joyce8/EMBER2024-capa huggingface dataset:
Function at 0x523b90
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5713c2
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x661850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x38], ecx
push str.Sun_May_10_21:37:40_2015
push 0x16d
push str.CMirSound::ReadBKMusicFileList
push str.SoundMirSound.cpp
lea ecx, [ebp - 0xd]
call fcn.004024e0
mov dword [ebp - 4], 0
push 0
push 0x80
push 3
push 0
push 1
push closesocket
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x523d61
mov ecx, dword [ebp - 0x38]
cmp dword [ecx + 0x488], 0
je 0x523c35
mov edx, dword [ebp - 0x38]
mov eax, dword [edx + 0x488]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.00544d52
add esp, 4
mov edx, dword [ebp - 0x38]
mov dword [edx + 0x488], 0
push 0x3a
call fcn.00545848
add esp, 4
mov dword [ebp - 0x28], eax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x28], 0
je 0x523c59
mov ecx, dword [ebp - 0x28]
call fcn.005266c0
mov dword [ebp - 0x3c], eax
jmp 0x523c60
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x24]
mov dword [ecx + 0x488], edx
push 0
lea eax, [ebp - 0x18]
push eax
push 0x3a
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x488]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x38]
mov edx, dword [ecx + 0x488]
mov eax, dword [edx + 0x32]
mov dword [ebp - 0x2c], eax
xor ecx, ecx
mov eax, dword [ebp - 0x2c]
mov edx, 0x18
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00542ae0
add esp, 4
mov dword [ebp - 0x34], eax
mov byte [ebp - 4], 2
cmp dword [ebp - 0x34], 0
je 0x523ce9
push fcn.0043af30
mov eax, dword [ebp - 0x2c]
push eax
push 0x18
mov ecx, dword [ebp - 0x34]
push ecx
call fcn.0043b1c0
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x40], edx
jmp 0x523cf0
mov dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x30], eax
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp - 0x30]
mov dword [ecx + 0x490], edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x488]
mov edx, dword [ecx + 0x32]
imul edx, edx, 0x18
push edx
push 0
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x490]
push ecx
call fcn.005454d0
add esp, 0xc
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x488]
mov edx, dword [ecx + 0x32]
imul edx, edx, 0x18
push edx
mov eax, dword [ebp - 0x38]
mov ecx, dword [eax + 0x490]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd]
call fcn.00402620
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x534b30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5727f8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x661850]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [0x7dd2e8]
mov ecx, dword fs:[0x2c]
mov edi, dword [ecx + eax*4]
mov eax, dword [edi + 0x2010]
mov dword [ebp - 0x1c], edi
cmp eax, 0x200
jge 0x534bb3
inc eax
mov dword [edi + 0x2010], eax
shl eax, 4
add eax, edi
mov dword [eax + 0x10], str.WHDXGraphic.cpp
mov dword [eax + 0x14], str.CWHDXGraphicWindow::ResetDXG
mov dword [eax + 0x18], 0x247
mov byte [ebp - 0xd], 1
mov dword [eax + 0x1c], 0x5889ac
jmp 0x534bb7
mov byte [ebp - 0xd], 0
cmp dword [esi + 0x3c], 0
mov dword [ebp - 4], 0
jne 0x534bcb
push 0
call fcn.0054b4be
test byte [esi + 0x64], 1
je 0x534c7e
mov edx, dword [esi + 8]
push 0xfffffffffffffff0
push edx
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0x7f31ffff
or eax, 0xce0000
push eax
mov eax, dword [esi + 8]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov cx, word [ebp + 0xc]
mov bx, word [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov word [esi + 0x1da], bx
mov word [esi + 0x1dc], cx
call edi
push 1
mov dword [ebp - 0x18], eax
call edi
push 0x20
mov dword [ebp - 0x14], eax
call edi
movzx edx, bx
lea eax, [edx + eax*2]
push 0x21
mov dword [ebp + 8], eax
call edi
mov ebx, eax
push 4
add ebx, ebx
call edi
