joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479379
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov dword [ebp - 0x108], 0
push 0x52f100
push 0x104
lea eax, [ebp - 0x104]
push eax
call fcn.00409000
movsx ecx, byte [ebp - 0x104]
cmp ecx, 0x5a
jge 0x47944d
cmp dword [ebp - 0x108], 0xffffffff
je 0x47944d
lea edx, [ebp - 0x104]
push edx
call fcn.0042b650
add esp, 4
test eax, eax
je 0x47943a
lea eax, [ebp - 0x104]
push eax
push str._sautorun.inf
push 0x104
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0040a150
add esp, 0x10
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x210], eax
cmp dword [ebp - 0x210], 0xffffffff
je 0x47943a
mov eax, dword [ebp - 0x210]
and eax, 0x10
test eax, eax
jne 0x47943a
push 0x80
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, byte [ebp - 0x104]
add al, 1
mov byte [ebp - 0x104], al
jmp 0x4793a2
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x47a79f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov dword [ebp - 0x118], ecx
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.0040a130
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47a7cc
xor eax, eax
jmp 0x47a8a4
push 0x2e
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040a130
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x47a7ea
xor eax, eax
jmp 0x47a8a4
push 0x5318dc
mov edx, dword [ebp - 8]
push edx
call fcn.00402980
add esp, 8
test eax, eax
jne 0x47a8a2
mov eax, dword [ebp - 8]
sub eax, dword [ebp + 8]
cmp eax, 0xa
jle 0x47a8a2
mov ecx, dword [ebp - 8]
sub ecx, 6
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
xor eax, eax
mov ax, word [edx]
cmp eax, 0x3830
jne 0x47a8a2
mov ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
cmp edx, 0x2e
je 0x47a85a
mov eax, dword [ebp - 0xc]
movsx ecx, byte [eax]
cmp ecx, 0x30
jl 0x47a84b
mov edx, dword [ebp - 0xc]
movsx eax, byte [edx]
cmp eax, 0x39
jle 0x47a84f
xor eax, eax
jmp 0x47a8a4
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
jmp 0x47a82a
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
jne 0x47a8a2
push 0x104
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 4]
sub edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x47a8a2
mov eax, 1
jmp 0x47a8a4
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x47ba2b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4418
push 0x4a7764
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
jne 0x47ba7e
jmp 0x47bbcc
push 1
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042b751
add esp, 0xc
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x47ba9e
jmp 0x47bbcc
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jne 0x47babd
mov dword [ebp - 4], 0xffffffff
jmp 0x47bbcc
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp - 0x34]
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 0
jne 0x47badb
mov dword [ebp - 4], 0xffffffff
jmp 0x47bbcc
mov eax, dword [ebp - 0x34]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
jne 0x47bb03
mov edx, dword [ebp - 0x20]
cmp dword [edx], 0x4550
jne 0x47bb03
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jne 0x47bb0f
mov dword [ebp - 4], 0xffffffff
jmp 0x47bbcc
mov edx, dword [ebp - 0x20]
xor eax, eax
mov ax, word [edx + 6]
cmp eax, 6
jl 0x47bb30
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x47bbcc
mov ecx, dword [ebp - 0x20]
xor edx, edx
mov dx, word [ecx + 0x14]
mov eax, dword [ebp - 0x20]
lea ecx, [eax + edx + 0x18]
mov dword [ebp - 0x28], ecx
cmp dword [ebp - 0x28], 0
jne 0x47bb52
mov dword [ebp - 4], 0xffffffff
jmp 0x47bbcc
mov dword [ebp - 0x2c], 0
jmp 0x47bb64
mov edx, dword [ebp - 0x2c]
add edx, 1
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov cx, word [eax + 6]
cmp dword [ebp - 0x2c], ecx
jge 0x47bbb3
push 4
push str..bad
mov edx, dword [ebp - 0x28]
push edx
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x47bb99
mov dword [ebp - 0x30], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x47bbcc
mov eax, dword [ebp - 0x28]
add eax, 0x28
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x47bbb1
mov dword [ebp - 4], 0xffffffff
jmp 0x47bbcc
jmp 0x47bb5b
mov dword [ebp - 4], 0xffffffff
jmp 0x47bbcc
cmp dword [ebp - 0x24], 0
je 0x47bbde
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.0042b816
add esp, 4
cmp dword [ebp - 0x30], 0
je 0x47bbff
mov edx, dword [ebp + 8]
push edx
call fcn.00453370
mov ecx, eax
call fcn.00453794
test eax, eax
je 0x47bbff
mov dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x47d080
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
and ecx, 0xffff
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x47d0b3
xor eax, eax
jmp 0x47d173
mov edx, dword [ebp - 0x1c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x47d0de
xor eax, eax
jmp 0x47d173
mov ecx, dword [ebp - 0x14]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x47d0f7
xor eax, eax
jmp 0x47d173
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, dword [ebp - 4]
push ecx
call sub.ntdll.dll_memcpy
add esp, 0xc
push 0
push 0
push 2
push 0
push 0
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x47d14e
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x47d15c
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
jmp 0x47d173
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x47d177
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push edi
cmp dword [0x53e6b0], 0
jne 0x47d194
mov eax, 1
jmp 0x47d2ac
mov byte [ebp - 0x14], 0
xor eax, eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x47d1be
xor eax, eax
jmp 0x47d2ac
push 1
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042a9c3
add esp, 0xc
test eax, eax
je 0x47d298
mov eax, dword [ebp + 8]
push eax
call fcn.0047d2b1
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x47d287
mov dword [ebp - 0x15c], 0
mov ecx, 0x51
xor eax, eax
lea edi, [ebp - 0x158]
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x54], ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x50]
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
push 0x104
lea edx, [ebp - 0x158]
push edx
call fcn.00409000
push 0
push 0
push 0x148
lea eax, [ebp - 0x15c]
push eax
push 0x80002014
call fcn.0047cac0
mov dword [ebp - 0x160], eax
mov ecx, dword [ebp - 0x160]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x160]
call dword [edx + 0x1c]
cmp eax, 0xffffffff
jne 0x47d27a
push str.error_driver.IoControl_error__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x47d285
push str.add_rule_ok__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x47d296
push str.error_mygetfilesize__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x47d2ac
jmp 0x47d2a7
push str.error_CalcFileMD5__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x47d2ac
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x47d2b1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0
push 0x80
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x47d2e1
or eax, 0xffffffff
jmp 0x47d30d
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x47d311
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
xor eax, eax
mov dword [ebp - 7], eax
mov word [ebp - 3], ax
mov byte [ebp - 1], al
mov word [ebp - 8], 0x3a41
mov byte [ebp - 0x110], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x114], 1
jmp 0x47d376
mov ecx, dword [ebp - 0x114]
shl ecx, 1
mov dword [ebp - 0x114], ecx
mov dl, byte [ebp - 8]
add dl, 1
mov byte [ebp - 8], dl
cmp dword [ebp - 0x114], 0
je 0x47d43f
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x114]
test eax, eax
je 0x47d43a
push 0x104
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
lea eax, [ebp - 0x110]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x110]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ntdll.dll__strnicmp]
add esp, 0xc
test eax, eax
jne 0x47d43a
lea eax, [ebp - 8]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call sub.ntdll.dll_memcpy
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
call sub.ntdll.dll_strlen
add esp, 4
push eax
lea ecx, [ebp - 0x110]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
mov edx, dword [ebp + 8]
add edx, eax
push edx
mov eax, dword [ebp + 8]
add eax, 2
push eax
call sub.ntdll.dll_memcpy
add esp, 0xc
mov ecx, dword [ebp + 8]
push ecx
call sub.ntdll.dll_strlen
add esp, 4
mov edx, dword [ebp + 8]
mov byte [edx + eax], 0
mov eax, 1
jmp 0x47d441
jmp 0x47d35f
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x47dc9d
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b4690
push 0x4a7764
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x30], ecx
cmp dword [ebp + 8], 0
jne 0x47dcd3
xor eax, eax
jmp 0x47de94
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.0040a130
add esp, 8
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x47dcf1
xor eax, eax
jmp 0x47de94
push 9
push str._system32_
mov ecx, dword [ebp - 0x1c]
sub ecx, 9
push ecx
call fcn.00415220
add esp, 0xc
test eax, eax
je 0x47dd25
push 9
push 0x533844
mov edx, dword [ebp - 0x1c]
sub edx, 9
push edx
call fcn.00415220
add esp, 0xc
test eax, eax
jne 0x47dd2c
xor eax, eax
jmp 0x47de94
mov dword [ebp - 0x20], 0
push str.wsock32.dll
mov eax, dword [ebp - 0x1c]
push eax
call fcn.00402980
add esp, 8
test eax, eax
jne 0x47dd51
mov dword [ebp - 0x20], 1
jmp 0x47dd76
push str.usp10.dll
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00402980
add esp, 8
test eax, eax
jne 0x47dd6f
mov dword [ebp - 0x20], 2
jmp 0x47dd76
xor eax, eax
jmp 0x47de94
cmp dword [ebp + 0xc], 0
jne 0x47dd86
mov eax, 0xfffffffe
jmp 0x47de94
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
jne 0x47de71
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp + 0xc]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov dx, word [ecx + 6]
test edx, edx
je 0x47de71
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0x4550
jne 0x47de71
mov ecx, dword [ebp - 0x2c]
xor edx, edx
mov dx, word [ecx + 0x18]
cmp edx, 0x10b
jne 0x47de71
cmp dword [ebp - 0x20], 1
jne 0x47de38
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.0047d653
test eax, eax
jne 0x47de25
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.0047d8bb
test eax, eax
je 0x47de36
push 1
call fcn.00435f52
add esp, 4
mov dword [ebp - 0x24], 1
jmp 0x47de71
cmp dword [ebp - 0x20], 2
jne 0x47de71
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp - 0x30]
call fcn.0047da69
test eax, eax
je 0x47de71
push 1
call fcn.00435f52
add esp, 4
mov dword [ebp - 0x24], 4
mov dword [0x53e6b4], 1
mov dword [ebp - 4], 0xffffffff
jmp 0x47de91
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x47e2e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b48c0
push 0x4a7764
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xfffffed0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x140], ecx
mov dword [ebp - 0x128], 0
mov byte [ebp - 0x124], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x123]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x130], 0
push 0x104
lea eax, [ebp - 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp + eax - 0x124]
mov dword [ebp - 0x130], ecx
push str.inf_svchoct.exe
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x124]
sub edx, eax
mov ecx, 0x104
sub ecx, edx
push ecx
mov edx, dword [ebp - 0x130]
push edx
call fcn.00409000
lea eax, [ebp - 0x124]
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
jne 0x47e3a1
xor eax, eax
jmp 0x47e549
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x12c], 0
lea ecx, [ebp - 0x124]
push ecx
call fcn.00429c3f
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x47e3dc
cmp dword [ebp - 0x1c], 0x32000
jb 0x47e3dc
cmp dword [ebp - 0x1c], 0x3e800
jbe 0x47e3e3
xor eax, eax
jmp 0x47e549
push 1
push 0
lea edx, [ebp - 0x124]
push edx
call fcn.0042b751
add esp, 0xc
mov dword [ebp - 0x12c], eax
cmp dword [ebp - 0x12c], 0
jne 0x47e40c
xor eax, eax
jmp 0x47e549
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x12c]
push eax
call fcn.0042a900
add esp, 4
test eax, eax
jne 0x47e435
mov dword [ebp - 0x128], 0
jmp 0x47e511
mov ecx, dword [ebp - 0x12c]
mov edx, dword [ebp - 0x12c]
add edx, dword [ecx + 0x3c]
mov dword [ebp - 0x134], edx
mov eax, dword [ebp - 0x134]
xor ecx, ecx
mov cx, word [eax + 6]
cmp ecx, 3
je 0x47e46a
mov dword [ebp - 0x128], 0
jmp 0x47e511
mov edx, dword [ebp - 0x134]
xor eax, eax
mov ax, word [edx + 0x14]
mov ecx, dword [ebp - 0x134]
lea edx, [ecx + eax + 0x68]
mov dword [ebp - 0x13c], edx
mov eax, dword [ebp - 0x13c]
cmp dword [eax], 0x7275782e
je 0x47e4a0
mov dword [ebp - 0x128], 0
jmp 0x47e511
mov ecx, dword [ebp - 0x134]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x138], edx
mov eax, dword [ebp - 0x13c]
mov ecx, dword [ebp - 0x138]
cmp ecx, dword [eax + 0xc]
jb 0x47e4da
mov edx, dword [ebp - 0x13c]
mov eax, dword [edx + 0xc]
mov ecx, dword [ebp - 0x13c]
add eax, dword [ecx + 8]
cmp dword [ebp - 0x138], eax
jbe 0x47e4e6
mov dword [ebp - 0x128], 0
jmp 0x47e511
mov edx, dword [ebp + 0xc]
push edx
push 0x6b
lea eax, [ebp - 0x124]
push eax
mov ecx, dword [ebp - 0x140]
push ecx
call dword [ebp + 8]
mov dword [ebp - 0x128], 1
xor edx, edx
test edx, edx
jne 0x47e413
mov dword [ebp - 4], 0xffffffff
jmp 0x47e534
mov eax, dword [ebp - 0x12c]
push eax
call fcn.0042b816
add esp, 4
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x47e55c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
push edi
mov dword [ebp - 0x36c], ecx
mov dword [ebp - 0x228], 0
mov byte [ebp - 0x110], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
mov byte [ebp - 0x21c], 0
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x21b]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x220], 0x105
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x110]
push ecx
lea edx, [ebp - 4]
push edx
push 0x534238
push 0x534240
push SysStringLen
call fcn.00442b70
mov ecx, eax
call fcn.00442d8a
test eax, eax
je 0x47e5e4
xor eax, eax
jmp 0x47e755
cmp dword [ebp - 4], 1
jne 0x47e5f3
cmp dword [ebp - 0x220], 0
jne 0x47e5fa
xor eax, eax
jmp 0x47e755
lea eax, [ebp - 0x110]
push eax
call sub.ntdll.dll_strlen
add esp, 4
mov dword [ebp - 0x114], eax
mov ecx, dword [ebp - 0x114]
lea edx, [ebp + ecx - 0x110]
mov dword [ebp - 0x224], edx
mov eax, dword [ebp - 0x114]
movsx ecx, byte [ebp + eax - 0x111]
cmp ecx, 0x3b
jne 0x47e652
mov edx, dword [ebp - 0x114]
mov byte [ebp + edx - 0x111], 0
mov eax, dword [ebp - 0x224]
sub eax, 1
mov dword [ebp - 0x224], eax
mov ecx, dword [ebp - 0x224]
mov byte [ecx], 0x5c
mov edx, dword [ebp - 0x224]
add edx, 1
mov dword [ebp - 0x224], edx
push 0x534284
mov eax, 0x105
sub eax, dword [ebp - 0x220]
push eax
mov ecx, dword [ebp - 0x224]
push ecx
call fcn.00409000
lea edx, [ebp - 0x368]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x47e6ab
xor eax, eax
jmp 0x47e755
mov ecx, dword [ebp - 0x368]
and ecx, 0x10
test ecx, ecx
je 0x47e6ba
jmp 0x47e72c
push str.IEXPLORE.EXE
lea edx, [ebp - 0x33c]
push edx
call fcn.0041bc90
add esp, 8
test eax, eax
je 0x47e6ea
push str.iedw.exe
lea eax, [ebp - 0x33c]
push eax
call fcn.0041bc90
add esp, 8
test eax, eax
jne 0x47e6ec
jmp 0x47e72c
lea ecx, [ebp - 0x33c]
push ecx
push 0x104
mov edx, dword [ebp - 0x224]
push edx
call fcn.00415330
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x110]
push edx
mov ecx, dword [ebp - 0x36c]
call fcn.0047e75c
test eax, eax
je 0x47e72c
mov dword [ebp - 0x228], 1
lea eax, [ebp - 0x368]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x47e6ab
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x228]
pop edi
mov esp, ebp
pop ebp
ret 8
Function at 0x47ef75
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0042b4af
add esp, 4
test eax, eax
jne 0x47efa8
jmp 0x47f170
push 1
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0042b751
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x47efc8
jmp 0x47f16e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x47efd9
jmp 0x47f16c
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x3c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
cmp dword [ebp - 8], 0
jne 0x47eff0
jmp 0x47f16a
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov cx, word [eax]
cmp ecx, 0x5a4d
jne 0x47f018
mov edx, dword [ebp - 8]
cmp dword [edx], 0x4550
jne 0x47f018
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jne 0x47f01d
jmp 0x47f168
mov edx, dword [ebp - 8]
xor eax, eax
mov ax, word [edx + 0x14]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x47f03b
jmp 0x47f166
push 5
push 0x53437c
mov eax, dword [ebp - 0x10]
push eax
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
je 0x47f05e
mov dword [ebp - 0x14], 1
jmp 0x47f164
push 5
push str.Upack
mov ecx, dword [ebp - 0x10]
push ecx
call sub.ntdll.dll_memcmp
add esp, 0xc
test eax, eax
jne 0x47f08a
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x10], 0
jne 0x47f08a
mov dword [ebp - 0x14], 1
jmp 0x47f162
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x31585055
jne 0x47f0a1
mov dword [ebp - 0x14], 1
jmp 0x47f160
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x28]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x3c], 0x40
jb 0x47f0cf
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ecx + 0x2c]
jb 0x47f0cf
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x2c]
mov edx, dword [ebp - 8]
add ecx, dword [edx + 0x1c]
cmp dword [ebp - 0x1c], ecx
jbe 0x47f0db
mov dword [ebp - 0x14], 1
jmp 0x47f15e
mov eax, dword [ebp - 8]
xor ecx, ecx
mov cx, word [eax + 6]
cmp ecx, 1
jle 0x47f124
mov edx, dword [ebp - 8]
xor eax, eax
mov ax, word [edx + 6]
sub eax, 1
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x10]
add ecx, eax
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edx + 0x14]
jbe 0x47f124
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x24]
and edx, 0x80000000
test edx, edx
je 0x47f124
mov dword [ebp - 0x14], 1
jmp 0x47f15c
cmp dword [ebp - 0xc], 0
je 0x47f136
mov eax, dword [ebp - 0xc]
push eax
call fcn.0042b816
add esp, 4
cmp dword [ebp - 0x14], 0
je 0x47f157
mov ecx, dword [ebp + 8]
push ecx
call fcn.00453370
mov ecx, eax
call fcn.00453794
test eax, eax
je 0x47f157
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x14]
jmp 0x47f172
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
jmp 0x47f124
mov esp, ebp
pop ebp
ret 4