joyce8/EMBER2024-capa huggingface dataset:
Function at 0x482df0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x4af68b
mov eax, dword fs:[0]
push eax
mov eax, 0x2cb4
call fcn.0049e430
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x2cb0], eax
push ebx
push ebp
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0x2cc0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2cd0]
mov ebp, dword [esp + 0x2cd4]
lea ecx, [esp + 0x1cbc]
push ecx
push str.Rar_DIXXXXXX
mov dword [esp + 0x14], eax
call fcn.0047f0a0
test al, al
je 0x483002
push 0x400
lea edx, [esp + 0x24c0]
push edx
lea eax, [esp + 0x20c4]
push eax
call fcn.0047e400
push 0
lea ecx, [esp + 0x1cc0]
push ecx
call fcn.0047e3b0
call fcn.0047b360
push 0x4e798c
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.00413690
mov edx, dword [0x4e0e10]
mov dword [0x4e613c], edx
call fcn.004771b0
mov ecx, dword [0x4e818c]
push edi
push esi
mov dword [0x4e5d28], 4
mov dword [0x4e5768], 2
call fcn.00465600
push 0
push 0
mov ecx, 0x4e0c08
call fcn.00416240
lea ecx, [esp + 0x10b4]
xor bl, bl
call fcn.00432d00
mov dword [esp + 0x2cc8], 0
push 0x4b175c
lea ecx, [esp + 0x10b8]
call fcn.00432d40
lea ecx, [esp + 0xc28]
call fcn.004680a0
lea ecx, [esp + 0xc4c]
call fcn.004680a0
lea ecx, [esp + 0xc70]
call fcn.004680a0
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10bc]
call fcn.004331a0
test al, al
je 0x482fb1
cmp byte [esp + 0xc24], 0
je 0x482f63
push 0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10bc]
call fcn.004331a0
test al, al
jne 0x482f40
jmp 0x482fb1
call fcn.0043ca60
test eax, eax
je 0x482f96
cmp word [esp + 0x414], 0
je 0x482f96
test ebp, ebp
je 0x482fa0
lea edx, [esp + 0x10]
push edx
push ebp
push 0x400
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x482fa0
test ebp, ebp
je 0x482fa0
xor ecx, ecx
mov word [ebp], cx
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0042fa70
mov bl, 1
lea ecx, [esp + 0x24bc]
push ecx
lea edx, [esp + 0x20c0]
push edx
call fcn.0047e3b0
test bl, bl
jne 0x482fd8
lea eax, [esp + 0x1cbc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, 0x4dc1d0
mov byte [0x4dc1fc], 0
call fcn.00464f70
mov dword [esp + 0x2cc8], 0xffffffff
lea ecx, [esp + 0x10b4]
call fcn.00432d20
mov al, bl
mov ecx, dword [esp + 0x2cc0]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x2cb0]
xor ecx, esp
call fcn.0049dea6
add esp, 0x2cc0
ret 8
Function at 0x484a10
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x868
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x864], eax
push ebx
push esi
mov esi, dword [esp + 0x874]
push edi
push esi
push 0x6c
call fcn.0045bde0
push eax
lea eax, [esp + 0x414]
push eax
call fcn.0049deb5
add esp, 0xc
push 0
push esi
call fcn.0047f460
test al, al
jne 0x484ae9
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
je 0x484ab9
lea ecx, [esp + 0xc]
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x484aa0
test dl, dl
je 0x484a9c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x484aa0
add eax, 2
add ecx, 2
test dl, dl
jne 0x484a80
xor eax, eax
jmp 0x484aa5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x484ab9
push 0
lea edx, [esp + 0x10]
push edx
call fcn.0047f460
test al, al
jne 0x484ae9
push 0x15
push 0x66
call fcn.0045bde0
mov ecx, dword [0x4dc1c8]
push eax
lea eax, [esp + 0x414]
push eax
push ecx
call edi
cmp eax, 2
je 0x484b05
push 0
push esi
call fcn.0047f460
test al, al
je 0x484a63
mov ecx, 0x4dfee0
call fcn.00440a40
test al, al
je 0x484b05
push 0
push 0
mov ecx, 0x4dfee0
call fcn.00440fc0
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x868
ret 4
Function at 0x484b20
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x178
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x174], eax
push esi
mov esi, dword [esp + 0x180]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x174]
push str._c:_
push ecx
call fcn.0049deb5
add esp, 0xc
push 0x301
push 0x160
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x180]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test byte [esi + 0x10], 1
je 0x484baa
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4b1914
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x484c10
sub eax, ecx
mov ecx, dword [edi]
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x484c5d
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x17c]
pop edi
pop esi
xor ecx, esp
call fcn.0049dea6
add esp, 0x178
ret 4
Function at 0x48a490
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
sub esp, 0xd54
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xd50], eax
cmp byte [esp + 0xd5c], 0
mov dword [0x4dbc58], 1
je 0x48a62d
push esi
push 0x400
lea eax, [esp + 0x558]
push eax
call fcn.0047e2d0
lea ecx, [esp + 0x554]
push ecx
call fcn.0044dfb0
lea edx, [esp + 0x554]
push edx
lea eax, [esp + 0x958]
push str._sRar_
push eax
call fcn.0049deb5
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x958]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [esp + 8], esi
cmp esi, 0xffffffff
je 0x48a625
push ebx
push edi
jmp 0x48a530
cmp dword [0x4dbc58], 1
jne 0x48a623
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x24]
cmp ecx, 8
setae byte [esp + 0xf]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x55c]
mov byte [esp + eax + 0x15c], cl
inc eax
test cl, cl
jne 0x48a550
lea eax, [esp + 0x48]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48a570
lea edi, [esp + 0x15c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48a581
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x1c], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x48a5fc
push 6
lea edx, [esp + 0x4c]
push str.Rar_DI
push edx
call fcn.0049f03f
add esp, 0xc
test eax, eax
jne 0x48a5c6
call fcn.0043ca60
cmp eax, 4
je 0x48a5c6
mov bl, 1
jmp 0x48a5c8
xor bl, bl
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x48a60b
cmp byte [esp + 0xf], al
je 0x48a5e9
cmp byte [esp + 0xd64], al
je 0x48a5ed
test bl, bl
je 0x48a60b
lea ecx, [esp + 0x15c]
push ecx
call fcn.0047f200
jmp 0x48a60b
push 0
lea edx, [esp + 0x160]
push edx
call fcn.0047f410
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x48a530
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp byte [esp + 0xd58], 0
jne 0x48a65b
cmp byte [0x4c8d50], 0
je 0x48a65b
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.00487030
mov byte [0x4c8d50], al
mov ecx, dword [esp + 0xd50]
xor ecx, esp
mov dword [0x4dbc58], 0
call fcn.0049dea6
add esp, 0xd54
ret 8
Function at 0x48e230
Capabilities:
Copy file

Disassembly:
mov eax, 0x1030
call fcn.0049e430
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x102c], eax
cmp dword [0x4dbc5c], 0
je 0x48e427
push 0
lea eax, [esp + 0x428]
push eax
mov ecx, 0x4e0c08
call fcn.00413690
push 1
push 0x4b2094
push 0x4b1b9c
call fcn.00456960
test eax, eax
setne al
mov byte [esp + 3], al
test al, al
je 0x48e2a5
push 0x400
push 0x4b1914
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.00456900
cmp byte [esp + 0x24], 0
jne 0x48e2b6
lea edx, [esp + 0x24]
push edx
call fcn.0043ad00
xor eax, eax
jmp 0x48e2c0
mov cl, byte [esp + eax + 0x24]
mov byte [esp + eax + 0x828], cl
inc eax
test cl, cl
jne 0x48e2c0
lea eax, [esp + 0x828]
push eax
call fcn.0044dfb0
lea ecx, [esp + 0x424]
push ecx
call fcn.0044db30
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e2f0
push esi
push edi
lea edi, [esp + 0x830]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48e303
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 1
push 0
lea edx, [esp + 0x838]
mov ecx, eax
push edx
and ecx, 3
push 0x5af
rep movsb byte es:[edi], byte [esi]
call fcn.0045bde0
push eax
mov eax, dword [0x4dc1c8]
push eax
call fcn.00418f60
pop edi
pop esi
test al, al
je 0x48e427
push 0x400
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x830]
push edx
call fcn.0044dff0
cmp byte [esp + 3], 0
je 0x48e379
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.004567c0
lea eax, [esp + 0x424]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e383
sub eax, edx
mov byte [esp + eax + 0x425], cl
lea eax, [esp + 0x828]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e3a0
sub eax, edx
mov byte [esp + eax + 0x829], cl
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea eax, [esp + 4]
lea ecx, [esp + 0x424]
lea edx, [esp + 0x828]
push eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je 0x48e427
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
push 0x5b0
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 0xc
mov ecx, 0x4c9364
call fcn.00427d40
mov ecx, dword [esp + 0x102c]
xor ecx, esp
call fcn.0049dea6
add esp, 0x1030
ret
Function at 0x48fd60
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x41c
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x418], eax
mov eax, dword [0x4e818c]
push esi
xor esi, esi
cmp dword [eax + 0x30], esi
je 0x48ff44
push esi
push 1
push esi
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.004145d0
cmp eax, 1
jne 0x48ff44
cmp dword [0x4e46b0], 3
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 4], esi
push eax
jne 0x48fdcd
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, 0x4e0c08
call fcn.00413c20
jmp 0x48fde1
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x4e0c08
call fcn.00413b30
cmp dword [esp + 4], esi
je 0x48ff44
mov ecx, dword [0x4e818c]
push esi
push 0x400
push esi
lea edx, [esp + 0x28]
push edx
call fcn.00465980
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x48fe50
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x14]
push edx
call fcn.0040a270
mov al, byte [esp + 0x10]
cmp al, 0x43
je 0x48fe2d
cmp al, 0x4e
jne 0x48fe50
mov eax, dword [esp + 8]
push eax
call fcn.0049e845
add esp, 4
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0049dea6
add esp, 0x41c
ret
push edi
lea ecx, [esp + 0x20]
push 0x4b1ba8
push ecx
call fcn.0049f748
mov edi, eax
add esp, 8
cmp edi, esi
jne 0x48fea7
lea edx, [esp + 0x20]
push edx
push 0x1f6
call fcn.0045bde0
push eax
push 0x4e758c
call fcn.00445390
mov eax, dword [esp + 0x18]
push eax
call fcn.0049e845
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.0049dea6
add esp, 0x41c
ret
mov eax, dword [0x4e46b0]
cmp eax, 3
jne 0x48fefb
push edi
push 0xff
call fcn.004a1cd5
push edi
push 0xfe
call fcn.004a1cd5
add esp, 0x10
cmp dword [esp + 8], esi
jbe 0x48ff26
mov ecx, dword [esp + 0x10]
movzx edx, word [ecx + esi*2]
push edi
push edx
call fcn.004a1cd5
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + esi*2 + 1]
push edi
push ecx
call fcn.004a1cd5
inc esi
add esp, 0x10
cmp esi, dword [esp + 8]
jb 0x48fed0
jmp 0x48ff26
cmp eax, 2
jne 0x48ff11
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push edx
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push edi
push eax
push 1
push ecx
call fcn.0049f602
add esp, 0x10
push edi
call fcn.0049f426
mov edx, dword [esp + 0x10]
push edx
call fcn.0049e845
mov eax, dword [esp + 0x18]
push eax
call fcn.0049e845
add esp, 0xc
pop edi
mov ecx, dword [esp + 0x41c]
pop esi
xor ecx, esp
call fcn.0049dea6
add esp, 0x41c
ret
Function at 0x490590
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x4cc
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x4c8], eax
cmp byte [0x4c8d50], 0
jne 0x490693
push esi
push 0x400
lea eax, [esp + 0xd0]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0xcc]
push ecx
call fcn.0044db30
mov edx, dword [str.rar.ini]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [eax], edx
mov ecx, dword [0x4b58d8]
lea edx, [esp + 0xcc]
push edx
push 0x64
mov dword [eax + 4], ecx
lea eax, [esp + 0x70]
push eax
push 0x4b1914
push str.regname
push str.registration
call esi
lea ecx, [esp + 0xcc]
push ecx
push 0x64
lea edx, [esp + 0xc]
push edx
push 0x4b1914
push str.regcode
push str.registration
call esi
lea eax, [esp + 0xcc]
push eax
push 0
push str.informed
push str.registration
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp byte [esp + 0x68], 0
pop esi
je 0x490693
cmp byte [esp], 0
je 0x490693
test eax, eax
jne 0x490693
lea ecx, [esp + 0xc8]
push ecx
push 0x4b58a4
push str.informed
push str.registration
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov edx, dword [0x4dc1c8]
mov eax, dword [0x4c9360]
push 0
push 0x485090
push edx
push str.REREG
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ecx, dword [esp + 0x4c8]
xor ecx, esp
call fcn.0049dea6
add esp, 0x4cc
ret
Function at 0x490c70
Capabilities:
Copy file

Disassembly:
sub esp, 0xc2c
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xc28], eax
push 0
push str.AppDataCopied
push 0x4b1b9c
call fcn.00456960
test eax, eax
jne 0x490df6
push 0x401
lea eax, [esp + 0x428]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x424]
push ecx
call fcn.0044db30
mov edx, dword [0x4b592c]
mov dword [eax], edx
mov cx, word [0x4b5930]
mov word [eax + 4], cx
mov dl, byte [0x4b5932]
mov byte [eax + 6], dl
lea eax, [esp + 0x828]
push eax
call fcn.0044e1b0
xor eax, eax
lea ebx, [ebx]
mov cl, byte [esp + eax + 0x828]
mov byte [esp + eax + 0x20], cl
inc eax
test cl, cl
jne 0x490cf0
lea ecx, [esp + 0x20]
push ecx
call fcn.0044dfb0
lea eax, [esp + 0x20]
dec eax
nop
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x490d10
mov edx, dword [0x4b592c]
mov cx, word [0x4b5930]
mov dword [eax], edx
mov dl, byte [0x4b5932]
mov word [eax + 4], cx
mov byte [eax + 6], dl
push 0
lea eax, [esp + 0x428]
push eax
call fcn.0042f950
test al, al
je 0x490de5
push 0
lea ecx, [esp + 0x24]
push ecx
call fcn.0042f950
test al, al
jne 0x490de5
lea eax, [esp + 0x424]
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x490d70
sub eax, edx
mov byte [esp + eax + 0x425], cl
lea eax, [esp + 0x20]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x490d87
sub eax, edx
mov byte [esp + eax + 0x21], cl
xor eax, eax
mov dword [esp + 8], eax
lea edx, [esp + 0x424]
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
lea eax, [esp + 0x20]
mov ecx, 0x14
push edx
mov dword [esp + 8], 2
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
push 1
push str.AppDataCopied
push 0x4b1b9c
call fcn.00456800
mov ecx, dword [esp + 0xc28]
xor ecx, esp
call fcn.0049dea6
add esp, 0xc2c
ret
Function at 0x490e10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x428
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x424], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], 0x35a00
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea ecx, [esp + 8]
push ecx
push str.VerInfo
push 0x4b1b9c
call fcn.00456990
lea edx, [esp + 0x24]
push edx
call fcn.0044e1b0
lea eax, [esp + 0x24]
push eax
call fcn.0044dfb0
lea eax, [esp + 0x24]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x490e68
mov ecx, dword [str.version.dat]
mov edx, dword [0x4b5948]
mov dword [eax], ecx
mov ecx, dword [0x4b594c]
push esi
mov dword [eax + 4], edx
lea edx, [esp + 0x28]
push 0x4b1948
push edx
mov dword [eax + 8], ecx
mov dword [esp + 0x18], 0
call fcn.0049f748
mov esi, eax
add esp, 8
test esi, esi
je 0x490ec3
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0049f9f9
push esi
call fcn.0049f426
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x490f75
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x490f41
lea ecx, [esp + 0x20]
push ecx
push str.VerInfo
push 0x4b1b9c
call fcn.00456860
lea edx, [esp + 0x28]
push 0x4b1ba8
push edx
call fcn.0049f748
mov esi, eax
add esp, 8
test esi, esi
je 0x490f21
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.0049f602
push esi
call fcn.0049f426
add esp, 0x14
mov dword [0x4dbcac], 0
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.0049dea6
add esp, 0x428
ret
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
push str.VerInfo
push 0x4b1b9c
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call fcn.00456860
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x490fbf
cmp dword [esp + 0x10], eax
je 0x490fbf
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x28]
push 0x4b1ba8
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call fcn.0049f748
mov esi, eax
add esp, 8
test esi, esi
je 0x490fbf
push esi
push 0xc
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.0049f602
push esi
call fcn.0049f426
add esp, 0x14
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
xor eax, eax
push 1
xor esi, esi
sub ecx, edx
push eax
sbb esi, eax
push esi
push ecx
call fcn.0049ea60
mov ecx, dword [esp + 8]
xor esi, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
sbb edx, esi
push esi
add eax, ecx
push 0x989680
adc edx, esi
push edx
push eax
call fcn.0049ede0
push esi
push 0xe10
push edx
push eax
call fcn.0049ede0
push esi
push 0x18
push edx
push eax
call fcn.0049ede0
mov dword [0x4dbcac], eax
test eax, eax
jge 0x491022
mov dword [0x4dbcac], 0x168
mov ecx, dword [esp + 0x428]
pop esi
xor ecx, esp
call fcn.0049dea6
add esp, 0x428
ret
Function at 0x4979d0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push 0x4db848
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x497a09
push 0x40
push 0x2bc
call fcn.0045bde0
push eax
push 0x2bd
call fcn.0045bde0
push eax
mov eax, dword [0x4dc1c8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
pop esi
ret
push 0
push 0
push 0x4db848
mov ecx, esi
call fcn.00496ac0
pop esi
ret

Function at 0x497a20
Capabilities:
Get common file path

Disassembly:
mov eax, 0x14a4
call fcn.0049e430
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x14a0], eax
push ebx
mov ebx, dword [esp + 0x14ac]
push esi
mov esi, dword [esp + 0x14b4]
test ebx, ebx
je 0x497a8b
push 0x4b5b24
push ebx
call fcn.0044df20
test al, al
jne 0x497a65
push esi
call fcn.00495a50
test al, al
je 0x497a8b
push 0x30
push 0x65
call fcn.0045bde0
push eax
push 0x596
call fcn.0045bde0
push eax
mov eax, dword [0x4dc1c8]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x497c8f
cmp dword [0x4dbc5c], 0
jne 0x497ac8
push 0
push 0
push 1
push 0
push 0
push 0
push esi
push ebx
call fcn.00495a90
test al, al
jne 0x497c8f
push ebx
push 0x201
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 8
jmp 0x497c8f
lea ecx, [esp + 0x4a8]
push ecx
push str.Rar_EXXXXXXX
call fcn.0047f0a0
test al, al
je 0x497c8f
lea edx, [esp + 0x8a8]
push edx
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x4a8]
push eax
call fcn.004ac458
add esp, 4
lea ecx, [esp + 8]
push ecx
mov ecx, 0x4e0c08
call fcn.004136e0
call fcn.0047b360
push 0x4e798c
push 0x4e758c
mov ecx, 0x4e0c08
call fcn.00413690
mov edx, dword [esp + 0x18]
mov ecx, dword [0x4e818c]
push 0x4b175c
mov dword [0x4e613c], edx
call fcn.00465910
call fcn.004771b0
push 0
push 0
mov ecx, 0x4e0c08
mov dword [0x4e5d28], 4
call fcn.00416240
cmp dword [0x4db840], 0
jne 0x497c8f
lea eax, [esp + 0xa8]
push eax
push ebx
call fcn.0044dc40
lea ecx, [esp + 0xca8]
push ecx
push esi
call fcn.0044dd80
lea edx, [esp + 0xa8]
push edx
mov eax, edx
push eax
call fcn.0042fa70
lea ecx, [esp + 0xca8]
push ecx
mov edx, ecx
push edx
call fcn.0042fb00
push 0x2010
push 0
push 0x4fdea0
call fcn.0049e460
add esp, 0xc
xor eax, eax
jmp 0x497bd0
mov cl, byte [esp + eax + 0xa8]
mov byte [eax + 0x4feaad], cl
inc eax
test cl, cl
jne 0x497bd0
lea eax, [esp + 0xca8]
push eax
push 0x4feeae
call fcn.0046dae0
xor eax, eax
jmp 0x497c00
mov cl, byte [eax + 0x4e758c]
mov byte [eax + 0x4fdea5], cl
inc eax
test cl, cl
jne 0x497c00
push 0x4e798c
push 0x4fe2a6
call fcn.0046dae0
xor eax, eax
mov cl, byte [esp + eax + 0x4a8]
mov byte [eax + 0x4ff6ae], cl
inc eax
test cl, cl
jne 0x497c22
lea ecx, [esp + 0x8a8]
push ecx
call fcn.004ac458
mov edx, dword [0x4e613c]
add esp, 4
cmp dword [esp + 0x94], 0
mov byte [0x4fdea4], 0
mov dword [0x4feaa8], edx
je 0x497c71
cmp byte [0x4e27ca], 0
mov byte [0x4feaac], 1
je 0x497c78
mov byte [0x4feaac], 0
push 0x4fdea0
push 0x10000
push 0x496310
call fcn.0049ef88
add esp, 0xc
mov ecx, dword [esp + 0x14a8]
pop esi
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x14a4
ret 8