joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d500
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ac
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
lea ebx, [ebp - 0x254]
test edi, edi
je 0x44d549
push edi
push ebx
call fcn.00497c80
add esp, 8
push ebx
call fcn.00497cb0
pop ecx
inc eax
add ebx, eax
push edi
push ebx
call fcn.00497c80
add esp, 8
push ebx
call fcn.00497cb0
pop ecx
inc eax
add ebx, eax
mov eax, 0x426
call fcn.004125d0
push eax
push ebx
call fcn.00497c80
add esp, 8
push ebx
call fcn.00497cb0
pop ecx
inc eax
add ebx, eax
push 0x4a7b88
push ebx
call fcn.00497c80
add esp, 8
push ebx
call fcn.00497cb0
pop ecx
inc eax
add ebx, eax
mov byte [ebx], 0
push 0x4c
push 0
lea edx, [ebp - 0x54]
push edx
call fcn.00497b00
mov dword [ebp - 0x54], 0x4c
mov ecx, dword [ebp - 4]
mov eax, dword [0x4b2148]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], eax
lea edx, [ebp - 0x254]
mov eax, esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x400
mov ecx, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x24], ecx
call fcn.0040bd28
cmp esi, eax
jne 0x44d5e5
lea edx, [ebp - 0x654]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0x654]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x1080c
cmp byte [ebp + 8], 0
je 0x44d5ff
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetSaveFileNameA
mov ebx, eax
jmp 0x44d60a
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
jne 0x44d63b
call sub.COMDLG32.DLL_CommDlgExtendedError
cmp eax, 0x3002
jne 0x44d63b
mov byte [esi], 0
cmp byte [ebp + 8], 0
je 0x44d630
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetSaveFileNameA
mov ebx, eax
jmp 0x44d63b
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x44d64c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff328
push ebx
push esi
push edi
lea edi, [ebp - 0x80c]
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [edi], 0
xor esi, esi
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x88c]
mov eax, 0x4c5bc4
mov edx, esi
call fcn.00457968
test al, al
je 0x44d6d8
push edi
call fcn.00497cb0
pop ecx
push eax
lea eax, [ebp - 0x88c]
push eax
call fcn.00497cb0
pop ecx
pop edx
add edx, eax
cmp edx, 0x3f6
ja 0x44d6d8
test esi, esi
je 0x44d6b7
push 0x4a7b8a
push edi
call fcn.00497ba4
add esp, 8
push 0x4a7b8c
push edi
call fcn.00497ba4
add esp, 8
lea ecx, [ebp - 0x88c]
push ecx
push edi
call fcn.00497ba4
add esp, 8
inc ebx
jmp 0x44d66e
test ebx, ebx
je 0x44d6df
inc esi
jmp 0x44d66c
mov eax, 0x426
call fcn.004125d0
push eax
push edi
mov eax, 0x425
call fcn.004125d0
push eax
push edi
mov eax, 0x424
call fcn.004125d0
push eax
push 0x4a7b8f
lea edx, [ebp - 0x40c]
push edx
call fcn.0049abd0
add esp, 0x1c
cmp byte [ebp - 9], 0
je 0x44d758
mov eax, dword [ebp - 8]
call fcn.0040c118
mov ebx, eax
test ebx, ebx
je 0x44d758
inc ebx
push ebx
call fcn.00497cb0
pop ecx
cmp eax, 0x14
jge 0x44d758
mov eax, 0x426
call fcn.004125d0
push eax
push ebx
push ebx
push 0x4a7ba9
lea edx, [ebp - 0x40c]
push edx
call fcn.0049abd0
add esp, 0x14
xor eax, eax
jmp 0x44d770
and edx, 0xff
cmp edx, 9
jne 0x44d76f
mov byte [ebp + eax - 0x40c], 0
inc eax
mov dl, byte [ebp + eax - 0x40c]
test dl, dl
jne 0x44d75c
push 0x4c
push 0
lea eax, [ebp - 0x8d8]
push eax
call fcn.00497b00
mov dword [ebp - 0x8d8], 0x4c
mov ecx, dword [ebp - 4]
mov eax, dword [0x4b2148]
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8d0], eax
lea edx, [ebp - 0x40c]
add esp, 0xc
mov dword [ebp - 0x8cc], edx
mov eax, 0x48d
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x8bc], ecx
mov dword [ebp - 0x8b8], 0x400
cmp byte [ebp + 8], 0
jne 0x44d7db
add eax, 0xfffffcb3
call fcn.004125d0
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 8]
call fcn.0040bd28
cmp eax, dword [ebp - 8]
jne 0x44d810
lea edx, [ebp - 0xcd8]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0xcd8]
mov dword [ebp - 0x8ac], ecx
mov dword [ebp - 0x8a4], 0x1080c
mov dword [ebp - 0x89c], 0x4a7bb9
lea eax, [ebp - 0x8d8]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
jne 0x44d856
call sub.COMDLG32.DLL_CommDlgExtendedError
cmp eax, 0x3002
jne 0x44d856
mov eax, dword [ebp - 8]
mov byte [eax], 0
lea edx, [ebp - 0x8d8]
push edx
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x44d868
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffffab4
mov ebp, ecx
mov edi, edx
mov esi, eax
lea ebx, [esp + 0x500]
mov eax, 0x426
call fcn.004125d0
push eax
lea edx, [esp + 4]
push edx
call fcn.00497c80
add esp, 8
push 3
push 0x4a7bbd
lea ecx, [esp + 8]
push ecx
call fcn.00497cb0
pop ecx
lea edx, [esp + 9]
add eax, edx
push eax
call fcn.00497a90
add esp, 0xc
mov word [esp + 0x100], 0
push 0x4c
push 0
push ebx
call fcn.00497b00
add esp, 0xc
mov dword [ebx], 0x4c
mov dword [ebx + 4], esi
mov eax, dword [0x4b2148]
lea ecx, [esp + 0x100]
mov dword [ebx + 8], eax
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], pe_nt_image_headers32
mov dword [ebx + 0x44], 0x44cf64
mov dword [ebx + 0x34], 0x9036c
mov dword [ebx + 0x30], ebp
mov dword [ebx + 0x40], edi
call fcn.0041043c
test eax, eax
je 0x44d9be
mov eax, 0x426
call fcn.004125d0
lea edx, [esp + 0x54c]
mov ecx, 0x1000000
call fcn.004104b4
lea eax, [esp + 0x54c]
call fcn.00410768
add eax, eax
lea edx, [esp + 0x54e]
add eax, edx
mov edx, 0x4a7bc0
call fcn.0041077c
lea eax, [esp + 0x54c]
call fcn.00410768
mov word [esp + eax*2 + 0x54e], 0
lea edx, [esp + 0x74c]
mov ecx, 0x1000000
mov eax, dword [ebx + 0x30]
call fcn.004104b4
lea eax, [esp + 0x54c]
lea edx, [esp + 0x74c]
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x48], 0x4a7bc4
lea ecx, [esp + 0x94c]
push ecx
push 0x800
call sub.KERNEL32.DLL_GetCurrentDirectoryW
lea eax, [esp + 0x94c]
mov dword [ebx + 0x2c], eax
push ebx
call sub.COMDLG32.DLL_GetOpenFileNameW
jmp 0x44d9ec
mov edx, esp
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x48], 0x4a7bdc
lea ecx, [esp + 0x114c]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x114c]
mov dword [ebx + 0x2c], eax
push ebx
call sub.COMDLG32.DLL_GetOpenFileNameA
add esp, 0x154c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4501f4
Capabilities:
Check mutex on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
mov eax, 0x4a7eec
push ebx
push esi
push edi
call fcn.004980b0
cmp dword [0x4c780c], 0
je 0x450221
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4503bc
push 0x4a7c8b
push 0
push 0
call sub.KERNEL32.DLL_CreateMutexA
mov esi, eax
push 0
push esi
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x450268
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, 0x5b9
call fcn.004125d0
push eax
call fcn.00486954
pop ecx
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
mov eax, edx
jmp 0x4503bc
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne cl
and ecx, 1
mov byte [0x4c86aa], cl
cmp byte [0x4c86aa], 0
jne 0x450294
cmp dword [0x4c7804], 0
jne 0x450294
xor ebx, ebx
jmp 0x450299
mov ebx, 1
push 8
call fcn.004962f0
pop ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x4502c1
mov word [ebp - 0x1c], 0x14
mov eax, dword [ebp - 4]
call fcn.0044e4e0
mov word [ebp - 0x1c], 8
mov edi, dword [ebp - 4]
jmp 0x4502c4
mov edi, dword [ebp - 4]
push 0x4f24
call fcn.004962f0
pop ecx
mov dword [ebp - 8], eax
test eax, eax
je 0x4502f1
mov word [ebp - 0x1c], 0x2c
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.0044da3c
mov word [ebp - 0x1c], 0x20
mov edx, dword [ebp - 8]
jmp 0x4502f4
mov edx, dword [ebp - 8]
mov dword [ebp - 0x30], edx
mov byte [0x4c86a9], 0
mov byte [0x4c86ac], 0
mov byte [0x4c86a8], 1
mov byte [0x4c86ab], 0
lea eax, [ebp - 0x34]
push eax
mov ecx, 3
test bl, bl
jne 0x450323
add ecx, 0xfffffffe
push ecx
push edi
push dword [ebp - 0x30]
call sub.OLE32.DLL_DoDragDrop
mov ebx, eax
mov eax, dword [ebp - 0x30]
push eax
mov byte [0x4c86a8], 0
mov edx, dword [eax]
call dword [edx + 8]
push edi
mov ecx, dword [edi]
call dword [ecx + 8]
cmp byte [0x4c86aa], 0
je 0x45036e
cmp dword [0x4c7804], 0
je 0x45036e
cmp ebx, 0x40100
jne 0x45036e
call fcn.0048389c
mov eax, 0x4c4e78
call fcn.0045a154
push esi
call sub.KERNEL32.DLL_ReleaseMutex
push esi
call sub.KERNEL32.DLL_CloseHandle
cmp ebx, 0x40100
je 0x4503b2
cmp byte [0x4c86ab], 0
jne 0x4503b2
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x3f0
je 0x4503b2
mov eax, 0x53c
call fcn.004125d0
push eax
call fcn.00486954
pop ecx
mov eax, 0x4b1b14
call fcn.0042d7a8
mov edx, dword [ebp - 0x2c]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x451e7c
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff7c
mov ebx, eax
mov esi, esp
mov ebp, 0x4a80d0
lea eax, [ebx + 4]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov edi, eax
mov dword [ebx + 0x404], edi
test edi, edi
jne 0x451eab
xor eax, eax
jmp 0x4520a8
lea edx, [ebp + 0x29]
push edx
push edi
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x490], eax
lea ecx, [ebp + 0x31]
push ecx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x494], eax
lea eax, [ebp + 0x36]
push eax
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x498], eax
lea edx, [ebp + 0x3c]
push edx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x49c], eax
lea ecx, [ebp + 0x42]
push ecx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4a0], eax
lea eax, [ebp + 0x4e]
push eax
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4a4], eax
lea edx, [ebp + 0x5a]
push edx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4a8], eax
lea ecx, [ebp + 0x62]
push ecx
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebx + 0x4ac], eax
cmp dword [ebx + 0x490], 0
je 0x451f69
cmp dword [ebx + 0x494], 0
jne 0x451f70
cmp dword [ebx + 0x498], 0
jne 0x451f70
xor eax, eax
jmp 0x4520a8
push 0x84
push 0
push esi
call fcn.00497b00
add esp, 0xc
mov dword [esi], 0x84
mov dword [esi + 4], 0x45066c
mov dword [esi + 8], 0x4507ac
mov dword [esi + 0xc], 0x4507bf
mov dword [esi + 0x10], 0x4507d4
mov dword [esi + 0x14], 0x450833
mov dword [esi + 0x18], 0x4509f8
mov dword [esi + 0x1c], 0x450a0c
mov dword [esi + 0x20], 0x450a17
mov dword [esi + 0x24], 0x450acb
mov dword [esi + 0x28], 0x450b6f
mov dword [esi + 0x2c], 0x450ca3
mov dword [esi + 0x30], 0x451036
mov dword [esi + 0x34], 0x451045
mov dword [esi + 0x38], 0x45109c
mov dword [esi + 0x3c], fcn.0045084a
mov dword [esi + 0x40], 0x45112e
mov dword [esi + 0x44], 0x45114a
mov dword [esi + 0x48], 0x451178
mov dword [esi + 0x4c], 0x45118d
mov dword [esi + 0x50], 0x4511a2
mov dword [esi + 0x54], 0x4511b7
mov dword [esi + 0x58], 0x4511cc
mov dword [esi + 0x5c], 0x45122d
mov dword [esi + 0x60], 0x45128c
mov dword [esi + 0x64], 0x4513d1
mov dword [esi + 0x68], 0x450c13
push 0x88
push 0
lea edx, [ebx + 0x408]
push edx
call fcn.00497b00
add esp, 0xc
lea ecx, [ebx + 0x408]
mov dword [ebx + 0x408], 0x88
push ecx
push esi
call dword [ebx + 0x490]
cmp dword [ebx + 0x488], 0
je 0x4520a6
push dword [ebx + 0x404]
call sub.KERNEL32.DLL_FreeLibrary
xor eax, eax
mov dword [ebx + 0x404], eax
lea eax, [ebx + 4]
call fcn.0040bd28
push eax
mov eax, 0x42e
call fcn.004125d0
push eax
call fcn.00486954
add esp, 8
xor eax, eax
jmp 0x4520a8
mov al, 1
add esp, 0x84
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x453420
Capabilities:
Check if file exists
Get common file path
Get disk information
Get file attributes
Query environment variable

Disassembly:
push ebx
mov ebx, ecx
add esp, 0xfffff800
mov edx, 0x4a81b6
mov byte [ebx], 0
mov eax, 0x4a81b0
push 0x4a80dd
push 0x400
lea ecx, [esp + 8]
call fcn.004611c4
cmp byte [esp], 0
jne 0x453467
cmp byte [0x4bcc80], 0
je 0x453508
push esp
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push 0x400
lea eax, [esp + 0x404]
push eax
lea edx, [esp + 8]
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
jle 0x4534a3
cmp eax, 0x400
jge 0x4534a3
push 0x400
lea ecx, [esp + 0x404]
push ecx
lea eax, [esp + 8]
push eax
call fcn.00497e60
add esp, 0xc
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4534b9
push esp
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
mov edx, 0x4a81c1
mov eax, 0x4a81b0
mov ecx, 1
call fcn.0046139c
test eax, eax
je 0x4534f7
cmp byte [0x4bcc80], 0
jne 0x4534f7
push 0
call sub.KERNEL32.DLL_GetDriveTypeA
cmp eax, 2
je 0x4534eb
cmp eax, 5
jne 0x453501
push esp
push ebx
call fcn.00497c80
add esp, 8
jmp 0x453501
push esp
push ebx
call fcn.00497c80
add esp, 8
mov eax, ebx
call fcn.0040c22c
add esp, 0x800
pop ebx
ret
Function at 0x4592ac
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
mov ebx, eax
push eax
add esp, 0xfffffe10
mov eax, dword [ebx + 0x520]
test eax, eax
je 0x45949f
mov edi, dword [ebx + eax*4 + 0x49c]
xor eax, eax
mov dword [esp], eax
test edi, edi
je 0x45949f
push esp
push 0x20
push dword [ebx]
push edi
mov edx, dword [edi]
call dword [edx + 0x10]
test eax, eax
jne 0x45949f
cmp dword [esp], 0
je 0x45949f
xor ecx, ecx
xor ebp, ebp
mov dword [esp + 4], ecx
jmp 0x459478
mov dword [esp + 0xc], 0x10000000
lea eax, [esp + 0xc]
push eax
lea edx, [esp + 8]
push edx
push 1
push edi
mov ecx, dword [edi]
call dword [ecx + 0x24]
test byte [esp + 0xf], 0x10
je 0x459344
lea eax, [esp + 0x10]
push eax
push 0
xor ecx, ecx
mov edx, dword [esp + 0xc]
mov eax, edi
call fcn.0046007c
test eax, eax
jne 0x459359
push dword [esp + 4]
mov edx, dword [0x4cb56c]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
jmp 0x459478
mov eax, dword [ebx + 0x520]
mov edx, dword [esp + 4]
mov eax, dword [ebx + eax*4 + 0x41c]
call fcn.0045ffec
mov esi, eax
push 0x4409
push 0x160
lea eax, [esp + 0x418]
push eax
push 0
push esi
call sub.SHELL32.DLL_SHGetFileInfoA
push esi
mov edx, dword [0x4cb56c]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
mov dword [esp + 0x570], 7
mov dword [esp + 0x574], ebp
xor edx, edx
mov eax, dword [esp + 0x414]
lea ecx, [esp + 0x10]
mov dword [esp + 0x58c], eax
mov dword [esp + 0x578], edx
mov dword [esp + 0x584], ecx
push 0xc30
push 0
lea eax, [esp + 0x5a0]
push eax
call fcn.00497b00
add esp, 0xc
mov edx, dword [esp + 4]
mov dword [esp + 0x11c0], edx
mov dword [esp + 0x11b4], 0x20
push dword [esp + 0x584]
lea ecx, [esp + 0x59c]
push ecx
call fcn.00497c80
add esp, 8
mov eax, 0x4c9844
mov dword [esp + 0x11a8], 0x10
lea edx, [esp + 0x598]
call fcn.0046082c
mov dword [esp + 0x590], eax
lea ecx, [esp + 0x570]
push ecx
push 0
push 0x1007
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov dword [esp + 0x11d0], 2
lea edx, [esp + 0x520]
lea ecx, [esp + 0x11c8]
mov dword [esp + 0x11dc], edx
push ecx
push eax
push 0x102e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
inc ebp
lea eax, [esp + 8]
push eax
lea eax, [esp + 8]
push eax
push 1
mov edx, dword [esp + 0xc]
push edx
mov ecx, dword [edx]
call dword [ecx + 0xc]
test eax, eax
je 0x45930b
mov eax, dword [esp]
push eax
mov edx, dword [eax]
call dword [edx + 8]
add esp, 0x11f0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45a5d8
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
mov esi, 0x4a8e1c
mov ebx, edx
push eax
add esp, 0xfffff9d0
lea edx, [esi + 4]
mov edi, ecx
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
push edx
mov edx, ebx
push 0x100
mov eax, 0x80000000
call fcn.004611e0
cmp byte [esp + 4], 0
je 0x45a623
lea ecx, [esp + 4]
push ecx
push edi
call fcn.00497c80
add esp, 8
push ebx
lea eax, [esi + 0x97]
push eax
lea edx, [esp + 0x10c]
push edx
call fcn.0049abd0
add esp, 0xc
lea ecx, [esp + 0x230]
push ecx
lea eax, [esi + 4]
push eax
push 0x800
lea ecx, [esi + 4]
lea edx, [esp + 0x110]
mov eax, 0x80000000
call fcn.004611e0
test al, al
jne 0x45a722
push ebx
lea edx, [esi + 0xa6]
push edx
lea ecx, [esp + 0x10c]
push ecx
call fcn.0049abd0
add esp, 0xc
lea eax, [esp + 0xa30]
push eax
lea edx, [esi + 4]
push edx
push 0x400
lea ecx, [esi + 4]
lea edx, [esp + 0x110]
mov eax, 0x80000000
call fcn.004611e0
test al, al
jne 0x45a6b0
xor eax, eax
jmp 0x45a7a3
xor edx, edx
mov dl, byte [esp + 0xa30]
cmp edx, 0x22
jne 0x45a6c7
lea ecx, [esp + 0xa31]
jmp 0x45a6ce
lea ecx, [esp + 0xa30]
push ecx
lea eax, [esp + 0x234]
push eax
call fcn.00497c80
add esp, 8
push 0x22
lea edx, [esp + 0x234]
push edx
call fcn.00497d4d
add esp, 8
test eax, eax
je 0x45a6f8
mov byte [eax], 0
lea eax, [esi + 0xbc]
push eax
lea edx, [esp + 0x234]
push edx
call fcn.00497d71
add esp, 8
test eax, eax
je 0x45a716
mov byte [eax], 0
lea eax, [esp + 0x230]
call fcn.0040f26c
lea edx, [esi + 0xbc]
push edx
lea ecx, [esp + 0x234]
push ecx
call fcn.00497c34
add esp, 8
test eax, eax
jne 0x45a741
xor eax, eax
jmp 0x45a7a3
xor esi, esi
push 0x800
lea eax, [esp + 0xe34]
push eax
lea edx, [esp + 0x238]
push edx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
push 0x2c
lea ecx, [esp + 0xe34]
push ecx
call fcn.00497d65
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x45a784
lea esi, [ebx + 1]
push esi
call fcn.0049c4d4
pop ecx
mov esi, eax
mov byte [ebx], 0
xor eax, eax
mov dword [esp], eax
push 1
lea edx, [esp + 4]
push edx
push 0
push esi
lea ecx, [esp + 0xe40]
push ecx
call sub.SHELL32.DLL_ExtractIconExA
mov eax, dword [esp]
add esp, 0x1630
pop edi
pop esi
pop ebx
ret
Function at 0x45bf4c
Capabilities:
Copy file

Disassembly:
push ebx
add esp, 0xfffff004
push eax
add esp, 0xfffffc00
mov ebx, eax
mov edx, esp
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.00457598
mov eax, esp
call fcn.0040bd28
mov edx, 0x4a8ffc
mov ecx, 6
call fcn.0040f248
test eax, eax
jne 0x45c0af
mov edx, 0x4a9003
mov eax, ebx
call fcn.004594ac
test eax, eax
jne 0x45bfac
mov edx, 0x4a900e
mov eax, ebx
call fcn.004594ac
test eax, eax
je 0x45c0af
lea edx, [esp + 0x800]
lea eax, [esp + 0x400]
call fcn.0044c49c
test al, al
je 0x45c0af
push 0x400
lea ecx, [esp + 0x1004]
push ecx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x4a9003
lea eax, [esp + 0x1004]
call fcn.0040bd28
push eax
call fcn.00497c80
add esp, 8
push 0
lea edx, [esp + 0x1004]
push edx
lea ecx, [esp + 0x408]
push ecx
call sub.KERNEL32.DLL_CopyFileA
test eax, eax
jne 0x45c054
lea eax, [esp + 0x1000]
call fcn.0046445c
lea eax, [esp + 0x1000]
call fcn.0040c22c
push 0x4a9003
lea edx, [esp + 0x1004]
push edx
call fcn.00497ba4
add esp, 8
push 0
lea ecx, [esp + 0x1004]
push ecx
lea eax, [esp + 0x408]
push eax
call sub.KERNEL32.DLL_CopyFileA
lea edx, [esp + 0x400]
push edx
call fcn.0049a83c
pop ecx
push dword [0x4c4e64]
call sub.USER32.DLL_SetForegroundWindow
mov al, 1
call fcn.0040e988
mov byte [0x4b2124], al
mov eax, 0x4c4e78
call fcn.0045a154
cmp byte [0x4b2124], 0
je 0x45c0af
push 0x30
mov eax, 0x368
call fcn.004125d0
push eax
mov eax, 0x367
call fcn.004125d0
push eax
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
add esp, 0x1400
pop ebx
ret
Function at 0x45c0b8
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffff200
mov ebp, ecx
mov ebx, edx
mov edi, eax
lea edx, [esp + 0xc00]
mov eax, ebx
call fcn.0040abcc
lea edx, [esp + 0x1000]
mov eax, ebp
call fcn.0040ac14
push ebx
lea ecx, [esp + 4]
push ecx
call fcn.00497c80
add esp, 8
mov edx, 0x400
lea eax, [esp + 0x800]
call fcn.00463dbc
lea ecx, [esp + 0x400]
push ecx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x800]
push eax
call fcn.00497cb0
pop ecx
mov ecx, eax
lea eax, [esp + 0x800]
mov edx, ebx
call fcn.0040f248
test eax, eax
je 0x45c174
push 0x5c
lea ecx, [esp + 4]
push ecx
call fcn.00497d65
add esp, 8
mov esi, eax
test eax, eax
je 0x45c174
mov edx, esp
cmp esi, edx
jbe 0x45c174
mov al, byte [esi - 1]
xor edx, edx
mov dl, al
cmp edx, 0x3a
je 0x45c174
cmp edx, 0x5c
je 0x45c174
mov byte [esi], 0
push esp
call fcn.00499610
pop ecx
push 1
mov ecx, ebp
mov edx, ebx
mov eax, edi
call fcn.0045ba2c
cmp eax, 0xffffffff
jne 0x45c19d
push 1
lea ecx, [esp + 0x1004]
lea edx, [esp + 0xc04]
mov eax, edi
call fcn.0045ba2c
cmp eax, 1
je 0x45c21b
cmp eax, 2
je 0x45c209
inc eax
jne 0x45c1c8
push ebx
mov eax, 0x1f5
call fcn.004125d0
push eax
lea edx, [esp + 0x1808]
push edx
call fcn.0049abd0
add esp, 0xc
jmp 0x45c1e9
mov eax, 0x1fc
call fcn.004125d0
push eax
push ebx
push 0x4a9019
lea edx, [esp + 0x180c]
push edx
call fcn.0049abd0
add esp, 0x10
push 0x10
mov eax, 0x66
call fcn.004125d0
push eax
lea edx, [esp + 0x1808]
push edx
push dword [0x4c4e64]
call sub.USER32.DLL_MessageBoxA
lea ecx, [esp + 0x400]
push ecx
call fcn.00499610
pop ecx
xor eax, eax
jmp 0x45c21d
mov al, 1
add esp, 0x1e00
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x45c228
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xfffff7f8
mov ebp, ecx
mov edi, edx
mov esi, eax
push 0x4a8e40
push edi
call fcn.00497c34
add esp, 8
test eax, eax
sete bl
and ebx, 1
cmp byte [esi + 0x41d], 0
je 0x45c2a9
xor eax, eax
test bl, bl
mov dword [esp], eax
je 0x45c26e
mov dword [esp], 1
push 0x4a8ffa
push edi
call fcn.00497c34
add esp, 8
test eax, eax
jne 0x45c289
mov edx, dword [esi + 0x520]
mov dword [esp], edx
cmp dword [esp], 0
je 0x45c2a9
xor ecx, ecx
mov edx, dword [esp]
mov eax, esi
call fcn.0045d6b8
xor edx, edx
mov eax, esi
call fcn.00458864
jmp 0x45c494
mov eax, esi
call fcn.0045e68c
cmp dword [0x4c7804], 0
je 0x45c39b
mov edx, 0x4a8e5f
mov eax, 0x4a8e43
xor ecx, ecx
call fcn.0046139c
test eax, eax
je 0x45c2da
test bl, bl
je 0x45c494
lea edx, [esp + 8]
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.0045756c
push 0x4a8ffa
push edi
call fcn.00497c34
add esp, 8
test eax, eax
je 0x45c32d
mov eax, 0x4c5bc4
mov ecx, ebp
mov edx, edi
call fcn.004573d4
test eax, eax
je 0x45c32d
test bl, bl
je 0x45c31f
lea eax, [esp + 8]
call fcn.0040bd28
mov edx, eax
jmp 0x45c321
xor edx, edx
mov eax, esi
call fcn.00459644
jmp 0x45c494
lea edx, [esp + 0x408]
mov eax, 0x4c5bc4
xor ecx, ecx
call fcn.00457598
lea eax, [esp + 0x408]
push eax
lea edx, [esp + 0x80c]
push edx
call fcn.00497c80
add esp, 8
lea eax, [esp + 0x808]
call fcn.0040c2fc
lea eax, [esp + 0x808]
xor edx, edx
call fcn.00463e6c
mov eax, esi
call fcn.0045e1b0
test al, al
je 0x45c494
lea eax, [esp + 0x408]
call fcn.0040bd28
mov edx, eax
mov eax, esi
call fcn.00458864
jmp 0x45c494
lea edx, [esp + 0xc08]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x45c45e
lea ecx, [esp + 0xc08]
push ecx
lea eax, [esp + 0x100c]
push eax
call fcn.00497c80
add esp, 8
lea edx, [esp + 0x1408]
lea eax, [esp + 0xc08]
call fcn.0040c954
lea eax, [esp + 0x1008]
call fcn.0040c22c
lea eax, [esp + 0x1408]
call fcn.0040c22c
lea edx, [esp + 0x1408]
lea eax, [esp + 0x1008]
call fcn.0040f224
test eax, eax
jne 0x45c45e
cmp dword [esi + 0x520], 0
jle 0x45c421
mov byte [esi + 0x41d], 1
jmp 0x45c453
xor edx, edx
mov dword [esp + 4], edx
lea ecx, [esp + 4]
push ecx
push 0x11
push dword [esi]
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
mov eax, 0x4c4e78
mov edx, dword [esp + 4]
call fcn.0045e5ec
push dword [esp + 4]
mov ecx, dword [0x4cb56c]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
xor edx, edx
mov eax, esi
call fcn.00458864
jmp 0x45c494
mov edx, ebp
mov eax, edi
call fcn.00463e6c
test al, al
jne 0x45c477
mov eax, 0x4a8ffa
xor edx, edx
call fcn.00463e6c
test bl, bl
je 0x45c48b
lea eax, [esp + 0xc08]
call fcn.0040bd28
mov edx, eax
jmp 0x45c48d
xor edx, edx
mov eax, esi
call fcn.00458864
add esp, 0x1808
pop ebp
pop edi
pop esi
pop ebx
ret