joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47bec0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 0xc], ebx
sete al
xor ecx, ecx
cmp dword [ebp + 8], ebx
sete cl
push ebx
push eax
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi], ebx
test eax, eax
je 0x47bf3c
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x47bf11
call fcn.00492150
push dword [esi]
call fcn.0047b600
add esp, 4
mov dword [esi], 0
lea eax, [edi + 1]
cmp eax, 2
jb 0x47bf20
mov dword [esi], edi
call fcn.00492150
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esi]
mov byte [esi + 4], 0
inc eax
cmp eax, 1
jbe 0x47bf40
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov byte [esi + 4], 0
int3

Function at 0x47c650
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
mov dword [ecx], 0
test ebx, ebx
je 0x47c6a0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x47c68a
call fcn.00492150
push dword [esi]
call fcn.0047b600
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x47c699
mov dword [esi], ebx
call fcn.00492150
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov byte [esi + 4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp eax, ebx
je 0x47c6b7
mov eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret 4
int3

Function at 0x47c760
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 8
mov esi, ecx
mov edi, dword [ebp + 8]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [ebp - 0x10], eax
cmp byte [ecx + 4], 0
je 0x47c7ce
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x47c7da
cmp byte [ebp + 0xc], 0
je 0x47c7ae
cmp byte [esi + 4], 0
je 0x47c7d2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, esi
push edi
call fcn.0047c830
mov bl, 1
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 8
mov eax, dword [esi]
jmp 0x47c784
mov eax, dword [esi]
jmp 0x47c7a2
mov eax, dword [esi]
jmp 0x47c7ec
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp byte [esi + 4], 0
je 0x47c7d6
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 0xea60
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x47c804
xor ebx, ebx
jmp 0x47c7b8
mov eax, dword [esi]
jmp 0x47c817
mov dword [ebp - 0x14], 0xffffffff
cmp byte [esi + 4], 0
je 0x47c800
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x47c7ae
mov edi, dword [ebp - 0x14]
jmp 0x47c7ae
Function at 0x47cbe0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0xb0
mov ebx, edx
mov dword [esp + 8], ecx
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0xa8], eax
mov dword [esp + 0x20], 0xa
mov eax, dword [0x52ce88]
mov al, byte [eax + 0xa]
test al, al
jne 0x47ce0f
xor edi, edi
dec edi
mov dword [esp + 0x98], edi
mov dword [esp + 0x9c], edi
mov dword [esp + 0xa0], edi
lea esi, [esp + 0x50]
mov ecx, ebx
push esi
call fcn.00497540
cmp byte [esi + 0xb], 0
mov dword [esp + 0xc], ebx
js 0x47cccd
mov eax, dword [esp + 0x58]
mov dword [esp + 0xa0], eax
movq xmm0, qword [esp + 0x50]
movq qword [esp + 0x98], xmm0
lea ebx, [esp + 0x50]
mov ecx, ebx
call fcn.00493ef0
lea esi, [esp + 0x8c]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, dword [esp + 0xc]
push esi
call fcn.00498b90
pxor xmm0, xmm0
movq qword [ebx + 0x34], xmm0
pxor xmm0, xmm0
movdqu xmmword [ebx + 0x24], xmm0
mov dword [ebx], 0x3c
mov dword [ebx + 4], 0x40
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], str.runas
cmp byte [esp + 0xa3], 0
js 0x47cce3
lea ecx, [esp + 0x98]
jmp 0x47ccea
lea ecx, [esp + 0x98]
push dword [esp + 0x54]
push dword [esp + 0x54]
call fcn.00478a70
jmp 0x47cc67
mov ecx, dword [esp + 0x98]
mov edi, dword [esp + 8]
mov al, byte [ebp + 8]
mov dword [esp + 0x60], ecx
cmp byte [esp + 0x97], 0
jns 0x47cd06
mov esi, dword [esp + 0x8c]
mov dword [esp + 0x64], esi
xor esi, esi
mov dword [esp + 0x68], esi
xor al, 1
movzx eax, al
mov dword [esp + 0x6c], eax
mov dword [esp + 0x70], esi
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x47cd8b
cmp byte [ebp + 0xc], 0
je 0x47cd84
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x9f
push str.launch_win.cc
push str.LaunchElevatedProcess
push esi
call fcn.00492120
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00486fa0
push 0xffffffffffffffff
push dword [esp + 0x8c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, ebx
lea ebx, [esp + 0x50]
call fcn.00487010
mov esi, dword [esp + 0x88]
mov ecx, edi
push esi
call fcn.0047c650
cmp byte [esp + 0x97], 0
jns 0x47cdac
push dword [esp + 0x8c]
call fcn.004dfb35
add esp, 4
cmp byte [esp + 0xa3], 0
jns 0x47cdc5
push dword [esp + 0x98]
call fcn.004dfb35
add esp, 4
mov dword [esp + 0x20], 0xa
mov eax, dword [0x52ce88]
mov al, byte [eax + 0xa]
test al, al
jne 0x47cdf1
mov ecx, dword [esp + 0xa8]
xor ecx, ebp
call fcn.004e0685
mov eax, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
movzx eax, al
mov dword [esp + 0x50], 0
lea ecx, [esp + 0x20]
push 2
push ebx
push ecx
push eax
call fcn.004577c0
add esp, 0x10
jmp 0x47cdd9
movzx eax, al
lea ecx, [esp + 0x50]
mov dword [ecx], str.LaunchElevatedProcess
lea edx, [esp + 0x20]
push 1
push ecx
push edx
push eax
call fcn.004568d0
add esp, 0x10
jmp 0x47cc1b
Function at 0x47d690
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x70
mov dword [esp + 8], ecx
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x68], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x30]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x42
push str.file_win.cc
push str.Read
push esi
call fcn.00492120
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.00486fa0
xor ebx, ebx
dec ebx
cmp dword [ebp + 0xc], 0
js 0x47d777
mov edi, dword [ebp + 0x14]
test edi, edi
js 0x47d777
mov ebx, dword [ebp + 8]
mov dword [esp + 0x2c], 0xffffffff
mov dword [esp + 0x28], 0
call fcn.004ddab0
test al, al
je 0x47d729
lea ecx, [esp + 0x28]
push 0
push edi
push dword [esp + 0x10]
push str.File::Read
call fcn.004ac8f0
pxor xmm0, xmm0
movdqa xmmword [esp + 0x10], xmm0
mov dword [esp + 0x20], 0
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ebx
lea eax, [esp + 0xc]
mov dword [eax], 0xffffffff
push esi
push eax
push edi
push dword [ebp + 0x10]
mov eax, dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x47d797
mov ebx, dword [esp + 0xc]
test ebx, ebx
js 0x47d7a9
lea ecx, [esp + 0x28]
call fcn.004ac880
lea ecx, [esp + 0x30]
call fcn.00487010
mov ecx, dword [esp + 0x68]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
cmp eax, 0x26
setne bl
neg ebx
jmp 0x47d76e
int3

Function at 0x47d890
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea edi, [esp + 0x10]
push 0xac
push str.file_win.cc
push str.GetLength
push edi
call fcn.00492120
add esp, 0x10
xor esi, esi
mov ecx, ebx
push esi
push edi
call fcn.00486fa0
mov dword [edi + 4], 0xffffffff
mov dword [edi], esi
mov edi, dword [esp + 4]
call fcn.004ddab0
test al, al
je 0x47d90f
lea ecx, [esp + 0x10]
push esi
push esi
push edi
push str.File::GetLength
call fcn.004ac8f0
xor eax, eax
dec eax
lea ebx, [esp + 8]
mov dword [ebx + 4], eax
mov dword [ebx], eax
push ebx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
cmp eax, 1
sbb esi, esi
mov edi, dword [ebx + 4]
or edi, esi
or esi, dword [ebx]
lea ecx, [esp + 0x10]
call fcn.004ac880
lea ecx, [esp + 0x20]
call fcn.00487010
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004e0685
mov eax, esi
mov edx, edi
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47da80
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 4], ecx
mov ebx, dword [ebp + 0xc]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea edi, [esp + 0x20]
movdqa xmmword [edi + 0x20], xmm0
movdqa xmmword [edi + 0x10], xmm0
movdqa xmmword [edi], xmm0
lea esi, [esp + 0x10]
push 0x171
push str.file_win.cc
push str.DoInitialize
push esi
call fcn.00492120
add esp, 0x10
mov ecx, edi
push 0
push esi
call fcn.00486fa0
mov eax, ebx
and eax, 1
neg eax
and eax, 3
xor edx, edx
inc edx
test bl, 2
cmove edx, eax
test bl, 4
mov ecx, 4
cmovne edx, ecx
test bl, 8
mov esi, 2
cmove esi, edx
test bl, 0x10
mov eax, 5
cmove eax, esi
test eax, eax
je 0x47dc4b
mov edx, ebx
and edx, 0x40
shl edx, 0x18
test bl, bl
cmovns ecx, edx
mov edx, ebx
rol edx, 0x1a
and edx, 0x80000100
or edx, ecx
bt ebx, 0x12
mov dword [esp + 0xc], eax
jae 0x47db4a
bt ebx, 0x15
jb 0x47dcb2
or edx, 0x20000000
mov eax, ebx
mov ecx, ebx
shr ecx, 4
and ecx, 0x10000
or ecx, edx
mov esi, ebx
shr esi, 8
and esi, 3
mov edx, ebx
shr edx, 0xd
and edx, 4
or edx, esi
and ebx, 0x400
mov dword [esp + 8], ebx
shl ebx, 0x14
mov esi, eax
shr esi, 3
and esi, 0x100
or esi, ebx
mov edi, eax
shr edi, 0xb
and edi, 2
or edi, esi
mov esi, eax
shl esi, 0xd
and esi, 0x4000000
or esi, edi
mov edi, eax
shl edi, 8
and edi, 0xa000000
or edi, esi
mov eax, dword [ebp + 8]
xor edx, 3
cmp byte [eax + 0xb], 0
mov esi, eax
jns 0x47dbb9
mov esi, dword [eax]
xor ebx, ebx
push ebx
push edi
push dword [esp + 0x14]
push ebx
push edx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov esi, dword [esp + 4]
cmp dword [esi], eax
je 0x47dc12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x47dbfa
call fcn.00492150
push dword [esi]
call fcn.0047b600
add esp, 4
mov dword [esi], 0
mov eax, edi
inc eax
cmp eax, 2
jb 0x47dc09
mov dword [esi], edi
call fcn.00492150
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov edi, dword [esi]
inc edi
cmp edi, 2
mov ecx, dword [ebp + 0xc]
jae 0x47dc65
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0047d960
add esp, 4
mov dword [esi + 0x14], eax
lea ecx, [esp + 0x20]
call fcn.00487010
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004e0685
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 8
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0xffffffff
call fcn.0050fe40
jmp 0x47dc2d
mov eax, dword [esp + 8]
shr eax, 0xa
mov dword [esi + 0x14], 0
mov byte [esi + 0x19], al
test cl, 4
jne 0x47dc89
test cl, 0xa
mov eax, dword [ebp + 8]
je 0x47dc9e
mov byte [esi + 0x18], 1
jmp 0x47dc9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
cmp eax, 0xb7
setne byte [esi + 0x18]
mov eax, dword [ebp + 8]
bt ecx, 0x15
jae 0x47dc2d
push eax
call fcn.0047fdd0
add esp, 4
jmp 0x47dc2d
int3
Function at 0x47dcc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov ebx, dword [ebp + 8]
cmp dword [ecx], ebx
je 0x47dd0a
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [esi]
inc eax
cmp eax, 2
jb 0x47dcf4
call fcn.00492150
push dword [esi]
call fcn.0047b600
add esp, 4
mov dword [esi], 0
lea eax, [ebx + 1]
cmp eax, 2
jb 0x47dd03
mov dword [esi], ebx
call fcn.00492150
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x47ddf0
Capabilities:
Check if file exists
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
pop ebp
jmp fcn.0047de00

Function at 0x47e040
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
inc edx
pop ebp
jmp fcn.0047de00

Function at 0x47e050
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x1e7
push str.file_util_win.cc
push str.DeleteFileAfterReboot
push ebx
call fcn.00492120
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00486fa0
mov al, byte [edi + 0xb]
test al, al
jns 0x47e0b8
cmp dword [edi + 4], 0x103
jbe 0x47e0b8
xor ebx, ebx
jmp 0x47e0ce
test al, al
jns 0x47e0be
mov edi, dword [edi]
push 4
push 0
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea ecx, [esp + 0x10]
call fcn.00487010
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x47e270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x226
push str.file_util_win.cc
push str.PathExists
push ebx
call fcn.00492120
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00486fa0
cmp byte [edi + 0xb], 0
jns 0x47e2cc
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne bl
mov ecx, esi
call fcn.00487010
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47e300
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x60
mov dword [esp + 0xc], edx
mov edi, ecx
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x58], eax
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x20]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea esi, [esp + 0x10]
push 0x22f
push str.file_util_win.cc
push str.PathHasAccess
push esi
call fcn.00492120
add esp, 0x10
mov ecx, ebx
push 0
push esi
call fcn.00486fa0
cmp byte [edi + 0xb], 0
jns 0x47e361
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor esi, esi
cmp eax, 0xffffffff
je 0x47e3f3
test al, 0x10
mov edx, dword [esp + 0xc]
cmove edx, dword [ebp + 8]
mov eax, 0x80
mov ecx, 0x2000000
cmove ecx, eax
push esi
push ecx
push 3
push esi
push 7
push edx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
test eax, eax
je 0x47e3ba
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp ebx, 0xffffffff
je 0x47e3f7
call fcn.00492150
mov esi, ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
test esi, esi
setne bl
lea eax, [esi + 1]
cmp eax, 2
jb 0x47e3d5
call fcn.00492150
push esi
call fcn.0047b600
add esp, 4
lea ecx, [esp + 0x20]
call fcn.00487010
mov ecx, dword [esp + 0x58]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
xor ebx, ebx
jmp 0x47e3d5
xor esi, esi
jmp 0x47e3b3

Function at 0x47e400
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x50
mov edi, dword [ebp + 8]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x48], eax
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
mov ebx, esp
push 0x24e
push str.file_util_win.cc
push str.DirectoryExists
push ebx
call fcn.00492120
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00486fa0
cmp byte [edi + 0xb], 0
jns 0x47e45c
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
setne al
and ebx, 0x10
shr ebx, 4
and bl, al
mov ecx, esi
call fcn.00487010
mov ecx, dword [esp + 0x48]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x47e490
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x228
mov eax, dword [0x540010]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x21a]
push 0x20a
push 0xff
push ebx
call fcn.004e3a90
add esp, 0xc
push ebx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, eax
dec esi
cmp esi, 0x102
ja 0x47e513
push ebx
call fcn.004fbc1b
add esp, 4
lea edi, [ebp - 0x234]
mov ecx, edi
push eax
push ebx
call fcn.00493e00
lea ebx, [ebp - 0x228]
mov ecx, edi
push ebx
call fcn.00495a50
mov ecx, dword [ebp + 8]
push ebx
call fcn.00493f70
mov ecx, ebx
call fcn.00493ef0
mov ecx, edi
call fcn.00493ef0
cmp esi, 0x103
setb bl
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
add esp, 0x228
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x47e540
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x218
mov esi, dword [ebp + 8]
mov eax, dword [0x540010]
xor eax, ebp
mov dword [ebp - 0xc], eax
lea edi, [ebp - 0x214]
push 0x208
push 0xff
push edi
call fcn.004e3a90
sub esp, 8
mov dword [esp + 0x10], edi
movaps xmm0, xmmword [0x52f480]
movups xmmword [esp], xmm0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x47e5bc
cmp word [ebp - 0x214], 0
je 0x47e5bc
push edi
call fcn.004fbc1b
add esp, 4
mov ecx, esi
push eax
push edi
call fcn.00493e00
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004e0685
mov eax, esi
add esp, 0x218
pop esi
pop edi
pop ebp
ret
xor eax, eax
dec eax
lea edi, [ebp - 0x220]
mov dword [edi], eax
mov dword [edi + 4], eax
mov dword [edi + 8], eax
mov ecx, edi
call fcn.00493db0
push edi
call fcn.0047e490
add esp, 4
mov ecx, esi
test al, al
jne 0x47e5f1
push 3
push 0x52f4f4
call fcn.00493e00
jmp 0x47e5f7
push edi
call fcn.00493dd0
lea ecx, [ebp - 0x220]
call fcn.00493ef0
jmp 0x47e5a6
Function at 0x47eca0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff0
sub esp, 0x90
mov eax, dword [0x540010]
xor eax, ebp
mov dword [esp + 0x88], eax
cmp byte [0x545a00], 0
je 0x47ece0
xor ebx, ebx
mov ecx, dword [esp + 0x88]
xor ecx, ebp
call fcn.004e0685
mov eax, ebx
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x10]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea ebx, [esp + 0x50]
push 0x2d4
push str.file_util_win.cc
push str.GetSecureSystemTemp
push ebx
call fcn.00492120
add esp, 0x10
mov ecx, esi
push 0
push ebx
call fcn.00486fa0
cmp dword [ebp + 8], 0
je 0x47eec6
xor edi, edi
dec edi
lea esi, [esp + 4]
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov ecx, esi
call fcn.00493db0
push esi
push 0x65
call fcn.00480b30
add esp, 8
test al, al
je 0x47edee
lea esi, [esp + 4]
mov ecx, esi
push 0xa
push 0x52f552
push ebx
call fcn.00495930
mov ecx, esi
push ebx
call fcn.00493f70
mov ecx, ebx
call fcn.00493ef0
pcmpeqd xmm0, xmm0
lea ebx, [esp + 0x50]
movdqa xmmword [ebx + 0x20], xmm0
movdqa xmmword [ebx + 0x10], xmm0
movdqa xmmword [ebx], xmm0
lea eax, [esp + 0x40]
push 0x226
push str.file_util_win.cc
push str.PathExists
push eax
call fcn.00492120
add esp, 0x10
mov ecx, ebx
push 0
lea eax, [esp + 0x44]
push eax
call fcn.00486fa0
cmp byte [esi + 0xb], 0
jns 0x47edbb
mov esi, dword [esp + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov ecx, ebx
call fcn.00487010
cmp esi, 0xffffffff
je 0x47edee
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.0047e300
add esp, 4
test al, al
jne 0x47eeae
lea esi, [esp + 4]
mov ecx, esi
call fcn.00493ef0
mov dword [esp + 4], edi
mov dword [esp + 8], edi
mov dword [esp + 0xc], edi
mov ecx, esi
call fcn.00493db0
push esi
push 0x67
call fcn.00480b30
add esp, 8
test al, al
je 0x47ee95
pcmpeqd xmm0, xmm0
lea esi, [esp + 0x50]
movdqa xmmword [esi + 0x20], xmm0
movdqa xmmword [esi + 0x10], xmm0
movdqa xmmword [esi], xmm0
lea edi, [esp + 0x40]
push 0x226
push str.file_util_win.cc
push str.PathExists
push edi
call fcn.00492120
add esp, 0x10
mov ecx, esi
push 0
push edi
call fcn.00486fa0
cmp byte [esp + 0xf], 0
lea eax, [esp + 4]
jns 0x47ee66
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov ecx, esi
call fcn.00487010
cmp ebx, 0xffffffff
je 0x47ee95
lea ecx, [esp + 4]
mov edx, 2
push 0x40000000
call fcn.0047e300
add esp, 4
test al, al
jne 0x47eeae
lea ecx, [esp + 4]
call fcn.00493ef0
xor ebx, ebx
lea ecx, [esp + 0x10]
call fcn.00487010
jmp 0x47ecc8
mov ecx, dword [ebp + 8]
lea esi, [esp + 4]
push esi
call fcn.00493f10
mov ecx, esi
call fcn.00493ef0
mov bl, 1
jmp 0x47eea0
int3