joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c31e0
Capabilities:
Copy file

Disassembly:
mov eax, 0x2004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp byte [0x528320], 0
push esi
mov esi, dword [esp + 0x200c]
je 0x4c323e
cmp byte [0x55596c], 0
jne 0x4c323e
push 0x24
push 0x5f0
call fcn.00463400
push eax
push 0x5f1
call fcn.00463400
push eax
mov eax, dword [0x53f484]
push eax
call fcn.004b53a0
cmp eax, 6
jne 0x4c33a1
push ebx
push edi
push 0x800
lea ecx, [esp + 0x1010]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea edx, [esp + 0x1014]
push edx
call fcn.00453690
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
lea eax, [esp + 0x1010]
push eax
push esi
call edi
push 1
push 0x800
lea ecx, [esp + 0x14]
test eax, eax
push ecx
setne bl
call fcn.004537b0
push 0x800
lea edx, [esp + 0x10]
push edx
call fcn.00452c60
push 0x800
push str.rarreg.key
lea eax, [esp + 0x14]
push eax
call fcn.00469530
test bl, bl
je 0x4c32c8
lea ecx, [esp + 0xc]
push ecx
call fcn.004450c0
jmp 0x4c32f5
push 0
lea edx, [esp + 0x10]
push edx
push esi
call edi
xor eax, eax
jmp 0x4c32e0
movzx ecx, word [esp + eax + 0xc]
mov word [esp + eax + 0x100c], cx
add eax, 2
test cx, cx
jne 0x4c32e0
mov eax, dword [0x53f484]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x53f484]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push ecx
call esi
push 1
lea edx, [esp + 0x1010]
push edx
call fcn.004380f0
mov byte [0x528320], al
mov eax, dword [0x53f484]
push 0
push eax
call esi
mov ecx, 0x549cb8
call fcn.00496040
cmp byte [0x528320], 0
pop edi
pop ebx
je 0x4c3381
push 0x30
push 0x368
call fcn.00463400
push eax
push 0x367
call fcn.00463400
mov ecx, dword [0x53f484]
push eax
push ecx
call fcn.004b53a0
pop esi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x2004
ret 4
lea edx, [esp + 0x1004]
push edx
call fcn.004450c0
push 0x366
call fcn.00463400
push eax
call fcn.004c2ab0
add esp, 4
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.004e6b3a
add esp, 0x2004
ret 4
Function at 0x4c33c0
Capabilities:
Copy file

Disassembly:
mov eax, 0x3024
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x3020], eax
cmp byte [0x53d329], 0
je 0x4c35a5
push ebx
push 0x800
lea eax, [esp + 0x2028]
push eax
mov ecx, 0x54be08
call fcn.0047b190
push 1
push 0x5041bc
push 0x503a94
call fcn.0049c560
test eax, eax
setne bl
test bl, bl
je 0x4c3435
push 0x800
push 0x501a20
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.0049c530
cmp word [esp + 0x24], 0
jne 0x4c3447
lea edx, [esp + 0x24]
push edx
call fcn.0048d550
push 0x800
lea eax, [esp + 0x1028]
push eax
lea ecx, [esp + 0x202c]
push ecx
call fcn.004534c0
push eax
lea edx, [esp + 0x30]
push edx
call fcn.00452cb0
push 1
push 0
lea eax, [esp + 0x102c]
push eax
push 0x5af
call fcn.00463400
mov ecx, dword [0x53f484]
push eax
push ecx
call fcn.0047dcc0
test al, al
je 0x4c35a4
push 0x800
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x102c]
push eax
call fcn.00453720
test bl, bl
je 0x4c34c6
lea ecx, [esp + 0x24]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.0049c4c0
lea eax, [esp + 0x2024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c34d0
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4c34ec
mov eax, 0x7ff
xor edx, edx
mov word [esp + eax*2 + 0x2024], dx
lea eax, [esp + 0x1024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c3500
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4c351c
mov eax, 0x7ff
xor ecx, ecx
mov word [esp + eax*2 + 0x1024], cx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea ecx, [esp + 4]
lea edx, [esp + 0x2024]
lea eax, [esp + 0x1024]
push ecx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4c35a4
cmp dword [esp + 0x16], 0
jne 0x4c35a4
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push 0x5b0
call fcn.00463400
push eax
call fcn.004c2ab0
add esp, 0xc
mov ecx, 0x531158
call fcn.0043f4b0
pop ebx
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x3024
ret
Function at 0x4c37c0
Capabilities:
Move file

Disassembly:
mov eax, 0x1110
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x110c], eax
cmp byte [0x54acfa], 0
jne 0x4c3a00
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
mov ecx, 0x549cb8
xor ebp, ebp
mov dword [esp + 0x10c8], esi
mov dword [esp + 0x10cc], esi
call fcn.004913c0
lea eax, [esp + 0x34]
push eax
mov ecx, 0x549cb8
call fcn.004913c0
test al, al
je 0x4c3846
lea esp, [esp]
lea edi, [esp + 0x13]
lea ebx, [esp + 0x34]
call fcn.004bace0
test al, al
jne 0x4c3902
mov ecx, ebx
push ecx
mov ecx, 0x549cb8
call fcn.004913c0
test al, al
jne 0x4c3820
push 0
mov ecx, 0x549cb8
call fcn.004913c0
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x549cb8
call fcn.004913c0
test al, al
je 0x4c38dc
lea eax, [esp + 0x34]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c3870
sub eax, edx
sar eax, 1
lea edi, [eax + ebp + 1]
lea edx, [edi + edi + 2]
push edx
push esi
call fcn.004e70ef
mov esi, eax
add esp, 8
test esi, esi
je 0x4c39fc
lea eax, [esp + 0x34]
mov edx, eax
lea ecx, [ebp + ebp]
sub ecx, edx
lea edx, [ecx + esi]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4c38b0
lea eax, [esp + 0x34]
push eax
mov ecx, 0x549cb8
mov ebp, edi
call fcn.004913c0
test al, al
jne 0x4c3865
test ebp, ebp
jne 0x4c395d
push 0x30
push 0x65
call fcn.00463400
push eax
push 0x14c
call fcn.00463400
mov ecx, dword [0x53f484]
push eax
push ecx
call fcn.004b53a0
jmp 0x4c39fc
cmp byte [esp + 0x1124], 0
je 0x4c3953
push 0x64
lea edx, [esp + 0x38]
push edx
call fcn.004979f0
push eax
push 0x203
call fcn.00463400
push eax
call fcn.004c2ab0
movzx eax, byte [esp + 0x1b]
add esp, 8
neg eax
sbb eax, eax
and eax, 0xffffff87
add eax, 0xce
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x531158
call fcn.0043f4b0
jmp 0x4c39fc
call fcn.004c1990
jmp 0x4c39fc
xor eax, eax
xor edx, edx
mov word [esi + ebp*2], dx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov eax, dword [0x53f484]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 3
cmp byte [esp + 0x1124], dl
je 0x4c39aa
mov ecx, 0x40
mov word [esp + 0x24], cx
lea edx, [esp + 0x14]
mov edi, 1
add dword [0x53e3dc], edi
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
sub dword [0x53e3dc], edi
push esi
call fcn.004e7061
add esp, 4
test bl, bl
je 0x4c39fc
cmp dword [esp + 0x26], 0
jne 0x4c39fc
mov ecx, 0x549ca0
call fcn.004a8900
push 0x501a20
mov ecx, 0x549cb8
call fcn.00494c40
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110c]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1110
ret 4
Function at 0x4c5fa0
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
mov eax, 0x100c
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x53e3dc], 0
push ebx
mov ebx, dword [esp + 0x1014]
jne 0x4c60e5
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x4c608c
push 0x800
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
push ebx
mov word [esp + 0x24], ax
call ebp
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x53d329], 0
je 0x4c603c
cmp byte [esp + 0x1020], 0
jne 0x4c6065
cmp eax, dword [0x549ce0]
je 0x4c6065
cmp eax, dword [0x549ca4]
je 0x4c6065
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4c6065
push 1
lea eax, [esp + 0x18]
push eax
mov ecx, 0x549cb8
call fcn.00495560
cmp eax, 1
je 0x4c60e3
push 7
push str.rarreg.
lea ecx, [esp + 0x1c]
push ecx
call fcn.004534c0
push eax
call fcn.0046cb30
test eax, eax
jne 0x4c608c
lea edx, [esp + 0x14]
push edx
call fcn.004c31e0
jmp 0x4c60e3
push esi
push 0
call fcn.004b0420
mov ecx, 0x55bbfc
call fcn.004698b0
xor esi, esi
test edi, edi
jle 0x4c60c6
push 0x800
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x55bbfc
call fcn.004698e0
inc esi
cmp esi, edi
jl 0x4c60a4
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
push 0
shr eax, 0xf
and al, 1
or byte [0x555986], al
call fcn.004b30b0
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x100c]
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x100c
ret 8

Function at 0x4c66c0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x2000], eax
push esi
push 0x1000
push 0
lea eax, [esp + 0x100c]
push eax
push str.rarreg.key
push 0x501a20
call fcn.0049c580
mov esi, eax
test esi, esi
je 0x4c6756
push edi
push 0x800
lea ecx, [esp + 0xc]
push ecx
push str.Rar_RK
call fcn.004b43c0
mov edi, eax
test edi, edi
je 0x4c6746
push edi
push esi
lea edx, [esp + 0x1010]
push 1
push edx
call fcn.004eb049
push edi
call fcn.004eae6b
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.004c31e0
lea ecx, [esp + 8]
push ecx
call fcn.004450c0
push str.rarreg.key
push 0x501a20
call fcn.0049c100
pop edi
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.004e6b3a
add esp, 0x2004
ret
Function at 0x4c6770
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1028
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], 0x51f00
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push str.VerInfo
push 0x503a94
call fcn.0049c580
push 1
push 0x800
lea edx, [esp + 0x30]
push edx
call fcn.004537b0
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.00452c60
push 0x800
push str.version.dat
lea ecx, [esp + 0x30]
push ecx
call fcn.00469530
push 0x5048cc
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x18], 0
call fcn.004452a0
mov esi, eax
test esi, esi
je 0x4c681d
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004eb477
push esi
call fcn.004eae6b
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4c68e9
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x4c68b5
lea ecx, [esp + 0x20]
push ecx
push str.VerInfo
push 0x503a94
call fcn.0049c500
call fcn.0049af90
test al, al
jne 0x4c6881
push 0x503b68
lea edx, [esp + 0x2c]
push edx
call fcn.004452a0
mov esi, eax
test esi, esi
je 0x4c6881
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.004eb049
push esi
call fcn.004eae6b
add esp, 0x14
call fcn.0049afb0
movzx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0xfffffe98
add ecx, 0x168
mov dword [0x53e3d0], ecx
pop esi
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1028
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x14]
push ecx
push str.VerInfo
push 0x503a94
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call fcn.0049c500
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x4c6939
cmp dword [esp + 0x10], eax
je 0x4c6939
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.0049af90
test al, al
jne 0x4c6939
push 0x503b68
lea ecx, [esp + 0x2c]
push ecx
call fcn.004452a0
mov esi, eax
test esi, esi
je 0x4c6939
push esi
push 0xc
lea edx, [esp + 0xc]
push 1
push edx
call fcn.004eb049
push esi
call fcn.004eae6b
add esp, 0x14
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
xor ecx, ecx
push 1
xor esi, esi
sub edx, eax
push ecx
sbb esi, ecx
push esi
push edx
call fcn.004e68d0
mov ecx, dword [esp + 8]
xor esi, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
sbb edx, esi
push esi
add eax, ecx
push 0x989680
adc edx, esi
push edx
push eax
call fcn.004e9e30
push esi
push 0xe10
push edx
push eax
call fcn.004e9e30
push esi
push 0x18
push edx
push eax
call fcn.004e9e30
mov dword [0x53e3d0], eax
test eax, eax
jge 0x4c699c
mov dword [0x53e3d0], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1028
ret
Function at 0x4c9ee0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2044
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x2040], eax
mov eax, dword [esp + 0x205c]
push ebx
mov ebx, dword [esp + 0x2058]
push ebp
mov ebp, dword [esp + 0x2058]
push esi
mov esi, dword [esp + 0x2058]
push edi
mov edi, dword [esp + 0x2070]
push 0x3c
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x1c], eax
call fcn.004e7df0
add esp, 0xc
cmp byte [esp + 0x2068], 0
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x500
jne 0x4c9f56
mov dword [esp + 0x18], 0x540
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], edi
call fcn.004536c0
test eax, eax
je 0x4c9f75
cmp word [eax], 0x2e
jne 0x4c9f82
cmp word [eax + 2], 0
jne 0x4c9f82
or dword [esp + 0x18], 1
mov dword [esp + 0x3c], 0x502598
push esi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], ebx
call fcn.004534c0
cmp eax, esi
jne 0x4c9fb4
push esi
lea edx, [esp + 0x54]
push str.._s
push edx
mov edx, 0x1000
call fcn.004a63e0
lea eax, [esp + 0x5c]
add esp, 0xc
mov dword [esp + 0x24], eax
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x34], 1
mov byte [0x53d32b], 1
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4ca012
call ebx
cmp eax, 0x4c7
jne 0x4c9ffa
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c9ff3
mov dword [eax], 0
mov al, 1
jmp 0x4ca0c4
cmp dword [esp + 0x20], 0
je 0x4ca012
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], 0
call edi
mov esi, eax
mov byte [0x53d32b], 0
test esi, esi
je 0x4ca0c2
call ebx
cmp eax, 0x483
je 0x4ca0c2
cmp byte [esp + 0x2068], 0
jne 0x4ca0be
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x4ca06f
mov eax, dword [0x579778]
mov edx, dword [esp + 0x34]
mov dword [eax*4 + 0x579738], ecx
mov dword [eax*4 + 0x5796f8], edx
inc eax
and eax, 0x8000000f
jns 0x4ca068
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x579778], eax
jmp 0x4ca0b4
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
jmp 0x4ca080
mov eax, dword [esi + 0x5796f8]
cmp eax, dword [esp + 0x34]
jne 0x4ca0a8
mov ecx, dword [esi + 0x579738]
push 0
push ecx
call edi
cmp eax, 0x102
jne 0x4ca0a8
mov edx, dword [esi + 0x579738]
mov dword [esp + 0x4c], edx
add esi, 4
cmp esi, 0x40
jl 0x4ca080
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4ca0be
mov dword [eax], ecx
mov al, 1
jmp 0x4ca0c4
xor al, al
mov ecx, dword [esp + 0x2050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e6b3a
add esp, 0x2044
ret 0x1c
Function at 0x4ca700
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4ffa6b
mov eax, dword fs:[0]
push eax
mov eax, 0x6060
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x605c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x519bc0]
xor eax, esp
push eax
lea eax, [esp + 0x6074]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6088]
mov ebp, dword [esp + 0x6084]
push eax
mov edi, ecx
call fcn.004534c0
mov ecx, edi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4ca760
sub ecx, esi
mov edx, eax
sar ecx, 1
lea ebx, [edx + 2]
mov si, word [edx]
add edx, 2
test si, si
jne 0x4ca774
sub edx, ebx
sar edx, 1
lea ecx, [edx + ecx + 1]
cmp ecx, 0x1000
jae 0x4ca8bc
push 0x1000
lea edx, [esp + 0x4074]
push edx
push eax
push edi
call fcn.00452cb0
lea ecx, [esp + 0x14]
call fcn.00469a70
mov dword [esp + 0x607c], 0
push 0x1000
push 0x501a20
lea eax, [esp + 0x1078]
push eax
push str.ViewerIgnoreModifications
push 0x503ef0
call fcn.0049c530
cmp word [esp + 0x1070], si
je 0x4ca7fc
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x107c]
push edx
call fcn.004a3ee0
push 0x800
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
call fcn.00469af0
test al, al
je 0x4ca8a8
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ecx]
push 0x800
lea ecx, [esp + 0x3074]
push ecx
lea edx, [esp + 0x78]
push edx
call edi
lea eax, [esp + 0x3072]
push 0x50a81c
push eax
call fcn.004ea8e5
mov esi, eax
add esp, 8
test esi, esi
je 0x4ca8e8
xor ecx, ecx
mov word [esi], cx
add esi, 4
cmp word [esi], cx
jne 0x4ca865
mov esi, 0x502a28
push 4
push ebp
lea edx, [esp + 0x3078]
push edx
call fcn.00448a60
test al, al
je 0x4ca88d
push 4
lea eax, [esp + 0x4074]
push eax
push esi
call fcn.00448a60
test al, al
jne 0x4ca8f1
push 0x800
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00469af0
test al, al
jne 0x4ca820
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0041e100
xor al, al
mov ecx, dword [esp + 0x6074]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x605c]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x606c
ret 8
lea esi, [esp + 0x3070]
jmp 0x4ca879
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0041e100
mov al, 1
jmp 0x4ca8be

Function at 0x4cb490
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push 0x53d330
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4cb4c8
push 0x40
push 0x2bc
call fcn.00463400
push eax
push 0x2bd
call fcn.00463400
push eax
mov eax, dword [0x53f484]
push eax
call fcn.004b53a0
pop esi
ret
push 0
push 0x53d330
mov ecx, esi
call fcn.004ca910
pop esi
ret
Function at 0x4cc040
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4ffb9e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x519bc0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
test byte [0x5819cc], 1
jne 0x4cc099
or dword [0x5819cc], 1
mov dword [esp + 0x14], 0
mov ecx, 0x57d8a8
call fcn.004c96a0
push 0x500770
call fcn.004ea830
add esp, 4
mov dword [esp + 0x14], 0xffffffff
mov esi, dword [esp + 0x1c]
push 1
push esi
mov ecx, 0x57d8a8
call fcn.004ca5e0
mov bl, byte [esp + 0x20]
push 0
test bl, bl
push 0x57d8a8
sete al
movzx ecx, al
push ecx
push 0
push 0
push esi
push 0
call fcn.004c9ee0
test al, al
jne 0x4cc118
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x57d8b0]
cmp eax, 0xffffffff
je 0x4cc0f1
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x57d8b0], 0xffffffff
mov ecx, 0x5818ca
call fcn.00466b80
cmp esi, 0x4c7
sete al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
test bl, bl
je 0x4cc135
push 0x57d8a8
push 0x10000
push 0x4cb4e0
call fcn.004ebd16
add esp, 0xc
jmp 0x4cc15a
mov eax, dword [0x57d8b0]
cmp eax, 0xffffffff
je 0x4cc150
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x57d8b0], 0xffffffff
mov ecx, 0x5818ca
call fcn.00466b80
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
Function at 0x4cc170
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4ffbce
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.004e6b50
mov eax, dword [0x519bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov eax, dword [0x519bc0]
xor eax, esp
push eax
lea eax, [esp + 0x100c]
mov dword fs:[0], eax
mov esi, dword [esp + 0x101c]
test esi, esi
je 0x4cc1f4
push 0x50a7ec
push esi
call fcn.004536e0
test al, al
jne 0x4cc1cf
call fcn.004c9b60
test al, al
je 0x4cc1f4
push 0x30
push 0x65
call fcn.00463400
push eax
push 0x596
call fcn.00463400
push eax
mov eax, dword [0x53f484]
push eax
call fcn.004b53a0
jmp 0x4cc31f
cmp byte [0x53d329], 0
jne 0x4cc230
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call fcn.004c9ee0
test al, al
jne 0x4cc31f
push esi
push 0x201
call fcn.00463400
push eax
call fcn.004c2ab0
add esp, 8
jmp 0x4cc31f
push 1
call fcn.004b0320
push 1
push 0x800
push 0x5517fe
push str.Rar_EX
call fcn.004b4490
test al, al
je 0x4cc31f
push 0x800
push 0x55abfa
mov ecx, 0x54be08
call fcn.0047b190
mov ecx, dword [0x54be0c]
mov dword [0x557ba8], ecx
push 0x502a28
mov ecx, 0x55bbfc
call fcn.004698e0
push 0x800
lea edx, [esp + 0xc]
push edx
push esi
push 0x5517fe
mov dword [0x556b98], 4
call fcn.00452cb0
push 0
push 0
mov ecx, 0x54be08
call fcn.0047d470
cmp byte [0x53d328], 0
jne 0x4cc31f
test byte [0x585af4], 1
jne 0x4cc2f7
or dword [0x585af4], 1
mov dword [esp + 0x1014], 0
mov ecx, 0x5819d0
call fcn.004c96a0
push 0x5007c0
call fcn.004ea830
add esp, 4
mov dword [esp + 0x1014], 0xffffffff
push 0
lea eax, [esp + 0xc]
push eax
mov ecx, 0x5819d0
call fcn.004ca5e0
push 0x5819d0
push 0x10000
push 0x4cb4e0
call fcn.004ebd16
add esp, 0xc
mov ecx, dword [esp + 0x100c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.004e6b3a
add esp, 0x1010
ret 4
Function at 0x4d2130
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push esi
push 0x5a9a20
mov esi, ecx
call fcn.0043a970
mov edx, dword [esp + 8]
mov dword [esi + 4], 0x12345678
mov dword [esi + 8], 0x23456789
mov dword [esi + 0xc], 0x34567890
mov cl, byte [edx]
test cl, cl
je 0x4d21ae
lea esp, [esp]
mov eax, dword [esi + 4]
movsx ecx, cl
xor ecx, eax
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x5a9a20]
shr eax, 8
xor ecx, eax
movzx eax, cl
add eax, dword [esi + 8]
mov dword [esi + 4], ecx
mov ecx, dword [esi + 0xc]
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 8], eax
shr eax, 0x18
xor eax, ecx
shr ecx, 8
and eax, 0xff
xor ecx, dword [eax*4 + 0x5a9a20]
inc edx
mov dword [esi + 0xc], ecx
mov cl, byte [edx]
test cl, cl
jne 0x4d2160
pop esi
ret 4
Function at 0x4d25a0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
cmp byte [0x554910], 0
je 0x4d262e
push ebx
mov ebx, dword [esp + 0xc]
imul ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0xc]
test ebx, ebx
je 0x4d262c
push esi
push edi
movsx edx, byte [ebp]
mov edi, dword [ecx + 4]
xor edx, edi
and edx, 0xff
mov edx, dword [edx*4 + 0x5a9a20]
mov eax, dword [ecx + 0xc]
shr edi, 8
xor edx, edi
mov dword [ecx + 4], edx
movzx edx, dl
add edx, dword [ecx + 8]
mov esi, eax
imul edx, edx, 0x8088405
inc edx
mov dword [ecx + 8], edx
shr edx, 0x18
xor edx, eax
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x5a9a20]
and esi, 0xfffd
mov dword [ecx + 0xc], eax
or esi, 2
mov eax, esi
xor eax, 1
imul eax, esi
shr eax, 8
xor byte [ebp], al
inc ebp
sub ebx, 1
jne 0x4d25c2
pop edi
pop esi
pop ebp
pop ebx
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 8]
push 0
push edx
mov edx, dword [esp + 0xc]
push eax
push edx
call fcn.004d1610
ret 0xc
Function at 0x4dad70
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x4c
push esi
mov esi, dword [esp + 0x54]
push edi
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4dada4
test al, 0x10
jne 0x4dad9a
and eax, 0xffffffdf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4dada4
pop edi
mov al, 1
pop esi
add esp, 0x4c
ret 4
mov eax, dword [edi + 0x64b3fc]
lea ecx, [esp + 8]
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], esi
mov dword [esp + 0x48], 2
call fcn.0046b580
pop edi
xor al, al
pop esi
add esp, 0x4c
ret 4