joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d0c8
Capabilities:
Print debug messages

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebx + 0x10]
mov dword [ebp - 0x20], eax
lea eax, [edi - 1]
div dword [ecx + 0x28]
cmp dword [ecx], edi
jae 0x45d116
mov dword [ebp + 0x14], edi
mov dword [ebp + 0x10], 0x80d44900
mov dword [ebp + 0xc], str.ext2fs_inode_alloc_stats2
mov dword [ebp + 8], str._s:___08X___Illegal_inode_number:__lu_
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0043efa9
mov ecx, dword [ebx + 0x2c]
xor edx, edx
cmp dword [ebp - 0x1c], 0
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov esi, eax
mov dword [esp], ecx
jle 0x45d135
call fcn.00466694
jmp 0x45d13a
call fcn.0046674a
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0045f020
mov edx, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], ebx
sub eax, edx
mov dword [esp + 8], eax
call fcn.0045f063
cmp dword [ebp - 0x20], 0
je 0x45d182
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0045f0a2
mov ecx, dword [ebp - 0x1c]
mov dword [esp + 4], esi
mov dword [esp], ebx
add eax, ecx
mov dword [esp + 8], eax
call fcn.0045f0e5
mov dword [esp + 8], 1
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.0045f24f
mov eax, dword [ebx + 0x10]
test dword [eax + 0x64], 0x410
je 0x45d1f8
mov edx, dword [eax + 0x28]
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [ebp - 0x28], edx
call fcn.0045f124
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + 0x28]
mov eax, ecx
imul eax, esi
lea edx, [edx + eax + 1]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x24]
sub edx, eax
cmp edi, edx
jb 0x45d1ec
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], esi
mov dword [esp], ebx
add eax, ecx
sub eax, edi
mov dword [esp + 8], eax
call fcn.0045f167
mov dword [esp + 4], esi
mov dword [esp], ebx
call fcn.00461c53
mov eax, dword [ebx + 0x10]
mov edi, dword [ebp - 0x1c]
sub dword [eax + 0x10], edi
or dword [ebx + 8], 0x16
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x45d234
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], ebx
mov dword [ebp - 0x20], eax
call fcn.0045e960
mov dword [ebp - 0x1c], eax
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call fcn.0045ea6e
cmp esi, eax
mov eax, edi
sbb eax, edx
jb 0x45d296
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x10], 0x80d44900
mov dword [ebp + 0xc], str.ext2fs_block_alloc_stats
mov dword [ebp + 8], str._s:___08X___Illegal_block_number:__lu_
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0043efa9
mov eax, dword [ebx + 0x30]
cmp dword [ebp - 0x20], 0
mov dword [esp + 4], esi
mov dword [esp + 8], edi
mov dword [esp], eax
jle 0x45d2b1
call fcn.00466694
jmp 0x45d2b6
call fcn.0046674a
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045ef9e
mov ecx, dword [ebp - 0x20]
mov dword [esp], ebx
sub eax, ecx
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], eax
call fcn.0045efe1
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 2
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.0045f24f
mov eax, dword [ebp - 0x1c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call fcn.00461c53
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebx + 0x64]
neg eax
cdq
shld edx, eax, cl
shl eax, cl
test cl, 0x20
je 0x45d31a
mov edx, eax
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], edx
mov eax, dword [ebx + 0x10]
mov dword [esp], eax
call fcn.0045ec2b
mov eax, dword [ebx + 0x94]
or dword [ebx + 8], 0x26
test eax, eax
je 0x45d353
mov ecx, dword [ebp - 0x20]
mov dword [ebp + 0xc], esi
mov dword [ebp + 0x10], edi
mov dword [ebp + 8], ebx
mov dword [ebp + 0x14], ecx
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
jmp eax
add esp, 0x2c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x460404
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push esi
mov ecx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
push ebx
mov edi, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x14]
test eax, eax
je 0x46043a
cmp dword [eax], 0x7f2bb701
jne 0x46043a
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], esi
mov dword [ebp + 8], ebx
