joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d0b20
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x515cbc
mov eax, dword fs:[0]
push eax
sub esp, 0x7bc
mov eax, dword [0x544354]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x54b9d4]
test eax, eax
je 0x4d0d31
push 0x200
lea ecx, [ebp - 0x410]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x5a2384]
cmp eax, 0xa
je 0x4d0c50
cmp eax, 9
je 0x4d0c50
mov edx, 0x5a4388
lea ecx, [ebp - 0x410]
mov edi, edi
mov si, word [ecx]
cmp si, word [edx]
jne 0x4d0bb6
test si, si
je 0x4d0bb2
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x4d0bb6
add ecx, 4
add edx, 4
test si, si
jne 0x4d0b90
xor ecx, ecx
jmp 0x4d0bbb
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x4d0c50
push 0x5a4388
push dword [0x54b9d4]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x5a2384]
cmp eax, 3
jne 0x4d0c69
cmp dword [0x5a2380], 0
je 0x4d0c55
push 0x3b8
lea eax, [ebp - 0x7c8]
push 0
push eax
call fcn.004fa860
mov eax, dword [0x54b9d4]
add esp, 0xc
mov dword [ebp - 0x7c4], eax
lea eax, [ebp - 0x7c8]
mov dword [ebp - 0x7c8], 0x3b8
mov dword [ebp - 0x7c0], 0x7b
push dword [0x5a59d4]
mov dword [ebp - 0x7bc], 4
push eax
call fcn.004d0190
lea eax, [ebp - 0x7c8]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [0x5a2384]
cmp eax, 3
jne 0x4d0c69
push 0x5a5488
push 0x9d
call fcn.004d0a80
mov eax, dword [0x5a2384]
test eax, eax
je 0x4d0c7c
cmp eax, 1
je 0x4d0c7c
cmp eax, 2
je 0x4d0c7c
cmp eax, 0xa
jne 0x4d0cbe
push 0x5a5488
push 0x9d
call fcn.004d0a80
push 0x5a2388
call fcn.0047d830
push eax
push 0x9c
push dword [0x54b9d4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x9c
push dword [0x54b9d4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.00447280
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5e16e8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5a6f3c]
cmp eax, dword [ecx + 4]
jle 0x4d0d15
push 0x5a6f3c
call fcn.004f8d29
add esp, 4
cmp dword [0x5a6f3c], 0xffffffff
jne 0x4d0d15
mov dword [ebp - 4], 0
mov dword [0x5a6f38], 0
mov dword [ebp - 4], 0xffffffff
push 0x5a6f3c
call fcn.004f8cea
add esp, 4
push 0x64
mov ecx, 0x5a6f38
call fcn.00446e10
test al, al
je 0x4d0d31
push dword [0x54b9d4]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004f833c
mov esp, ebp
pop ebp
ret
Function at 0x4d4da0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2008
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2004], eax
cmp byte [esp + 0x2024], 0
push ebx
mov ebx, dword [esp + 0x201c]
push ebp
mov ebp, dword [esp + 0x2018]
push esi
mov esi, dword [esp + 0x2020]
push edi
mov edi, dword [esp + 0x201c]
je 0x4d4e3d
push 0x800
push esi
push edi
push str.DefFolder
push str.Extraction
call fcn.004a5ee0
cmp word [edi], 0
jne 0x4d4e08
push ebp
push esi
push edi
call fcn.004947d0
jmp 0x4d4e3d
push 0x800
lea eax, [esp + 0x1018]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4d4e38
cmp eax, 0x800
jae 0x4d4e38
push ebp
lea eax, [esp + 0x1018]
push eax
push edi
call fcn.004947d0
jmp 0x4d4e3d
xor eax, eax
mov word [edi], ax
movzx eax, word [edi]
mov ecx, eax
mov dword [esp + 0x10], ecx
test ax, ax
jne 0x4d4e57
push ebp
push edi
mov ecx, 0x570db0
call fcn.00440d20
push ebp
push edi
call fcn.0047bc90
push 0x800
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.004947d0
xor ebx, ebx
cmp word [esp + 0x14], bx
je 0x4d4eb3
xor eax, eax
lea esi, [esp + 0x14]
lea ecx, [ecx]
cmp word [esi], 0x25
jne 0x4d4ea3
lea ecx, [esp + 0x16]
add eax, ecx
push 0x25
push eax
call fcn.004f961b
add esp, 8
test eax, eax
je 0x4d4ea3
mov ecx, 0x5f
mov word [esi], cx
inc ebx
lea esi, [esp + 0x14]
lea eax, [ebx + ebx]
add esi, eax
cmp word [esi], 0
jne 0x4d4e80
lea eax, [esp + 0x14]
push eax
call fcn.0047cbe0
mov esi, eax
test esi, esi
je 0x4d4f4e
lea eax, [esp + 0x14]
cmp esi, eax
jbe 0x4d4f4e
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x14]
push eax
call fcn.0047cbe0
mov ebx, eax
test ebx, ebx
je 0x4d4f2d
lea eax, [esp + 0x14]
cmp ebx, eax
jbe 0x4d4f2d
cmp byte [esp + 0x2030], 0
je 0x4d4f19
cmp word [esi + 2], 0
je 0x4d4f19
movzx eax, word [esi + 4]
push eax
call fcn.00494390
test al, al
jne 0x4d4f19
movzx eax, word [esi - 2]
push eax
call fcn.00494390
test al, al
jne 0x4d4f28
push str..tar
push ebx
call fcn.00497d90
test eax, eax
jne 0x4d4f2d
xor eax, eax
mov word [ebx], ax
sub esi, 2
lea eax, [esp + 0x14]
cmp esi, eax
jbe 0x4d4f4e
cmp word [esi], 0x2e
jne 0x4d4f4e
xor eax, eax
mov word [esi], ax
sub esi, 2
lea eax, [esp + 0x14]
cmp esi, eax
ja 0x4d4f38
push 0x800
lea eax, [esp + 0x18]
push eax
call fcn.0047d830
push eax
push 0x5ab7a8
call fcn.004947d0
push 0x5ab7a8
call fcn.004cc800
push 0
push 0x5ab7a8
call fcn.0047d580
cmp byte [esp + 0x202c], 0
jne 0x4d4f90
cmp word [esp + 0x10], 0
je 0x4d4fb7
push 1
push str.AppendName
push str.Extraction
call fcn.004a5d50
test eax, eax
je 0x4d4fb7
push ebp
lea eax, [esp + 0x18]
push eax
call fcn.0047d830
push eax
push edi
call fcn.00494790
push edi
call fcn.004cc800
push 0
push edi
call fcn.0047d580
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x2008
ret 0x1c
Function at 0x4d4fe0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1008
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x100c]
lea ecx, [esp]
push 0x800
push ecx
push eax
mov ecx, 0x570db0
call fcn.004417b0
push 0x802
lea eax, [esp + 4]
push eax
call fcn.0047bc90
push 0x802
push 0x517c80
lea eax, [esp + 8]
push eax
call fcn.00494790
push 1
push 0x51787c
push 0
lea eax, [esp + 0xc]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.004f833c
add esp, 0x1008
ret 4

Function at 0x4d5f60
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x325c
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x3258], eax
cmp byte [esp + 0x3264], 0
push ebx
mov bh, byte [esp + 0x3264]
mov dword [0x54bad0], 1
je 0x4d60cd
push edi
push 0
push 0x800
lea eax, [esp + 0x1268]
push eax
call fcn.004cbf30
push 0x800
lea eax, [esp + 0x1264]
push eax
call fcn.0047bc90
lea eax, [esp + 0x1260]
push eax
push str._sRar_
lea eax, [esp + 0x2268]
push 0x800
push eax
call fcn.00402720
add esp, 0x10
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4d60c5
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push esi
cmp dword [0x54bad0], 1
jne 0x4d60c3
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x1268]
sub esi, dword [esp + 0x20]
push 0x800
push eax
lea eax, [esp + 0x270]
push eax
call fcn.004947d0
push 0x800
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x270]
push eax
call fcn.00494790
test byte [esp + 0x18], 0x10
je 0x4d60a6
push 6
lea eax, [esp + 0x48]
push str.Rar_DI
push eax
call fcn.004fecf4
add esp, 0xc
test eax, eax
lea eax, [esp + 0x268]
sete bl
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4d60b3
cmp esi, 8
jb 0x4d6093
test bh, bh
je 0x4d6097
test bl, bl
je 0x4d60b3
lea eax, [esp + 0x268]
push eax
call fcn.004cb740
jmp 0x4d60b3
lea eax, [esp + 0x268]
push eax
call fcn.004cb670
lea eax, [esp + 0x18]
push eax
push edi
call ebp
test eax, eax
jne 0x4d6012
pop esi
pop ebp
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
test bh, bh
pop ebx
jne 0x4d60f6
cmp byte [0x5792f4], 0
je 0x4d60f6
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004e1bd0
mov byte [0x5792f4], al
mov ecx, dword [esp + 0x3258]
xor ecx, esp
mov dword [0x54bad0], 0
call fcn.004f833c
add esp, 0x325c
ret 8
Function at 0x4d93c0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1120
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x111c], eax
cmp byte [0x571df6], 0
jne 0x4d962e
cmp byte [esp + 0x1124], 0
jne 0x4d940b
call fcn.004d9650
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.004f833c
add esp, 0x1120
ret 4
push ebp
push edi
xor edi, edi
mov ecx, 0x570db0
push edi
xor ebp, ebp
mov dword [esp + 0x10c0], edi
mov dword [esp + 0x10c4], edi
mov dword [esp + 0x10c8], edi
mov dword [esp + 0x10cc], edi
mov dword [esp + 0x10d0], edi
mov dword [esp + 0x10d4], edi
call fcn.00441170
lea eax, [esp + 0x2c]
mov ecx, 0x570db0
push eax
call fcn.00441170
test al, al
je 0x4d948a
lea esp, [esp]
lea eax, [esp + 0xb]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004ddb70
test al, al
lea eax, [esp + 0x2c]
jne 0x4d95ae
push eax
mov ecx, 0x570db0
call fcn.00441170
test al, al
jne 0x4d9460
push ebx
push esi
push 0
mov ecx, 0x570db0
call fcn.00441170
lea eax, [esp + 0x34]
mov ecx, 0x570db0
push eax
call fcn.00441170
test al, al
je 0x4d9601
nop
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d94b7
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + edi]
lea eax, [ebx*2 + 4]
push eax
push ebp
call fcn.004fe8c9
mov esi, eax
add esp, 8
test esi, esi
je 0x4d9621
lea ecx, [esp + 0x34]
mov ebp, esi
lea edx, [edi + edi]
mov eax, ecx
sub edx, eax
add edx, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4d94f3
lea eax, [esp + 0x34]
mov ecx, 0x570db0
push eax
lea edi, [ebx + 1]
call fcn.00441170
test al, al
jne 0x4d94b0
test edi, edi
je 0x4d9601
xor eax, eax
mov word [esi + edi*2], ax
inc dword [0x54cb40]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov eax, dword [0x54b9c8]
mov dword [esp + 0x14], eax
mov eax, 0x40
mov word [esp + 0x24], ax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
push esi
sete bl
dec dword [0x54cb40]
call fcn.004fe8b9
add esp, 4
test bl, bl
je 0x4d962a
cmp dword [esp + 0x26], 0
jne 0x4d962a
mov ecx, 0x54cb54
call fcn.004b3790
push 0x51787c
mov ecx, 0x570db0
call fcn.004444e0
jmp 0x4d962a
push 0x64
push eax
call fcn.00447190
push eax
push 0x204
call fcn.0048e4c0
push eax
call fcn.004d1700
add esp, 8
push 0x205
call fcn.0048e4c0
push eax
call fcn.004d19a0
movzx eax, byte [esp + 0xf]
add esp, 4
neg eax
sbb eax, eax
and eax, 0xffffff87
add eax, 0xce
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x57f41c
call fcn.00466a60
jmp 0x4d962c
push 0x30
push 0x65
call fcn.0048e4c0
push eax
push 0x14c
call fcn.0048e4c0
push eax
push dword [0x54b9c8]
call fcn.004cd560
push ebp
call fcn.004fe8b9
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.004f833c
add esp, 0x1120
ret 4
Function at 0x4dad30
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x100c
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x54cb40], 0
push ebx
mov ebx, dword [esp + 0x1014]
je 0x4dad73
xor al, al
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.004f833c
add esp, 0x100c
ret 8
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x4dae2f
xor eax, eax
push 0x800
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
push eax
push 0
push ebx
call ebp
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x54ba54], 0
je 0x4dade1
cmp byte [esp + 0x1020], 0
jne 0x4dae06
cmp eax, dword [0x570de0]
je 0x4dae06
cmp eax, dword [0x54cb5c]
je 0x4dae06
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4dae06
push 1
lea eax, [esp + 0x18]
mov ecx, 0x570db0
push eax
call fcn.00441e60
cmp eax, 1
je 0x4dae2b
push 7
push 0x52ac6c
lea eax, [esp + 0x1c]
push eax
call fcn.0047d830
push eax
call fcn.00497de0
test eax, eax
jne 0x4dae2f
lea eax, [esp + 0x14]
push eax
call fcn.004dd930
xor al, al
jmp 0x4dae75
push esi
push 0
call fcn.004c7510
mov ecx, 0x563a1c
call fcn.00494aa0
xor esi, esi
test edi, edi
je 0x4dae72
jmp 0x4dae50
push 0x800
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea eax, [esp + 0x18]
mov ecx, 0x563a1c
push eax
call fcn.004948c0
inc esi
cmp esi, edi
jb 0x4dae50
mov al, 1
pop esi
mov ecx, dword [esp + 0x1014]
pop edi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x100c
ret 8
Function at 0x4dd930
Capabilities:
Copy file

Disassembly:
mov eax, 0x2004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp byte [0x5792f4], 0
push esi
mov esi, dword [esp + 0x200c]
je 0x4dd98e
cmp byte [0x55d650], 0
jne 0x4dd98e
push 0x24
push 0x5f0
call fcn.0048e4c0
push eax
push 0x5f1
call fcn.0048e4c0
push eax
push dword [0x54b9c8]
call fcn.004cd560
cmp eax, 6
jne 0x4ddadf
push ebx
push 0x800
lea eax, [esp + 0x100c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea eax, [esp + 0x1010]
push eax
call fcn.0047d930
push 0
lea eax, [esp + 0x100c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
test eax, eax
lea eax, [esp + 0xc]
push 0x800
push eax
setne bl
call fcn.0047cd50
push 0x800
lea eax, [esp + 0xc]
push eax
call fcn.0047bc90
push 0x800
push str.rarreg.key
lea eax, [esp + 0x10]
push eax
call fcn.00494790
test bl, bl
lea eax, [esp + 8]
pop ebx
je 0x4dda16
push eax
call fcn.0046c6d0
jmp 0x4dda37
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x800
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x100c]
push eax
call fcn.004947d0
push dword [0x54b9c8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push dword [0x54b9c8]
call esi
push 1
lea eax, [esp + 0x1008]
push eax
call fcn.0045e690
push 0
push dword [0x54b9c8]
mov byte [0x5792f4], al
call esi
mov ecx, 0x570db0
call fcn.00445040
cmp byte [0x5792f4], 0
je 0x4ddabf
push 0x40
push 0x368
call fcn.0048e4c0
push eax
push 0x367
call fcn.0048e4c0
push eax
push dword [0x54b9c8]
call fcn.004cd560
pop esi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.004f833c
add esp, 0x2004
ret 4
lea eax, [esp + 0x1004]
push eax
call fcn.0046c6d0
push 0x366
call fcn.0048e4c0
push eax
call fcn.004d1700
add esp, 4
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x2004
ret 4

Function at 0x4ddb70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
push ebx
mov byte [edi], 0
call fcn.0047d830
push 3
mov esi, eax
push 0x529a98
push esi
call fcn.00497de0
test eax, eax
je 0x4ddba8
push 3
push 0x529aa0
push esi
call fcn.00497de0
test eax, eax
jne 0x4ddbcb
movzx eax, word [esi + 6]
push eax
call fcn.00503bae
add esp, 4
test eax, eax
je 0x4ddbcb
movzx eax, word [esi + 8]
cmp eax, 0x2e
je 0x4ddc46
test ax, ax
je 0x4ddc46
push 3
push 0x529aa8
push esi
call fcn.00497de0
test eax, eax
je 0x4ddc0f
push 3
push 0x529ab0
push esi
call fcn.00497de0
test eax, eax
je 0x4ddc0f
push 3
push 0x529ab8
push esi
call fcn.00497de0
test eax, eax
je 0x4ddc0f
push 3
push 0x52593c
push esi
call fcn.00497de0
test eax, eax
jne 0x4ddc1d
movzx eax, word [esi + 6]
cmp eax, 0x2e
je 0x4ddc46
test ax, ax
je 0x4ddc46
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4ddc3e
push ebx
call fcn.0046cad0
test al, al
je 0x4ddc3e
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov al, 1
mov byte [edi], al
pop edi
pop esi
pop ebx
ret 8
Function at 0x4e0a20
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x58
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
mov ebp, ecx
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov dword [esp + 0x18], 0x10000
mov dword [esp + 0x1c], 0x38000
lea eax, [ecx + 1]
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x10000
mov dword [esp + 0x34], 0x10000
mov dword [esp + 0x38], 0x7c000
mov dword [esp + 0x3c], 0x10000
mov dword [esp + 0x40], 0x10000
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0x10000
mov dword [esp + 0x4c], 0x10000
mov dword [esp + 0x50], 0x10000
mov dword [esp + 0x54], 0xfe000
mov dword [esp + 0x58], 0x10000
mov dword [esp + 0x5c], 0x10000
mov dword [esp + 0x60], 0x10000
mov dword [esi + 0x18], eax
cmp ecx, 6
jb 0x4e0b0f
pop edi
mov dword [esi], 0
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.004f833c
add esp, 0x58
ret 4
mov eax, ecx
xor edx, edx
mov ecx, 6
div ecx
cmp edx, 3
jb 0x4e0b28
mov eax, 5
sub eax, edx
mov edx, eax
movzx eax, byte [esi + 6]
lea ecx, [esp + 0x10]
push 0
push eax
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi + 4]
push eax
push ebx
push edi
lea eax, [edx*8]
push 7
sub eax, edx
push 0xa
push 0
lea eax, [ecx + eax*4]
mov ecx, ebp
push eax
call fcn.004e0190
mov ecx, dword [esp + 0x64]
mov dword [esi + 0x10], edi
pop edi
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004f833c
add esp, 0x58
ret 4
Function at 0x4e1ca0
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x35d8
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x35d4], eax
cmp dword [0x544140], 0xffffffff
push ebx
mov ebx, dword [esp + 0x35e4]
push ebp
mov ebp, dword [esp + 0x35f0]
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push edi
mov edi, dword [esp + 0x35ec]
jne 0x4e1d46
push 0x4001
push 0x2b4
lea eax, [esp + 0x84]
push eax
push 0
push 0x517c80
call esi
mov eax, dword [esp + 0x80]
mov dword [0x5b03c4], eax
lea eax, [esp + 0x25e4]
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x84]
push eax
push 0
lea eax, [esp + 0x25f4]
push eax
call esi
mov eax, dword [esp + 0x80]
mov dword [0x544140], eax
push 0x800
push ebx
lea eax, [esp + 0x5ec]
push eax
call fcn.004947d0
push 0x800
lea eax, [esp + 0x5e8]
push eax
push eax
call fcn.0047d9c0
movzx eax, word [edi]
mov ecx, eax
mov dword [esp + 0x14], 3
mov dword [esp + 0x10], ecx
mov ebx, eax
lea ecx, [esp + 0x5e4]
mov dword [esp + 0x18], 0x40000000
test ax, ax
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea eax, [esp + 0x330]
je 0x4e1dc3
push 0x4011
push 0x2b4
push eax
movzx eax, byte [esp + 0x3600]
neg eax
sbb eax, eax
and eax, 0x10
push eax
jmp 0x4e1dd0
push 0x4001
push 0x2b4
push eax
push 0
lea eax, [esp + 0x5f4]
push eax
call esi
mov eax, dword [esp + 0x334]
mov dword [esp + 0x30], eax
push 0x800
test bx, bx
je 0x4e1dff
push edi
lea eax, [esp + 0x15ec]
push eax
call fcn.004947d0
jmp 0x4e1e32
lea eax, [esp + 0x5e8]
push eax
lea eax, [esp + 0x15ec]
push eax
call fcn.004947d0
lea eax, [esp + 0x15e4]
push eax
call fcn.0047d890
lea eax, [esp + 0x5e4]
push eax
call fcn.0047d830
mov dword [esp + 0x28], eax
push 0x66
push dword [0x54b9d4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x104d
push esi
call edi
cmp word [esp + 0x10], 0
mov ebx, eax
lea eax, [esp + 0x15e4]
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
je 0x4e1e8c
mov ecx, dword [0x544140]
mov dword [esp + 0x30], ecx
jmp 0x4e1e95
mov eax, dword [0x5b03c4]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x104c
push esi
call edi
lea eax, [esp + 0x48]
mov dword [esp + 0x50], 2
push eax
push ebx
push 0x1074
push esi
mov dword [esp + 0x6c], ebp
call edi
test ebx, ebx
jne 0x4e1ee0
lea eax, [esp + 0x48]
mov dword [esp + 0x58], 1
push eax
push ebx
push 0x102b
push esi
mov dword [esp + 0x64], 1
call edi
mov eax, dword [0x5ac89c]
pop edi
pop esi
inc eax
mov dword [0x5ac89c], eax
pop ebp
pop ebx
cmp eax, 1
jne 0x4e1f0d
push 0x4f5
call fcn.0048e4c0
push eax
push 2
push dword [0x54b9d4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [esp + 0x35d4]
xor ecx, esp
call fcn.004f833c
add esp, 0x35d8
ret 0x10
Function at 0x4e3e00
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x2000], eax
push edi
push 0x1000
push 0
lea eax, [esp + 0x100c]
push eax
push str.rarreg.key
push 0x51787c
call fcn.004a5d70
mov edi, eax
test edi, edi
je 0x4e3e96
push esi
push 0x800
lea eax, [esp + 0xc]
push eax
push 0x52aed0
call fcn.004cc240
mov esi, eax
test esi, esi
je 0x4e3e86
push esi
push edi
lea eax, [esp + 0x1010]
push 1
push eax
call fcn.004ff1cc
push esi
call fcn.004fede7
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.004dd930
lea eax, [esp + 8]
push eax
call fcn.0046c6d0
push str.rarreg.key
push 0x51787c
call fcn.004a5880
pop esi
mov ecx, dword [esp + 0x2004]
pop edi
xor ecx, esp
call fcn.004f833c
add esp, 0x2004
ret
Function at 0x4e4000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1028
call fcn.004f8350
mov eax, dword [0x544354]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x55002
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea eax, [esp + 0xc]
push eax
push str.VerInfo
push 0x517ba4
call fcn.004a5d70
push 1
push 0x800
lea eax, [esp + 0x30]
push eax
call fcn.0047cd50
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.0047bc90
push 0x800
push str.version.dat
lea eax, [esp + 0x30]
push eax
call fcn.00494790
push 0x519c98
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0
push eax
call fcn.0046dd80
mov esi, eax
test esi, esi
je 0x4e40ad
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0050273f
push esi
call fcn.004fede7
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4e4176
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x4e4142
lea eax, [esp + 0x20]
push eax
push str.VerInfo
push 0x517ba4
call fcn.004a6980
call fcn.004a6690
test al, al
jne 0x4e4111
push 0x517df8
lea eax, [esp + 0x2c]
push eax
call fcn.0046dd80
mov esi, eax
test esi, esi
je 0x4e4111
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.004ff1cc
push esi
call fcn.004fede7
add esp, 0x14
call fcn.004a66a0
movzx eax, al
neg eax
pop esi
sbb eax, eax
and eax, 0xfffffe98
add eax, 0x168
mov dword [0x54caf0], eax
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.004f833c
add esp, 0x1028
ret
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push str.VerInfo
push 0x517ba4
mov dword [esp + 0x14], ecx
call fcn.004a6980
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x4e41c6
cmp dword [esp + 0x10], eax
je 0x4e41c6
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
call fcn.004a6690
test al, al
jne 0x4e41c6
push 0x517df8
lea eax, [esp + 0x2c]
push eax
call fcn.0046dd80
mov esi, eax
test esi, esi
je 0x4e41c6
push esi
push 0xc
lea eax, [esp + 0xc]
push 1
push eax
call fcn.004ff1cc
push esi
call fcn.004fede7
add esp, 0x14
mov eax, dword [esp + 0x24]
xor ecx, ecx
sub ecx, ecx
push 0xc9
sbb eax, dword [esp + 0x10]
sub ecx, dword [esp + 0xc]
push 0x2a69c000
sbb eax, 0
add ecx, dword [esp + 0x28]
adc eax, 0
push eax
push ecx
call fcn.004f84b0
mov dword [0x54caf0], eax
test eax, eax
jns 0x4e4204
mov dword [0x54caf0], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.004f833c
add esp, 0x1028
ret