joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470bb8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 0x11], cl
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x470da8
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 0x10]
mov eax, 0x470dc4
call fcn.0040909c
test eax, eax
je 0x470d85
cmp byte [ebp - 0x11], 0
je 0x470d78
xor edx, edx
push ebp
push 0x470d6e
push dword fs:[edx]
mov dword fs:[edx], esp
xor esi, esi
mov eax, dword [0x535bcc]
cmp byte [eax], 0
je 0x470c46
call fcn.0040c054
cmp byte [eax + 0x19], 0
je 0x470c33
mov esi, pe_nt_image_headers32
jmp 0x470c46
call fcn.0040c054
cmp byte [eax + 0x18], 0
je 0x470c46
mov esi, 0x200
lea eax, [ebp - 0x18]
push eax
or esi, 0x2000f
push esi
push 0
mov eax, dword [ebp - 0x10]
call fcn.00408ac4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyExW_1
xor edx, edx
push ebp
push 0x470d5d
push dword fs:[edx]
mov dword fs:[edx], esp
test eax, eax
jne 0x470d3c
xor eax, eax
mov dword [ebp - 0x20], eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryInfoKeyW
test eax, eax
jne 0x470d3c
mov esi, dword [ebp - 0x20]
dec esi
cmp esi, 0
jl 0x470d3c
mov eax, dword [0x534104]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408c48
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.004081e8
push eax
push esi
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegEnumKeyExW
test eax, eax
jne 0x470d32
lea eax, [ebp - 4]
mov edx, dword [ebp - 0x1c]
call fcn.00408c48
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.004267f4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
call fcn.00408d20
movzx ecx, byte [ebp - 0x11]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00470bb8
test al, al
jne 0x470d32
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x470d85
dec esi
cmp esi, 0xffffffff
jne 0x470cb6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470d64
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408c48
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00470aa4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470daf
lea eax, [ebp - 0x24]
call fcn.00407c30
lea eax, [ebp - 8]
mov edx, 2
call fcn.00407c90
ret
Function at 0x471a94
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00408ac4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x471b42
xor eax, eax
push ebp
push 0x471b31
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045e8
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.0040502c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00408ac4
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471b42
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x472274
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x47234a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x47231d
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x4722ce
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00408bc0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041e968
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083d4
jmp 0x4722dd
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040877c
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x4722ee
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x472310
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x534198]
inc ecx
dec edx
jne 0x4722f7
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x472327
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472351
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x47235c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x47247c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x47244f
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x4723c7
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00408bc0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041e968
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083d4
jmp 0x4723d6
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040877c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x4723f0
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x472439
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00409a6c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x53459c]
mov eax, dword [eax*8 + 0x534598]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x4723fb
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x472459
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x472483
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x476704
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4767cc
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407c30
xor eax, eax
push ebp
push 0x4767a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x47679c
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4766d8]
call fcn.0040a018
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x476784
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408b1c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x4766d8]
call fcn.0040a018
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4767b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4767d3
lea eax, [ebp - 4]
mov edx, dword [0x4766d8]
call fcn.0040a13c
ret

Function at 0x47ab8c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x47ac28
push 0
mov eax, ebx
call fcn.00408ac4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x47ac03
mov ebx, esi
test ebx, ebx
je 0x47abd5
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00408ac4
push eax
push 1
push 0
mov eax, edi
call fcn.00408ac4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x47ac1e
mov ecx, dword [0x535d18]
mov dl, 1
mov eax, dword [0x478b6c]
call fcn.0042544c
call fcn.00407328
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47ad70
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40f754]
call fcn.00409418
xor eax, eax
push ebp
push 0x47aeba
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x534ff8], 0
jne 0x47adc4
mov ecx, dword [0x535b8c]
mov dl, 1
mov eax, dword [0x41a398]
call fcn.0042544c
call fcn.00407328
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.0040502c
mov eax, ebx
call fcn.00408830
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x47aec8
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040b798
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x47ae0b
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x47ae60
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x47ae59
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00408bac
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00408b70
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.0041e924
test eax, eax
jne 0x47ae59
mov ebx, 0x15
jmp 0x47ae65
mov ebx, 0x10
jmp 0x47ae65
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x534ff8]
call fcn.0047ab50
mov eax, dword [ebp - 4]
call fcn.0047ab50
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040b7b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47aec1
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0xc]
mov edx, dword [0x40f754]
call fcn.004094f0
ret

