joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5750bc
Capabilities:
Delete file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x5750d2
add esp, 0xfffffff0
call fcn.00404a98
mov esi, ecx
mov ebx, edx
mov edi, eax
xor eax, eax
push ebp
push 0x575226
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [edi + 4]
mov edx, esi
call fcn.004056ec
lea edx, [ebp - 4]
mov eax, esi
call fcn.0040b440
mov edx, dword [ebp - 4]
lea eax, [edi + 8]
mov ecx, 0x575254
call fcn.004059b0
mov dl, 1
mov eax, dword [0x41dce4]
call fcn.00404704
mov dword [edi + 0x10], eax
mov dl, 1
mov eax, dword [0x41dce4]
call fcn.00404704
mov dword [edi + 0x14], eax
mov dl, 1
mov eax, dword [0x41dce4]
call fcn.00404704
mov dword [edi + 0x18], eax
mov dl, 1
mov eax, dword [0x41dce4]
call fcn.00404704
mov dword [edi + 0x1c], eax
mov dl, 1
mov eax, dword [0x41dce4]
call fcn.00404704
mov dword [edi + 0x20], eax
mov dl, 1
mov eax, dword [0x41dce4]
call fcn.00404704
mov dword [edi + 0x24], eax
mov byte [edi + 0x3c], 0
xor eax, eax
mov dword [edi + 0x38], eax
mov eax, dword [0x5d170c]
mov eax, dword [eax]
call fcn.00405b28
push eax
push 0
push 0x575260
push 0x575268
call sub.kernel32.dll_GetPrivateProfileIntA
mov esi, eax
mov eax, esi
cdq
push edx
push eax
call fcn.0040dbb0
call fcn.004035a8
sub dword [esp], eax
sbb dword [esp + 4], edx
pop eax
pop edx
test edx, edx
jge 0x5751b0
neg eax
adc edx, 0
neg edx
cmp edx, 0
jne 0x5751bc
cmp eax, 0xf
jb 0x575205
jmp 0x5751be
jl 0x575205
mov eax, dword [edi + 8]
call fcn.00405b28
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, dword [0x5d170c]
mov eax, dword [eax]
call fcn.00405b28
push eax
call fcn.0040dbb0
call fcn.004035a8
push edx
push eax
lea eax, [ebp - 8]
call fcn.0040ac6c
mov eax, dword [ebp - 8]
call fcn.00405b28
push eax
push 0x575260
push 0x575268
call sub.kernel32.dll_WritePrivateProfileStringA
mov eax, edi
mov edx, dword [eax]
call dword [edx]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57522d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056bc
ret

Function at 0x576ba0
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
xor ecx, ecx
mov edx, 0x40
call fcn.00403b60
ret
Function at 0x59faac
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp - 4]
mov edx, dword [ebp - 8]
dec edx
test edx, edx
jl 0x59fb51
inc edx
mov dword [ebp - 0x10], edx
mov edx, dword [eax]
and edx, 0xffff
or edx, 2
mov dword [ebp - 0xc], edx
movzx edx, byte [esi]
mov ebx, dword [ebp - 0xc]
xor ebx, 1
imul ebx, dword [ebp - 0xc]
shr ebx, 8
xor dl, bl
mov byte [esi], dl
mov edx, dword [ecx]
movzx ebx, byte [esi]
xor dl, bl
movzx edx, dl
mov edx, dword [edx*4 + 0x5d05f8]
mov ebx, dword [ecx]
shr ebx, 8
and ebx, 0xffffff
xor edx, ebx
mov dword [ecx], edx
mov edx, dword [ecx]
and edx, 0xff
add dword [edi], edx
mov edx, dword [edi]
imul edx, dword [ebp + 8]
inc edx
mov dword [edi], edx
mov edx, dword [eax]
mov ebx, dword [edi]
shr ebx, 0x18
xor dl, bl
movzx edx, dl
mov edx, dword [edx*4 + 0x5d05f8]
mov ebx, dword [eax]
shr ebx, 8
and ebx, 0xffffff
xor edx, ebx
mov dword [eax], edx
inc esi
dec dword [ebp - 0x10]
jne 0x59fad4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x5a14c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.kernel32.dll_GetTempPathA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.0040b8a4
mov eax, dword [ebx]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x5a1509
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x5a151e
mov eax, ebx
mov edx, 0x5a152c
call fcn.00405964
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a5410
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
xor ecx, ecx
mov edx, 0x94
call fcn.00403b60
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 5
jb 0x5a5446
cmp dword [esp + 8], 1
jb 0x5a5446
cmp dword [esp + 0x10], 2
je 0x5a544a
xor eax, eax
jmp 0x5a544c
mov al, 1
add esp, 0x94
ret

Function at 0x5a5454
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov eax, esp
xor ecx, ecx
mov edx, 0x94
call fcn.00403b60
mov dword [esp], 0x94
push esp
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 4], 6
jne 0x5a548a
cmp dword [esp + 8], 0
jne 0x5a548a
cmp dword [esp + 0x10], 2
je 0x5a548e
xor eax, eax
jmp 0x5a5490
mov al, 1
add esp, 0x94
ret

Function at 0x5b93a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.005b9368
mov eax, dword [ebx]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x5b93e1
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x5b93f6
mov eax, ebx
mov edx, 0x5b9404
call fcn.00405964
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5b9408
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
mov ebx, eax
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
mov edx, ebx
lea eax, [ebp - 0x104]
call fcn.005b9368
mov eax, dword [ebx]
mov dword [ebp - 0x108], eax
mov eax, dword [ebp - 0x108]
test eax, eax
je 0x5b9449
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x5b945e
mov eax, ebx
mov edx, 0x5b946c
call fcn.00405964
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5c2c0c
Capabilities:
Terminate process

Disassembly:
push 0
call sub.kernel32.dll_GetCurrentProcessId
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
ret

Function at 0x5c2d3c
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, eax
push edx
push 0
push 0xc
push ebx
call sub.user32.dll_SendMessageA
push 0
push 0xd
push pe_nt_image_headers32
push ebx
call sub.user32.dll_PostMessageA
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
ret
Function at 0x5c3ff8
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x5c4000
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00405b18
mov esi, 0x5da61c
xor eax, eax
push ebp
push 0x5c422b
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov eax, dword [0x5d16ec]
cmp byte [eax], 6
jbe 0x5c4055
lea edx, [ebp - 0x10]
mov eax, dword [0x5d170c]
mov eax, dword [eax]
call fcn.0040b440
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x5c4244
call fcn.004059b0
jmp 0x5c4077
lea eax, [ebp - 0x14]
call fcn.005324c8
push dword [ebp - 0x14]
push 0x5c4258
push 0x5c4244
lea eax, [ebp - 8]
mov edx, 3
call fcn.00405a2c
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x41dee4]
call fcn.00422f9c
mov dword [ebp - 0xc], eax
cmp dword [esi], 0
je 0x5c409a
mov eax, dword [esi]
call fcn.00404734
xor ecx, ecx
mov dl, 1
mov eax, dword [0x559160]
call fcn.0053625c
mov dword [esi], eax
xor eax, eax
push ebp
push 0x5c40cf
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [esi]
call fcn.005596e4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5c40fb
mov eax, dword [esi]
call fcn.0054aeb0
mov eax, dword [esi]
call fcn.00404734
xor eax, eax
mov dword [esi], eax
mov esi, dword [0x5d16c4]
mov esi, dword [esi]
mov edx, dword [0x5d16c4]
mov edx, dword [edx]
lea eax, [ebp - 0x18]
mov ecx, 0x5c428c
call fcn.004059b0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x1c]
call fcn.00405b28
push eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
call fcn.00405b28
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov edx, dword [0x5d16c4]
mov edx, dword [edx]
mov eax, dword [ebp - 0xc]
call fcn.005c3f74
test al, al
je 0x5c4195
mov edx, dword [0x5d16c4]
mov edx, dword [edx]
lea eax, [ebp - 0x24]
mov ecx, 0x5c428c
call fcn.004059b0
mov esi, dword [ebp - 0x24]
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
call fcn.00405b28
push eax
call sub.kernel32.dll_DeleteFileA
cmp eax, 1
sbb eax, eax
inc eax
jmp 0x5c41d8
mov edx, dword [0x5d16c4]
mov edx, dword [edx]
lea eax, [ebp - 0x28]
mov ecx, 0x5c428c
call fcn.004059b0
mov esi, dword [ebp - 0x28]
mov edi, dword [0x5d16c4]
mov edi, dword [edi]
mov dword [ebp - 0x1c], edi
mov eax, dword [ebp - 0x1c]
call fcn.00405b28
push eax
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
call fcn.00405b28
push eax
call sub.kernel32.dll_MoveFileA
cmp eax, 1
sbb eax, eax
inc eax
mov eax, dword [ebp - 0xc]
call fcn.00404734
mov eax, dword [ebp - 8]
call fcn.00405b28
push eax
call sub.kernel32.dll_DeleteFileA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c4232
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004056bc
lea eax, [ebp - 0x18]
call fcn.00405698
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004056bc
lea eax, [ebp - 8]
mov edx, 2
call fcn.004056bc
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
mov ecx, 0x1dfc40b0
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x1cc33a61
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x419ff0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x439efb
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x45e4c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov dword [ebx], 0
mov dword [ebp - 0x44], edx
mov dword [eax], 0
mov byte [edx], 0
mov edx, ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x34], eax
call fcn.00419eb0
mov dword [ebp - 4], 0
cmp dword [eax + 0x14], 8
jb 0x41a051
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push eax
call dword [0x43c188]
mov esi, eax
mov dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 8
jb 0x41a084
push dword [ebp - 0x28]
call fcn.00421a46
add esp, 4
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp esi, 0xffffffff
jne 0x41a0a4
xor al, al
jmp 0x41a1f1
push 0xc
call fcn.00421a96
add esp, 4
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 1
mov edi, dword [0x43c1a4]
test eax, eax
je 0x41a0de
mov dword [eax], 0x4557e4
mov byte [ebp - 4], 2
mov dword [eax], 0x455a08
mov dword [eax + 4], edi
mov dword [eax + 8], esi
mov byte [ebp - 4], 1
jmp 0x41a0e0
xor eax, eax
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 4
push 0
push 0
push 0
push 2
push 0
push esi
call dword [0x43c068]
mov esi, eax
test esi, esi
jne 0x41a10f
xor bl, bl
jmp 0x41a1e0
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], edi
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x2c], esi
call fcn.0041bf70
mov byte [ebp - 4], 5
push 0
push 0
push 0
push 4
push esi
call dword [0x43c120]
mov edi, eax
test edi, edi
jne 0x41a141
xor bl, bl
jmp 0x41a1d4
mov eax, dword [0x43c11c]
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x30]
push eax
mov dword [ebp - 0x2c], edi
call fcn.0041c000
mov byte [ebp - 4], 6
mov eax, 0x5a4d
cmp word [edi], ax
jne 0x41a18d
mov esi, dword [edi + 0x3c]
add esi, edi
cmp dword [esi], 0x4550
je 0x41a17b
mov dword [ebx], 1
jmp 0x41a1c6
movzx eax, word [esi + 4]
cmp eax, 0x14c
je 0x41a199
cmp eax, 0x8664
je 0x41a191
xor bl, bl
jmp 0x41a1c8
mov dword [ebx], 3
jmp 0x41a1bd
mov edx, edi
mov dword [ebx], 2
mov ecx, esi
call fcn.0041a210
test eax, eax
je 0x41a1bd
mov eax, dword [eax + 0x10]
test al, 1
je 0x41a1bd
test al, 2
jne 0x41a1bd
mov eax, dword [ebp - 0x44]
mov byte [eax], 1
mov ecx, dword [ebp - 0x34]
movzx eax, word [esi + 0x5c]
mov dword [ecx], eax
mov bl, 1
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
call fcn.004154a0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x38]
call fcn.004154a0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004154a0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004210ea
mov esp, ebp
pop ebp
ret
Function at 0x401c60
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x2d0], eax
push ebx
mov ebx, ecx
push esi
mov esi, dword [esp + 0x2e0]
push edi
mov eax, dword [ebx]
mov edi, dword [esp + 0x2e8]
test eax, eax
je 0x401c94
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
mov dword [ebx + 4], 0xffffffff
push dword [0x5b681c]
push edi
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
push str.ComboBoxEx32
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0
push 4
push 0x408
push eax
mov dword [ebx], eax
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0
push 0x407
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x401cf1
push eax
call fcn.004ee2f0
mov eax, dword [ebx]
test eax, eax
je 0x401e04
push 0
push 0
push 0x14b
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
jne 0x401d81
push 0x4209
push 0x2b4
lea eax, [esp + 0x1c]
push eax
push 0
push dword [esp + 0x1c]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push eax
push 0
push 0x402
push dword [ebx]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x5e3c10]
push dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x541740]
call esi
push 0
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x2c]
mov ecx, ebx
push eax
push dword [esp + 0x28]
push 0
push 1
push eax
call fcn.00401f70
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
test eax, eax
jne 0x401da9
push eax
push eax
push dword [esp + 0x18]
mov ecx, ebx
call fcn.00401720
test al, al
jne 0x401dfd
push ebp
call fcn.004ec5f0
mov ebp, eax
xor edi, edi
mov esi, 1
test ebp, esi
je 0x401df4
lea eax, [edi + 0x41]
push eax
push str._c:_
lea eax, [esp + 0x2d4]
push 0xa
push eax
call fcn.00402c90
add esp, 0x10
lea eax, [esp + 0x2cc]
mov ecx, ebx
push 1
push 0xffffffffffffffff
push 2
push 0
push 0xffffffffffffffff
push 0
push 0
push eax
call fcn.00401f70
inc edi
rol esi, 1
cmp edi, 0x20
jl 0x401db8
pop ebp
mov ecx, ebx
call fcn.004024b0
mov ecx, dword [esp + 0x2dc]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x2d4
ret 8
Function at 0x401f70
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2e4
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x2e0], eax
push ebx
mov ebx, dword [esp + 0x2f0]
push ebp
mov ebp, dword [esp + 0x2f0]
push esi
mov esi, dword [esp + 0x304]
push edi
push 0x1008
mov dword [esp + 0x18], ecx
call fcn.0051da6d
mov ecx, dword [esp + 0x304]
add esp, 4
mov edi, eax
mov dword [esp + 0x10], edi
push 0x800
push ebp
mov dword [edi], ebx
mov dword [edi + 4], ecx
call fcn.004affc0
push eax
lea ecx, [edi + 8]
push ecx
call fcn.004b0360
cmp byte [esp + 0x314], 0
mov edi, dword [esp + 0x304]
jne 0x402060
cmp edi, 0xffffffff
je 0x402013
test esi, esi
jne 0x402060
xor eax, eax
cmp ebx, 2
sete al
lea eax, [eax*2 + 0x4201]
push eax
push 0x2b4
lea eax, [esp + 0x44]
push eax
push esi
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x40203e
xor eax, eax
cmp ebx, 2
sete al
lea eax, [eax*2 + 0x4201]
push eax
push 0x2b4
lea eax, [esp + 0x44]
push eax
push 0
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edi, dword [esp + 0x40]
test esi, esi
jne 0x402060
lea esi, [esp + 0x48]
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0x37
mov dword [esp + 0x20], esi
jmp 0x40208a
mov dword [esp + 0x24], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x18], 0x37
test esi, esi
je 0x402082
mov dword [esp + 0x20], esi
jmp 0x40208a
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [esp + 0x10]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x310]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30c]
mov dword [esp + 0x34], eax
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x18]
push 0
push 0x40b
mov dword [esp + 0x34], edi
push dword [eax]
mov dword [esp + 0x3c], edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x2f0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x2e4
ret 0x20
Function at 0x402298
Capabilities:
Check if file exists
Get file attributes
Get graphical window text

Disassembly:
mov eax, 0x2004
call fcn.0051dcc0
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x2000], eax
push esi
mov esi, ecx
lea eax, [esp + 4]
push 0x800
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [esp + 4]
push eax
call fcn.004cc0f0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 0x158
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x40240c
push 0
push eax
push 0x14e
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi]
test eax, eax
je 0x4023cb
push 0
push 0
push 0x147
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
je 0x4023cb
push edi
push 0
push eax
push 0x150
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4023ca
test edi, edi
je 0x4023ca
mov eax, dword [edi]
cmp eax, 5
ja case.0x402332.2
jmp dword [eax*4 + 0x402490]
push 0x800
lea eax, [esp + 0x100c]
push eax
call fcn.0044c720
test al, al
je case.0x402332.2
push 1
lea eax, [esp + 0x100c]
mov ecx, 0x5a84b0
push eax
call fcn.004501b0
jmp case.0x402332.2
push 1
lea eax, [edi + 8]
mov ecx, 0x5a84b0
push eax
call fcn.004501b0
jmp case.0x402332.2
mov ecx, 0x5a84b0
call fcn.004508c0
test al, al
je case.0x402332.2
push dword [edi + 4]
mov ecx, 0x5a84b0
call fcn.00457660
push 0
mov ecx, 0x5a84b0
call fcn.00455ed0
push dword [0x5a84e0]
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [0x5733b8], 0
jne 0x4023ca
mov ecx, esi
mov dword [0x5733b8], 1
call fcn.004024b0
dec dword [0x5733b8]
pop edi
cmp byte [0x57a0e0], 0
mov ecx, esi
je 0x4023f1
call fcn.00402a30
pop esi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.0051dca8
add esp, 0x2004
ret
call fcn.00402be0
pop esi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.0051dca8
add esp, 0x2004
ret
cmp byte [0x57a0e0], 0
je 0x402423
lea eax, [esp + 4]
push eax
call fcn.00494ef0
test al, al
je 0x402466
lea eax, [esp + 4]
push eax
call fcn.004b00c0
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x402466
test al, 0x10
jne 0x402466
lea eax, [esp + 4]
mov ecx, 0x5a84b0
push eax
call fcn.00453590
pop esi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.0051dca8
add esp, 0x2004
ret
push 1
lea eax, [esp + 8]
mov ecx, 0x5a84b0
push eax
call fcn.004501b0
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.0051dca8
add esp, 0x2004
ret
Function at 0x40c6b0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x814]
xor eax, eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x400
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
push eax
call fcn.004afad0
mov ebx, eax
test ebx, ebx
je 0x40c745
test esi, esi
jne 0x40c6fc
mov esi, 1
jmp 0x40c727
movzx eax, word [esp + 0xc]
mov ecx, 0x588ac0
push eax
call fcn.004738a0
test al, al
jne 0x40c727
cmp esi, 1
jne 0x40c726
movzx eax, word [esp + 0xc]
mov word [edi], ax
movzx eax, word [esp + 0xe]
mov word [edi + 2], ax
inc esi
push 0x400
lea eax, [esp + 0x10]
push eax
push ebx
call fcn.004afad0
mov ebx, eax
test ebx, ebx
jne 0x40c6f1
cmp esi, 2
jne 0x40c745
mov word [edi], ax
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x804
ret 4
Function at 0x40da00
Capabilities:
Copy file

Disassembly:
mov eax, 0x301c
call fcn.0051dcc0
mov eax, dword [0x572844]
xor eax, esp
mov dword [esp + 0x3018], eax
push ebx
mov ebx, dword [esp + 0x3024]
push ebp
push esi
push edi
call fcn.00487e30
test al, al
je 0x40dba9
call fcn.004ed9f0
test al, al
je 0x40dba9
push 0x800
lea eax, [esp + 0x202c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
movzx ebp, word [ebx]
mov esi, 0x20
mov dword [esp + 0x10], str.RarExtLogo.altform_unplated_targetsize_32.png
xor edi, edi
mov dword [esp + 0x14], str.RarExtLogo.altform_unplated_targetsize_48.png
mov dword [esp + 0x18], str.RarExtLogo.altform_unplated_targetsize_64.png
mov dword [esp + 0x1c], str.RarExtLogo_Default.altform_unplated_targetsize_32.png
mov dword [esp + 0x20], str.RarExtLogo_Default.altform_unplated_targetsize_48.png
mov dword [esp + 0x24], str.RarExtLogo_Default.altform_unplated_targetsize_64.png
lea esp, [esp]
push 0x800
lea eax, [esp + 0x202c]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.005267b2
push 0x800
lea eax, [esp + 0x2038]
push eax
lea eax, [esp + 0x103c]
push eax
call fcn.005267b2
add esp, 0x18
lea eax, [esp + 0x28]
push 0x800
push dword [esp + edi + 0x14]
push eax
call fcn.00495960
push 0x800
push dword [esp + edi + 0x20]
lea eax, [esp + 0x1030]
push eax
call fcn.00495960
lea eax, [esp + 0x1028]
push eax
call fcn.004837b0
test bp, bp
jne 0x40db46
test al, al
je 0x40dba9
lea eax, [esp + 0x28]
push eax
call fcn.004837b0
test al, al
je 0x40db27
lea eax, [esp + 0x28]
push eax
call fcn.004831b0
test al, al
je 0x40dbdb
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1030]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40dbdb
jmp 0x40db9a
test al, al
jne 0x40db63
push 0
lea eax, [esp + 0x102c]
push eax
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40dbdb
lea eax, [esp + 0x28]
push eax
call fcn.004837b0
test al, al
je 0x40db7f
lea eax, [esp + 0x28]
push eax
call fcn.004831b0
test al, al
je 0x40dbdb
push esi
push esi
lea eax, [esp + 0x30]
push eax
push ebx
call fcn.0040e600
lea eax, [esp + 0x28]
push eax
call fcn.004837b0
test al, al
je 0x40dbc6
add esi, 0x10
add edi, 4
cmp esi, 0x50
jb 0x40da90
mov al, 1
mov ecx, dword [esp + 0x3028]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0051dca8
add esp, 0x301c
ret 4
push 0
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x1030]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor al, al
jmp 0x40dbab