joyce8/EMBER2024-capa huggingface dataset:
Function at 0x463b50
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4b0158
push 1
push 0
push 0x4b0188
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x463c1b
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x463b9c
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x463bb0
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x463bc2
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4b01b8
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x463c12
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x463c09
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x463c28
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
lea edx, [ebp - 8]
push edx
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x463c64
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
lea edx, [ebp - 8]
push edx
push 0x19
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x463ca0
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x463cb8
xor eax, eax
jmp 0x463cf5
push ebx
call fcn.00498eac
pop ecx
lea edx, [ebp - 0x20]
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
push edx
call fcn.00498cfc
add esp, 0xc
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x14
mov dword [ebp - 0x18], ebx
lea ecx, [ebp - 0x20]
push ecx
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464330
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
mov esi, edx
mov ebx, eax
lea eax, [ebp - 0x400]
mov edx, 0x400
call fcn.00464700
lea eax, [ebp - 0x400]
call fcn.0040c35c
push ebx
lea edx, [ebp - 0x400]
push edx
call fcn.00498da0
add esp, 8
lea eax, [ebp - 0x400]
call fcn.0040adc4
test eax, eax
je 0x46438b
push 0
lea edx, [ebp - 0x400]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x4643b3
lea ecx, [ebp - 0x400]
mov eax, 0x1f7
push ecx
call fcn.004129c8
push eax
call fcn.00487828
add esp, 8
mov eax, 0x4b3b9c
call fcn.0042dd14
xor eax, eax
jmp 0x4643c5
lea edx, [ebp - 0x400]
push edx
push esi
call fcn.00498e7c
add esp, 8
mov al, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x464548
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], eax
call sub.USER32.DLL_GetDesktopWindow
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [ebp - 0x2c]
push eax
push 0x18
push dword [ebp - 4]
call sub.GDI32.DLL_GetObjectA
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [ebp - 0x14], eax
push 0xcc0020
push dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
neg edx
push edx
push 0
mov ecx, dword [ebp - 0x28]
dec ecx
push ecx
push ebx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [ebp - 0x10]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [ebp - 0x14]
push esi
call sub.GDI32.DLL_SelectObject
push dword [ebp - 0xc]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push dword [ebp - 8]
call sub.USER32.DLL_ReleaseDC
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x464700
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x4abebf
push esi
mov edx, 0x4abed7
mov eax, 0x4abed1
mov ecx, ebx
call fcn.004619ec
mov byte [ebp - 0x400], 0
cmp byte [ebx], 0
je 0x464757
push 0x400
lea eax, [ebp - 0x400]
push eax
push ebx
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x464757
lea edx, [ebp - 0x400]
mov ecx, esi
mov eax, ebx
call fcn.0040f778
cmp byte [ebx], 0
je 0x464767
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x464785
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x464777
cmp byte [ebx], 0
jne 0x464785
push str._rartemp
push ebx
call fcn.00498e7c
add esp, 8
mov eax, ebx
call fcn.0040c35c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x46492c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff6c
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [ebp - 0x84], 2
jne 0x46496f
cmp dword [ebp - 0x90], 5
ja 0x464973
cmp dword [ebp - 0x90], 5
jne 0x46496f
cmp dword [ebp - 0x8c], 0
ja 0x464973
xor eax, eax
jmp 0x464978
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4651b4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x4651bd
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4ac024
call fcn.004992ac
call fcn.004a127c
mov dword [ebp - 0x2458], eax
xor ebx, ebx
cmp dword [ebp + 8], 0
je 0x465200
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.004136c4
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.004141d8
lea eax, [ebp - 0x28d0]
call fcn.004141d8
lea eax, [ebp - 0x28a4]
call fcn.004141d8
inc dword [0x4c9894]
jmp 0x4652ed
test bl, bl
jne 0x465283
call fcn.004a127c
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x465283
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.004735f4
mov bl, 1
test bl, bl
je 0x465297
lea eax, [ebp - 0x3510]
call fcn.004754a8
call fcn.00474794
call fcn.0047d98c
cmp byte [ebp + 0x18], 0
je 0x4652b7
lea eax, [ebp - 0x3510]
call fcn.0040be48
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x4652bb
xor eax, eax
jmp 0x4652c0
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x14]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 0xc]
call fcn.004653a8
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.004137fc
test eax, eax
jne 0x46530f
cmp dword [0x4c989c], 0
je 0x46525b
dec dword [0x4c9894]
cmp dword [0x4c989c], 0
sete cl
and ecx, 1
mov byte [ebp - 0x2459], cl
mov word [ebp - 0x2440], 0x14
cmp dword [0x4c989c], 0
je 0x46534b
mov eax, esi
call fcn.00461038
xor edx, edx
mov dword [0x4c989c], edx
jmp 0x465352
mov eax, esi
call fcn.00461310
cmp dword [ebp + 8], 0
je 0x465362
call fcn.00475954
mov edx, dword [ebp + 8]
mov byte [edx], al
test bl, bl
je 0x465371
push dword [0x4c6ef8]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.0041379c
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x466188
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
push 0x1000000
call fcn.0049768c
pop ecx
mov edi, eax
test edi, edi
jne 0x4661ae
mov eax, 1
xor edx, edx
jmp 0x46623c
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x466205
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
mov cl, byte [edi + ebx]
sub ebx, 0x100
xor byte [edi + esi], cl
sub esi, 0x100
dec eax
test eax, eax
jg 0x4661d2
dec ebx
dec esi
add dword [ebp - 8], 1
adc dword [ebp - 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
jb 0x4661cd
push edi
call fcn.004974c8
pop ecx
push 0
push 0x64
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.0049d350
add eax, 1
adc edx, 0
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x46bee4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push 0x4c98b0
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46bf1b
push 0x40
mov eax, 0x2bc
call fcn.004129c8
push eax
mov eax, 0x2bd
call fcn.004129c8
push eax
push dword [0x4c6eec]
call sub.USER32.DLL_MessageBoxA
