joyce8/EMBER2024-capa huggingface dataset:
Function at 0x450f4c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
push eax
add esp, 0xfffffab4
mov edi, edx
mov esi, eax
lea ebx, [esp + 0x500]
mov eax, 0x426
call fcn.00410804
push eax
lea edx, [esp + 4]
push edx
call fcn.00482a00
add esp, 8
push 3
push 0x4971e1
lea ecx, [esp + 8]
push ecx
call fcn.00482a30
pop ecx
lea edx, [esp + 9]
add eax, edx
push eax
call fcn.00482810
add esp, 0xc
lea eax, [esp + 0x100]
mov word [eax], 0
push 0x4c
push 0
push ebx
call fcn.00482880
add esp, 0xc
mov dword [ebx], 0x4c
mov dword [ebx + 4], esi
mov ecx, dword [0x49edec]
lea eax, [esp + 0x100]
mov dword [ebx + 8], ecx
mov dword [ebx + 0x1c], eax
mov dword [ebx + 0x20], pe_nt_image_headers32
mov dword [ebx + 0x44], 0x450694
mov dword [ebx + 0x34], 0x9036c
mov eax, 0x451
call fcn.00410804
mov dword [ebx + 0x30], eax
mov dword [ebx + 0x40], edi
call fcn.0040e9e0
test eax, eax
je 0x4510ad
mov eax, 0x426
call fcn.00410804
lea edx, [esp + 0x54c]
mov ecx, 0x10000000
call fcn.0040ea48
lea eax, [esp + 0x54c]
call fcn.0040eab0
add eax, eax
lea edx, [esp + 0x54e]
add eax, edx
mov edx, 0x4971e4
call fcn.0040eac4
lea eax, [esp + 0x54c]
call fcn.0040eab0
mov word [esp + eax*2 + 0x54e], 0
lea edx, [esp + 0x74c]
mov ecx, 0x10000000
mov eax, dword [ebx + 0x30]
call fcn.0040ea48
lea eax, [esp + 0x54c]
lea edx, [esp + 0x74c]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x30], edx
mov ecx, 0x4971e8
lea eax, [esp + 0x94c]
mov dword [ebx + 0x48], ecx
push eax
push 0x800
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea edx, [esp + 0x94c]
mov dword [ebx + 0x2c], edx
push ebx
call sub.COMDLG32.DLL_GetOpenFileNameW
jmp 0x4510db
mov ecx, esp
mov dword [ebx + 0xc], ecx
mov dword [ebx + 0x48], str.OKCANCELTPL
lea eax, [esp + 0x114c]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea edx, [esp + 0x114c]
mov dword [ebx + 0x2c], edx
push ebx
call sub.COMDLG32.DLL_GetOpenFileNameA
add esp, 0x154c
pop edi
pop esi
pop ebx
ret
Function at 0x45324c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
mov eax, 0x4974dc
push ebx
push esi
push edi
call fcn.00482ea0
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne dl
and edx, 1
mov byte [0x4baa56], dl
cmp byte [0x4baa56], 0
jne 0x45328b
cmp dword [0x4afc0c], 0
jne 0x45328b
xor ebx, ebx
jmp 0x453290
mov ebx, 1
push 8
call fcn.00481038
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4532b8
mov word [ebp - 0x1c], 0x14
mov eax, dword [ebp - 4]
call fcn.00451a98
mov word [ebp - 0x1c], 8
mov esi, dword [ebp - 4]
jmp 0x4532bb
mov esi, dword [ebp - 4]
push 0x36a4
call fcn.00481038
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x4532e8
mov word [ebp - 0x1c], 0x2c
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0045112c
mov word [ebp - 0x1c], 0x20
mov edi, dword [ebp - 8]
jmp 0x4532eb
mov edi, dword [ebp - 8]
mov byte [0x4baa55], 0
mov byte [0x4baa57], 0
mov byte [0x4baa54], 1
lea eax, [ebp - 0x30]
push eax
test bl, bl
je 0x45330f
mov edx, 3
jmp 0x453314
mov edx, 1
push edx
push esi
push edi
call sub.OLE32.DLL_DoDragDrop
mov ebx, eax
mov byte [0x4baa54], 0
push edi
mov eax, dword [edi]
call dword [eax + 8]
push esi
mov ecx, dword [esi]
call dword [ecx + 8]
cmp byte [0x4baa56], 0
je 0x45335a
cmp dword [0x4afc0c], 0
je 0x45335a
cmp ebx, 0x40100
jne 0x45335a
call fcn.00442d50
mov eax, 0x4ad5bc
call fcn.0045b6f8
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x453787
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dl, 1
mov eax, ebx
call fcn.0040b0f8
mov edx, ebx
mov eax, ebx
call fcn.0040aa34
xor edx, edx
mov eax, ebx
call fcn.0040b160
jmp 0x453809
test esi, 2
setne cl
push dword [ebp + 0x10]
and ecx, 1
lea eax, [ebp - 1]
push ecx
mov ecx, edi
mov edx, ebx
call fcn.004555d0
mov al, byte [ebp - 1]
sub al, 0x41
je 0x4537e5
sub al, 2
je 0x453802
sub al, 0xb
je 0x453802
sub al, 0xb
je 0x4537e5
jmp 0x453809
push 0
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
test esi, 1
jne 0x4537fb
push ebx
call sub.KERNEL32.DLL_DeleteFileA
mov eax, 0x59
jmp 0x453819
xor eax, eax
mov al, byte [ebp - 1]
jmp 0x453819
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4537b4
mov eax, 0x59
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0x10
Function at 0x4545f8
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff7c
mov ebx, eax
mov edi, esp
mov ebp, str.Formats.fmt
lea eax, [ebx + 4]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov esi, eax
mov dword [ebx + 0x404], esi
test esi, esi
jne 0x454627
xor eax, eax
jmp 0x4547c7
lea edx, [ebp + 0x29]
push edx
push esi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x48c], eax
lea ecx, [ebp + 0x31]
push ecx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x490], eax
lea eax, [ebp + 0x36]
push eax
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x494], eax
lea edx, [ebp + 0x3c]
push edx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x498], eax
lea ecx, [ebp + 0x48]
push ecx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x49c], eax
lea eax, [ebp + 0x54]
push eax
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4a0], eax
lea edx, [ebp + 0x5c]
push edx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4a4], eax
cmp dword [ebx + 0x48c], 0
je 0x4546c7
cmp dword [ebx + 0x490], 0
jne 0x4546ce
xor eax, eax
jmp 0x4547c7
push 0x84
push 0
push edi
call fcn.00482880
add esp, 0xc
mov dword [edi], 0x84
mov dword [edi + 4], 0x453614
mov dword [edi + 8], 0x4536e9
mov dword [edi + 0xc], 0x4536fc
mov dword [edi + 0x10], 0x453711
mov dword [edi + 0x14], 0x453770
mov dword [edi + 0x18], 0x453821
mov dword [edi + 0x1c], 0x453835
mov dword [edi + 0x20], 0x453840
mov dword [edi + 0x24], 0x4538cf
mov dword [edi + 0x28], 0x453903
mov dword [edi + 0x2c], 0x453987
mov dword [edi + 0x30], 0x453c07
mov dword [edi + 0x34], 0x453c16
mov dword [edi + 0x38], 0x453ca7
mov dword [edi + 0x3c], fcn.00453787
mov dword [edi + 0x40], 0x453d39
mov dword [edi + 0x44], 0x453d5d
push 0x84
push 0
lea edx, [ebx + 0x408]
push edx
call fcn.00482880
add esp, 0xc
lea ecx, [ebx + 0x408]
mov dword [ebx + 0x408], 0x84
push ecx
push edi
call dword [ebx + 0x48c]
cmp dword [ebx + 0x488], 0
je 0x4547c5
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
mov dword [ebx + 0x404], eax
lea eax, [ebx + 4]
call fcn.0040a924
push eax
mov eax, 0x42e
call fcn.00410804
push eax
call fcn.00447a48
add esp, 8
xor eax, eax
jmp 0x4547c7
mov al, 1
add esp, 0x84
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x454abc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7d8
push ebx
push esi
push edi
mov byte [ebp - 0x25], dl
mov ebx, eax
mov eax, 0x497a9c
call fcn.00482ea0
push 0
cmp byte [0x4a77c2], 0
je 0x454ae9
mov eax, 2
jmp 0x454aee
mov eax, 1
mov edx, 0x4a84b8
mov cl, byte [ebp - 0x25]
call fcn.0046aa14
mov byte [ebp - 0x26], al
lea eax, [ebp - 0x428]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov dl, byte [0x4a7c89]
mov byte [ebp - 0x27], dl
mov byte [0x4a7c89], 0
cmp byte [ebp - 0x27], 0
je 0x454b68
mov eax, 0x4a84b8
call fcn.0040a924
push eax
lea edx, [ebp - 0x828]
push edx
call fcn.00482a00
add esp, 8
lea eax, [ebp - 0x828]
xor edx, edx
call fcn.0040ac28
lea eax, [ebp - 0x828]
xor ecx, ecx
xor edx, edx
call fcn.004095e0
lea eax, [ebp - 0x828]
push eax
call fcn.00484424
pop ecx
mov word [ebp - 0x14], 8
mov edx, dword [0x4a7c9c]
mov eax, dword [ebx + edx*4 + 0x104]
mov edx, dword [eax]
call dword [edx]
mov word [ebp - 0x14], 0
jmp 0x454b9f
mov dl, byte [ebp - 0x27]
mov byte [0x4a7c89], dl
lea ecx, [ebp - 0x428]
push ecx
call fcn.00484424
pop ecx
cmp dword [0x4afc10], 0
jne 0x454bcf
cmp byte [ebp - 0x26], 0
je 0x454bcf
push dword [0x4ad5b4]
call sub.USER32.DLL_DestroyWindow
mov eax, dword [ebp - 0x24]
mov dword fs:[0], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x454c40
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff3d8
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov edi, 0x4a5e34
mov eax, 0x497ae4
call fcn.00482ea0
cmp dword [edi + 0x18c4], 0
jne 0x454c6f
cmp dword [edi + 0x18c0], 0
je 0x454ccf
cmp dword [edi + 0x18c4], 0x80000000
jne 0x454cb4
cmp dword [edi + 0x18c0], 0
jne 0x454cb4
cmp byte [edi + 0x18e1], 0
jne 0x454cb4
lea edx, [edi + 0x2684]
push edx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x454cb4
mov dword [edi + 0x18c0], 0
mov dword [edi + 0x18c4], 0
mov eax, dword [0x4aa970]
and eax, 0x18
test eax, eax
je 0x454ccf
cmp dword [edi + 0x18a8], 0
je 0x454ccf
or dword [edi + 0x18a8], eax
lea ecx, [edi + 8]
lea edx, [edi + 0x2684]
mov eax, esi
call fcn.00455244
mov eax, dword [edi + 0x1e68]
call fcn.00440b2c
mov word [ebp - 0x818], 8
mov edx, edi
lea eax, [ebp - 0x804]
call fcn.00467bcc
inc dword [ebp - 0x80c]
mov word [ebp - 0x818], 0x14
cmp byte [edi + 0x18e6], 0
je 0x454d34
cmp dword [edi + 0x1e68], 0
je 0x454d34
lea edx, [edi + 0x18e7]
lea eax, [edi + 0x2684]
xor ecx, ecx
call fcn.0040b6c4
lea eax, [edi + 0x2684]
xor edx, edx
call fcn.00409944
test al, al
je 0x454dc3
cmp dword [0x4afc0c], 0
je 0x454d55
mov byte [esi + 0x1c3a], 1
push 1
push 0
lea edx, [edi + 0x2684]
xor ecx, ecx
mov eax, esi
call fcn.00457b40
dec eax
jne 0x454dc3
mov eax, dword [esi + 0x208]
test eax, eax
je 0x454dc3
dec eax
je 0x454dc3
push 0x30
mov eax, 0x65
call fcn.00410804
push eax
mov eax, 0x1fd
call fcn.00410804
push eax
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
dec dword [ebp - 0x80c]
lea eax, [ebp - 0x804]
mov edx, 2
call fcn.00467ca0
mov ecx, dword [ebp - 0x828]
mov dword fs:[0], ecx
jmp 0x454e78
push 0
lea edx, [edi + 0x2684]
mov ecx, ebx
xor eax, eax
call fcn.0046aa14
mov ebx, eax
mov eax, dword [edi + 0x1e68]
mov eax, dword [esi + eax*4 + 0x104]
mov edx, dword [eax]
call dword [edx + 8]
cmp dword [0x4afc10], 0
jne 0x454e00
test bl, bl
je 0x454e00
push dword [0x4ad5b4]
call sub.USER32.DLL_DestroyWindow
lea edx, [ebp - 0xc28]
lea eax, [edi + 0x2684]
call fcn.00409cf4
push 0x5c
lea ecx, [ebp - 0xc28]
push ecx
call fcn.00482b55
add esp, 8
test eax, eax
je 0x454e3d
lea edx, [ebp - 0xc28]
cmp eax, edx
je 0x454e3d
xor ecx, ecx
mov cl, byte [eax - 1]
cmp ecx, 0x3a
je 0x454e3d
mov byte [eax], 0
push 0
lea eax, [ebp - 0xc28]
push eax
push 0x2001
push 0x1000
call sub.SHELL32.DLL_SHChangeNotify
dec dword [ebp - 0x80c]
lea eax, [ebp - 0x804]
mov edx, 2
call fcn.00467ca0
mov ecx, dword [ebp - 0x828]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455244
Capabilities:
Check if file exists
Get common file path
Get disk information
Get file attributes

Disassembly:
push ebx
mov ebx, ecx
add esp, 0xfffffc00
mov edx, 0x497745
mov byte [ebx], 0
mov eax, 0x49773f
push 0x4976e5
push 0x400
lea ecx, [esp + 8]
call fcn.00460a70
cmp byte [esp], 0
je 0x4552cf
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x455289
push esp
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
mov edx, 0x497750
mov eax, 0x49773f
mov ecx, 1
call fcn.00460c28
test eax, eax
je 0x4552be
push 0
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x4552b2
cmp eax, 5
jne 0x4552c8
push esp
push ebx
call fcn.00482a00
add esp, 8
jmp 0x4552c8
push esp
push ebx
call fcn.00482a00
add esp, 8
mov eax, ebx
call fcn.0040adfc
add esp, 0x400
pop ebx
ret
Function at 0x45a990
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
mov ebx, eax
push eax
add esp, 0xfffffe10
mov eax, dword [ebx + 0x524]
test eax, eax
je 0x45ab81
mov edi, dword [ebx + eax*4 + 0x4a0]
xor eax, eax
mov dword [esp], eax
test edi, edi
je 0x45ab81
push esp
push 0x20
push dword [ebx]
push edi
mov edx, dword [edi]
call dword [edx + 0x10]
test eax, eax
jne 0x45ab81
cmp dword [esp], 0
je 0x45ab81
xor ecx, ecx
xor ebp, ebp
mov dword [esp + 4], ecx
jmp 0x45ab5a
mov dword [esp + 0xc], 0x10000000
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 8]
push edx
push 1
push edi
mov ecx, dword [edi]
call dword [ecx + 0x24]
test byte [esp + 0xf], 0x10
je 0x45aa26
lea eax, [esp + 0x10]
xor ecx, ecx
push eax
mov eax, edi
mov edx, dword [esp + 8]
call fcn.0045ff4c
test eax, eax
jne 0x45aa3b
push dword [esp + 4]
mov edx, dword [0x4bbf94]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
jmp 0x45ab5a
mov eax, dword [ebx + 0x524]
mov edx, dword [esp + 4]
mov eax, dword [ebx + eax*4 + 0x420]
call fcn.0045febc
mov esi, eax
push 0x4409
push 0x160
lea eax, [esp + 0x418]
push eax
push 0
push esi
call sub.SHELL32.DLL_SHGetFileInfoA
push esi
mov edx, dword [0x4bbf94]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
mov dword [esp + 0x570], 7
mov dword [esp + 0x574], ebp
xor edx, edx
mov eax, dword [esp + 0x414]
lea ecx, [esp + 0x10]
mov dword [esp + 0x58c], eax
mov dword [esp + 0x578], edx
mov dword [esp + 0x584], ecx
push 0xc30
push 0
lea eax, [esp + 0x5a0]
push eax
call fcn.00482880
add esp, 0xc
mov edx, dword [esp + 4]
mov dword [esp + 0x11c0], edx
mov dword [esp + 0x11b4], 0x20
push dword [esp + 0x584]
lea ecx, [esp + 0x59c]
push ecx
call fcn.00482a00
add esp, 8
mov eax, 0x4bb27c
mov dword [esp + 0x11a8], 0x10
lea edx, [esp + 0x598]
call fcn.00460190
mov dword [esp + 0x590], eax
lea ecx, [esp + 0x570]
push ecx
push 0
push 0x1007
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov dword [esp + 0x11d0], 2
lea edx, [esp + 0x520]
lea ecx, [esp + 0x11c8]
mov dword [esp + 0x11dc], edx
push ecx
push eax
push 0x102e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
inc ebp
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 1
mov edx, dword [esp + 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 0xc]
test eax, eax
je 0x45a9ef
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
add esp, 0x11f0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45bb3c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
mov esi, str.name
mov ebx, edx
push eax
add esp, 0xfffffa34
lea edx, [esi + 4]
mov edi, ecx
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
push edx
mov edx, ebx
push 0x100
mov eax, 0x80000000
call fcn.00460a8c
cmp byte [esp + 4], 0
je 0x45bb87
lea ecx, [esp + 4]
push ecx
push edi
call fcn.00482a00
add esp, 8
push ebx
lea eax, [esi + 0x8e]
push eax
lea edx, [esp + 0x10c]
push edx
call fcn.00486578
add esp, 0xc
lea ecx, [esp + 0x1cc]
push ecx
lea eax, [esi + 4]
push eax
push 0x800
lea ecx, [esi + 4]
lea edx, [esp + 0x110]
mov eax, 0x80000000
call fcn.00460a8c
test al, al
jne 0x45bc86
push ebx
lea edx, [esi + 0x9d]
push edx
lea ecx, [esp + 0x10c]
push ecx
call fcn.00486578
add esp, 0xc
lea eax, [esp + 0x9cc]
push eax
lea edx, [esi + 4]
push edx
push 0x400
lea ecx, [esi + 4]
lea edx, [esp + 0x110]
mov eax, 0x80000000
call fcn.00460a8c
test al, al
jne 0x45bc14
xor eax, eax
jmp 0x45bd07
xor edx, edx
mov dl, byte [esp + 0x9cc]
cmp edx, 0x22
jne 0x45bc2b
lea ecx, [esp + 0x9cd]
jmp 0x45bc32
lea ecx, [esp + 0x9cc]
push ecx
lea eax, [esp + 0x1d0]
push eax
call fcn.00482a00
add esp, 8
push 0x22
lea edx, [esp + 0x1d0]
push edx
call fcn.00482b3d
add esp, 8
test eax, eax
je 0x45bc5c
mov byte [eax], 0
lea eax, [esi + 0xb3]
push eax
lea edx, [esp + 0x1d0]
push edx
call fcn.00482b61
add esp, 8
test eax, eax
je 0x45bc7a
mov byte [eax], 0
lea eax, [esp + 0x1cc]
call fcn.0040d864
lea edx, [esi + 0xb3]
push edx
lea ecx, [esp + 0x1d0]
push ecx
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x45bca5
xor eax, eax
jmp 0x45bd07
xor esi, esi
push 0x800
lea eax, [esp + 0xdd0]
push eax
lea edx, [esp + 0x1d4]
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push 0x2c
lea ecx, [esp + 0xdd0]
push ecx
call fcn.00482b55
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45bce8
lea esi, [ebx + 1]
push esi
call fcn.00489f1c
pop ecx
mov esi, eax
mov byte [ebx], 0
xor eax, eax
mov dword [esp], eax
push 1
lea edx, [esp + 4]
push edx
push 0
push esi
lea ecx, [esp + 0xddc]
push ecx
call sub.SHELL32.DLL_ExtractIconExA
mov eax, dword [esp]
add esp, 0x15cc
pop edi
pop esi
pop ebx
ret
Function at 0x45ce2c
Capabilities:
Copy file

Disassembly:
push ebx
add esp, 0xfffff004
push eax
add esp, 0xfffffc00
mov ebx, eax
cmp byte [0x49ede8], 0
jne 0x45cf3f
mov edx, esp
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.0045900c
mov eax, esp
call fcn.0040a924
mov edx, str.rarkey.rar
call fcn.0040d81c
test eax, eax
jne 0x45cf3f
mov edx, str.rarreg.key
mov eax, ebx
call fcn.0045ab8c
test eax, eax
je 0x45cf3f
lea edx, [esp + 0x800]
lea eax, [esp + 0x400]
call fcn.004450dc
test al, al
je 0x45cf3f
push 0x400
lea ecx, [esp + 0x1004]
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push str.rarreg.key
lea eax, [esp + 0x1004]
call fcn.0040a924
push eax
call fcn.00482a00
add esp, 8
push 0
lea edx, [esp + 0x1004]
push edx
lea ecx, [esp + 0x408]
push ecx
call sub.KERNEL32.DLL_CopyFileA
lea eax, [esp + 0x400]
push eax
call fcn.00485848
pop ecx
push dword [0x4ad5a8]
call sub.USER32.DLL_SetForegroundWindow
mov al, 1
call fcn.0040cfd0
mov byte [0x49ede8], al
mov eax, 0x4ad5bc
call fcn.0045b6f8
cmp byte [0x49ede8], 0
je 0x45cf3f
push 0x30
mov eax, 0x368
call fcn.00410804
push eax
mov eax, 0x367
call fcn.00410804
push eax
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
add esp, 0x1400
pop ebx
ret

Function at 0x45cf48
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff200
mov ebp, ecx
mov ebx, edx
mov edi, eax
push ebx
lea eax, [esp + 4]
push eax
call fcn.00482a00
add esp, 8
mov edx, 0x400
lea eax, [esp + 0x800]
call fcn.00462ca0
lea ecx, [esp + 0x400]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x800]
push eax
call fcn.00482a30
pop ecx
mov ecx, eax
lea eax, [esp + 0x800]
mov edx, ebx
call fcn.0040d840
test eax, eax
je 0x45cfe1
push 0x5c
lea ecx, [esp + 4]
push ecx
call fcn.00482b55
add esp, 8
mov esi, eax
test eax, eax
je 0x45cfe1
mov edx, esp
cmp esi, edx
jbe 0x45cfe1
mov al, byte [esi - 1]
xor edx, edx
mov dl, al
cmp edx, 0x3a
je 0x45cfe1
cmp edx, 0x5c
je 0x45cfe1
mov byte [esi], 0
push esp
call fcn.00484424
pop ecx
push 1
mov ecx, ebp
mov edx, ebx
mov eax, edi
call fcn.0045cc58
cmp eax, 1
je 0x45d06c
cmp eax, 2
je 0x45d05a
inc eax
jne 0x45d019
push ebx
mov eax, 0x1f5
call fcn.00410804
push eax
lea edx, [esp + 0xc08]
push edx
call fcn.00486578
add esp, 0xc
jmp 0x45d03a
mov eax, 0x1fc
call fcn.00410804
push eax
push ebx
push str._s_n_s
lea edx, [esp + 0xc0c]
push edx
call fcn.00486578
add esp, 0x10
push 0x10
mov eax, 0x66
call fcn.00410804
push eax
lea edx, [esp + 0xc08]
push edx
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
lea ecx, [esp + 0x400]
push ecx
call fcn.00484424
pop ecx
xor eax, eax
jmp 0x45d06e
mov al, 1
add esp, 0xe00
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45d07c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffff7f8
mov ebp, ecx
mov edi, edx
mov esi, eax
push 0x498104
push edi
call fcn.004829b4
add esp, 8
test eax, eax
sete bl
and ebx, 1
cmp byte [esi + 0x421], 0
je 0x45d0fd
xor eax, eax
test bl, bl
mov dword [esp], eax
je 0x45d0c2
mov dword [esp], 1
push 0x49820d
push edi
call fcn.004829b4
add esp, 8
test eax, eax
jne 0x45d0dd
mov edx, dword [esi + 0x524]
mov dword [esp], edx
cmp dword [esp], 0
je 0x45d0fd
xor ecx, ecx
mov edx, dword [esp]
mov eax, esi
call fcn.0045e520
xor edx, edx
mov eax, esi
call fcn.00459fd8
jmp 0x45d2e8
mov eax, esi
call fcn.0045f29c
cmp dword [0x4afc0c], 0
je 0x45d1ef
mov edx, str.FlatView
mov eax, 0x498107
xor ecx, ecx
call fcn.00460c28
test eax, eax
je 0x45d12e
test bl, bl
je 0x45d2e8
lea edx, [esp + 8]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.00458fe0
push 0x49820d
push edi
call fcn.004829b4
add esp, 8
test eax, eax
je 0x45d181
mov eax, 0x4adfd0
mov ecx, ebp
mov edx, edi
call fcn.00458ef4
test eax, eax
je 0x45d181
test bl, bl
je 0x45d173
lea eax, [esp + 8]
call fcn.0040a924
mov edx, eax
jmp 0x45d175
xor edx, edx
mov eax, esi
call fcn.0045ac8c
jmp 0x45d2e8
lea edx, [esp + 0x408]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.0045900c
lea eax, [esp + 0x408]
push eax
lea edx, [esp + 0x80c]
push edx
call fcn.00482a00
add esp, 8
lea eax, [esp + 0x808]
call fcn.0040ae9c
lea eax, [esp + 0x808]
xor edx, edx
call fcn.00462d1c
mov eax, esi
call fcn.0045edf0
test al, al
je 0x45d2e8
lea eax, [esp + 0x408]
call fcn.0040a924
mov edx, eax
mov eax, esi
call fcn.00459fd8
jmp 0x45d2e8
lea edx, [esp + 0xc08]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x45d2b2
lea ecx, [esp + 0xc08]
push ecx
lea eax, [esp + 0x100c]
push eax
call fcn.00482a00
add esp, 8
lea edx, [esp + 0x1408]
lea eax, [esp + 0xc08]
call fcn.0040b2d8
lea eax, [esp + 0x1008]
call fcn.0040adfc
lea eax, [esp + 0x1408]
call fcn.0040adfc
lea edx, [esp + 0x1408]
lea eax, [esp + 0x1008]
call fcn.0040d81c
test eax, eax
jne 0x45d2b2
cmp dword [esi + 0x524], 0
jle 0x45d275
mov byte [esi + 0x421], 1
jmp 0x45d2a7
xor edx, edx
mov dword [esp + 4], edx
lea ecx, [esp + 4]
push ecx
push 0x11
push dword [esi]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, 0x4ad5bc
mov edx, dword [esp + 4]
call fcn.0045f1fc
push dword [esp + 4]
mov ecx, dword [0x4bbf94]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
xor edx, edx
mov eax, esi
call fcn.00459fd8
jmp 0x45d2e8
mov edx, ebp
mov eax, edi
call fcn.00462d1c
test al, al
jne 0x45d2cb
mov eax, 0x49820d
xor edx, edx
call fcn.00462d1c
test bl, bl
je 0x45d2df
lea eax, [esp + 0xc08]
call fcn.0040a924
mov edx, eax
jmp 0x45d2e1
xor edx, edx
mov eax, esi
call fcn.00459fd8
add esp, 0x1808
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45db88
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
add esp, 0xffffffec
mov ebx, eax
push esp
call sub.USER32.DLL_GetCursorPos
push esp
push dword [ebx]
call sub.USER32.DLL_ScreenToClient
mov eax, esp
push eax
push 0
push 0x1012
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne bl
and ebx, 1
push 0x12
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
push 0x11
mov esi, eax
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
test byte [esp + 8], 1
jne 0x45dbf3
test ebx, ebx
jne 0x45dbf3
test esi, esi
jne 0x45dbf3
test eax, eax
je 0x45dbf7
xor edx, edx
jmp 0x45dbfc
mov edx, 1
mov eax, edx
add esp, 0x14
pop esi
pop ebx
ret

Function at 0x45dc78
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffa78
mov ebx, eax
push 0
push 0
push 0x1004
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov esi, eax
mov eax, esp
mov edx, 0x400
call fcn.00462ca0
push 0x4001
push 0x160
lea ecx, [esp + 0x408]
push ecx
push 0
lea eax, [esp + 0x10]
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
push 0x28
push 0
lea edx, [esp + 0x568]
push edx
call fcn.00482880
add esp, 0xc
xor eax, eax
mov dword [esp + 0x560], 3
mov ecx, dword [esp + 0x404]
mov dword [esp + 0x57c], ecx
mov dword [esp + 0x564], esi
mov dword [esp + 0x568], eax
mov eax, 0x3d4
call fcn.00410804
mov dword [esp + 0x574], eax
lea edx, [esp + 0x560]
push edx
push 0
push 0x1007
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebx]
call sub.USER32.DLL_SetFocus
mov byte [ebx + 0x20], 1
push 0
push esi
push 0x1017
push dword [ebx]
call sub.USER32.DLL_SendMessageA
add esp, 0x588
pop esi
pop ebx
ret