movzx ecx, word [ebp + 0xc]
mov edi, dword [ebp + 8]
add eax, ebx
add ecx, eax
mov eax, dword [ebp - 0x14]
sub eax, ecx
cdq
push 1
sub eax, edx
push ecx
mov ecx, dword [0x69ec10]
sar eax, 1
push edi
push eax
mov eax, dword [ebp - 0x18]
sub eax, edi
cdq
sub eax, edx
sar eax, 1
push eax
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esi + 8]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edi, dword [ebp - 0x1c]
jmp 0x534cbc
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call ebx
push 1
mov dword [ebp - 0x1c], eax
call ebx
fild dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
movzx ecx, word [ebp + 0xc]
fild dword [ebp + 8]
mov dword [ebp + 0xc], ecx
fdivp st(1)
fstp dword [esi + 0x1b6]
fild dword [ebp - 0x18]
fild dword [ebp + 0xc]
fdivp st(1)
fstp dword [esi + 0x1ba]
mov edx, dword [esi]
mov eax, dword [edx + 8]
mov ecx, esi
call eax
cmp byte [ebp - 0xd], 0
je 0x534cd1
dec dword [edi + 0x2010]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x53ea30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftDirectX
push closesocket
mov dword [ebp - 8], 0x200
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x53ea65
mov eax, 0x7dceb8
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
push esi
lea ecx, [ebp - 8]
push ecx
push 0x7dccb8
lea edx, [ebp - 0xc]
push edx
push 0
push str.DXSDK_Samples_Path
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [ebp - 4]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x53ea5c
push str.D3DIMMedia_
push 0x7dccb8
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, 0x7dccb8
mov esp, ebp
pop ebp
ret
Function at 0x54514c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x661850]
jne 0x545156
repz ret
jmp fcn.0054f46c

Function at 0x55df6f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x661850]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0054eeff
and dword [ebp - 0x14], 0
cmp dword [0x7de06c], 0
mov dword [ebp - 0x18], eax
jne 0x55e022
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x55e0ca
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x55e0ca
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x593324
push ebx
mov dword [0x7de06c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x7de070], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x7de074], eax
call edi
push eax
call esi
mov dword [0x7de07c], eax
test eax, eax
je 0x55e022
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x7de078], eax
mov eax, dword [0x7de078]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x55e07b
cmp dword [0x7de07c], ecx
je 0x55e07b
push eax
call esi
push dword [0x7de07c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x55e07b
test ebx, ebx
je 0x55e07b
call edi
test eax, eax
je 0x55e072
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x55e072
test byte [ebp - 8], 1
jne 0x55e07b
or dword [ebp + 0x10], 0x200000
jmp 0x55e0ae
mov eax, dword [0x7de070]
cmp eax, dword [ebp - 0x18]
je 0x55e0ae
push eax
call esi
test eax, eax
je 0x55e0ae
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x55e0ae
mov eax, dword [0x7de074]
cmp eax, dword [ebp - 0x18]
je 0x55e0ae
push eax
call esi
test eax, eax
je 0x55e0ae
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x7de06c]
call esi
test eax, eax
je 0x55e0ca
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x55e0cc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0054514c
leave
ret
Function at 0x47a730
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b741b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x108
push ebx
push ebp
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 1
lea eax, [esp + 0x18]
push 0x1a
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CString::CString_2
push str.Tencent
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], ebx
call fcn.004ab4d0
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.MSVCRT.dll__mkdir]
push edx
call edi
add esp, 4
lea ecx, [esp + 0x10]
push str.QQGame
call fcn.004ab4d0
mov eax, dword [esp + 0x10]
push eax
call edi
add esp, 4
lea ecx, [esp + 0x10]
push str.Users
call fcn.004ab4d0
mov ecx, dword [esp + 0x10]
push ecx
call edi
mov eax, dword [esi + 0x654]
push eax
call edi
mov eax, dword [esi + 0x658]
mov ebp, dword [sym.imp.MSVCRT.dll_fopen]
push 0x4d5dc0
push eax
call ebp
mov edi, eax
add esp, 0x10
cmp edi, ebx
je 0x47a81e
mov edx, dword [esi + 0x6e0]
mov ebx, dword [sym.imp.MSVCRT.dll_fprintf]
push edx
push str._sprit__npanelpage_d
push edi
call ebx
mov eax, dword [esi + 0x6e4]
add esp, 0xc
push eax
jmp 0x47a854
mov eax, dword [esi + 0x658]
push 0x4d5c20
push eax
call ebp
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x47a866
mov ecx, dword [esi + 0x6e0]
mov ebx, dword [sym.imp.MSVCRT.dll_fprintf]
push ecx
push str._sprit__npanelpage_d
push edi
call ebx
mov edx, dword [esi + 0x6e4]
add esp, 0xc
push edx
push str._nshowtip_d
push edi
call ebx
push edi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x10
lea ecx, [esp + 0x10]
mov dword [esp + 0x120], 0xffffffff
call fcn.004ab42e
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x114
ret
Function at 0x411450
Capabilities:
Get common file path
Get disk information
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov edi, dword [esp + 0x810]
push 0x400
push 0x4b8a1e
lea eax, [esp + 0x10]
push eax
push str.TempFolder
push str.Paths
mov byte [edi], 0
call fcn.0045b440
cmp byte [esp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
jne 0x4114b4
cmp byte [0x4f5fcc], 0
je 0x411570
lea ecx, [esp + 8]
push ecx
push 0x400
call esi
push 0x400
lea edx, [esp + 0x40c]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jle 0x4114f1
cmp eax, 0x400
jae 0x4114f1
push 0x400
lea ecx, [esp + 0x40c]
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.004a5350
add esp, 0xc
push 0
lea eax, [esp + 0xc]
push eax
call fcn.004313f0
test al, al
jne 0x41150d
lea ecx, [esp + 8]
push ecx
push 0x400
call esi
push 1
push 0x4b89d8
push str.Paths
call fcn.0045afb0
test eax, eax
je 0x411553
cmp byte [0x4f5fcc], 0
jne 0x411553
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x41153d
cmp eax, 5
jne 0x41156a
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411547
jmp 0x41156a
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411560
push edi
call fcn.00451880
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.004a39f3
add esp, 0x804
ret 4

Function at 0x415900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4b4321
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4ca3b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esp + 0x14], 1
lea ecx, [esi + 0x1ef0]
call fcn.00401a00
mov byte [esp + 0x14], 0
lea ecx, [esi + 0x30]
call fcn.0042d990
mov dword [esp + 0x14], 0xffffffff
mov ecx, esi
call fcn.004028c0
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x4171a0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x148
push ebp
push esi
mov esi, ecx
lea ebp, [esi + 4]
push ebp
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x804], eax
test eax, eax
jne 0x4171ef
push ebp
call fcn.004842d0
test eax, eax
je 0x4171e4
cmp eax, 0x20
je 0x4171e4
push ebp
push eax
push 0x20
push 0x5c8
call fcn.00460760
push eax
call fcn.00492420
add esp, 0x10
pop esi
xor al, al
pop ebp
add esp, 0x148
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Prepare
push eax
call edi
mov dword [esi + 0x9e0], eax
mov eax, dword [esi + 0x804]
push str.Open
push eax
call edi
mov ecx, dword [esi + 0x804]
push str.Close
push ecx
mov dword [esi + 0x9e4], eax
call edi
mov edx, dword [esi + 0x804]
push str.GetNextName
push edx
mov dword [esi + 0x9e8], eax
call edi
mov dword [esi + 0x9ec], eax
mov eax, dword [esi + 0x804]
push str.GetListItem
push eax
call edi
mov ecx, dword [esi + 0x804]
push str.Extract
push ecx
mov dword [esi + 0x9f0], eax
call edi
mov edx, dword [esi + 0x804]
push str.GetComment
push edx
mov dword [esi + 0x9f4], eax
call edi
cmp dword [esi + 0x9e0], 0
mov dword [esi + 0x9f8], eax
je 0x4173e6
cmp dword [esi + 0x9e4], 0
je 0x4173e6
push 0x148
lea eax, [esp + 0x10]
push 0
push eax
call fcn.004a4250
add esp, 0xc
mov dword [esp + 0xc], 0x148
mov dword [esp + 0x10], 0x410c60
mov dword [esp + 0x14], 0x410dd0
mov dword [esp + 0x18], 0x410de0
mov dword [esp + 0x44], 0x410df0
mov dword [esp + 0x20], 0x410e00
mov dword [esp + 0x2c], 0x410f90
mov dword [esp + 0x30], 0x410fb0
mov dword [esp + 0x38], 0x410fc0
mov dword [esp + 0x3c], 0x413520
mov dword [esp + 0x34], 0x413830
mov dword [esp + 0x48], 0x4110b0
mov dword [esp + 0x4c], 0x4110c0
mov dword [esp + 0x24], 0x4110d0
mov dword [esp + 0x54], 0x411130
mov dword [esp + 0x28], 0x4111b0
mov dword [esp + 0x40], 0x411250
mov dword [esp + 0x58], 0x411290
mov dword [esp + 0x5c], 0x4112a0
mov dword [esp + 0x1c], 0x416c10
mov dword [esp + 0x50], 0x4112b0
call fcn.0043e7a0
push 0x1d8
lea edi, [esi + 0x808]
push 0
push edi
mov dword [esp + 0xe4], eax
call fcn.004a4250
mov edx, dword [esi + 0x9e0]
add esp, 0xc
push edi
lea ecx, [esp + 0x10]
push ecx
mov dword [edi], 0x1d8
mov dword [esi + 0x80c], 1
mov dword [esi + 0x810], 0x40001
call edx
test al, al
je 0x4173b5
cmp dword [esi + 0x80c], 1
jne 0x4173b5
pop edi
pop esi
mov al, 1
pop ebp
add esp, 0x148
ret
mov eax, dword [esi + 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebp
mov dword [esi + 0x804], 0
call fcn.004513d0
push eax
push 0x42e
call fcn.00460760
push eax
call fcn.00492420
add esp, 8
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x148
ret
Function at 0x451980
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push 0x1a
push 0
mov byte [esi], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x451a07
mov edx, dword [esp + 4]
push esi
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x451a07
cmp byte [esi], 0
je 0x451a07
push esi
call fcn.00451880
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4519c7
mov ecx, dword [str.WinRAR]
mov dword [eax], ecx
mov dx, word [0x4bbc40]
mov word [eax + 4], dx
mov cl, byte [0x4bbc42]
push 0
push esi
mov byte [eax + 6], cl
call fcn.004313f0
test al, al
jne 0x451a33
push 0
push 0
push 0
push esi
call fcn.00431ac0
test eax, eax
je 0x451a33
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.00451350
lea edx, [esi + 2]
cmp eax, edx
jb 0x451a30
cmp byte [esi + 1], 0x3a
jne 0x451a2f
add esi, 4
cmp eax, esi
jb 0x451a30
dec eax
mov byte [eax], 0
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4

Function at 0x451a50
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x10]
lea edx, [esp + 4]
push edx
xor ecx, ecx
push 0x1a
push ecx
mov word [esi], cx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x451aed
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x451aed
cmp word [esi], 0
je 0x451aed
push esi
call fcn.00450e70
mov eax, esi
add eax, 0xfffffffe
jmp 0x451aa0
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x451aa0
mov ecx, dword [0x4ba748]
mov dword [eax], ecx
mov edx, dword [0x4ba74c]
mov dword [eax + 4], edx
mov ecx, dword [0x4ba750]
mov dword [eax + 8], ecx
mov dx, word [0x4ba754]
push esi
push 0
mov word [eax + 0xc], dx
call fcn.004313f0
test al, al
jne 0x451b1e
push 0
push 0
push esi
push 0
call fcn.00431ac0
test eax, eax
je 0x451b1e
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.004513d0
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x451b19
cmp word [esi + 2], 0x3a
jne 0x451b16
add esi, 8
cmp eax, esi
jb 0x451b19
sub eax, 2
xor edx, edx
mov word [eax], dx
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4
Function at 0x483a80
