joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474d20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b3b99
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x6dd118]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dd118
call edx
mov edi, dword [esp + 0x2c]
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x24], esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push ebp
push esi
push 0xfde9
mov dword [esp + 0x38], 1
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jle 0x474e40
mov edi, eax
lea ebx, [esp + 0x14]
call fcn.00476490
mov dword [esp + 0x24], 2
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
xor ebx, ebx
push ebx
push ebx
push eax
push ecx
push 0xffffffffffffffff
push ebp
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp eax, 1
jle 0x474e08
mov ecx, dword [esi]
mov byte [ecx + eax - 1], bl
mov edx, dword [esi]
cmp edx, ebx
jne 0x474de8
mov ebp, dword [esp + 0x2c]
xor eax, eax
push eax
push edx
mov eax, ebp
call fcn.0040b2a2
jmp 0x474e0c
mov eax, edx
lea edi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x474df0
mov ebp, dword [esp + 0x2c]
sub eax, edi
push eax
push edx
mov eax, ebp
call fcn.0040b2a2
jmp 0x474e0c
mov ebp, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x474e2a
xor edi, edi
call fcn.004765d0
push esi
call fcn.005796d1
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x474e60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b3a29
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x6dd118]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dd118
call edx
mov edi, dword [esp + 0x2c]
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x24], esi
push esi
push esi
push 0xffffffffffffffff
push ebp
push esi
push 0xfde9
mov dword [esp + 0x30], 1
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, 1
jle 0x474f86
mov edi, eax
lea ebx, [esp + 0x14]
call fcn.00476530
mov dword [esp + 0x24], 2
mov esi, dword [esp + 0x14]
mov eax, dword [esi + 4]
mov ecx, dword [esi]
push eax
push ecx
push 0xffffffffffffffff
push ebp
xor ebx, ebx
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, 1
jle 0x474f4e
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2 - 2], dx
mov edx, dword [esi]
cmp edx, ebx
jne 0x474f27
mov ebp, dword [esp + 0x2c]
xor eax, eax
push eax
push edx
mov eax, ebp
call fcn.0040b3ac
jmp 0x474f52
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x474f30
mov ebp, dword [esp + 0x2c]
sub eax, edi
sar eax, 1
push eax
push edx
mov eax, ebp
call fcn.0040b3ac
jmp 0x474f52
mov ebp, dword [esp + 0x2c]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x474f70
xor edi, edi
call fcn.00476620
push esi
call fcn.005796d1
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x475470
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b3b39
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x44], ebx
mov ebp, dword [esp + 0x4c]
mov dword [esp + 0x14], ebx
mov eax, dword [0x6dd118]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dd118
mov dword [esp + 0x18], ebp
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x44], ebx
mov eax, 7
xor ecx, ecx
mov dword [esp + 0x34], eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], cx
cmp esi, 0xffffffff
jne 0x4754f7
call fcn.005785f1
jmp 0x4754ff
cmp esi, 0x7ffffffe
jbe 0x475508
call fcn.005785f1
mov eax, dword [esp + 0x34]
cmp eax, esi
jae 0x47553d
mov edx, dword [esp + 0x30]
push edx
push esi
lea eax, [esp + 0x24]
push eax
call fcn.0040cd36
mov eax, dword [esp + 0x34]
cmp esi, ebx
jbe 0x47559a
cmp esi, 1
jne 0x47555d
cmp eax, 8
mov eax, dword [esp + 0x20]
jae 0x475536
lea eax, [esp + 0x20]
xor edx, edx
mov word [eax], dx
jmp 0x475581
cmp esi, ebx
jne 0x475522
mov edi, 8
cmp eax, edi
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], ebx
jae 0x475556
lea eax, [esp + 0x20]
xor ecx, ecx
mov word [eax], cx
jmp 0x47559f
mov edi, dword [esp + 0x20]
cmp eax, 8
jae 0x47556a
lea edi, [esp + 0x20]
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x30], esi
jae 0x475594
lea eax, [esp + 0x20]
xor ecx, ecx
mov word [eax + esi*2], cx
mov edi, 8
mov dword [esp + 0x44], 2
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], edi
jae 0x4755b5
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x50]
lea edx, [esp + 0x54]
push edx
mov edx, dword [esp + 0x34]
push ecx
push 0xffffffffffffffff
push edx
push eax
call fcn.0057ae8a
mov esi, eax
add esp, 0x14
cmp esi, ebx
jle 0x4755f4
cmp esi, dword [esp + 0x30]
jbe 0x4755e0
call fcn.0057a4ca
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], edi
jae 0x4755ee
lea eax, [esp + 0x20]
xor ecx, ecx
mov word [eax + esi*2], cx
cmp dword [esp + 0x34], edi
jb 0x475608
mov eax, dword [esp + 0x20]
mov edx, eax
cmp eax, ebx
jne 0x47560c
xor eax, eax
jmp 0x475620
lea edx, [esp + 0x20]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x475611
sub eax, esi
sar eax, 1
push eax
push edx
mov eax, ebp
call fcn.0040b3ac
mov byte [esp + 0x44], bl
cmp dword [esp + 0x34], edi
jb 0x475640
mov edx, dword [esp + 0x20]
push edx
call fcn.005796d1
add esp, 4
xor eax, eax
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebx
mov word [esp + 0x20], ax
mov eax, ebp
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.005796dc
add esp, 0x34
ret
Function at 0x4757c0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5b3a79
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x6c56f8]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x5c]
mov ebp, dword [esp + 0x58]
mov dword [esp + 0x20], ebx
mov edx, dword [0x6dd118]
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0xc]
mov ecx, 0x6dd118
mov dword [esp + 0x24], ebp
call eax
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x50], ebx
mov eax, dword [esp + 0x60]
push ebx
cdq
push 2
push edx
push eax
mov dword [esp + 0x30], 1
call fcn.0057f080
mov esi, eax
add esi, 1
adc edx, ebx
mov eax, esi
add eax, 0x80000000
adc edx, ebx
mov dword [esp + 0x1c], edx
jne 0x475858
cmp eax, 0xffffffff
jbe 0x475862
push 0x80004005
call fcn.00402d79
cmp esi, ebx
jle 0x4759ac
lea edi, [esi + 1]
mov eax, 0xf
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
cmp edi, 0xffffffff
jne 0x47588a
call fcn.005785f1
jmp 0x47588f
cmp edi, 0xfffffffe
jbe 0x475898
call fcn.005785f1
mov eax, dword [esp + 0x40]
cmp eax, edi
jae 0x4758c9
mov ecx, dword [esp + 0x3c]
push ecx
push edi
lea ecx, [esp + 0x30]
call fcn.0040cc0b
mov eax, dword [esp + 0x40]
cmp edi, ebx
jbe 0x475914
cmp edi, 1
jne 0x4758e6
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x4758c5
lea eax, [esp + 0x2c]
mov byte [eax], bl
jmp 0x4758fe
cmp edi, ebx
jne 0x4758b1
mov edi, 0x10
cmp eax, edi
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], ebx
jae 0x4758e2
lea eax, [esp + 0x2c]
mov byte [eax], bl
jmp 0x475919
cmp eax, 0x10
mov eax, dword [esp + 0x2c]
jae 0x4758f3
lea eax, [esp + 0x2c]
push edi
push ebx
push eax
call fcn.0057e5e0
add esp, 0xc
cmp dword [esp + 0x40], 0x10
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x3c], edi
jae 0x475911
lea eax, [esp + 0x2c]
mov byte [eax + edi], bl
mov edi, 0x10
mov dword [esp + 0x50], 2
mov eax, dword [esp + 0x2c]
mov dword [esp + 0x18], esi
cmp dword [esp + 0x40], edi
jae 0x475933
lea eax, [esp + 0x2c]
mov ecx, dword [esp + 0x60]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x18]
call fcn.0041bdf4
add esp, 4
test eax, eax
je 0x475985
mov esi, dword [esp + 0x18]
cmp esi, ebx
jl 0x475985
cmp esi, dword [esp + 0x3c]
jbe 0x47595f
call fcn.0057a4ca
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], edi
jae 0x47596d
lea eax, [esp + 0x2c]
mov byte [eax + esi], bl
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], edi
jae 0x47597e
lea eax, [esp + 0x2c]
push eax
push ebp
call fcn.0040847c
mov byte [esp + 0x50], bl
cmp dword [esp + 0x40], edi
jb 0x47599c
mov eax, dword [esp + 0x2c]
push eax
call fcn.005796d1
add esp, 4
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov eax, ebp
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.005796dc
add esp, 0x40
ret
Function at 0x476680
Capabilities:
Get token privileges

Disassembly:
push 0xffffffffffffffff
push 0x5ade2b
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x24], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4766c3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4767cf
push 0xc
call fcn.00579757
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
mov byte [esp + 0x24], 1
cmp esi, ebx
je 0x47673c
push 0x1000
push ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], 1
call fcn.0057c558
mov ecx, dword [esi + 4]
add esp, 8
mov dword [esi], eax
cmp ecx, 0x1000
jae 0x476733
mov edx, 0x1000
sub edx, ecx
push edx
add ecx, eax
push ebx
push ecx
call fcn.0057e5e0
add esp, 0xc
mov dword [esi + 4], 0x1000
jmp 0x47673e
xor esi, esi
mov byte [esp + 0x24], bl
mov dword [esp + 0x18], esi
mov byte [esp + 0x24], 2
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], eax
mov eax, dword [esi + 4]
push eax
push edi
push 3
push edx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4767a2
xor eax, eax
cmp dword [edi], ebx
jbe 0x47678e
lea ecx, [edi + 0xc]
jmp 0x476780
mov dword [ecx], 2
inc eax
add ecx, 0xc
cmp eax, dword [edi]
jb 0x476780
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebx
push ebx
push eax
push edi
push ebx
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x4767cf
cmp dword [esi + 4], ebx
je 0x4767c2
mov eax, dword [esi]
push ebx
push eax
call fcn.0057c558
add esp, 8
mov dword [esi], eax
mov dword [esi + 4], ebx
push esi
call fcn.005796d1
add esp, 4
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4767e6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x476800
Capabilities:
Access peb ldr_data
Get common file path
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x5b3a29
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x2c]
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x6dd118]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dd118
call edx
add eax, 0x10
mov dword [ebp], eax
mov dword [esp + 0x24], esi
mov edi, 0x400
lea ebx, [esp + 0x14]
mov dword [esp + 0x18], 1
call fcn.00476530
mov dword [esp + 0x24], 2
mov ecx, dword [esp + 0x30]
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
push 1
push ecx
push eax
xor ebx, ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x4768ae
mov edx, dword [esi]
cmp edx, ebx
jne 0x476891
xor eax, eax
jmp 0x4768a5
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x476896
sub eax, edi
sar eax, 1
push eax
push edx
mov eax, ebp
call fcn.0040b3ac
mov byte [esp + 0x24], bl
add dword [esi + 8], 0xffffffff
jne 0x4768cc
xor edi, edi
call fcn.00476620
push esi
call fcn.005796d1
add esp, 4
mov dword [esp + 0x14], ebx
mov eax, ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x4768f0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x5b39d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor esi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], esi
mov eax, dword [0x6dd118]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dd118
call edx
mov edi, dword [esp + 0x2c]
add eax, 0x10
mov dword [edi], eax
mov dword [esp + 0x24], esi
mov ebp, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push esi
push esi
mov dword [esp + 0x20], 1
call ebp
cmp eax, esi
je 0x4769d1
lea edi, [eax + 1]
lea ebx, [esp + 0x14]
call fcn.00476530
mov dword [esp + 0x24], 2
mov esi, dword [esp + 0x14]
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push eax
push ecx
call ebp
test eax, eax
jbe 0x4769ae
cmp eax, dword [esi + 4]
jae 0x4769ae
mov ecx, dword [esi]
xor edx, edx
mov word [ecx + eax*2], dx
mov edx, dword [esi]
test edx, edx
jne 0x47698f
xor eax, eax
jmp 0x4769a3
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x476994
sub eax, edi
sar eax, 1
push eax
mov eax, dword [esp + 0x30]
push edx
call fcn.0040b3ac
mov byte [esp + 0x24], 0
add dword [esi + 8], 0xffffffff
jne 0x4769cd
xor edi, edi
call fcn.00476620
push esi
call fcn.005796d1
add esp, 4
mov dword [esp + 0x14], edi
mov edi, dword [esp + 0x2c]
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
je 0x476a22
lea edx, [ecx - 1]
test edx, edx
jl 0x476a38
cmp edx, ecx
jg 0x476a38
movzx edx, word [eax + edx*2]
cmp dx, 0x5c
jne 0x476a22
lea esi, [ecx - 1]
mov ecx, 1
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, esi
or eax, ecx
jge 0x476a0c
mov eax, esi
mov ecx, edi
call fcn.0040cfb4
test esi, esi
jl 0x476a38
mov eax, dword [edi]
cmp esi, dword [eax - 8]
jg 0x476a38
mov dword [eax - 0xc], esi
mov eax, dword [edi]
xor ecx, ecx
mov word [eax + esi*2], cx
mov eax, edi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
push 0x80070057
call fcn.00402d79
int3
Function at 0x476db0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x5b67a2
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, dword [0x6dd118]
mov edx, dword [eax + 0xc]
mov ecx, 0x6dd118
call edx
add eax, 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 1
mov eax, 0x692054
test eax, 0xffff0000
jne 0x476e26
mov ecx, eax
movzx esi, cx
push esi
call fcn.00402e8e
add esp, 4
cmp eax, ebx
je 0x476e35
push esi
push eax
lea edx, [esp + 0x18]
push edx
call fcn.0040cec6
jmp 0x476e35
push ebx
push 0x692054
lea eax, [esp + 0x18]
call fcn.0040b3ac
mov dword [esp + 0x20], 2
lea ebp, [edi + 0xc]
lea eax, [esp + 0x10]
mov ecx, ebp
call fcn.00476ae0
mov dword [esp + 0x20], ebx
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x476e6f
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp byte [edi + 8], 0
jne 0x476ea8
mov eax, dword [edi]
push ebp
push eax
mov byte [edi + 8], 1
call ebx
mov esi, eax
mov eax, dword [edi + 0x260]
cmp esi, eax
je 0x476e9d
cmp eax, 0xffffffff
je 0x476e9d
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [edi + 0x260], esi
cmp esi, 0xffffffff
jmp 0x476ebd
mov eax, dword [edi + 0x260]
cmp eax, 0xffffffff
je 0x476ed5
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x476ed5
lea esi, [edi + 0x38]
call fcn.00473520
test al, al
jne 0x476e75
lea eax, [edi + 4]
mov ecx, ebp
call fcn.00476ae0
mov esi, dword [esp + 0x28]
push ebp
push esi
call fcn.00476f10
mov dword [esp + 0x20], 0
mov dword [esp + 0x14], 1
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x476fa0
Capabilities:
Compare security identifiers

Disassembly:
push 0xffffffffffffffff
push 0x5adde8
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x6c56f8]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
xor esi, esi
cmp dword [ebx], esi
je 0x477068
mov dword [esp + 0xc], esi
mov dword [esp + 0x1c], esi
mov eax, dword [esp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esp + 0x10], esi
cmp eax, esi
je 0x476ff0
push eax
call edi
mov dword [esp + 0xc], esi
mov edx, dword [esp + 0x24]
lea eax, [esp + 0xc]
push eax
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push 1
push 1
push edx
call dword [sym.imp.ADVAPI32.dll_GetSecurityInfo]
test eax, eax
jne 0x477055
mov eax, dword [esp + 0x10]
cmp eax, esi
je 0x477055
cmp dword [esp + 0xc], esi
je 0x477055
mov ecx, dword [ebx]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
je 0x477055
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x47703f
push eax
call edi
mov al, 1
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4
mov dword [esp + 0x1c], 0xffffffff
mov eax, dword [esp + 0xc]
cmp eax, esi
je 0x477068
push eax
call edi
xor al, al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret 4

Function at 0x477230
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebx
xor ebx, ebx
push ebp
push edi
cmp dword [esi + 0x34], ebx
ja 0x477244
cmp dword [esi + 0x30], 0x40
jbe 0x477348
mov edi, dword [esi + 0x28]
mov ebp, dword [sym.imp.KERNEL32.dll_IsBadReadPtr]
push 0x40
push edi
call ebp
test eax, eax
jne 0x47734d
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x47734d
mov byte [esi + 0x38], 1
mov eax, dword [edi + 0x3c]
mov edi, dword [esi + 0x34]
xor ecx, ecx
lea edx, [eax + 0xf8]
cmp edi, ecx
jb 0x477348
ja 0x47728f
mov ecx, dword [esi + 0x30]
cmp ecx, edx
jbe 0x477348
mov edx, dword [esi + 0x28]
add eax, edx
push 0xf8
push eax
mov dword [esi + 0x24], eax
call ebp
test eax, eax
jne 0x47734d
mov eax, dword [esi + 0x24]
cmp dword [eax], 0x4550
jne 0x47734d
mov ecx, 0x2000
test word [eax + 0x16], cx
jne 0x4772c5
mov byte [esi + 0x44], 1
mov edx, eax
movzx eax, word [edx + 0x18]
mov ecx, 0x10b
cmp ax, cx
jne 0x4772e1
mov dword [esi + 0x40], 1
add edx, 0x78
jmp 0x4772f8
mov ecx, 0x20b
cmp ax, cx
jne 0x4772fb
mov dword [esi + 0x40], 2
add edx, 0x88
mov dword [esi + 0x20], edx
cmp dword [esi + 0x20], ebx
je 0x47734d
mov eax, dword [esi + 0x24]
movzx ecx, word [eax + 6]
mov dword [esi + 0x3c], ecx
test ecx, ecx
je 0x47734d
movzx edx, word [eax + 0x14]
mov ebx, dword [esi + 0x34]
lea ecx, [ecx + ecx*4]
add ecx, ecx
add ecx, ecx
add ecx, ecx
sub ecx, dword [esi + 0x28]
add ecx, edx
lea edi, [ecx + eax + 0x18]
xor ecx, ecx
cmp ebx, ecx
jb 0x477348
ja 0x477336
mov ecx, dword [esi + 0x30]
cmp ecx, edi
jbe 0x477348
pop edi
mov ebx, 1
lea edx, [edx + eax + 0x18]
pop ebp
mov eax, ebx
mov dword [esi + 0x1c], edx
pop ebx
ret
mov ebx, 2
pop edi
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x477570
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ecx + 0x24]
push ebx
push esi
mov ecx, eax
push edi
mov edi, dword [eax + 0x28]
movzx eax, word [eax + 0x14]
lea esi, [eax + ecx + 0x18]
movzx ecx, word [ecx + 6]
xor eax, eax
test ecx, ecx
jbe 0x4775a8
lea ecx, [ecx]
mov edx, dword [esi + 0xc]
cmp edi, edx
jb 0x4775a0
mov ebx, dword [esi + 8]
add ebx, edx
cmp edi, ebx
jb 0x4775b0
inc eax
add esi, 0x28
cmp eax, ecx
jb 0x477590
pop edi
pop esi
xor eax, eax
pop ebx
ret 0x10
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov eax, esi
lea edx, [eax + 1]
jmp 0x4775c0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4775c0
sub eax, edx
push eax
mov eax, dword [esp + 0x18]
push esi
call fcn.0040b2a2
mov eax, dword [esp + 0x18]
mov edx, edi
sub edx, dword [esi + 0xc]
mov dword [eax], edx
mov ecx, dword [esi + 8]
mov edx, dword [esp + 0x1c]
sub ecx, edi
add ecx, dword [esi + 0xc]
mov dword [edx], ecx
mov eax, dword [esi + 0x14]
sub eax, dword [esi + 0xc]
add eax, edi
pop edi
pop esi
pop ebx
ret 0x10

Function at 0x477600
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [eax + 0x24]
movzx edx, word [ecx + 0x14]
push ebx
push esi
movzx esi, word [ecx + 6]
lea eax, [edx + ecx + 0x18]
xor edx, edx
test esi, esi
jbe 0x47762f
mov ecx, dword [eax + 0xc]
cmp edi, ecx
jb 0x477627
mov ebx, dword [eax + 8]
add ebx, ecx
cmp edi, ebx
jb 0x477631
inc edx
add eax, 0x28
cmp edx, esi
jb 0x477617
xor eax, eax
pop esi
pop ebx
ret

Function at 0x477640
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [eax + 0x24]
movzx ecx, word [eax + 0x14]
push ebx
push esi
movzx esi, word [eax + 6]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x47766f
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x477667
mov ebx, dword [ecx + 8]
add ebx, eax
cmp edi, ebx
jb 0x477674
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x477657
pop esi
xor eax, eax
pop ebx
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop esi
add eax, edi
pop ebx
ret

Function at 0x477680
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [ebx + 0x24]
movzx ecx, word [eax + 0x14]
push ebp
push esi
movzx esi, word [eax + 6]
xor edx, edx
lea ecx, [ecx + eax + 0x18]
test esi, esi
jbe 0x4776af
mov eax, dword [ecx + 0xc]
cmp edi, eax
jb 0x4776a7
mov ebp, dword [ecx + 8]
add ebp, eax
cmp edi, ebp
jb 0x4776b4
inc edx
add ecx, 0x28
cmp edx, esi
jb 0x477697
pop esi
xor eax, eax
pop ebp
ret
mov eax, dword [ecx + 0x14]
sub eax, dword [ecx + 0xc]
pop esi
add eax, dword [ebx + 0x28]
pop ebp
add eax, edi
ret