Function at 0x47bd44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47be13
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47bdf0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x47bde6
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408b1c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47bdb6
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47bdcc
mov eax, ebx
mov edx, 0x47be30
call fcn.00408cc8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047bcf4
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47bdfa
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47be1a
lea eax, [ebp - 0x208]
call fcn.00407c30
ret
Function at 0x47be34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47bf03
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47bee0
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x47bed6
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408b1c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47bea6
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47bebc
mov eax, ebx
mov edx, 0x47bf20
call fcn.00408cc8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047bcf4
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47beea
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bf0a
lea eax, [ebp - 0x208]
call fcn.00407c30
ret

Function at 0x47bf24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47c02f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47c001
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x535bcc]
cmp byte [eax], 0
jne 0x47bf81
mov eax, ebx
call fcn.0047be34
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c00b
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemWow64DirectoryW
test eax, eax
je 0x47bff7
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00408b70
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0047bcf4
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x47bfd9
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47bff7
lea edx, [ebp - 0x218]
mov eax, dword [ebx]
call fcn.004267f4
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c00b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c036
lea eax, [ebp - 0x218]
call fcn.00407c30
lea eax, [ebp - 0x210]
call fcn.00407c30
ret
Function at 0x47c140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47c234
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47c20c
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x47c202
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408b1c
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.00480740
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00408010
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047bcf4
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x47c1ec
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47c202
mov eax, ebx
mov edx, 0x47c250
call fcn.00408cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c216
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c23b
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00407c90
ret

Function at 0x47c254
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47c2e1
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x402]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x47c2d7
mov edx, ebx
lea eax, [ebp - 0x402]
call fcn.00420ab4
cmp dword [ebx], 0
je 0x47c2d7
mov eax, dword [ebx]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x47c2c1
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47c2d7
mov eax, ebx
mov edx, 0x47c300
call fcn.00408cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c2eb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47cb24
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47cc9f
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47cc77
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c8d0
cmp al, 9
jb 0x47cc07
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408c48
xor edx, edx
push ebp
push 0x47cc00
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47cbe8
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, dword [ebp - 8]
call fcn.00420ab4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cbba
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47cbd6
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004267f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47cc81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cc07
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408c48
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x535d10]
mov eax, dword [eax]
mov ecx, 0x47ccbc
mov edx, 0x47cce8
call fcn.0047056c
test al, al
je 0x47cc6d
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cc3b
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47cc6d
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cc50
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47cc6d
mov eax, dword [ebp - 8]
mov edx, 0x47cd78
call fcn.00408cc8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47cc81
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cca6
lea eax, [ebp - 0x10]
call fcn.00407c30
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47cd7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47cf10
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47cee3
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c8d0
cmp al, 9
jb 0x47ce5b
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408c48
xor edx, edx
push ebp
push 0x47ce54
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47ce3c
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, dword [ebp - 8]
call fcn.00420ab4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47ce0e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47ce2a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004267f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ceed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ce5b
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408c48
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x535de8]
mov eax, dword [eax]
mov ecx, 0x47cf2c
mov edx, 0x47cf48
call fcn.0047056c
test al, al
je 0x47ced9
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0047bcf4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408010
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cea7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47ced9
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cebc
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47ced9
mov eax, dword [ebp - 8]
mov edx, 0x47cfd8
call fcn.00408cc8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ceed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cf17
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47cfdc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47d170
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47d143
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c8d0
cmp al, 9
jb 0x47d0bb
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408c48
xor edx, edx
push ebp
push 0x47d0b4
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47d09c
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, dword [ebp - 8]
call fcn.00420ab4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47d06e
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47d08a
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004267f4
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d14d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d0bb
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408c48
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x535de8]
mov eax, dword [eax]
mov ecx, 0x47d18c
mov edx, 0x47d1b4
call fcn.0047056c
test al, al
je 0x47d139
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0047bcf4
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408010
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47d107
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47d139
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47d11c
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47d139
mov eax, dword [ebp - 8]
mov edx, 0x47d244
call fcn.00408cc8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d14d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d177
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret