joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463fac
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x463fdb
cmp dword [esp + 4], 5
ja 0x463fdf
cmp dword [esp + 4], 5
jne 0x463fdb
cmp dword [esp + 8], 0
ja 0x463fdf
xor eax, eax
jmp 0x463fe4
mov eax, 1
add esp, 0x94
ret

Function at 0x464808
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x464811
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4a9f5c
call fcn.00498090
call fcn.004a0084
mov dword [ebp - 0x2458], eax
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x464854
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.0041327c
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.00413d44
lea eax, [ebp - 0x28d0]
call fcn.00413d44
lea eax, [ebp - 0x28a4]
call fcn.00413d44
inc dword [0x4c77cc]
jmp 0x464941
test bl, bl
jne 0x4648d7
call fcn.004a0084
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x4648d7
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.00472a48
mov bl, 1
test bl, bl
je 0x4648eb
lea eax, [ebp - 0x3510]
call fcn.00474860
call fcn.00473b88
call fcn.0047cbc0
cmp byte [ebp + 0x18], 0
je 0x46490b
lea eax, [ebp - 0x3510]
call fcn.0040bd0c
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x46490f
xor eax, eax
jmp 0x464914
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x14]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 0xc]
call fcn.004649f4
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.004133b0
test eax, eax
jne 0x464963
cmp dword [0x4c77d4], 0
je 0x4648af
dec dword [0x4c77cc]
mov eax, dword [0x4c77d4]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x2459], dl
mov word [ebp - 0x2440], 0x14
test eax, eax
je 0x46499a
mov eax, esi
call fcn.004607b4
xor edx, edx
mov dword [0x4c77d4], edx
jmp 0x4649a1
mov eax, esi
call fcn.00460ab0
cmp dword [ebp + 8], 0
je 0x4649b1
call fcn.00474cd8
mov edx, dword [ebp + 8]
mov byte [edx], al
test bl, bl
je 0x4649c0
push dword [0x4c4e30]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.00413354
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4657ad
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.0049643c
pop ecx
mov edi, eax
test edi, edi
jne 0x4657d0
mov eax, 1
xor edx, edx
jmp 0x465863
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x465827
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x4657f6
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x4657f1
push edi
call fcn.00496274
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.0049c168
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret
Function at 0x469ec0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffff6cc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov ebx, dword [ebp + 0x10]
lea esi, [ebp - 0x44]
push 0x3c
push 0
push esi
call fcn.00497ae0
add esp, 0xc
mov dword [esi], 0x3c
mov dword [esi + 4], 0x500
test bl, bl
jne 0x469f03
or dword [esi + 4], 0x40
mov dword [esi + 0x10], edi
cmp dword [ebp + 8], 0
je 0x469f14
mov eax, dword [ebp + 8]
mov dword [esi + 0xc], eax
jmp 0x469f38
lea edx, [ebp - 0x94]
mov ecx, 0x50
mov eax, dword [esi + 0x10]
call fcn.00468900
test al, al
je 0x469f33
lea edx, [ebp - 0x94]
jmp 0x469f35
xor edx, edx
mov dword [esi + 0xc], edx
mov eax, dword [ebp - 8]
mov dword [esi + 0x18], eax
mov eax, edi
mov ecx, dword [ebp + 0x14]
mov dword [esi + 0x14], ecx
call fcn.0040bd0c
cmp edi, eax
jne 0x469f6d
push edi
push str.._s
lea edx, [ebp - 0x894]
push edx
call fcn.0049abc0
add esp, 0xc
lea ecx, [ebp - 0x894]
mov dword [esi + 0x10], ecx
mov dword [esi + 0x1c], 1
call fcn.00410420
test eax, eax
je 0x46a038
mov eax, dword [ebp - 4]
call fcn.0040f1b8
cmp word [eax], 0
je 0x46a038
xor edi, edi
push 0x4aa3dd
call sub.KERNEL32.DLL_GetModuleHandleA
test eax, eax
je 0x469fb0
push str.ShellExecuteExW
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov edi, eax
test edi, edi
jne 0x469fbb
xor eax, eax
jmp 0x46a0ee
mov edx, dword [ebp - 4]
mov dword [esi + 0x10], edx
mov eax, dword [esi + 0xc]
test eax, eax
je 0x469fe1
lea edx, [ebp - 0x934]
mov ecx, 0x1000000
call fcn.00410498
lea edx, [ebp - 0x934]
mov dword [esi + 0xc], edx
cmp dword [ebp - 8], 0
je 0x46a003
lea edx, [ebp - 0x1134]
mov ecx, 0x1000000
mov eax, dword [ebp - 8]
call fcn.00410498
lea eax, [ebp - 0x1134]
mov dword [esi + 0x18], eax
cmp dword [ebp + 0x14], 0
je 0x46a025
lea edx, [ebp - 0x1934]
mov ecx, 0x1000000
mov eax, dword [ebp + 0x14]
call fcn.00410498
lea edx, [ebp - 0x1934]
mov dword [esi + 0x14], edx
mov byte [0x4c77d0], 1
push esi
call edi
mov byte [0x4c77d0], 0
jmp 0x46a04c
mov byte [0x4c77d0], 1
push esi
call sub.SHELL32.DLL_ShellExecuteExA
mov byte [0x4c77d0], 0
test eax, eax
je 0x46a05c
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x483
jne 0x46a063
xor eax, eax
jmp 0x46a0ee
test bl, bl
jne 0x46a0ec
mov eax, dword [esi + 0x38]
test eax, eax
je 0x46a0ab
mov edx, dword [0x4aa3ac]
mov dword [edx*4 + 0x4cb634], eax
mov ecx, dword [0x4aa3ac]
mov eax, dword [esi + 0x20]
mov dword [ecx*4 + 0x4cb674], eax
mov edx, dword [0x4aa3ac]
inc edx
and edx, 0x8000000f
jns 0x46a0a3
dec edx
or edx, 0xfffffff0
inc edx
mov dword [0x4aa3ac], edx
jmp 0x46a0de
xor ebx, ebx
mov eax, dword [ebx*4 + 0x4cb674]
cmp eax, dword [esi + 0x20]
jne 0x46a0d8
push 0
push dword [ebx*4 + 0x4cb634]
call sub.KERNEL32.DLL_WaitForSingleObject
cmp eax, 0x102
jne 0x46a0d8
mov edx, dword [ebx*4 + 0x4cb634]
mov dword [esi + 0x38], edx
inc ebx
cmp ebx, 0x10
jl 0x46a0ad
cmp dword [ebp + 0xc], 0
je 0x46a0ec
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 0x38]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x46b438
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4c77e8
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46b46f
push 0x40
mov eax, 0x2bc
call fcn.004125b4
push eax
mov eax, 0x2bd
call fcn.004125b4
push eax
push dword [0x4c4e24]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4c77e8
xor ecx, ecx
mov eax, ebx
call fcn.0046a5d0
pop ebx
ret

Function at 0x46b484
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffb64
mov esi, ecx
mov ebx, edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.004696e5
test al, al
je 0x46b4d0
push 0x30
mov eax, 0x65
call fcn.004125b4
push eax
mov eax, 0x596
call fcn.004125b4
push eax
push dword [0x4c4e24]
call sub.USER32.DLL_MessageBoxA
jmp 0x46b695
cmp dword [0x4c77c4], 0
jne 0x46b50d
push 0
push 1
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00469ec0
test al, al
jne 0x46b695
push ebx
mov eax, 0x201
call fcn.004125b4
push eax
call fcn.00486908
add esp, 8
jmp 0x46b695
mov edx, esp
mov eax, str.Rar_EXXXXXXX
call fcn.004639d4
test al, al
je 0x46b695
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.004995f4
pop ecx
lea edx, [esp + 0x800]
mov eax, 0x4c5b84
call fcn.0045759c
call fcn.00449528
mov ecx, 0x4bdc78
mov edx, 0x4bd878
mov eax, 0x4c5b84
call fcn.00457568
mov ecx, dword [esp + 0x810]
mov dword [0x4bc428], ecx
mov edx, 0x4aa3d6
mov eax, dword [0x4be478]
call fcn.0040fbd8
call fcn.0044a0ac
mov eax, 0x4c5b84
xor ecx, ecx
xor edx, edx
call fcn.0045246c
cmp dword [0x4c77d8], 0
jne 0x46b695
lea edx, [esp + 0x89c]
mov eax, ebx
call fcn.0040be1c
lea edx, [esp + 0xc9c]
mov eax, esi
call fcn.0040bf48
lea edx, [esp + 0x89c]
lea eax, [esp + 0x89c]
call fcn.0040abb0
lea edx, [esp + 0xc9c]
lea eax, [esp + 0xc9c]
call fcn.0040abf8
push 0x2010
push 0
push 0x4cf8e4
call fcn.00497ae0
add esp, 0xc
lea ecx, [esp + 0x89c]
push ecx
push 0x4d04f1
call fcn.00497c60
add esp, 8
mov eax, 0x4d08f2
lea edx, [esp + 0xc9c]
call fcn.00410760
push 0x4bd878
push 0x4cf8e9
call fcn.00497c60
add esp, 8
mov edx, 0x4bdc78
mov eax, 0x4cfcea
call fcn.00410760
push esp
push 0x4d10f2
call fcn.00497c60
add esp, 8
lea ecx, [esp + 0x400]
push ecx
call fcn.004995f4
pop ecx
mov byte [0x4cf8e8], 0
cmp dword [esp + 0x88c], 0
setne dl
mov eax, dword [0x4bc428]
push 0x4cf8e4
mov dword [0x4d04ec], eax
and edx, 1
push 0x10000
push 0x469748
mov byte [0x4d04f0], dl
call fcn.0049ff04
add esp, 0xc
add esp, 0x149c
pop esi
pop ebx
ret
Function at 0x471fae
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb6c
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
mov edi, edx
mov dword [ebp - 0x54], eax
mov eax, 0x4ab488
call fcn.00498090
push str.winrar_config_integration
push 0x10000
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x471ffa
mov eax, dword [ebp - 0x50]
mov dword fs:[0], eax
jmp 0x4721fa
push 0
push 0
push 0
push 2
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov word [ebp - 0x40], 8
mov esi, eax
mov word [ebp - 0x40], 0x14
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00411d58
add dword [ebp - 0x34], 2
mov word [ebp - 0x40], 0x20
test edi, edi
je 0x472067
lea eax, [ebp - 0x20]
mov dl, 0x49
call fcn.00411ee4
lea eax, [ebp - 0x20]
mov dl, 0x1a
call fcn.00411ee4
lea eax, [ebp - 0x20]
mov ecx, 0x1a
mov edx, edi
call fcn.00411fb4
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x58]
call fcn.00471f79
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x14]
call fcn.00471f79
cmp dword [ebp + 0x10], 0
je 0x472098
lea eax, [ebp - 0x20]
mov dl, 0x54
call fcn.00411ee4
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x10]
call fcn.00471f79
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0xc]
call fcn.00471f79
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 8]
call fcn.00471f79
mov word [ebp - 0x40], 0x2c
lea eax, [ebp - 0x2c]
call fcn.00402134
inc dword [ebp - 0x34]
lea edx, [ebp - 0x2c]
mov word [ebp - 0x40], 0x20
lea eax, [ebp - 0x20]
call fcn.0041207c
cmp dword [ebp - 0x28], 0x10000
jle 0x4720ff
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004017ec
sub dword [ebp - 0x34], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00411dd8
mov ecx, dword [ebp - 0x50]
mov dword fs:[0], ecx
jmp 0x4721fa
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.00497a70
add esp, 0xc
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push 0x400
lea eax, [ebp - 0x458]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov dword [ebp - 0x494], 0x3c
mov dword [ebp - 0x490], 0x40
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x48c], edx
xor eax, eax
mov dword [ebp - 0x488], str.runas
mov dword [ebp - 0x484], ecx
xor edx, edx
mov dword [ebp - 0x480], str._setup_integration
mov dword [ebp - 0x47c], 0x4ab2e8
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], edx
lea ecx, [ebp - 0x494]
push ecx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
je 0x4721a6
push 0xffffffffffffffff
push dword [ebp - 0x45c]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [ebp - 0x45c]
call sub.KERNEL32.DLL_CloseHandle
push ebx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004017ec
sub dword [ebp - 0x34], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.00411dd8
mov word [ebp - 0x40], 8
mov word [ebp - 0x40], 0
jmp 0x4721f0
mov edx, dword [ebp - 0x50]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4723c8
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffdc0
mov byte [esp], dl
mov ebx, eax
mov esi, 0x4aafec
lea eax, [esp + 4]
call fcn.0046442c
lea eax, [esp + 4]
call fcn.0040c210
lea edx, [esi + 0x387]
push edx
lea ecx, [esp + 8]
push ecx
call fcn.00497b84
add esp, 8
lea eax, [esp + 4]
push eax
lea edx, [esp + 0x408]
push edx
call fcn.00497c60
add esp, 8
test bl, bl
je 0x472435
lea edx, [esi + 0x394]
lea eax, [esi + 8]
mov ecx, 1
call fcn.004610a0
jmp 0x472477
lea edx, [esp + 4]
lea eax, [esi + 0x387]
mov cl, 1
call fcn.0040c418
lea eax, [esp + 4]
xor edx, edx
call fcn.0040a710
test al, al
jne 0x472477
cmp byte [esp], 0
je 0x472462
xor eax, eax
jmp 0x4725ff
lea edx, [esp + 0x404]
push edx
lea ecx, [esp + 8]
push ecx
call fcn.00497c60
add esp, 8
cmp byte [esp], 0
jne 0x4724b0
lea eax, [esi + 0x3a5]
test bl, bl
push eax
mov eax, 0x5b4
push 0
jne 0x472490
inc eax
call fcn.004125b4
mov edx, eax
lea ecx, [esp + 0xc]
mov eax, dword [0x4c4e24]
call fcn.0044d4d0
test al, al
jne 0x4724b0
xor eax, eax
jmp 0x4725ff
lea edx, [esp + 4]
test bl, bl
push edx
je 0x4724c1
lea ecx, [esi + 0x3ab]
jmp 0x4724c7
lea ecx, [esi + 0x3d6]
push ecx
lea eax, [esp + 0x80c]
push eax
call fcn.0049abc0
add esp, 0xc
push 0x3c
push 0
lea edx, [esp + 0xd0c]
push edx
call fcn.00497ae0
add esp, 0xc
mov eax, dword [0x4c4e24]
lea edx, [esi + 0x3de]
mov dword [esp + 0xd04], 0x3c
mov dword [esp + 0xd08], 0x40
mov dword [esp + 0xd0c], eax
mov dword [esp + 0xd14], edx
lea ecx, [esp + 0x804]
lea eax, [esp + 0xd04]
mov dword [esp + 0xd18], ecx
mov dword [esp + 0xd20], 1
push eax
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne dl
and edx, 1
mov byte [esp + 1], dl
cmp byte [esp + 1], 0
je 0x472571
push 0x1388
push dword [esp + 0xd40]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0xd3c]
call sub.KERNEL32.DLL_CloseHandle
test bl, bl
je 0x472583
lea edx, [esi + 0x394]
lea eax, [esi + 8]
call fcn.00461470
cmp byte [esp + 1], 0
je 0x4725da
test bl, bl
jne 0x472593
call fcn.00472608
lea ecx, [esp + 4]
push ecx
mov eax, 0x460
test bl, bl
jne 0x4725a2
inc eax
call fcn.004125b4
push eax
lea edx, [esp + 0xd48]
push edx
call fcn.0049abc0
add esp, 0xc
mov eax, 0x2ee
push 0
call fcn.004125b4
push eax
lea edx, [esp + 0xd48]
push edx
push dword [0x4c4e24]
call sub.USER32.DLL_MessageBoxA
jmp 0x4725fb
cmp byte [esp], 0
jne 0x4725fb
lea ecx, [esp + 0x804]
mov eax, 0x201
push ecx
call fcn.004125b4
push eax
call fcn.00486908
add esp, 8
mov al, byte [esp + 1]
add esp, 0x1240
pop esi
pop ebx
ret
Function at 0x47270c
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff004
push eax
add esp, 0xfffffbe4
push str.winrar_config_integration
push 0
push 4
call sub.KERNEL32.DLL_OpenFileMappingA
mov edi, eax
test edi, edi
je 0x472838
push 0x10000
push 0
push 0
push 4
push edi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
test esi, esi
jne 0x472756
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x472838
mov ebx, esi
xor eax, eax
mov al, byte [esi]
cmp eax, 0x49
jne 0x4727c5
xor edx, edx
mov dl, byte [esi + 1]
cmp edx, 0x1a
jne 0x4727c5
push 0x1a
lea ecx, [esi + 2]
push ecx
lea eax, [esp + 8]
push eax
call fcn.00497a70
add esp, 0xc
lea ebx, [esi + 0x1c]
mov eax, ebx
mov ecx, 0x400
lea edx, [esp + 0x1c]
call fcn.00472203
mov ebx, eax
lea edx, [esp + 0x41c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472203
mov ebx, eax
test ebx, ebx
je 0x4727c5
mov eax, esp
xor edx, edx
call fcn.004633c8
lea edx, [esp + 0x41c]
lea eax, [esp + 0x1c]
call fcn.00471f2e
xor ecx, ecx
mov cl, byte [ebx]
cmp ecx, 0x54
jne 0x47282c
inc ebx
lea edx, [esp + 0x81c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472203
mov ebx, eax
lea edx, [esp + 0xc1c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472203
mov ebx, eax
lea edx, [esp + 0x101c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472203
mov ebx, eax
test ebx, ebx
je 0x47282c
lea ecx, [esp + 0x101c]
lea edx, [esp + 0xc1c]
lea eax, [esp + 0x81c]
call fcn.004635b8
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push edi
call sub.KERNEL32.DLL_CloseHandle
add esp, 0x141c
pop edi
pop esi
pop ebx
ret

Function at 0x4728c6
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
push eax
push dword [0x4c4e30]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
push esp
push esi
call fcn.00497c14
add esp, 8
test eax, eax
je 0x472903
push esi
push ebx
call sub.USER32.DLL_SetWindowTextA
add esp, 0x200
pop esi
pop ebx
ret
Function at 0x473b88
Capabilities:
Get graphical window text

Disassembly:
add esp, 0xfffffe00
mov eax, dword [0x4c4e30]
test eax, eax
je 0x473c35
push pe_nt_image_headers32
lea edx, [esp + 4]
push edx
push eax
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4d1aa8], 8
je 0x473bda
push 0x4d1aac
lea ecx, [esp + 4]
push ecx
call fcn.00497c14
add esp, 8
test eax, eax
je 0x473bda
push 0x4d1aac
push dword [0x4c4e30]
call sub.USER32.DLL_SetWindowTextA
mov eax, dword [0x4d1aa8]
test eax, eax
je 0x473bf2
cmp eax, 1
je 0x473bf2
cmp eax, 2
je 0x473bf2
cmp eax, 8
jne 0x473c17
mov edx, 0x4d1b2c
mov eax, 0x9c
call fcn.004728c6
mov eax, 0x4d1bac
call fcn.0040bd0c
mov edx, eax
mov eax, 0x9b
call fcn.004728c6
mov edx, 0x64
mov eax, 2
call fcn.0047d618
test al, al
je 0x473c35
push dword [0x4c4e30]
call sub.USER32.DLL_UpdateWindow
add esp, 0x200
ret
Function at 0x474e10
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x474e36
mov eax, str.comctl32.dll
call fcn.00463b0c
mov dword [ebx + 8], eax
mov eax, dword [ebx]
test eax, eax
je 0x474e42
push eax
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x4b210c]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x474e7a
mov ecx, str.ComboBoxEx32
jmp 0x474e7f
mov ecx, str.combobox
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x474f2c
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4cb52c]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.004752a4
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x407
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x474f3f
call fcn.00463f04
jmp 0x474f3f
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x474f6c
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x474f6c
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00474fd0
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x474fbd
call fcn.00463e18
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x474fb7
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push 0x4ab5bb
push eax
call fcn.0049abc0
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.004752a4
inc esi
cmp esi, 0x20
jl 0x474f7b
mov eax, ebx
call fcn.00475434
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4752a4
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe74
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x1c]
push 0x408
call fcn.00496298
pop ecx
mov esi, eax
mov eax, dword [ebp - 8]
mov dword [esi], eax
mov edx, dword [ebp + 0x20]
mov dword [esi + 4], edx
mov eax, dword [ebp - 4]
call fcn.0040f1a8
push eax
lea edx, [esi + 8]
push edx
call fcn.00497c60
add esp, 8
cmp byte [ebx + 4], 0
je 0x47540b
cmp dword [ebx + 8], 0x50000
jb 0x47530d
cmp dword [0x4c813c], 4
jne 0x475311
cmp dword [0x4c8140], 0
jne 0x475311
mov byte [ebp + 8], 0
cmp byte [ebp + 8], 0
jne 0x475322
cmp edi, 0xffffffff
je 0x475326
cmp dword [ebp + 0x18], 0
je 0x475326
xor eax, eax
jmp 0x47532b
mov eax, 1
test al, al
je 0x47536e
cmp dword [ebp - 8], 2
mov eax, 0x4201
jne 0x47533d
or eax, 2
push eax
push 0x160
lea edx, [ebp - 0x168]
push edx
push 0
push dword [ebp - 4]
call sub.SHELL32.DLL_SHGetFileInfoA
cmp edi, 0xffffffff
jne 0x47535f
mov edi, dword [ebp - 0x164]
cmp dword [ebp + 0x18], 0
jne 0x47536e
lea eax, [ebp - 0x15c]
mov dword [ebp + 0x18], eax
push 0x24
push 0
lea edx, [ebp - 0x18c]
push edx
call fcn.00497ae0
add esp, 0xc
mov dword [ebp - 0x18c], 0x37
cmp dword [ebp + 0x18], 0
je 0x475396
mov ecx, dword [ebp + 0x18]
jmp 0x475399
or ecx, 0xffffffff
mov dword [ebp - 0x184], ecx
mov dword [ebp - 0x16c], esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x188], eax
mov dword [ebp - 0x17c], edi
mov dword [ebp - 0x178], edi
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x170], edx
cmp dword [ebp + 0x14], 0
je 0x4753f2
call fcn.00410420
test eax, eax
je 0x4753f2
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 0x18c]
mov dword [ebp - 0x184], eax
push edx
push 0
push 0x40b
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x47542b
lea ecx, [ebp - 0x18c]
push ecx
push 0
push 0x401
push dword [ebx]
call sub.USER32.DLL_SendMessageA
jmp 0x47542b
push dword [ebp - 4]
push dword [ebp + 0xc]
push 0x14a
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push esi
push eax
push 0x151
push dword [ebx]
call sub.USER32.DLL_SendMessageA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c