joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466370
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5654e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [ebp + 8]
cmp ebx, 0x81f7
je 0x4663b0
cmp ebx, 0x81f8
jne 0x466408
push str.UIFinishOk
lea ecx, [edi + 0x14]
call fcn.004aa2a0
push str.UIFinishSearch
lea ecx, [edi + 0x14]
mov dword [ebp - 0x2c], eax
call fcn.004aa2a0
mov esi, eax
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x4663ed
mov edx, dword [eax]
cmp ebx, 0x81f7
sete cl
movzx ecx, cl
push ecx
mov ecx, eax
call dword [edx + 0xf8]
test esi, esi
je 0x466408
mov edx, dword [esi]
cmp ebx, 0x81f8
mov ecx, esi
sete al
movzx eax, al
push eax
call dword [edx + 0xf8]
add ebx, 0xffff7e0b
cmp ebx, 3
ja case.default.0x466417
jmp dword [ebx*4 + 0x466544]
mov eax, dword [ebp + 0xc]
lea ecx, [edi + 0x744]
push eax
mov dword [edi + 0xc0c], eax
call fcn.004679e0
jmp case.default.0x466417
lea ecx, [edi + 0x778]
call fcn.0042e370
push eax
push dword [edi + 0xc0c]
lea ecx, [edi + 0x744]
push dword [edi + 0x964]
push dword [edi + 0x960]
call fcn.00468530
jmp case.default.0x466417
lea eax, [edi + 0x8b8]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x4664b3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4664b3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.localfilepath
push str.Software
call fcn.0043bc70
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 0x88]
push 0
lea ecx, [edi + 0x744]
call fcn.00468170
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb case.default.0x466417
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4664f8
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46653d
push edx
push ecx
call fcn.00497cc1
add esp, 8
jmp case.default.0x466417
mov eax, dword [edi]
mov ecx, edi
push 2
call dword [eax + 0x88]
push 0
lea ecx, [edi + 0x744]
call fcn.00467be0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret 8
call fcn.00524999
nop
push ds
inc esi
add byte [eax], bh
inc esi
add byte [esi + 0x64], ah
inc esi
add byte [0xcccc0046], al
int3
Function at 0x46e560
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566078
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
call fcn.004824b1
mov ecx, 0x5b13f8
call fcn.0046de50
call fcn.00482b8d
push 0x591f40
push 0x7b
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
je 0x46e63f
call fcn.00482b8d
push esi
mov eax, dword [eax + 0xc]
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
test eax, eax
je 0x46e63f
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
mov dword [ebp - 0x14], 0
call fcn.00482b8d
push esi
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
push esi
push 0x42
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
push eax
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push esi
push edi
push eax
call fcn.00520ed0
mov esi, dword [ebp - 0x18]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
lea eax, [ebp - 0x14]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x46e633
push dword [ebp - 0x14]
call fcn.0046df00
push esi
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov eax, 1
push 0
push 0xc8
push 0x465
push dword [ebx + 0x20]
mov dword [ebx + 0xa8], eax
call dword [sym.imp.USER32.dll_SetTimer]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.004700b0
mov edx, eax
mov dword [ebp - 4], 0
mov ecx, dword [0x5ba9ac]
cmp dword [0x5ba9b0], ecx
je 0x46e6a2
mov dword [ecx], 0
cmp ecx, edx
je 0x46e695
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], 0
mov byte [ecx + 4], 1
add dword [0x5ba9ac], 8
jmp 0x46e6a9
push edx
push ecx
call fcn.00435bd0
mov dword [ebp - 4], 2
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x46e6d5
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x46e6d5
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x46e6cf
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x46e6d3
mov eax, dword [ecx]
push 1
call dword [eax]
push 2
push 0xb2
push 0x102
push 0
push 0
push 0xfffffffffffffffe
mov dword [ebp - 4], 0xffffffff
push dword [ebx + 0x20]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, dword [ebx + 0x20]
push str.user32
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x46e71c
push str.SwitchToThisWindow
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 1
push esi
call eax
jmp 0x46e72a
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret
Function at 0x46f600
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x5ba980]
sub esp, 0x1c
mov eax, dword [ecx + 0x614]
push esi
push edi
push 4
mov dword [ecx + 0x618], eax
call fcn.004b3040
push 0x58bdf0
call fcn.004b2fd0
movzx eax, word [ebp + 8]
add esp, 8
push 0x592048
push eax
call fcn.004ab020
push eax
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov esi, eax
test esi, esi
je 0x46f73f
push esi
call fcn.004ab020
push eax
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov edi, eax
test edi, edi
je 0x46f73f
push esi
call fcn.004ab020
push eax
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov esi, eax
test esi, esi
je 0x46f73f
push edi
call dword [sym.imp.KERNEL32.DLL_LockResource]
push dword [ebp + 8]
lea ecx, [eax + esi]
push ecx
mov ecx, dword [0x5ba980]
push eax
push dword [ecx + 0x618]
add ecx, 0x614
call fcn.004077f0
mov ecx, dword [0x5ba980]
mov eax, dword [ecx + 0x618]
sub eax, dword [ecx + 0x614]
je 0x46f73f
push 9
push str.1Nc:P3n_.
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0xf
mov byte [ebp - 0x1c], 0
call fcn.00406610
mov esi, dword [0x5ba980]
lea ecx, [ebp - 0x1c]
lea edx, [esi + 0x614]
call fcn.00413400
mov edx, dword [ebp - 8]
cmp edx, 0x10
jb 0x46f725
mov ecx, dword [ebp - 0x1c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x46f715
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x46f747
push edx
push ecx
call fcn.00497cc1
mov esi, dword [0x5ba980]
add esp, 8
mov ecx, dword [esi + 0x614]
mov eax, dword [esi + 0x618]
push 0
sub eax, ecx
push eax
push ecx
call fcn.004b3050
add esp, 0xc
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00524999
int3
Function at 0x472b80
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push 0x58f530
call fcn.004a3140
test eax, eax
je 0x472bb6
push 5
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x477e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a6050
push 0x520720
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x5b0514]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x20], edx
mov edx, ecx
mov dword [ebp - 0x2c], edx
xor esi, esi
test edx, edx
jne 0x477e95
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0
mov eax, dword [edx + 0x3c]
mov ebx, dword [eax + edx + 0x78]
add ebx, edx
mov eax, dword [ebx + 0x1c]
add eax, edx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebx + 0x20]
add ecx, edx
mov dword [ebp - 0x1c], ecx
mov edi, dword [ebx + 0x24]
add edi, edx
mov dword [ebp - 0x28], edi
mov eax, dword [ebp - 0x20]
test eax, 0xffff0000
jne 0x477ee1
movzx eax, ax
sub eax, dword [ebx + 0x10]
mov esi, dword [ebp - 0x24]
mov esi, dword [esi + eax*4]
add esi, edx
jmp 0x477f4e
mov ebx, dword [ebx + 0x18]
mov dword [ebp - 0x34], ebx
mov eax, ebx
dec ebx
mov dword [ebp - 0x34], ebx
test eax, eax
je 0x477f51
mov eax, dword [ecx]
add eax, edx
mov ecx, dword [ebp - 0x20]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x477f18
test dl, dl
je 0x477f14
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x477f18
add eax, 2
add ecx, 2
test dl, dl
jne 0x477ef8
xor eax, eax
jmp 0x477f1d
sbb eax, eax
or eax, 1
test eax, eax
jne 0x477f2f
movzx eax, word [edi]
mov esi, dword [ebp - 0x24]
mov esi, dword [esi + eax*4]
add esi, dword [ebp - 0x2c]
jmp 0x477f4e
mov ecx, dword [ebp - 0x1c]
add ecx, 4
mov dword [ebp - 0x1c], ecx
add edi, 2
mov dword [ebp - 0x28], edi
mov edx, dword [ebp - 0x2c]
jmp 0x477ee7
mov dword [ebp - 0x30], esi
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x477f70
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [edx + 0x3c]
add esi, edx
push edi
mov edi, ecx
movzx eax, word [esi + 0x14]
add eax, 0x18
add eax, esi
mov dword [ebp - 4], eax
cmp edi, dword [eax + 0x14]
jae 0x477f98
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push ebx
movzx ebx, word [esi + 6]
xor eax, eax
xor ecx, ecx
mov dword [ebp - 8], ebx
cmp ax, bx
jae 0x477fd7
nop dword [eax]
mov esi, dword [ebp - 4]
movzx edx, cx
lea eax, [edx + edx*4]
mov esi, dword [esi + eax*8 + 0xc]
cmp edi, esi
jb 0x477fd1
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + eax*8 + 0x10]
mov ebx, dword [ebp - 8]
add eax, esi
cmp edi, eax
jb 0x477fe0
inc ecx
cmp cx, bx
jb 0x477fb0
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
lea eax, [edx + edx*4]
pop ebx
mov eax, dword [ecx + eax*8 + 0x14]
sub eax, esi
add eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x478000
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, 0x10b
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x3c]
cmp word [ecx + edi + 0x18], ax
jne 0x478079
mov ecx, dword [ecx + edi + 0x78]
mov edx, edi
call fcn.00477f70
mov ecx, dword [edi + eax + 0x20]
mov edx, edi
lea ebx, [edi + eax]
mov dword [ebp - 8], ebx
call fcn.00477f70
mov ecx, dword [ebx + 0x24]
mov edx, edi
lea esi, [edi + eax]
call fcn.00477f70
mov ebx, dword [ebx + 0x18]
lea ecx, [edi + eax]
mov dword [ebp - 4], ecx
test ebx, ebx
je 0x478079
mov ecx, dword [esi]
mov edx, edi
dec ebx
call fcn.00477f70
add eax, edi
push str.RefLoader
push eax
call fcn.00520c60
add esp, 8
test eax, eax
jne 0x478082
add dword [ebp - 4], 2
add esi, 4
test ebx, ebx
jne 0x478050
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 8]
mov edx, edi
mov ecx, dword [ecx + 0x1c]
call fcn.00477f70
mov ecx, dword [ebp - 4]
add eax, edi
mov edx, edi
movzx ecx, word [ecx]
mov ecx, dword [eax + ecx*4]
call fcn.00477f70
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4780b0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x5a6070
push 0x520720
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x5b0514]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov edi, edx
mov esi, ecx
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x24], 0
test esi, esi
je 0x478178
test edi, edi
je 0x478178
mov dword [ebp - 4], 0
call fcn.00478000
test eax, eax
je 0x478158
add eax, esi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
push pe_nt_image_headers32
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
test eax, eax
je 0x478158
call dword [ebp - 0x2c]
test eax, eax
je 0x478149
lea ecx, [ebp - 0x28]
push ecx
push 6
push 0
call eax
neg eax
sbb eax, eax
and eax, dword [ebp - 0x28]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x28]
jmp 0x47817a
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret
Function at 0x479fd0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x566bd0
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00449940
test eax, eax
je 0x47a0b0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
push eax
call fcn.00449b00
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x47a05f
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
mov dword [esi + 0x750], ebx
mov dword [esi + 0x754], 0
cmp edx, 8
jb 0x47a0b0
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47a0a6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a147
push edx
push ecx
call fcn.00497cc1
add esp, 8
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], esi
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.0047a9d0
mov edx, eax
mov dword [ebp - 4], 1
mov ecx, dword [0x5ba9ac]
cmp dword [0x5ba9b0], ecx
je 0x47a0f8
mov dword [ecx], 0
cmp ecx, edx
je 0x47a0eb
mov eax, dword [edx]
mov dword [ecx], eax
mov dword [edx], 0
mov byte [ecx + 4], 1
add dword [0x5ba9ac], 8
jmp 0x47a0ff
push edx
push ecx
call fcn.00435bd0
mov dword [ebp - 4], 3
mov ecx, dword [ebp - 0x34]
test ecx, ecx
je 0x47a12b
or eax, 0xffffffff
lock xadd dword [ecx + 4], eax
jne 0x47a12b
mov edx, dword [ecx + 0x78]
test edx, edx
je 0x47a125
mov eax, dword [edx]
push ecx
mov ecx, edx
jmp 0x47a129
mov eax, dword [ecx]
push 1
call dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret
call fcn.00524999
int3
Function at 0x47a790
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5654e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
cmp eax, 0x5ff
je 0x47a8e8
cmp eax, 0x81f4
jne case.default.0x47a7ea
mov eax, dword [ebp + 0xc]
add eax, 0xffff7e0b
cmp eax, 3
ja case.default.0x47a7ea
jmp dword [eax*4 + 0x47a9b4]
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x740]
push eax
mov dword [esi + 0xc04], eax
call fcn.004679e0
jmp case.default.0x47a7ea
lea ecx, [esi + 0x770]
call fcn.0042e370
push eax
push dword [esi + 0xc04]
lea ecx, [esi + 0x740]
push dword [esi + 0x95c]
push dword [esi + 0x958]
call fcn.00468530
jmp case.default.0x47a7ea
lea eax, [esi + 0x8b0]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x47a886
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47a886
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.localfilepath
push str.Software
call fcn.0043bc70
push 1
lea ecx, [esi + 0x740]
call fcn.00468170
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb case.default.0x47a7ea
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47a8c7
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47a9ae
push edx
push ecx
call fcn.00497cc1
add esp, 8
jmp case.default.0x47a7ea
push 1
lea ecx, [esi + 0x740]
call fcn.00467be0
jmp case.default.0x47a7ea
mov eax, dword [ebp + 0x10]
cmp eax, 0x203
jne 0x47a976
mov edi, dword [0x5ba980]
cmp dword [edi + 0x640], 0
je 0x47a928
lea eax, [edi + 0x644]
mov dword [edi + 0x658], 0
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [edi + 0x640], 0
mov ecx, esi
call fcn.004a1100
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push 0x56cab0
push 1
push 0
push 0x56cad0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x47a969
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x2c]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x47a7ea
cmp eax, 0x205
jne case.default.0x47a7ea
call fcn.004a1100
push eax
call fcn.0043c2e0
mov dword [ebx], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret 0x10
call fcn.00524999
nop
int1
cmpsd dword [esi], dword es:[edi]
inc edi
add byte [ebx], cl
test al, 0x47
add byte [ecx], bh
test al, 0x47
add dh, dl
test al, 0x47
add ah, cl
int3
Function at 0x47dc10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5654e8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x5b0514]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
cmp eax, 0x5ff
je 0x47dd7a
cmp eax, 0x81f4
jne case.default.0x47dc6a
mov eax, dword [ebp + 0xc]
add eax, 0xffff7e0b
cmp eax, 3
ja case.default.0x47dc6a
jmp dword [eax*4 + 0x47de48]
mov eax, dword [ebp + 0x10]
lea ecx, [esi + 0x740]
push eax
mov dword [esi + 0xc04], eax
call fcn.004679e0
jmp case.default.0x47dc6a
lea ecx, [esi + 0x770]
call fcn.0042e370
push eax
push dword [esi + 0xc04]
lea ecx, [esi + 0x740]
push dword [esi + 0x95c]
push dword [esi + 0x958]
call fcn.00468530
jmp case.default.0x47dc6a
lea eax, [esi + 0x8b0]
push eax
lea ecx, [ebp - 0x28]
call fcn.00402a30
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
je 0x47dd06
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47dd06
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push str.localfilepath
push str.Software
call fcn.0043bc70
push 1
lea ecx, [esi + 0x740]
call fcn.00468170
push 3
mov ecx, esi
call fcn.004320c0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb case.default.0x47dc6a
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x47dd50
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x47de40
push edx
push ecx
call fcn.00497cc1
add esp, 8
jmp case.default.0x47dc6a
push 1
lea ecx, [esi + 0x740]
call fcn.00467be0
push 3
mov ecx, esi
call fcn.004320c0
jmp case.default.0x47dc6a
mov eax, dword [ebp + 0x10]
cmp eax, 0x203
jne 0x47de08
mov edi, dword [0x5ba980]
cmp dword [edi + 0x640], 0
je 0x47ddba
lea eax, [edi + 0x644]
mov dword [edi + 0x658], 0
push eax
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov dword [edi + 0x640], 0
mov ecx, esi
call fcn.004a1100
mov edi, eax
lea eax, [ebp - 0x2c]
push eax
push 0x56cab0
push 1
push 0
push 0x56cad0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x47ddfb
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x2c]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp case.default.0x47dc6a
cmp eax, 0x205
jne case.default.0x47dc6a
call fcn.004a1100
push eax
call fcn.0043c2e0
mov dword [ebx], 0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov dword [0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00497cb0
mov esp, ebp
pop ebp
ret 0x10
call fcn.00524999
nop dword [eax]
jno 0x47de26
inc edi
add byte [ebx - 0x46ffb824], cl
fadd qword [edi]
pop edi
fld qword [edi]
int3