
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
cmp eax, 0x102
jne 0x47ff33
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret
xor ax, ax
pop ebp
pop edi
pop esi
pop ebx
add esp, 8
ret

Function at 0x483a10
Capabilities:
Check if file exists

Disassembly:
sub esp, 0xc
mov eax, 0x52
mov byte [esp], al
push esi
mov byte [esp + 5], 0x4e
mov byte [esp + 6], 0x42
mov byte [esp + 7], 0x4f
mov byte [esp + 8], 0x44
mov esi, dword [esp + 0x14]
mov byte [esp + 9], al
mov ax, word [esp + 0x18]
push 0
add al, 0x30
push 0x80
mov byte [esp + 0x13], al
push 3
lea ecx, [esp + 0x10]
push 0
push 3
mov dword [esi], 0
mov byte [esp + 0x1e], 0x56
mov byte [esp + 0x20], 0
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi], eax
cmp eax, 0xffffffff
jne 0x483aac
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x483a88
cmp eax, 3
jbe 0x483aa1
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x483a96
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x80b
pop esi
add esp, 0xc
ret 8
mov ax, 0x80c
pop esi
add esp, 0xc
ret 8
mov ax, 0x800
pop esi
add esp, 0xc
ret 8
Function at 0x483ac0
Capabilities:
Enumerate pe sections
Read file on windows
Write file on windows

Disassembly:
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x14]
push edi
mov word [esi + 6], 0xffff
push esi
call fcn.00487ae0
lea eax, [esp + 0xc]
push 0
mov edi, dword [esp + 0x18]
push eax
xor eax, eax
mov ecx, dword [edi]
mov ax, word [esi + 2]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ebx, eax
test ebx, ebx
je 0x483b12
lea eax, [esp + 0xc]
push 0
push eax
mov ecx, dword [edi]
xor eax, eax
mov ax, word [esi + 2]
push eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
push esi
call fcn.00487a90
test ebx, ebx
je 0x483b24
cmp word [esi + 6], 0xffff
jne 0x483b2a
mov word [esi + 6], 0x83b
mov ax, word [esi + 6]
pop edi
pop esi
pop ebx
add esp, 4
ret 8
Function at 0x487920
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
mov edx, 0xc6ef3720
push edi
mov esi, dword [eax]
push ebp
mov edi, dword [eax + 4]
mov ebx, 0x1f
mov ecx, dword [esp + 0x18]
mov eax, esi
mov ebp, esi
shl eax, 4
add edx, 0x61c88647
shr ebp, 5
add eax, dword [ecx + 8]
add ebp, dword [ecx + 0xc]
xor eax, ebp
lea ebp, [edx + esi - 0x61c88647]
xor eax, ebp
sub edi, eax
mov ebp, edi
mov eax, edi
shl ebp, 4
shr eax, 5
add ebp, dword [ecx]
add eax, dword [ecx + 4]
xor ebp, eax
lea eax, [edi + edx - 0x61c88647]
xor ebp, eax
mov eax, ebx
sub esi, ebp
dec ebx
test eax, eax
jne 0x48793b
mov eax, dword [esp + 0x14]
pop ebp
mov dword [eax], esi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
ret 8

Function at 0x4879e0
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
xor edx, edx
push edi
mov esi, dword [eax]
push ebp
mov edi, dword [eax + 4]
mov ebx, 0x1f
mov ecx, dword [esp + 0x18]
sub edx, 0x61c88647
mov eax, edi
shl eax, 4
mov ebp, edi
shr ebp, 5
add eax, dword [ecx]
add ebp, dword [ecx + 4]
xor eax, ebp
lea ebp, [edi + edx]
xor eax, ebp
add esi, eax
mov ebp, esi
mov eax, esi
shl ebp, 4
shr eax, 5
add ebp, dword [ecx + 8]
add eax, dword [ecx + 0xc]
xor ebp, eax
lea eax, [edx + esi]
xor ebp, eax
mov eax, ebx
add edi, ebp
dec ebx
test eax, eax
jne 0x4879f8
mov eax, dword [esp + 0x14]
pop ebp
mov dword [eax], esi
mov dword [eax + 4], edi
pop edi
pop esi
pop ebx
ret 8

Function at 0x487b90
Capabilities:
Check if file exists

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x10
lea ecx, [esp]
push esi
push eax
push ecx
call fcn.00487b40
lea ecx, [esp + 4]
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [esp + 0x18]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x487bff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jb 0x487bdb
cmp eax, 3
jbe 0x487bf4
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x487be9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ax, 0x20b
pop esi
add esp, 0x10
ret 8
mov ax, 0x20c
pop esi
add esp, 0x10
ret 8
mov ax, 0x200
pop esi
add esp, 0x10
ret 8