joyce8/EMBER2024-capa huggingface dataset:
Function at 0x466020
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46603b
xor eax, eax
jmp 0x4660a8
lea eax, [ebp - 0x404]
mov ecx, 0x400
mov edx, ebx
call fcn.0040ffdc
lea eax, [ebp - 0x404]
push eax
call fcn.0049fe04
pop ecx
lea edx, [ebp - 0x424]
mov byte [ebp + eax - 0x403], 0
push 0x1e
push 0
push edx
call fcn.0049fc54
mov dword [ebp - 0x420], 3
mov word [ebp - 0x414], 0x14
add esp, 0xc
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x41c], ecx
lea eax, [ebp - 0x424]
push eax
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4667e4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x400]
mov edx, 0x400
call fcn.00466df0
lea eax, [ebp - 0x400]
call fcn.0040ca00
push ebx
lea edx, [ebp - 0x400]
push edx
call fcn.0049fcf8
add esp, 8
lea eax, [ebp - 0x400]
call fcn.0040aee4
test eax, eax
je 0x46683f
push 0
lea edx, [ebp - 0x400]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x466867
lea ecx, [ebp - 0x400]
mov eax, 0x1f7
push ecx
call fcn.00413388
push eax
call fcn.0048a820
add esp, 8
mov eax, 0x4bb2e4
call fcn.0042ed78
xor eax, eax
jmp 0x466879
lea edx, [ebp - 0x400]
push edx
push esi
call fcn.0049fdd4
add esp, 8
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x466c38
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.USER32.DLL_GetDesktopWindow
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [ebp - 4]
call sub.GDI32.DLL_GetObjectA
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x14], eax
push 0xcc0020
push dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
neg edx
push edx
push 0
mov ecx, dword [ebp - 0x28]
dec ecx
push ecx
push ebx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [ebp - 0x10]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [ebp - 0x14]
push esi
call sub.GDI32.DLL_SelectObject
push dword [ebp - 0xc]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push dword [ebp - 8]
call sub.USER32.DLL_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x466df0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x4b3443
push esi
mov edx, 0x4b346c
mov eax, 0x4b3466
mov ecx, ebx
call fcn.00463c14
mov byte [ebp - 0x400], 0
cmp byte [ebx], 0
je 0x466e47
push 0x400
lea eax, [ebp - 0x400]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x466e47
lea edx, [ebp - 0x400]
mov ecx, esi
mov eax, ebx
call fcn.0040ffdc
cmp byte [ebx], 0
je 0x466e57
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x466e75
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x466e67
cmp byte [ebx], 0
jne 0x466e75
push str._rartemp
push ebx
call fcn.0049fdd4
add esp, 8
mov eax, ebx
call fcn.0040ca00
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46701c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x84], 2
jne 0x46705f
cmp dword [ebp - 0x90], 5
ja 0x467063
cmp dword [ebp - 0x90], 5
jne 0x46705f
cmp dword [ebp - 0x8c], 0
ja 0x467063
xor eax, eax
jmp 0x467068
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x46794c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x467955
mov eax, dword [ebp - 4]
add esp, 0xfffffaf0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4b363c
call fcn.004a0204
call fcn.004a82c8
mov dword [ebp - 0x2458], eax
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x467998
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.0041408c
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x2900]
call fcn.00414bf8
lea eax, [ebp - 0x28d4]
call fcn.00414bf8
lea eax, [ebp - 0x28a8]
call fcn.00414bf8
inc dword [0x4d27dc]
jmp 0x467a85
test bl, bl
jne 0x467a1b
call fcn.004a82c8
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x467a1b
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.00476300
mov bl, 1
test bl, bl
je 0x467a2f
lea eax, [ebp - 0x3514]
call fcn.004781e0
call fcn.004774b8
call fcn.00480728
cmp byte [ebp + 0x18], 0
je 0x467a4f
lea eax, [ebp - 0x3514]
call fcn.0040c4d0
lea edx, [ebp - 0x3514]
cmp eax, edx
jne 0x467a53
xor eax, eax
jmp 0x467a58
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x14]
lea eax, [ebp - 0x3514]
push edx
lea edx, [ebp - 0x3114]
mov cl, byte [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x3514]
push dword [ebp + 0xc]
call fcn.00467b40
lea edx, [ebp - 0x3514]
lea eax, [ebp - 0x242c]
call fcn.004141cc
test eax, eax
jne 0x467aa7
cmp dword [0x4d27e4], 0
je 0x4679f3
dec dword [0x4d27dc]
cmp dword [0x4d27e4], 0
sete cl
and ecx, 1
mov byte [ebp - 0x2459], cl
mov word [ebp - 0x2440], 0x14
cmp dword [0x4d27e4], 0
je 0x467ae3
mov eax, esi
call fcn.00463260
xor edx, edx
mov dword [0x4d27e4], edx
jmp 0x467aea
mov eax, esi
call fcn.00463538
cmp dword [ebp + 8], 0
je 0x467afa
call fcn.004786c4
mov edx, dword [ebp + 8]
mov byte [edx], al
test bl, bl
je 0x467b09
push dword [0x4cfe40]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.0041416c
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x468a5c
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
push 0x1000000
call fcn.0049e5e4
pop ecx
mov edi, eax
test edi, edi
jne 0x468a82
mov eax, 1
xor edx, edx
jmp 0x468b10
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x468ad9
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
mov cl, byte [edi + ebx]
sub ebx, 0x100
xor byte [edi + esi], cl
sub esi, 0x100
dec eax
test eax, eax
jg 0x468aa6
dec ebx
dec esi
add dword [ebp - 8], 1
adc dword [ebp - 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
jb 0x468aa1
push edi
call fcn.0049e420
pop ecx
push 0
push 0x64
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004a439c
add eax, 1
adc edx, 0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46e830
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4d27f8
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46e867
push 0x40
mov eax, 0x2bc
call fcn.00413388
push eax
mov eax, 0x2bd
call fcn.00413388
push eax
push dword [0x4cfe34]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4d27f8
xor ecx, ecx
mov eax, ebx
call fcn.0046d958
pop ebx
ret

Function at 0x46e87c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffb64
push ebx
push esi
mov esi, ecx
mov ebx, edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.0046c9e4
test al, al
je 0x46e8cb
push 0x30
mov eax, 0x65
call fcn.00413388
push eax
mov eax, 0x596
call fcn.00413388
push eax
push dword [0x4cfe34]
call sub.USER32.DLL_MessageBoxA
jmp 0x46eaaf
cmp dword [0x4d27d4], 0
jne 0x46e90a
push 0
push 0
push 1
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.0046d1b8
test al, al
jne 0x46eaaf
push ebx
mov eax, 0x201
call fcn.00413388
push eax
call fcn.0048a820
add esp, 8
jmp 0x46eaaf
lea edx, [ebp - 0x400]
mov eax, str.Rar_EXXXXXXX
call fcn.004667e4
test al, al
je 0x46eaaf
lea edx, [ebp - 0x800]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0x400]
push ecx
call fcn.004a186c
pop ecx
lea edx, [ebp - 0x89c]
mov eax, 0x4d0b94
call fcn.00458d98
call fcn.0044b01c
mov ecx, 0x4c7c88
mov edx, 0x4c7888
mov eax, 0x4d0b94
call fcn.00458d64
mov ecx, dword [ebp - 0x88c]
mov dword [0x4c6438], ecx
mov edx, 0x4b3ab6
mov eax, dword [0x4c8488]
call fcn.004107b8
call fcn.0044bbdc
mov dword [0x4c6024], 4
mov eax, 0x4d0b94
xor ecx, ecx
xor edx, edx
call fcn.00454664
cmp dword [0x4d27e8], 0
jne 0x46eaaf
lea edx, [ebp - 0xc9c]
mov eax, ebx
call fcn.0040c608
lea edx, [ebp - 0x149c]
mov eax, esi
call fcn.0040c738
lea edx, [ebp - 0xc9c]
lea eax, [ebp - 0xc9c]
call fcn.0040adf8
lea edx, [ebp - 0x149c]
lea eax, [ebp - 0x149c]
call fcn.0040ae48
push 0x2010
push 0
push 0x4da990
call fcn.0049fc54
add esp, 0xc
lea ecx, [ebp - 0xc9c]
push ecx
push 0x4db59d
call fcn.0049fdd4
add esp, 8
lea edx, [ebp - 0x149c]
mov eax, 0x4db99e
call fcn.00411488
push 0x4c7888
push 0x4da995
call fcn.0049fdd4
add esp, 8
mov edx, 0x4c7c88
mov eax, 0x4dad96
call fcn.00411488
lea ecx, [ebp - 0x400]
push ecx
push 0x4dc19e
call fcn.0049fdd4
add esp, 8
lea eax, [ebp - 0x800]
push eax
call fcn.004a186c
cmp dword [ebp - 0x810], 0
mov byte [0x4da994], 0
pop ecx
mov edx, dword [0x4c6438]
mov dword [0x4db598], edx
je 0x46ea89
cmp byte [0x4d2752], 0
je 0x46ea8d
xor ecx, ecx
jmp 0x46ea92
mov ecx, 1
mov byte [0x4db59c], cl
push 0x4da990
push 0x10000
push 0x46ca48
call fcn.004a8148
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475813
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb6c
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
mov edi, edx
mov dword [ebp - 0x54], eax
mov eax, 0x4b4bd8
call fcn.004a0204
push str.winrar_config_integration
push 0x10000
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x47585f
mov eax, dword [ebp - 0x50]
mov dword fs:[0], eax
jmp 0x475a5f
push 0
push 0
push 0
push 2
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov word [ebp - 0x40], 8
mov esi, eax
mov word [ebp - 0x40], 0x14
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00412b10
add dword [ebp - 0x34], 2
mov word [ebp - 0x40], 0x20
test edi, edi
je 0x4758cc
lea eax, [ebp - 0x20]
mov dl, 0x49
call fcn.00412ca4
lea eax, [ebp - 0x20]
mov dl, 0x1a
call fcn.00412ca4
lea eax, [ebp - 0x20]
mov ecx, 0x1a
mov edx, edi
call fcn.00412d78
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x58]
call fcn.004757de
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x14]
call fcn.004757de
cmp dword [ebp + 0x10], 0
je 0x4758fd
lea eax, [ebp - 0x20]
mov dl, 0x54
call fcn.00412ca4
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x10]
call fcn.004757de
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0xc]
call fcn.004757de
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 8]
call fcn.004757de
mov word [ebp - 0x40], 0x2c
lea eax, [ebp - 0x2c]
call fcn.00402138
inc dword [ebp - 0x34]
lea edx, [ebp - 0x2c]
mov word [ebp - 0x40], 0x20
lea eax, [ebp - 0x20]
call fcn.00412e48
cmp dword [ebp - 0x28], 0x10000
jle 0x475964
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004017f0
sub dword [ebp - 0x34], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00412b90
mov ecx, dword [ebp - 0x50]
mov dword fs:[0], ecx
jmp 0x475a5f
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.0049fbe4
add esp, 0xc
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push 0x400
lea eax, [ebp - 0x458]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov dword [ebp - 0x494], 0x3c
mov dword [ebp - 0x490], 0x40
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x48c], edx
xor eax, eax
mov dword [ebp - 0x488], str.runas
mov dword [ebp - 0x484], ecx
xor edx, edx
mov dword [ebp - 0x480], str._setup_integration
mov dword [ebp - 0x47c], 0x4b4a30
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], edx
lea ecx, [ebp - 0x494]
push ecx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
je 0x475a0b
push 0xffffffffffffffff
push dword [ebp - 0x45c]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [ebp - 0x45c]
call sub.KERNEL32.DLL_CloseHandle
push ebx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004017f0
sub dword [ebp - 0x34], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00412b90
mov word [ebp - 0x40], 8
mov word [ebp - 0x40], 0
jmp 0x475a55
mov edx, dword [ebp - 0x50]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x475c40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffdc0
push ebx
push esi
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, 0x4b4734
lea eax, [ebp - 0x404]
call fcn.0040cbd4
lea eax, [ebp - 0x404]
call fcn.0040ca00
lea edx, [esi + 0x390]
push edx
lea ecx, [ebp - 0x404]
push ecx
call fcn.0049fcf8
add esp, 8
lea eax, [ebp - 0x404]
push eax
lea edx, [ebp - 0x804]
push edx
call fcn.0049fdd4
add esp, 8
test bl, bl
je 0x475cb7
lea edx, [esi + 0x39d]
lea eax, [esi + 8]
mov ecx, 1
call fcn.00463b18
jmp 0x475cfe
lea edx, [ebp - 0x404]
lea eax, [esi + 0x390]
mov cl, 1
call fcn.0040cc78
lea eax, [ebp - 0x404]
xor edx, edx
call fcn.0040a918
test al, al
jne 0x475cfe
cmp byte [ebp - 1], 0
je 0x475ce8
xor eax, eax
jmp 0x475e78
lea edx, [ebp - 0x804]
push edx
lea ecx, [ebp - 0x404]
push ecx
call fcn.0049fdd4
add esp, 8
cmp byte [ebp - 1], 0
jne 0x475d38
lea eax, [esi + 0x3ae]
test bl, bl
push eax
mov eax, 0x5b4
push ebx
jne 0x475d16
inc eax
call fcn.00413388
mov edx, eax
lea ecx, [ebp - 0x404]
mov eax, dword [0x4cfe34]
call fcn.0044f828
test al, al
jne 0x475d38
xor eax, eax
jmp 0x475e78
lea edx, [ebp - 0x404]
test bl, bl
push edx
je 0x475d4b
lea ecx, [esi + 0x3b4]
jmp 0x475d51
lea ecx, [esi + 0x3df]
push ecx
lea eax, [ebp - 0xd04]
push eax
call fcn.004a2e18
add esp, 0xc
lea edx, [ebp - 0xd40]
push 0x3c
push 0
push edx
call fcn.0049fc54
mov dword [ebp - 0xd40], 0x3c
mov dword [ebp - 0xd3c], 0x40
mov eax, dword [0x4cfe34]
lea edx, [esi + 0x3e7]
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0xd30], edx
lea ecx, [ebp - 0xd04]
add esp, 0xc
mov dword [ebp - 0xd2c], ecx
lea eax, [ebp - 0xd40]
mov dword [ebp - 0xd24], 1
push eax
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 2], dl
cmp byte [ebp - 2], 0
je 0x475ded
push 0x1388
push dword [ebp - 0xd08]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [ebp - 0xd08]
call sub.KERNEL32.DLL_CloseHandle
test bl, bl
je 0x475dff
lea edx, [esi + 0x39d]
lea eax, [esi + 8]
call fcn.00463ef8
cmp byte [ebp - 2], 0
je 0x475e55
test bl, bl
jne 0x475e0e
call fcn.00475e80
lea ecx, [ebp - 0x404]
push ecx
mov eax, 0x460
test bl, bl
jne 0x475e1f
inc eax
call fcn.00413388
push eax
lea edx, [ebp - 0x1240]
push edx
call fcn.004a2e18
add esp, 0xc
mov eax, 0x2ee
push 0
call fcn.00413388
push eax
lea edx, [ebp - 0x1240]
push edx
push dword [0x4cfe34]
call sub.USER32.DLL_MessageBoxA
jmp 0x475e75
cmp byte [ebp - 1], 0
jne 0x475e75
lea ecx, [ebp - 0xd04]
mov eax, 0x201
push ecx
call fcn.00413388
push eax
call fcn.0048a820
add esp, 8
mov al, byte [ebp - 2]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x475f8c
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffbe4
push ebx
push esi
push edi
push str.winrar_config_integration
push 0
push 4
call sub.KERNEL32.DLL_OpenFileMappingA
mov edi, eax
test edi, edi
je 0x4760b9
push 0x10000
push 0
push 0
push 4
push edi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
test esi, esi
jne 0x475fd9
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4760b9
mov ebx, esi
xor eax, eax
mov al, byte [esi]
cmp eax, 0x49
jne 0x47604a
xor edx, edx
mov dl, byte [esi + 1]
cmp edx, 0x1a
jne 0x47604a
push 0x1a
lea ecx, [esi + 2]
push ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.0049fbe4
add esp, 0xc
lea ebx, [esi + 0x1c]
lea edx, [ebp - 0x41c]
mov ecx, 0x400
mov eax, ebx
call fcn.00475a68
mov ebx, eax
lea edx, [ebp - 0x81c]
mov ecx, 0x400
mov eax, ebx
call fcn.00475a68
mov ebx, eax
test ebx, ebx
je 0x47604a
lea eax, [ebp - 0x1c]
xor edx, edx
call fcn.004660b0
lea edx, [ebp - 0x81c]
lea eax, [ebp - 0x41c]
call fcn.00475793
xor ecx, ecx
mov cl, byte [ebx]
cmp ecx, 0x54
jne 0x4760ad
inc ebx
lea edx, [ebp - 0xc1c]
mov ecx, 0x400
mov eax, ebx
call fcn.00475a68
mov ebx, eax
lea edx, [ebp - 0x101c]
mov ecx, 0x400
mov eax, ebx
call fcn.00475a68
mov ebx, eax
lea edx, [ebp - 0x141c]
mov ecx, 0x400
mov eax, ebx
call fcn.00475a68
mov ebx, eax
test ebx, ebx
je 0x4760ad
push 0
lea ecx, [ebp - 0x141c]
lea edx, [ebp - 0x101c]
lea eax, [ebp - 0xc1c]
call fcn.004662ac
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push edi
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4774b8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
cmp dword [0x4cfe40], 0
je 0x47758b
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push dword [0x4cfe40]
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4dcb84], 8
je 0x477516
push 0x4dd788
lea edx, [ebp - 0x200]
push edx
call fcn.0049fd88
add esp, 8
test eax, eax
je 0x477516
push 0x4dd788
push dword [0x4cfe40]
call sub.USER32.DLL_SetWindowTextA
cmp dword [0x4dcb84], 0
je 0x47753a
cmp dword [0x4dcb84], 1
je 0x47753a
cmp dword [0x4dcb84], 2
je 0x47753a
cmp dword [0x4dcb84], 8
jne 0x47756d
mov edx, 0x4dd808
xor ecx, ecx
mov eax, 0x9c
call fcn.00476154
mov eax, 0x4dcf88
call fcn.0040c568
push eax
mov eax, 0x4dcb88
call fcn.0040c4d0
mov edx, eax
mov eax, 0x9b
pop ecx
call fcn.00476154
mov edx, 0x64
mov eax, 2
call fcn.004811dc
test al, al
je 0x47758b
push dword [0x4cfe40]
call sub.USER32.DLL_UpdateWindow
mov esp, ebp
pop ebp
ret
Function at 0x478808
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x47882e
mov eax, str.comctl32.dll
call fcn.00466938
mov dword [ebx + 8], eax
cmp dword [ebx], 0
je 0x47883a
push dword [ebx]
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x4bb91c]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x478872
mov ecx, str.ComboBoxEx32
jmp 0x478877
mov ecx, str.combobox
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x478924
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4d65d8]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.00478c9c
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x407
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x478937
call fcn.00466f70
jmp 0x478937
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x478964
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x478964
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.004789c8
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x4789b5
call fcn.00466e84
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x4789af
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push 0x4b4d0b
push eax
call fcn.004a2e18
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.00478c9c
inc esi
cmp esi, 0x20
jl 0x478973
mov eax, ebx
call fcn.00478e2c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x478c9c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x1c]
push 0x408
call fcn.0049e444
pop ecx
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [ebp + 0x20]
mov dword [esi + 4], edx
mov eax, dword [ebp - 4]
call fcn.0040fd60
push eax
lea edx, [esi + 8]
push edx
call fcn.0049fdd4
add esp, 8
cmp byte [ebx + 4], 0
je 0x478e03
cmp dword [ebx + 8], 0x50000
jb 0x478d05
cmp dword [0x4d314c], 4
jne 0x478d09
cmp dword [0x4d3150], 0
jne 0x478d09
mov byte [ebp + 8], 0
cmp byte [ebp + 8], 0
jne 0x478d1a
cmp edi, 0xffffffff
je 0x478d1e
cmp dword [ebp + 0x18], 0
je 0x478d1e
xor eax, eax
jmp 0x478d23
mov eax, 1
test al, al
je 0x478d66
cmp dword [ebp - 8], 2
mov eax, 0x4201
jne 0x478d35
or eax, 2
push eax
push 0x160
lea edx, [ebp - 0x168]
push edx
push 0
push dword [ebp - 4]
call sub.SHELL32.DLL_SHGetFileInfoA
cmp edi, 0xffffffff
jne 0x478d57
mov edi, dword [ebp - 0x164]
cmp dword [ebp + 0x18], 0
jne 0x478d66
lea eax, [ebp - 0x15c]
mov dword [ebp + 0x18], eax
push 0x24
push 0
lea edx, [ebp - 0x18c]
push edx
call fcn.0049fc54
add esp, 0xc
mov dword [ebp - 0x18c], 0x37
cmp dword [ebp + 0x18], 0
je 0x478d8e
mov ecx, dword [ebp + 0x18]
jmp 0x478d91
or ecx, 0xffffffff
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x16c], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x17c], edi
mov dword [ebp - 0x178], edi
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x170], edx
cmp dword [ebp + 0x14], 0
je 0x478dea
call fcn.0041113c
test eax, eax
je 0x478dea
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x18c]
mov dword [ebp - 0x184], eax
push edx
push 0
push 0x40b
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x478e23
lea ecx, [ebp - 0x18c]
push ecx
push 0
push 0x401
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x478e23
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x14a
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push esi
push eax
push 0x151
push dword [ebx]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c