joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43dc60
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43dc93
push esi
call fcn.00440d50
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43dc8c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43dd19
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43dd02
mov eax, dword [esi + 8]
test eax, eax
je 0x43dcb7
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43dcfe
cmp eax, 2
je 0x43dd02
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43dcaa
cmp eax, 3
je 0x43dcdd
cmp eax, 1
jne 0x43dcaa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43dcaa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43dcaa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043dd40
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43dd28
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043dd40
add esp, 4
pop esi
ret

Function at 0x45c589
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x45c5c1
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045a63d
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045a615
jmp 0x45c5cd
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x45dc77
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x45dcb9
call fcn.00463730
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x45dcb9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x45dcb0
xor eax, eax
jmp 0x45dcc1
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0045dcc7
pop edi
pop esi
pop ebx
ret 4

Function at 0x463c60
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x463c8e
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x463cac
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00463bc6
jmp 0x463cac
mov eax, dword [esi + 0x14]
test eax, eax
je 0x463cac
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00463bc6
test edi, edi
mov eax, edi
jne 0x463c96
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4014b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4014cb
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401502
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
add eax, esi
and ecx, 0xf
jbe 0x4014fe
jmp 0x4014f0
cmp esi, eax
jae 0x401502
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4014f0
cmp esi, eax
jb 0x401509
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x4015a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x493480], 0
jne 0x401690
lea eax, [ebp - 0x250]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push reloc.WS2_32.dll_accept
mov dword [0x493480], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401690
lea ecx, [ebp - 0x258]
push ecx
mov ecx, dword [ebp - 0x250]
lea edx, [ebp - 0x24c]
push edx
lea eax, [ebp - 0x254]
push eax
push 0
push 0
push ecx
mov dword [ebp - 0x258], 0x104
mov dword [ebp - 0x254], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401683
push esi
push edi
mov ecx, 0xb
mov esi, 0x471a10
lea edi, [ebp - 0x30]
lea edx, [ebp - 0x24c]
rep movsd dword es:[edi], dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push edx
call edi
mov esi, eax
lea eax, [ebp - 0x30]
push eax
call edi
cmp esi, eax
jl 0x401681
lea ecx, [ebp - 0x30]
push ecx
mov edx, ecx
push edx
call edi
sub esi, eax
lea eax, [ebp + esi*2 - 0x24c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x401681
mov dword [0x49347c], 1
pop edi
pop esi
mov ecx, dword [ebp - 0x250]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [0x49347c]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret

Function at 0x402120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.0042e07d
movzx ebx, word [ebp + 8]
mov edi, dword [eax + 0xc]
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40215b
push 2
push ebx
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40215b
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x402154
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x402154
push eax
call fcn.00401560
movzx eax, ax
add esp, 4
push ebx
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp word [ebp + 8], 0x10
jne 0x402154
push 0
push esi
push edi
call fcn.0042397a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403c80
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46a1f3
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x4914f4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.0042ef4b
xor eax, eax
lea ebx, [esi + 0x10]
mov dword [esi], vtable.BCMenuMemDC.0
mov dword [ebp - 4], eax
mov dword [ebx + 4], eax
mov dword [ebx], vtable.CBitmap.0
mov eax, dword [ebp + 0xc]
push eax
lea edi, [esi + 0x20]
push edi
mov byte [ebp - 4], 1
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [esi + 0x1c], eax
mov dword [esi + 0x18], 0
cmp dword [eax + 0xc], ecx
sete cl
mov dword [esi + 0x30], ecx
test ecx, ecx
je 0x403d53
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push eax
mov ecx, esi
call fcn.0042f432
mov eax, dword [edi + 0xc]
sub eax, dword [edi + 4]
mov ecx, dword [edi + 8]
sub ecx, dword [edi]
push eax
push ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
mov ecx, ebx
call fcn.0042f704
test ebx, ebx
je 0x403d32
mov ebx, dword [ebx + 4]
mov eax, dword [esi + 4]
push ebx
push eax
call fcn.0042f793
mov ecx, dword [esi + 0x24]
mov edx, dword [edi]
push ecx
mov dword [esi + 0x18], eax
push edx
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call fcn.0042f067
jmp 0x403d65
mov ecx, dword [eax + 0xc]
mov dword [esi + 0xc], ecx
mov edx, dword [eax + 4]
mov dword [esi + 4], edx
mov eax, dword [eax + 8]
mov dword [esi + 8], eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4116f0
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b0fb
mov eax, dword fs:[0]
push eax
mov eax, 0x16a4
call fcn.004481c0
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x16b0]
push eax
mov esi, ecx
mov dword [ebp - 0x16b0], 8
mov dword [ebp - 0x16ac], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call fcn.00433cd0
call fcn.0045c530
test eax, eax
setne cl
push 0
mov byte [0x496c68], cl
call fcn.0043540d
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str._uninstall
push eax
xor edi, edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x411783
mov edi, 1
push 0
call fcn.0043540d
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add esp, 4
push 0x100
lea edx, [ebp - 0x610]
push edx
push 0
call ebx
mov eax, dword [section..QQSKINT]
test edi, edi
je 0x4117d4
test eax, eax
je 0x4118f2
push 0
push 0
push 0x4f7
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4118f2
test eax, eax
je 0x4117fd
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 6
push eax
call esi
mov eax, dword [section..QQSKINT]
push 9
push eax
call esi
mov ecx, dword [section..QQSKINT]
push 1
push ecx
call esi
jmp 0x4118f2
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
call fcn.0041b5f0
mov edx, dword [0x4937ac]
cmp dword [edx - 0xc], 0
jne 0x411829
push 0
push 0
push 0x472c88
call fcn.00431143
jmp 0x4118f2
call fcn.0045d6f0
test eax, eax
je 0x41188c
call fcn.0045bae0
test eax, eax
jne 0x41188c
push 0x100
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, dword [0x4937ac]
push 3
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.0044810c
add esp, 0xc
test eax, eax
jne 0x41188c
push 0x100
lea eax, [ebp - 0x210]
push eax
push 0
call ebx
lea ecx, [ebp - 0x210]
push 1
push ecx
call fcn.0045cfa0
add esp, 8
jmp 0x4118f2
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
push 1
mov dword [0x4934cc], eax
call edi
movzx edx, byte [0x496c68]
shl edx, 9
add edx, 0x472770
push edx
mov ecx, esi
mov dword [0x4934c8], eax
call fcn.004348c0
push 0
lea ecx, [ebp - 0x16a8]
call fcn.00414d40
lea eax, [ebp - 0x16a8]
mov ecx, eax
mov dword [ebp - 4], 0
mov dword [esi + 0x20], eax
call fcn.00432982
lea ecx, [ebp - 0x16a8]
mov dword [ebp - 4], 0xffffffff
call fcn.004113b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret

Function at 0x411c70
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00463060
Function at 0x411d20
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x496e90], 0
jne 0x411e12
push esi
push 0
push str.noad.ini
call fcn.0045ec40
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 8
push eax
call esi
test eax, eax
jne 0x411e11
push eax
push str.noad.ini
call fcn.0045b8f0
add esp, 8
push eax
call esi
test eax, eax
jne 0x411e11
push 0x496ea0
call fcn.0045f810
add esp, 4
test eax, eax
jne 0x411e11
cmp dword [0x4984bc], eax
je 0x411da5
push 0x473a60
lea eax, [ebp - 0x204]
push eax
jmp 0x411db1
push 0x473960
lea ecx, [ebp - 0x204]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
push 0x473924
lea edx, [ebp - 0x204]
push edx
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x411e0c
push 0x496ea0
call fcn.00463fb0
call fcn.004649a0
push 0
push str.noad.ini
call fcn.0045ec40
push eax
lea eax, [ebp - 0x204]
push eax
call fcn.00465790
add esp, 0x14
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
call fcn.00463dd0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
Function at 0x4140c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b2fb
mov eax, dword fs:[0]
push eax
mov eax, 0x1028
call fcn.004481c0
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x1034], eax
push 0x800
mov dword [ebp - 0x1030], eax
mov dword [ebp - 0x1024], eax
mov dword [ebp - 0x102c], eax
mov dword [ebp - 0x1028], eax
mov dword [ebp - 0x1020], eax
mov dword [ebp - 0x101c], eax
mov word [ebp - 0x1018], ax
mov dword [ebp - 0x1034], eax
lea ecx, [ebp - 0x810]
mov eax, 0x14
push 0
push ecx
mov word [ebp - 0x1024], ax
mov dword [ebp - 0x1030], 3
call fcn.00446290
push 0x800
lea edx, [ebp - 0x1010]
push 0
push edx
call fcn.00446290
add esp, 0x18
push esi
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x1034]
lea ecx, [ebp - 0x810]
lea edx, [ebp - 0x1010]
push eax
mov dword [ebp - 0x102c], ecx
mov dword [ebp - 0x1028], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov esi, eax
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x4141ba
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x1014], eax
xor ecx, ecx
test esi, esi
sete cl
lea edx, [ebp - 0x810]
lea eax, [ebp - 0x1014]
mov dword [ebp - 4], 0
mov esi, ecx
push esi
push edx
push str.deletedir:_success:_d
push eax
call fcn.00403af0
mov eax, dword [ebp - 0x1014]
add eax, 0xfffffff0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x414221
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
Function at 0x414ee0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b4f6
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x471d88
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
lea ecx, [ebp - 0x210]
push ecx
push 0x4742d4
push SysReAllocString
call fcn.0045bc30
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x415050
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x414f6c
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 0
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x414f9f
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x218], eax
push 0x471d80
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 1
call fcn.0045f150
add esp, 0x10
push 0x4742d0
push 0x4742d0
lea ecx, [ebp - 0x214]
call fcn.00414470
mov ecx, eax
call fcn.00413b30
lea ecx, [ebp - 0x214]
push ecx
mov ecx, esi
call fcn.00403a00
mov eax, dword [ebp - 0x218]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415027
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x214]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415050
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
jne 0x4150ae
push 0x22
push str.C:Program_FilesHaoZipHaoZip.exe
mov ecx, esi
call fcn.00403400
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x4150ae
push 0x28
push str.C:Program_Files__x86_HaoZipHaoZip.exe
mov ecx, esi
call fcn.00403400
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x4150ae
push str.d:Program_FilesHaoZipHaoZip.exe
mov ecx, esi
call fcn.00405850
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x4150ae
push str.d:Program_Files__x86_HaoZipHaoZip.exe
mov ecx, esi
call fcn.00405850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
Function at 0x4150d0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b4f6
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x471d88
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
lea ecx, [ebp - 0x210]
push ecx
push str.360zip_shellopencommand
push SysReAllocString
call fcn.0045bc30
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x415240
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41515c
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 0
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41518f
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x218], eax
push 0x471d80
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 1
call fcn.0045f150
add esp, 0x10
push 0x4742d0
push 0x4742d0
lea ecx, [ebp - 0x214]
call fcn.00414470
mov ecx, eax
call fcn.00413b30
lea ecx, [ebp - 0x214]
push ecx
mov ecx, esi
call fcn.00403a00
mov eax, dword [ebp - 0x218]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415217
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x214]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415240
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
jne 0x41529e
push 0x26
push str.C:Program_Files360360zip360zip.exe
mov ecx, esi
call fcn.00403400
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x41529e
push 0x2c
push str.C:Program_Files__x86_360360zip360zip.exe
mov ecx, esi
call fcn.00403400
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x41529e
push str.d:Program_Files360360zip360zip.exe
mov ecx, esi
call fcn.00405850
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x41529e
push str.d:Program_Files__x86_360360zip360zip.exe
mov ecx, esi
call fcn.00405850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret
Function at 0x4152c0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x46b4f6
mov eax, dword fs:[0]
push eax
sub esp, 0x20c
mov eax, dword [0x4914f4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x471d88
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 1
lea ecx, [ebp - 0x210]
push ecx
push str.WinRaR_shellopencommand
push SysReAllocString
call fcn.0045bc30
add esp, 0x10
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x415430
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41534c
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x214], eax
mov dword [ebp - 4], 0
call fcn.0042fa4e
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x41537f
push 0x80004005
call fcn.00401350
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x218], eax
push 0x471d80
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x210]
push eax
mov byte [ebp - 4], 1
call fcn.0045f150
add esp, 0x10
push 0x4742d0
push 0x4742d0
lea ecx, [ebp - 0x214]
call fcn.00414470
mov ecx, eax
call fcn.00413b30
lea ecx, [ebp - 0x214]
push ecx
mov ecx, esi
call fcn.00403a00
mov eax, dword [ebp - 0x218]
add eax, 0xfffffff0
mov byte [ebp - 4], 0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x415407
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [ebp - 0x214]
add eax, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x415430
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esi]
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call edi
test eax, eax
jne 0x41548e
push 0x22
push str.C:Program_FilesWinRARWinRAR.exe
mov ecx, esi
call fcn.00403400
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x41548e
push 0x28
push str.C:Program_Files__x86_WinRARWinRAR.exe
mov ecx, esi
call fcn.00403400
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x41548e
push str.d:Program_FilesWinRARWinRAR.exe
mov ecx, esi
call fcn.00405850
mov eax, dword [esi]
push eax
call edi
test eax, eax
jne 0x41548e
push str.d:Program_Files__x86_WinRARWinRAR.exe
mov ecx, esi
call fcn.00405850
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044665f
mov esp, ebp
pop ebp
ret