joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d5ae
Capabilities:
Get disk information

Disassembly:
mov eax, 0x4cf97f
call fcn.004cc470
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
push ebx
push ebx
call edi
mov esi, eax
cmp esi, ebx
jne 0x47d5d7
xor eax, eax
jmp 0x47d684
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 1]
mul edx
seto cl
mov dword [ebp - 0x18], ebx
neg ecx
or ecx, eax
push ecx
call fcn.0049391c
mov ebx, eax
test ebx, ebx
pop ecx
je 0x47d681
lea eax, [esi + esi + 2]
push eax
push 0
push ebx
call fcn.00495180
add esp, 0xc
push ebx
push esi
call edi
mov esi, eax
mov eax, dword [0x50dc24]
mov ecx, 0x50dc24
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
shr esi, 2
test esi, esi
mov dword [ebp - 0x14], ebx
jle 0x47d668
mov dword [ebp - 0x18], esi
push dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
call fcn.00432935
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x47d663
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0043299e
add dword [ebp - 0x14], 8
lea esi, [ebp - 0x10]
call fcn.0040146d
dec dword [ebp - 0x18]
jne 0x47d636
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
mov dword [ebp - 0x18], 1
call fcn.004011c0
push ebx
call fcn.004951fa
pop ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret

Function at 0x47d693
Capabilities:
Get disk information
Get storage device properties

Disassembly:
mov eax, 0x4ceda4
call fcn.004cc470
sub esp, 0x40
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
xor esi, esi
cmp ecx, esi
jne 0x47d6b7
xor eax, eax
jmp 0x47d75f
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x47d6b0
mov eax, dword [0x50dc24]
mov ecx, 0x50dc24
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], esi
push dword [edi]
lea eax, [ebp - 0x14]
push 0x4ed690
call fcn.004328d6
pop ecx
pop ecx
push esi
push esi
push 3
push esi
push 3
push SysReAllocStringLen
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x47d752
push 9
pop ecx
push 0x28
xor eax, eax
mov dword [ebp - 0x4c], esi
lea edi, [ebp - 0x48]
rep stosd dword es:[edi], eax
pop eax
push esi
lea ecx, [ebp - 0x18]
push ecx
push eax
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x4c]
push eax
push 0xc
lea eax, [ebp - 0x24]
push eax
push 0x2d1400
push ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x47d74b
cmp dword [ebp - 0x30], 7
je 0x47d74b
xor esi, esi
inc esi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x47d880
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x4cf97f
call fcn.004cc470
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0043295b
push dword [ebp + 8]
and dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x47d8cb
xor esi, esi
inc esi
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x47d8ac
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
mov ebx, 0xb7
cmp eax, ebx
je 0x47d8ac
lea ecx, [ebp - 0x10]
call fcn.0047d7b2
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
jne 0x47d902
xor esi, esi
jmp 0x47d8af
push eax
call fcn.0047d880
test eax, eax
pop ecx
je 0x47d8fe
push 0
push dword [ebp + 8]
call esi
test eax, eax
jne 0x47d8ac
call edi
cmp eax, ebx
jne 0x47d8fe
jmp 0x47d8ac

Function at 0x47d920
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4cf97f
call fcn.004cc470
sub esp, 0x64
push ebx
push esi
push edi
xor ebx, ebx
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 0x14], ebx
call fcn.00495180
xor eax, eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x50dc24]
xor edi, edi
inc edi
add esp, 0xc
mov ecx, 0x50dc24
mov dword [ebp - 0x70], 0x44
mov dword [ebp - 0x44], edi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push dword [ebp + 8]
mov dword [ebp - 4], ebx
push str.__s___s
call fcn.004328d6
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push ebx
push ebx
neg esi
push ebx
sbb esi, esi
push ebx
and esi, 0xa
mov word [ebp - 0x40], si
mov esi, dword [ebp - 0x10]
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x47d9c6
cmp dword [ebp + 0x10], ebx
je 0x47d9c3
push dword [ebp + 0x10]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], edi
cmp dword [ebp - 0x24], ebx
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x47d9d9
push dword [ebp - 0x24]
call edi
mov dword [ebp - 0x24], ebx
cmp dword [ebp - 0x20], ebx
je 0x47d9e6
push dword [ebp - 0x20]
call edi
mov dword [ebp - 0x20], ebx
lea eax, [esi - 0x10]
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x47dba0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov eax, 0x4cf757
call fcn.004cc470
sub esp, 0xc
mov eax, dword [0x50dc24]
push ebx
push esi
push edi
mov ecx, 0x50dc24
call dword [eax + 0xc]
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
call fcn.0043295b
push 0x5c
push 3
pop ecx
lea esi, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.0043276d
mov esi, eax
inc esi
je 0x47dc40
mov ecx, esi
lea edx, [ebp - 0x18]
lea eax, [ebp - 0x10]
call fcn.004327b5
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004013bf
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x47dc2f
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, eax
test ebx, ebx
je 0x47dc43
mov ecx, esi
push 0x5c
lea esi, [ebp - 0x10]
call fcn.0043276d
inc eax
mov esi, eax
jne 0x47dbe9
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004011c0
lea eax, [edi - 0x10]
call fcn.004011c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, ebx
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x47e1c1
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x4ce473
call fcn.004cc470
sub esp, 0x68
push ebx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
mov ebx, ecx
jne 0x47e1e0
xor eax, eax
jmp 0x47e323
mov eax, dword [0x50dc24]
push esi
mov ecx, 0x50dc24
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
push dword [ebp + 8]
lea eax, [ebp - 0x1c]
push str.__s___s
call fcn.004328d6
add esp, 0xc
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call fcn.0044e1b0
test eax, eax
jne 0x47e306
push 0x40
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x74], 0x44
call fcn.00495180
and dword [ebp - 0x30], 0
xor eax, eax
add esp, 0xc
neg ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
sbb ebx, ebx
and ebx, 5
stosd dword es:[edi], eax
mov word [ebp - 0x44], bx
xor ebx, ebx
push str.userenv.dll
stosd dword es:[edi], eax
mov dword [ebp - 0x6c], str.Winsta0Default
mov dword [ebp - 0x20], 0x30
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x18], eax
je 0x47e2b0
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x18]
mov esi, eax
call edi
cmp esi, ebx
mov dword [ebp - 0x14], eax
je 0x47e2b0
push ebx
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call esi
test eax, eax
je 0x47e2ad
mov dword [ebp - 0x20], 0x430
jmp 0x47e2b0
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x20]
push ebx
push ebx
push ebx
push dword [ebp - 0x1c]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x30], ebx
mov edi, eax
je 0x47e2df
push dword [ebp - 0x30]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x2c], ebx
je 0x47e2ed
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x14], ebx
je 0x47e2f8
push dword [ebp + 8]
call dword [ebp - 0x14]
cmp dword [ebp - 0x18], ebx
je 0x47e306
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x10], 0
pop esi
je 0x47e316
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x47e331
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x86c
push ebx
push esi
push edi
xor esi, esi
push 0x40
lea eax, [ebp - 0x64]
push esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x68], 0x44
call fcn.00495180
xor eax, eax
mov dword [ebp - 0x1c], esi
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
xor ebx, ebx
mov dword [ebp - 0xc], esi
call fcn.0047f05e
add esp, 0x10
test eax, eax
je 0x47e41b
lea eax, [ebp - 4]
push eax
push dword [ebp - 0xc]
call fcn.0047f10c
push 0x7fe
lea eax, [ebp - 0x866]
push esi
push eax
mov word [ebp - 0x868], si
call fcn.00495180
push dword [ebp + 0xc]
lea eax, [ebp - 0x868]
push dword [ebp + 8]
push str.__s___s
push 0x400
push eax
call fcn.0049509f
add esp, 0x28
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
cmp ebx, esi
je 0x47e3fc
push str.CreateProcessWithTokenW
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
je 0x47e3fc
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x68]
push ecx
push esi
push esi
push esi
lea ecx, [ebp - 0x868]
push ecx
push esi
push esi
push dword [ebp - 4]
call eax
jmp 0x47e418
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x868]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x47e42e
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], esi
je 0x47e43b
push dword [ebp - 0x1c]
call edi
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], esi
je 0x47e448
push dword [ebp - 0x18]
call edi
mov dword [ebp - 0x18], esi
cmp ebx, esi
je 0x47e453
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x47e45b
Capabilities:
Check os version
Create process on windows

