joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467e90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x4bea98
push 0x4978e8
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x4c5008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x438], edi
mov dword [ebp - 0x43c], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x467ef1
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
mov ecx, edi
call fcn.00467fe0
mov bl, al
mov byte [ebp - 0x431], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x467f34
test bl, bl
jne 0x467fbd
cmp edi, 0x1a
jne 0x467fbd
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x467f56
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp - 0x430]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x207
lea eax, [ebp - 0x430]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp - 0x430]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x467f90
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x430]
push eax
mov ecx, esi
call fcn.004027a0
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004973c3
mov esp, ebp
pop ebp
ret
Function at 0x46ae10
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x140
mov eax, dword [0x4c5008]
xor eax, esp
mov dword [esp + 0x13c], eax
push esi
mov esi, ecx
push 0x118
push 0
lea eax, [esi + 4]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esi], 0x11c
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x46af52
cmp dword [esi + 4], 6
push edi
ja 0x46ae66
jne 0x46aeee
cmp dword [esi + 8], 2
jb 0x46aeee
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
je 0x46aeee
push 0x10
push 1
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x46aeee
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x46aeee
movups xmm0, xmmword [0x4afe98]
push eax
movups xmmword [esp + 0x128], xmm0
movups xmm0, xmmword [0x4afea8]
movups xmmword [esp + 0x138], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x46aeee
lea eax, [esp + 0x124]
push eax
lea ecx, [edi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x46aeee
cmp word [edi + 2], ax
jbe 0x46aeee
movzx edx, word [edi + 0x32]
movzx ecx, word [edi + 0x30]
movzx eax, word [edi + 0x36]
mov dword [esi + 4], edx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], eax
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.RtlGetVersion
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x46af39
push 0x118
lea eax, [esp + 0x10]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [esp + 8], 0x11c
lea eax, [esp + 8]
push eax
call edi
test eax, eax
jne 0x46af39
mov eax, dword [esp + 0x14]
mov dword [esi + 0xc], eax
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.004973c3
add esp, 0x140
ret
mov ecx, dword [esp + 0x140]
xor al, al
pop esi
xor ecx, esp
call fcn.004973c3
add esp, 0x140
ret
Function at 0x46ccb0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4948
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x46ccf3
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.0047edd0
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x46cd1c
lea eax, [esi + 8]
jmp 0x46cd1e
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x46cd2e
cmp dword [ebx + 0x14], 8
jb 0x46cd30
mov ebx, dword [ebx]
jmp 0x46cd30
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x46cd51
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x46cd51
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x46cd7a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x46cd8f
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.00497404
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004973c3
mov esp, ebp
pop ebp
ret 4

Function at 0x46d120
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a4a55
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x4c5008]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x1050
call fcn.004973d4
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
push 0x1050
push 0
push esi
call sub.VCRUNTIME140.dll_memset
lea ecx, [esi + 0x44]
mov dword [esi], 0
mov eax, ecx
mov dword [esi + 4], 0
neg eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
lea edx, [esi + 0x1044]
mov dword [esi + 0x10], 0
and eax, 3
mov dword [esi + 0x14], 0
add esp, 0x10
mov dword [esi + 0x18], 0
add eax, ecx
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [ebp - 0x14], esi
mov dword [edx], 0
mov dword [esi + 0x1048], 0
mov dword [esi + 0x38], ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edx
mov byte [ebp - 4], 2
mov dword [esi + 0x104c], 0
mov dword [ebp - 4], 0xffffffff
mov eax, edi
mov dword [edi], esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x470ee0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a50b6
mov eax, dword fs:[0]
push eax
sub esp, 0x834
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x824], ecx
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [ebp - 0x810]
push eax
push 0x3fe
call edi
mov ebx, eax
mov dword [ebp - 0x81c], ebx
test ebx, ebx
je 0x470fbe
lea edx, [ebp - 0x810]
mov dword [ebp - 0x814], 0
xor esi, esi
mov dword [ebp - 0x818], edx
mov dword [ebp - 0x814], esi
mov dword [ebp - 4], esi
cmp ebx, 0x3fe
jbe 0x470fdc
xor ecx, ecx
lea eax, [ebx + 2]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0049790b
add esp, 4
mov dword [ebp - 0x818], eax
mov esi, eax
mov dword [ebp - 0x814], esi
push eax
push ebx
call edi
test eax, eax
je 0x470fa8
cmp eax, ebx
ja 0x470fa8
mov edx, esi
xor ecx, ecx
mov ebx, eax
mov dword [ebp - 0x81c], ebx
mov dword [edx + eax*2], ecx
jmp 0x47100a
mov dword [ebp - 4], 0xffffffff
mov eax, esi
test eax, eax
je 0x470fbe
push eax
call fcn.004978da
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004973c3
mov esp, ebp
pop ebp
ret
lea eax, [ebx + ebx]
cmp eax, 0x800
jae 0x471143
xor ecx, ecx
mov word [ebp + eax - 0x810], cx
add eax, 2
cmp eax, 0x800
jae 0x471143
mov word [ebp + eax - 0x810], cx
xor eax, eax
xor edi, edi
test ebx, ebx
je 0x471122
mov ecx, dword [ebp - 0x81c]
mov ebx, 2
cmp word [edx + ebx - 2], 0
jne 0x471116
cmp eax, edi
je 0x471116
lea edx, [edx + eax*2]
mov dword [ebp - 0x82c], 0
mov ecx, edx
mov dword [ebp - 0x828], 0
xor eax, eax
mov dword [ebp - 0x82c], 0
mov word [ebp - 0x83c], ax
mov dword [ebp - 0x828], 7
lea eax, [ecx + 2]
mov dword [ebp - 0x820], eax
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x471074
sub ecx, dword [ebp - 0x820]
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x83c]
call fcn.004027a0
mov byte [ebp - 4], 1
lea eax, [ebp - 0x83c]
mov ecx, dword [ebp - 0x824]
push eax
call fcn.00403c00
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x828]
cmp edx, 8
jb 0x4710ea
mov ecx, dword [ebp - 0x83c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4710e0
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47113d
push edx
push ecx
call fcn.00497404
add esp, 8
mov ecx, dword [ebp - 0x81c]
xor eax, eax
mov edx, dword [ebp - 0x818]
mov word [ebp - 0x83c], ax
lea eax, [edi + 1]
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x828], 7
inc edi
add ebx, 2
cmp edi, ecx
jb 0x471021
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x471136
push esi
call fcn.004978da
add esp, 4
mov al, 1
jmp 0x470fc0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.00497a58
int3
Function at 0x471ab0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a51eb
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi], 0
je 0x471ae9
call fcn.00471ce0
cmp byte [0x4c5cac], 0
jne 0x471afc
mov eax, 0x80000001
jmp 0x471cbb
mov eax, dword [esi]
test eax, eax
jne 0x471b7c
push 8
call fcn.004973d4
mov edi, eax
add esp, 4
mov dword [ebp - 0x150], edi
mov dword [ebp - 4], 0
push 1
call fcn.004973d4
add esp, 4
mov dword [edi + 4], eax
mov byte [eax], 0
lea eax, [ebp - 0x130]
push 0x118
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x471b6b
cmp dword [ebp - 0x130], 6
mov eax, dword [edi + 4]
setae cl
mov byte [eax], cl
mov dword [ebp - 4], 0xffffffff
mov dword [esi], edi
mov dword [edi], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x471caa
call fcn.0047bd40
test al, al
jne 0x471bbe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [esi]
push eax
add ecx, 4
call fcn.0047c450
test al, al
je 0x471caa
mov ecx, dword [esi]
add ecx, 4
call fcn.0047b770
call fcn.0047bd40
test al, al
je 0x471caa
push 0xc
xor eax, eax
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 0
lea ecx, [ebp - 0x14c]
push str.Advapi32.dll
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 7
mov word [ebp - 0x14c], ax
call fcn.004027a0
mov dword [ebp - 4], 2
lea eax, [ebp - 0x14c]
push eax
call fcn.0046c3a0
mov ecx, eax
call fcn.0046c460
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x138]
cmp edx, 8
jb 0x471c66
mov ecx, dword [ebp - 0x14c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x471c5c
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x471c5c
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00497404
add esp, 8
xor eax, eax
mov dword [ebp - 0x13c], 0
mov dword [ebp - 0x138], 7
mov word [ebp - 0x14c], ax
test edi, edi
je 0x471caa
push str.RegOpenCurrentUser
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x471caa
push dword [esi]
push dword [ebp + 8]
call eax
test eax, eax
je 0x471caa
mov eax, dword [esi]
mov dword [eax], 0
mov eax, dword [esi]
cmp dword [eax], 0
jne 0x471cb9
mov dword [eax], 0x80000001
mov eax, dword [esi]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004973c3
mov esp, ebp
pop ebp
ret 4
Function at 0x477c60
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x4c5008]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
mov ebp, ecx
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
push edi
cmp dword [ebp + 0x10], 0xffffffff
mov edi, dword [esp + 0x20]
je 0x477ce2
mov ecx, 0x100000
nop dword [eax]
nop word [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x477ce2
test ecx, ecx
je 0x477cde
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x477ca0
xor eax, eax
jmp 0x477ce7
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x477cf1
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004973c3
add esp, 0xc
ret 0xc

Function at 0x478710
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4c5008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 0x10]
cmp eax, 0xffffffff
je 0x478783
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47875e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x478783
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004973c3
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004973c3
add esp, 8
ret 4

Function at 0x478af0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4c5008]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, dword [esp + 0x10]
push edi
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [ecx + 4]
cmp eax, 0xffffffff
je 0x478b63
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x478b3e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x478b63
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, edi
pop edi
adc eax, 0
mov dword [esi], ecx
mov dword [esi + 4], eax
xor eax, eax
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004973c3
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
mov eax, 1
pop edi
pop esi
xor ecx, esp
call fcn.004973c3
add esp, 8
ret 4
Function at 0x47ae10
Capabilities:
Check os version

Disassembly:
sub esp, 0x120
mov eax, dword [0x4c5008]
xor eax, esp
mov dword [esp + 0x11c], eax
push esi
push 1
mov esi, ecx
call fcn.004973d4
mov dword [esi], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov dword [esp + 4], 0x11c
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x47ae6c
cmp dword [esp + 8], 6
mov ecx, dword [esi]
setae dl
mov byte [ecx], dl
mov ecx, dword [esp + 0x120]
pop esi
xor ecx, esp
call fcn.004973c3
add esp, 0x120
ret
Function at 0x47df40
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4c5008]
xor eax, esp
mov dword [esp + 4], eax
mov eax, dword [ecx]
push esi
push edi
mov edi, dword [esp + 0x14]
test eax, eax
je 0x47dfa3
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x47dfa3
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x47df7e
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x47dfa3
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.004973c3
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.004973c3
add esp, 8
ret 4

Function at 0x47e220
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6738
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
cmp esi, 0xffffffff
jne 0x47e25b
xor al, al
jmp 0x47e325
and esi, 0xffffb1af
mov eax, edi
cmp dword [edi + 0x14], 8
jb 0x47e26b
mov eax, dword [edi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
push eax
call ebx
test eax, eax
je 0x47e280
mov al, 1
jmp 0x47e325
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.0047eb50
test al, al
je 0x47e2ca
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push esi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x47e2ca
mov bl, 1
jmp 0x47e2cc
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x47e30f
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47e305
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47e305
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00497404
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004973c3
mov esp, ebp
pop ebp
ret
Function at 0x47e350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4a6738
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x47e386
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x47e436
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.0047eb50
test al, al
je 0x47e3df
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x47e422
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47e418
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
jbe 0x47e418
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
push edx
push ecx
call fcn.00497404
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004973c3
mov esp, ebp
pop ebp
ret
Function at 0x47e770
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x624]
sub esp, 0x624
push 0xffffffffffffffff
push 0x4a67b8
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x4c5008]
xor eax, ebp
mov dword [ebp + 0x620], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 4
lea ecx, [ebp - 0x10]
call fcn.00408cd0
mov eax, dword [0x4c5cb0]
mov dword [ebp - 0x10], 0x4c5cb0
test eax, eax
je 0x47e7c8
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov dword [ebp - 4], 0
mov edx, dword [0x4c5088]
test edx, edx
je 0x47e826
cmp esi, 0x4c5078
je 0x47e7fd
cmp dword [0x4c508c], 8
mov eax, 0x4c5078
push edx
cmovae eax, dword [0x4c5078]
mov ecx, esi
push eax
call fcn.004027a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x47e81f
mov eax, dword [eax]
test eax, eax
je 0x47e818
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
mov al, 1
jmp 0x47e940
push 0x20c
lea eax, [ebp + 0x414]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp + 0x414]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x103
ja 0x47e91c
xor eax, eax
push 0x412
push eax
mov word [ebp + 0x61e], ax
lea eax, [ebp]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp]
push 0x208
push eax
lea eax, [ebp + 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
cmp eax, 0x208
ja 0x47e8c0
test eax, eax
je 0x47e8c0
add eax, eax
cmp eax, 0x412
jae 0x47e961
xor ecx, ecx
mov word [ebp + eax], cx
lea ecx, [ebp]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47e8b0
lea eax, [ebp]
jmp 0x47e8e1
lea ecx, [ebp + 0x414]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47e8d0
lea eax, [ebp + 0x414]
sub ecx, edx
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.004027a0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x47e81f
mov eax, dword [eax]
test eax, eax
je 0x47e818
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
mov al, 1
jmp 0x47e940
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x47e93e
mov eax, dword [eax]
test eax, eax
je 0x47e937
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 0x10], 0
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp + 0x620]
xor ecx, ebp
call fcn.004973c3
lea esp, [ebp + 0x624]
pop ebp
ret
call fcn.00497a58
int3