joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467388
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x134], eax
mov dword [ebp - 0x138], eax
mov dword [ebp - 4], eax
lea edi, [ebp - 0x130]
xor eax, eax
push ebp
push 0x46749a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
call fcn.004668b8
test al, al
je 0x4673cf
mov byte [ebp - 5], 1
jmp 0x467474
push 0
push 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [edi], 0x128
push edi
push esi
call sub.kernel32.dll_Process32First
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x46746a
mov eax, dword [edi + 8]
call fcn.00466e9c
test al, al
je 0x467401
mov byte [ebp - 5], 1
jmp 0x46746e
lea edx, [ebp - 4]
mov eax, dword [edi + 8]
call fcn.00466cf4
cmp dword [ebp - 4], 0
je 0x46745d
lea eax, [ebp - 0x138]
lea edx, [edi + 0x24]
mov ecx, 0x104
call fcn.00405638
mov ecx, dword [ebp - 0x138]
lea eax, [ebp - 0x134]
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x134]
call fcn.00466ba8
test al, al
je 0x46745d
push 0
mov eax, dword [edi + 8]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push edi
push esi
call sub.kernel32.dll_Process32Next
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x4673ef
push esi
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4674a1
lea eax, [ebp - 0x138]
mov edx, 2
call fcn.004053ec
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x467570
Capabilities:
Parse pe header

Disassembly:
push ebx
push esi
xor ecx, ecx
mov eax, dword [0x6377f8]
test eax, eax
je 0x4675b3
movzx edx, word [eax]
not dx
cmp dx, 0x5a4d
je 0x4675b3
mov esi, eax
mov edx, esi
mov ebx, dword [eax + 0x3c]
add edx, ebx
mov edx, dword [edx]
not edx
cmp edx, 0x4550
je 0x4675b3
mov edx, ebx
add edx, 0x18
add edx, 0x34
sub edx, 8
add edx, 0x14
add edx, esi
mov eax, edx
mov ecx, dword [eax]
mov eax, ecx
pop esi
pop ebx
ret
Function at 0x46f1e4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov dword [ebp - 8], edx
mov ebx, eax
mov eax, dword [ebp - 8]
call fcn.00405848
xor eax, eax
push ebp
push 0x46f289
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x1c]
mov edx, dword [ebp - 8]
call fcn.00467e08
mov esi, dword [ebx + 0x1c]
mov dword [esi + 0x53c], ebx
mov dword [esi + 0x538], 0x46f14c
mov dword [esi + 0x544], ebx
mov dword [esi + 0x540], 0x46f1ac
lea eax, [ebp - 0x10]
push eax
push 0
push esi
push 0x46f164
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [ebp - 4], eax
push ebp
call fcn.0046f1c0
pop ecx
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetExitCodeThread
cmp dword [ebp - 0xc], 0
je 0x46f273
mov eax, ebx
call fcn.0046f048
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46f290
lea eax, [ebp - 8]
call fcn.004053c8
ret

Function at 0x47089c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov edi, eax
mov dword [0x48ebd0], 0xffffffff
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
mov ebx, 0xff
jmp 0x4708e0
cmp dword [0x48ebd0], 0
je 0x4708f2
mov eax, edi
call fcn.00470808
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, ebp
jbe 0x4708e0
mov ebx, 0x102
jmp 0x4708f2
cmp ebx, 0xff
jne 0x4708f2
mov eax, dword [0x6339ec]
cmp byte [eax], 0
je 0x4708bc
xor eax, eax
mov dword [0x48ebd0], eax
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x473e8c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], edx
mov ebx, eax
or ebp, 0xffffffff
cmp dword [esp], 0x32
jne 0x473f6c
mov esi, ebx
movzx eax, word [esi + 2]
cmp ax, 0x2417
jbe 0x473f6c
cmp ax, 0x241d
jae 0x473f6c
push 0x32
call fcn.004070d8
pop ecx
mov esi, eax
mov ecx, 0x32
mov edx, ebx
mov eax, esi
call fcn.00408388
movzx ebp, word [esi + 2]
sub ebp, 0x2012
sub ebp, 6
sub ebp, 0x400
dec ebp
cmp ebp, 0xffffffff
jne 0x473f41
mov dword [esp + 4], 4
mov ebx, 0x63c8cc
mov eax, dword [ebx]
call fcn.00473c64
push 0x32
call fcn.004070d8
pop ecx
mov edi, eax
mov ecx, 0x32
mov edx, esi
mov eax, edi
call fcn.00408388
mov eax, dword [ebx]
mov edx, edi
call fcn.004240ac
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebx]
mov dword [edx + 4], eax
add ebx, 4
dec dword [esp + 4]
jne 0x473efd
push esi
call fcn.004070e8
pop ecx
jmp 0x473f6c
mov eax, ebp
sub eax, 4
jae 0x473f67
mov eax, dword [ebp*4 + 0x63c8cc]
mov edx, esi
call fcn.004240ac
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [ebp*4 + 0x63c8cc]
mov dword [edx + 4], eax
jmp 0x473f6c
mov ebp, 0xfffffffe
mov eax, ebp
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x475a74
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48ec58], ax
cmp byte [0x48ec54], 0
jne 0x475a89
xor ebx, ebx
jmp 0x475aec
call fcn.00475a38
push esp
push 0
push 0
push 0x475594
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x475ae0
cmp dword [0x48ec50], 0
je 0x475ac1
push 0x64
mov eax, dword [0x48ec50]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x475aa7
cmp dword [0x48ec64], 0
jbe 0x475ad2
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48ec64]
jmp 0x475aec
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.0047517c
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x476e84
Capabilities:
Create thread

Disassembly:
push ebx
push ecx
mov word [0x48ed40], ax
cmp byte [0x48ed3c], 0
jne 0x476e99
xor ebx, ebx
jmp 0x476efc
call fcn.00476e48
push esp
push 0
push 0
push 0x4769a4
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov ebx, eax
test ebx, ebx
je 0x476ef0
cmp dword [0x48ed38], 0
je 0x476ed1
push 0x64
mov eax, dword [0x48ed38]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x476eb7
cmp dword [0x48ed4c], 0
jbe 0x476ee2
push 0xffffffffffffffff
push ebx
call sub.kernel32.dll_WaitForSingleObject
push ebx
call sub.kernel32.dll_CloseHandle_1
mov ebx, dword [0x48ed4c]
jmp 0x476efc
call sub.kernel32.dll_GetLastError_1
mov ebx, eax
call fcn.0047658c
mov eax, ebx
pop edx
pop ebx
ret
Function at 0x477674
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x477830
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [eax + 0x28], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 0
xor eax, eax
push ebp
push 0x477800
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x47764c]
call fcn.004068bc
add esp, 4
test esi, esi
je 0x4776f7
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00477dd8
jmp 0x47773c
mov ebx, 0x41
lea eax, [ebp - 0x14]
mov edx, ebx
call fcn.004055b0
lea eax, [ebp - 0x14]
mov edx, 0x477848
call fcn.00405694
mov esi, dword [ebp - 0x14]
push esi
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
jne 0x477736
lea eax, [ebp - 0x18]
mov edx, esi
call fcn.004055c0
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00477dd8
inc ebx
cmp ebx, 0x5b
jne 0x4776fc
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 0
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x47778b
inc esi
xor ebx, ebx
mov edx, dword [0x4775b4]
xor eax, eax
call fcn.00423fa4
mov edi, eax
mov eax, dword [ebp - 4]
mov dword [eax + ebx*4], edi
mov eax, dword [ebp - 8]
mov dword [edi + 0x6c], eax
lea eax, [edi + 0x30]
push eax
push 4
push edi
push 0x4775f0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
mov edx, dword [ebp - 4]
mov edx, dword [edx + ebx*4]
mov dword [edx + 0x20], eax
inc ebx
dec esi
jne 0x47774e
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4777ac
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.004252a4
push 1
call sub.kernel32.dll_Sleep_1
inc ebx
dec esi
jne 0x477796
mov esi, dword [ebp - 0xc]
dec esi
test esi, esi
jl 0x4777d1
inc esi
xor ebx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.004252fc
mov eax, dword [ebp - 4]
mov eax, dword [eax + ebx*4]
call fcn.00423fc4
inc ebx
dec esi
jne 0x4777b7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477807
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x1c]
call fcn.00477e40
mov eax, dword [ebp - 8]
mov byte [eax + 0x44], 1
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x24], edx
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 1
ret
Function at 0x478474
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x478691
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x4786a8
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x14c]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x478666
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
cmp dword [ebp - 0x150], 0
jne 0x478560
push dword [ebp - 4]
push 0x4786b8
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 8]
call fcn.004783a4
jmp 0x47859f
push dword [ebp - 4]
push 0x4786b8
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 8]
call fcn.004783a4
push 0x20
mov eax, dword [ebp - 8]
call fcn.00405858
mov ebx, eax
push ebx
call sub.kernel32.dll_SetFileAttributesA
lea eax, [ebp - 0x148]
call fcn.00478444
test al, al
je 0x4785ca
mov eax, dword [ebp - 8]
call fcn.00478474
jmp 0x4785d0
push ebx
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x148]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x478500
push esi
call sub.kernel32.dll_FindClose_1
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
mov eax, dword [ebp - 4]
test eax, eax
je 0x47860b
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp byte [edx + eax - 1], 0x5c
je 0x478666
lea eax, [ebp - 0x164]
mov ecx, 0x4786b8
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x164]
call fcn.00405858
call fcn.0042304c
test al, al
je 0x478666
lea eax, [ebp - 0x168]
mov ecx, 0x4786b8
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x168]
call fcn.00405858
push eax
call sub.kernel32.dll_RemoveDirectoryA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x478698
lea eax, [ebp - 0x168]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x4787c8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x478846
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
xor eax, eax
call fcn.004030d0
mov esi, 0x42
mov ebx, 0x48ed6c
push dword [ebp - 4]
push 0x47885c
lea eax, [ebp - 0xc]
mov edx, dword [ebx]
call fcn.004055c0
push dword [ebp - 0xc]
lea eax, [ebp - 8]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 8]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
add ebx, 4
dec esi
jne 0x4787f5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47884d
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004053ec
ret
Function at 0x4794a4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, 0x63c974
push 0xffffffffffffffff
push 0xffffffffffffffff
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetProcessWorkingSetSize
mov eax, dword [0x633bf4]
mov eax, dword [eax]
call fcn.00425b88
cmp dword [esi], 0
je 0x47954a
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x633974]
sub eax, dword [edx]
cmp eax, 0xea60
jbe 0x479538
mov eax, dword [0x6339ec]
mov byte [eax], 1
nop
mov eax, dword [0x633d40]
mov byte [eax], 0
mov eax, dword [0x6339f0]
mov eax, dword [eax]
mov byte [eax + 0x1c], 0
mov eax, dword [0x63414c]
mov byte [eax], 1
push 0
mov eax, dword [0x633f60]
mov eax, dword [eax]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
push 0x30
push 0x479550
push 0x479558
push ebx
call sub.user32.dll_MessageBoxA_1
mov eax, dword [0x63414c]
mov byte [eax], 0
push 1
mov eax, dword [esi]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x4794ad
pop esi
pop ebx
ret

Function at 0x4795f4
Capabilities:
Copy file
Create thread
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x479732
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x633d48]
cmp dword [eax], 0
je 0x479636
mov eax, dword [ebp - 4]
call fcn.00405858
call fcn.00423080
test al, al
jne 0x47969d
mov eax, 0x7d0
call fcn.0040344c
lea edx, [ebp - 0xc]
call fcn.00422578
mov edx, dword [ebp - 0xc]
mov eax, dword [0x633d48]
mov ecx, 0x479748
call fcn.004056e0
push 0x20
mov eax, dword [0x633d48]
mov eax, dword [eax]
call fcn.00405858
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [0x633d48]
mov eax, dword [eax]
call fcn.00405858
push eax
call sub.kernel32.dll_DeleteFileA
push 0xffffffffffffffff
mov eax, dword [0x633d48]
mov eax, dword [eax]
call fcn.00405858
push eax
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_CopyFileA
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x63c974], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x63c978], eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [0x633d48]
mov eax, dword [eax]
push eax
push 0x4792e0
push 0
push 0
call sub.kernel32.dll_CreateThread_1
test eax, eax
je 0x479714
push eax
call sub.kernel32.dll_CloseHandle_1
cmp dword [0x63c978], 0
je 0x47970d
mov eax, dword [0x633bf4]
mov eax, dword [eax]
call fcn.00425b88
push 0x64
mov eax, dword [0x63c978]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
jne 0x4796e7
movzx ebx, byte [0x48ee74]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479739
lea eax, [ebp - 0xc]
call fcn.004053c8
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x479750
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x479912
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
mov ecx, 0x479928
mov edx, dword [ebp - 4]
call fcn.004056e0
mov eax, dword [ebp - 0x14c]
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4798e7
lea eax, [ebp - 0x150]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
cmp dword [ebp - 0x150], 0
jne 0x47983a
push dword [ebp - 4]
push 0x479938
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
push dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x154]
lea edx, [ebp - 8]
call fcn.00464c68
jmp 0x479879
push dword [ebp - 4]
push 0x479938
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x18]
mov ecx, 0xe
call fcn.00405638
push dword [ebp - 0x160]
lea eax, [ebp - 0x15c]
mov edx, 3
call fcn.0040575c
mov eax, dword [ebp - 0x15c]
lea edx, [ebp - 8]
call fcn.00464c68
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.00405638
mov eax, dword [ebp - 0x168]
lea edx, [ebp - 0x164]
call fcn.004227b8
mov edx, dword [ebp - 0x164]
mov eax, 0x479944
call fcn.004059a4
test eax, eax
jne 0x4798cc
push 0x20
mov eax, dword [ebp - 8]
call fcn.00405858
mov esi, eax
push esi
call sub.kernel32.dll_SetFileAttributesA
push esi
call sub.kernel32.dll_DeleteFileA
lea eax, [ebp - 0x148]
push eax
push ebx
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x4797da
push ebx
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x479919
lea eax, [ebp - 0x168]
mov edx, 8
call fcn.004053ec
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret

Function at 0x47a1bc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
xor eax, eax
push ebp
push 0x47a228
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 0x24
mov ebx, 0x53242c
push 0x20
lea eax, [ebp - 8]
mov edx, dword [ebx]
call fcn.004055c0
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x47a240
call fcn.004056e0
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_SetFileAttributesA
add ebx, 4
dec esi
jne 0x47a1dd
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a22f
lea eax, [ebp - 8]
mov edx, 2
call fcn.004053ec
ret
Function at 0x47b3f8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403aec
ret

Function at 0x47b52c
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47b67a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.0047b3f8
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x47b659
xor eax, eax
push ebp
push 0x47b652
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x47b63b
xor eax, eax
push ebp
push 0x47b634
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47b61d
xor eax, eax
push ebp
push 0x47b616
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize_1
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.0047b430
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b61d
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b63b
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b659
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle_1
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0047b4b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b681
lea eax, [ebp - 4]
call fcn.004053c8
ret
Function at 0x47b7f4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 0x10
add esp, 0xfffff004
push eax
dec eax
jne 0x47b7fd
mov eax, dword [ebp - 4]
add esp, 0xfffffebc
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47b8d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x633f50]
mov byte [eax], 0
mov dword [ebx], 0xffffffff
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x154]
call fcn.004037a0
mov edx, 1
lea eax, [ebp - 0x154]
call fcn.00403c90
call fcn.00403148
test eax, eax
jne 0x47b8b4
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x10145]
mov ecx, 0xfff1
lea eax, [ebp - 0x154]
call fcn.00403908
movzx edx, word [ebp - 8]
test dx, dx
jbe 0x47b8ae
lea eax, [ebp - 0x10145]
movzx ecx, byte [eax]
mov esi, dword [ebx]
and esi, 0xff
xor ecx, esi
mov ecx, dword [ecx*4 + 0x532514]
mov esi, dword [ebx]
shr esi, 8
xor ecx, esi
mov dword [ebx], ecx
inc eax
dec dx
jne 0x47b88b
cmp dword [ebp - 8], 0
jne 0x47b862
lea eax, [ebp - 0x154]
call fcn.00403948
not dword [ebx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b8de
lea eax, [ebp - 4]
call fcn.004053c8
ret

Function at 0x47b958
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00405848
xor eax, eax
push ebp
push 0x47ba1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00405858
push eax
call sub.kernel32.dll_CreateFileA_1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x47b9ec
xor eax, eax
push ebp
push 0x47b9e5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetFileSize_1
xor edx, edx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], edx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b9ec
mov eax, dword [ebp - 0x14]
call fcn.00425658
ret
cmp dword [ebp - 0xc], 0
jne 0x47ba06
cmp dword [ebp - 0x10], 0xffffffff
jne 0x47ba06
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ba23
lea eax, [ebp - 4]
call fcn.004053c8
ret