Disassembly:
mov eax, 0x4ced0c
call fcn.004cc470
sub esp, 0x178
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x47e47a
xor eax, eax
jmp 0x47e631
mov eax, dword [0x50dc24]
push esi
mov ecx, 0x50dc24
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push str.__s___s
call fcn.004328d6
push 0x110
lea eax, [ebp - 0x180]
push ebx
push eax
call fcn.00495180
add esp, 0x18
lea eax, [ebp - 0x184]
push eax
mov dword [ebp - 0x184], 0x114
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x47e4e0
cmp dword [ebp - 0x180], 6
jne 0x47e4e0
inc esi
cmp esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
lea esi, [ebp - 0x10]
jne 0x47e4f4
call fcn.0044e1b0
jmp 0x47e4f9
call fcn.0044e160
cmp eax, ebx
jne 0x47e614
push edi
push 0x40
lea eax, [ebp - 0x6c]
push ebx
push eax
mov dword [ebp - 0x70], 0x44
call fcn.00495180
push dword [ebp - 0x10]
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 5
mov dword [ebp - 0x44], 1
mov word [ebp - 0x40], ax
call fcn.0044e21b
add esp, 0x10
test al, al
jne 0x47e55f
cmp dword [ebp - 0x10], ebx
je 0x47e555
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
call fcn.0044e395
pop ecx
push str.userenv.dll
mov dword [ebp - 0x68], str.Winsta0Default
mov dword [ebp - 0x14], 0x30
mov dword [ebp + 8], ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [ebp - 0x1c], eax
je 0x47e5be
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreateEnvironmentBlock
push eax
call edi
push str.DestroyEnvironmentBlock
push dword [ebp - 0x1c]
mov esi, eax
call edi
cmp esi, ebx
mov edi, eax
je 0x47e5be
push ebx
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call esi
test eax, eax
je 0x47e5bb
mov dword [ebp - 0x14], 0x430
jmp 0x47e5be
mov dword [ebp + 8], ebx
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x70]
push eax
push ebx
push dword [ebp + 8]
push dword [ebp - 0x14]
push ebx
push ebx
push ebx
push dword [ebp - 0x18]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
cmp dword [ebp - 0x2c], ebx
mov dword [ebp - 0x14], eax
je 0x47e5ee
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x28], ebx
je 0x47e5fc
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x47e605
push dword [ebp + 8]
call edi
cmp dword [ebp - 0x1c], ebx
pop edi
je 0x47e614
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [ebp - 0x10], ebx
pop esi
je 0x47e623
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x47e63e
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cf6b1
call fcn.004cc470
mov eax, dword [ebp + 8]
mov eax, dword [eax]
sub esp, 0xc
push edi
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x47e834
mov eax, dword [0x50dc24]
push ebx
push esi
mov esi, 0x50dc24
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], edi
mov eax, dword [0x50dc24]
mov ecx, esi
call dword [eax + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp - 0x14], ebx
mov byte [ebp - 4], 1
cmp dword [ebx - 0xc], edi
jne 0x47e7fa
mov eax, dword [ebp + 8]
lea edi, [ebp - 0x14]
call fcn.004013bf
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47e6b6
mov esi, edi
call fcn.0040146d
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
jne 0x47e7fa
lea esi, [ebp - 0x10]
call fcn.0040146d
lea edi, [ebp - 0x18]
call fcn.0047eaf2
mov edi, esi
mov byte [ebp - 4], 5
call fcn.004013bf
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x47e758
push eax
lea esi, [ebp - 0x18]
call fcn.0047e843
pop ecx
mov byte [ebp - 4], 6
call fcn.004013bf
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.004150f1
pop ecx
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.004013bf
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47e758
mov esi, edi
call fcn.0040146d
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
jne 0x47e7fa
lea esi, [ebp - 0x10]
call fcn.0040146d
lea edi, [ebp - 0x18]
call fcn.0047eba2
mov edi, esi
mov byte [ebp - 4], 8
call fcn.004013bf
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x47e7f6
push eax
lea esi, [ebp - 0x18]
call fcn.0047e843
pop ecx
mov byte [ebp - 4], 9
call fcn.004013bf
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
push dword [ebp + 8]
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.004150f1
pop ecx
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 0xa
call fcn.004013bf
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.004011c0
mov ebx, dword [ebp - 0x14]
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47e7f6
mov esi, edi
call fcn.0040146d
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
je 0x47e816
push ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47e816
push ebx
call esi
mov edi, eax
test edi, edi
jne 0x47e81f
mov eax, dword [ebp + 8]
push dword [eax]
call esi
mov edi, eax
lea eax, [ebx - 0x10]
call fcn.004011c0
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.004011c0
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
mov dword fs:[0], ecx
leave
ret
Function at 0x47e8d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx - 0xc], eax
je 0x47e933
push ebx
push edi
push 0x208
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.00495180
add esp, 0xc
mov ebx, str._ALLUSERSPROFILE_
push ebx
xor ecx, ecx
call fcn.00401336
or edi, 0xffffffff
cmp eax, edi
je 0x47e936
lea eax, [ebp - 0x210]
push eax
push ebx
call fcn.0047ee1d
pop ecx
test eax, eax
pop ecx
jne 0x47ea46
xor eax, eax
pop edi
pop ebx
pop esi
leave
ret
mov ebx, str._APPDATA_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
jne 0x47e918
mov ebx, str._TEMP_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
jne 0x47e918
mov ebx, str._SYSTEM_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e984
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jbe 0x47e92f
jmp 0x47ea46
mov ebx, str._WINDOWS_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e9a9
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x47e97b
mov ebx, str._CUR_MODULE_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e9cb
lea eax, [ebp - 0x210]
push eax
call fcn.0047ed76
jmp 0x47e926
mov ebx, str._CUR_EXE_MODULE_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e9fa
push 0x104
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x47e92f
jmp 0x47ea39
mov ebx, str._CUR_DIR_
push ebx
xor ecx, ecx
call fcn.00401336
cmp eax, edi
je 0x47e92f
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.00495180
add esp, 0xc
push 0x105
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
push ebx
push esi
call fcn.00479fd5
push 0x3f
xor ecx, ecx
call fcn.0043276d
mov ebx, eax
cmp ebx, edi
je 0x47ead8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004996b4
pop ecx
jmp 0x47eac9
and word [ebp + 8], 0
xor eax, eax
lea edi, [ebp + 0xa]
stosw word es:[edi], ax
call fcn.004996c1
and eax, 0x8000000f
jns 0x47ea8f
dec eax
or eax, 0xfffffff0
inc eax
push eax
lea eax, [ebp + 8]
push 0x4ed814
push eax
call fcn.00480369
movzx edi, word [ebp + 8]
add esp, 0xc
test ebx, ebx
jl 0x47eae7
mov eax, dword [esi]
mov eax, dword [eax - 0xc]
cmp ebx, eax
mov dword [ebp - 4], eax
jge 0x47eae7
call fcn.0040bbb0
mov word [eax + ebx*2], di
mov eax, dword [ebp - 4]
mov edx, esi
call fcn.004011d8
inc ebx
mov ecx, ebx
mov eax, esi
call fcn.004803e4
cmp ax, 0x3f
je 0x47ea72
mov eax, esi
call fcn.0047da00
xor eax, eax
inc eax
jmp 0x47e931
push 0x80070057
call fcn.0040131e
int3
Function at 0x47eaf2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
xor esi, esi
test byte [0x50fd94], 1
mov dword [ebp - 4], esi
jne 0x47eb31
mov eax, dword [0x50dc24]
or dword [0x50fd94], 1
mov ecx, 0x50dc24
call dword [eax + 0xc]
add eax, 0x10
push 0x4d2eca
mov dword [0x50fd90], eax
call fcn.00494c94
pop ecx
mov eax, dword [0x50fd90]
cmp dword [eax - 0xc], esi
jne 0x47eb8b
push ebx
push 0x20a
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call fcn.00495180
add esp, 0xc
push 1
push 0x25
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
call fcn.00495089
pop ecx
lea ecx, [ebp - 0x210]
mov ebx, eax
push ecx
mov eax, 0x50fd90
call fcn.00401400
pop ebx
mov eax, dword [0x50fd90]
add eax, 0xfffffff0
call fcn.00401367
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
leave
ret

