Function at 0x47f520
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x250
mov ebp, dword [esp + 0x268]
mov ebx, dword [ebp + 0x48]
test bx, bx
js 0x47f84a
push 0x107
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov dword [esp], eax
mov byte [eax], 0
push str.SCOOP
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x47f5e5
mov esi, eax
mov ebp, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isspace]
mov edi, eax
nop
movsx ebx, byte [edi]
push ebx
call ebp
add esp, 4
inc edi
test eax, eax
jne 0x47f570
test bl, bl
je 0x47f5e5
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ebx, eax
mov ebp, 0x107
test eax, eax
je 0x47f65f
cmp ebx, 0x106
jbe 0x47f664
lea eax, [ebx + 1]
mov ecx, 0x107
nop
mov ebp, ecx
add ecx, ecx
cmp eax, ebp
ja 0x47f5b0
push ebp
push dword [esp + 4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov edi, eax
push ebx
push esi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [edi + ebx], 0
test ebp, ebp
jne 0x47f677
mov al, 1
jmp 0x47f68d
mov edi, dword [0x507648]
mov ebp, 0x107
test edi, edi
je 0x47f655
push edi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
test eax, eax
je 0x47f655
mov ebx, eax
cmp eax, 0x106
jbe 0x47f6d6
mov eax, ebx
inc eax
mov ecx, 0x107
nop word cs:[eax + eax]
mov ebp, ecx
add ecx, ecx
cmp eax, ebp
ja 0x47f620
push ebp
push dword [esp + 4]
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
push ebx
push edi
mov esi, eax
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [esi + ebx], 0
test ebp, ebp
jne 0x47f6e9
mov al, 1
jmp 0x47f6fb
xor ebx, ebx
mov esi, dword [esp]
jmp 0x47f6e9
mov edi, dword [esp]
jmp 0x47f677
push ebx
push esi
mov edi, dword [esp + 8]
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [edi + ebx], 0
mov eax, ebx
not eax
add eax, ebp
cmp eax, 6
ja 0x47f789
xor eax, eax
cmp ebp, 1
ja 0x47f692
mov ebp, 0x20
lea ecx, [ebx + 8]
mov edx, ebp
nop word [eax + eax]
mov ebp, edx
add edx, edx
cmp ecx, ebp
ja 0x47f6a0
test al, al
je 0x47f74d
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
test ebx, ebx
je 0x47f784
lea eax, [ebx + 1]
push eax
push edi
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x47f787
push ebx
push edi
mov esi, dword [esp + 8]
push esi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov byte [esi + ebx], 0
mov eax, ebx
not eax
add eax, ebp
cmp eax, 0xc
ja 0x47f73b
xor eax, eax
cmp ebp, 1
ja 0x47f700
mov ebp, 0x20
lea ecx, [ebx + 0xe]
mov edx, ebp
nop word cs:[eax + eax]
mov ebp, edx
add edx, edx
cmp ecx, ebp
ja 0x47f710
test al, al
je 0x47f73f
push ebp
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov edi, eax
test ebx, ebx
je 0x47f75b
lea eax, [ebx + 1]
push eax
push esi
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
jmp 0x47f760
mov edi, esi
jmp 0x47f760
push ebp
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov edi, eax
jmp 0x47f760
push ebp
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
add esp, 8
mov edi, eax
jmp 0x47f789
mov byte [edi], 0
xor ebx, ebx
mov byte [edi + ebx + 0xc], 0x2a
mov dword [edi + ebx + 8], 0x2f737070
mov dword [edi + ebx + 4], 0x612f706f
mov dword [edi + ebx], 0x6f63732f
lea eax, [edi + ebx]
add eax, 0xd
jmp 0x47f79e
mov byte [esi], 0
mov edi, esi
mov dword [edi + ebx + 3], 0x2a2f7370
mov dword [edi + ebx], 0x7070612f
lea eax, [edi + ebx]
add eax, 7
mov byte [eax], 0
lea eax, [esp + 0x110]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x47f827
mov esi, eax
mov dword [esp + 4], edi
mov dword [esp], 0
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor ebx, ebx
jmp 0x47f7e0
inc ebx
lea eax, [esp + 0x110]
push eax
push esi
call edi
test eax, eax
je 0x47f811
test byte [esp + 0x110], 0x10
je 0x47f7d1
test byte [esp], 1
jne 0x47f7d0
lea eax, [esp + 0x13c]
push eax
push str.scoop
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x47f7d0
mov al, 1
mov dword [esp], eax
jmp 0x47f7d1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebx - 2]
cmp ebx, 2
cmovb eax, ebx
mov edi, dword [esp + 4]
jmp 0x47f829
xor eax, eax
mov ecx, dword [esp + 0x264]
mov dword [ecx + 0x4c], eax
test ebp, ebp
je 0x47f840
push edi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
mov ebp, dword [esp + 0x268]
mov ebx, dword [ebp + 0x48]
test bl, 4
jne 0x47f932
push str.ChocolateyInstall
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x47f932
cmp byte [eax], 0
je 0x47f932
lea esi, [esp + 8]
push eax
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, 0x106
sub ecx, eax
push ecx
push str._lib_
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strncat
add esp, 0xc
lea edi, [esp + 0x110]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x47f923
mov esi, eax
mov dword [esp], 0
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor ebx, ebx
jmp 0x47f8d9
inc ebx
push edi
push esi
call ebp
test eax, eax
je 0x47f90a
test byte [esp + 0x110], 0x10
je 0x47f8d1
test byte [esp], 1
jne 0x47f8d0
lea eax, [esp + 0x13c]
push eax
push str.choco
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
add esp, 8
test eax, eax
jne 0x47f8d0
mov al, 1
mov dword [esp], eax
jmp 0x47f8d1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebx - 2]
cmp ebx, 2
cmovb eax, ebx
mov ebp, dword [esp + 0x268]
jmp 0x47f925
xor eax, eax
mov ecx, dword [esp + 0x264]
mov dword [ecx + 0xc], eax
mov ebx, dword [ebp + 0x48]
test ebx, 0x200
jne 0x47f9dc
push str.MSYSTEM_PREFIX
call sub.api_ms_win_crt_environment_l1_1_0.dll_getenv
add esp, 4
test eax, eax
je 0x47f9dc
lea esi, [esp + 8]
push eax
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strcpy
add esp, 8
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
add esp, 4
mov ecx, 0x106
sub ecx, eax
push ecx
push str._.._var_lib_pacman_local_
push esi
call sub.api_ms_win_crt_string_l1_1_0.dll_strncat
add esp, 0xc
lea edi, [esp + 0x110]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x47f9cd
mov esi, eax
xor ebx, ebx
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
nop
bt dword [esp + 0x110], 4
adc ebx, 0
push edi
push esi
call ebp
test eax, eax
jne 0x47f9a0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebx - 2]
cmp ebx, 2
cmovb eax, ebx
mov ebp, dword [esp + 0x268]
jmp 0x47f9cf
xor eax, eax
mov ecx, dword [esp + 0x264]
mov dword [ecx + 0x34], eax
mov ebx, dword [ebp + 0x48]
test ebx, 0x20000
jne 0x47fc5c
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov eax, dword [0x5052b0]
mov dword [esp + 0x10], eax
mov dword [esp + 0x110], str.winget.exe
mov dword [esp + 0x114], str.list
mov dword [esp + 0x118], str.__disable_interactivity
mov dword [esp + 0x11c], 0
lea eax, [esp + 0x110]
lea ecx, [esp + 8]
push 0
push eax
push ecx
call fcn.00474b20
add esp, 0xc
test eax, eax
jne 0x47fc39
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
xor ebx, ebx
test eax, eax
je 0x47fbb8
cmp byte [eax + edi - 1], 0xa
jne 0x47fb02
inc eax
nop word [eax + eax]
mov ebp, eax
add eax, 0xfffffffe
mov dword [esp + 0xc], eax
cmp ebp, 2
je 0x47fae2
lea eax, [ebp - 1]
cmp byte [edi + ebp - 3], 0xa
je 0x47fa70
cmp dword [esp + 8], 0
jne 0x47faed
lea ecx, [eax - 1]
mov dword [esp], ecx
mov dword [esp + 0xc], 0
mov ecx, 0x20
nop word cs:[eax + eax]
mov esi, ecx
add ecx, ecx
cmp eax, esi
ja 0x47fab0
push esi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov byte [eax], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], esi
mov esi, dword [esp]
push esi
push edi
push eax
mov edi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esp + 0xc], esi
jmp 0x47faed
cmp dword [esp + 8], 0
je 0x47fb9e
mov byte [edi + ebp - 2], 0
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
test eax, eax
je 0x47fbb8
cmp byte [eax + edi - 1], 0x20
jne 0x47fb84
inc eax
nop
mov ebp, eax
add eax, 0xfffffffe
mov dword [esp + 0xc], eax
cmp ebp, 2
je 0x47fb88
lea eax, [ebp - 1]
cmp byte [edi + ebp - 3], 0x20
je 0x47fb10
cmp dword [esp + 8], 0
jne 0x47fb8f
lea ecx, [eax - 1]
mov dword [esp], ecx
mov dword [esp + 0xc], 0
mov ecx, 0x20
nop word cs:[eax + eax]
mov ebx, ecx
add ecx, ecx
cmp eax, ebx
ja 0x47fb50
push ebx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
add esp, 4
mov esi, eax
mov byte [eax], 0
mov dword [esp + 0x10], eax
mov dword [esp + 8], ebx
mov ebx, dword [esp]
push ebx
push edi
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add esp, 0xc
mov dword [esp + 0xc], ebx
mov edi, esi
jmp 0x47fb8f
mov ebx, eax
jmp 0x47fbb8
cmp dword [esp + 8], 0
je 0x47fb9e
mov byte [edi + ebp - 2], 0
mov ebx, dword [esp + 0xc]
mov edi, dword [esp + 0x10]
jmp 0x47fbb8
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov edi, dword [0x5052b0]
mov dword [esp + 0x10], edi
push str.___r_n
push edi
call sub.api_ms_win_crt_private_l1_1_0.dll_strstr
add esp, 8
test eax, eax
je 0x47fc39
sub eax, edi
cmp eax, ebx
je 0x47fc39
lea ecx, [edi + eax]
add ecx, 4
add eax, 4
mov edx, ebx
sub edx, eax
push edx
push 0xa
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
mov ecx, eax
sub ecx, edi
test eax, eax
cmove ecx, ebx
xor esi, esi
cmp ecx, ebx
jae 0x47fc23
xor esi, esi
nop word [eax + eax]
inc esi
lea eax, [edi + ecx]
inc eax
inc ecx
mov edx, ebx
sub edx, ecx
push edx
push 0xa
push eax
call sub.api_ms_win_crt_private_l1_1_0.dll_memchr
add esp, 0xc
mov ecx, eax
sub ecx, edi
test eax, eax
cmove ecx, ebx
cmp ecx, ebx
jb 0x47fc00
xor eax, eax
cmp byte [ebx + edi - 1], 0xa
setne al
add eax, esi
mov ecx, dword [esp + 0x264]
mov dword [ecx + 0x54], eax
cmp dword [esp + 8], 0
mov dword [esp + 0xc], 0
je 0x47fc5c
mov dword [esp + 8], 0
push dword [esp + 0x10]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
add esp, 4
add esp, 0x250
pop esi
pop edi
pop ebx
pop ebp
ret