joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47042c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x52cbdc]
cmp byte [eax], 0
jne 0x47045e
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x4704df
xor eax, eax
push ebp
push 0x4704c1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x52cbdc]
cmp byte [eax], 0
je 0x4704a0
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x47048d
mov ebx, pe_nt_image_headers32
jmp 0x4704a0
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x4704a0
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4704df
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4705fc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4707ec
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x470808
call fcn.00408e88
test eax, eax
je 0x4707c9
cmp byte [ebp - 0x11], 0
je 0x4707bc
xor edx, edx
push ebp
push 0x4707b2
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x52cbdc]
cmp byte [eax], 0
je 0x47068a
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x470677
mov esi, pe_nt_image_headers32
jmp 0x47068a
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x47068a
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x4707a1
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x470780
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x470780
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x470780
mov eax, dword [0x52b11c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a34
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004081e8
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x470776
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a34
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.004263ac
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00408b0c
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004705fc
test al, al
jne 0x470776
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4707c9
dec esi
cmp esi, 0xffffffff
jne 0x4706fa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4707a8
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a34
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004704e8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4707f3
lea eax, [ebp - 0x24]
call fcn.00407c30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x4714d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088b0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x471586
xor eax, eax
push ebp
push 0x471575
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045e8
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.0040502c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088b0
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471586
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x471cb8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x471d8e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x471d61
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x471d12
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004089ac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041e5fc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083c4
jmp 0x471d21
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00408568
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x471d32
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x471d54
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x52b1b0]
inc ecx
dec edx
jne 0x471d3b
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471d6b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471d95
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x471da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x471ec0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x471e93
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x471e0b
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.004089ac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041e5fc
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083c4
jmp 0x471e1a
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00408568
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x471e34
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x471e7d
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00409714
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x52b5b4]
mov eax, dword [eax*8 + 0x52b5b0]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x471e3f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471e9d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471ec7
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x475db0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x475e78
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407c30
xor eax, eax
push ebp
push 0x475e52
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x475e48
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x475d84]
call fcn.00409cc0
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x475e30
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408908
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x475d84]
call fcn.00409cc0
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475e5c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475e7f
lea eax, [ebp - 4]
mov edx, dword [0x475d84]
call fcn.00409de4
ret

Function at 0x47a238
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x47a2d4
push 0
mov eax, ebx
call fcn.004088b0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x47a2af
mov ebx, esi
test ebx, ebx
je 0x47a281
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004088b0
push eax
push 1
push 0
mov eax, edi
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x47a2ca
mov ecx, dword [0x52cd28]
mov dl, 1
mov eax, dword [0x478218]
call fcn.00425004
call fcn.00407328
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47a41c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40f3e8]
call fcn.004090c0
xor eax, eax
push ebp
push 0x47a566
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x52c010], 0
jne 0x47a470
mov ecx, dword [0x52cb9c]
mov dl, 1
mov eax, dword [0x41a02c]
call fcn.00425004
call fcn.00407328
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.0040502c
mov eax, ebx
call fcn.0040861c
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x47a574
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040b440
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x47a4b7
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x47a50c
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x47a505
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00408998
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.0040895c
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.0041e5b8
test eax, eax
jne 0x47a505
mov ebx, 0x15
jmp 0x47a511
mov ebx, 0x10
jmp 0x47a511
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x52c010]
call fcn.0047a1fc
mov eax, dword [ebp - 4]
call fcn.0047a1fc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040b458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a56d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0xc]
mov edx, dword [0x40f3e8]
call fcn.00409198
ret

Function at 0x47b3e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b4af
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b48c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x47b482
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408908
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47b452
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47b468
mov eax, ebx
mov edx, 0x47b4cc
call fcn.00408ab4
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047b390
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b496
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b4b6
lea eax, [ebp - 0x208]
call fcn.00407c30
ret
Function at 0x47b4d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b59f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b57c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x47b572
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408908
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47b542
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47b558
mov eax, ebx
mov edx, 0x47b5bc
call fcn.00408ab4
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047b390
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b586
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b5a6
lea eax, [ebp - 0x208]
call fcn.00407c30
ret

Function at 0x47b5c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b6cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b69d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x52cbdc]
cmp byte [eax], 0
jne 0x47b61d
mov eax, ebx
call fcn.0047b4d0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b6a7
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemWow64DirectoryW
test eax, eax
je 0x47b693
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040895c
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0047b390
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x47b675
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47b693
lea edx, [ebp - 0x218]
mov eax, dword [ebx]
call fcn.004263ac
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b6a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b6d2
lea eax, [ebp - 0x218]
call fcn.00407c30
lea eax, [ebp - 0x210]
call fcn.00407c30
ret

Function at 0x47b7dc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi

Function at 0x47b8f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b97d
Function at 0x47c420
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47c5b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47c587
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c254
cmp al, 9
jb 0x47c4ff
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408a34
xor edx, edx
push ebp
push 0x47c4f8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47c4e0
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, dword [ebp - 8]
call fcn.0042066c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c4b2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47c4ce
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004263ac
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c591
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c4ff
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a34
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x52cdf8]
mov eax, dword [eax]
mov ecx, 0x47c5d0
mov edx, 0x47c5ec
call fcn.0046ffb0
test al, al
je 0x47c57d
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0047b390
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408010
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c54b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47c57d
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c560
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47c57d
mov eax, dword [ebp - 8]
mov edx, 0x47c67c
call fcn.00408ab4
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c591
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c5bb
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47ec50
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov esi, eax
xor eax, eax
push ebp
push 0x47ede9
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], 0
je 0x47ec90
call fcn.0046cb94
mov dword [ebp - 0x18], eax
mov eax, esi
test eax, eax
je 0x47ec9b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x47eca6
xor ebx, ebx
jmp 0x47edc1
cmp byte [ebp - 0x12], 0
je 0x47edaa
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00408058
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004263fc
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00408058
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0041feb8
mov eax, dword [ebp - 8]
test eax, eax
je 0x47ece7
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x47ed14
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00408cdc
mov eax, dword [ebp - 0x1c]
mov edx, 0x47ee04
call fcn.00408ca4
sete al
jmp 0x47ed16
xor eax, eax
test al, al
je 0x47ed1e
mov al, 1
jmp 0x47ed28
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041f828
test al, al
je 0x47ed30
mov al, 1
jmp 0x47ed3e
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408ca4
sete al
test al, al
jne 0x47edc1
cmp dword [ebp - 4], 0
jne 0x47ed62
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x47edc1
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00408908
mov eax, dword [ebp - 0x20]
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0047ec50
mov ebx, eax
test bl, bl
je 0x47eda0
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x47eda4
xor eax, eax
jmp 0x47eda6
mov al, 1
mov ebx, eax
jmp 0x47edc1
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47edf0
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407c90
ret

Function at 0x47ee08
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088b0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47ee21
test al, 0x10
jne 0x47ee25
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47f9e4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0047fa94
test al, al
je 0x47fa24
mov eax, esi
call fcn.0041fca8
mov ebx, eax
test bl, bl
jne 0x47fa24
mov eax, esi
call fcn.0047f8c8
push 0x80
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041fca8
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x47fa2c
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0047fa94
test al, al
je 0x47fa8c
mov eax, esi
call fcn.0041fca8
mov ebx, eax
test bl, bl
jne 0x47fa8c
mov eax, esi
call fcn.0047f8c8
push 0x80
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041fca8
mov ebx, eax
test bl, bl
jne 0x47fa8c
cmp byte [esp], 0
je 0x47fa8c
call fcn.0046c25c
test al, al
je 0x47fa8c
mov eax, esi
call fcn.00480008
mov ebx, eax
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x47fa94
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088b0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47faad
test al, 0x10
je 0x47fab1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47fab8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088b0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47fad1
test al, 0x10
je 0x47fad5
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47fc1c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47fc85
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00408058
lea eax, [ebp - 8]
mov edx, esi
call fcn.00408058
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fc8c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret