joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d090
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
lea esi, [ebp + ebp + 0x1a]
test esi, esi
push edi
mov edi, eax
mov dword [esp + 0x14], 0
jne 0x46d0ad
xor esi, esi
jmp 0x46d0d4
cmp esi, 0xfffffffd
jb 0x46d152
push str.memory_allocation_error:_block_too_big
push ebx
call fcn.00455f40
mov eax, dword [esp + 0x1c]
add esp, 8
test ebx, ebx
je 0x46d0d2
mov ecx, dword [ebx + 0x10]
add dword [ecx + 0x3c], esi
mov esi, eax
mov dword [esi + 0xc], ebp
mov dword [esi + 8], edi
mov eax, dword [ebx + 0x10]
mov cl, byte [eax + 0x10]
xor eax, eax
and cl, 3
lea edx, [ebp + ebp]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], eax
mov eax, dword [esp + 0x10]
push edx
mov byte [esi + 5], cl
push eax
lea ecx, [esi + 0x18]
push ecx
mov byte [esi + 4], 5
mov byte [esi + 6], 0
call fcn.0050bcb0
mov word [esi + ebp*2 + 0x18], 0
mov eax, dword [ebx + 0x10]
mov edx, dword [eax + 8]
mov ecx, dword [eax]
sub edx, 1
and edi, edx
mov edx, dword [ecx + edi*4]
mov dword [esi], edx
mov ecx, dword [eax]
mov dword [ecx + edi*4], esi
add dword [eax + 4], 1
mov ecx, dword [eax + 4]
mov eax, dword [eax + 8]
add esp, 0xc
cmp ecx, eax
jle 0x46d14c
cmp eax, 0x3ffffffe
jg 0x46d14c
lea edx, [eax + eax]
push edx
push ebx
call fcn.0046cf20
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebp
ret
push 0
push 0
mov eax, esi
call fcn.00475e00
add esp, 8
test eax, eax
jne 0x46d0c8
test ebx, ebx
je 0x46d0a9
lea edx, [eax + 4]
mov ecx, ebx
jmp 0x450590

Function at 0x46d180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, eax
mov ecx, esi
shr ecx, 5
add ecx, 1
cmp esi, ecx
mov ebp, esi
push edi
mov dword [esp + 0x10], ebp
mov edx, esi
jb 0x46d1e1
mov eax, dword [esp + 0x20]
lea eax, [eax + esi*2 - 2]
movzx edi, word [eax]
cmp di, 0xff
jbe 0x46d1b4
movzx edi, di
jmp 0x46d1be
movzx edi, byte [eax]
movzx edi, byte [edi + 0x563750]
mov ebx, ebp
shl ebx, 5
shr ebp, 2
add ebx, edi
add ebp, ebx
mov ebx, ebp
mov ebp, dword [esp + 0x10]
lea edi, [ecx + ecx]
xor ebp, ebx
sub edx, ecx
sub eax, edi
cmp edx, ecx
mov dword [esp + 0x10], ebp
jae 0x46d1a5
mov ecx, dword [esp + 0x1c]
mov eax, dword [ecx + 0x10]
mov edx, dword [eax + 8]
mov eax, dword [eax]
sub edx, 1
and edx, ebp
mov eax, dword [eax + edx*4]
test eax, eax
je 0x46d263
lea esp, [esp]
cmp dword [eax + 0xc], esi
jne 0x46d25d
test esi, esi
mov ecx, dword [esp + 0x20]
mov edi, esi
lea edx, [eax + 0x18]
jbe 0x46d225
mov bx, word [ecx]
cmp bx, word [edx]
jne 0x46d24d
add ecx, 2
add edx, 2
sub edi, 1
jne 0x46d212
mov esi, dword [esp + 0x1c]
mov cl, byte [eax + 5]
mov esi, dword [esi + 0x10]
movzx ebx, byte [esi + 0x10]
movzx edx, cl
and edx, 3
not ebx
test bl, dl
je 0x46d277
pop edi
pop esi
xor cl, 3
pop ebp
mov byte [eax + 5], cl
pop ebx
add esp, 8
ret
mov cx, bx
cmp cx, word [edx]
sbb edx, edx
and edx, 0xfffffffe
add edx, 1
je 0x46d225
mov eax, dword [eax]
test eax, eax
jne 0x46d200
mov eax, dword [esp + 0x20]
mov ebx, dword [esp + 0x1c]
push esi
push eax
mov eax, ebp
call fcn.0046d090
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x46d280
Capabilities:
Terminate process

Disassembly:
mov eax, dword [ecx + 0x58]
test eax, eax
je 0x4505a8
mov dword [eax + 0x44], edx
mov eax, dword [ecx + 0x58]
push 1
add eax, 4
push eax
call fcn.0051051c
mov edx, dword [ecx + 0x10]
mov eax, dword [edx + 0x50]
push ecx
call eax
add esp, 4
push 1
call fcn.0050d409
int3
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push edi
lea edi, [ebp + 0x10]
xor ebx, ebx
test edi, edi
jne 0x46d294
xor eax, eax
jmp 0x46d2b3
cmp edi, 0xfffffffd
jb 0x46d2e3
push str.memory_allocation_error:_block_too_big
push esi
call fcn.00455f40
add esp, 8
test esi, esi
je 0x46d2b1
mov eax, dword [esi + 0x10]
add dword [eax + 0x3c], edi
mov eax, ebx
mov ecx, dword [esi + 0x10]
mov dl, byte [ecx + 0x10]
mov dword [eax + 0xc], ebp
mov byte [eax + 4], 8
mov dword [eax + 8], 0
and dl, 3
mov byte [eax + 5], dl
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 0x68]
mov ecx, dword [edx]
mov dword [eax], ecx
mov edx, dword [esi + 0x10]
mov ecx, dword [edx + 0x68]
pop edi
pop ebp
mov dword [ecx], eax
pop ebx
ret
push 0
push 0
mov eax, edi
call fcn.00475e00
add esp, 8
mov ebx, eax
test ebx, ebx
jne 0x46d2a7
test esi, esi
je 0x46d290
lea edx, [eax + 4]
mov ecx, esi
jmp 0x450590
Function at 0x471130
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
lea esi, [ebx + 1]
shl esi, 4
push edi
mov edi, 0
jne 0x471148
xor eax, eax
jmp 0x471167
cmp esi, 0xfffffffd
jb 0x47118a
push str.memory_allocation_error:_block_too_big
push ebp
call fcn.00455f40
add esp, 8
test ebp, ebp
je 0x471165
mov eax, dword [ebp + 0x10]
add dword [eax + 0x3c], esi
mov eax, edi
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx + 0x14]
mov dword [eax], edx
mov dword [ecx + 0x14], eax
mov cl, byte [ecx + 0x10]
pop edi
and cl, 3
pop esi
mov byte [eax + 5], cl
mov byte [eax + 4], 7
mov byte [eax + 6], 1
mov byte [eax + 7], bl
pop ebp
ret
push 0
push 0
mov eax, esi
call fcn.00475e00
add esp, 8
mov edi, eax
test edi, edi
jne 0x47115b
test ebp, ebp
je 0x471144
lea edx, [eax + 4]
mov ecx, ebp
jmp 0x450590

Function at 0x4711b0
Capabilities:
Terminate process

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
lea esi, [esi*4 + 0x24]
xor ebp, ebp
test esi, esi
jne 0x4711c7
xor eax, eax
jmp 0x4711e6
cmp esi, 0xfffffffd
jb 0x471223
push str.memory_allocation_error:_block_too_big
push ebx
call fcn.00455f40
add esp, 8
test ebx, ebx
je 0x4711e4
mov eax, dword [ebx + 0x10]
add dword [eax + 0x3c], esi
mov eax, ebp
mov ecx, dword [ebx + 0x10]
mov edx, dword [ecx + 0x14]
mov dword [eax], edx
mov dword [ecx + 0x14], eax
mov cl, byte [ecx + 0x10]
and cl, 3
mov byte [eax + 5], cl
mov byte [eax + 4], 7
mov byte [eax + 6], 0
mov edx, dword [edi]
mov dword [eax + 0x10], edx
mov ecx, dword [edi + 4]
mov dword [eax + 0x14], ecx
mov edx, dword [edi + 8]
mov dword [eax + 0x18], edx
mov ecx, dword [edi + 0xc]
mov dl, byte [esp + 0xc]
pop esi
mov dword [eax + 0x1c], ecx
mov byte [eax + 7], dl
pop ebp
ret
push 0
push 0
mov eax, esi
call fcn.00475e00
add esp, 8
mov ebp, eax
test ebp, ebp
jne 0x4711da
test ebx, ebx
je 0x4711c3
lea edx, [eax + 4]
mov ecx, ebx
jmp 0x450590

Function at 0x471250
Capabilities:
Terminate process

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
push edi
lea edi, [ebp + 0x50]
mov ebx, eax
mov eax, dword [edi]
test eax, eax
je 0x471277
mov ecx, dword [eax + 8]
cmp ecx, ebx
jb 0x471277
je 0x471296
mov edi, eax
mov eax, dword [eax]
test eax, eax
jne 0x471266
push 0
push 0
mov eax, 0x20
call fcn.00475e00
add esp, 8
test eax, eax
jne 0x4712b4
lea edx, [eax + 4]
mov ecx, ebp
jmp 0x450590
mov cl, byte [eax + 5]
movzx ebx, byte [esi + 0x10]
movzx edx, cl
and edx, 3
not ebx
test bl, dl
je 0x4712e9
pop edi
pop esi
xor cl, 3
pop ebp
mov byte [eax + 5], cl
pop ebx
ret
mov ecx, dword [ebp + 0x10]
add dword [ecx + 0x3c], 0x20
mov byte [eax + 4], 0xb
mov cl, byte [esi + 0x10]
and cl, 3
mov byte [eax + 5], cl
mov dword [eax + 8], ebx
mov edx, dword [edi]
mov dword [eax], edx
mov dword [edi], eax
lea ecx, [esi + 0x70]
mov dword [eax + 0x10], ecx
mov ecx, dword [esi + 0x84]
mov dword [eax + 0x14], ecx
mov dword [ecx + 0x10], eax
mov dword [esi + 0x84], eax
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x471460
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
mov esi, eax
push ebx
push ebx
lea eax, [ebx + 0x64]
call fcn.00475e00
add esp, 8
cmp eax, ebx
jne 0x471489
cmp esi, ebx
je 0x471485
lea edx, [ebx + 4]
mov ecx, esi
jmp 0x450590
xor eax, eax
jmp 0x471494
cmp esi, ebx
je 0x471494
mov ecx, dword [esi + 0x10]
add dword [ecx + 0x3c], 0x64
push edi
mov edi, dword [esi + 0x10]
mov ecx, dword [edi + 0x14]
mov dword [eax], ecx
mov dl, byte [edi + 0x10]
mov dword [edi + 0x14], eax
mov dword [eax + 8], ebx
mov dword [eax + 0x2c], ebx
mov dword [eax + 0x10], ebx
mov dword [eax + 0x38], ebx
mov dword [eax + 0xc], ebx
mov dword [eax + 0x50], ebx
mov dword [eax + 0x30], ebx
mov dword [eax + 0x34], ebx
mov dword [eax + 0x28], ebx
mov byte [eax + 0x4c], bl
mov dword [eax + 0x1c], ebx
mov byte [eax + 0x4d], bl
mov byte [eax + 0x4e], bl
mov byte [eax + 0x4f], bl
mov dword [eax + 0x14], ebx
mov dword [eax + 0x3c], ebx
mov dword [eax + 0x18], ebx
mov dword [eax + 0x40], ebx
mov dword [eax + 0x20], ebx
and dl, 3
mov byte [eax + 5], dl
mov byte [eax + 4], 0xa
mov dword [eax + 0x54], 0xffffffff
mov ecx, dword [esi + 0x10]
mov edx, dword [ecx + 0xf8]
mov dword [eax + 0x24], edx
mov esi, dword [esi + 0x10]
add dword [esi + 0xf8], 1
pop edi
pop esi
mov dword [eax + 0x44], ebx
pop ebx
ret

Function at 0x4717e0
Capabilities:
Read file via mapping

Disassembly:
sub esp, 0x104
mov eax, dword [0x59099c]
xor eax, esp
mov dword [esp + 0x100], eax
cmp dword [0x5eee1c], 0
jne 0x47185d
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [esp + 4]
push str.gPakInterfaceP__d
push eax
call fcn.0050b433
add esp, 0xc
lea ecx, [esp]
push ecx
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push 4
push 0
push 0
push 0xf001f
push eax
mov dword [0x5eee1c], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x5eee20], eax
mov eax, dword [eax]
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.0050bc9c
add esp, 0x104
ret
mov ecx, dword [esp + 0x100]
mov edx, dword [0x5eee20]
mov eax, dword [edx]
xor ecx, esp
call fcn.0050bc9c
add esp, 0x104
ret

Function at 0x4735f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
push edi
mov edi, eax
test edi, edi
mov esi, ecx
jne 0x47364a
test esi, esi
je 0x473644
mov eax, ebx
call fcn.00475db0
cmp eax, 0xffffffff
push esi
jne 0x473621
add dword [0x5eee48], 1
call fcn.0050ce8b
add esp, 4
jmp 0x473630
lea esi, [eax + eax*4]
lea esi, [esi*4 + 0x5eef48]
call fcn.00475d40
xor esi, esi
test ebp, ebp
je 0x47363e
mov eax, dword [ebp + 0x10]
sub edi, ebx
add dword [eax + 0x3c], edi
pop edi
mov eax, esi
pop esi
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebp
ret
cmp edi, 0xfffffffd
jb 0x47365f
push str.memory_allocation_error:_block_too_big
push ebp
call fcn.00455f40
add esp, 8
jmp 0x473632
push ebx
push esi
call fcn.00475e00
mov esi, eax
add esp, 8
test esi, esi
jne 0x473632
test ebp, ebp
je 0x473644
lea edx, [eax + 4]
mov ecx, ebp
jmp 0x450590
Function at 0x4739b0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
mov ecx, 4
lea eax, [esp + 0x1c]
call fcn.004736e0
mov ebx, dword [esp + 0x1c]
add esp, 4
test ebx, ebx
jge 0x4739d4
nop
mov edi, dword [ebp]
lea esi, [ebx*4]
test esi, esi
jne 0x4739e6
xor eax, eax
jmp 0x473a20
cmp esi, 0xfffffffd
jb 0x4739f6
push str.memory_allocation_error:_block_too_big
push edi
call fcn.00455f40
push 0
push 0
mov eax, esi
call fcn.00475e00
add esp, 8
test eax, eax
jne 0x473a16
test edi, edi
je 0x4739e2
lea edx, [eax + 4]
mov ecx, edi
jmp 0x450590
test edi, edi
je 0x473a20
mov edi, dword [edi + 0x10]
add dword [edi + 0x3c], esi
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
mov dword [ecx + 0xc], eax
mov dword [ecx + 0x30], ebx
call fcn.004737d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x473a40
Capabilities:
Terminate process

Disassembly:
sub esp, 0xc
push ebp
push esi
push ebx
mov ecx, 4
lea eax, [esp + 0x10]
call fcn.004736e0
mov ebp, dword [esp + 0x10]
add esp, 4
test ebp, ebp
jge 0x473a60
nop
mov eax, dword [ebx]
lea esi, [ebp + ebp*2]
add esi, esi
add esi, esi
mov dword [esp + 0xc], eax
jne 0x473a74
xor eax, eax
jmp 0x473ab0
cmp esi, 0xfffffffd
jb 0x473a84
push str.memory_allocation_error:_block_too_big
push eax
call fcn.00455f40
push 0
push 0
mov eax, esi
call fcn.00475e00
mov ecx, dword [esp + 0x14]
add esp, 8
test eax, eax
jne 0x473aa6
test ecx, ecx
je 0x473a70
lea edx, [eax + 4]
jmp 0x450590
test ecx, ecx
je 0x473ab0
mov ecx, dword [ecx + 0x10]
add dword [ecx + 0x3c], esi
test ebp, ebp
mov dword [edi + 0x18], eax
mov dword [edi + 0x3c], ebp
jle 0x473b1b
xor esi, esi
lea esp, [esp]
push ebx
call fcn.00473900
mov ecx, dword [edi + 0x18]
mov dword [esi + ecx], eax
add esp, 4
push ebx
mov ecx, 4
lea eax, [esp + 0x10]
call fcn.004736e0
mov eax, dword [esp + 0x10]
add esp, 4
test eax, eax
jge 0x473aea
nop
mov edx, dword [edi + 0x18]
mov dword [esi + edx + 4], eax
push ebx
mov ecx, 4
lea eax, [esp + 0x14]
call fcn.004736e0
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jge 0x473b0c
nop
mov ecx, dword [edi + 0x18]
mov dword [esi + ecx + 8], eax
add esi, 0xc
sub ebp, 1
jne 0x473ac0
pop esi
pop ebp
add esp, 0xc
ret

Function at 0x473b30
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
mov ecx, 4
lea eax, [esp + 0x1c]
call fcn.004736e0
mov ebx, dword [esp + 0x1c]
add esp, 4
test ebx, ebx
jge 0x473b54
nop
mov edi, dword [ebp]
lea esi, [ebx*4]
test esi, esi
jne 0x473b66
xor eax, eax
jmp 0x473ba0
cmp esi, 0xfffffffd
jb 0x473b76
push str.memory_allocation_error:_block_too_big
push edi
call fcn.00455f40
push 0
push 0
mov eax, esi
call fcn.00475e00
add esp, 8
test eax, eax
jne 0x473b96
test edi, edi
je 0x473b62
lea edx, [eax + 4]
mov ecx, edi
jmp 0x450590
test edi, edi
je 0x473ba0
mov edi, dword [edi + 0x10]
add dword [edi + 0x3c], esi
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x34], ebx
call fcn.004737d0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x473bc0
Capabilities:
Terminate process

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
push edi
push ebp
mov ecx, 4
lea eax, [esp + 0x14]
call fcn.004736e0
mov edi, dword [esp + 0x14]
add esp, 4
test edi, edi
jge 0x473be4
nop
je 0x473c06
mov eax, dword [esp + 0x1c]
movzx eax, byte [eax + 0x4c]
cmp edi, eax
je 0x473c06
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp]
push eax
push edi
push ecx
push str.bad_nupvalues_in__s:_read__d__expected__d
push edx
call fcn.00455f40
mov ebx, dword [ebp]
lea esi, [edi*4]
test esi, esi
jne 0x473c18
xor eax, eax
jmp 0x473c52
cmp esi, 0xfffffffd
jb 0x473c28
push str.memory_allocation_error:_block_too_big
push ebx
call fcn.00455f40
push 0
push 0
mov eax, esi
call fcn.00475e00
add esp, 8
test eax, eax
jne 0x473c48
test ebx, ebx
je 0x473c14
lea edx, [eax + 4]
mov ecx, ebx
jmp 0x450590
test ebx, ebx
je 0x473c52
mov ebx, dword [ebx + 0x10]
add dword [ebx + 0x3c], esi
mov ecx, dword [esp + 0x1c]
xor esi, esi
test edi, edi
mov dword [ecx + 0x1c], eax
mov dword [ecx + 0x28], edi
jle 0x473c7c
push ebp
call fcn.00473900
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx + 0x1c]
mov dword [edx + esi*4], eax
add esi, 1
add esp, 4
cmp esi, edi
jl 0x473c62
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x473f10
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x214
mov eax, dword [0x59099c]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
push esi
push edi
call fcn.00471460
push ebx
mov esi, eax
call fcn.00473900
add esp, 4
test eax, eax
mov dword [esi + 0x20], eax
jne 0x473f4f
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x20], eax
mov eax, dword [0x5eee00]
test eax, eax
je 0x473fa2
lea edx, [esp + 0x12]
sub edx, eax
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x473f60
lea eax, [esp + 0x10]
mov word [esp + 0x10], 0x40
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x473f80
sub eax, edx
mov edx, dword [ebx]
lea ecx, [esp + 0x10]
push ecx
sar eax, 1
push edx
call fcn.0046d180
add esp, 8
mov dword [esi + 0x20], eax
mov eax, dword [esi + 0x20]
or byte [eax + 5], 0x20
push ebx
mov ecx, 4
lea eax, [esp + 0x10]
call fcn.004736e0
mov eax, dword [esp + 0x10]
add esp, 4
test eax, eax
jge 0x473fc4
nop
mov dword [esi + 0x40], eax
push ebx
mov ecx, 4
lea eax, [esp + 0x10]
call fcn.004736e0
mov eax, dword [esp + 0x10]
add esp, 4
test eax, eax
jge 0x473fe2
nop
mov edi, ebx
mov dword [esi + 0x44], eax
call fcn.00473680
mov byte [esi + 0x4c], al
call fcn.00473680
mov byte [esi + 0x4d], al
call fcn.00473680
mov byte [esi + 0x4e], al
call fcn.00473680
push esi
push ebx
mov byte [esi + 0x4f], al
call fcn.00473b30
mov edi, esi
call fcn.00473a40
push esi
push ebx
call fcn.00473bc0
push esi
push ebx
call fcn.00473c90
push esi
push ebx
call fcn.004739b0
mov edi, dword [esi + 0x30]
push 0xff
push edi
push esi
call fcn.00455710
add esp, 0x2c
test eax, eax
jne 0x474051
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx]
push eax
push str.bad_code_in__s
push ecx
call fcn.00455f40
mov ebx, dword [ebx]
add edi, edi
add edi, edi
add edi, edi
jne 0x47405f
xor eax, eax
jmp 0x474099
cmp edi, 0xfffffffd
jb 0x47406f
push str.memory_allocation_error:_block_too_big
push ebx
call fcn.00455f40
push 0
push 0
mov eax, edi
call fcn.00475e00
add esp, 8
test eax, eax
jne 0x47408f
test ebx, ebx
je 0x47405b
lea edx, [eax + 4]
mov ecx, ebx
jmp 0x450590
test ebx, ebx
je 0x474099
mov ebx, dword [ebx + 0x10]
add dword [ebx + 0x3c], edi
mov edx, dword [esi + 0x30]
add edx, edx
add edx, edx
add edx, edx
push edx
push 0
push eax
mov dword [esi + 0x50], eax
call fcn.00509c30
mov ecx, dword [esp + 0x228]
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebx
xor ecx, esp
call fcn.0050bc9c
mov esp, ebp
pop ebp
ret
Function at 0x4767b0
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x59099c]
xor eax, esp
mov dword [esp + 0x9c], eax
cmp byte [0x5860a4], 0
push esi
je 0x476839
push 0x9c
lea eax, [esp + 8]
push 0
push eax
call fcn.00509c30
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x9c
call esi
test eax, eax
jne 0x476826
lea edx, [esp + 4]
push edx
mov dword [esp + 8], 0x94
call esi
test eax, eax
jne 0x476826
xor al, al
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0050bc9c
add esp, 0xa0
ret
cmp dword [esp + 8], 6
mov byte [0x5860a4], 0
setae byte [0x593384]
mov ecx, dword [esp + 0xa0]
mov al, byte [0x593384]
pop esi
xor ecx, esp
call fcn.0050bc9c
add esp, 0xa0
ret
Function at 0x47e970
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53192e
mov eax, dword fs:[0]
push eax
push ecx
push ebp
push esi
push edi
mov eax, dword [0x59099c]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
call fcn.0047cfe0
mov dword [esi + 4], eax
mov byte [eax + 0x71], 1
mov eax, dword [esi + 4]
mov dword [eax + 4], eax
mov eax, dword [esi + 4]
mov dword [eax], eax
mov eax, dword [esi + 4]
xor ebp, ebp
mov dword [eax + 8], eax
mov dword [esi + 8], ebp
lea edi, [esi + 0xc]
mov ecx, edi
mov dword [esp + 0x1c], ebp
call fcn.00479f40
mov dword [edi + 4], eax
mov dword [edi + 8], ebp
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], ebp
mov word [esi + 0x1c], bp
lea edi, [esi + 0x34]
mov ecx, edi
mov byte [esp + 0x1c], 2
call fcn.0040c810
mov dword [edi + 4], eax
mov byte [eax + 0x45], 1
mov eax, dword [edi + 4]
mov dword [eax + 4], eax
mov eax, dword [edi + 4]
mov dword [eax], eax
mov eax, dword [edi + 4]
mov dword [eax + 8], eax
mov dword [edi + 8], ebp
mov dword [esi + 0x40], ebp
mov dword [esi + 0x44], ebp
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x10
ret

Function at 0x47ea30
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x53196e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x59099c]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [esi + 0x38]
mov ecx, dword [eax]
lea edi, [esi + 0x34]
push eax
push edi
push ecx
push edi
lea eax, [esp + 0x24]
push eax
mov ecx, edi
mov dword [esp + 0x38], 2
call fcn.0040b8f0
mov eax, dword [edi + 4]
push eax
call fcn.0050b609
xor ebx, ebx
add esp, 4
mov dword [edi + 4], ebx
mov dword [edi + 8], ebx
cmp dword [esi + 0x30], 8
jb 0x47eaa2
mov eax, dword [esi + 0x1c]
push eax
call fcn.0050b609
add esp, 4
mov dword [esi + 0x30], 7
mov dword [esi + 0x2c], ebx
lea ecx, [esi + 0xc]
mov word [esi + 0x1c], bx
call fcn.00480fd0
mov eax, dword [esi + 4]
mov ecx, dword [eax]
push eax
push esi
push ecx
push esi
lea ecx, [esp + 0x24]
push ecx
mov ecx, esi
mov dword [esp + 0x38], 0xffffffff
call fcn.0047dc60
mov edx, dword [esi + 4]
push edx
call fcn.0050b609
add esp, 4
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x47eb00
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x5319b1
mov eax, dword fs:[0]
push eax
sub esp, 0x100
mov eax, dword [0x59099c]
xor eax, esp
mov dword [esp + 0xfc], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x59099c]
xor eax, esp
push eax
lea eax, [esp + 0x114]
mov dword fs:[0], eax
mov edi, dword [esp + 0x124]
mov esi, ecx
lea ecx, [esp + 0x78]
call fcn.00481560
lea eax, [esp + 0x78]
xor ebp, ebp
lea ecx, [esi + 8]
mov dword [esp + 0x11c], ebp
mov dword [esi + 4], eax
call fcn.0040a4ce
lea ecx, [esp + 0x30]
mov byte [esi + 0x24], 0
call fcn.0047e970
mov ecx, dword [esi + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push edi
mov byte [esp + 0x120], 1
call eax
test al, al
je 0x47eb97
mov edx, dword [esi]
mov edx, dword [edx + 0x10]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call edx
mov ecx, dword [esi + 4]
call fcn.00481500
test al, al
je 0x47ebf4
mov ecx, dword [esi + 4]
lea eax, [esp + 0x14]
push eax
call fcn.00481660
mov edi, eax
mov ecx, dword [esi + 4]
mov ebx, dword [esi]
mov byte [esp + 0x11c], 2
call fcn.00481510
mov edx, dword [ebx + 0x1c]
push eax
push edi
mov ecx, esi
call edx
cmp dword [esp + 0x2c], 8
jb 0x47ebe1
mov eax, dword [esp + 0x18]
push eax
call fcn.0050b609
add esp, 4
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], ebp
mov word [esp + 0x18], bp
jmp 0x47ec02
mov edx, dword [esi]
mov edx, dword [edx + 0x14]
lea eax, [esp + 0x30]
push eax
mov ecx, esi
call edx
cmp byte [esi + 0x24], 0
lea ecx, [esp + 0x30]
mov dword [esi + 4], ebp
sete bl
mov byte [esp + 0x11c], 0
call fcn.0047ea30
lea ecx, [esp + 0x78]
mov dword [esp + 0x11c], 0xffffffff
call fcn.004815b0
mov al, bl
mov ecx, dword [esp + 0x114]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xfc]
xor ecx, esp
call fcn.0050bc9c
add esp, 0x10c
ret 4