joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46bca0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0040ff8c
test eax, eax
je 0x46bd0b
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046bb04
mov ebx, eax
test ebx, ebx
je 0x46bd43
lea edx, [ebp - 0xa8]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.00410004
mov eax, esi
call fcn.004101ec
add eax, eax
lea edx, [ebp - 0xa8]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov eax, ebx
call fcn.0046bbb0
jmp 0x46bd43
mov eax, esi
call fcn.004101ec
add eax, eax
add eax, 2
push eax
call fcn.004931a4
pop ecx
mov ebx, eax
mov ecx, 0x10000000
mov edx, ebx
mov eax, esi
call fcn.0040ffe0
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.0046bc54
push ebx
call fcn.00492fcc
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x46be3c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.0046bb66
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x46be7e
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046bbb0
test esi, esi
jne 0x46be88
cmp dword [ebp + 8], 0
jne 0x46be98
push dword [ebp + 0xc]
push edi
call fcn.004949c8
add esp, 8
xor eax, eax
jmp 0x46be9a
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46bec0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.0040ff8c
test eax, eax
je 0x46bf3e
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046bb66
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.00410004
mov esi, 1
test ebx, ebx
je 0x46bf29
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.0046bbb0
test esi, esi
jne 0x46bf33
cmp dword [ebp + 8], 0
ja 0x46bf37
xor ebx, ebx
jmp 0x46bf76
mov ebx, 1
jmp 0x46bf76
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.004931a4
pop ecx
mov esi, eax
push esi
push 0x4a7488
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046be3c
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.00410004
push esi
call fcn.00492fcc
pop ecx
test bl, bl
jne 0x46bf84
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.00410200
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46bf90
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.0046bb66
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x46bfd9
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.0046bbb0
test esi, esi
jne 0x46bfe3
cmp dword [ebp - 0x10], 0
jne 0x46bfec
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x46bfee
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46c040
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.0046bb66
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x46c081
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.0046bbb0
test edi, edi
jne 0x46c08b
cmp dword [ebp - 0xc], 0
jne 0x46c0b4
cmp dword [ebp + 0xc], 0
je 0x46c0a2
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.004947d8
add esp, 0xc
jmp 0x46c0b0
push esi
push 0
push dword [ebp + 0x10]
call fcn.00494848
add esp, 0xc
xor eax, eax
jmp 0x46c0b7
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x46c0d0
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 4]
call fcn.0046bbcc
test al, al
je 0x46c0f4
push esp
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x100
pop ebx
ret

Function at 0x46c10c
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, ecx
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 8]
call fcn.0046bbcc
test al, al
je 0x46c155
push esp
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x46c155
push esi
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp]
call fcn.0046bbb0
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x46dda4
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4aa724
push 1
push 0
push 0x4aa754
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x46de6f
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x46ddf0
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x46de04
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x46de16
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4aa784
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x46de66
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x46de5d
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46de7c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x46deb4
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46dec9
xor eax, eax
jmp 0x46df07
push ebx
call fcn.004949f8
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.00494848
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret

Function at 0x46e4b4
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.0046e8e0
mov eax, esp
call fcn.0040bf34
push ebx
lea edx, [esp + 4]
push edx
call fcn.004948ec
add esp, 8
mov eax, esp
call fcn.0040aa5c
test eax, eax
je 0x46e4fc
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x46e51e
push esp
mov eax, 0x1f7
call fcn.00411fe8
push eax
call fcn.0044e1d4
add esp, 8
mov eax, 0x4ae120
call fcn.0042cf6c
xor eax, eax
jmp 0x46e52a
push esp
push esi
call fcn.004949c8
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x46e5ec
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x44
push 0
lea eax, [esp + 8]
push eax
call fcn.00494848
add esp, 0xc
mov dword [esp], 0x44
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x46e655
test edi, edi
je 0x46e63f
push edi
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x46e657
xor eax, eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x46e714
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call sub.USER32.DLL_GetDesktopWindow
mov ebp, eax
push ebp
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call sub.GDI32.DLL_GetObjectA
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [esp + 4], eax
push dword [esp]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [esp + 8]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [esp + 0xc]
push esi
call sub.GDI32.DLL_SelectObject
push dword [esp + 4]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push ebp
call sub.USER32.DLL_ReleaseDC
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x46e8e0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, 0x4a7d99
push 0x4a7d87
push esi
mov ecx, ebx
mov edx, 0x4a7d9f
call fcn.0046be20
mov byte [esp], 0
cmp byte [ebx], 0
je 0x46e937
push 0x400
lea eax, [esp + 4]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x46e937
lea edx, [esi - 1]
push edx
lea ecx, [esp + 4]
push ecx
push ebx
call fcn.00494ba8
add esp, 0xc
mov byte [ebx + esi - 1], 0
cmp byte [ebx], 0
je 0x46e947
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46e965
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x46e957
cmp byte [ebx], 0
jne 0x46e965
push str._rartemp
push ebx
call fcn.004949c8
add esp, 8
mov eax, ebx
call fcn.0040bf34
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x46eaa8
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x46ead7
cmp dword [esp + 4], 5
ja 0x46eadb
cmp dword [esp + 4], 5
jne 0x46ead7
cmp dword [esp + 8], 0
ja 0x46eadb
xor eax, eax
jmp 0x46eae0
mov eax, 1
add esp, 0x94
ret

Function at 0x46f0dc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x46f0e5
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4a7e94
call fcn.00494df8
call fcn.0049cdec
mov dword [ebp - 0x2458], eax
xor ebx, ebx
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.00412c98
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.00413750
lea eax, [ebp - 0x28d0]
call fcn.00413750
lea eax, [ebp - 0x28a4]
call fcn.00413750
inc dword [0x4c3de8]
jmp 0x46f209
test bl, bl
jne 0x46f19f
call fcn.0049cdec
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x46f19f
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.0047c8e4
mov bl, 1
test bl, bl
je 0x46f1b3
lea eax, [ebp - 0x3510]
call fcn.0047e4d0
call fcn.0047d960
call fcn.004481c8
cmp byte [ebp + 0x14], 0
je 0x46f1d3
lea eax, [ebp - 0x3510]
call fcn.0040ba30
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x46f1d7
xor eax, eax
jmp 0x46f1dc
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x10]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 8]
call fcn.0046f2ac
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.00412dcc
test eax, eax
jne 0x46f22b
cmp dword [0x4c3df0], 0
je 0x46f177
dec dword [0x4c3de8]
mov eax, dword [0x4c3df0]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x2459], dl
mov word [ebp - 0x2440], 0x14
test eax, eax
je 0x46f262
mov eax, esi
call fcn.0046b474
xor edx, edx
mov dword [0x4c3df0], edx
jmp 0x46f269
mov eax, esi
call fcn.0046b788
test bl, bl
je 0x46f278
push dword [0x4c144c]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.00412d70
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x470031
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.004931a4
pop ecx
mov edi, eax
test edi, edi
jne 0x470054
mov eax, 1
xor edx, edx
jmp 0x4700e7
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x4700ab
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x47007a
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x470075
push edi
call fcn.00492fcc
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00498ed0
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x474648
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff6cc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0x10]
lea esi, [ebp - 0x44]
push 0x3c
push 0
push esi
call fcn.00494848
add esp, 0xc
mov dword [esi], 0x3c
mov dword [esi + 4], 0x500
test bl, bl
jne 0x47468b
or dword [esi + 4], 0x40
mov dword [esi + 0x10], edi
cmp dword [ebp + 8], 0
je 0x47469c
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
jmp 0x4746c0
lea edx, [ebp - 0x94]
mov ecx, 0x50
mov eax, dword [esi + 0x10]
call fcn.004730d8
test al, al
je 0x4746bb
lea edx, [ebp - 0x94]
jmp 0x4746bd
xor edx, edx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x14], ecx
call fcn.0040ba30
cmp edi, eax
jne 0x4746f5
push edi
push str.._s
lea edx, [ebp - 0x894]
push edx
call fcn.00497928
add esp, 0xc
lea ecx, [ebp - 0x894]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], 1
call fcn.0040ff8c
test eax, eax
je 0x4747c0
mov eax, dword [ebp - 4]
call fcn.0040ed7c
cmp word [eax], 0
je 0x4747c0
xor edi, edi
push str.shell32.dll
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x474738
push str.ShellExecuteExW
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
test edi, edi
jne 0x474743
xor eax, eax
jmp 0x474876
mov edx, dword [ebp - 4]
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x474769
lea edx, [ebp - 0x934]
mov ecx, 0x10000000
call fcn.00410004
lea edx, [ebp - 0x934]
mov dword [esi + 0xc], edx
cmp dword [ebp - 8], 0
je 0x47478b
lea edx, [ebp - 0x1134]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.00410004
lea eax, [ebp - 0x1134]
mov dword [esi + 0x18], eax
cmp dword [ebp + 0x14], 0
je 0x4747ad
lea edx, [ebp - 0x1934]
mov ecx, 0x10000000
mov eax, dword [ebp + 0x14]
call fcn.00410004
lea edx, [ebp - 0x1934]
mov dword [esi + 0x14], edx
mov byte [0x4c3dec], 1
push esi
call edi
mov byte [0x4c3dec], 0
jmp 0x4747d4
mov byte [0x4c3dec], 1
push esi
call sub.SHELL32.DLL_ShellExecuteExA
mov byte [0x4c3dec], 0
test eax, eax
je 0x4747e4
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x483
jne 0x4747eb
xor eax, eax
jmp 0x474876
test bl, bl
jne 0x474874
mov eax, dword [esi + 0x38]
test eax, eax
je 0x474833
mov edx, dword [0x4a8294]
mov dword [edx*4 + 0x4c9b14], eax
mov ecx, dword [0x4a8294]
mov eax, dword [esi + 0x20]
mov dword [ecx*4 + 0x4c9b54], eax
mov edx, dword [0x4a8294]
inc edx
and edx, 0x8000000f
jns 0x47482b
dec edx
or edx, 0xfffffff0
inc edx
mov dword [0x4a8294], edx
jmp 0x474866
xor ebx, ebx
mov eax, dword [ebx*4 + 0x4c9b54]
cmp eax, dword [esi + 0x20]
jne 0x474860
push 0
push dword [ebx*4 + 0x4c9b14]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x474860
mov edx, dword [ebx*4 + 0x4c9b14]
mov dword [esi + 0x38], edx
inc ebx
cmp ebx, 0x10
jl 0x474835
cmp dword [ebp + 0xc], 0
je 0x474874
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x38]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x475afc
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4c3e04
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x475b33
push 0x40
mov eax, 0x2bc
call fcn.00411fe8
push eax
mov eax, 0x2bd
call fcn.00411fe8
push eax
push dword [0x4c1440]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4c3e04
xor ecx, ecx
mov eax, ebx
call fcn.00474d58
pop ebx
ret

Function at 0x475b48
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffb64
mov esi, ecx
mov ebx, edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.00473e6a
test al, al
je 0x475b94
push 0x30
mov eax, 0x65
call fcn.00411fe8
push eax
mov eax, 0x596
call fcn.00411fe8
push eax
push dword [0x4c1440]
call sub.USER32.DLL_MessageBoxA
jmp 0x475d52
cmp dword [0x4c3de0], 0
jne 0x475bd1
push 0
push 1
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00474648
test al, al
jne 0x475d52
push ebx
mov eax, 0x201
call fcn.00411fe8
push eax
call fcn.0044e1d4
add esp, 8
jmp 0x475d52
mov edx, esp
mov eax, str.Rar_EXXXXXXX
call fcn.0046e4b4
test al, al
je 0x475d52
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.0049635c
pop ecx
lea edx, [esp + 0x800]
mov eax, 0x4c219c
call fcn.00462424
call fcn.00456acc
mov ecx, 0x4ba2b4
mov edx, 0x4b9eb4
mov eax, 0x4c219c
call fcn.004623f0
mov ecx, dword [esp + 0x810]
mov dword [0x4b8a6c], ecx
mov edx, 0x4a82be
mov eax, dword [0x4baab4]
call fcn.0040f744
call fcn.00457628
mov eax, 0x4c219c
xor ecx, ecx
xor edx, edx
call fcn.0045d418
cmp dword [0x4c3df4], 0
jne 0x475d52
lea edx, [esp + 0x89c]
mov eax, ebx
call fcn.0040bb40
lea edx, [esp + 0xc9c]
mov eax, esi
call fcn.0040bc68
lea edx, [esp + 0x89c]
lea eax, [esp + 0x89c]
call fcn.0040a978
lea edx, [esp + 0xc9c]
lea eax, [esp + 0xc9c]
call fcn.0040a9c0
push 0x200c
push 0
push 0x4cddbc
call fcn.00494848
add esp, 0xc
lea ecx, [esp + 0x89c]
push ecx
push 0x4ce9c5
call fcn.004949c8
add esp, 8
mov eax, 0x4cedc6
lea edx, [esp + 0xc9c]
call fcn.00410200
push 0x4b9eb4
push 0x4cddc0
call fcn.004949c8
add esp, 8
mov edx, 0x4ba2b4
mov eax, 0x4ce1c0
call fcn.00410200
push esp
push 0x4cf5c6
call fcn.004949c8
add esp, 8
lea ecx, [esp + 0x400]
push ecx
call fcn.0049635c
pop ecx
mov eax, dword [0x4b8a6c]
cmp dword [esp + 0x88c], 0
setne dl
push 0x4cddbc
and edx, 1
mov dword [0x4ce9c0], eax
push 0x10000
push 0x473ed0
mov byte [0x4ce9c4], dl
call fcn.0049cc6c
add esp, 0xc
add esp, 0x149c
pop esi
pop ebx
ret
Function at 0x47c762
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
push eax
push dword [0x4c144c]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
push esp
push esi
call fcn.0049497c
add esp, 8
test eax, eax
je 0x47c79f
push esi
push ebx
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x47d960
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xfffffe00
mov eax, dword [0x4c144c]
test eax, eax
je 0x47da0d
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4cff7c], 8
je 0x47d9b2
push 0x4cff80
lea ecx, [esp + 4]
push ecx
call fcn.0049497c
add esp, 8
test eax, eax
je 0x47d9b2
push 0x4cff80
push dword [0x4c144c]
call sub.USER32.DLL_SetWindowTextA
mov eax, dword [0x4cff7c]
test eax, eax
je 0x47d9ca
cmp eax, 1
je 0x47d9ca
cmp eax, 2
je 0x47d9ca
cmp eax, 8
jne 0x47d9ef
mov edx, 0x4d0000
mov eax, 0x9c
call fcn.0047c762
mov eax, 0x4d0080
call fcn.0040ba30
mov edx, eax
mov eax, 0x9b
call fcn.0047c762
mov edx, 0x64
mov eax, 2
call fcn.00448b10
test al, al
je 0x47da0d
push dword [0x4c144c]
call sub.USER32.DLL_UpdateWindow
add esp, 0x200
ret