Function at 0x47eba2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
xor esi, esi
test byte [0x50fd8c], 1
mov dword [ebp - 4], esi
jne 0x47ebe1
mov eax, dword [0x50dc24]
or dword [0x50fd8c], 1
mov ecx, 0x50dc24
call dword [eax + 0xc]
add eax, 0x10
push 0x4d2ed7
mov dword [0x50fd88], eax
call fcn.00494c94
pop ecx
mov eax, dword [0x50fd88]
cmp dword [eax - 0xc], esi
jne 0x47ec3b
push ebx
push 0x20a
lea eax, [ebp - 0x20e]
push esi
push eax
mov word [ebp - 0x210], si
call fcn.00495180
add esp, 0xc
push 1
push 0x24
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x210]
push eax
call fcn.00495089
pop ecx
lea ecx, [ebp - 0x210]
mov ebx, eax
push ecx
mov eax, 0x50fd88
call fcn.00401400
pop ebx
mov eax, dword [0x50fd88]
add eax, 0xfffffff0
call fcn.00401367
add eax, 0x10
mov dword [edi], eax
mov eax, edi
pop esi
leave
ret

Function at 0x47ec52
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov eax, 0x4ce8b0
call fcn.004cc470
sub esp, 0x20c
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov ecx, 0x50dc24
mov dword [ebp - 0x10], edi
call fcn.004014c8
push 0x206
lea eax, [ebp - 0x216]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
mov word [ebp - 0x218], di
call fcn.00495180
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push edi
push edi
push 0x26
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x47ecd4
push str.Internet_Exploreriexplore.exe
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x218]
push eax
push esi
call fcn.00432935
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret