joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46fe70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00407d14
mov eax, dword [ebp - 8]
call fcn.00407d14
xor eax, eax
push ebp
push 0x46ffb0
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
xor eax, eax
mov dword [esi], eax
xor eax, eax
mov dword [edi], eax
xor ebx, ebx
mov eax, dword [0x531be4]
cmp byte [eax], 0
je 0x46fee6
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x46fed3
mov ebx, pe_nt_image_headers32
jmp 0x46fee6
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x46fee6
mov ebx, 0x200
lea eax, [ebp - 0x18]
push eax
or ebx, 0x20019
push ebx
push 0
mov eax, dword [ebp - 4]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x46ff95
cmp dword [ebp - 8], 0
jne 0x46ff17
xor ebx, ebx
jmp 0x46ff21
mov eax, dword [ebp - 8]
call fcn.004088b0
mov ebx, eax
lea eax, [ebp - 0x20]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46ff8c
mov eax, dword [ebp - 0x20]
call fcn.004045e8
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x46ff84
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x14]
jne 0x46ff7a
mov eax, dword [ebp - 0x1c]
mov dword [esi], eax
mov eax, dword [ebp - 0x20]
mov dword [edi], eax
mov byte [ebp - 0xd], 1
jmp 0x46ff8c
mov eax, dword [ebp - 0x1c]
call fcn.00404604
jmp 0x46ff8c
mov eax, dword [ebp - 0x1c]
call fcn.00404604
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46ffb7
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret

Function at 0x470294
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov dword [esp], ecx
mov ebp, edx
mov edi, eax
xor ebx, ebx
xor esi, esi
mov eax, dword [0x531be4]
cmp byte [eax], 0
je 0x4702d8
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x4702c5
mov esi, pe_nt_image_headers32
jmp 0x4702d8
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x4702d8
mov esi, 0x200
lea eax, [esp + 4]
push eax
or esi, 0x20019
push esi
push 0
mov eax, ebp
call fcn.004088b0
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x470323
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x10]
call fcn.004088b0
push eax
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47032c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
xor ebx, ebx
xor eax, eax
mov dword [edi], eax
xor esi, esi
mov eax, dword [0x531be4]
cmp byte [eax], 0
je 0x47037b
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x470368
mov esi, pe_nt_image_headers32
jmp 0x47037b
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x47037b
mov esi, 0x200
lea eax, [ebp - 0x10]
push eax
or esi, 0x20019
push esi
push 0
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4703f3
cmp dword [ebp - 0xc], 0
jne 0x4703c0
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
jmp 0x4703e1
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
sete bl
test bl, bl
je 0x4703ea
mov eax, dword [ebp - 0x14]
mov dword [edi], eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x470470
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebp, ecx
mov edi, edx
mov esi, eax
mov byte [esp], 0
xor ebx, ebx
mov eax, dword [0x531be4]
cmp byte [eax], 0
je 0x4704b5
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x4704a2
mov ebx, pe_nt_image_headers32
jmp 0x4704b5
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x4704b5
mov ebx, 0x200
lea eax, [esp + 4]
push eax
or ebx, 0x20006
push ebx
push 0
mov eax, edi
call fcn.004088b0
push eax
push esi
call sub.advapi32.dll_RegOpenKeyExW_1
mov ebx, eax
push ebx
call sub.kernel32.dll_SetLastError
test ebx, ebx
jne 0x4704ff
mov eax, ebp
call fcn.004088b0
push eax
mov eax, dword [esp + 8]
push eax
call sub.advapi32.dll_RegDeleteValueW
test eax, eax
sete byte [esp]
mov eax, dword [esp + 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, byte [esp]
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47050c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [0x531be4]
cmp byte [eax], 0
jne 0x47053e
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyW
mov ebx, eax
jmp 0x4705bf
xor eax, eax
push ebp
push 0x4705a1
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x531be4]
cmp byte [eax], 0
je 0x470580
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x47056d
mov ebx, pe_nt_image_headers32
jmp 0x470580
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x470580
mov ebx, 0x200
push 0
push ebx
mov eax, dword [ebp - 8]
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegDeleteKeyExW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4705bf
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4706dc
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4708cc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x4708e8
call fcn.00408e88
test eax, eax
je 0x4708a9
cmp byte [ebp - 0x11], 0
je 0x47089c
xor edx, edx
push ebp
push 0x470892
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x531be4]
cmp byte [eax], 0
je 0x47076a
call fcn.0040bce8
cmp byte [eax + 0x19], 0
je 0x470757
mov esi, pe_nt_image_headers32
jmp 0x47076a
call fcn.0040bce8
cmp byte [eax + 0x18], 0
je 0x47076a
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.004088b0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x470881
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x470860
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x470860
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x470860
mov eax, dword [0x53011c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a34
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004081e8
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x470856
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408a34
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00426490
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00408b0c
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.004706dc
test al, al
jne 0x470856
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4708a9
dec esi
cmp esi, 0xffffffff
jne 0x4707da
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470888
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408a34
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.004705c8
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4708d3
lea eax, [ebp - 0x24]
call fcn.00407c30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x4715b8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088b0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x471666
xor eax, eax
push ebp
push 0x471655
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045e8
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.0040502c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.004088b0
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471666
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x471d98
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x471e6e
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x471e41
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x471df2
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.004089ac
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041e604
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083c4
jmp 0x471e01
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00408568
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x471e12
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x471e34
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x5301b0]
inc ecx
dec edx
jne 0x471e1b
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471e4b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471e75
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x471e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x471fa0
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x471f73
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x471eeb
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.004089ac
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041e604
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083c4
jmp 0x471efa
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.00408568
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x471f14
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x471f5d
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00409714
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x5305b4]
mov eax, dword [eax*8 + 0x5305b0]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x471f1f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471f7d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x471fa7
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x475e90
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x475f58
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407c30
xor eax, eax
push ebp
push 0x475f32
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x475f28
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x475e64]
call fcn.00409cc0
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.004088b0
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x475f10
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408908
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x475e64]
call fcn.00409cc0
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x475f3c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475f5f
lea eax, [ebp - 4]
mov edx, dword [0x475e64]
call fcn.00409de4
ret

Function at 0x47a318
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x47a3b4
push 0
mov eax, ebx
call fcn.004088b0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x47a38f
mov ebx, esi
test ebx, ebx
je 0x47a361
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.004088b0
push eax
push 1
push 0
mov eax, edi
call fcn.004088b0
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x47a3aa
mov ecx, dword [0x531d30]
mov dl, 1
mov eax, dword [0x4782f8]
call fcn.004250e8
call fcn.00407328
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47a4fc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40f3f0]
call fcn.004090c0
xor eax, eax
push ebp
push 0x47a646
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x531010], 0
jne 0x47a550
mov ecx, dword [0x531ba4]
mov dl, 1
mov eax, dword [0x41a034]
call fcn.004250e8
call fcn.00407328
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.0040502c
mov eax, ebx
call fcn.0040861c
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x47a654
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040b440
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x47a597
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x47a5ec
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x47a5e5
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00408998
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.0040895c
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.0041e5c0
test eax, eax
jne 0x47a5e5
mov ebx, 0x15
jmp 0x47a5f1
mov ebx, 0x10
jmp 0x47a5f1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x531010]
call fcn.0047a2dc
mov eax, dword [ebp - 4]
call fcn.0047a2dc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040b458
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47a64d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0xc]
mov edx, dword [0x40f3f0]
call fcn.00409198
ret

Function at 0x47b4d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b59f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b57c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x47b572
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408908
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47b542
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47b558
mov eax, ebx
mov edx, 0x47b5bc
call fcn.00408ab4
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047b480
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b586
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b5a6
lea eax, [ebp - 0x208]
call fcn.00407c30
ret
Function at 0x47b5c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b68f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b66c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x47b662
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408908
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47b632
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47b648
mov eax, ebx
mov edx, 0x47b6ac
call fcn.00408ab4
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047b480
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b676
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b696
lea eax, [ebp - 0x208]
call fcn.00407c30
ret

Function at 0x47b6b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b7bb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b78d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x531be4]
cmp byte [eax], 0
jne 0x47b70d
mov eax, ebx
call fcn.0047b5c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b797
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemWow64DirectoryW
test eax, eax
je 0x47b783
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.0040895c
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0047b480
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x47b765
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47b783
lea edx, [ebp - 0x218]
mov eax, dword [ebx]
call fcn.00426490
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b797
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b7c2
lea eax, [ebp - 0x218]
call fcn.00407c30
lea eax, [ebp - 0x210]
call fcn.00407c30
ret
Function at 0x47b8cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47b9c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47b998
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x47b98e
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408908
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.0047feb8
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00408010
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047b480
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x47b978
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47b98e
mov eax, ebx
mov edx, 0x47b9dc
call fcn.00408ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47b9a2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47b9c7
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00407c90
ret

Function at 0x47b9e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47ba6d
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x402]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x47ba63
mov edx, ebx
lea eax, [ebp - 0x402]
call fcn.00420750
cmp dword [ebx], 0
je 0x47ba63
mov eax, dword [ebx]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x47ba4d
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47ba63
mov eax, ebx
mov edx, 0x47ba8c
call fcn.00408ab4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ba77
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret