joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440be8
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret

Function at 0x440eb0
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebx
add esp, 0xfffffc00
mov ebx, eax
mov eax, ebx
call fcn.00462bcc
test al, al
jne 0x440ec8
xor eax, eax
jmp 0x440f03
push 0
push ebx
call sub.KERNEL32.DLL_SetFileAttributesA
push ebx
call fcn.00485848
pop ecx
push ebx
lea edx, [esp + 4]
push edx
call fcn.00482a00
add esp, 8
push 0x5c
lea ecx, [esp + 4]
push ecx
call fcn.00482b55
add esp, 8
mov ebx, eax
test eax, eax
je 0x440efd
mov byte [ebx], 0
push esp
call sub.KERNEL32.DLL_RemoveDirectoryA
add esp, 0x400
pop ebx
ret

Function at 0x440f68
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
test esi, esi
je 0x44106a
push esi
call fcn.00482a30
pop ecx
mov dword [esp], eax
test eax, eax
je 0x44106a
push 0
call sub.USER32.DLL_OpenClipboard
test eax, eax
jne 0x440f9b
xor eax, eax
jmp 0x44106f
call sub.USER32.DLL_EmptyClipboard
mov edi, dword [esp]
inc edi
push edi
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test eax, eax
je 0x440fde
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov ebp, eax
test eax, eax
je 0x440fde
mov edx, dword [esp]
inc edx
push edx
push esi
push ebp
call fcn.00482810
add esp, 0xc
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
push 1
call sub.USER32.DLL_SetClipboardData
push edi
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test eax, eax
je 0x44101f
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov ebp, eax
test eax, eax
je 0x44101f
mov edx, dword [esp]
inc edx
push edx
push esi
push ebp
call fcn.00482810
add esp, 0xc
push ebp
push ebp
call sub.USER32.DLL_CharToOemA
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
push 7
call sub.USER32.DLL_SetClipboardData
call fcn.0040e9e0
test eax, eax
je 0x441065
mov ecx, edi
add ecx, ecx
push ecx
push 0x2002
call sub.KERNEL32.DLL_GlobalAlloc
mov ebx, eax
test eax, eax
je 0x441065
push ebx
call sub.KERNEL32.DLL_GlobalLock
mov ebp, eax
test eax, eax
je 0x441065
push edi
push ebp
push 0xffffffffffffffff
push esi
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push ebx
call sub.KERNEL32.DLL_GlobalUnlock
push ebx
push 0xd
call sub.USER32.DLL_SetClipboardData
call sub.USER32.DLL_CloseClipboard
mov eax, 1
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x441a60
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffff79c
mov ebx, eax
lea esi, [esp + 0x464]
push ebx
mov eax, 0x6c
call fcn.00410804
push eax
lea edx, [esp + 8]
push edx
call fcn.00486578
add esp, 0xc
jmp 0x441ad9
push 0x400
push esi
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x441ab7
push esi
push ebx
call fcn.004829b4
add esp, 8
test eax, eax
je 0x441ab7
mov eax, esi
xor edx, edx
call fcn.00462d1c
test al, al
jne 0x441ae6
push 0x15
mov eax, 0x66
call fcn.00410804
push eax
lea edx, [esp + 8]
push edx
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
cmp eax, 2
je 0x441b00
xor edx, edx
mov eax, ebx
call fcn.00462d1c
test al, al
je 0x441a8c
mov eax, 0x4ad5bc
call fcn.0045edf0
test al, al
je 0x441b00
mov eax, 0x4ad5bc
xor edx, edx
call fcn.00459fd8
add esp, 0x864
pop esi
pop ebx
ret

Function at 0x441b64
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
push ebp
add esp, 0xfffffe94
mov eax, dword [ebx + 0x2c]
add eax, 0x41
push eax
push 0x495ab6
lea edx, [esp + 8]
push edx
call fcn.00486578
add esp, 0xc
push 0x301
push 0x160
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [esp + 0x10]
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
test byte [ebx + 0x10], 1
je 0x441bce
push 0xd
call sub.USER32.DLL_GetSysColor
push eax
push dword [ebx + 0x18]
call sub.GDI32.DLL_SetBkColor
mov edi, eax
push 0xe
call sub.USER32.DLL_GetSysColor
push eax
push dword [ebx + 0x18]
call sub.GDI32.DLL_SetTextColor
mov ebp, eax
push 0
push 0
push 0x495a5d
lea eax, [ebx + 0x1c]
push eax
push 2
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call sub.GDI32.DLL_ExtTextOutA
push 0x31
call sub.USER32.DLL_GetSystemMetrics
mov esi, eax
push 0x32
call sub.USER32.DLL_GetSystemMetrics
push 3
push 0
push 0
push eax
push esi
push dword [esp + 0x20]
push dword [ebx + 0x20]
push dword [ebx + 0x1c]
push dword [ebx + 0x18]
call sub.USER32.DLL_DrawIconEx
push dword [esp + 0xc]
call sub.USER32.DLL_DestroyIcon
lea eax, [esp + 0x18]
push eax
call fcn.00482a30
pop ecx
push eax
lea edx, [esp + 0x1c]
push edx
mov ecx, dword [ebx + 0x20]
add ecx, 2
push ecx
add esi, dword [ebx + 0x1c]
add esi, 7
push esi
push dword [ebx + 0x18]
call sub.GDI32.DLL_TextOutA
test byte [ebx + 0x10], 1
je 0x441c5d
push edi
push dword [ebx + 0x18]
call sub.GDI32.DLL_SetBkColor
push ebp
push dword [ebx + 0x18]
call sub.GDI32.DLL_SetTextColor
add esp, 0x16c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x442be8
Capabilities:
Move file

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
push eax
add esp, 0xffffffb0
mov ebp, eax
call fcn.0040e9e0
test eax, eax
je 0x442c0d
mov eax, ebp
call fcn.00437f90
jmp 0x442d19
xor ebx, ebx
xor esi, esi
mov eax, 0x4ad5bc
xor edx, edx
call fcn.0045ea58
jmp 0x442c6c
lea edx, [esp + 0xc30]
mov eax, esp
call fcn.00409cf4
lea ecx, [esp + 0xc30]
push ecx
call fcn.00482a30
pop ecx
mov edi, eax
inc edi
lea eax, [edi + esi + 1]
push eax
push ebx
call fcn.004817b0
add esp, 8
mov ebx, eax
test ebx, ebx
je 0x442d19
lea edx, [esp + 0xc30]
push edx
lea ecx, [esi + ebx]
push ecx
call fcn.00482a00
add esp, 8
add esi, edi
mov edx, esp
mov eax, 0x4ad5bc
call fcn.0045ea58
test al, al
jne 0x442c1f
test esi, esi
jne 0x442ca5
push 0x30
mov eax, 0x65
call fcn.00410804
push eax
mov eax, 0x14c
call fcn.00410804
push eax
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
jmp 0x442d19
mov byte [ebx + esi], 0
push 0x1e
push 0
lea edx, [esp + 0x1038]
push edx
call fcn.00482880
add esp, 0xc
mov ecx, dword [0x4ad5a8]
mov dword [esp + 0x1030], ecx
mov dword [esp + 0x1034], 3
test ebp, ebp
je 0x442ce3
mov word [esp + 0x1040], 0x40
mov dword [esp + 0x1038], ebx
lea eax, [esp + 0x1030]
push eax
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete dl
and edx, 1
test ebx, ebx
je 0x442d0a
push ebx
call fcn.004817a0
pop ecx
mov edx, 0x495a5d
mov eax, 0x4ad5bc
call fcn.00459fd8
add esp, 0x1050
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4459f4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
cmp byte [ebp + 8], 0
je 0x445a2e
push ebx
push 0x400
mov edx, 0x495b90
mov eax, 0x495fc9
mov ecx, edi
call fcn.00460a70
cmp byte [edi], 0
jne 0x445a31
push ebx
push edi
call fcn.00482a00
add esp, 8
jmp 0x445a31
mov byte [edi], 0
mov al, byte [edi]
test al, al
setne bl
and ebx, 1
test al, al
jne 0x445a4a
push edi
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, edi
call fcn.0040adfc
cmp byte [ebp + 0x10], 0
jne 0x445a5f
test bl, bl
je 0x445aec
mov edx, 0x495fd4
mov eax, 0x495fc9
mov ecx, 1
call fcn.00460c28
test eax, eax
je 0x445aec
mov eax, esi
call fcn.0040a924
push eax
push edi
call fcn.00482924
add esp, 8
mov eax, edi
call fcn.0040ace4
mov esi, eax
test esi, esi
je 0x445aec
cmp edi, esi
jae 0x445aec
mov byte [esi], 0
mov eax, edi
call fcn.0040ace4
mov ebx, eax
test ebx, ebx
je 0x445aec
cmp edi, ebx
jae 0x445aec
cmp byte [ebp + 0xc], 0
je 0x445ad9
cmp byte [esi + 1], 0
je 0x445ad9
xor eax, eax
mov al, byte [esi + 2]
push eax
call fcn.004878f0
pop ecx
test eax, eax
jne 0x445ad9
xor edx, edx
mov dl, byte [esi - 1]
push edx
call fcn.004878f0
pop ecx
test eax, eax
jne 0x445ae9
mov edx, 0x495e70
mov eax, ebx
call fcn.0040d81c
test eax, eax
jne 0x445aec
mov byte [ebx], 0
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x447818
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4afc28
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x44784f
push 0x40
mov eax, 0x2bc
call fcn.00410804
push eax
mov eax, 0x2bd
call fcn.00410804
push eax
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4afc28
xor ecx, ecx
mov eax, ebx
call fcn.00446abc
pop ebx
ret
Function at 0x447864
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff004
push eax
add esp, 0xfffffb68
mov esi, ecx
mov ebx, edx
cmp dword [0x4afc0c], 0
jne 0x4478b3
push 0
push 1
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.0043c2d8
test al, al
jne 0x4478a9
push ebx
mov eax, 0x201
call fcn.00410804
push eax
call fcn.00447a48
add esp, 8
mov eax, 1
jmp 0x447a17
mov edx, esp
mov eax, str.Rar_EXXXXXXX
call fcn.004629ac
test al, al
jne 0x4478cd
mov eax, 1
jmp 0x447a17
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call fcn.00484424
pop ecx
lea edx, [esp + 0x800]
mov eax, 0x4adfd0
call fcn.00459040
call fcn.0044f218
mov ecx, 0x4a88b8
mov edx, 0x4a84b8
mov eax, 0x4adfd0
call fcn.0045900c
mov ecx, dword [esp + 0x810]
mov dword [0x4a7c9c], ecx
