joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b870
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x401c
call fcn.004a4490
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x528c48]
push ebx
push esi
xor bl, bl
mov dword [ebp - 0x400c], 0
xor esi, esi
mov word [ebp - 0x4008], 0x500
cmp eax, 0x10
jl 0x46b8bc
cmp eax, 0xf
jl 0x46b8bc
mov ecx, 0xfffffffc
mov dword [ebp - 0x4018], ecx
jmp 0x46b8f6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x4018]
push ecx
push 8
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x46b8e0
mov ecx, dword [ebp - 0x4018]
mov esi, ecx
jmp 0x46b8f6
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov dword [ebp - 0x4018], ecx
test eax, eax
jne 0x46ba09
lea eax, [ebp - 0x4014]
mov dword [ebp - 0x4010], 0
push eax
push 4
lea eax, [ebp - 0x4010]
push eax
push 0x14
push ecx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x46b9fe
cmp dword [ebp - 0x4010], 0
je 0x46b9fe
lea eax, [ebp - 0x4014]
push eax
push 0x4000
lea eax, [ebp - 0x4004]
push eax
push 2
push dword [ebp - 0x4018]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x46b9fe
test esi, esi
je 0x46b962
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x401c]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x400c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
xor esi, esi
cmp dword [ebp - 0x4004], esi
jbe 0x46b9e0
nop word [eax + eax]
push dword [ebp + esi*8 - 0x4000]
push dword [ebp - 0x401c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x46b9de
inc esi
cmp esi, dword [ebp - 0x4004]
jb 0x46b9a0
push dword [ebp - 0x401c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov bl, 1
push dword [ebp - 0x401c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x46ba09
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor al, al
pop esi
xor ecx, ebp
pop ebx
call fcn.004a389b
mov esp, ebp
pop ebp
ret
Function at 0x46be60
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea esi, [ebp - 0x20c]
mov dword [ebp - 0x418], edx
push 0x104
mov eax, esi
mov ebx, ecx
push eax
push ebx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp eax, 0x104
jne 0x46bebc
push 0x10000
call fcn.004b0190
mov esi, eax
add esp, 4
test esi, esi
je 0x46bf25
push 0x8000
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x46bf2d
cmp byte [ebp + 8], 0
je 0x46bef6
push 0x104
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test eax, eax
je 0x46bef6
lea eax, [ebp - 0x20c]
cmp esi, eax
je 0x46bef0
push esi
call fcn.004b01a0
add esp, 4
lea esi, [ebp - 0x414]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x46bf2d
mov edx, esi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x46bf07
sub edx, ecx
mov ecx, dword [ebp - 0x418]
sar edx, 1
push edx
push esi
call fcn.0040a090
jmp 0x46bf35
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
lea eax, [ebp - 0x20c]
cmp esi, eax
je 0x46bf52
lea eax, [ebp - 0x414]
cmp esi, eax
je 0x46bf52
push esi
call fcn.004b01a0
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a389b
mov esp, ebp
pop ebp
ret
Function at 0x46c420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, edx
mov edx, ecx
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x21c], edx
push edi
mov edi, dword [ebp + 8]
test edx, edx
je 0x46c590
test eax, eax
je 0x46c590
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x46c461
mov ecx, dword [edi]
push ebx
push esi
xor esi, esi
mov dword [edi + 0x10], 0
mov word [ecx], si
xor ecx, ecx
mov word [ebp - 0x20c], cx
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x20c]
mov dword [ebp - 0x210], 0x208
push ecx
push esi
push esi
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
cmp esi, 0xea
jne 0x46c54b
mov eax, dword [ebp - 0x210]
add eax, 2
push 0x4f321c
push eax
mov dword [ebp - 0x214], eax
call fcn.004a3916
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x46c533
lea eax, [ebp - 0x214]
push eax
push ebx
push 0
push 0
push dword [ebp - 0x218]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
jne 0x46c517
mov eax, dword [ebp - 0x214]
shr eax, 1
je 0x46c50e
lea edx, [eax - 1]
lea edx, [ebx + edx*2]
nop
cmp word [edx], 0
jne 0x46c50e
sub edx, 2
sub eax, 1
jne 0x46c500
push eax
push ebx
mov ecx, edi
call fcn.0040a090
push ebx
call fcn.004a3911
add esp, 4
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov esi, 8
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
test esi, esi
jne 0x46c57d
mov eax, dword [ebp - 0x210]
shr eax, 1
je 0x46c56e
lea ecx, [ebp + eax*2 - 0x20e]
cmp word [ecx], 0
jne 0x46c56e
sub ecx, 2
sub eax, 1
jne 0x46c560
push eax
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0040a090
mov eax, esi
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x57
xor ecx, ebp
pop edi
call fcn.004a389b
mov esp, ebp
pop ebp
ret
Function at 0x46f440
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, edx
push edi
mov edi, dword [ebp + 0x18]
test ecx, 0x400
je 0x46f458
or dword [esi], 0x80
test ecx, 0x800
je 0x46f466
or dword [esi], 0x100
test cl, 1
je 0x46f471
or dword [esi], 0x80000000
test ecx, 0x100
je 0x46f47f
or dword [esi], 0x20000000
test ecx, 0x200
je 0x46f48d
or dword [esi], 0x10000
test cl, cl
jns 0x46f494
or dword [esi], 4
mov edx, dword [ebp + 8]
test cl, 2
je 0x46f4a4
or dword [esi], 0x40000000
jmp 0x46f4b4
test cl, 4
je 0x46f4b4
mov eax, dword [esi]
mov dword [edx], eax
or eax, 0x100
mov dword [esi], eax
mov edx, ecx
and edx, 0x20000000
push ebx
test cl, 8
je 0x46f4df
test edx, edx
mov eax, 5
mov ebx, 2
cmove ebx, eax
mov eax, dword [ebp + 0x10]
neg edx
sbb edx, edx
add edx, 2
mov dword [eax], edx
jmp 0x46f4fe
mov eax, dword [ebp + 0x10]
test edx, edx
je 0x46f4f3
mov dword [eax], 4
mov ebx, 3
jmp 0x46f4fe
mov dword [eax], 3
mov ebx, 1
mov eax, dword [ebp + 0xc]
mov dword [edi], ebx
pop ebx
test cl, 0x10
je 0x46f50c
or dword [eax], 1
test cl, 0x20
je 0x46f514
or dword [eax], 2
test cl, 0x40
je 0x46f51c
or dword [eax], 4
mov edx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x14]
test ecx, ecx
jns 0x46f532
or dword [edi], 0x4000000
or dword [edx], 0x1000
test ecx, 0x10000000
je 0x46f546
or dword [edi], 0x2000000
or dword [edx], 0x4000
test ecx, 0x8000000
je 0x46f557
or dword [edi], 0x2000000
or dword [edx], 1
test ecx, 0x40000
je 0x46f56b
or dword [edi], 0x200000
or dword [edx], 0x200000
mov eax, ecx
and eax, 0x7000000
je 0x46f5c5
cmp eax, 0x6000000
ja 0x46f5b5
je 0x46f5aa
cmp eax, 0x4000000
je 0x46f599
cmp eax, 0x5000000
jne 0x46f5c5
or dword [edi], 0x10000000
or dword [edx], 0x800
jmp 0x46f5c5
mov eax, dword [ebp + 0x20]
or dword [edi], 0x2100
or dword [eax], 0x2100
jmp 0x46f5c5
or dword [edi], 0x8000000
or dword [edx], 4
jmp 0x46f5c5
cmp eax, 0x7000000
jne 0x46f5c5
or dword [edi], 0x80000000
or dword [edx], 2
test ecx, 0x10000
jne 0x46f5e8
or dword [esi], 0x100000
mov esi, dword [ebp + 8]
mov eax, dword [esi]
test eax, eax
je 0x46f5e3
or eax, 0x100000
mov dword [esi], eax
or dword [edx], 0x20
jmp 0x46f5ee
or dword [edi], 0x40000000
pop edi
pop esi
test ecx, 0xc000
je 0x46f5fe
or dword [edx], 0x100
pop ebp
ret
Function at 0x4711e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, edx
mov esi, ecx
push edi
mov dword [ebx], 0
cmp word [esi], 0x2a
jne 0x471264
push 5
lea eax, [esi + 2]
push 0x508bd8
push eax
call fcn.004bd322
add esp, 0xc
test eax, eax
jne 0x471264
push 0x10
push eax
lea eax, [esi + 0xc]
push eax
call fcn.004bb46f
add esp, 0xc
cmp eax, 0xffffffff
je 0x471264
push 0
lea edx, [ebp - 0x48]
mov dword [ebp - 8], 0x10002
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], eax
call fcn.00470f60
or ecx, 0xffffffff
add esp, 4
test eax, eax
cmove ecx, dword [ebp - 0x48]
mov dword [ebx], ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov eax, dword [0x528bec]
xor edi, edi
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], eax
test eax, eax
je 0x471288
push edi
mov ecx, eax
call dword [0x4ed33c]
call dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebx], eax
cmp eax, 0xffffffff
jne 0x47129e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, dword [0x528bec]
test esi, esi
je 0x4712b5
push dword [ebp - 0x10]
mov ecx, esi
call dword [0x4ed33c]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a389b
mov esp, ebp
pop ebp
ret

Function at 0x4712d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10008
call fcn.004a4490
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x528bec]
push edi
xor edi, edi
mov dword [ebp - 0x10008], ecx
lea ebx, [edi + 1]
test esi, esi
je 0x47130c
push edi
mov ecx, esi
call dword [0x4ed33c]
call esi
mov ebx, eax
lea eax, [ebp - 0x10004]
push eax
push 0x8000
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x47132c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x471357
lea edx, [ebp - 0x10004]
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x471335
mov ecx, dword [ebp - 0x10008]
lea eax, [ebp - 0x10004]
sub edx, esi
sar edx, 1
push edx
push eax
call fcn.0040a090
mov esi, dword [0x528bec]
test esi, esi
je 0x47136c
push ebx
mov ecx, esi
call dword [0x4ed33c]
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004a389b
mov esp, ebp
pop ebp
ret
Function at 0x471cf0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov ebx, ecx
mov edi, edx
mov dword [ebp - 0x210], edi
test ebx, ebx
je 0x471e38
cmp word [ebx], 0
je 0x471e38
push esi
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x471e1f
cmp esi, 0x104
jae 0x471d69
push esi
lea eax, [ebp - 0x20c]
mov ecx, edi
push eax
call fcn.0040a090
pop esi
pop edi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004b0190
mov edi, eax
add esp, 4
test edi, edi
je 0x471e07
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x471de3
cmp eax, esi
jae 0x471dc2
mov ecx, dword [ebp - 0x210]
push esi
push edi
call fcn.0040a090
push edi
call fcn.004b01a0
add esp, 4
xor eax, eax
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
push edi
mov esi, 0x7a
call fcn.004b01a0
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
mov esi, eax
call fcn.004b01a0
add esp, 4
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov esi, 8
mov eax, esi
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
pop esi
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x57
pop edi
xor ecx, ebp
pop ebx
call fcn.004a389b
mov esp, ebp
pop ebp
ret
Function at 0x478df0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov ecx, 0x52638c
push 0
call fcn.004a4e4f
mov edi, eax
mov esi, 1
test edi, edi
je 0x478f37
mov ebx, dword [ebp + 8]
mov eax, ebx
shr eax, 4
mov dword [ebp - 8], eax
inc eax
movzx eax, ax
mov dword [ebp - 4], eax
nop dword [eax]
push 0
push eax
push 6
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
test eax, eax
je 0x478e51
push ebx
mov edx, eax
mov ecx, edi
call fcn.00479b40
add esp, 4
test eax, eax
jne 0x478e6c
push esi
mov ecx, 0x52638c
inc esi
call fcn.004a4e4f
mov edi, eax
test edi, edi
je 0x478f37
mov eax, dword [ebp - 4]
jmp 0x478e30
test edi, edi
je 0x478f37
mov eax, dword [ebp - 8]
inc eax
push 6
movzx eax, ax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x478f37
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x478f37
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x478f37
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
lea ecx, [esi + eax]
and ebx, 0xf
jbe 0x478ed5
cmp esi, ecx
jae 0x478f37
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ebx, 1
jne 0x478ec3
cmp esi, ecx
jae 0x478f37
cmp word [esi], 0
je 0x478f37
mov ebx, dword [ebp - 0xc]
mov ecx, 1
movzx edi, word [esi]
mov eax, dword [ebx]
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x478f00
push edi
mov ecx, ebx
call fcn.00478f50
movzx ecx, word [esi]
lea eax, [esi + 2]
push ecx
push eax
push edi
push dword [ebx]
call fcn.004bdf2a
push eax
call fcn.00479bb0
mov eax, dword [ebx]
add esp, 0x14
cmp edi, dword [eax - 8]
jg 0x478f42
mov dword [eax - 0xc], edi
xor ecx, ecx
mov eax, dword [ebx]
mov word [eax + edi*2], cx
lea eax, [ecx + 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
push 0x80070057
call fcn.00426b70
int3

Function at 0x479b40
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x479b9b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x479b9b
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x479b88
cmp esi, edx
jae 0x479b9b
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x479b76
cmp esi, edx
jae 0x479b9b
xor eax, eax
cmp word [esi], ax
pop edi
cmove esi, eax
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x47a200
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
xor esi, esi
mov ebx, ecx
test edi, edi
je 0x47a2d9
mov eax, dword [0x521c14]
test eax, eax
jns 0x47a23f
call fcn.00480c70
neg eax
sbb eax, eax
neg eax
mov dword [0x521c14], eax
test eax, eax
jle 0x47a2d9
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 0x82c]
mov dword [ebp - 0x82c], esi
push eax
push 1
push edi
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x47a2c3
cmp dword [ebp - 8], 0x800
mov edi, dword [ebp - 0x82c]
ja 0x47a2b5
push 0x820
lea eax, [ebp - 0x828]
push esi
push eax
call fcn.004a6890
push dword [ebp - 8]
lea eax, [ebp - 0x828]
push edi
push eax
call fcn.004a6310
add esp, 0x18
mov dword [ebp - 0x28], 0xc
lea eax, [ebp - 0x828]
mov dword [ebp - 0x24], eax
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x47a2cb
push edi
mov esi, 0x7a
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x47a2cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x47a363
lea esi, [ebp - 0x828]
cmp dword [ebx + 0x14], 8
jb 0x47a2e1
mov ebx, dword [ebx]
mov eax, dword [0x528bec]
xor edi, edi
mov dword [ebp - 0x830], 1
mov dword [ebp - 0x834], eax
test eax, eax
je 0x47a311
push edi
mov ecx, eax
call dword [0x4ed33c]
call dword [ebp - 0x834]
mov dword [ebp - 0x830], eax
lea ecx, [esi + 0x800]
neg esi
sbb esi, esi
and esi, ecx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x47a331
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov esi, dword [0x528bec]
test esi, esi
je 0x47a34b
push dword [ebp - 0x830]
mov ecx, esi
call dword [0x4ed33c]
call esi
test edi, edi
jne 0x47a376
lea eax, [edi + 1]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
cmp edi, 0xb7
pop edi
setne al
xor ecx, ebp
pop esi
dec eax
pop ebx
call fcn.004a389b
mov esp, ebp
pop ebp
ret
Function at 0x47b6c0
Capabilities:
Get common file path
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [0x528cc4], esi
jne 0x47b6fd
sub esp, 8
lea ecx, [esi + 1]
call fcn.0047b470
mov esi, eax
add esp, 8
test esi, esi
jne 0x47b7d4
or dword [0x528ccc], 2
mov eax, dword [0x528cc4]
test eax, eax
je 0x47b70d
push eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x528cc8]
mov ecx, eax
inc eax
mov dword [0x528cc8], eax
test ecx, ecx
jne 0x47b7c2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.004bd1d2
add esp, 4
xor eax, eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
push str._SystemRoot_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ax, word [ebp - 0x210]
xor ecx, ecx
cmp cx, ax
je 0x47b769
mov ecx, 0x25
cmp cx, ax
jne 0x47b78d
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x210]
push eax
push str.SystemRoot
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, 4
call fcn.0046aca0
mov esi, eax
test esi, esi
jne 0x47b7bd
or dword [0x528ccc], 1
mov cl, 1
call fcn.0047a070
mov esi, eax
test esi, esi
jne 0x47b7bd
call fcn.0047a940
call fcn.0047b310
jmp 0x47b7c2
call fcn.0047b7f0
mov eax, dword [0x528cc4]
test eax, eax
je 0x47b7d2
push eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004a389b
mov esp, ebp
pop ebp
ret
Function at 0x482500
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x521104]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov eax, edx
mov dword [ebp - 0x210], eax
test esi, esi
je 0x482692
test eax, eax
je 0x482692
push ebx
push 4
push 0x5099ec
push esi
call fcn.004b4bc1
add esp, 0xc
test eax, eax
je 0x482596
push 4
push 0x508c2c
push esi
call fcn.004b4bc1
add esp, 0xc
test eax, eax
je 0x482596
mov eax, 0x3a
cmp ax, word [esi + 2]
jne 0x4825c5
mov eax, 0x5c
cmp ax, word [esi + 4]
jne 0x4825c5
push 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004b6405
add esp, 0xc
lea ebx, [ebp - 0x208]
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x20c]
jmp 0x4825e5
push 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004b6405
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0x204]
push 0x5c
push eax
call fcn.004a6c78
mov ebx, eax
add esp, 0x14
test ebx, ebx
jne 0x4825df
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x204]
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
push edi
push dword [ebp - 0x210]
mov word [ebx], cx
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
je 0x482653
cmp eax, edi
jae 0x482653
mov ecx, dword [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x482610
sub ecx, edx
sar ecx, 1
je 0x482653
lea eax, [ebp - 0x20c]
sub ebx, eax
sar ebx, 1
lea esi, [esi + ebx*2]
mov edx, esi
lea ebx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x482633
sub edx, ebx
sar edx, 1
lea eax, [edx + 1]
add eax, ecx
cmp eax, edi
jbe 0x482666
push 0x7a
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x210]
sub edi, ecx
push edi
push esi
lea eax, [eax + ecx*2]
push eax
call fcn.004b6405
add esp, 0xc
mov eax, 1
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a389b
mov esp, ebp
pop ebp
ret
push 0xa0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.004a389b
mov esp, ebp
pop ebp
ret
Function at 0x486690
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x486698
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4866ab
test al, 0x10
jne 0x4866ab
mov al, 1
ret
xor al, al
ret

Function at 0x4866b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [ecx + 0x14], 8
jb 0x4866b8
mov ecx, dword [ecx]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4866cb
test al, 0x10
je 0x4866cb
mov al, 1
ret
xor al, al
ret

Function at 0x486a90
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x28
push esi
mov esi, ecx
mov dword [esp + 4], edx
push edi
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x486aab
mov eax, dword [esi]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x486bcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x486af7
cmp dword [esi + 0x14], 8
jb 0x486ad0
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x486ae4
test al, 0x10
jne 0x486bcf
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 3
jne 0x486aef
xor eax, eax
nop
mov edi, dword [esi + 0x14]
mov ecx, esi
cmp edi, 8
jb 0x486b0c
mov ecx, dword [esi]
mov edx, dword [esi + 0x10]
inc eax
push 2
push 0x50a76c
push eax
call fcn.0040dc40
add esp, 0xc
mov dword [esp + 0xc], eax
cmp eax, 0xffffffff
je 0x486b88
inc eax
mov dword [esp + 0x20], 0
cmp dword [esi + 0x10], eax
xorps xmm0, xmm0
movaps xmmword [esp + 0x10], xmm0
mov ecx, esi
cmovb eax, dword [esi + 0x10]
mov dword [esp + 0x24], 0
cmp edi, 8
jb 0x486b52
mov ecx, dword [esi]
push eax
push ecx
lea ecx, [esp + 0x18]
call fcn.0040a370
cmp dword [esp + 0x24], 8
lea eax, [esp + 0x10]
push dword [esp + 8]
cmovae eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea ecx, [esp + 0x10]
call fcn.0040a450
mov eax, dword [esp + 0xc]
jmp 0x486b00
mov eax, esi
cmp edi, 8
jb 0x486b91
mov eax, dword [esi]
push dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x486bcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x14], 8
mov edi, eax
jb 0x486bb0
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x486bc0
test al, 0x10
jne 0x486bcf
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret