joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d4d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ac
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
lea ebx, [ebp - 0x254]
test edi, edi
je 0x44d519
push edi
push ebx
call fcn.00497c60
add esp, 8
push ebx
call fcn.00497c90
pop ecx
inc eax
add ebx, eax
push edi
push ebx
call fcn.00497c60
add esp, 8
push ebx
call fcn.00497c90
pop ecx
inc eax
add ebx, eax
mov eax, 0x426
call fcn.004125b4
push eax
push ebx
call fcn.00497c60
add esp, 8
push ebx
call fcn.00497c90
pop ecx
inc eax
add ebx, eax
push 0x4a7b48
push ebx
call fcn.00497c60
add esp, 8
push ebx
call fcn.00497c90
pop ecx
inc eax
add ebx, eax
mov byte [ebx], 0
push 0x4c
push 0
lea edx, [ebp - 0x54]
push edx
call fcn.00497ae0
mov dword [ebp - 0x54], 0x4c
mov ecx, dword [ebp - 4]
mov eax, dword [0x4b2108]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], eax
lea edx, [ebp - 0x254]
mov eax, esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x400
mov ecx, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x24], ecx
call fcn.0040bd0c
cmp esi, eax
jne 0x44d5b5
lea edx, [ebp - 0x654]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0x654]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x1080c
cmp byte [ebp + 8], 0
je 0x44d5cf
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetSaveFileNameA
mov ebx, eax
jmp 0x44d5da
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
jne 0x44d60b
call sub.COMDLG32.DLL_CommDlgExtendedError
cmp eax, 0x3002
jne 0x44d60b
mov byte [esi], 0
cmp byte [ebp + 8], 0
je 0x44d600
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetSaveFileNameA
mov ebx, eax
jmp 0x44d60b
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44d61c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff328
push ebx
push esi
push edi
lea edi, [ebp - 0x80c]
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [edi], 0
xor esi, esi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x88c]
mov eax, 0x4c5b84
mov edx, esi
call fcn.00457938
test al, al
je 0x44d6a8
push edi
call fcn.00497c90
pop ecx
push eax
lea eax, [ebp - 0x88c]
push eax
call fcn.00497c90
pop ecx
pop edx
add edx, eax
cmp edx, 0x3f6
ja 0x44d6a8
test esi, esi
je 0x44d687
push 0x4a7b4a
push edi
call fcn.00497b84
add esp, 8
push 0x4a7b4c
push edi
call fcn.00497b84
add esp, 8
lea ecx, [ebp - 0x88c]
push ecx
push edi
call fcn.00497b84
add esp, 8
inc ebx
jmp 0x44d63e
test ebx, ebx
je 0x44d6af
inc esi
jmp 0x44d63c
mov eax, 0x426
call fcn.004125b4
push eax
push edi
mov eax, 0x425
call fcn.004125b4
push eax
push edi
mov eax, 0x424
call fcn.004125b4
push eax
push str._s_t_s_t_s_t_s_.exe_t_s_t._t
lea edx, [ebp - 0x40c]
push edx
call fcn.0049abc0
add esp, 0x1c
cmp byte [ebp - 9], 0
je 0x44d728
mov eax, dword [ebp - 8]
call fcn.0040c0fc
mov ebx, eax
test ebx, ebx
je 0x44d728
inc ebx
push ebx
call fcn.00497c90
pop ecx
cmp eax, 0x14
jge 0x44d728
mov eax, 0x426
call fcn.004125b4
push eax
push ebx
push ebx
push str._s_t._s_t_s_t._t
lea edx, [ebp - 0x40c]
push edx
call fcn.0049abc0
add esp, 0x14
xor eax, eax
jmp 0x44d740
and edx, 0xff
cmp edx, 9
jne 0x44d73f
mov byte [ebp + eax - 0x40c], 0
inc eax
mov dl, byte [ebp + eax - 0x40c]
test dl, dl
jne 0x44d72c
push 0x4c
push 0
lea eax, [ebp - 0x8d8]
push eax
call fcn.00497ae0
mov dword [ebp - 0x8d8], 0x4c
mov ecx, dword [ebp - 4]
mov eax, dword [0x4b2108]
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8d0], eax
lea edx, [ebp - 0x40c]
add esp, 0xc
mov dword [ebp - 0x8cc], edx
mov eax, 0x48d
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x8bc], ecx
mov dword [ebp - 0x8b8], 0x400
cmp byte [ebp + 8], 0
jne 0x44d7ab
add eax, 0xfffffcb3
call fcn.004125b4
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 8]
call fcn.0040bd0c
cmp eax, dword [ebp - 8]
jne 0x44d7e0
lea edx, [ebp - 0xcd8]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0xcd8]
mov dword [ebp - 0x8ac], ecx
mov dword [ebp - 0x8a4], 0x1080c
mov dword [ebp - 0x89c], 0x4a7b79
lea eax, [ebp - 0x8d8]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
jne 0x44d826
call sub.COMDLG32.DLL_CommDlgExtendedError
cmp eax, 0x3002
jne 0x44d826
mov eax, dword [ebp - 8]
mov byte [eax], 0
lea edx, [ebp - 0x8d8]
push edx
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44d838
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffffab4
mov ebp, ecx
mov edi, edx
mov esi, eax
lea ebx, [esp + 0x500]
mov eax, 0x426
call fcn.004125b4
push eax
lea edx, [esp + 4]
push edx
call fcn.00497c60
add esp, 8
push 3
push 0x4a7b7d
lea ecx, [esp + 8]
push ecx
call fcn.00497c90
pop ecx
lea edx, [esp + 9]
add eax, edx
push eax
call fcn.00497a70
add esp, 0xc
mov word [esp + 0x100], 0
push 0x4c
push 0
push ebx
call fcn.00497ae0
add esp, 0xc
mov dword [ebx], 0x4c
mov dword [ebx + 4], esi
mov eax, dword [0x4b2108]
lea ecx, [esp + 0x100]
mov dword [ebx + 8], eax
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], pe_nt_image_headers32
mov dword [ebx + 0x44], 0x44cf34
mov dword [ebx + 0x34], 0x9036c
mov dword [ebx + 0x30], ebp
mov dword [ebx + 0x40], edi
call fcn.00410420
test eax, eax
je 0x44d98e
mov eax, 0x426
call fcn.004125b4
lea edx, [esp + 0x54c]
mov ecx, 0x1000000
call fcn.00410498
lea eax, [esp + 0x54c]
call fcn.0041074c
add eax, eax
lea edx, [esp + 0x54e]
add eax, edx
mov edx, 0x4a7b80
call fcn.00410760
lea eax, [esp + 0x54c]
call fcn.0041074c
mov word [esp + eax*2 + 0x54e], 0
lea edx, [esp + 0x74c]
mov ecx, 0x1000000
mov eax, dword [ebx + 0x30]
call fcn.00410498
lea eax, [esp + 0x54c]
lea edx, [esp + 0x74c]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x48], 0x4a7b84
lea ecx, [esp + 0x94c]
push ecx
push 0x800
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea eax, [esp + 0x94c]
mov dword [ebx + 0x2c], eax
push ebx
call sub.COMDLG32.DLL_GetOpenFileNameW
jmp 0x44d9bc
mov edx, esp
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x48], str.OKCANCELTPL
lea ecx, [esp + 0x114c]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x114c]
mov dword [ebx + 0x2c], eax
push ebx
call sub.COMDLG32.DLL_GetOpenFileNameA
add esp, 0x154c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4501c4
Capabilities:
Check mutex on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x4a7eac
push ebx
push esi
push edi
call fcn.00498090
cmp dword [0x4c77cc], 0
je 0x4501f1
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x45038c
push str.WinRAR_DragDrop
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov esi, eax
push 0
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x450238
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x5b9
call fcn.004125b4
push eax
call fcn.00486908
pop ecx
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x45038c
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne cl
and ecx, 1
mov byte [0x4c866a], cl
cmp byte [0x4c866a], 0
jne 0x450264
cmp dword [0x4c77c4], 0
jne 0x450264
xor ebx, ebx
jmp 0x450269
mov ebx, 1
push 8
call fcn.00496298
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x450291
mov word [ebp - 0x1c], 0x14
mov eax, dword [ebp - 4]
call fcn.0044e4b0
mov word [ebp - 0x1c], 8
mov edi, dword [ebp - 4]
jmp 0x450294
mov edi, dword [ebp - 4]
push 0x4f24
call fcn.00496298
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x4502c1
mov word [ebp - 0x1c], 0x2c
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0044da0c
mov word [ebp - 0x1c], 0x20
mov edx, dword [ebp - 8]
jmp 0x4502c4
mov edx, dword [ebp - 8]
mov dword [ebp - 0x30], edx
mov byte [0x4c8669], 0
mov byte [0x4c866c], 0
mov byte [0x4c8668], 1
mov byte [0x4c866b], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, 3
test bl, bl
jne 0x4502f3
add ecx, 0xfffffffe
push ecx
push edi
push dword [ebp - 0x30]
call sub.OLE32.DLL_DoDragDrop
mov ebx, eax
mov eax, dword [ebp - 0x30]
push eax
mov byte [0x4c8668], 0
mov edx, dword [eax]
call dword [edx + 8]
push edi
mov ecx, dword [edi]
call dword [ecx + 8]
cmp byte [0x4c866a], 0
je 0x45033e
cmp dword [0x4c77c4], 0
je 0x45033e
cmp ebx, 0x40100
jne 0x45033e
call fcn.00483850
mov eax, 0x4c4e38
call fcn.0045a124
push esi
call sub.KERNEL32.DLL_ReleaseMutex
push esi
call sub.KERNEL32.DLL_CloseHandle
cmp ebx, 0x40100
je 0x450382
cmp byte [0x4c866b], 0
jne 0x450382
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3f0
je 0x450382
mov eax, 0x53c
call fcn.004125b4
push eax
call fcn.00486908
pop ecx
mov eax, 0x4b1ad4
call fcn.0042d778
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451e4c
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff7c
mov ebx, eax
mov esi, esp
mov ebp, str.Formats.fmt
lea eax, [ebx + 4]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
mov dword [ebx + 0x404], edi
test edi, edi
jne 0x451e7b
xor eax, eax
jmp 0x452078
lea edx, [ebp + 0x29]
push edx
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x490], eax
lea ecx, [ebp + 0x31]
push ecx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x494], eax
lea eax, [ebp + 0x36]
push eax
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x498], eax
lea edx, [ebp + 0x3c]
push edx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x49c], eax
lea ecx, [ebp + 0x42]
push ecx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4a0], eax
lea eax, [ebp + 0x4e]
push eax
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4a4], eax
lea edx, [ebp + 0x5a]
push edx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4a8], eax
lea ecx, [ebp + 0x62]
push ecx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4ac], eax
cmp dword [ebx + 0x490], 0
je 0x451f39
cmp dword [ebx + 0x494], 0
jne 0x451f40
cmp dword [ebx + 0x498], 0
jne 0x451f40
xor eax, eax
jmp 0x452078
push 0x84
push 0
push esi
call fcn.00497ae0
add esp, 0xc
mov dword [esi], 0x84
mov dword [esi + 4], 0x45063c
mov dword [esi + 8], 0x45077c
mov dword [esi + 0xc], 0x45078f
mov dword [esi + 0x10], 0x4507a4
mov dword [esi + 0x14], 0x450803
mov dword [esi + 0x18], 0x4509c8
mov dword [esi + 0x1c], 0x4509dc
mov dword [esi + 0x20], 0x4509e7
mov dword [esi + 0x24], 0x450a9b
mov dword [esi + 0x28], 0x450b3f
mov dword [esi + 0x2c], 0x450c73
mov dword [esi + 0x30], 0x451006
mov dword [esi + 0x34], 0x451015
mov dword [esi + 0x38], 0x45106c
mov dword [esi + 0x3c], fcn.0045081a
mov dword [esi + 0x40], 0x4510fe
mov dword [esi + 0x44], 0x45111a
mov dword [esi + 0x48], 0x451148
mov dword [esi + 0x4c], 0x45115d
mov dword [esi + 0x50], 0x451172
mov dword [esi + 0x54], 0x451187
mov dword [esi + 0x58], 0x45119c
mov dword [esi + 0x5c], 0x4511fd
mov dword [esi + 0x60], 0x45125c
mov dword [esi + 0x64], 0x4513a1
mov dword [esi + 0x68], 0x450be3
push 0x88
push 0
lea edx, [ebx + 0x408]
push edx
call fcn.00497ae0
add esp, 0xc
lea ecx, [ebx + 0x408]
mov dword [ebx + 0x408], 0x88
push ecx
push esi
call dword [ebx + 0x490]
cmp dword [ebx + 0x488], 0
je 0x452076
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
mov dword [ebx + 0x404], eax
lea eax, [ebx + 4]
call fcn.0040bd0c
push eax
mov eax, 0x42e
call fcn.004125b4
push eax
call fcn.00486908
add esp, 8
xor eax, eax
jmp 0x452078
mov al, 1
add esp, 0x84
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4533f0
Capabilities:
Check if file exists
Get common file path
Get disk information
Get file attributes
Query environment variable

Disassembly:
push ebx
mov ebx, ecx
add esp, 0xfffff800
mov edx, 0x4a8176
mov byte [ebx], 0
mov eax, 0x4a8170
push 0x4a809d
push 0x400
lea ecx, [esp + 8]
call fcn.00461194
cmp byte [esp], 0
jne 0x453437
cmp byte [0x4bcc40], 0
je 0x4534d8
push esp
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push 0x400
lea eax, [esp + 0x404]
push eax
lea edx, [esp + 8]
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
jle 0x453473
cmp eax, 0x400
jge 0x453473
push 0x400
lea ecx, [esp + 0x404]
push ecx
lea eax, [esp + 8]
push eax
call fcn.00497e40
add esp, 0xc
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x453489
push esp
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
mov edx, 0x4a8181
mov eax, 0x4a8170
mov ecx, 1
call fcn.0046136c
test eax, eax
je 0x4534c7
cmp byte [0x4bcc40], 0
jne 0x4534c7
push 0
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x4534bb
cmp eax, 5
jne 0x4534d1
push esp
push ebx
call fcn.00497c60
add esp, 8
jmp 0x4534d1
push esp
push ebx
call fcn.00497c60
add esp, 8
mov eax, ebx
call fcn.0040c210
add esp, 0x800
pop ebx
ret
Function at 0x45927c
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
mov ebx, eax
push eax
add esp, 0xfffffe10
mov eax, dword [ebx + 0x520]
test eax, eax
je 0x45946f
mov edi, dword [ebx + eax*4 + 0x49c]
xor eax, eax
mov dword [esp], eax
test edi, edi
je 0x45946f
push esp
push 0x20
push dword [ebx]
push edi
mov edx, dword [edi]
call dword [edx + 0x10]
test eax, eax
jne 0x45946f
cmp dword [esp], 0
je 0x45946f
xor ecx, ecx
xor ebp, ebp
mov dword [esp + 4], ecx
jmp 0x459448
mov dword [esp + 0xc], 0x10000000
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 8]
push edx
push 1
push edi
mov ecx, dword [edi]
call dword [ecx + 0x24]
test byte [esp + 0xf], 0x10
je 0x459314
lea eax, [esp + 0x10]
push eax
push 0
xor ecx, ecx
mov edx, dword [esp + 0xc]
mov eax, edi
call fcn.0046004c
test eax, eax
jne 0x459329
push dword [esp + 4]
mov edx, dword [0x4cb52c]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
jmp 0x459448
mov eax, dword [ebx + 0x520]
mov edx, dword [esp + 4]
mov eax, dword [ebx + eax*4 + 0x41c]
call fcn.0045ffbc
mov esi, eax
push 0x4409
push 0x160
lea eax, [esp + 0x418]
push eax
push 0
push esi
call sub.SHELL32.DLL_SHGetFileInfoA
push esi
mov edx, dword [0x4cb52c]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
mov dword [esp + 0x570], 7
mov dword [esp + 0x574], ebp
xor edx, edx
mov eax, dword [esp + 0x414]
lea ecx, [esp + 0x10]
mov dword [esp + 0x58c], eax
mov dword [esp + 0x578], edx
mov dword [esp + 0x584], ecx
push 0xc30
push 0
lea eax, [esp + 0x5a0]
push eax
call fcn.00497ae0
add esp, 0xc
mov edx, dword [esp + 4]
mov dword [esp + 0x11c0], edx
mov dword [esp + 0x11b4], 0x20
push dword [esp + 0x584]
lea ecx, [esp + 0x59c]
push ecx
call fcn.00497c60
add esp, 8
mov eax, 0x4c9804
mov dword [esp + 0x11a8], 0x10
lea edx, [esp + 0x598]
call fcn.004607fc
mov dword [esp + 0x590], eax
lea ecx, [esp + 0x570]
push ecx
push 0
push 0x1007
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov dword [esp + 0x11d0], 2
lea edx, [esp + 0x520]
lea ecx, [esp + 0x11c8]
mov dword [esp + 0x11dc], edx
push ecx
push eax
push 0x102e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
inc ebp
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 1
mov edx, dword [esp + 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 0xc]
test eax, eax
je 0x4592db
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
add esp, 0x11f0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45a5a8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
mov esi, str.name
mov ebx, edx
push eax
add esp, 0xfffff9d0
lea edx, [esi + 4]
mov edi, ecx
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
push edx
mov edx, ebx
push 0x100
mov eax, 0x80000000
call fcn.004611b0
cmp byte [esp + 4], 0
je 0x45a5f3
lea ecx, [esp + 4]
push ecx
push edi
call fcn.00497c60
add esp, 8
push ebx
lea eax, [esi + 0x97]
push eax
lea edx, [esp + 0x10c]
push edx
call fcn.0049abc0
add esp, 0xc
lea ecx, [esp + 0x230]
push ecx
lea eax, [esi + 4]
push eax
push 0x800
lea ecx, [esi + 4]
lea edx, [esp + 0x110]
mov eax, 0x80000000
call fcn.004611b0
test al, al
jne 0x45a6f2
push ebx
lea edx, [esi + 0xa6]
push edx
lea ecx, [esp + 0x10c]
push ecx
call fcn.0049abc0
add esp, 0xc
lea eax, [esp + 0xa30]
push eax
lea edx, [esi + 4]
push edx
push 0x400
lea ecx, [esi + 4]
lea edx, [esp + 0x110]
mov eax, 0x80000000
call fcn.004611b0
test al, al
jne 0x45a680
xor eax, eax
jmp 0x45a773
xor edx, edx
mov dl, byte [esp + 0xa30]
cmp edx, 0x22
jne 0x45a697
lea ecx, [esp + 0xa31]
jmp 0x45a69e
lea ecx, [esp + 0xa30]
push ecx
lea eax, [esp + 0x234]
push eax
call fcn.00497c60
add esp, 8
push 0x22
lea edx, [esp + 0x234]
push edx
call fcn.00497d2d
add esp, 8
test eax, eax
je 0x45a6c8
mov byte [eax], 0
lea eax, [esi + 0xbc]
push eax
lea edx, [esp + 0x234]
push edx
call fcn.00497d51
add esp, 8
test eax, eax
je 0x45a6e6
mov byte [eax], 0
lea eax, [esp + 0x230]
call fcn.0040f250
lea edx, [esi + 0xbc]
push edx
lea ecx, [esp + 0x234]
push ecx
call fcn.00497c14
add esp, 8
test eax, eax
jne 0x45a711
xor eax, eax
jmp 0x45a773
xor esi, esi
push 0x800
lea eax, [esp + 0xe34]
push eax
lea edx, [esp + 0x238]
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push 0x2c
lea ecx, [esp + 0xe34]
push ecx
call fcn.00497d45
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45a754
lea esi, [ebx + 1]
push esi
call fcn.0049c4f0
pop ecx
mov esi, eax
mov byte [ebx], 0
xor eax, eax
mov dword [esp], eax
push 1
lea edx, [esp + 4]
push edx
push 0
push esi
lea ecx, [esp + 0xe40]
push ecx
call sub.SHELL32.DLL_ExtractIconExA
mov eax, dword [esp]
add esp, 0x1630
pop edi
pop esi
pop ebx
ret
Function at 0x45bf1c
Capabilities:
Copy file

Disassembly:
push ebx
add esp, 0xfffff004
push eax
add esp, 0xfffffc00
mov ebx, eax
mov edx, esp
mov eax, 0x4c5b84
xor ecx, ecx
call fcn.00457568
mov eax, esp
call fcn.0040bd0c
mov edx, 0x4a8fbc
mov ecx, 6
call fcn.0040f22c
test eax, eax
jne 0x45c07f
mov edx, 0x4a8fc3
mov eax, ebx
call fcn.0045947c
test eax, eax
jne 0x45bf7c
mov edx, str.rarreg.txt
mov eax, ebx
call fcn.0045947c
test eax, eax
je 0x45c07f
lea edx, [esp + 0x800]
lea eax, [esp + 0x400]
call fcn.0044c46c
test al, al
je 0x45c07f
push 0x400
lea ecx, [esp + 0x1004]
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x4a8fc3
lea eax, [esp + 0x1004]
call fcn.0040bd0c
push eax
call fcn.00497c60
add esp, 8
push 0
lea edx, [esp + 0x1004]
push edx
lea ecx, [esp + 0x408]
push ecx
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
jne 0x45c024
lea eax, [esp + 0x1000]
call fcn.0046442c
lea eax, [esp + 0x1000]
call fcn.0040c210
push 0x4a8fc3
lea edx, [esp + 0x1004]
push edx
call fcn.00497b84
add esp, 8
push 0
lea ecx, [esp + 0x1004]
push ecx
lea eax, [esp + 0x408]
push eax
call sub.KERNEL32.DLL_CopyFileA
lea edx, [esp + 0x400]
push edx
call fcn.0049a824
pop ecx
push dword [0x4c4e24]
call sub.USER32.DLL_SetForegroundWindow
mov al, 1
call fcn.0040e96c
mov byte [0x4b20e4], al
mov eax, 0x4c4e38
call fcn.0045a124
cmp byte [0x4b20e4], 0
je 0x45c07f
push 0x30
mov eax, 0x368
call fcn.004125b4
push eax
mov eax, 0x367
call fcn.004125b4
push eax
push dword [0x4c4e24]
call sub.USER32.DLL_MessageBoxA
add esp, 0x1400
pop ebx
ret
Function at 0x45c088
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffff200
mov ebp, ecx
mov ebx, edx
mov edi, eax
lea edx, [esp + 0xc00]
mov eax, ebx
call fcn.0040abb0
lea edx, [esp + 0x1000]
mov eax, ebp
call fcn.0040abf8
push ebx
lea ecx, [esp + 4]
push ecx
call fcn.00497c60
add esp, 8
mov edx, 0x400
lea eax, [esp + 0x800]
call fcn.00463d8c
lea ecx, [esp + 0x400]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x800]
push eax
call fcn.00497c90
pop ecx
mov ecx, eax
lea eax, [esp + 0x800]
mov edx, ebx
call fcn.0040f22c
test eax, eax
je 0x45c144
push 0x5c
lea ecx, [esp + 4]
push ecx
call fcn.00497d45
add esp, 8
mov esi, eax
test eax, eax
je 0x45c144
mov edx, esp
cmp esi, edx
jbe 0x45c144
mov al, byte [esi - 1]
xor edx, edx
mov dl, al
cmp edx, 0x3a
je 0x45c144
cmp edx, 0x5c
je 0x45c144
mov byte [esi], 0
push esp
call fcn.004995f4
pop ecx
push 1
mov ecx, ebp
mov edx, ebx
mov eax, edi
call fcn.0045b9fc
cmp eax, 0xffffffff
jne 0x45c16d
push 1
lea ecx, [esp + 0x1004]
lea edx, [esp + 0xc04]
mov eax, edi
call fcn.0045b9fc
cmp eax, 1
je 0x45c1eb
cmp eax, 2
je 0x45c1d9
inc eax
jne 0x45c198
push ebx
mov eax, 0x1f5
call fcn.004125b4
push eax
lea edx, [esp + 0x1808]
push edx
call fcn.0049abc0
add esp, 0xc
jmp 0x45c1b9
mov eax, 0x1fc
call fcn.004125b4
push eax
push ebx
push str._s_n_s
lea edx, [esp + 0x180c]
push edx
call fcn.0049abc0
add esp, 0x10
push 0x10
mov eax, 0x66
call fcn.004125b4
push eax
lea edx, [esp + 0x1808]
push edx
push dword [0x4c4e24]
call sub.USER32.DLL_MessageBoxA
lea ecx, [esp + 0x400]
push ecx
call fcn.004995f4
pop ecx
xor eax, eax
jmp 0x45c1ed
mov al, 1
add esp, 0x1e00
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45c1f8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffff7f8
mov ebp, ecx
mov edi, edx
mov esi, eax
push 0x4a8e00
push edi
call fcn.00497c14
add esp, 8
test eax, eax
sete bl
and ebx, 1
cmp byte [esi + 0x41d], 0
je 0x45c279
xor eax, eax
test bl, bl
mov dword [esp], eax
je 0x45c23e
mov dword [esp], 1
push 0x4a8fba
push edi
call fcn.00497c14
add esp, 8
test eax, eax
jne 0x45c259
mov edx, dword [esi + 0x520]
mov dword [esp], edx
cmp dword [esp], 0
je 0x45c279
xor ecx, ecx
mov edx, dword [esp]
mov eax, esi
call fcn.0045d688
xor edx, edx
mov eax, esi
call fcn.00458834
jmp 0x45c464
mov eax, esi
call fcn.0045e65c
cmp dword [0x4c77c4], 0
je 0x45c36b
mov edx, str.FlatView
mov eax, 0x4a8e03
xor ecx, ecx
call fcn.0046136c
test eax, eax
je 0x45c2aa
test bl, bl
je 0x45c464
lea edx, [esp + 8]
mov eax, 0x4c5b84
xor ecx, ecx
call fcn.0045753c
push 0x4a8fba
push edi
call fcn.00497c14
add esp, 8
test eax, eax
je 0x45c2fd
mov eax, 0x4c5b84
mov ecx, ebp
mov edx, edi
call fcn.004573a4
test eax, eax
je 0x45c2fd
test bl, bl
je 0x45c2ef
lea eax, [esp + 8]
call fcn.0040bd0c
mov edx, eax
jmp 0x45c2f1
xor edx, edx
mov eax, esi
call fcn.00459614
jmp 0x45c464
lea edx, [esp + 0x408]
mov eax, 0x4c5b84
xor ecx, ecx
call fcn.00457568
lea eax, [esp + 0x408]
push eax
lea edx, [esp + 0x80c]
push edx
call fcn.00497c60
add esp, 8
lea eax, [esp + 0x808]
call fcn.0040c2e0
lea eax, [esp + 0x808]
xor edx, edx
call fcn.00463e3c
mov eax, esi
call fcn.0045e180
test al, al
je 0x45c464
lea eax, [esp + 0x408]
call fcn.0040bd0c
mov edx, eax
mov eax, esi
call fcn.00458834
jmp 0x45c464
lea edx, [esp + 0xc08]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x45c42e
lea ecx, [esp + 0xc08]
push ecx
lea eax, [esp + 0x100c]
push eax
call fcn.00497c60
add esp, 8
lea edx, [esp + 0x1408]
lea eax, [esp + 0xc08]
call fcn.0040c938
lea eax, [esp + 0x1008]
call fcn.0040c210
lea eax, [esp + 0x1408]
call fcn.0040c210
lea edx, [esp + 0x1408]
lea eax, [esp + 0x1008]
call fcn.0040f208
test eax, eax
jne 0x45c42e
cmp dword [esi + 0x520], 0
jle 0x45c3f1
mov byte [esi + 0x41d], 1
jmp 0x45c423
xor edx, edx
mov dword [esp + 4], edx
lea ecx, [esp + 4]
push ecx
push 0x11
push dword [esi]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, 0x4c4e38
mov edx, dword [esp + 4]
call fcn.0045e5bc
push dword [esp + 4]
mov ecx, dword [0x4cb52c]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
xor edx, edx
mov eax, esi
call fcn.00458834
jmp 0x45c464
mov edx, ebp
mov eax, edi
call fcn.00463e3c
test al, al
jne 0x45c447
mov eax, 0x4a8fba
xor edx, edx
call fcn.00463e3c
test bl, bl
je 0x45c45b
lea eax, [esp + 0xc08]
call fcn.0040bd0c
mov edx, eax
jmp 0x45c45d
xor edx, edx
mov eax, esi
call fcn.00458834
add esp, 0x1808
pop ebp
pop edi
pop esi
pop ebx
ret