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0045f92c
pop ebx
mov eax, 0x7f2bb701
pop esi
pop edi
pop ebp
ret
Function at 0x46ea0a
Capabilities:
Get file size

Disassembly:
push ebp
xor ecx, ecx
mov edx, 1
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0xf0]
push ebx
sub esp, 0x11c
mov dword [ebp - 0xf0], ecx
mov dword [ebp - 0xe0], ecx
mov dword [ebp - 0xdc], ecx
lea ecx, [ebp - 0xec]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0xf1]
mov dword [esp + 8], eax
lea eax, [ebp - 0xe0]
mov dword [esp + 4], eax
lea eax, [ebp - 0xe8]
mov dword [esp], eax
mov eax, dword [ebp + 8]
call fcn.0046e494
test al, al
jne 0x46ea73
mov eax, dword [ebp - 0xf0]
jmp 0x46ec0d
cmp dword [ebp - 0xdc], 0
jne 0x46ebd2
cmp dword [ebp - 0xe0], 0
jne 0x46ebd2
cmp dword [0x52b544], 0
mov ebx, dword [ebp - 0xec]
jne 0x46eabe
mov eax, str.NtDll
call fcn.0046dab4
mov dword [esp + 4], str.NtDeviceIoControlFile
mov dword [esp], eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push edx
push edx
mov dword [0x52b544], eax
mov edx, dword [0x52b544]
test edx, edx
je 0x46ebd2
lea esi, [ebp - 0xa8]
xor eax, eax
mov ecx, 0x24
mov edi, esi
rep stosd dword es:[edi], eax
xor edi, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
lea esi, [ebp - 0xd8]
mov dword [esp + 0x24], 0x90
mov dword [esp + 0x1c], 0x90
mov dword [esp + 0x14], 0x70048
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 8], edi
mov dword [esp + 4], edi
mov dword [esp], ebx
call edx
sub esp, 0x28
test eax, eax
js 0x46eb32
mov eax, dword [ebp - 0x98]
mov edx, dword [ebp - 0x94]
jmp 0x46ebc6
cmp eax, 0xc0000010
jne 0x46eb9a
lea edx, [ebp - 0xd0]
xor eax, eax
mov ecx, 0xa
mov edi, edx
rep stosd dword es:[edi], eax
xor ecx, ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x24], 0x28
mov dword [esp + 0x1c], 0x28
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], 0x700a0
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
mov dword [esp], ebx
call dword [0x52b544]
sub esp, 0x28
test eax, eax
js 0x46ebd2
mov eax, dword [ebp - 0xb8]
mov edx, dword [ebp - 0xb4]
jmp 0x46ebc6
cmp eax, 0xc000000d
jne 0x46ebd2
lea eax, [ebp - 0xd0]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
push edx
push edx
test eax, eax
je 0x46ebd2
mov eax, dword [ebp - 0xd0]
mov edx, dword [ebp - 0xcc]
mov dword [ebp - 0xe0], eax
mov dword [ebp - 0xdc], edx
mov eax, dword [ebp - 0xec]
call fcn.0046e5c6
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], eax
sar eax, 0x1f
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xe0]
mov edx, dword [ebp - 0xdc]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.00487e10
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 4], edx
mov dword [ecx], eax
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4756a0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 8], 0x4b8440
mov edx, dword [ebp + 0xc]
pop ebp
jmp fcn.004755b4
Function at 0x475dfd
Capabilities:
Encode data using xor
Encrypt data using tea
Hash data using murmur3
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x14c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0x24]
mov dword [ebp - 0x12c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x134], ecx
mov dword [ebp - 0x130], eax
mov eax, dword [ebp + 0x14]
test ebx, ebx
je 0x475ea4
test eax, eax
je 0x475ea4
bt edx, 0x1e
jae 0x475ea4
lea edx, [ebp - 0x11c]
mov ecx, dword [eax + 4]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], edx
mov edx, dword [ebp - 0x130]
mov dword [esp + 0x10], 0x104
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [ecx]
lea edx, [ebp - 0x11c]
test eax, eax
jns 0x475e7a
cmp eax, 0xffffffea
jne 0x475ed7
jmp 0x475ea4
mov dword [esp + 0x10], esi
mov esi, dword [ebp - 0x134]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x12c]
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], esi
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.0047594a
jmp 0x475ed7
mov eax, dword [ebp - 0x134]
mov dword [ebp + 0x1c], edi
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x130]
mov dword [ebp + 0x10], ebx
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 0x12c]
mov dword [ebp + 8], eax
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.0047594a
add esp, 0x14c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47ab23
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x1c2
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1e5]
lea edi, [ebp - 0x1da]
mov esi, 0x4bc4d1
push ebx
sub esp, 0x20c
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1ec], 0x20454d41
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x1da]
mov dword [ebp - 0x1e1], 0x4e495753
mov dword [ebp - 0x1f0], 0x4e204f4e
mov dword [ebp - 0x1e9], 0x20202020
mov dword [ebp - 0x1e5], 0x4d903ceb
mov dword [ebp - 0x1de], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47abc6
call fcn.0047d6b6
test eax, eax
jne 0x47abfa
xor eax, eax
jmp 0x47ac2a
call fcn.0047d6b6
test eax, eax
je 0x47abc2
xor ecx, ecx
lea eax, [ebp - 0x1f0]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x2b
mov dword [esp + 8], edi
jmp 0x47abb9
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x1c2
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3e
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x47ace3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x1c2
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1e5]
lea edi, [ebp - 0x1da]
mov esi, 0x4bc693
push ebx
sub esp, 0x20c
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1ec], 0x20454d41
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x1da]
mov dword [ebp - 0x1e1], 0x4e495753
mov dword [ebp - 0x1f0], 0x4e204f4e
mov dword [ebp - 0x1e9], 0x20202020
mov dword [ebp - 0x1e5], 0x4d903ceb
mov dword [ebp - 0x1de], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47ad86
call fcn.0047d6b6
test eax, eax
jne 0x47adba
xor eax, eax
jmp 0x47adea
call fcn.0047d6b6
test eax, eax
je 0x47ad82
xor ecx, ecx
lea eax, [ebp - 0x1f0]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x2b
mov dword [esp + 8], edi
jmp 0x47ad79
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x1c2
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3e
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47aea3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x1c2
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1e5]
lea edi, [ebp - 0x1da]
mov esi, str.FREELDR_SYSLoad_failed__r_n
push ebx
sub esp, 0x20c
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1ec], 0x20454d41
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x1da]
mov dword [ebp - 0x1e1], 0x72644c72
mov dword [ebp - 0x1f0], 0x4e204f4e
mov dword [ebp - 0x1e9], 0x20202020
mov dword [ebp - 0x1e5], 0x469071eb
mov dword [ebp - 0x1de], 0x302e3172
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47af46
call fcn.0047d6b6
test eax, eax
jne 0x47af7a
xor eax, eax
jmp 0x47afaa
call fcn.0047d6b6
test eax, eax
je 0x47af42
xor ecx, ecx
lea eax, [ebp - 0x1f0]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x2b
mov dword [esp + 8], edi
jmp 0x47af39
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x1c2
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3e
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
add esp, 0x20c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x47b185
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x396
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x5c9]
lea edi, [ebp - 0x3ae]
mov esi, 0x492d20
push ebx
sub esp, 0x5ec
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x5d0], 0x20454d41
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5be]
mov dword [ebp - 0x5c5], 0x4e495753
mov esi, 0x4bca29
mov dword [ebp - 0x5d4], 0x4e204f4e
mov ecx, 0x84
mov dword [ebp - 0x5cd], 0x20202020
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x3ae]
lea esi, [ebp - 0x5be]
mov dword [ebp - 0x5c9], 0x4d9058eb
mov dword [ebp - 0x5c2], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47b243
call fcn.0047d6b6
test eax, eax
jne 0x47b277
xor eax, eax
jmp 0x47b2d3
call fcn.0047d6b6
test eax, eax
je 0x47b23c
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5d4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x47b233
xor ecx, ecx
mov dword [esp + 0xc], edi
xor edi, edi
mov dword [esp + 0x10], 0x396
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x52
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
je 0x47b23c
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x210
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
add esp, 0x5ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47b3e3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x396
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x3ae]
mov esi, 0x4930c0
push ebx
sub esp, 0x5ec
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x5d0], 0x20454d41
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5be]
mov dword [ebp - 0x5c5], 0x4e495753
lea esi, [ebp - 0x5be]
mov dword [ebp - 0x5d4], 0x4e204f4e
mov dword [ebp - 0x5cd], 0x20202020
mov dword [ebp - 0x5c9], 0x4d9058eb
mov dword [ebp - 0x5c2], 0x312e344e
mov eax, ecx
mov ecx, 0x84
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x5c9]
mov dword [esp], ebx
lea edi, [ebp - 0x3ae]
mov word [ebp - 0x5b0], 0xaa55
mov word [ebp - 0x3b0], 0xaa55
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
je 0x47b4b0
call fcn.0047d6b6
test eax, eax
jne 0x47b4e4
xor eax, eax
jmp 0x47b540
call fcn.0047d6b6
test eax, eax
je 0x47b4a9
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x5d4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x47b4a0
xor ecx, ecx
mov dword [esp + 0xc], edi
xor edi, edi
mov dword [esp + 0x10], 0x396
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x52
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
je 0x47b4a9
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x210
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
add esp, 0x5ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47b688
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x396
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x7c9]
lea edi, [ebp - 0x3ae]
mov esi, 0x493460
push ebx
sub esp, 0x7ec
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x7d0], 0x20454d41
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5be]
mov dword [ebp - 0x7c5], 0x4e495753
mov esi, 0x4bca29
mov dword [ebp - 0x7d4], 0x4e204f4e
mov ecx, 0x84
mov dword [ebp - 0x7cd], 0x20202020
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x7be]
mov esi, 0x4bcc39
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x7c9], 0x4d9058eb
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x3ae]
lea esi, [ebp - 0x5be]
mov dword [ebp - 0x7c2], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47b758
call fcn.0047d6b6
test eax, eax
jne 0x47b78c
xor eax, eax
jmp 0x47b81e
call fcn.0047d6b6
test eax, eax
je 0x47b751
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7d4]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x47b748
xor eax, eax
mov dword [esp + 0x10], 0x396
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x52
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
je 0x47b751
xor ecx, ecx
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 0x10], 0x210
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], esi
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
je 0x47b751
xor eax, eax
xor edx, edx
mov dword [esp], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7be]
mov dword [esp + 0x10], 0x200
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1800
mov dword [esp + 8], edx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
add esp, 0x7ec
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47b966
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x39b
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x7ce]
lea edi, [ebp - 0x3b3]
mov esi, str.FAT32___3
push ebx
sub esp, 0x7fc
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x7d5], 0x20454d41
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x5c3]
mov dword [ebp - 0x7ca], 0x4e495753
mov esi, 0x4bca29
mov dword [ebp - 0x7d9], 0x4e204f4e
mov ecx, 0x84
mov dword [ebp - 0x7d2], 0x20202020
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x7c3]
mov esi, 0x4bce39
mov ecx, pe_nt_image_headers32
mov dword [ebp - 0x7ce], 0x4d9058eb
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0xc], eax
lea edi, [ebp - 0x3b3]
lea esi, [ebp - 0x5c3]
mov dword [ebp - 0x7c7], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47ba36
call fcn.0047d6b6
test eax, eax
jne 0x47ba6a
xor eax, eax
jmp 0x47bafc
call fcn.0047d6b6
test eax, eax
je 0x47ba2f
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7d9]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x47ba26
xor eax, eax
mov dword [esp + 0x10], 0x39b
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x52
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
je 0x47ba2f
xor ecx, ecx
mov dword [esp + 0xc], esi
xor esi, esi
mov dword [esp + 0x10], 0x210
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], esi
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
je 0x47ba2f
xor eax, eax
xor edx, edx
mov dword [esp], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x7c3]
mov dword [esp + 0x10], 0x200
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x1800
mov dword [esp + 8], edx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
add esp, 0x7fc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47bc32
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x396
mov ebp, esp
push edi
push esi
mov esi, str.FAT32___1
push ebx
and esp, 0xfffffff0
sub esp, 0x5e0
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
movups xmm0, xmmword [0x4bd3f0]
lea eax, [esp + 0x2f]
mov dword [esp + 0x28], 0x20454d41
lea edi, [esp + 0x24a]
mov dword [esp + 0x33], 0x4e495753
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0x24], 0x4e204f4e
lea edi, [esp + 0x4a]
mov esi, 0x4bd039
mov ecx, pe_nt_image_headers32
mov dword [esp + 0x2b], 0x20202020
rep movsd dword es:[edi], dword [esi]
movups xmmword [esp + 0x3a], xmm0
lea edi, [esp + 0x24a]
lea esi, [esp + 0x4a]
mov dword [esp + 0x2f], 0x4d9058eb
mov dword [esp + 0x36], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47bcef
call fcn.0047d6b6
test eax, eax
jne 0x47bd21
xor eax, eax
jmp 0x47bdb1
call fcn.0047d6b6
test eax, eax
je 0x47bce8
xor eax, eax
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], eax
lea eax, [esp + 0x24]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], eax
mov dword [esp], ebx
jmp 0x47bcdf
xor eax, eax
mov dword [esp + 0x10], 0x396
mov dword [esp + 0x14], eax
xor eax, eax
mov dword [esp + 0xc], edi
mov dword [esp + 4], 0x52
mov dword [esp + 8], eax
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
je 0x47bce8
xor ecx, ecx
xor edi, edi
lea eax, [esp + 0x3a]
mov dword [esp + 0x10], 0x10
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x3f0
mov dword [esp + 8], edi
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
je 0x47bce8
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x200
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x1c00
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x47be67
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ecx, 0x1ae
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x1d1]
lea edi, [ebp - 0x1c6]
mov esi, 0x4bd239
push ebx
sub esp, 0x1fc
mov ebx, dword [ebp + 8]
cmp dword [ebp + 0xc], 0
mov dword [ebp - 0x1d8], 0x20454d41
rep movsb byte es:[edi], byte [esi]
mov dword [esp + 0xc], eax
lea esi, [ebp - 0x1c6]
mov dword [ebp - 0x1cd], 0x4e495753
mov dword [ebp - 0x1dc], 0x4e204f4e
mov dword [ebp - 0x1d5], 0x20202020
mov dword [ebp - 0x1d1], 0x4d9058eb
mov dword [ebp - 0x1ca], 0x312e344e
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], 0
mov dword [esp + 4], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
je 0x47bf0a
call fcn.0047d6b6
test eax, eax
jne 0x47bf3e
xor eax, eax
jmp 0x47bf6e
call fcn.0047d6b6
test eax, eax
je 0x47bf06
xor ecx, ecx
lea eax, [ebp - 0x1dc]
xor edi, edi
mov dword [esp], ebx
mov dword [esp + 0x10], 0xb
mov dword [esp + 0x14], ecx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 0x47
mov dword [esp + 8], edi
jmp 0x47befd
xor eax, eax
xor edx, edx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x1ae
mov dword [esp + 0x14], eax
mov dword [esp + 4], 0x52
mov dword [esp + 8], edx
mov dword [esp], ebx
call fcn.0047d6b6
test eax, eax
setne al
movzx eax, al
add esp, 0x1fc
pop ebx
pop esi
pop edi
pop ebp
ret