joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486b90
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x404
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
push 0x200
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [edi], 0x3a8
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x40
lea edx, [esp + 0xc]
push edx
call fcn.00446c00
cmp word [0x50e250], 0
je 0x486c40
lea eax, [esp + 8]
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x486be0
mov ecx, dword [0x4be188]
mov dx, word [0x4be18c]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x486c06
sub eax, edx
push 0x50e250
sar eax, 1
push 0x5aa
mov esi, eax
call fcn.00461310
push eax
lea eax, [esp + esi*2 + 0x10]
push str._s:__s
mov edx, 0x200
sub edx, esi
push eax
call fcn.0049c820
add esp, 0x10
cmp byte [0x50e2b6], 0
je 0x486cae
lea eax, [esp + 8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x486c50
mov ecx, dword [0x4be188]
mov dx, word [0x4be18c]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x486c76
sub eax, edx
sar eax, 1
mov esi, eax
mov eax, dword [esp + 0x410]
push eax
push 0x2fd
call fcn.00461310
push eax
lea ecx, [esp + esi*2 + 0x10]
mov edx, 0x200
sub edx, esi
push ecx
call fcn.0049c820
add esp, 0xc
push 0x80
lea edx, [esp + 0xc]
push edx
add edi, 0x18
push edi
call fcn.0046ac10
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.004a4b43
add esp, 0x404
ret 4
Function at 0x489be0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x800], eax
cmp byte [esp + 0x81c], 0
push ebx
push ebp
mov ebp, dword [esp + 0x810]
push esi
mov esi, dword [esp + 0x818]
push edi
mov edi, dword [esp + 0x820]
je 0x489c87
push 0x400
push esi
push ebp
push str.DefFolder
push str.Extraction
call fcn.0045ba60
cmp word [ebp], 0
jne 0x489c51
mov edx, ebp
mov eax, esi
sub edx, esi
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x489c40
jmp 0x489c8d
push 0x400
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
lea eax, [esp + 0x10]
mov word [esp + 0x80e], cx
mov edx, ebp
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x489c76
jmp 0x489c8d
xor edx, edx
mov word [ebp], dx
movzx eax, word [ebp]
test ax, ax
setne bl
test ax, ax
jne 0x489ca8
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push ebp
call fcn.004516c0
cmp byte [esp + 0x824], 0
jne 0x489cc0
test bl, bl
je 0x489df2
push 1
push str.AppendName
push str.Extraction
call fcn.0045ba90
test eax, eax
je 0x489df2
push 0x400
push edi
lea eax, [esp + 0x18]
push eax
call fcn.0046ac10
xor edi, edi
cmp word [esp + 0x10], di
je 0x489d29
xor eax, eax
lea esi, [esp + 0x10]
cmp word [esi], 0x25
jne 0x489d19
lea ecx, [esp + eax + 0x12]
push 0x25
push ecx
call fcn.004a5ae0
add esp, 8
test eax, eax
je 0x489d19
mov edx, 0x5f
mov word [esi], dx
inc edi
lea eax, [edi + edi]
cmp word [esp + eax + 0x10], 0
lea esi, [esp + eax + 0x10]
jne 0x489cf8
lea eax, [esp + 0x10]
push eax
call fcn.00451c20
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x489d35
mov edi, ebp
sub eax, edx
add edi, 0xfffffffe
jmp 0x489d50
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x489d50
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.00451fb0
mov esi, eax
test esi, esi
je 0x489df2
cmp esi, ebp
jbe 0x489df2
xor ecx, ecx
push ebp
mov word [esi], cx
call fcn.00451fb0
mov edi, eax
test edi, edi
je 0x489dd2
cmp edi, ebp
jbe 0x489dd2
cmp byte [esp + 0x828], 0
je 0x489dbe
cmp word [esi + 2], 0
je 0x489dbe
movzx edx, word [esi + 4]
push edx
call fcn.0046a9e0
test al, al
jne 0x489dbe
movzx eax, word [esi - 2]
push eax
call fcn.0046a9e0
test al, al
jne 0x489dcd
push str..tar
push edi
call fcn.00473520
test eax, eax
jne 0x489dd2
xor ecx, ecx
mov word [edi], cx
sub esi, 2
cmp esi, ebp
jbe 0x489df2
lea esp, [esp]
cmp word [esi], 0x2e
jne 0x489df2
xor edx, edx
mov word [esi], dx
sub esi, 2
cmp esi, ebp
ja 0x489de0
push 0
push ebp
call fcn.00451710
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004a4b43
add esp, 0x804
ret 0x18
Function at 0x489e20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [esp + 0x80c]
push edi
lea ecx, [esp + 4]
push ecx
push eax
call fcn.004518e0
lea edx, [esp + 4]
push edx
call fcn.004516c0
lea edi, [esp + 4]
add edi, 0xfffffffe
jmp 0x489e60
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x489e60
mov eax, dword [0x4bb6fc]
push 1
push 0x4bad38
push 0
lea ecx, [esp + 0x10]
push ecx
push str.open
push 0
mov dword [edi], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.004a4b43
add esp, 0x808
ret 4
Function at 0x48b8c0
Capabilities:
Move file

Disassembly:
mov eax, 0x1054
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x1050], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov ecx, 0x4f04a8
xor esi, esi
call fcn.00440540
push edi
lea eax, [esp + 0x30]
push eax
mov ecx, 0x4f04a8
call fcn.00440540
test al, al
je 0x48b98e
lea ecx, [esp + 0x85c]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.004518e0
lea eax, [esp + 0x85c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48b920
sub eax, edx
sar eax, 1
lea ebx, [eax + edi + 1]
lea eax, [ebx + ebx + 2]
push eax
push esi
call fcn.004a4d6d
mov esi, eax
add esp, 8
test esi, esi
je 0x48ba54
lea eax, [esp + 0x85c]
mov edx, eax
lea ecx, [edi + edi]
sub ecx, edx
lea edx, [ecx + esi]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x48b960
push 0
lea eax, [esp + 0x30]
push eax
mov ecx, 0x4f04a8
mov edi, ebx
call fcn.00440540
test al, al
jne 0x48b903
test edi, edi
jne 0x48b9b5
push 0x30
push 0x65
call fcn.00461310
push eax
push 0x14c
call fcn.00461310
mov ecx, dword [0x4eacd4]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x48ba54
xor eax, eax
xor edx, edx
mov word [esi + edi*2], dx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov eax, dword [0x4eacd4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
cmp byte [esp + 0x1064], dl
je 0x48ba02
mov ecx, 0x40
mov word [esp + 0x1c], cx
lea edx, [esp + 0xc]
mov edi, 1
add dword [0x4ea434], edi
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
sub dword [0x4ea434], edi
push esi
call fcn.004a4cdf
add esp, 4
test bl, bl
je 0x48ba54
cmp dword [esp + 0x1e], 0
jne 0x48ba54
mov ecx, 0x4f0480
call fcn.00470e00
push 0x4bad38
mov ecx, 0x4f04a8
call fcn.00443130
mov ecx, dword [esp + 0x105c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004a4b43
add esp, 0x1054
ret 4
Function at 0x48d4f0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x2d0], eax
push esi
mov esi, dword [esp + 0x2dc]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x2c8]
push 0x4ba858
push ecx
mov edx, 0xa
call fcn.0049c820
add esp, 0xc
push 0x301
push 0x2b4
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [esi + 0x10], 1
je 0x48d57f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4bad38
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48d5e2
mov ecx, dword [edi]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x48d635
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
xor ecx, esp
call fcn.004a4b43
add esp, 0x2d4
ret 4
Function at 0x4932b0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x1a64
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x1a60], eax
cmp byte [esp + 0x1a6c], 0
mov dword [0x4ea3a0], 1
je 0x493460
push esi
push 0x400
lea eax, [esp + 0xa68]
push eax
call fcn.00484c20
lea ecx, [esp + 0xa64]
push ecx
call fcn.004516c0
lea edx, [esp + 0xa64]
push edx
lea eax, [esp + 0x1268]
push str._sRar_
push eax
mov edx, 0x400
call fcn.0049c820
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1268]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 8], esi
cmp esi, 0xffffffff
je 0x493458
push ebx
push edi
cmp dword [0x4ea3a0], 1
jne 0x493456
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x24]
cmp ecx, 8
setae byte [esp + 0xf]
xor eax, eax
movzx ecx, word [esp + eax + 0xa6c]
mov word [esp + eax + 0x26c], cx
add eax, 2
test cx, cx
jne 0x493370
lea eax, [esp + 0x48]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x493390
lea edi, [esp + 0x26c]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4933b0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4933b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x1c], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x493431
push 6
lea edx, [esp + 0x4c]
push str.Rar_DI
push edx
call fcn.004a75f3
add esp, 0xc
test eax, eax
jne 0x4933fb
call fcn.0043ee90
cmp eax, 0x400
je 0x4933fb
mov bl, 1
jmp 0x4933fd
xor bl, bl
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x49343e
cmp byte [esp + 0xf], al
je 0x49341e
cmp byte [esp + 0x1a74], al
je 0x493422
test bl, bl
je 0x49343e
lea ecx, [esp + 0x26c]
push ecx
call fcn.00485a50
jmp 0x49343e
lea edx, [esp + 0x26c]
push edx
call fcn.004857e0
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x493351
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp byte [esp + 0x1a68], 0
jne 0x49348e
cmp byte [0x4d70a0], 0
je 0x49348e
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004909a0
mov byte [0x4d70a0], al
mov ecx, dword [esp + 0x1a60]
xor ecx, esp
mov dword [0x4ea3a0], 0
call fcn.004a4b43
add esp, 0x1a64
ret 8
Function at 0x493f80
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x202c
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x2028], eax
cmp byte [0x4e9b89], 0
je 0x494195
push ebx
push 0x401
lea eax, [esp + 0x828]
push eax
mov ecx, 0x4f0dd0
call fcn.004130a0
push 1
push str.History
push str.General
call fcn.0045ba90
test eax, eax
setne bl
test bl, bl
je 0x493ff5
push 0x400
push 0x4bad38
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push 0x4bc270
call fcn.0045ba60
cmp word [esp + 0x24], 0
jne 0x494007
lea edx, [esp + 0x24]
push edx
call fcn.0043ccd0
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x24]
mov word [esp + eax + 0x1028], cx
add eax, 2
test cx, cx
jne 0x494010
lea eax, [esp + 0x1028]
push eax
call fcn.004516c0
lea ecx, [esp + 0x824]
push ecx
call fcn.00451c20
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x494041
push esi
push edi
lea edi, [esp + 0x1030]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x494060
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 1
push 0
lea edx, [esp + 0x1038]
mov ecx, eax
push edx
and ecx, 3
push 0x5af
rep movsb byte es:[edi], byte [esi]
call fcn.00461310
push eax
mov eax, dword [0x4eacd4]
push eax
call fcn.00419830
pop edi
pop esi
test al, al
je 0x494194
push 0x400
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1030]
push edx
call fcn.00452160
test bl, bl
je 0x4940d7
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push 0x4bc270
call fcn.0045b990
lea eax, [esp + 0x824]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4940e1
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x826], cx
lea eax, [esp + 0x1028]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x494104
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x102a], dx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea edx, [esp + 4]
lea eax, [esp + 0x824]
lea ecx, [esp + 0x1028]
push edx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x494194
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 0x5b0
call fcn.00461310
push eax
call fcn.004934b0
add esp, 0xc
mov ecx, 0x4d76b4
call fcn.00428fc0
pop ebx
mov ecx, dword [esp + 0x2028]
xor ecx, esp
call fcn.004a4b43
add esp, 0x202c
ret
Function at 0x4970c0
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x182c
call fcn.004a5370
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x1828], eax
push 0
push str.AppDataCopied
push str.General
call fcn.0045ba90
test eax, eax
jne 0x497278
push esi
push 0x401
lea eax, [esp + 0x82c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x828]
push ecx
mov esi, str.Themes
call fcn.00451c20
lea esp, [esp]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x497120
lea edx, [esp + 0x102c]
push edx
call fcn.00452420
xor eax, eax
pop esi
jmp 0x497150
movzx ecx, word [esp + eax + 0x1028]
mov word [esp + eax + 0x20], cx
add eax, 2
test cx, cx
jne 0x497150
lea eax, [esp + 0x20]
push eax
call fcn.004516c0
lea eax, [esp + 0x20]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x497176
mov ecx, dword [str.Themes]
mov edx, dword [0x4c1688]
mov dword [eax], ecx
mov ecx, dword [0x4c168c]
mov dword [eax + 4], edx
mov dx, word [0x4c1690]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x824]
push eax
call fcn.004317d0
test al, al
je 0x497267
lea ecx, [esp + 0x20]
push ecx
call fcn.004317d0
test al, al
jne 0x497267
lea eax, [esp + 0x824]
lea edx, [eax + 2]
jmp 0x4971e0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4971e0
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x826], dx
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x497200
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x22], cx
xor eax, eax
mov dword [esp + 8], eax
lea edx, [esp + 0x824]
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
lea eax, [esp + 0x20]
mov ecx, 0x14
push edx
mov dword [esp + 8], 2
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 1
push str.AppDataCopied
push str.General
call fcn.0045b9b0
mov ecx, dword [esp + 0x1828]
xor ecx, esp
call fcn.004a4b43
add esp, 0x182c
ret
Function at 0x497290
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x428
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x424], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], 0x40100
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea ecx, [esp + 8]
push ecx
push str.VerInfo
push str.General
call fcn.0045bab0
lea edx, [esp + 0x24]
push edx
call fcn.004523a0
lea eax, [esp + 0x24]
push eax
call fcn.004520e0
lea eax, [esp + 0x24]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x4972e8
mov ecx, dword [str.version.dat]
mov edx, dword [0x4c16b4]
mov dword [eax], ecx
mov ecx, dword [0x4c16b8]
push esi
mov dword [eax + 4], edx
lea edx, [esp + 0x28]
push 0x4baa34
push edx
mov dword [eax + 8], ecx
mov dword [esp + 0x18], 0
call fcn.004a8067
mov esi, eax
add esp, 8
test esi, esi
je 0x497343
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004a6862
push esi
call fcn.004a6c05
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4973f5
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x4973c1
lea ecx, [esp + 0x20]
push ecx
push str.VerInfo
push str.General
call fcn.0045ba10
lea edx, [esp + 0x28]
push 0x4bae08
push edx
call fcn.004a8067
mov esi, eax
add esp, 8
test esi, esi
je 0x4973a1
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.004a6e34
push esi
call fcn.004a6c05
add esp, 0x14
mov dword [0x4ea428], 0
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.004a4b43
add esp, 0x428
ret
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
push str.VerInfo
push str.General
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call fcn.0045ba10
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x49743f
cmp dword [esp + 0x10], eax
je 0x49743f
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x28]
push 0x4bae08
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call fcn.004a8067
mov esi, eax
add esp, 8
test esi, esi
je 0x49743f
push esi
push 0xc
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.004a6e34
push esi
call fcn.004a6c05
add esp, 0x14
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
xor eax, eax
push 1
xor esi, esi
sub ecx, edx
push eax
sbb esi, eax
push esi
push ecx
call fcn.004a59a0
mov ecx, dword [esp + 8]
xor esi, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
sbb edx, esi
push esi
add eax, ecx
push 0x989680
adc edx, esi
push edx
push eax
call fcn.004a5ef0
push esi
push 0xe10
push edx
push eax
call fcn.004a5ef0
push esi
push 0x18
push edx
push eax
call fcn.004a5ef0
mov dword [0x4ea428], eax
test eax, eax
jge 0x4974a2
mov dword [0x4ea428], 0x168
mov ecx, dword [esp + 0x428]
pop esi
xor ecx, esp
call fcn.004a4b43
add esp, 0x428
ret
Function at 0x498040
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x810
mov eax, dword [0x4cc3b0]
xor eax, esp
mov dword [esp + 0x80c], eax
mov eax, dword [0x4f987c]
push esi
xor esi, esi
cmp dword [eax + 0x20], esi
je 0x498224
push esi
push 1
push 0x4f907c
mov ecx, 0x4f0dd0
call fcn.004162e0
cmp eax, 1
jne 0x498224
cmp dword [0x4f54e0], 3
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 4], esi
push eax
jne 0x4980ac
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, 0x4f0dd0
call fcn.00413360
jmp 0x4980c0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x4f0dd0
call fcn.00413280
cmp dword [esp + 4], esi
je 0x498224
mov ecx, dword [0x4f987c]
push 0x400
lea edx, [esp + 0x14]
push edx
call fcn.0046b560
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x498131
push esi
push esi
push 0x7fffffff
push 0x7fffffff
lea ecx, [esp + 0x20]
push ecx
push esi
call fcn.0040af10
cmp al, 0x43
je 0x49810e
cmp al, 0x4e
jne 0x498131
mov edx, dword [esp + 8]
push edx
call fcn.004a5785
add esp, 4
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.004a4b43
add esp, 0x810
ret
push edi
push esi
push 0x4bae08
lea eax, [esp + 0x1c]
push eax
call fcn.00432070
mov edi, eax
cmp edi, esi
jne 0x498186
lea ecx, [esp + 0x14]
push ecx
push 0x1f6
call fcn.00461310
push eax
push 0x4f907c
call fcn.00493aa0
mov edx, dword [esp + 0x18]
push edx
call fcn.004a5785
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.004a4b43
add esp, 0x810
ret
mov eax, dword [0x4f54e0]
cmp eax, 3
jne 0x4981db
push edi
push 0xff
call fcn.004a8640
push edi
push 0xfe
call fcn.004a8640
add esp, 0x10
cmp dword [esp + 8], esi
jbe 0x498206
nop
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + esi*2]
push edi
push ecx
call fcn.004a8640
mov edx, dword [esp + 0x18]
movzx eax, byte [edx + esi*2 + 1]
push edi
push eax
call fcn.004a8640
inc esi
add esp, 0x10
cmp esi, dword [esp + 8]
jb 0x4981b0
jmp 0x498206
cmp eax, 2
jne 0x4981f1
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ecx
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push edi
push edx
push 1
push eax
call fcn.004a6e34
add esp, 0x10
push edi
call fcn.004a6c05
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004a5785
mov edx, dword [esp + 0x18]
push edx
call fcn.004a5785
add esp, 0xc
pop edi
mov ecx, dword [esp + 0x810]
pop esi
xor ecx, esp
call fcn.004a4b43
add esp, 0x810
ret