joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469d80
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x70
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
je 0x469d9b
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 4], 0
push 1
push str.ViewSmall
push str.GeneralToolbar
call fcn.00456960
test eax, eax
je 0x469f53
mov eax, dword [0x4c935c]
mov ecx, dword [0x4dc1c8]
push ebx
push ebp
push edi
push 0
push eax
push 0xd
push ecx
push 0
push 0
push 0
push 0
push 0x56000944
push 0
push str.ToolbarWindow32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x14
push 0x41e
push eax
mov dword [esi + 4], eax
call ebp
call fcn.0047ee00
mov ebx, 0x10
mov byte [esp + 0x13], al
mov dword [esp + 0x14], ebx
test al, al
je 0x469e22
push ebx
call fcn.0047ed60
push 0x10
mov ebx, eax
call fcn.0047ed60
mov dword [esp + 0x14], eax
movzx edi, word [esp + 0x14]
mov eax, dword [esi + 4]
movzx edx, bx
shl edi, 0x10
or edi, edx
push edi
push 0
push 0x41f
push eax
call ebp
mov ecx, dword [esi + 4]
push edi
push 0
push 0x420
push ecx
call ebp
push 0
push 0xf
push str.FolderUp.bmp
mov ecx, 0x4e2960
call fcn.00467730
mov edi, eax
test edi, edi
jne 0x469e67
mov edi, dword [esi + 0x1c]
cmp byte [esp + 0x13], 0
je 0x469e87
mov edx, dword [esp + 0x14]
push edx
push ebx
push edi
call fcn.0047e1f0
mov edi, eax
push edi
mov ecx, 0x4e2960
call fcn.00467520
mov ecx, dword [esi + 4]
lea eax, [esp + 0x18]
push eax
push 1
push 0x413
push ecx
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], edi
call ebp
mov edx, dword [esi + 4]
push 0x4bfa20
push 1
push 0x414
push edx
call ebp
lea eax, [esp + 0x30]
push eax
push 2
mov ecx, esi
call fcn.00468fe0
mov eax, dword [esp + 0x38]
mov dword [esp + 0x30], 0x38
mov dword [esp + 0x34], 0x173
test eax, eax
jne 0x469ee2
mov eax, 1
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
or eax, 4
push 0x12
mov dword [esp + 0x3c], eax
mov dword [esp + 0x54], ecx
mov dword [esp + 0x68], 2
mov dword [esp + 0x58], 0
call edi
push 0xf
mov dword [esp + 0x40], eax
call edi
cmp dword [esp + 0x5c], 0
mov dword [esp + 0x40], eax
jne 0x469f25
mov dword [esp + 0x5c], 0x28
mov eax, dword [0x4dfed0]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [esi + 8]
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x30]
push edx
push 0xffffffffffffffff
push 0x401
push eax
mov dword [esp + 0x68], ecx
call ebp
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x70
ret
Function at 0x46ced0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov ecx, dword [0x4db5d8]
mov eax, dword [esp + 4]
mov edx, ecx
shr ecx, 8
xor edx, eax
and edx, 0xff
xor ecx, dword [edx*4 + 0x4c6a28]
mov edx, dword [0x4db5e0]
mov dword [0x4db5d8], ecx
movzx ecx, cl
add ecx, dword [0x4db5dc]
imul ecx, ecx, 0x8088405
inc ecx
mov dword [0x4db5dc], ecx
shr ecx, 0x18
xor ecx, edx
and ecx, 0xff
shr edx, 8
xor edx, dword [ecx*4 + 0x4c6a28]
mov dword [0x4db5e0], edx
ret 4

Function at 0x46cf30
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov eax, 0x12345678
mov edx, 0x23456789
mov esi, 0x34567890
mov dword [0x4db5d8], eax
mov dword [0x4db5dc], edx
mov dword [0x4db5e0], esi
mov cl, byte [edi]
test cl, cl
je 0x46cfb0
lea esp, [esp]
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
shr eax, 8
xor eax, dword [ecx*4 + 0x4c6a28]
inc edi
movzx ecx, al
add ecx, edx
imul ecx, ecx, 0x8088405
inc ecx
mov edx, ecx
shr ecx, 0x18
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x4c6a28]
mov dword [0x4db5d8], eax
mov dword [0x4db5dc], edx
mov dword [0x4db5e0], esi
mov cl, byte [edi]
test cl, cl
jne 0x46cf60
pop edi
pop esi
ret 4
Function at 0x4707f0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x408
push ebx
push ebp
push esi
mov esi, dword [esp + 0x418]
push edi
mov ebx, ecx
movzx edi, word [ebx]
sub edi, dword [esi + 0x654]
mov dword [esp + 0x14], ebx
push edi
push esi
call fcn.004705e0
mov dl, byte [esi + 0xa6c]
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 4]
sub eax, 6
lea ebp, [esp + 0x18]
xor ecx, ecx
lea ecx, [ecx]
movzx ebx, byte [eax + 6]
add eax, 6
cmp byte [ebx + esi + 0x66c], dl
je 0x470830
movzx ebx, byte [eax + 1]
mov dword [ebp], eax
add ecx, ebx
add ebp, 4
sub edi, 1
jne 0x470830
add dword [esi + 0x4a84], ecx
mov eax, dword [esi + 0x4a78]
xor edx, edx
div dword [esi + 0x4a84]
xor edx, edx
mov edi, eax
mov eax, dword [esi + 0x4a74]
sub eax, dword [esi + 0x4a70]
mov dword [esi + 0x4a78], edi
div edi
mov ebx, dword [esi + 0x4a84]
cmp eax, ebx
jl 0x470896
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x408
ret 4
cmp eax, ecx
mov edx, dword [esp + 0x18]
lea edi, [esp + 0x18]
jge 0x470913
movzx ecx, byte [edx + 1]
cmp ecx, eax
jg 0x4708c0
lea ebx, [ebx]
mov edx, dword [edi + 4]
movzx ebx, byte [edx + 1]
add edi, 4
add ecx, ebx
cmp ecx, eax
jle 0x4708b0
mov edi, dword [esp + 0x10]
mov dword [esi + 0x4a80], ecx
movzx eax, byte [edx + 1]
sub ecx, eax
mov dword [esi + 0x4a7c], ecx
mov cl, byte [edi + 2]
cmp cl, 7
jae 0x4708f9
add byte [edi + 3], 0xff
jne 0x4708f9
mov ax, word [edi]
add ax, ax
mov word [edi], ax
mov al, 3
shl al, cl
inc cl
mov byte [edi + 2], cl
mov byte [edi + 3], al
mov ecx, dword [esp + 0x14]
push edx
push esi
call fcn.004705a0
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
mov edi, dword [esp + 0x14]
mov dword [esi + 0x4a7c], ecx
mov dword [esi + 0x4a80], ebx
movzx ecx, word [edi]
sub ecx, dword [esi + 0x654]
lea eax, [esp + 0x18]
sub eax, 4
mov edx, dword [eax + 4]
movzx edx, byte [edx]
mov bl, byte [esi + 0xa6c]
add eax, 4
sub ecx, 1
mov byte [edx + esi + 0x66c], bl
jne 0x470933
mov cx, word [esi + 0x4a84]
mov eax, dword [esp + 0x10]
add word [eax], cx
movzx edx, word [edi]
pop edi
mov dword [esi + 0x654], edx
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x408
ret 4
Function at 0x477010
Capabilities:
Write file on windows

Disassembly:
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x477060
push esi
push 0x4e42b0
push str.Rar_CMXXXXXX
call fcn.0047efc0
mov esi, eax
test esi, esi
je 0x47705f
cmp byte [esp + 0x10], 0
je 0x47703e
push edi
push edi
call dword [sym.imp.USER32.dll_CharToOemA]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x477043
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049f602
push esi
call fcn.0049f426
add esp, 0x14
pop esi
pop edi
ret 8

Function at 0x477070
Capabilities:
Get memory capacity

Disassembly:
mov eax, dword [0x4f66ec]
sub esp, 0x20
test eax, eax
jne 0x4770b8
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [esp + 8]
mov eax, 0x400000
mov dword [0x4f66ec], eax
cmp ecx, 0x8000000
ja 0x4770a6
mov eax, 0x200000
mov dword [0x4f66ec], eax
cmp ecx, 0x4000000
ja 0x4770b8
mov eax, 0x100000
mov dword [0x4f66ec], eax
add esp, 0x20
ret

Function at 0x477380
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
sub esp, 0xe04
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xe00], eax
push ebx
push ebp
mov ebp, dword [esp + 0xe10]
push edi
call fcn.0044db30
cmp byte [0x4f6590], 0
push 0x3a
push eax
je 0x4773bb
mov ecx, 0x4f6490
call fcn.0046e2a0
jmp 0x4773c3
call fcn.0049db10
add esp, 8
mov ebx, dword [sym.imp.USER32.dll_MessageBoxA]
test eax, eax
je 0x4773f8
cmp byte [0x4f66f0], 0
jne 0x4773f8
push 0x31
push 0x65
call fcn.0045bde0
push eax
push 0x528
call fcn.0045bde0
push eax
push ebp
call ebx
cmp eax, 1
jne 0x477410
mov byte [0x4f66f0], al
cmp byte [0x4f6590], 0
push 0x5c
push edi
je 0x477417
mov ecx, 0x4f6490
call fcn.0046e300
jmp 0x47741f
xor al, al
jmp 0x4774ec
call fcn.0049dbd0
add esp, 8
test eax, eax
je 0x477509
cmp eax, edi
je 0x477509
cmp byte [eax - 1], 0x3a
je 0x477509
push esi
lea esi, [esp + 0x40c]
mov ecx, edi
sub esi, edi
mov dl, byte [ecx]
mov byte [esi + ecx], dl
inc ecx
test dl, dl
jne 0x477445
sub eax, edi
mov byte [esp + eax + 0x40c], dl
push 0x400
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea edx, [esp + 0xc]
push edx
mov byte [esp + 0x40f], 0
call esi
cmp eax, 0xffffffff
jne 0x4774e9
lea ebx, [ebx]
push 0x14d
call fcn.0045bde0
push eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x814]
push str.__s__n_s
push ecx
call fcn.0049deb5
add esp, 0x10
push 0x34
push 0x65
call fcn.0045bde0
push eax
lea edx, [esp + 0x814]
push edx
push ebp
call ebx
cmp eax, 6
jne 0x477505
push 0
push 0
lea eax, [esp + 0x14]
push eax
call fcn.00430250
lea ecx, [esp + 0xc]
push ecx
call esi
cmp eax, 0xffffffff
je 0x477490
mov al, 1
pop esi
mov ecx, dword [esp + 0xe08]
pop ebp
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0xe04
ret 4
xor al, al
jmp 0x4774eb
mov al, 1
jmp 0x4774ec
Function at 0x47a830
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x4e42b0], 0
jne 0x47a87e
push edi
mov edi, dword [0x4f66d0]
test edi, edi
je 0x47a87d
push esi
push 0x4e42b0
push str.Rar_CMXXXXXX
call fcn.0047efc0
mov esi, eax
test esi, esi
je 0x47a87c
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47a860
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049f602
push esi
call fcn.0049f426
add esp, 0x14
pop esi
pop edi
ret

Function at 0x47b4b0
Capabilities:
Write file on windows

Disassembly:
push 1
call fcn.0047b410
jmp fcn.0047a830

Function at 0x47b4c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
mov ebx, dword [esp + 0x25c]
push esi
push edi
mov edi, dword [esp + 0x268]
xor esi, esi
push esi
lea eax, [esp + 0x10]
push str.Profiles_d
push eax
mov byte [edi], 0
call fcn.0049deb5
add esp, 0xc
push 0x200
push 0x4b1914
lea ecx, [esp + 0x64]
push ecx
push 0x4b44b0
lea edx, [esp + 0x1c]
push edx
call fcn.00456900
cmp byte [esp + 0x5c], 0
je 0x47b5df
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.004652e0
test eax, eax
je 0x47b570
inc esi
push esi
lea ecx, [esp + 0x10]
push str.Profiles_d
push ecx
call fcn.0049deb5
add esp, 0xc
push 0x200
push 0x4b1914
lea edx, [esp + 0x64]
push edx
push 0x4b44b0
lea eax, [esp + 0x1c]
push eax
call fcn.00456900
cmp byte [esp + 0x5c], 0
jne 0x47b526
jmp 0x47b5df
push 0
push 1
push esi
call fcn.00479d00
push 0
push str.ImmExec
lea ecx, [esp + 0x14]
push ecx
call fcn.00456960
test eax, eax
setne al
mov byte [edi], al
test al, al
je 0x47b5df
cmp byte [0x4e42b0], 0
jne 0x47b5df
mov edi, dword [0x4f66d0]
test edi, edi
je 0x47b5df
push 0x4e42b0
push str.Rar_CMXXXXXX
call fcn.0047efc0
mov esi, eax
test esi, esi
je 0x47b5df
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47b5c3
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049f602
push esi
call fcn.0049f426
add esp, 0x14
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x254
ret 8
Function at 0x47de60
Capabilities:
Get graphical window text

Disassembly:
call fcn.0043ca60
test eax, eax
je 0x47de6f
jmp dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [edi + 1]
push eax
call fcn.0049e9f4
mov ecx, dword [esp + 0x10]
add esp, 4
push edi
mov esi, eax
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [esp + 0x10]
push 0x1000000
push edx
push esi
call fcn.0046d7e0
push esi
call fcn.0049e845
add esp, 4
pop edi
pop esi
ret 0xc

Function at 0x47e100
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
push ebx
call edi
push ebx
mov esi, eax
call edi
mov ebp, dword [esp + 0x38]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov dword [esp + 0x40], eax
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x24]
push 0xcc0020
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov edx, eax
neg edx
push edx
push 0
lea edx, [eax - 1]
push edx
push esi
push ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0xcc0020
push 0
push 0
push edi
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov edx, dword [esp + 0x18]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x47e2d0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push edi
mov edi, dword [esp + 0x414]
push edi
push 0x4b1914
push esi
push str.TempFolder
push 0x4b192c
call fcn.00456900
cmp byte [esi], 0
mov byte [esp + 8], 0
je 0x47e346
push 0x400
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x47e335
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.00465320
cmp byte [esi], 0
je 0x47e346
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x47e370
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x47e357
cmp byte [esi], 0
jne 0x47e370
mov edx, dword [str._rartemp]
mov dword [esi], edx
mov eax, dword [0x4b4a74]
mov dword [esi + 4], eax
mov cl, byte [0x4b4a78]
mov byte [esi + 8], cl
push esi
call fcn.0044dfb0
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.0049dea6
add esp, 0x404
ret 8

Function at 0x47e400
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
test esi, esi
je 0x47e42f
xor eax, eax
mov word [esi], ax
call fcn.0043ca60
test eax, eax
je 0x47e42f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x47e42f
pop edi
xor al, al
pop esi
ret 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47e44a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret 0xc
pop edi
mov al, 1
pop esi
ret 0xc

Function at 0x47e520
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x47e579
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x47e55f
jne 0x47e579
cmp dword [esp + 8], 0
jbe 0x47e579
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0049dea6
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.0049dea6
add esp, 0x98
ret
Function at 0x47f0a0
Capabilities:
Create directory

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x410]
push 0x400
lea eax, [esp + 0xc]
push eax
call fcn.0047e2d0
lea ecx, [esp + 8]
push ecx
call fcn.0044dfb0
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47f0e1
push edi
lea edi, [esp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47f0f0
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0xc]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0042fbc0
pop edi
test eax, eax
je 0x47f13e
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x47f13e
lea eax, [esp + 8]
mov edx, ebx
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x47f130
mov al, 1
jmp 0x47f162
lea edx, [esp + 8]
push edx
push 0x1f7
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 8
mov ecx, 0x4c9364
call fcn.00427d40
xor al, al
mov ecx, dword [esp + 0x408]
pop esi
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x404
ret 8
Function at 0x47fd60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
push edi
call fcn.0047e520
mov ecx, dword [ebp + 4]
movzx ebx, al
neg ebx
push 0x200
sbb ebx, ebx
lea eax, [esp + 0x14]
push eax
and ebx, 0x40
push ecx
add ebx, 0x40
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, ebx
shr edx, 1
push edx
lea eax, [esp + 0x14]
push eax
call fcn.004455f0
cmp byte [0x4f6bb0], 0
je 0x47fe2d
call fcn.0043ca60
test eax, eax
mov eax, 0x4b2834
jne 0x47fdd0
mov eax, 0x4b2a74
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47fdd2
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47fde0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47fe00
push 0x4f6bb0
sub eax, edx
push 0x5aa
mov esi, eax
call fcn.0045bde0
push eax
lea ecx, [esp + esi + 0x18]
push str._s:__s
push ecx
call fcn.0049deb5
add esp, 0x10
cmp byte [0x4f6b85], 0
je 0x47feab
call fcn.0043ca60
test eax, eax
mov eax, 0x4b2834
jne 0x47fe49
mov eax, 0x4b2a74
mov edx, eax
jmp 0x47fe50
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47fe50
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47fe60
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47fe80
sub eax, edx
mov edx, dword [esp + 0x21c]
push edx
push 0x2fd
mov esi, eax
call fcn.0045bde0
push eax
lea eax, [esp + esi + 0x18]
push eax
call fcn.0049deb5
add esp, 0xc
push ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [ebp + 0x18]
push edx
call fcn.00465320
call fcn.0047e520
mov ecx, dword [esp + 0x210]
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x190
pop edi
add eax, 0x58
pop esi
mov dword [ebp], eax
pop ebp
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x204
ret 8
Function at 0x47fef0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [0x4db83c]
test eax, eax
je 0x47ffdc
push esi
push 0x200
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [0x4f7b18]
cmp esi, 8
je 0x47ff78
mov ecx, 0x4f6e98
lea eax, [esp + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47ff57
test dl, dl
je 0x47ff53
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47ff57
add eax, 2
add ecx, 2
test dl, dl
jne 0x47ff37
xor eax, eax
jmp 0x47ff5c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47ff78
mov edx, dword [0x4db83c]
push 0x4f6e98
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov esi, dword [0x4f7b18]
test esi, esi
je 0x47ff8b
cmp esi, 1
je 0x47ff8b
cmp esi, 2
je 0x47ff8b
cmp esi, 8
jne 0x47ffc2
push ebx
push edi
push 0x9c
xor ebx, ebx
mov edi, 0x4f6e18
call fcn.0047fad0
push 0x4f6f18
call fcn.0044dbb0
push 0x4f7718
mov ebx, eax
call fcn.0044db30
push 0x9b
mov edi, eax
call fcn.0047fad0
pop edi
pop ebx
push 0x64
push 2
call fcn.004458a0
pop esi
test al, al
je 0x47ffdc
mov eax, dword [0x4db83c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.0049dea6
add esp, 0x204
ret
Function at 0x482c00
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x400], eax
cmp byte [esp + 0x41c], 0
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x418]
push edi
mov edi, dword [esp + 0x420]
je 0x482c9c
push 0x400
push esi
push ebp
push str.DefFolder
push str.Extraction
call fcn.00456900
cmp byte [ebp], 0
jne 0x482c6c
mov edx, ebp
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x482c60
jmp 0x482ca0
push 0x400
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x10]
mov edx, ebp
mov ecx, eax
mov byte [esp + 0x40f], 0
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x482c90
jmp 0x482ca0
mov byte [ebp], 0
mov al, byte [ebp]
test al, al
setne bl
test al, al
jne 0x482cb8
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebp
call fcn.0044dfb0
cmp byte [esp + 0x424], 0
jne 0x482cd0
test bl, bl
je 0x482dcd
push 1
push str.AppendName
push str.Extraction
call fcn.00456960
test eax, eax
je 0x482dcd
push 0x400
push edi
lea edx, [esp + 0x18]
push edx
call fcn.00465320
cmp byte [esp + 0x10], 0
je 0x482d24
lea esi, [esp + 0x10]
cmp byte [esi], 0x25
jne 0x482d1e
lea eax, [esi + 1]
push 0x25
push eax
call fcn.0049db10
add esp, 8
test eax, eax
je 0x482d1e
mov byte [esi], 0x5f
inc esi
cmp byte [esi], 0
jne 0x482d04
lea ecx, [esp + 0x10]
push ecx
call fcn.0044db30
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x482d30
mov edi, ebp
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x482d40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.0044dec0
mov esi, eax
test esi, esi
je 0x482dcd
cmp esi, ebp
jbe 0x482dcd
push ebp
mov byte [esi], 0
call fcn.0044dec0
mov edi, eax
test edi, edi
je 0x482db9
cmp edi, ebp
jbe 0x482db9
cmp byte [esp + 0x428], 0
je 0x482da7
cmp byte [esi + 1], 0
je 0x482da7
movsx edx, byte [esi + 2]
push edx
call fcn.00465130
test al, al
jne 0x482da7
movsx eax, byte [esi - 1]
push eax
call fcn.00465130
test al, al
jne 0x482db6
push str..tar
push edi
call fcn.004652e0
test eax, eax
jne 0x482db9
mov byte [edi], 0
dec esi
cmp esi, ebp
jbe 0x482dcd
mov edi, edi
cmp byte [esi], 0x2e
jne 0x482dcd
mov byte [esi], 0
dec esi
cmp esi, ebp
ja 0x482dc0
push 0
push ebp
call fcn.0044e6c0
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x404
ret 0x18