joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a504
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40f3f0]
call fcn.004090c0
xor eax, eax
push ebp
push 0x47a64e
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x532010], 0
jne 0x47a558
mov ecx, dword [0x532ba4]
mov dl, 1
mov eax, dword [0x41a034]
call fcn.004250e8
call fcn.00407328
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.0040502c
mov eax, ebx
call fcn.0040861c
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x47a65c
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040b440
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x47a59f
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x47a5f4
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x47a5ed
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00408998
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.0040895c
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.0041e5c0
test eax, eax
jne 0x47a5ed
mov ebx, 0x15
jmp 0x47a5f9
mov ebx, 0x10
jmp 0x47a5f9
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x532010]
call fcn.0047a2e4
mov eax, dword [ebp - 4]
call fcn.0047a2e4
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040b458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a655
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0xc]
mov edx, dword [0x40f3f0]
call fcn.00409198
ret

Function at 0x47b4d8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b5a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b584
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x47b57a
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408908
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47b54a
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47b560
mov eax, ebx
mov edx, 0x47b5c4
call fcn.00408ab4
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047b488
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b58e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b5ae
lea eax, [ebp - 0x208]
call fcn.00407c30
ret
Function at 0x47b5c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b697
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b674
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x47b66a
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408908
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47b63a
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47b650
mov eax, ebx
mov edx, 0x47b6b4
call fcn.00408ab4
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047b488
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b67e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b69e
lea eax, [ebp - 0x208]
call fcn.00407c30
ret

Function at 0x47b6b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b7c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b795
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x532be4]
cmp byte [eax], 0
jne 0x47b715
mov eax, ebx
call fcn.0047b5c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b79f
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemWow64DirectoryW
test eax, eax
je 0x47b78b
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040895c
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0047b488
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x47b76d
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47b78b
lea edx, [ebp - 0x218]
mov eax, dword [ebx]
call fcn.00426490
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b79f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b7ca
lea eax, [ebp - 0x218]
call fcn.00407c30
lea eax, [ebp - 0x210]
call fcn.00407c30
ret
Function at 0x47b8d4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b9c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b9a0
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x47b996
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408908
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0047fec0
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00408010
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047b488
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x47b980
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47b996
mov eax, ebx
mov edx, 0x47b9e4
call fcn.00408ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b9aa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b9cf
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00407c90
ret

Function at 0x47b9e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47ba75
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x402]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x47ba6b
mov edx, ebx
lea eax, [ebp - 0x402]
call fcn.00420750
cmp dword [ebx], 0
je 0x47ba6b
mov eax, dword [ebx]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x47ba55
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47ba6b
mov eax, ebx
mov edx, 0x47ba94
call fcn.00408ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ba7f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47c2b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47c433
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47c40b
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c334
cmp al, 9
jb 0x47c39b
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408a34
xor edx, edx
push ebp
push 0x47c394
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47c37c
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, dword [ebp - 8]
call fcn.00420750
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c34e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47c36a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00426490
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c415
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c39b
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a34
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x532d28]
mov eax, dword [eax]
mov ecx, 0x47c450
mov edx, 0x47c47c
call fcn.00470098
test al, al
je 0x47c401
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c3cf
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47c401
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c3e4
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47c401
mov eax, dword [ebp - 8]
mov edx, 0x47c50c
call fcn.00408ab4
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c415
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c43a
lea eax, [ebp - 0x10]
call fcn.00407c30
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47c510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47c6a4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47c677
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c334
cmp al, 9
jb 0x47c5ef
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408a34
xor edx, edx
push ebp
push 0x47c5e8
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47c5d0
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, dword [ebp - 8]
call fcn.00420750
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c5a2
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47c5be
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00426490
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c681
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c5ef
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a34
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x532e00]
mov eax, dword [eax]
mov ecx, 0x47c6c0
mov edx, 0x47c6dc
call fcn.00470098
test al, al
je 0x47c66d
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0047b488
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408010
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c63b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47c66d
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c650
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47c66d
mov eax, dword [ebp - 8]
mov edx, 0x47c76c
call fcn.00408ab4
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c681
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c6ab
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47c770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47c904
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47c8d7
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c334
cmp al, 9
jb 0x47c84f
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408a34
xor edx, edx
push ebp
push 0x47c848
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47c830
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, dword [ebp - 8]
call fcn.00420750
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c802
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47c81e
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00426490
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c8e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c84f
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a34
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x532e00]
mov eax, dword [eax]
mov ecx, 0x47c920
mov edx, 0x47c948
call fcn.00470098
test al, al
je 0x47c8cd
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0047b488
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408010
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c89b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47c8cd
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47c8b0
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47c8cd
mov eax, dword [ebp - 8]
mov edx, 0x47c9d8
call fcn.00408ab4
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c8e1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c90b
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47f034
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov esi, eax
xor eax, eax
push ebp
push 0x47f1cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], 0
je 0x47f074
call fcn.0046cc7c
mov dword [ebp - 0x18], eax
mov eax, esi
test eax, eax
je 0x47f07f
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x47f08a
xor ebx, ebx
jmp 0x47f1a5
cmp byte [ebp - 0x12], 0
je 0x47f18e
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00408058
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004264e0
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00408058
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.0041ff24
mov eax, dword [ebp - 8]
test eax, eax
je 0x47f0cb
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x47f0f8
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00408cdc
mov eax, dword [ebp - 0x1c]
mov edx, 0x47f1e8
call fcn.00408ca4
sete al
jmp 0x47f0fa
xor eax, eax
test al, al
je 0x47f102
mov al, 1
jmp 0x47f10c
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041f830
test al, al
je 0x47f114
mov al, 1
jmp 0x47f122
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408ca4
sete al
test al, al
jne 0x47f1a5
cmp dword [ebp - 4], 0
jne 0x47f146
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x47f1a5
mov eax, dword [ebp - 4]
call fcn.004088b0
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00408908
mov eax, dword [ebp - 0x20]
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0047f034
mov ebx, eax
test bl, bl
je 0x47f184
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x47f188
xor eax, eax
jmp 0x47f18a
mov al, 1
mov ebx, eax
jmp 0x47f1a5
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f1d4
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407c90
ret

Function at 0x47f1ec
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088b0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47f205
test al, 0x10
jne 0x47f209
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47fdc8
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0047fe78
test al, al
je 0x47fe08
mov eax, esi
call fcn.0041fd14
mov ebx, eax
test bl, bl
jne 0x47fe08
mov eax, esi
call fcn.0047fcac
push 0x80
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041fd14
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x47fe10
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
push ecx
mov byte [esp], dl
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.0047fe78
test al, al
je 0x47fe70
mov eax, esi
call fcn.0041fd14
mov ebx, eax
test bl, bl
jne 0x47fe70
mov eax, esi
call fcn.0047fcac
push 0x80
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.0041fd14
mov ebx, eax
test bl, bl
jne 0x47fe70
cmp byte [esp], 0
je 0x47fe70
call fcn.0046c33c
test al, al
je 0x47fe70
mov eax, esi
call fcn.004803ec
mov ebx, eax
mov eax, ebx
pop edx
pop esi
pop ebx
ret

Function at 0x47fe78
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088b0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47fe91
test al, 0x10
je 0x47fe95
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x47fe9c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.004088b0
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47feb5
test al, 0x10
je 0x47feb9
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x480000
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x480069
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00408058
lea eax, [ebp - 8]
mov edx, esi
call fcn.00408058
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
call sub.kernel32.dll_MoveFileW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x480070
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x4869e0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x486a44
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.004088b0
push eax
mov eax, esi
call fcn.004088b0
push eax
mov eax, ebx
call fcn.004088b0
push eax
push 0x486a54
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486a4b
lea eax, [ebp + 8]
call fcn.00407c30
ret

Function at 0x486a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x486aff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], 0x40
mov eax, 0x486b14
mov dword [ebp - 0x30], eax
mov eax, ebx
call fcn.004088b0
mov dword [ebp - 0x2c], eax
mov eax, esi
call fcn.004088b0
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x34], edi
mov eax, dword [ebp + 8]
call fcn.004088b0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 1
lea ebx, [ebp - 0x3c]
push ebx
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb eax, eax
inc eax
mov ebx, eax
test bl, bl
je 0x486ae9
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_WaitForSingleObject
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486b06
lea eax, [ebp + 8]
call fcn.00407c30
ret

Function at 0x486b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebp + 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x486b84
push dword fs:[eax]
mov dword fs:[eax], esp
push 5
mov eax, dword [ebp + 8]
call fcn.004088b0
push eax
mov eax, esi
call fcn.004088b0
push eax
mov eax, ebx
call fcn.004088b0
push eax
push 0x486b94
push edi
call sub.shell32.dll_ShellExecuteW
cmp eax, 0x20
seta bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486b8b
lea eax, [ebp + 8]
call fcn.00407c30
ret