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
push ebx
call edi
push ebx
mov esi, eax
call edi
mov ebp, dword [esp + 0x38]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov dword [esp + 0x40], eax
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x24]
push 0xcc0020
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov edx, eax
neg edx
push edx
push 0
lea edx, [eax - 1]
push edx
push esi
push ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0xcc0020
push 0
push 0
push edi
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov edx, dword [esp + 0x18]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4

Function at 0x483c50
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x800], eax
cmp byte [0x4f7838], 0
push esi
mov esi, dword [esp + 0x80c]
je 0x483c8d
mov eax, dword [esp + 0x810]
push eax
push esi
push 0x4f7838
call fcn.00472580
jmp 0x483d15
push edi
mov edi, dword [esp + 0x814]
push edi
push 0x4b8d0c
push esi
push str.TempFolder
push str.Paths
call fcn.0045af80
xor ecx, ecx
mov word [esp + 8], cx
cmp word [esi], cx
je 0x483cea
push 0x400
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x483cd8
push edi
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00469f80
cmp word [esi], 0
je 0x483cea
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x483d14
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x483cfc
cmp word [esi], 0
jne 0x483d14
mov eax, str._rartemp
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x483d05
pop edi
push esi
call fcn.00450e70
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004a39f3
add esp, 0x804
ret 8
Function at 0x492e20
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x202c
call fcn.004a4220
mov eax, dword [0x4ca3b0]
xor eax, esp
mov dword [esp + 0x2028], eax
cmp byte [0x4e7b89], 0
je 0x493035
push ebx
push 0x401
lea eax, [esp + 0x828]
push eax
mov ecx, 0x4eeda0
call fcn.00413010
push 1
push str.History
push str.General
call fcn.0045afb0
test eax, eax
setne bl
test bl, bl
je 0x492e95
push 0x400
push 0x4b8d0c
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push 0x4ba248
call fcn.0045af80
cmp word [esp + 0x24], 0
jne 0x492ea7
lea edx, [esp + 0x24]
push edx
call fcn.0043c5a0
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x24]
mov word [esp + eax + 0x1028], cx
add eax, 2
test cx, cx
jne 0x492eb0
lea eax, [esp + 0x1028]
push eax
call fcn.00450e70
lea ecx, [esp + 0x824]
push ecx
call fcn.004513d0
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x492ee1
push esi
push edi
lea edi, [esp + 0x1030]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x492f00
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 1
push 0
lea edx, [esp + 0x1038]
mov ecx, eax
push edx
and ecx, 3
push 0x5af
rep movsb byte es:[edi], byte [esi]
call fcn.00460760
push eax
mov eax, dword [0x4e8cd4]
push eax
call fcn.00419620
pop edi
pop esi
test al, al
je 0x493034
push 0x400
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1030]
push edx
call fcn.00451900
test bl, bl
je 0x492f77
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push 0x4ba248
call fcn.0045aeb0
lea eax, [esp + 0x824]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x492f81
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x826], cx
lea eax, [esp + 0x1028]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x492fa4
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x102a], dx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea edx, [esp + 4]
lea eax, [esp + 0x824]
lea ecx, [esp + 0x1028]
push edx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x493034
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 0x5b0
call fcn.00460760
push eax
call fcn.00492420
add esp, 0xc
mov ecx, 0x4d56b4
call fcn.00428c40
pop ebx
mov ecx, dword [esp + 0x2028]
xor ecx, esp
call fcn.004a39f3
add esp, 0x202c
ret