pop ebx
ret
push 0
mov edx, 0x4c98b0
xor ecx, ecx
mov eax, ebx
call fcn.0046b04c
pop ebx
ret

Function at 0x46bf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffb64
push ebx
push esi
mov esi, ecx
mov ebx, edx
push 0
push 0
xor edx, edx
mov eax, ebx
call fcn.0046a110
test al, al
je 0x46bf7f
push 0x30
mov eax, 0x65
call fcn.004129c8
push eax
mov eax, 0x596
call fcn.004129c8
push eax
push dword [0x4c6eec]
call sub.USER32.DLL_MessageBoxA
jmp 0x46c161
cmp dword [0x4c988c], 0
jne 0x46bfbc
push 0
push 1
push 0
push 0
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.0046a8f0
test al, al
jne 0x46c161
push ebx
mov eax, 0x201
call fcn.004129c8
push eax
call fcn.00487828
add esp, 8
jmp 0x46c161
lea edx, [ebp - 0x400]
mov eax, str.Rar_EXXXXXXX
call fcn.00464330
test al, al
je 0x46c161
lea edx, [ebp - 0x800]
push edx
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea ecx, [ebp - 0x400]
push ecx
call fcn.0049a80c
pop ecx
lea edx, [ebp - 0x89c]
mov eax, 0x4c7c4c
call fcn.00457db0
call fcn.00449c20
mov ecx, 0x4bfd40
mov edx, 0x4bf940
mov eax, 0x4c7c4c
call fcn.00457d7c
mov ecx, dword [ebp - 0x88c]
mov dword [0x4be4f0], ecx
mov edx, 0x4ac49e
mov eax, dword [0x4c0540]
call fcn.0040ff50
call fcn.0044a7b4
mov dword [0x4be0dc], 4
mov eax, 0x4c7c4c
xor ecx, ecx
xor edx, edx
call fcn.00452bdc
cmp dword [0x4c98a0], 0
jne 0x46c161
lea edx, [ebp - 0xc9c]
mov eax, ebx
call fcn.0040bf64
lea edx, [ebp - 0x149c]
mov eax, esi
call fcn.0040c094
lea edx, [ebp - 0xc9c]
lea eax, [ebp - 0xc9c]
call fcn.0040acd8
lea edx, [ebp - 0x149c]
lea eax, [ebp - 0x149c]
call fcn.0040ad28
push 0x2010
push 0
push 0x4d19ac
call fcn.00498cfc
add esp, 0xc
lea ecx, [ebp - 0xc9c]
push ecx
push 0x4d25b9
call fcn.00498e7c
add esp, 8
lea edx, [ebp - 0x149c]
mov eax, 0x4d29ba
call fcn.00410b08
push 0x4bf940
push 0x4d19b1
call fcn.00498e7c
add esp, 8
mov edx, 0x4bfd40
mov eax, 0x4d1db2
call fcn.00410b08
lea ecx, [ebp - 0x400]
push ecx
push 0x4d31ba
call fcn.00498e7c
add esp, 8
lea eax, [ebp - 0x800]
push eax
call fcn.0049a80c
cmp dword [ebp - 0x810], 0
mov byte [0x4d19b0], 0
pop ecx
mov edx, dword [0x4be4f0]
mov dword [0x4d25b4], edx
je 0x46c13b
cmp byte [0x4c980a], 0
je 0x46c13f
xor ecx, ecx
jmp 0x46c144
mov ecx, 1
mov byte [0x4d25b8], cl
push 0x4d19ac
push 0x10000
push 0x46a174
call fcn.004a10fc
add esp, 0xc
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x472b29
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb6c
push ebx
push esi
push edi
mov dword [ebp - 0x58], ecx
mov edi, edx
mov dword [ebp - 0x54], eax
mov eax, 0x4ad550
call fcn.004992ac
push str.winrar_config_integration
push 0x10000
push 0
push 0x8000004
push 0
push 0xffffffffffffffff
call sub.KERNEL32.DLL_CreateFileMappingA
mov ebx, eax
test ebx, ebx
jne 0x472b75
mov eax, dword [ebp - 0x50]
mov dword fs:[0], eax
jmp 0x472d75
push 0
push 0
push 0
push 2
push ebx
call sub.KERNEL32.DLL_MapViewOfFile
mov word [ebp - 0x40], 8
mov esi, eax
mov word [ebp - 0x40], 0x14
lea eax, [ebp - 0x20]
xor edx, edx
call fcn.00412150
add dword [ebp - 0x34], 2
mov word [ebp - 0x40], 0x20
test edi, edi
je 0x472be2
lea eax, [ebp - 0x20]
mov dl, 0x49
call fcn.004122e4
lea eax, [ebp - 0x20]
mov dl, 0x1a
call fcn.004122e4
lea eax, [ebp - 0x20]
mov ecx, 0x1a
mov edx, edi
call fcn.004123b8
lea eax, [ebp - 0x20]
mov edx, dword [ebp - 0x58]
call fcn.00472af4
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x14]
call fcn.00472af4
cmp dword [ebp + 0x10], 0
je 0x472c13
lea eax, [ebp - 0x20]
mov dl, 0x54
call fcn.004122e4
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0x10]
call fcn.00472af4
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 0xc]
call fcn.00472af4
lea eax, [ebp - 0x20]
mov edx, dword [ebp + 8]
call fcn.00472af4
mov word [ebp - 0x40], 0x2c
lea eax, [ebp - 0x2c]
call fcn.00402138
inc dword [ebp - 0x34]
lea edx, [ebp - 0x2c]
mov word [ebp - 0x40], 0x20
lea eax, [ebp - 0x20]
call fcn.00412488
cmp dword [ebp - 0x28], 0x10000
jle 0x472c7a
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004017f0
sub dword [ebp - 0x34], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004121d0
mov ecx, dword [ebp - 0x50]
mov dword fs:[0], ecx
jmp 0x472d75
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push esi
call fcn.00498c8c
add esp, 0xc
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push 0x400
lea eax, [ebp - 0x458]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov dword [ebp - 0x494], 0x3c
mov dword [ebp - 0x490], 0x40
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x458]
mov dword [ebp - 0x48c], edx
xor eax, eax
mov dword [ebp - 0x488], str.runas
mov dword [ebp - 0x484], ecx
xor edx, edx
mov dword [ebp - 0x480], str._setup_integration
mov dword [ebp - 0x47c], 0x4ad3b0
mov dword [ebp - 0x478], eax
mov dword [ebp - 0x474], edx
lea ecx, [ebp - 0x494]
push ecx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
je 0x472d21
push 0xffffffffffffffff
push dword [ebp - 0x45c]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [ebp - 0x45c]
call sub.KERNEL32.DLL_CloseHandle
push ebx
call sub.KERNEL32.DLL_CloseHandle
dec dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
mov edx, 2
call fcn.004017f0
sub dword [ebp - 0x34], 2
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004121d0
mov word [ebp - 0x40], 8
mov word [ebp - 0x40], 0
jmp 0x472d6b
mov edx, dword [ebp - 0x50]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x472f54
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffdc0
push ebx
push esi
mov byte [ebp - 1], dl
mov ebx, eax
mov esi, 0x4ad0b4
lea eax, [ebp - 0x404]
call fcn.00464dd0
lea eax, [ebp - 0x404]
call fcn.0040c35c
lea edx, [esi + 0x387]
push edx
lea ecx, [ebp - 0x404]
push ecx
call fcn.00498da0
add esp, 8
lea eax, [ebp - 0x404]
push eax
lea edx, [ebp - 0x804]
push edx
call fcn.00498e7c
add esp, 8
test bl, bl
je 0x472fcb
lea edx, [esi + 0x394]
lea eax, [esi + 8]
mov ecx, 1
call fcn.004618f0
jmp 0x473012
lea edx, [ebp - 0x404]
lea eax, [esi + 0x387]
mov cl, 1
call fcn.0040c568
lea eax, [ebp - 0x404]
xor edx, edx
call fcn.0040a838
test al, al
jne 0x473012
cmp byte [ebp - 1], 0
je 0x472ffc
xor eax, eax
jmp 0x47318c
lea edx, [ebp - 0x804]
push edx
lea ecx, [ebp - 0x404]
push ecx
call fcn.00498e7c
add esp, 8
cmp byte [ebp - 1], 0
jne 0x47304c
lea eax, [esi + 0x3a5]
test bl, bl
push eax
mov eax, 0x5b4
push ebx
jne 0x47302a
inc eax
call fcn.004129c8
mov edx, eax
lea ecx, [ebp - 0x404]
mov eax, dword [0x4c6eec]
call fcn.0044dbd0
test al, al
jne 0x47304c
xor eax, eax
jmp 0x47318c
lea edx, [ebp - 0x404]
test bl, bl
push edx
je 0x47305f
lea ecx, [esi + 0x3ab]
jmp 0x473065
lea ecx, [esi + 0x3d6]
push ecx
lea eax, [ebp - 0xd04]
push eax
call fcn.0049bdcc
add esp, 0xc
lea edx, [ebp - 0xd40]
push 0x3c
push 0
push edx
call fcn.00498cfc
mov dword [ebp - 0xd40], 0x3c
mov dword [ebp - 0xd3c], 0x40
mov eax, dword [0x4c6eec]
lea edx, [esi + 0x3de]
mov dword [ebp - 0xd38], eax
mov dword [ebp - 0xd30], edx
lea ecx, [ebp - 0xd04]
add esp, 0xc
mov dword [ebp - 0xd2c], ecx
lea eax, [ebp - 0xd40]
mov dword [ebp - 0xd24], 1
push eax
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne dl
and edx, 1
mov byte [ebp - 2], dl
cmp byte [ebp - 2], 0
je 0x473101
push 0x1388
push dword [ebp - 0xd08]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [ebp - 0xd08]
call sub.KERNEL32.DLL_CloseHandle
test bl, bl
je 0x473113
lea edx, [esi + 0x394]
lea eax, [esi + 8]
call fcn.00461cd0
cmp byte [ebp - 2], 0
je 0x473169
test bl, bl
jne 0x473122
call fcn.00473194
lea ecx, [ebp - 0x404]
push ecx
mov eax, 0x460
test bl, bl
jne 0x473133
inc eax
call fcn.004129c8
push eax
lea edx, [ebp - 0x1240]
push edx
call fcn.0049bdcc
add esp, 0xc
mov eax, 0x2ee
push 0
call fcn.004129c8
push eax
lea edx, [ebp - 0x1240]
push edx
push dword [0x4c6eec]
call sub.USER32.DLL_MessageBoxA
jmp 0x473189
cmp byte [ebp - 1], 0
jne 0x473189
lea ecx, [ebp - 0xd04]
mov eax, 0x201
push ecx
call fcn.004129c8
push eax
call fcn.00487828
add esp, 8
mov al, byte [ebp - 2]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4732a0
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffbe4
push ebx
push esi
push edi
push str.winrar_config_integration
push 0
push 4
call sub.KERNEL32.DLL_OpenFileMappingA
mov edi, eax
test edi, edi
je 0x4733cb
push 0x10000
push 0
push 0
push 4
push edi
call sub.KERNEL32.DLL_MapViewOfFile
mov esi, eax
test esi, esi
jne 0x4732ed
push edi
call sub.KERNEL32.DLL_CloseHandle
jmp 0x4733cb
mov ebx, esi
xor eax, eax
mov al, byte [esi]
cmp eax, 0x49
jne 0x47335e
xor edx, edx
mov dl, byte [esi + 1]
cmp edx, 0x1a
jne 0x47335e
push 0x1a
lea ecx, [esi + 2]
push ecx
lea eax, [ebp - 0x1c]
push eax
call fcn.00498c8c
add esp, 0xc
lea ebx, [esi + 0x1c]
lea edx, [ebp - 0x41c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472d7e
mov ebx, eax
lea edx, [ebp - 0x81c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472d7e
mov ebx, eax
test ebx, ebx
je 0x47335e
lea eax, [ebp - 0x1c]
xor edx, edx
call fcn.00463cfc
lea edx, [ebp - 0x81c]
lea eax, [ebp - 0x41c]
call fcn.00472aa9
xor ecx, ecx
mov cl, byte [ebx]
cmp ecx, 0x54
jne 0x4733bf
inc ebx
lea edx, [ebp - 0xc1c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472d7e
mov ebx, eax
lea edx, [ebp - 0x101c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472d7e
mov ebx, eax
lea edx, [ebp - 0x141c]
mov ecx, 0x400
mov eax, ebx
call fcn.00472d7e
mov ebx, eax
test ebx, ebx
je 0x4733bf
lea ecx, [ebp - 0x141c]
lea edx, [ebp - 0x101c]
lea eax, [ebp - 0xc1c]
call fcn.00463ef4
push esi
call sub.KERNEL32.DLL_UnmapViewOfFile
push edi
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x473468
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
push ebx
push esi
mov esi, edx
push eax
push dword [0x4c6ef8]
call sub.USER32.DLL_GetDlgItem
mov ebx, eax
lea eax, [ebp - 0x200]
push pe_nt_image_headers32
push eax
push ebx
call sub.USER32.DLL_GetWindowTextA
lea edx, [ebp - 0x200]
push edx
push esi
call fcn.00498e30
add esp, 8
test eax, eax
je 0x4734b0
push esi
push ebx
call sub.USER32.DLL_SetWindowTextA
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x474794
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
cmp dword [0x4c6ef8], 0
je 0x474859
push pe_nt_image_headers32
lea eax, [ebp - 0x200]
push eax
push dword [0x4c6ef8]
call sub.USER32.DLL_GetWindowTextA
cmp dword [0x4d3b70], 8
je 0x4747f2
push 0x4d3b74
lea edx, [ebp - 0x200]
push edx
call fcn.00498e30
add esp, 8
test eax, eax
je 0x4747f2
push 0x4d3b74
push dword [0x4c6ef8]
call sub.USER32.DLL_SetWindowTextA
cmp dword [0x4d3b70], 0
je 0x474816
cmp dword [0x4d3b70], 1
je 0x474816
cmp dword [0x4d3b70], 2
je 0x474816
cmp dword [0x4d3b70], 8
jne 0x47483b
mov edx, 0x4d3bf4
mov eax, 0x9c
call fcn.00473468
mov eax, 0x4d3c74
call fcn.0040be48
mov edx, eax
mov eax, 0x9b
call fcn.00473468
mov edx, 0x64
mov eax, 2
call fcn.0047e418
test al, al
je 0x474859
push dword [0x4c6ef8]
call sub.USER32.DLL_UpdateWindow
mov esp, ebp
pop ebp
ret
Function at 0x475a98
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe84
push ebx
mov ebx, eax
push esi
push edi
mov byte [ebp - 1], cl
mov esi, edx
cmp dword [ebx + 8], 0
jne 0x475abe
mov eax, str.comctl32.dll
call fcn.00464484
mov dword [ebx + 8], eax
cmp dword [ebx], 0
je 0x475aca
push dword [ebx]
call sub.USER32.DLL_DestroyWindow
mov dword [ebx + 0xc], 0xffffffff
mov dl, byte [ebp - 1]
mov byte [ebx + 4], dl
push 0
push dword [0x4b41d4]
push dword [ebp + 8]
push esi
push 0xdc
push 0x3c
push 0
push 0
push 0x44200046
push 0
cmp byte [ebp - 1], 0
je 0x475b02
mov ecx, str.ComboBoxEx32
jmp 0x475b07
mov ecx, str.combobox
push ecx
push 0
call sub.USER32.DLL_CreateWindowExA
mov dword [ebx], eax
cmp byte [ebp - 1], 0
je 0x475bb4
lea eax, [ebp - 8]
push eax
push 0
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push 0x4209
push 0x160
lea edx, [ebp - 0x17c]
push edx
push 0
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetFileInfoA
push eax
push 0
push 0x402
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push dword [ebp - 8]
mov eax, dword [0x4cd5f4]
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
push 0
lea ecx, [ebp - 0x170]
push dword [ebp - 0x178]
push ecx
push 0
push 0
push 0xffffffffffffffff
push 0
mov ecx, 1
lea edx, [ebp - 0x170]
mov eax, ebx
call fcn.00475f2c
push 0
push 4
push 0x408
push dword [ebx]
call sub.USER32.DLL_SendMessageA
push 0
push 0
push 0x407
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x475bc7
call fcn.00464880
jmp 0x475bc7
push 3
push 0
push 0
push 0
push 0
push 0
push dword [ebx]
call sub.USER32.DLL_SetWindowPos
mov byte [ebp - 9], 0
cmp byte [ebp - 1], 0
je 0x475bf4
xor eax, eax
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x10]
push edx
call sub.SHELL32.DLL_SHGetDesktopFolder
test eax, eax
jne 0x475bf4
push 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov eax, ebx
call fcn.00475c58
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x475c45
call fcn.00464794
mov edi, eax
xor esi, esi
mov ecx, esi
mov eax, 1
shl eax, cl
test eax, edi
je 0x475c3f
lea edx, [esi + 0x41]
lea eax, [ebp - 0x1c]
push edx
push 0x4ad683
push eax
call fcn.0049bdcc
add esp, 0xc
xor ecx, ecx
lea edx, [ebp - 0x1c]
mov eax, ebx
push 0
push 0xffffffffffffffff
push 0
push 0
push 2
push 0xffffffffffffffff
push 1
call fcn.00475f2c
inc esi
cmp esi, 0x20
jl 0x475c03
mov eax, ebx
call fcn.004760bc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4