joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031690
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x1003169f
pop dword [ebp - 0x24]
mov eax, 0xc4d8f47c
add eax, 0x4b2a2223
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xaa3d4564
sub dword [ebp - 0x34], 0x5beb0019
mov dword [ebp - 0x30], 0x8a280d0f
sub dword [ebp - 0x30], 0x57f4c0ca
mov dword [ebp - 0x2c], 0x7b6c9db2
sub dword [ebp - 0x2c], 0x2f205984
mov dword [ebp - 0x28], 0x488fac49
sub dword [ebp - 0x28], 0x488fac49
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0x94bf3c8d
sub dword [ebp - 0x34], 0x204cd337
mov dword [ebp - 0x30], 0x9de1aadd
add dword [ebp - 0x30], 0xa38ab698
mov dword [ebp - 0x2c], 0x8ffccf1e
sub dword [ebp - 0x2c], 0x2c8d62b2
mov dword [ebp - 0x28], 0xf15045e4
sub dword [ebp - 0x28], 0xf15045e4
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x81f9a7ad
sub eax, 0x71f5c729
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x3e7ed
push 0
call eax
mov ecx, 0x48b9
xor esi, esi
add esi, eax
mov edi, 0x10071200
add edi, dword [ebp - 0x24]
mov ebx, 0xe3a0e9be
sub ebx, 0x3cf8608f
sub dword [ebp - 4], eax
mov edx, dword [edi]
sub dword [ebp - 0x20], eax
sub edx, ebx
xor dword [ebp - 8], ebx
mov dword [esi], edx
mov dword [ebp - 4], 0x86c09d26
add esi, 4
add edi, 0x7f1dc90f
sub edi, 0x7f1dc90b
loop 0x100317b2
add eax, 0x63facfb7
sub eax, 0x63f9ba00
xor ebx, ebx
add ebx, eax
add eax, 0xf7539a5a
add eax, 0x8ac65ab
mov ecx, 0x10000000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x406900
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, esp
call fcn.00406917

Function at 0x4101c0
Capabilities:
Access the windows event log
Write file on windows

Disassembly:
mov eax, 0x10c
call fcn.0054d1b0
mov eax, dword [0x6d1554]
xor eax, esp
mov dword [esp + 0x108], eax
push esi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov esi, eax
test esi, esi
je 0x410246
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileType]
test eax, eax
je 0x410246
lea eax, [esp + 0x118]
mov edx, 0x100
push eax
push ecx
push dword [esp + 0x11c]
lea ecx, [esp + 0x14]
call fcn.0040f6c0
add esp, 0xc
test eax, eax
jns 0x41021c
mov eax, 0x100
push 0
lea ecx, [esp + 8]
push ecx
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0054d193
add esp, 0x10c
ret
lea eax, [esp + 0x118]
mov edx, 0xff
push eax
push ecx
push dword [esp + 0x11c]
lea ecx, [esp + 0x14]
call fcn.0040f6c0
add esp, 0xc
mov byte [esp + 0x107], 0
call fcn.00410080
test eax, eax
jle 0x4102ca
push str.OpenSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
test esi, esi
je 0x4102de
push 0
lea eax, [esp + 0xc]
mov dword [esp + 8], eax
lea eax, [esp + 8]
push eax
push 0
push 1
push 0
push 0
push 0
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
pop esi
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0054d193
add esp, 0x10c
ret
push 0x10
push str.OpenSSL:_FATAL
lea eax, [esp + 0x10]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x10c]
pop esi
xor ecx, esp
call fcn.0054d193
add esp, 0x10c
ret
Function at 0x428d20
Capabilities:
Encode data using base64

Disassembly:
push ebp
push esi
mov esi, dword [esp + 0xc]
xor ebp, ebp
push edi
mov edi, ecx
test esi, esi
jle 0x428dee
inc edx
push ebx
movzx eax, byte [edx - 1]
cmp esi, 3
jl 0x428d88
movzx ecx, byte [edx]
shl eax, 8
or eax, ecx
movzx ecx, byte [edx + 1]
shl eax, 8
or eax, ecx
mov ecx, eax
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], cl
mov ecx, eax
shr ecx, 0xc
inc edi
and ecx, 0x3f
mov ebx, edi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], cl
mov ecx, eax
and ecx, 0x3f
shr eax, 6
and eax, 0x3f
mov ch, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x428dd1
shl eax, 0x10
cmp esi, 2
jne 0x428d98
movzx ecx, byte [edx]
shl ecx, 8
or eax, ecx
mov ecx, eax
lea ebx, [edi + 1]
shr ecx, 0x12
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edi], cl
mov ecx, eax
shr ecx, 0xc
mov edi, ebx
and ecx, 0x3f
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ebx], cl
cmp esi, 1
jne 0x428dc3
mov cl, 0x3d
jmp 0x428dcf
shr eax, 6
and eax, 0x3f
mov cl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov ch, 0x3d
lea eax, [edi + 2]
mov byte [ebx + 1], cl
sub esi, 3
mov byte [eax], ch
add ebp, 4
lea edi, [eax + 1]
add edx, 3
test esi, esi
jg 0x428d35
pop ebx
mov byte [edi], 0
mov eax, ebp
pop edi
pop esi
pop ebp
ret

Function at 0x42aa80
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov ebx, ecx
call fcn.0042a900
mov edi, eax
test edi, edi
jne 0x42aafb
sub esp, 8
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push eax
lea edx, [edi + 1]
lea ecx, [edi + 2]
call fcn.0040d040
push 0x67ebb4
push esi
push 0x67ebb8
push ebx
push str.fopen_
push 5
call fcn.0040de90
add esp, 0x24
call fcn.005d23df
cmp dword [eax], 2
je 0x42aadd
call fcn.005d23df
cmp dword [eax], 6
je 0x42aadd
sub esp, 8
push 2
jmp 0x42aae5
sub esp, 8
push 0x80
mov edx, 0x6d
lea ecx, [edx - 0x4d]
call fcn.0040d040
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x6d3288
call fcn.00409de0
add esp, 4
mov esi, eax
push edi
test esi, esi
jne 0x42ab1d
call fcn.005ea26d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 1
push 0x6a
push esi
call fcn.0040a4b0
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x476930
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov eax, 0x90
call fcn.0054d1b0
mov eax, dword [0x6d1554]
xor eax, esp
mov dword [esp + 0x8c], eax
push ebx
mov ebx, dword [esp + 0x9c]
push ebp
mov ebp, dword [esp + 0xa4]
push esi
mov esi, ecx
mov dword [esp + 0x10], edx
xor ecx, ecx
mov dword [esp + 0xc], ebp
push edi
mov edi, dword [esp + 0xa4]
mov eax, dword [esi]
test ebx, ebx
je 0x476990
cmp ebx, eax
je 0x476987
test edx, edx
je 0x476ae2
test edi, edi
js 0x476ae2
mov ecx, 1
mov dword [esi], ebx
jmp 0x47699a
test eax, eax
je 0x476ae2
mov ebx, eax
test edx, edx
je 0x476a46
mov eax, dword [ebx + 0x40]
cmp eax, 0x80
jg 0x476afd
cmp eax, edi
jge 0x476a07
push dword [esp + 0x10]
lea ebp, [esi + 4]
mov edx, ebx
mov ecx, ebp
call fcn.00440700
add esp, 4
test eax, eax
je 0x476ae2
mov eax, dword [ebp + 0x14]
push edi
push dword [esp + 0x18]
push ebp
call eax
add esp, 0xc
test eax, eax
je 0x476ae2
lea eax, [esi + 0x4c]
mov ecx, ebp
push eax
lea edx, [esi + 0x50]
call fcn.00440910
add esp, 4
test eax, eax
je 0x476ae2
mov edi, dword [esi + 0x4c]
mov ebp, dword [esp + 0x10]
jmp 0x476a24
cmp edi, 0x80
ja 0x476ae2
push edi
push edx
lea eax, [esi + 0x50]
push eax
call fcn.005c6e20
add esp, 0xc
mov dword [esi + 0x4c], edi
cmp edi, 0x80
je 0x476a4e
mov eax, 0x80
sub eax, edi
push eax
lea eax, [esi + 0x50]
add eax, edi
push 0
push eax
call fcn.005c7920
add esp, 0xc
jmp 0x476a4e
test ecx, ecx
je 0x476acc
xor ecx, ecx
mov al, byte [esi + ecx + 0x50]
xor al, 0x36
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x476a50
lea edi, [esi + 0x1c]
mov edx, ebx
push ebp
mov ecx, edi
call fcn.00440700
add esp, 4
test eax, eax
je 0x476ae2
push dword [ebx + 0x40]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esi + 0x30]
push edi
call eax
add esp, 0xc
test eax, eax
je 0x476ae2
xor ecx, ecx
mov edi, edi
mov al, byte [esi + ecx + 0x50]
xor al, 0x5c
mov byte [esp + ecx + 0x18], al
inc ecx
cmp ecx, 0x80
jl 0x476a90
lea edi, [esi + 0x34]
mov edx, ebx
push ebp
mov ecx, edi
call fcn.00440700
add esp, 4
test eax, eax
je 0x476ae2
push dword [ebx + 0x40]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x14]
push edi
call eax
add esp, 0xc
test eax, eax
je 0x476ae2
lea edx, [esi + 0x1c]
lea ecx, [esi + 4]
call fcn.004409a0
test eax, eax
je 0x476ae2
mov eax, 1
jmp 0x476ae4
xor eax, eax
mov ecx, dword [esp + 0x9c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0054d193
add esp, 0x90
ret
push str.j____int_sizeof_ctx__key_
mov edx, 0x74
call fcn.00410300
int3
Function at 0x47eda0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x627e8b
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x6d1554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x21c], edi
call fcn.0047fb20
mov ecx, eax
test ecx, ecx
je 0x47eef7
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push 0x208
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.005c7920
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47ee30
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00481fe0
push esi
lea ecx, [ebp - 0x21c]
call fcn.0047d1b0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp - 0x21c]
je 0x47eead
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x47eead
push 0x65503c
mov ecx, edi
call fcn.0047cc90
mov dword [ebp - 4], 0xffffffff
add esi, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47eeda
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x47eeda
add esi, 0xfffffff0
push esi
call fcn.0047d610
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
mov dword [edi], eax
add esp, 4
or eax, 0xffffffff
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x47eeda
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d193
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0047d4b0
int3
Function at 0x47f520
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x627f8b
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x6d1554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x220], esi
je 0x47f58b
mov edi, dword [ebx]
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x47f57a
push edi
call fcn.0051c980
add esp, 4
test eax, eax
jne 0x47f58b
push 0x65503c
mov ecx, esi
call fcn.0047cc90
jmp 0x47f60e
push 0x20a
lea eax, [ebp - 0x21c]
push 0
push eax
call fcn.005c7920
push 1
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push dword [ebx]
call fcn.0047f640
add esp, 0x20
call fcn.0047fb20
mov ecx, eax
test ecx, ecx
je 0x47f62c
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [esi], eax
lea eax, [ebp - 0x21c]
mov dword [ebp - 4], 0
push eax
mov ecx, esi
call fcn.0047d4d0
test al, al
jne 0x47f60e
lea ecx, [ebp - 0x21c]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47f5f0
sub ecx, edx
lea eax, [ebp - 0x21c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00481fe0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d193
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0047d4b0
int3
Function at 0x47f640
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x627fcb
mov eax, dword fs:[0]
push eax
mov eax, 0x2018
call fcn.0054d1b0
mov eax, dword [0x6d1554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x2014], eax
mov eax, dword [ebp + 0x10]
push 0x2000
mov dword [ebp - 0x201c], eax
lea eax, [ebp - 0x2010]
push 0
push eax
call fcn.005c7920
add esp, 0xc
lea eax, [ebp - 0x2020]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x47f7bd
cmp eax, 0x1fff
ja 0x47f7bd
lea ecx, [ebp - 0x2010]
push ecx
push eax
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x47f7bd
lea eax, [ebp - 0x2024]
push eax
lea eax, [ebp - 0x2018]
push eax
push 0x655004
lea eax, [ebp - 0x2010]
push eax
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x47f7bd
cmp dword [ebp + 0x18], 0
mov eax, dword [ebp - 0x2018]
je 0x47f713
mov ebx, dword [eax + 8]
mov edi, dword [eax + 0xc]
jmp 0x47f719
mov ebx, dword [eax + 0x10]
mov edi, dword [eax + 0x14]
mov eax, dword [ebp - 0x2014]
test eax, eax
je 0x47f725
mov dword [eax], ebx
mov eax, dword [ebp - 0x201c]
test eax, eax
je 0x47f731
mov dword [eax], edi
test esi, esi
je 0x47f7b6
lea ecx, [ebp - 0x2014]
call fcn.0047cd30
movzx eax, di
push eax
shr edi, 0x10
push edi
movzx eax, bx
push eax
shr ebx, 0x10
lea eax, [ebp - 0x2014]
push ebx
push 0x6550e0
push eax
mov dword [ebp - 4], 0
call fcn.0047e8a0
mov edx, dword [ebp - 0x2014]
add esp, 0x18
mov ecx, 0x104
sub edx, esi
nop dword [eax]
lea eax, [ecx + 0x7ffffefa]
test eax, eax
je 0x47f79e
movzx eax, word [edx + esi]
test ax, ax
je 0x47f79e
mov word [esi], ax
add esi, 2
sub ecx, 1
jne 0x47f780
test ecx, ecx
lea eax, [esi - 2]
cmovne eax, esi
xor ecx, ecx
mov word [eax], cx
lea ecx, [ebp - 0x2014]
call fcn.0047ce50
mov eax, 1
jmp 0x47f7bf
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d193
mov esp, ebp
pop ebp
ret
Function at 0x47f910
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628046
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x6d1554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x228], edi
mov dword [ebp - 0x224], 0
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
push 0x200
lea eax, [ebp - 0x210]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.005c7920
add esp, 0xc
lea ecx, [ebp - 0x224]
push 0x20019
push str.SOFTWAREMicrosoftInternet_Explorer
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004817b0
mov esi, dword [ebp - 0x224]
test eax, eax
jne 0x47fa8b
lea eax, [ebp - 0x214]
mov dword [ebp - 0x214], 0x200
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.svcVersion
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47fa05
mov eax, dword [ebp - 0x218]
cmp eax, 1
je 0x47f9ea
cmp eax, 2
jne 0x47fa05
mov eax, dword [ebp - 0x214]
test eax, eax
je 0x47fa65
test al, 1
jne 0x47fa05
shr eax, 1
cmp word [ebp + eax*2 - 0x212], 0
je 0x47fa6e
push 0x200
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.005c7920
add esp, 0xc
mov dword [ebp - 0x214], 0x200
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push str.Version
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x47fa6e
mov eax, dword [ebp - 0x218]
cmp eax, 1
je 0x47fa5c
cmp eax, 2
jne 0x47fa6e
cmp dword [ebp - 0x214], 0
jne 0x47fa6e
xor eax, eax
mov word [ebp - 0x210], ax
test esi, esi
je 0x47fa81
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x220], 0
call fcn.0047fb20
mov ecx, eax
test ecx, ecx
je 0x47fb06
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x210]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
call fcn.0047d4d0
test al, al
jne 0x47fade
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x47fac0
sub ecx, edx
lea eax, [ebp - 0x210]
sar ecx, 1
push ecx
push eax
mov ecx, edi
call fcn.00481fe0
test esi, esi
je 0x47fae9
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d193
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0047d4b0
int3
Function at 0x480510
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x62826c
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x6d1554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov dword [ebp - 0x220], edi
call fcn.0047fb20
mov ecx, eax
test ecx, ecx
je 0x480740
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x220]
mov dword [ebp - 4], 0
push 0
push eax
call fcn.00521dd0
add esp, 8
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 1
call fcn.0047d000
mov edx, dword [ebp - 0x220]
or esi, 0xffffffff
mov byte [ebp - 4], 0
add edx, 0xfffffff0
mov eax, esi
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x4805b0
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
cmp dword [eax - 0xc], 0
je 0x4805ef
lea ebx, [eax - 0x10]
push ebx
call fcn.0047d610
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [edi], eax
lock xadd dword [ebx + 0xc], esi
dec esi
test esi, esi
jg 0x480722
mov ecx, dword [ebx]
push ebx
mov edx, dword [ecx]
call dword [edx + 4]
jmp 0x480722
lea eax, [ebp - 0x220]
push 1
push eax
call fcn.00521dd0
add esp, 8
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 2
call fcn.0047d000
mov edx, dword [ebp - 0x220]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x480631
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
cmp dword [eax - 0xc], 0
jne 0x48067f
lea eax, [ebp - 0x220]
push 2
push eax
call fcn.00521dd0
add esp, 8
push eax
lea ecx, [ebp - 0x21c]
mov byte [ebp - 4], 3
call fcn.0047d000
mov edx, dword [ebp - 0x220]
mov eax, esi
mov byte [ebp - 4], 0
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x48067f
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x21c]
cmp dword [eax - 0xc], 0
jne 0x4806f2
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.005c7920
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
push 0x655074
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4806d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00481fe0
mov ebx, dword [ebp - 0x21c]
add ebx, 0xfffffff0
push ebx
call fcn.0047d610
add eax, 0x10
mov dword [ebp - 4], 0xffffffff
add esp, 4
mov dword [edi], eax
lock xadd dword [ebx + 0xc], esi
dec esi
test esi, esi
jg 0x480722
mov ecx, dword [ebx]
push ebx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d193
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0047d4b0
int3
Function at 0x480b10
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x628341
mov eax, dword fs:[0]
push eax
sub esp, 0x210
mov eax, dword [0x6d1554]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x218]
mov esi, dword [ebp + 0xc]
push 0x208
push 0
push eax
mov dword [ebp - 0x21c], edi
call fcn.005c7920
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x480bbc
call fcn.0047fb20
mov ecx, eax
test ecx, ecx
je 0x480cae
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
push 0x65503c
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.0047d4d0
test al, al
jne 0x480c91
push 0
push 0x65503c
mov ecx, edi
call fcn.00481fe0
jmp 0x480c91
call fcn.0047fb20
mov ecx, eax
test ecx, ecx
je 0x480cb8
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebp - 0x21c]
call fcn.0047d4d0
test al, al
jne 0x480c22
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x480c00
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x21c]
call fcn.00481fe0
push esi
lea ecx, [ebp - 0x21c]
mov dword [ebp - 4], 2
call fcn.0047d1b0
cmp dword [ebp + 0x10], 0
mov esi, dword [ebp - 0x21c]
je 0x480c68
push 0
push esi
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x480c68
push 0x65503c
mov ecx, edi
call fcn.0047cc90
add esi, 0xfffffff0
jmp 0x480c79
add esi, 0xfffffff0
push esi
call fcn.0047d610
add esp, 4
add eax, 0x10
mov dword [edi], eax
or eax, 0xffffffff
mov dword [ebp - 4], eax
lock xadd dword [esi + 0xc], eax
dec eax
test eax, eax
jg 0x480c91
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0054d193
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.0047d4b0
push 0x80004005
call fcn.0047d4b0
int3

Function at 0x4814f0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x48151c
cmp dword [ebp + 0xc], 0
je 0x481515
push dword [ebp + 8]
call fcn.0051c980
add esp, 4
test eax, eax
je 0x48151c
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret