joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454b70
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00454cc0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x454b90
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x454b71
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.00454cc0
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x454b90
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x454bc0
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x454c17
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x454c2d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.00454c50
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x454c50
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x454ce0
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x454d29
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x455370
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4eff50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00454d50
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00454dd0
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00454dd0
lea ecx, [esi + 0xc]
call fcn.004e0fc9
lea ecx, [esi + 0x10]
call fcn.004e0fc9
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00457950
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00457950
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00457950
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004e103e
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004e103e
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x456198
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f0178
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x4561a8
call fcn.004566c0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x45628b
cmp byte [edi], 0
je 0x45628b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x4561cd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.00454b70
test eax, eax
jne 0x4561ed
push 0x5e08e4
lea ecx, [esi + 0x38]
call fcn.004e117b
jmp 0x45628b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.00454bc0
test eax, eax
jne 0x45621c
mov ecx, esi
call fcn.00454cc0
push edi
add esi, 0x38
push 0x5e08c0
push esi
call fcn.004dec1a
add esp, 0xc
jmp 0x45628b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.00456f40
test eax, eax
je 0x456284
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.00456360
test eax, eax
jne 0x4562a0
push edi
lea eax, [esi + 0x38]
push 0x5e089c
push eax
call fcn.004dec1a
add esp, 0xc
mov ecx, esi
call fcn.004566c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x456348
mov ecx, dword [0x5e95b8]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.004dec1a
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.00454c70
test eax, eax
jne 0x45630a
push 0x5e0880
lea ecx, [esi + 0x38]
call fcn.004e117b
jmp 0x45631a
push 0xfa
mov ecx, esi
call fcn.00456f40
test eax, eax
jne 0x456337
mov ecx, esi
call fcn.004566c0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004e103e
jmp 0x45628b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.004e103e
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x45ea90
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f06e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
push ebx
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.0047a4a0
lea ecx, [esp + 0x20]
mov dword [esp + 0x38], 0
call fcn.0047a4a0
mov eax, dword [esp + 0x48]
lea ecx, [esp + 0x10]
push eax
mov byte [esp + 0x3c], 1
call fcn.0045eea0
lea ecx, [esp + 0x10]
call fcn.0042bc50
cmp eax, 1
jae 0x45eb38
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0
push 0
call ebx
mov edi, eax
test edi, edi
je 0x45eba3
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x45eba3
push esi
push edi
call ebx
push esi
lea ecx, [esp + 0x14]
call fcn.0045eea0
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [esp + 0x10]
call fcn.0042bc50
cmp eax, 1
jb 0x45eba3
lea edx, [esp + 0x10]
mov ecx, ebp
push edx
call fcn.0045e930
test eax, eax
je 0x45eba3
lea eax, [esp + 0x10]
mov ecx, ebp
push eax
call fcn.0045ec10
mov edi, dword [esp + 0x44]
xor esi, esi
lea ecx, [esp + 0x10]
push ecx
lea ecx, [esp + 0x24]
call fcn.0045ef00
push edi
lea ecx, [esp + 0x24]
call fcn.0047a4d0
push esi
lea ecx, [esp + 0x24]
call fcn.0045ef20
push str..tmp
lea ecx, [esp + 0x24]
call fcn.0047a4d0
lea edx, [esp + 0x20]
mov ecx, ebp
push edx
call fcn.0045e910
test eax, eax
je 0x45ebd9
inc esi
cmp esi, 0x7a0a1f00
jb 0x45eb5a
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.0047a4c0
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047a4c0
xor eax, eax
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x2c
ret 0xc
mov ecx, dword [esp + 0x40]
lea eax, [esp + 0x20]
push eax
call fcn.0045ef00
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 0
call fcn.0047a4c0
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0xffffffff
call fcn.0047a4c0
mov eax, 1
jmp 0x45ebc4
Function at 0x45f120
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f0798
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0xc]
call fcn.0047a4a0
mov eax, dword [esp + 0x30]
lea ecx, [esp + 0xc]
push eax
mov dword [esp + 0x28], 0
call fcn.0045eea0
push 0
mov ecx, esi
call fcn.0045f0a0
mov ebx, dword [esp + 0x2c]
cmp ebx, 1
jb 0x45f258
lea ecx, [esp + 0xc]
call fcn.0042bc50
cmp eax, 1
jae 0x45f1a7
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0047a4c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
mov eax, dword [esp + 0x34]
lea edi, [esi + 0xc]
test eax, eax
jne 0x45f1f4
push 0
lea ecx, [esp + 0x10]
call fcn.00439630
push eax
push edi
mov ecx, 0x61e9a4
call fcn.0045ea90
test eax, eax
jne 0x45f1fc
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0047a4c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
push eax
mov ecx, edi
call fcn.0045eea0
push edi
mov ecx, 0x61e9a4
call fcn.0045e9f0
push 0
push 2
push 2
push 0
push 3
push 0xc0000000
mov ecx, edi
call fcn.0045f020
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x45f258
push 0
push ebx
push 0
push 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
test eax, eax
mov dword [esi + 4], eax
je 0x45f258
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [esi + 8], eax
jne 0x45f288
push 1
mov ecx, esi
call fcn.0045f0a0
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], 0xffffffff
call fcn.0047a4c0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc
lea ecx, [esp + 0xc]
mov dword [esi + 0x1c], ebx
mov dword [esp + 0x24], 0xffffffff
call fcn.0047a4c0
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret 0xc

Function at 0x45fc00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
mov ecx, 0x41
xor eax, eax
push edi
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 0x110]
call fcn.0045eea0
pop edi
add esp, 0x104
ret 4
Function at 0x468b60
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0
call fcn.0046efe0
mov ebp, dword [esp + 0x220]
mov eax, dword [esp + 0x21c]
push ebp
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov edi, eax
cmp edi, 0x20
ja 0x468c59
lea ecx, [esp + 0x10]
push ecx
push str..htm
push 0x80000000
mov ecx, esi
call fcn.00468c70
test eax, eax
jne 0x468c59
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push 0x80000000
mov ecx, esi
call fcn.00468c70
test eax, eax
jne 0x468c59
lea edx, [esp + 0x10]
push str.__1_
push edx
call fcn.004cfd20
mov esi, eax
add esp, 8
test esi, esi
jne 0x468c2a
lea eax, [esp + 0x10]
push 0x5e2244
push eax
call fcn.004cfd20
mov esi, eax
add esp, 8
test esi, esi
jne 0x468c2a
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x468c2d
mov byte [esi], 0
push 0x5e1a0c
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x468c70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x468cd2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x46ef20
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4f13f8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x118]
test eax, eax
jne 0x46efd0
mov eax, dword [0x5e95b8]
push esi
mov dword [esp + 8], eax
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call fcn.004e1422
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call fcn.004e1471
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call fcn.004e13ce
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x46efb7
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x46efb7
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x118], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.004e103e
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x4720d0
Capabilities:
Get number of processors

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4f1880
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
mov esi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x472277
mov ecx, dword [0x5e95b8]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x30], ecx
mov ecx, dword [eax - 8]
mov bl, 1
test ecx, ecx
mov byte [esp + 0x28], bl
jle 0x4721cc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push edi
push ecx
mov ecx, esi
call fcn.00470df0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 2
call fcn.004e112b
lea ecx, [esp + 0x14]
mov byte [esp + 0x28], bl
call fcn.004e103e
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push 0x5e1a0c
call fcn.004e10ac
lea edx, [esp + 0x14]
push 0x3d
push edx
lea eax, [esp + 0x24]
push edi
push eax
mov ecx, esi
call fcn.004711b0
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 3
call fcn.004e112b
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], bl
call fcn.004e103e
lea ecx, [esp + 0xc]
call fcn.004e1506
mov ecx, dword [esp + 0xc]
push 0x5e244c
push ecx
call fcn.004cec24
add esp, 8
test eax, eax
je 0x4721f4
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx - 8]
cmp ecx, eax
jl 0x47212d
mov esi, dword [esp + 0x34]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 0
call fcn.004e103e
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.004e103e
jmp 0x47227b
lea eax, [esp + 0x30]
mov ecx, esi
push eax
call fcn.00471e70
test eax, eax
push 0
je 0x47225f
lea ecx, [esp + 0x34]
push 0x64
push ecx
mov ecx, esi
call fcn.00470510
mov ecx, dword [esp + 0x3c]
test ecx, ecx
je 0x472245
cmp eax, 0x64
jg 0x472233
mov edx, dword [esp + 0x38]
push eax
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4721d0
push 0x64
push eax
mov eax, dword [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4721d0
cmp eax, 0x64
jge 0x4721cc
mov ecx, dword [esp + 0x34]
push 0x64
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov esi, eax
jmp 0x4721d0
mov edx, dword [esp + 0x3c]
lea eax, [esp + 0x34]
push edx
push eax
mov ecx, esi
call fcn.00470510
mov esi, eax
jmp 0x4721d0
mov esi, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
cmp esi, eax
jl 0x472285
mov eax, esi
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret 0x10
Function at 0x479e20
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x4f1b61
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x178
push ebp
mov dword [esp + 8], ecx
push esi
push edi
lea ecx, [esp + 0x24]
call fcn.0047a4a0
lea ecx, [esp + 0x34]
mov dword [esp + 0x18c], 0
call fcn.0047a4a0
lea ecx, [esp + 0x14]
mov byte [esp + 0x18c], 1
call fcn.0047a4a0
mov eax, dword [esp + 0x1a0]
mov edi, dword [esp + 0x19c]
mov ebp, dword [esp + 0x198]
cmp eax, 1
mov byte [esp + 0x18c], 2
jne 0x479e9f
mov dword [edi], 0
mov dword [ebp], 0
mov eax, dword [esp + 0x194]
lea ecx, [esp + 0x24]
push eax
call fcn.0045eea0
lea ecx, [esp + 0x24]
push ecx
call fcn.0047a880
add esp, 4
lea ecx, [esp + 0x24]
push 0x5e2c74
call fcn.0047a4d0
lea edx, [esp + 0x44]
lea ecx, [esp + 0x24]
push edx
call fcn.0045f020
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x47a024
mov esi, 0x5e2c68
lea eax, [esp + 0x70]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x479f1a
test cl, cl
je 0x479f16
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x479f1a
add eax, 2
add esi, 2
test cl, cl
jne 0x479ef6
xor eax, eax
jmp 0x479f1f
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47a008
mov esi, 0x5e2c64
lea eax, [esp + 0x70]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x479f54
test cl, cl
je 0x479f50
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x479f54
add eax, 2
add esi, 2
test cl, cl
jne 0x479f30
xor eax, eax
jmp 0x479f59
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47a008
test byte [esp + 0x44], 0x10
mov eax, dword [esp + 0x194]
push eax
jne 0x479fb1
lea ecx, [esp + 0x38]
call fcn.0045eea0
lea ecx, [esp + 0x34]
push ecx
call fcn.0047a880
add esp, 4
lea edx, [esp + 0x70]
lea ecx, [esp + 0x34]
push edx
call fcn.0047a4d0
push 0
lea ecx, [esp + 0x38]
call fcn.0045f020
push eax
call fcn.004d1af2
add esp, 8
test eax, eax
jne 0x47a008
inc dword [ebp]
jmp 0x47a008
lea ecx, [esp + 0x18]
call fcn.0045eea0
lea ecx, [esp + 0x14]
push ecx
call fcn.0047a880
add esp, 4
lea edx, [esp + 0x70]
lea ecx, [esp + 0x14]
push edx
call fcn.0047a4d0
push 0
lea ecx, [esp + 0x18]
call fcn.0045f020
push eax
call fcn.004d1af2
add esp, 8
test eax, eax
jne 0x47a008
mov ecx, dword [edi]
push eax
inc ecx
push edi
mov dword [edi], ecx
push ebp
lea ecx, [esp + 0x20]
call fcn.00439630
mov ecx, dword [esp + 0x1c]
push eax
call fcn.00479e20
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x44]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x479eed
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, dword [ebp]
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add esi, eax
mov byte [esp + 0x18c], 1
call fcn.0047a4c0
lea ecx, [esp + 0x34]
mov byte [esp + 0x18c], 0
call fcn.0047a4c0
lea ecx, [esp + 0x24]
mov dword [esp + 0x18c], 0xffffffff
call fcn.0047a4c0
mov ecx, dword [esp + 0x184]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x184
ret 0x10
Function at 0x47a7a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4f1bc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0047a4a0
mov eax, dword [esp + 0x24]
lea ecx, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.0045eea0
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
push ecx
push edx
lea ecx, [esp + 0xc]
push eax
push ecx
mov ecx, esi
call fcn.0047a6d0
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x1c], 0xffffffff
call fcn.0047a4c0
mov ecx, dword [esp + 0x14]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x1c
ret 0x10

Function at 0x47c180
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
xor ebp, ebp
push esi
cmp ebx, 1
push edi
jl 0x47c19b
cmp ebx, 8
jg 0x47c19b
mov eax, 1
jmp 0x47c19d
xor eax, eax
mov esi, dword [esp + 0x14]
push str.bad_pack_level
push eax
push esi
call fcn.0047aa00
mov eax, dword [esi + 0x6af70]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af78], ebp
jne 0x47c1d4
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
mov ecx, 0x7fff
xor eax, eax
lea edi, [esi + 0x4af70]
mov dword [esi + 0x6af6c], ebp
rep stosd dword es:[edi], eax
mov ax, word [ebx*8 + 0x5af232]
xor ecx, ecx
mov dword [esi + 0x6af98], eax
mov cx, word [ebx*8 + 0x5af230]
xor edx, edx
mov dword [esi + 0x6af9c], ecx
mov dx, word [ebx*8 + 0x5af234]
xor eax, eax
mov dword [esi + 0x6afa0], edx
mov ax, word [ebx*8 + 0x5af236]
cmp ebx, 2
mov dword [esi + 0x6af94], eax
jg 0x47c235
mov eax, dword [esp + 0x1c]
or byte [eax], 4
jmp 0x47c241
cmp ebx, 8
jl 0x47c241
mov eax, dword [esp + 0x1c]
or byte [eax], 2
lea edi, [esi + 0x1af70]
push 0x10000
push edi
push esi
mov dword [esi + 0x6af84], ebp
mov dword [esi + 0x6af74], ebp
call dword [esi + 0xc]
add esp, 0xc
cmp eax, ebp
mov dword [esi + 0x6af90], eax
je 0x47c2ba
cmp eax, 0xffffffff
je 0x47c2ba
cmp eax, 0x106
mov dword [esi + 0x6af8c], ebp
jae 0x47c285
push esi
call fcn.0047c4d0
add esp, 4
mov dword [esi + 0x6af7c], ebp
xor eax, eax
mov edx, dword [esi + 0x6af7c]
xor ecx, ecx
mov cl, byte [edi + eax]
and edx, 0x3ff
and ecx, 0x7fff
shl edx, 5
xor ecx, edx
inc eax
cmp eax, 2
mov dword [esi + 0x6af7c], ecx
jb 0x47c28d
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], ebp
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x47d550
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 8]
test ecx, ecx
jne 0x47d55b
xor eax, eax
ret
mov eax, dword [esp + 4]
push ebx
push esi
mov esi, dword [esp + 0x14]
cmp esi, 8
not eax
jb 0x47d65e
push edi
mov edi, esi
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [edx*4 + 0x5af280]
sub esi, 8
xor eax, ebx
inc ecx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5af280]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5af280]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5af280]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5af280]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov edx, dword [edx*4 + 0x5af280]
shr eax, 8
xor edx, eax
inc ecx
mov eax, edx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [ecx + 1]
mov eax, dword [eax*4 + 0x5af280]
shr edx, 8
xor eax, edx
inc ecx
mov edx, eax
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5af280]
xor eax, edx
inc ecx
dec edi
jne 0x47d576
pop edi
test esi, esi
je 0x47d680
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x5af280]
xor eax, edx
inc ecx
dec esi
jne 0x47d662
pop esi
pop ebx
not eax
ret