joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471a20
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 8], 0
mov eax, dword [ebp - 4]
add eax, 0x14
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00408ac4
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0xc], ebx
test ebx, ebx
jbe 0x471ace
xor eax, eax
push ebp
push 0x471abd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004045e8
mov esi, eax
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, esi
xor ecx, ecx
call fcn.0040502c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x14]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
call fcn.00408ac4
push eax
call sub.version.dll_GetFileVersionInfoW
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [ebp - 4]
mov byte [edx + 8], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x471ace
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x472200
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x4722d6
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor esi, esi
push ebp
push 0x4722a9
push dword fs:[esi]
mov dword fs:[esi], esp
test dl, dl
je 0x47225a
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00408bc0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0xc]
call fcn.0041e980
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083d4
jmp 0x472269
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040877c
mov eax, 1
mov edx, dword [ebp - 4]
test edx, edx
je 0x47227a
sub edx, 4
mov edx, dword [edx]
test edx, edx
jle 0x47229c
mov ecx, 1
imul eax, eax, 0x5517e877
mov ebx, dword [ebp - 4]
movzx ebx, byte [ebx + ecx - 1]
xor eax, dword [ebx*4 + 0x534198]
inc ecx
dec edx
jne 0x472283
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4722b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4722dd
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x4722e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], ecx
mov ebx, eax
xor eax, eax
push ebp
push 0x472408
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
xor ecx, ecx
push ebp
push 0x4723db
push dword fs:[ecx]
mov dword fs:[ecx], esp
test dl, dl
je 0x472353
lea eax, [ebp - 0x20]
mov edx, ebx
call fcn.00408bc0
mov eax, dword [ebp - 0x20]
lea edx, [ebp - 0x1c]
call fcn.0041e980
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 4]
mov ecx, 0xfde9
call fcn.004083d4
jmp 0x472362
lea eax, [ebp - 4]
mov edx, ebx
mov ecx, 0xfde9
call fcn.0040877c
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
test eax, eax
je 0x47237c
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
test ebx, ebx
jle 0x4723c5
mov esi, 1
push 0
push 0x5517e877
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00409a6c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
movzx eax, byte [eax + esi - 1]
mov edx, dword [eax*8 + 0x53459c]
mov eax, dword [eax*8 + 0x534598]
xor eax, dword [ebp - 0x18]
xor edx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
inc esi
dec ebx
jne 0x472387
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4723e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47240f
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407cf0
lea eax, [ebp - 4]
call fcn.00407c54
ret
Function at 0x476670
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x476738
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00407c30
xor eax, eax
push ebp
push 0x476712
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
mov ebx, eax
test ebx, ebx
jle 0x476708
inc ebx
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x476644]
call fcn.0040a018
add esp, 4
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
je 0x4766f0
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00408b1c
push 0
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x476644]
call fcn.0040a018
add esp, 4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47671c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47673f
lea eax, [ebp - 4]
mov edx, dword [0x476644]
call fcn.0040a13c
ret

Function at 0x47aaf8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x47ab94
push 0
mov eax, ebx
call fcn.00408ac4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExW
mov ebx, eax
test ebx, ebx
jne 0x47ab6f
mov ebx, esi
test ebx, ebx
je 0x47ab41
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.00408ac4
push eax
push 1
push 0
mov eax, edi
call fcn.00408ac4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExW
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x47ab8a
mov ecx, dword [0x535d18]
mov dl, 1
mov eax, dword [0x478ad8]
call fcn.00425464
call fcn.00407328
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x47acdc
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x5c], ebx
mov dword [ebp - 0x10], ecx
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x40f76c]
call fcn.00409418
xor eax, eax
push ebp
push 0x47ae26
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x534ff8], 0
jne 0x47ad30
mov ecx, dword [0x535b8c]
mov dl, 1
mov eax, dword [0x41a3b0]
call fcn.00425464
call fcn.00407328
lea eax, [ebp - 0x24]
xor ecx, ecx
mov edx, 0x10
call fcn.0040502c
mov eax, ebx
call fcn.00408830
mov dword [ebp - 0x20], eax
push esi
mov esi, 0x47ae34
lea edi, [ebp - 0x34]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop esi
lea eax, [ebp - 0x34]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.0040b798
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
test eax, eax
je 0x47ad77
sub eax, 4
mov eax, dword [eax]
shr eax, 1
test eax, eax
jle 0x47adcc
mov dword [ebp - 0x14], 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x54]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x47adc5
lea eax, [ebp - 0x58]
mov edx, ebx
call fcn.00408bac
mov eax, dword [ebp - 0x58]
push eax
lea eax, [ebp - 0x5c]
lea edx, [ebp - 0x54]
mov ecx, 0x10
call fcn.00408b70
mov eax, dword [ebp - 0x5c]
pop edx
call fcn.0041e93c
test eax, eax
jne 0x47adc5
mov ebx, 0x15
jmp 0x47add1
mov ebx, 0x10
jmp 0x47add1
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x24]
push eax
push ebx
push 0
push esi
call dword [0x534ff8]
call fcn.0047aabc
mov eax, dword [ebp - 4]
call fcn.0047aabc
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.0040b7b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ae2d
lea eax, [ebp - 0x5c]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0xc]
mov edx, dword [0x40f76c]
call fcn.004094f0
ret

Function at 0x47bcb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47bd7f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47bd5c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
test eax, eax
je 0x47bd52
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408b1c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47bd22
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47bd38
mov eax, ebx
mov edx, 0x47bd9c
call fcn.00408cc8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047bc60
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47bd66
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bd86
lea eax, [ebp - 0x208]
call fcn.00407c30
ret
Function at 0x47bda0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47be6f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47be4c
push dword fs:[edx]
mov dword fs:[edx], esp
push 0xff
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
test eax, eax
je 0x47be42
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408b1c
mov eax, dword [ebx]
mov dword [ebp - 0x204], eax
mov eax, dword [ebp - 0x204]
test eax, eax
je 0x47be12
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47be28
mov eax, ebx
mov edx, 0x47be8c
call fcn.00408cc8
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047bc60
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47be56
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47be76
lea eax, [ebp - 0x208]
call fcn.00407c30
ret

Function at 0x47be90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x218], edx
mov dword [ebp - 0x210], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47bf9b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47bf6d
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [0x535bcc]
cmp byte [eax], 0
jne 0x47beed
mov eax, ebx
call fcn.0047bda0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47bf77
push 0x104
lea eax, [ebp - 0x20a]
push eax
call sub.kernel32.dll_GetSystemWow64DirectoryW
test eax, eax
je 0x47bf63
mov eax, ebx
lea edx, [ebp - 0x20a]
mov ecx, 0x105
call fcn.00408b70
lea edx, [ebp - 0x210]
mov eax, dword [ebx]
call fcn.0047bc60
mov edx, dword [ebp - 0x210]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x47bf45
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47bf63
lea edx, [ebp - 0x218]
mov eax, dword [ebx]
call fcn.0042680c
mov edx, dword [ebp - 0x218]
mov eax, ebx
call fcn.00408010
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47bf77
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47bfa2
lea eax, [ebp - 0x218]
call fcn.00407c30
lea eax, [ebp - 0x210]
call fcn.00407c30
ret
Function at 0x47c0ac
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x208], edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x47c1a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47c178
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x200]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathW
test eax, eax
je 0x47c16e
mov eax, ebx
lea edx, [ebp - 0x200]
call fcn.00408b1c
lea edx, [ebp - 0x204]
mov eax, dword [ebx]
call fcn.004806ac
mov edx, dword [ebp - 0x204]
mov eax, ebx
call fcn.00408010
lea edx, [ebp - 0x208]
mov eax, dword [ebx]
call fcn.0047bc60
mov edx, dword [ebp - 0x208]
mov eax, ebx
call fcn.00408010
mov eax, dword [ebx]
mov dword [ebp - 0x20c], eax
mov eax, dword [ebp - 0x20c]
test eax, eax
je 0x47c158
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47c16e
mov eax, ebx
mov edx, 0x47c1bc
call fcn.00408cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c182
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c1a7
lea eax, [ebp - 0x208]
mov edx, 2
call fcn.00407c90
ret

Function at 0x47c1c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00407c30
xor edx, edx
push ebp
push 0x47c24d
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x402]
push eax
push 0
push 0
push esi
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, 0x80000000
sete al
test al, al
je 0x47c243
mov edx, ebx
lea eax, [ebp - 0x402]
call fcn.00420acc
cmp dword [ebx], 0
je 0x47c243
mov eax, dword [ebx]
mov dword [ebp - 0x408], eax
mov eax, dword [ebp - 0x408]
test eax, eax
je 0x47c22d
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47c243
mov eax, ebx
mov edx, 0x47c26c
call fcn.00408cc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47c257
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x47ca90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47cc0b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47cbe3
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c85c
cmp al, 9
jb 0x47cb73
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408c48
xor edx, edx
push ebp
push 0x47cb6c
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47cb54
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, dword [ebp - 8]
call fcn.00420acc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cb26
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47cb42
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0042680c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47cbed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cb73
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408c48
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x535d10]
mov eax, dword [eax]
mov ecx, 0x47cc28
mov edx, 0x47cc54
call fcn.004704f8
test al, al
je 0x47cbd9
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cba7
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47cbd9
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cbbc
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47cbd9
mov eax, dword [ebp - 8]
mov edx, 0x47cce4
call fcn.00408cc8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47cbed
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cc12
lea eax, [ebp - 0x10]
call fcn.00407c30
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47cce8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47ce7c
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47ce4f
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c85c
cmp al, 9
jb 0x47cdc7
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408c48
xor edx, edx
push ebp
push 0x47cdc0
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push 0
push 0
push 0x1a
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47cda8
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, dword [ebp - 8]
call fcn.00420acc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cd7a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47cd96
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0042680c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ce59
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47cdc7
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408c48
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x535de8]
mov eax, dword [eax]
mov ecx, 0x47ce98
mov edx, 0x47ceb4
call fcn.004704f8
test al, al
je 0x47ce45
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0047bc60
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408010
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47ce13
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47ce45
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47ce28
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47ce45
mov eax, dword [ebp - 8]
mov edx, 0x47cf44
call fcn.00408cc8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47ce59
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47ce83
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47cf48
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x47d0dc
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
push ebp
push 0x47d0af
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0046c85c
cmp al, 9
jb 0x47d027
lea eax, [ebp - 4]
mov edx, 0x104
call fcn.00408c48
xor edx, edx
push ebp
push 0x47d020
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
call fcn.00408ac4
push eax
push 0
push 0
push 0x1c
push 0
call sub.SHFolder.dll_SHGetFolderPathW
test eax, eax
jne 0x47d008
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, dword [ebp - 8]
call fcn.00420acc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47cfda
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47cff6
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0042680c
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00408010
call fcn.0040741c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d0b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d027
lea eax, [ebp - 4]
xor edx, edx
call fcn.00408c48
ret
mov eax, dword [ebp - 8]
push eax
mov eax, dword [0x535de8]
mov eax, dword [eax]
mov ecx, 0x47d0f8
mov edx, 0x47d120
call fcn.004704f8
test al, al
je 0x47d0a5
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0047bc60
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408010
mov edx, dword [ebp - 8]
mov edx, dword [edx]
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47d073
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x47d0a5
mov eax, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x47d088
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp word [edx + eax*2 - 2], 0x5c
je 0x47d0a5
mov eax, dword [ebp - 8]
mov edx, 0x47d1b0
call fcn.00408cc8
mov eax, dword [ebp - 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x47d0b9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47d0e3
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 4]
call fcn.00407c30
ret
Function at 0x47f80c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], dl
mov esi, eax
xor eax, eax
push ebp
push 0x47f9a5
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
xor eax, eax
mov dword [ebp - 0x18], eax
cmp byte [ebp - 0x11], 0
je 0x47f84c
call fcn.0046d0dc
mov dword [ebp - 0x18], eax
mov eax, esi
test eax, eax
je 0x47f857
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x47f862
xor ebx, ebx
jmp 0x47f97d
cmp byte [ebp - 0x12], 0
je 0x47f966
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.00408058
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0042685c
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00408058
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
call fcn.004202a0
mov eax, dword [ebp - 8]
test eax, eax
je 0x47f8a3
sub eax, 4
mov eax, dword [eax]
cmp eax, 2
jne 0x47f8d0
lea eax, [ebp - 0x1c]
push eax
mov ecx, 1
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00408ef0
mov eax, dword [ebp - 0x1c]
mov edx, 0x47f9c0
call fcn.00408eb8
sete al
jmp 0x47f8d2
xor eax, eax
test al, al
je 0x47f8da
mov al, 1
jmp 0x47f8e4
mov dl, 1
mov eax, dword [ebp - 8]
call fcn.0041fbac
test al, al
je 0x47f8ec
mov al, 1
jmp 0x47f8fa
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.00408eb8
sete al
test al, al
jne 0x47f97d
cmp dword [ebp - 4], 0
jne 0x47f91e
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x47f97d
mov eax, dword [ebp - 4]
call fcn.00408ac4
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00408b1c
mov eax, dword [ebp - 0x20]
movzx ecx, byte [ebp - 0x12]
movzx edx, byte [ebp - 0x11]
call fcn.0047f80c
mov ebx, eax
test bl, bl
je 0x47f95c
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
call fcn.00408ac4
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x47f960
xor eax, eax
jmp 0x47f962
mov al, 1
mov ebx, eax
jmp 0x47f97d
lea eax, [ebp - 0x18]
push eax
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_CreateDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47f9ac
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00407c90
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00407c90
ret

Function at 0x47f9c4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00408ac4
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x47f9dd
test al, 0x10
jne 0x47f9e1
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x4805b4
Capabilities:
Set file attributes

Disassembly:
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00480664
test al, al
je 0x4805f4
mov eax, esi
call fcn.00420090
mov ebx, eax
test bl, bl
jne 0x4805f4
mov eax, esi
call fcn.00480498
push 0x80
mov eax, esi
call fcn.00408ac4
push eax
call sub.kernel32.dll_SetFileAttributesW
mov eax, esi
call fcn.00420090
mov ebx, eax
mov eax, ebx
pop esi
pop ebx
ret