mov edx, 0x495b9e
mov eax, dword [0x4a90b8]
call fcn.0040e1cc
call fcn.0044fbdc
mov eax, 0x4adfd0
xor edx, edx
call fcn.00454abc
cmp dword [0x4afc1c], 0
jne 0x447a12
lea edx, [esp + 0x898]
mov eax, ebx
call fcn.00409cf4
lea edx, [esp + 0xc98]
mov eax, esi
call fcn.00409d3c
push 0x200c
push 0
push 0x4b775c
call fcn.00482880
add esp, 0xc
lea ecx, [esp + 0x898]
push ecx
push 0x4b8365
call fcn.00482a00
add esp, 8
mov eax, 0x4b8766
lea edx, [esp + 0xc98]
call fcn.0040eac4
push 0x4a84b8
push 0x4b7760
call fcn.00482a00
add esp, 8
mov edx, 0x4a88b8
mov eax, 0x4b7b60
call fcn.0040eac4
push esp
push 0x4b8f66
call fcn.00482a00
add esp, 8
lea ecx, [esp + 0x400]
push ecx
call fcn.00484424
pop ecx
mov eax, dword [0x4a7c9c]
cmp dword [esp + 0x88c], 0
setne dl
push 0x4b775c
and edx, 1
mov dword [0x4b8360], eax
push 0x10000
push 0x446318
mov byte [0x4b8364], dl
call fcn.0048dc18
add esp, 0xc
mov eax, 1
add esp, 0x1498
pop esi
pop ebx
ret
Function at 0x448060
Capabilities:
Copy file
Get file attributes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff004
mov esi, eax
push eax
add esp, 0xfffff400
cmp dword [0x4afc14], 0
jne 0x448292
push 0
push 0
push 0xffffffffffffffff
push esi
call sub.SHELL32.DLL_DragQueryFileA
mov edi, eax
cmp edi, 1
jne 0x4481fc
mov word [esp + 0x400], 0
push 0x400
lea eax, [esp + 4]
push eax
push 0
push esi
call sub.SHELL32.DLL_DragQueryFileA
call fcn.0040e9e0
test eax, eax
je 0x4480d1
push 0x400
lea edx, [esp + 0x404]
push edx
push 0
push esi
call sub.SHELL32.DLL_DragQueryFileW
cmp dword [0x4afc0c], 0
jne 0x448102
push esp
call sub.KERNEL32.DLL_GetFileAttributesA
test al, 0x10
jne 0x448102
push 1
lea ecx, [esp + 0x404]
lea edx, [esp + 4]
mov eax, 0x4ad5bc
call fcn.0045cc58
dec eax
je 0x448292
cmp byte [0x49ede8], 0
jne 0x4481fc
push 7
push str.rarreg.
lea eax, [esp + 8]
call fcn.0040a924
push eax
call fcn.00482ca0
add esp, 0xc
test eax, eax
jne 0x4481fc
push 0x400
lea edx, [esp + 0xc04]
push edx
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x49618d
lea eax, [esp + 0xc04]
call fcn.0040a924
push eax
call fcn.00482a00
add esp, 8
push 0
lea edx, [esp + 0xc04]
push edx
lea ecx, [esp + 8]
push ecx
call sub.KERNEL32.DLL_CopyFileA
push dword [0x4ad5a8]
call sub.USER32.DLL_SetForegroundWindow
push 1
push dword [0x4ad5a8]
call sub.USER32.DLL_FlashWindow
mov al, 1
call fcn.0040cfd0
mov byte [0x49ede8], al
push 0
push dword [0x4ad5a8]
call sub.USER32.DLL_FlashWindow
cmp dword [0x4afc0c], 0
je 0x4481b8
mov eax, 0x4ad5bc
call fcn.0045b6f8
jmp 0x4481c7
mov edx, 0x495a5d
mov eax, 0x4ad5bc
call fcn.00459fd8
cmp byte [0x49ede8], 0
je 0x448292
push 0x30
mov eax, 0x368
call fcn.00410804
push eax
mov eax, 0x367
call fcn.00410804
push eax
push dword [0x4ad5a8]
call sub.USER32.DLL_MessageBoxA
jmp 0x448292
xor eax, eax
call fcn.0044f618
mov dword [0x4a76ec], 1
mov eax, dword [0x4a90b8]
call fcn.0040e19c
xor ebx, ebx
cmp edi, ebx
jle 0x448277
mov word [esp + 0x1400], 0
push 0x400
lea eax, [esp + 0x1004]
push eax
mov ebp, ebx
push ebp
push esi
call sub.SHELL32.DLL_DragQueryFileA
call fcn.0040e9e0
test eax, eax
je 0x44825a
push 0x400
lea eax, [esp + 0x1404]
push eax
push ebp
push esi
call sub.SHELL32.DLL_DragQueryFileW
lea ecx, [esp + 0x1400]
lea edx, [esp + 0x1000]
mov eax, dword [0x4a90b8]
call fcn.0040e1d4
inc ebx
cmp edi, ebx
jg 0x44821d
push 0x10
call sub.USER32.DLL_GetKeyState
test ah, 0x80
setne al
and eax, 1
mov cl, 1
mov edx, eax
xor eax, eax
call fcn.0044ffcc
add esp, 0x1c00
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4487b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
add esp, 0xfffffbcc
mov eax, dword [ebx + 0x3c]
cmp edx, eax
jl 0x4487c9
mov ecx, eax
add ecx, dword [ebx + 0x40]
cmp edx, ecx
jl 0x4487d0
xor eax, eax
jmp 0x448851
sub edx, eax
push edx
push 0x495c05
lea edx, [esp + 8]
push edx
call fcn.00486578
add esp, 0xc
push 0x495a5d
push 0x400
lea ecx, [esp + 0x3c]
lea edx, [esp + 8]
mov eax, ebx
call fcn.00460a70
lea ecx, [esp + 0x34]
push ecx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x44883c
test al, 0x10
je 0x44883c
lea eax, [esp + 0x34]
xor edx, edx
call fcn.00462d1c
mov eax, 0x4ad5bc
call fcn.0045edf0
test al, al
je 0x44884c
lea edx, [esp + 0x34]
mov eax, 0x4ad5bc
xor ecx, ecx
call fcn.0045d07c
jmp 0x44884c
lea edx, [esp + 0x34]
mov eax, 0x4ad5bc
xor ecx, ecx
call fcn.0045cf48
mov eax, 1
add esp, 0x434
pop ebx
ret

Function at 0x44885c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffbfc
mov esi, edx
cmp dword [0x4afc0c], 0
mov ebx, eax
mov byte [esp], cl
je 0x448886
lea edx, [esp + 4]
mov eax, 0x4adfd0
xor ecx, ecx
call fcn.0045900c
jmp 0x448895
lea eax, [esp + 4]
push eax
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea edx, [esp + 4]
push edx
push 0x4ba370
call fcn.00482a00
add esp, 8
mov byte [0x4ba770], 0
push 0
push 0x43d657
push esi
push str.FAVORITESDLG
push dword [0x49edec]
call sub.USER32.DLL_DialogBoxParamA
test eax, eax
jne 0x4488ce
xor eax, eax
jmp 0x4488e7
cmp byte [esp], 0
je 0x4488e5
mov ecx, 0x4ba770
mov edx, 0x4ba370
mov eax, ebx
call fcn.00448568
mov al, 1
add esp, 0x404
pop esi
pop ebx
ret
Function at 0x44894c
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff2b0
mov dword [0x4afc20], 1
mov byte [esp], al
lea edi, [esp + 0x950]
lea ebp, [esp + 0x810]
push 0
push str.WinRarWindow
call sub.USER32.DLL_FindWindowA
test eax, eax
sete al
and eax, 1
mov byte [esp + 1], al
lea eax, [esp + 0x10]
mov edx, 0x400
call fcn.00462ca0
lea eax, [esp + 0x10]
call fcn.0040adfc
lea edx, [esp + 0x10]
push edx
push str._sRar_
lea ecx, [esp + 0x418]
push ecx
call fcn.00486578
add esp, 0xc
lea eax, [esp + 4]
push eax
call sub.KERNEL32.DLL_GetSystemTimeAsFileTime
push ebp
lea edx, [esp + 0x414]
push edx
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
cmp eax, 0xffffffff
sete al
and eax, 1
jmp 0x448a9e
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
sub edx, dword [ebp + 8]
push eax
cmp edx, 8
push edi
setae bl
and ebx, 1
call fcn.00482a00
add esp, 8
lea edx, [ebp + 0x2c]
push edx
push edi
call fcn.00482924
add esp, 8
test byte [ebp], 0x10
je 0x448a80
cmp byte [esp + 1], 0
je 0x448a3b
push 6
push str.Rar_DI
lea ecx, [ebp + 0x2c]
push ecx
call fcn.00482afc
add esp, 0xc
test eax, eax
jne 0x448a3b
call fcn.0040e9e0
cmp eax, 4
jne 0x448a3f
xor eax, eax
jmp 0x448a44
mov eax, 1
mov byte [esp + 0xc], al
push edi
call sub.KERNEL32.DLL_RemoveDirectoryA
test eax, eax
jne 0x448a8f
test bl, bl
je 0x448a5c
cmp byte [esp], 0
je 0x448a63
cmp byte [esp + 0xc], 0
je 0x448a8f
mov eax, edi
call fcn.00462bcc
test al, al
je 0x448a8f
mov eax, edi
xor edx, edx
call fcn.00409c80
mov eax, edi
call fcn.0046266c
jmp 0x448a8f
mov eax, edi
xor edx, edx
call fcn.00409c80
push edi
call sub.KERNEL32.DLL_DeleteFileA
push ebp
push esi
call sub.KERNEL32.DLL_FindNextFileA
test eax, eax
sete al
and eax, 1
test eax, eax
jne 0x448aaf
cmp dword [0x4afc20], 1
je 0x4489e2
push esi
call sub.KERNEL32.DLL_FindClose
cmp byte [esp], 0
jne 0x448aee
cmp byte [0x49ede8], 0
je 0x448aee
push 0
call sub.KERNEL32.DLL_GetCurrentThread
push eax
call sub.KERNEL32.DLL_SetThreadPriority
mov al, 1
call fcn.0040cfd0
mov ebx, eax
mov byte [0x49ede8], bl
test bl, bl
jne 0x448aee
mov eax, 0x49615f
call fcn.004498c0
xor edx, edx
mov dword [0x4afc20], edx
add esp, 0xd50
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44b43b
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
cmp dword [0x496b54], 0
jne 0x44b47d
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov dword [0x496b54], 0x400000
mov eax, dword [esp + 8]
cmp eax, 0x8000000
ja 0x44b46c
mov dword [0x496b54], 0x200000
cmp eax, 0x4000000
ja 0x44b47d
mov dword [0x496b54], 0x100000
mov eax, dword [0x496b54]
add esp, 0x20
ret

Function at 0x44c247
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffa00
mov esi, edx
mov ebx, eax
mov ebp, esp
mov eax, esi
call fcn.0040a924
mov edi, eax
cmp byte [0x4a0724], 0
je 0x44c27c
mov eax, 0x4a0624
mov ecx, 0x3a
mov edx, edi
call fcn.0040eef0
jmp 0x44c287
push 0x3a
push edi
call fcn.00482b38
add esp, 8
test eax, eax
je 0x44c2c5
cmp byte [0x496b98], 0
jne 0x44c2c5
push 0x31
mov eax, 0x65
call fcn.00410804
push eax
mov eax, 0x528
call fcn.00410804
push eax
push ebx
call sub.USER32.DLL_MessageBoxA
dec eax
jne 0x44c2be
mov byte [0x496b98], 1
jmp 0x44c2c5
xor eax, eax
jmp 0x44c378
mov edi, esi
cmp byte [0x4a0724], 0
je 0x44c2e3
mov eax, 0x4a0624
mov ecx, 0x5c
mov edx, edi
call fcn.0040ef34
jmp 0x44c2ee
push 0x5c
push edi
call fcn.00482b50
add esp, 8
mov edi, eax
test edi, edi
je 0x44c302
cmp esi, edi
je 0x44c302
xor eax, eax
mov al, byte [edi - 1]
cmp eax, 0x3a
jne 0x44c306
mov al, 1
jmp 0x44c378
push esi
push ebp
call fcn.00482a00
add esp, 8
sub edi, esi
mov byte [ebp + edi], 0
jmp 0x44c36b
mov eax, 0x14d
call fcn.00410804
push eax
push ebp
push str.__s__n_s
lea edx, [esp + 0x40c]
push edx
call fcn.00486578
add esp, 0x10
mov eax, 0x65
push 0x34
call fcn.00410804
push eax
lea edx, [esp + 0x408]
push edx
push ebx
call sub.USER32.DLL_MessageBoxA
cmp eax, 6
jne 0x44c367
mov eax, ebp
xor ecx, ecx
xor edx, edx
call fcn.004095e0
jmp 0x44c36b
xor eax, eax
jmp 0x44c378
push ebp
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
je 0x44c319
mov al, 1
add esp, 0x600
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x44ec01
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff400
mov esi, edx
xor ebx, ebx
mov byte [esi], 0
mov eax, dword [0x4a90b8]
cmp dword [eax + 0x30], 0
jbe 0x44ec7b
push 0x400
push 0
lea edx, [esp + 8]
xor ecx, ecx
call fcn.0040e2b8
mov edx, dword [0x4a90b8]
cmp dword [edx + 0x30], 1
jne 0x44ec63
mov eax, esp
xor edx, edx
call fcn.00409944
test al, al
je 0x44ec5c
mov eax, esp
xor edx, edx
call fcn.00409c88
call fcn.004099cc
test al, al
je 0x44ec5c
xor ebx, ebx
jmp 0x44ec6a
mov ebx, 1
jmp 0x44ec6a
mov eax, esp
call fcn.0040ae9c
mov eax, esp
call fcn.0040a924
push eax
push esi
call fcn.00482a00
add esp, 8
cmp byte [esi], 0
jne 0x44ecf6
lea edx, [esp + 0x400]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.0040a924
push eax
push esi
call fcn.00482a00
add esp, 8
cmp byte [esi], 0
jne 0x44ece3
push 0x400
push 0
lea edx, [esp + 0x808]
xor ecx, ecx
mov eax, dword [0x4a90b8]
call fcn.0040e2b8
test al, al
je 0x44ece3
lea eax, [esp + 0x800]
call fcn.0040a924
push eax
push esi
call fcn.00482a00
add esp, 8
mov bl, 1
cmp byte [esi], 0
jne 0x44ecf6
push str.archive
push esi
call fcn.00482a00
add esp, 8
test bl, bl
je 0x44ed17
mov eax, esi
call fcn.0040ace4
mov ebx, eax
mov eax, esi
call fcn.0040a924
cmp ebx, eax
je 0x44ed17
xor edx, edx
mov eax, esi
call fcn.0040ac28
add esp, 0xc00
pop esi
pop ebx
ret
Function at 0x450c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ac
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 8]
lea ebx, [ebp - 0x254]
test edi, edi
je 0x450c79
push edi
push ebx
call fcn.00482a00
add esp, 8
push ebx
call fcn.00482a30
pop ecx
inc eax
add ebx, eax
push edi
push ebx
call fcn.00482a00
add esp, 8
push ebx
call fcn.00482a30
pop ecx
inc eax
add ebx, eax
mov eax, 0x426
call fcn.00410804
push eax
push ebx
call fcn.00482a00
add esp, 8
push ebx
call fcn.00482a30
pop ecx
inc eax
add ebx, eax
push 0x4971ac
push ebx
call fcn.00482a00
add esp, 8
push ebx
call fcn.00482a30
pop ecx
inc eax
add ebx, eax
mov byte [ebx], 0
push 0x4c
push 0
lea edx, [ebp - 0x54]
push edx
call fcn.00482880
mov dword [ebp - 0x54], 0x4c
mov ecx, dword [ebp - 4]
mov eax, dword [0x49edec]
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], eax
lea edx, [ebp - 0x254]
mov eax, esi
mov dword [ebp - 0x48], edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], 0x400
mov ecx, dword [ebp - 8]
add esp, 0xc
mov dword [ebp - 0x24], ecx
call fcn.0040a924
cmp esi, eax
jne 0x450d15
lea edx, [ebp - 0x654]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0x654]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x20], 0x1080c
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
jne 0x450d45
call sub.COMDLG32.DLL_CommDlgExtendedError
cmp eax, 0x3002
jne 0x450d45
mov byte [esi], 0
lea eax, [ebp - 0x54]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
setne al
and eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x450d58
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff328
push ebx
push esi
lea esi, [ebp - 0x80c]
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [esi], 0
xor ebx, ebx
lea ecx, [ebp - 0x88c]
mov eax, 0x4adfd0
mov edx, ebx
call fcn.00459280
test al, al
je 0x450dc0
test ebx, ebx
je 0x450d9f
push 0x4971ae
push esi
call fcn.00482924
add esp, 8
push 0x4971b0
push esi
call fcn.00482924
add esp, 8
lea eax, [ebp - 0x88c]
push eax
push esi
call fcn.00482924
add esp, 8
inc ebx
jmp 0x450d77
mov eax, 0x426
call fcn.00410804
push eax
push esi
mov eax, 0x425
call fcn.00410804
push eax
push esi
mov eax, 0x424
call fcn.00410804
push eax
push str._s_t_s_t_s_t_s_.exe_t_s_t._t
lea edx, [ebp - 0x40c]
push edx
call fcn.00486578
add esp, 0x1c
cmp byte [ebp - 9], 0
je 0x450e39
mov eax, dword [ebp - 8]
call fcn.0040ace4
mov ebx, eax
test ebx, ebx
je 0x450e39
inc ebx
push ebx
call fcn.00482a30
pop ecx
cmp eax, 0x14
jge 0x450e39
mov eax, 0x426
call fcn.00410804
push eax
push ebx
push ebx
push str._s_t._s_t_s_t._t
lea edx, [ebp - 0x40c]
push edx
call fcn.00486578
add esp, 0x14
xor eax, eax
jmp 0x450e51
and edx, 0xff
cmp edx, 9
jne 0x450e50
mov byte [ebp + eax - 0x40c], 0
inc eax
mov dl, byte [ebp + eax - 0x40c]
test dl, dl
jne 0x450e3d
push 0x4c
push 0
lea eax, [ebp - 0x8d8]
push eax
call fcn.00482880
mov dword [ebp - 0x8d8], 0x4c
mov ecx, dword [ebp - 4]
mov eax, dword [0x49edec]
mov dword [ebp - 0x8d4], ecx
mov dword [ebp - 0x8d0], eax
lea edx, [ebp - 0x40c]
add esp, 0xc
mov dword [ebp - 0x8cc], edx
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x8bc], ecx
mov dword [ebp - 0x8b8], 0x400
cmp byte [ebp + 8], 0
je 0x450eb9
mov eax, 0x48d
jmp 0x450ebe
mov eax, 0x140
call fcn.00410804
mov dword [ebp - 0x8a8], eax
mov eax, dword [ebp - 8]
call fcn.0040a924
cmp eax, dword [ebp - 8]
jne 0x450ef3
lea edx, [ebp - 0xcd8]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0xcd8]
mov dword [ebp - 0x8ac], ecx
mov dword [ebp - 0x8a4], 0x1080c
mov dword [ebp - 0x89c], 0x4971dd
lea eax, [ebp - 0x8d8]
push eax
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
jne 0x450f39
call sub.COMDLG32.DLL_CommDlgExtendedError
cmp eax, 0x3002
jne 0x450f39
mov eax, dword [ebp - 8]
mov byte [eax], 0
lea edx, [ebp - 0x8d8]
push edx
call sub.COMDLG32.DLL_GetOpenFileNameA
mov ebx, eax
test ebx, ebx
setne al
and eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4