joyce8/EMBER2024-capa huggingface dataset:
Function at 0x464bb0
Capabilities:
Execute vbscript javascript or jscript in memory

Disassembly:
push 0xffffffffffffffff
push 0x561e1b
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x424], eax
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
mov esi, dword [esp + 0x448]
mov ebp, ecx
cmp dword [ebp + 0x1ab0], esi
je 0x464d99
mov eax, dword [ebp + 0x1850]
lea edi, [ebp + 0x1850]
test eax, eax
je 0x464c2b
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
mov eax, dword [edi]
test eax, eax
je 0x464c2b
mov dword [edi], 0
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [ebp + 0x1ab0], 0
test esi, esi
je 0x464d99
lea eax, [esp + 0x14]
push eax
push 0x574308
call dword [sym.imp.ole32.dll_CLSIDFromProgID]
test eax, eax
jge 0x464c7a
lea ecx, [esp + 0x14]
push ecx
push 0x57c090
call fcn.00459a20
add esp, 8
test eax, eax
jge 0x464c7a
push 0xffffffffffffffff
push 0x10
push 0x552b
call fcn.0050c4d3
jmp 0x464d99
push edi
push 0x57b184
push 0x17
push 0
lea edx, [esp + 0x24]
push edx
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x464d75
mov ecx, dword [edi]
xor eax, eax
mov dword [esp + 0x10], eax
test ecx, ecx
je 0x464cba
mov eax, dword [ecx]
mov eax, dword [eax]
lea edx, [esp + 0x10]
push edx
push 0x57bc50
push ecx
call eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x440], 0
test eax, eax
je 0x464d5a
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push eax
call edx
mov esi, eax
test esi, esi
jl 0x464d56
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push 0x5b4094
push eax
call edx
mov esi, eax
test esi, esi
jl 0x464d56
mov eax, dword [edi]
mov edx, dword [0x5b4090]
mov ecx, dword [eax]
push 0x402
push edx
push eax
mov eax, dword [ecx + 0x20]
call eax
mov esi, eax
test esi, esi
jl 0x464d56
cmp dword [esp + 0x448], 2
mov eax, str.emmet_epp.js
je 0x464d20
mov eax, str.zen_coding_epp.js
push eax
lea ecx, [esp + 0x28]
push 0x208
push ecx
call fcn.00424440
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x20]
push eax
call fcn.004649f0
mov esi, eax
add esp, 0x14
test esi, esi
jl 0x464d56
mov edi, dword [edi]
mov ecx, dword [edi]
mov edx, dword [ecx + 0x14]
push 2
push edi
call edx
mov esi, eax
mov eax, dword [esp + 0x10]
mov dword [esp + 0x440], 0xffffffff
test eax, eax
je 0x464d71
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
test esi, esi
jge 0x464d8c
push 0xffffffffffffffff
push 0x10
push 0x5526
call fcn.0050c4d3
mov ecx, ebp
call fcn.0045ff30
jmp 0x464d99
mov eax, dword [esp + 0x448]
mov dword [ebp + 0x1ab0], eax
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.0053f73f
add esp, 0x434
ret 4
Function at 0x4652b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x7d4
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x7d0], eax
mov eax, dword [esp + 0x7d8]
push esi
mov esi, dword [esp + 0x7e0]
push eax
push 0x3e8
lea eax, [esp + 0xc]
push eax
push 0x57bc10
push 0x571d7c
push str.InternetShortcut
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 4]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x465300
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call fcn.00401e40
mov ecx, dword [esp + 0x7d4]
pop esi
xor ecx, esp
call fcn.0053f73f
add esp, 0x7d4
ret
Function at 0x468340
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x5620db
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x430], eax
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x440]
mov dword fs:[0], eax
mov edi, dword [esp + 0x450]
lea eax, [esp + 0x2c]
push eax
call fcn.004f6940
add esp, 4
lea ecx, [esp + 0x2c]
push ecx
mov dword [0x5ed0a4], 0
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4683bb
push 2
lea edx, [esp + 0x30]
push edx
push edi
call fcn.00467c60
add esp, 0xc
jmp 0x468447
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4683d5
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea esi, [eax + 0x10]
mov dword [esp + 0xc], esi
push 0x5f7e
mov dword [esp + 0x44c], 0
call fcn.00508953
test eax, eax
je 0x468411
push 0x5f7e
push eax
lea ecx, [esp + 0x14]
call fcn.00401d70
mov esi, dword [esp + 0xc]
mov ecx, dword [edi + 4]
push esi
push 0
push 1
push ecx
call dword [sym.imp.USER32.dll_AppendMenuW]
lea eax, [esi - 0x10]
mov dword [esp + 0x448], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x468447
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [0x5b4070]
mov ecx, dword [0x5ed0a4]
cmp ecx, eax
jge 0x468464
sub eax, ecx
push eax
push ecx
mov ecx, 0x5b4068
call fcn.004627d0
mov edx, dword [edi + 4]
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x18], eax
push edx
mov dword [esp + 0x18], 0x1c
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x1c], 0x10
call dword [sym.imp.USER32.dll_GetMenuInfo]
mov eax, dword [esp + 0x18]
mov edx, dword [edi + 4]
lea ecx, [esp + 0x10]
and eax, 0x7bffffff
push ecx
or eax, 0x4000000
push edx
mov dword [esp + 0x20], eax
call dword [sym.imp.USER32.dll_SetMenuInfo]
mov ecx, dword [esp + 0x440]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x430]
xor ecx, esp
call fcn.0053f73f
add esp, 0x440
ret
Function at 0x4692d0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x5621b8
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0x68]
mov dword fs:[0], eax
push 0x44
lea eax, [esp + 0x28]
push 0
push eax
call fcn.0053ff80
add esp, 0xc
mov dword [esp + 0x24], 0x44
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x469329
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x10], eax
mov edx, dword [esp + 0x78]
mov dword [esp + 0x70], 0
test edx, edx
jne 0x46934d
xor eax, eax
jmp 0x469361
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x469352
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00401e40
mov esi, dword [esp + 0x7c]
test esi, esi
je 0x46939d
cmp word [esi], 0
je 0x46939d
push 0x57c334
lea ecx, [esp + 0x14]
call fcn.00402270
push esi
lea ecx, [esp + 0x14]
call fcn.00402270
push 0x22
lea ecx, [esp + 0x14]
call fcn.00405c40
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edi, eax
test edi, edi
je 0x4693da
mov eax, dword [esp + 0x14]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call ebx
mov ecx, dword [esp + 0x18]
push ecx
call ebx
lea eax, [esi - 0x10]
mov dword [esp + 0x70], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x4693fe
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
mov ecx, dword [esp + 0x68]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x64
ret
Function at 0x469870
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x424
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x420], eax
push esi
xor esi, esi
push edi
mov edi, dword [esp + 0x430]
mov dword [esp + 0xc], 0x208
cmp dword [0x5ecf4c], esi
je 0x469904
lea eax, [esp + 8]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerFileExts.htmlUserChoice
push reloc.WSOCK32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x469904
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1c]
push ecx
push esi
push str.Progid
push edx
mov dword [esp + 0x2c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4698f5
lea esi, [eax + 1]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x469922
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x1c]
push edx
push str..html
push bind
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x469953
mov eax, dword [esp + 0x434]
push 1
push 0
push eax
lea ecx, [esp + 0x24]
push edi
push ecx
call fcn.00469420
add esp, 0x14
pop edi
pop esi
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0053f73f
add esp, 0x424
ret
mov ecx, dword [esp + 0x428]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.0053f73f
add esp, 0x424
ret
Function at 0x46b750
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov ecx, dword [0x5ed0c0]
push 0
call fcn.0050c645
test eax, eax
jne 0x46b929
mov ecx, dword [0x5ed0c0]
cmp dword [ecx + 0x1824], 0
lea eax, [ecx + 0x1824]
push edi
mov edi, ecx
je 0x46b920
mov dword [eax], 0
mov eax, dword [eax]
push ebx
push esi
cmp eax, 1
jne 0x46b8a4
mov eax, dword [0x5ba378]
mov dword [0x5ed110], 0xffffffff
cmp dword [eax + 0xc4], 0x3b5
lea esi, [edi + 0xec]
mov ecx, esi
jne 0x46b7eb
cmp dword [0x5ed730], 0
je 0x46b7d6
push 0xc
push 0x5b3fd8
call fcn.0051b33e
mov ecx, edi
call fcn.00457460
jmp 0x46b809
push 0xb
push 0x5b3f80
call fcn.0051b33e
mov ecx, edi
call fcn.00457460
jmp 0x46b809
cmp dword [0x5ed730], 0
je 0x46b7fd
push 0xb
push 0x5b3fac
jmp 0x46b804
push 0xa
push 0x5b3f58
call fcn.0051b33e
cmp dword [0x5b4800], 0
je 0x46b854
mov ecx, dword [0x5ed0c0]
push 0xe704
add ecx, 0xec
call fcn.0051aafa
mov ecx, dword [0x5ed0c0]
mov ebx, eax
push ebx
add ecx, 0xec
call fcn.0051ab55
mov ecx, dword [0x5ed0c0]
or eax, 0x4000000
push eax
push ebx
add ecx, 0xec
call fcn.0051b24d
push 0x14
call dword [sym.imp.USER32.dll_GetKeyState]
test al, 1
jne 0x46b8db
mov ecx, dword [0x5ed0c0]
push 0xe701
add ecx, 0xec
call fcn.0051aafa
mov ecx, dword [0x5ed0c0]
mov ebx, eax
push ebx
add ecx, 0xec
call fcn.0051ab55
mov ecx, dword [0x5ed0c0]
or eax, 0x4000000
push eax
push ebx
add ecx, 0xec
call fcn.0051b24d
jmp 0x46b8db
cmp eax, 2
jne 0x46b8b1
push eax
push 0x5b4008
jmp 0x46b8ce
cmp eax, 3
jne 0x46b8bf
push 4
push 0x5b4010
jmp 0x46b8ce
push 1
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], 0
push ecx
lea esi, [edi + 0xec]
mov ecx, esi
call fcn.0051b33e
push 0
mov ecx, esi
call fcn.0051ab55
or eax, 0x8000100
push eax
push 0
mov ecx, esi
call fcn.0051b24d
mov edx, dword [edi + 0x10c]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [edi + 0x10c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, edi
call fcn.00462ed0
mov ecx, dword [0x5ed0c0]
pop esi
pop ebx
pop edi
add esp, 4
jmp fcn.0046b590
pop ecx
ret
Function at 0x46d1f0
Capabilities:
Create directory

Disassembly:
sub esp, 0x414
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
movzx eax, word [esi]
push edi
xor edi, edi
test ax, ax
je 0x46d25e
cmp ax, 0x5c
je 0x46d230
add esi, 2
mov word [esp + edi*2 + 8], ax
movzx eax, word [esi]
inc edi
test ax, ax
jne 0x46d217
jmp 0x46d25e
movzx eax, word [esi]
test ax, ax
je 0x46d25e
jmp 0x46d240
mov ecx, 0x5c
cmp cx, ax
jne 0x46d25e
movzx eax, word [esi + 2]
add esi, 2
mov edx, ecx
mov word [esp + edi*2 + 8], dx
inc edi
test ax, ax
jne 0x46d240
mov eax, 0x5c
cmp ax, word [esi]
jne 0x46d273
mov ecx, eax
mov word [esp + edi*2 + 8], cx
inc edi
add esi, 2
movzx eax, word [esi]
test ax, ax
je 0x46d2c6
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp ax, 0x5c
je 0x46d299
add esi, 2
mov word [esp + edi*2 + 0xc], ax
movzx eax, word [esi]
inc edi
test ax, ax
jne 0x46d282
xor edx, edx
push edx
lea eax, [esp + 0x10]
push eax
mov word [esp + edi*2 + 0x14], dx
call ebx
mov ecx, 0x5c
cmp cx, word [esi]
jne 0x46d2bd
mov edx, ecx
mov word [esp + edi*2 + 0xc], dx
inc edi
add esi, 2
movzx eax, word [esi]
test ax, ax
jne 0x46d282
pop ebx
mov ecx, dword [esp + 0x418]
pop edi
pop esi
xor ecx, esp
call fcn.0053f73f
add esp, 0x414
ret

Function at 0x46d650
Capabilities:
Check if file exists
Create process on windows

Disassembly:
sub esp, 0x3c
push esi
mov esi, dword [esp + 0x44]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x46d6ad
push 0x3c
lea eax, [esp + 8]
push 0
push eax
call fcn.0053ff80
mov ecx, dword [0x5ed0c0]
add esp, 0xc
mov dword [esp + 4], 0x3c
mov edx, dword [ecx + 0x20]
lea eax, [esp + 4]
push eax
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], str.properties
mov dword [esp + 0x18], esi
mov dword [esp + 0xc], 0xc
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
pop esi
add esp, 0x3c
ret
push 0xffffffffffffffff
push 0
push 0x5ba3
call fcn.0050c4d3
pop esi
add esp, 0x3c
ret

Function at 0x46db20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xb0], 0
jne 0x46dbab
cmp dword [0x5ed7f0], 0
jne 0x46db3c
cmp dword [esp + 0xc], 0
jne 0x46dbab
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46dbab
test al, 1
je 0x46db84
cmp dword [esi + 0x64], 0
jne 0x46dbab
push 1
mov ecx, esi
call fcn.0046d100
mov dword [esi + 0x64], 1
mov dword [esi + 0x60], 1
cmp dword [0x5ed808], 0
je 0x46dbab
mov dword [esi + 0x94], 1
pop esi
ret 8
cmp dword [esi + 0x64], 0
je 0x46dbab
push 0
mov ecx, esi
call fcn.0046d100
mov dword [esi + 0x64], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x60], 0
pop esi
ret 8
Function at 0x471090
Capabilities:
Check if file exists
Copy file

Disassembly:
sub esp, 0x824
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x820], eax
mov ecx, dword [esp + 0x82c]
push edi
mov edi, dword [esp + 0x82c]
test ecx, ecx
jl 0x4711f6
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, eax
mov eax, dword [eax*4 + 0x5b9068]
imul edx, edx, 0x3e8
sub ecx, edx
imul ecx, ecx, 0x1ee8
mov ecx, dword [ecx + eax + 0x88]
test ecx, ecx
je 0x4711f6
xor edx, edx
cmp dx, word [ecx]
je 0x4711f6
xor eax, eax
mov word [esp + 4], ax
mov eax, ecx
push esi
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x471110
push 0x208
sub eax, esi
lea edx, [esp + 0xc]
push edx
sar eax, 1
push eax
push ecx
call fcn.0046d190
mov edx, dword [esp + 0x848]
movzx ecx, word [edx]
add esp, 0x10
cmp cx, 0x2f
je 0x47114e
mov esi, 0x5c
mov word [esp + eax*2 + 8], si
inc eax
test cx, cx
je 0x471176
movzx ecx, cx
mov esi, 0x2f
add edx, 2
cmp si, cx
jne 0x471168
mov ecx, 0x5c
mov word [esp + eax*2 + 8], cx
movzx ecx, word [edx]
inc eax
test cx, cx
jne 0x471153
lea edx, [esp + 8]
xor ecx, ecx
push edx
mov word [esp + eax*2 + 0xc], cx
lea eax, [esp + 0x41c]
push 0x208
push eax
call fcn.0053fe1c
lea ecx, [esp + 0x424]
push 0x5c
push ecx
call fcn.00540922
add esp, 0x14
pop esi
test eax, eax
je 0x4711b0
xor edx, edx
mov word [eax], dx
lea eax, [esp + 0x414]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4711d2
lea ecx, [esp + 0x414]
push ecx
call fcn.0046d1f0
add esp, 4
push 0
lea edx, [esp + 8]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
pop edi
mov ecx, dword [esp + 0x820]
xor ecx, esp
call fcn.0053f73f
add esp, 0x824
ret
mov ecx, dword [esp + 0x824]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0053f73f
add esp, 0x824
ret
Function at 0x473e05
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0xb0]
mov ebx, 1
xor ebp, ebp
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], ebx
test edi, edi
jne 0x473e31
mov eax, dword [esi + 0x24]
cmp dword [eax - 0xc], ebp
jle 0x473e31
cmp dword [esi + 0x64], ebp
jne 0x473e44
xor ebx, ebx
cmp dword [esi + 0xb0], 0
jne 0x473e9c
test ebx, ebx
je 0x473e9c
push 1
push 0
jmp 0x473ea2
push 0xffffffffffffffff
push 0x33
push 0x54ff
call fcn.0050c4d3
cmp eax, 6
jne 0x473e83
mov eax, dword [esi + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov eax, dword [esi + 0x24]
mov ecx, edi
and ecx, 0xfffffffe
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x473e31
xor ebx, ebx
mov ebp, edi
mov dword [esi + 0x64], ebx
mov dword [esi + 0x60], ebx
jmp 0x473e31
cmp eax, 2
jne 0x473e31
mov dword [esi + 0xb0], edi
pop edi
pop esi
mov dword [esp + 8], ebp
mov eax, ebp
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esi + 0x24]
push 1
push eax
mov edx, dword [esi]
mov eax, dword [edx + 0x98]
mov ecx, esi
call eax
test eax, eax
jne 0x473eb6
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x473ed7
mov ecx, dword [esi + 0x24]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 1
mov ecx, esi
mov dword [esi + 0x64], eax
mov dword [esi + 0x60], eax
call fcn.0046edb0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x473ee9
mov edi, dword [esp + 0x14]
mov dword [esi + 0xb0], edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x479be0
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x562b2b
mov eax, dword fs:[0]
push eax
sub esp, 0xc38
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0xc34], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b7b5c]
xor eax, esp
push eax
lea eax, [esp + 0xc4c]
mov dword fs:[0], eax
mov edi, dword [esp + 0xc68]
mov eax, dword [esp + 0xc64]
mov esi, dword [esp + 0xc5c]
mov ebp, dword [esp + 0xc6c]
mov dword [esp + 0x14], eax
test edi, edi
jne 0x479c5d
push edi
push 0x208
lea ecx, [esp + 0x840]
push ecx
push eax
call fcn.0044cdf0
add esp, 0x10
lea edi, [esp + 0x838]
mov ecx, dword [0x5ed87c]
mov ebx, dword [0x5ed880]
xor edx, edx
xor eax, eax
mov word [esp + 0x18], dx
mov word [esp + 0x428], ax
cmp dword [ecx - 0xc], eax
je 0x479da8
mov edx, dword [esp + 0xc70]
mov ecx, dword [esp + 0xc60]
push edx
push 0x208
lea eax, [esp + 0x20]
push eax
push ebp
push ecx
push esi
push 0x208
lea edx, [esp + 0x444]
push edx
push ebx
push edi
call fcn.00477640
add esp, 0x28
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x479dcf
call fcn.005089db
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x479ce3
push 0x80004005
call fcn.00401340
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x18]
push 0x54b6
push edx
mov dword [esp + 0xc60], 0
call fcn.00402140
mov eax, dword [esp + 0x20]
add esp, 0xc
push 0
push 0x14
push eax
call fcn.0050c485
cmp eax, 6
jne 0x479d7b
lea ecx, [esp + 0x18]
push ecx
call fcn.0046d1f0
xor edx, edx
mov word [esp + 0x1c], dx
mov edx, dword [esp + 0xc74]
push edx
push 0x208
xor eax, eax
mov word [esi], ax
xor ecx, ecx
lea eax, [esp + 0x24]
push eax
push ebp
mov word [esp + 0x43c], cx
mov ecx, dword [esp + 0xc74]
push ecx
push esi
push 0x208
lea edx, [esp + 0x448]
push edx
push ebx
push edi
call fcn.00477640
add esp, 0x2c
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov dword [esp + 0xc54], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x479dcf
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
jmp 0x479dcf
cmp dword [esp + 0xc70], eax
jne 0x479dcf
mov ecx, dword [esp + 0x14]
mov edi, dword [esp + 0xc60]
push ecx
push edi
push esi
call fcn.0053fe1c
push ebx
push edi
push esi
call fcn.0053fd9f
add esp, 0x18
mov ecx, dword [esp + 0xc4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xc34]
xor ecx, esp
call fcn.0053f73f
add esp, 0xc44
ret
Function at 0x47b540
Capabilities:
Get common file path

Disassembly:
sub esp, 0x824
mov eax, dword [0x5b7b5c]
xor eax, esp
mov dword [esp + 0x820], eax
push esi
mov esi, dword [esp + 0x82c]
lea eax, [esp + 0x414]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ecx, [esp + 4]
push ecx
push 0
lea edx, [esp + 0x41c]
push 0x57e7a4
push edx
call fcn.0044f000
lea eax, [esp + 0x14]
add esp, 0x10
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x47b592
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 8]
push eax
mov ecx, esi
call fcn.00401e40
mov ecx, dword [esp + 0x824]
pop esi
xor ecx, esp
call fcn.0053f73f
add esp, 0x824
ret
Function at 0x47e3b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], ecx
test edi, edi
jne 0x47e3e7
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push eax
push edx
call fcn.0047c5c0
inc eax
pop edi
pop ecx
ret 0x20
push ebp
mov ebp, dword [esp + 0x14]
test ebp, ebp
jle 0x47e3f5
xor eax, eax
mov word [edi], ax
mov eax, dword [esp + 0x24]
push ebx
mov ebx, dword [esp + 0x20]
push esi
cmp ebx, eax
jne 0x47e43c
mov esi, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
sub esi, eax
test esi, esi
jle 0x47e5a5
mov ecx, dword [ecx + 0x334]
lea edx, [ebx + ebx*8]
mov edx, dword [ecx + edx*4 + 8]
push esi
lea eax, [edx + eax*2]
push eax
push ebp
push edi
call fcn.0044c530
add esp, 0x10
lea eax, [esi + 1]
pop esi
pop ebx
pop ebp
pop edi
pop ecx
ret 0x20
cmp dword [ecx + 0x78], 0
je 0x47e479
cmp dword [esp + 0x34], 0
je 0x47e479
mov edx, dword [esp + 0x30]
push 1
push edx
mov edx, dword [esp + 0x28]
push 0
push 1
push eax
mov eax, dword [esp + 0x3c]
push eax
push ebx
push edx
push edi
call fcn.0047ade0
mov esi, eax
xor eax, eax
mov word [edi + esi*2], ax
lea eax, [esi + 1]
pop esi
pop ebx
pop ebp
pop edi
pop ecx
ret 0x20
mov eax, dword [ecx + 0x334]
mov ecx, dword [esp + 0x20]
lea edx, [ebx + ebx*8]
mov esi, dword [eax + edx*4]
lea eax, [eax + edx*4]
mov edx, dword [eax + 8]
sub esi, ecx
dec esi
push esi
lea eax, [edx + ecx*2]
push eax
push ebp
push edi
call fcn.0044c530
mov eax, dword [esp + 0x40]
add esp, 0x10
cmp eax, 1
jne 0x47e4bf
mov ecx, 0xd
mov word [edi + esi*2], cx
inc esi
mov edx, 0xa
mov word [edi + esi*2], dx
jmp 0x47e4d7
test eax, eax
jne 0x47e4ce
mov eax, 0xa
mov word [edi + esi*2], ax
jmp 0x47e4d7
mov ecx, 0xd
mov word [edi + esi*2], cx
mov ecx, dword [esp + 0x2c]
inc esi
xor edx, edx
inc ebx
cmp ebx, ecx
lea eax, [edi + esi*2]
mov word [eax], dx
jge 0x47e579
lea ebp, [ebx + ebx*8]
add ebp, ebp
add ebp, ebp
sub ecx, ebx
mov dword [esp + 0x20], ecx
lea ebx, [ebx]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx + 0x334]
mov ebx, dword [edx + ebp]
lea ecx, [edx + ebp]
mov ecx, dword [ecx + 8]
mov edx, dword [esp + 0x1c]
dec ebx
push ebx
push ecx
sub edx, esi
push edx
push eax
call fcn.0044c530
mov eax, dword [esp + 0x40]
add esp, 0x10
add esi, ebx
cmp eax, 1
jne 0x47e546
mov eax, 0xd
mov word [edi + esi*2], ax
inc esi
mov ecx, 0xa
mov word [edi + esi*2], cx
jmp 0x47e55e
test eax, eax
jne 0x47e555
mov edx, 0xa
mov word [edi + esi*2], dx
jmp 0x47e55e
mov eax, 0xd
mov word [edi + esi*2], ax
inc esi
xor ecx, ecx
lea eax, [edi + esi*2]
add ebp, 0x24
sub dword [esp + 0x20], 1
mov word [eax], cx
jne 0x47e500
mov ebp, dword [esp + 0x1c]
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x28]
test ebx, ebx
jle 0x47e5a5
mov eax, dword [esp + 0x10]
lea edx, [ecx + ecx*8]
mov ecx, dword [eax + 0x334]
mov edx, dword [ecx + edx*4 + 8]
push ebx
push edx
sub ebp, esi
lea eax, [edi + esi*2]
push ebp
push eax
call fcn.0044c530
add esp, 0x10
add esi, ebx
lea eax, [esi + 1]
pop esi
pop ebx
pop ebp
pop edi
pop ecx
ret 0x20