joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ded60
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1008
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x100c]
lea ecx, [esp]
push 0x800
push ecx
push eax
mov ecx, 0x57de98
call fcn.00447a80
push 0x802
lea eax, [esp + 4]
push eax
call fcn.004836c0
push 0x802
push 0x524968
lea eax, [esp + 8]
push eax
call fcn.0049ce50
push 1
push 0x52452c
push 0
lea eax, [esp + 0xc]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.00502f8e
add esp, 0x1008
ret 4

Function at 0x4dfcf0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x325c
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x3258], eax
cmp byte [esp + 0x3264], 0
push ebx
mov bh, byte [esp + 0x3264]
mov dword [0x558bb0], 1
je 0x4dfe5e
push edi
push 0
push 0x800
lea eax, [esp + 0x1268]
push eax
call fcn.004d5520
push 0x800
lea eax, [esp + 0x1264]
push eax
call fcn.004836c0
lea eax, [esp + 0x1260]
push eax
push str._sRar_
lea eax, [esp + 0x2268]
push 0x800
push eax
call fcn.004027c0
add esp, 0x10
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4dfe56
push esi
jmp 0x4dfda0
cmp dword [0x558bb0], 1
jne 0x4dfe55
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1264]
sub esi, dword [esp + 0x1c]
push 0x800
push eax
lea eax, [esp + 0x26c]
push eax
call fcn.0049ce90
push 0x800
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x26c]
push eax
call fcn.0049ce50
test byte [esp + 0x14], 0x10
je 0x4dfe34
push 6
lea eax, [esp + 0x44]
push str.Rar_DI
push eax
call fcn.00509bed
add esp, 0xc
test eax, eax
lea eax, [esp + 0x264]
sete bl
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4dfe41
cmp esi, 8
jb 0x4dfe21
test bh, bh
je 0x4dfe25
test bl, bl
je 0x4dfe41
lea eax, [esp + 0x264]
push eax
call fcn.004d4ce0
jmp 0x4dfe41
lea eax, [esp + 0x264]
push eax
call fcn.004d4c10
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4dfda0
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
test bh, bh
pop ebx
jne 0x4dfe8d
call fcn.00465e30
test al, al
je 0x4dfe8d
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004eba40
mov byte [esp], al
push dword [esp]
call fcn.00465fe0
mov ecx, dword [esp + 0x3258]
xor ecx, esp
mov dword [0x558bb0], 0
call fcn.00502f8e
add esp, 0x325c
ret 8
Function at 0x4e31c0
Capabilities:
Delete file

Disassembly:
mov eax, 0x1120
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x111c], eax
cmp byte [0x57eeda], 0
jne 0x4e342e
cmp byte [esp + 0x1124], 0
jne 0x4e320b
call fcn.004e3450
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.00502f8e
add esp, 0x1120
ret 4
push ebp
push edi
xor edi, edi
mov ecx, 0x57de98
push edi
xor ebp, ebp
mov dword [esp + 0x10c0], edi
mov dword [esp + 0x10c4], edi
mov dword [esp + 0x10c8], edi
mov dword [esp + 0x10cc], edi
mov dword [esp + 0x10d0], edi
mov dword [esp + 0x10d4], edi
call fcn.004473f0
lea eax, [esp + 0x2c]
mov ecx, 0x57de98
push eax
call fcn.004473f0
test al, al
je 0x4e328a
lea esp, [esp]
lea eax, [esp + 0xb]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004e7a20
test al, al
lea eax, [esp + 0x2c]
jne 0x4e33ae
push eax
mov ecx, 0x57de98
call fcn.004473f0
test al, al
jne 0x4e3260
push ebx
push esi
push 0
mov ecx, 0x57de98
call fcn.004473f0
lea eax, [esp + 0x34]
mov ecx, 0x57de98
push eax
call fcn.004473f0
test al, al
je 0x4e3401
nop
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4e32b7
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + edi]
lea eax, [ebx*2 + 4]
push eax
push ebp
call fcn.005097c2
mov esi, eax
add esp, 8
test esi, esi
je 0x4e3421
lea ecx, [esp + 0x34]
mov ebp, esi
lea edx, [edi + edi]
mov eax, ecx
sub edx, eax
add edx, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4e32f3
lea eax, [esp + 0x34]
mov ecx, 0x57de98
push eax
lea edi, [ebx + 1]
call fcn.004473f0
test al, al
jne 0x4e32b0
test edi, edi
je 0x4e3401
xor eax, eax
mov word [esi + edi*2], ax
inc dword [0x559c20]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov eax, dword [0x558aa8]
mov dword [esp + 0x14], eax
mov eax, 0x40
mov word [esp + 0x24], ax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
push esi
sete bl
dec dword [0x559c20]
call fcn.005097b2
add esp, 4
test bl, bl
je 0x4e342a
cmp dword [esp + 0x26], 0
jne 0x4e342a
mov ecx, 0x559c34
call fcn.004bc100
push 0x52452c
mov ecx, 0x57de98
call fcn.0044ab10
jmp 0x4e342a
push 0x64
push eax
call fcn.0044ded0
push eax
push 0x204
call fcn.00496b20
push eax
call fcn.004db310
add esp, 8
push 0x205
call fcn.00496b20
push eax
call fcn.004db5b0
movzx eax, byte [esp + 0xf]
add esp, 4
neg eax
sbb eax, eax
and eax, 0xffffff87
add eax, 0xce
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x58c304
call fcn.0046df00
jmp 0x4e342c
push 0x30
push 0x65
call fcn.00496b20
push eax
push 0x14c
call fcn.00496b20
push eax
push dword [0x558aa8]
call fcn.004d6c50
push ebp
call fcn.005097b2
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.00502f8e
add esp, 0x1120
ret 4
Function at 0x4e4b40
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x100c
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x559c20], 0
push ebx
mov ebx, dword [esp + 0x1014]
je 0x4e4b83
xor al, al
pop ebx
mov ecx, dword [esp + 0x1008]
xor ecx, esp
call fcn.00502f8e
add esp, 0x100c
ret 8
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov edi, eax
cmp edi, 1
jne 0x4e4c40
xor eax, eax
push 0x800
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
push eax
push 0
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x558b34], 0
je 0x4e4bf2
cmp byte [esp + 0x101c], 0
jne 0x4e4c17
cmp eax, dword [0x57dec8]
je 0x4e4c17
cmp eax, dword [0x559c3c]
je 0x4e4c17
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4e4c17
push 1
lea eax, [esp + 0x14]
mov ecx, 0x57de98
push eax
call fcn.00448140
cmp eax, 1
je 0x4e4c3c
push 7
push 0x537b5c
lea eax, [esp + 0x18]
push eax
call fcn.00485280
push eax
call fcn.004a0630
test eax, eax
jne 0x4e4c40
lea eax, [esp + 0x10]
push eax
call fcn.004e77d0
xor al, al
jmp 0x4e4c89
push esi
push 0
call fcn.004d0a10
mov ecx, 0x570afc
call fcn.0049d160
xor esi, esi
test edi, edi
je 0x4e4c86
jmp 0x4e4c60
push 0x800
lea eax, [esp + 0x18]
push eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [esp + 0x14]
mov ecx, 0x570afc
push eax
call fcn.0049cf80
inc esi
cmp esi, edi
jb 0x4e4c60
mov al, 1
pop esi
mov ecx, dword [esp + 0x1010]
pop edi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x100c
ret 8
Function at 0x4e77d0
Capabilities:
Copy file

Disassembly:
mov eax, 0x2008
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x2004], eax
push esi
mov esi, dword [esp + 0x2010]
call fcn.00465e30
test al, al
je 0x4e782e
cmp byte [0x56a730], 0
jne 0x4e782e
push 0x24
push 0x5f0
call fcn.00496b20
push eax
push 0x5f1
call fcn.00496b20
push eax
push dword [0x558aa8]
call fcn.004d6c50
cmp eax, 6
jne 0x4e7989
push ebx
push 0x800
lea eax, [esp + 0x1010]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea eax, [esp + 0x1014]
push eax
call fcn.00485380
push 0
lea eax, [esp + 0x1010]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
test eax, eax
lea eax, [esp + 0x10]
push 0x800
push eax
setne bl
call fcn.004847a0
push 0x800
lea eax, [esp + 0x10]
push eax
call fcn.004836c0
push 0x800
push str.rarreg.key
lea eax, [esp + 0x14]
push eax
call fcn.0049ce50
test bl, bl
lea eax, [esp + 0xc]
pop ebx
je 0x4e78b6
push eax
call fcn.00473d60
jmp 0x4e78d7
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x800
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1010]
push eax
call fcn.0049ce90
push dword [0x558aa8]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [0x558aa8]
call dword [sym.imp.USER32.dll_FlashWindow]
push 1
lea eax, [esp + 0x100c]
push eax
call fcn.00465c70
mov byte [esp + 4], al
push dword [esp + 4]
call fcn.00465fe0
push 0
push dword [0x558aa8]
call dword [sym.imp.USER32.dll_FlashWindow]
mov ecx, 0x57de98
call fcn.0044b6b0
call fcn.00465e30
test al, al
je 0x4e7969
push 0x40
push 0x368
call fcn.00496b20
push eax
push 0x367
call fcn.00496b20
push eax
push dword [0x558aa8]
call fcn.004d6c50
pop esi
mov ecx, dword [esp + 0x2004]
xor ecx, esp
call fcn.00502f8e
add esp, 0x2008
ret 4
lea eax, [esp + 0x1008]
push eax
call fcn.00473d60
push 0x366
call fcn.00496b20
push eax
call fcn.004db310
add esp, 4
mov ecx, dword [esp + 0x2008]
pop esi
xor ecx, esp
call fcn.00502f8e
add esp, 0x2008
ret 4
Function at 0x4e7a20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
push ebx
mov byte [edi], 0
call fcn.00485280
push 3
mov esi, eax
push 0x536984
push esi
call fcn.004a0630
test eax, eax
je 0x4e7a58
push 3
push 0x53698c
push esi
call fcn.004a0630
test eax, eax
jne 0x4e7a7b
movzx eax, word [esi + 6]
push eax
call fcn.0050eaae
add esp, 4
test eax, eax
je 0x4e7a7b
movzx eax, word [esi + 8]
cmp eax, 0x2e
je 0x4e7af6
test ax, ax
je 0x4e7af6
push 3
push 0x536994
push esi
call fcn.004a0630
test eax, eax
je 0x4e7abf
push 3
push 0x53699c
push esi
call fcn.004a0630
test eax, eax
je 0x4e7abf
push 3
push 0x5369a4
push esi
call fcn.004a0630
test eax, eax
je 0x4e7abf
push 3
push 0x5327f4
push esi
call fcn.004a0630
test eax, eax
jne 0x4e7acd
movzx eax, word [esi + 6]
cmp eax, 0x2e
je 0x4e7af6
test ax, ax
je 0x4e7af6
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4e7aee
push ebx
call fcn.00474160
test al, al
je 0x4e7aee
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov al, 1
mov byte [edi], al
pop edi
pop esi
pop ebx
ret 8
Function at 0x4ea870
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x58
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x54], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x68]
mov ebp, ecx
push edi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov ecx, dword [esi + 0x18]
mov edi, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
mov dword [esp + 0x18], 0x10000
mov dword [esp + 0x1c], 0x38000
lea eax, [ecx + 1]
mov dword [esp + 0x20], 0x10000
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0x10000
mov dword [esp + 0x34], 0x10000
mov dword [esp + 0x38], 0x7c000
mov dword [esp + 0x3c], 0x10000
mov dword [esp + 0x40], 0x10000
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0x10000
mov dword [esp + 0x4c], 0x10000
mov dword [esp + 0x50], 0x10000
mov dword [esp + 0x54], 0xfe000
mov dword [esp + 0x58], 0x10000
mov dword [esp + 0x5c], 0x10000
mov dword [esp + 0x60], 0x10000
mov dword [esi + 0x18], eax
cmp ecx, 6
jb 0x4ea95f
pop edi
mov dword [esi], 0
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.00502f8e
add esp, 0x58
ret 4
mov eax, ecx
xor edx, edx
mov ecx, 6
div ecx
cmp edx, 3
jb 0x4ea978
mov eax, 5
sub eax, edx
mov edx, eax
movzx eax, byte [esi + 6]
lea ecx, [esp + 0x10]
push 0
push eax
movzx eax, byte [esi + 5]
push eax
movzx eax, byte [esi + 4]
push eax
push ebx
push edi
lea eax, [edx*8]
push 7
sub eax, edx
push 0xa
push 0
lea eax, [ecx + eax*4]
mov ecx, ebp
push eax
call fcn.004e9fe0
mov ecx, dword [esp + 0x64]
mov dword [esi + 0x10], edi
pop edi
mov dword [esi + 0x14], ebx
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x58
ret 4
Function at 0x4ebb10
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x35d4
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x35d0], eax
cmp dword [0x5511c0], 0xffffffff
push ebx
mov ebx, dword [esp + 0x35e8]
push esi
mov esi, dword [esp + 0x35e0]
push edi
mov edi, dword [esp + 0x35e8]
jne 0x4ebbab
push 0x4001
push 0x2b4
lea eax, [esp + 0x7c]
push eax
push 0
push 0x524968
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x78]
mov dword [0x5bd2bc], eax
lea eax, [esp + 0x25dc]
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x7c]
push eax
push 0
lea eax, [esp + 0x25ec]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x78]
mov dword [0x5511c0], eax
push ebp
push 0x800
push edi
lea eax, [esp + 0x5e8]
push eax
call fcn.0049ce90
push 0x800
lea eax, [esp + 0x5e4]
push eax
push eax
call fcn.00485410
movzx eax, word [esi]
lea ecx, [esp + 0x5e0]
mov ebp, eax
mov dword [esp + 0x10], 3
mov edi, eax
mov dword [esp + 0x14], 0x40000000
test ax, ax
mov dword [esp + 0x18], 0
mov dword [esp + 0x24], ecx
lea eax, [esp + 0x32c]
je 0x4ebc25
push 0x4011
push 0x2b4
push eax
movzx eax, byte [esp + 0x35fc]
neg eax
sbb eax, eax
and eax, 0x10
push eax
jmp 0x4ebc32
push 0x4001
push 0x2b4
push eax
push 0
lea eax, [esp + 0x5f0]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov eax, dword [esp + 0x330]
mov dword [esp + 0x2c], eax
push 0x800
test di, di
je 0x4ebc65
push esi
lea eax, [esp + 0x15e8]
push eax
call fcn.0049ce90
jmp 0x4ebc98
lea eax, [esp + 0x5e4]
push eax
lea eax, [esp + 0x15e8]
push eax
call fcn.0049ce90
lea eax, [esp + 0x15e0]
push eax
call fcn.004852e0
lea eax, [esp + 0x5e0]
push eax
call fcn.00485280
mov dword [esp + 0x24], eax
push 0x66
push dword [0x558ab4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0
push 0x104d
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [esp + 0x10], 3
lea eax, [esp + 0x15e0]
mov dword [esp + 0x14], edi
test bp, bp
mov dword [esp + 0x18], 1
mov dword [esp + 0x24], eax
pop ebp
je 0x4ebcee
mov ecx, dword [0x5511c0]
mov dword [esp + 0x28], ecx
jmp 0x4ebcf7
mov eax, dword [0x5bd2bc]
mov dword [esp + 0x28], eax
lea eax, [esp + 0xc]
push eax
push 0
push 0x104c
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [esp + 0x40]
mov dword [esp + 0x48], 2
push eax
push edi
push 0x1074
push esi
mov dword [esp + 0x64], ebx
call dword [sym.imp.USER32.dll_SendMessageW]
test edi, edi
jne 0x4ebd4e
lea eax, [esp + 0x40]
mov dword [esp + 0x50], 1
push eax
push edi
push 0x102b
push esi
mov dword [esp + 0x5c], 1
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [0x5b9794]
pop edi
inc eax
mov dword [0x5b9794], eax
pop esi
pop ebx
cmp eax, 1
jne 0x4ebd7a
push 0x4f5
call fcn.00496b20
push eax
push 2
push dword [0x558ab4]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [esp + 0x35d0]
xor ecx, esp
call fcn.00502f8e
add esp, 0x35d4
ret 0x10
Function at 0x4edea0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x2000], eax
push edi
push 0x1000
push 0
lea eax, [esp + 0x100c]
push eax
push str.rarreg.key
push 0x52452c
call fcn.004ae560
mov edi, eax
test edi, edi
je 0x4edf36
push esi
push 0x800
lea eax, [esp + 0xc]
push eax
push 0x537d9c
call fcn.004d5850
mov esi, eax
test esi, esi
je 0x4edf26
push esi
push edi
lea eax, [esp + 0x1010]
push 1
push eax
call fcn.0050a0c5
push esi
call fcn.00509ce0
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.004e77d0
lea eax, [esp + 8]
push eax
call fcn.00473d60
push str.rarreg.key
push 0x52452c
call fcn.004ae060
pop esi
mov ecx, dword [esp + 0x2004]
pop edi
xor ecx, esp
call fcn.00502f8e
add esp, 0x2004
ret
Function at 0x4ee0a0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1028
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
mov dword [esp + 0x1c], 0x55b00
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea eax, [esp + 0xc]
push eax
push str.VerInfo
push 0x5248b8
call fcn.004ae560
push 1
push 0x800
lea eax, [esp + 0x30]
push eax
call fcn.004847a0
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.004836c0
push 0x800
push str.version.dat
lea eax, [esp + 0x30]
push eax
call fcn.0049ce50
push 0x526a10
lea eax, [esp + 0x2c]
mov dword [esp + 0x14], 0
push eax
call fcn.00475430
mov esi, eax
test esi, esi
je 0x4ee14d
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.0050d63f
push esi
call fcn.00509ce0
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4ee216
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x4ee1e2
lea eax, [esp + 0x20]
push eax
push str.VerInfo
push 0x5248b8
call fcn.004af170
call fcn.004aee80
test al, al
jne 0x4ee1b1
push 0x524ae0
lea eax, [esp + 0x2c]
push eax
call fcn.00475430
mov esi, eax
test esi, esi
je 0x4ee1b1
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.0050a0c5
push esi
call fcn.00509ce0
add esp, 0x14
call fcn.004aee90
movzx eax, al
neg eax
pop esi
sbb eax, eax
and eax, 0xfffffe98
add eax, 0x168
mov dword [0x559bd0], eax
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.00502f8e
add esp, 0x1028
ret
mov eax, dword [esp + 0x18]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push eax
push str.VerInfo
push 0x5248b8
mov dword [esp + 0x14], ecx
call fcn.004af170
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x4ee266
cmp dword [esp + 0x10], eax
je 0x4ee266
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
call fcn.004aee80
test al, al
jne 0x4ee266
push 0x524ae0
lea eax, [esp + 0x2c]
push eax
call fcn.00475430
mov esi, eax
test esi, esi
je 0x4ee266
push esi
push 0xc
lea eax, [esp + 0xc]
push 1
push eax
call fcn.0050a0c5
push esi
call fcn.00509ce0
add esp, 0x14
mov eax, dword [esp + 0x24]
xor ecx, ecx
sub ecx, ecx
push 0xc9
sbb eax, dword [esp + 0x10]
sub ecx, dword [esp + 0xc]
push 0x2a69c000
sbb eax, 0
add ecx, dword [esp + 0x28]
adc eax, 0
push eax
push ecx
call fcn.00503120
mov dword [0x559bd0], eax
test eax, eax
jns 0x4ee2a4
mov dword [0x559bd0], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.00502f8e
add esp, 0x1028
ret
Function at 0x4eefc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5218d6
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x5513d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5ee5e0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5c59ec]
cmp eax, dword [ecx + 4]
jle 0x4ef049
push 0x5c59ec
call fcn.005039c4
add esp, 4
cmp dword [0x5c59ec], 0xffffffff
jne 0x4ef049
mov dword [ebp - 4], 0
mov ecx, 0x5c58ea
call fcn.00499f80
mov byte [ebp - 4], 0
push 0x522110
call fcn.0050370b
mov dword [ebp - 4], 0xffffffff
push 0x5c59ec
call fcn.00503985
add esp, 8
mov esi, dword [ebp + 8]
mov ecx, 0x5c18c8
push 1
push esi
call fcn.004f0810
mov bl, byte [ebp + 0xc]
push 0
push 0x5c18c8
test bl, bl
sete al
movzx eax, al
push eax
push 0
push 0
push esi
push 0
call fcn.004f18c0
test al, al
jne 0x4ef0c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [0x5c18d0]
mov esi, eax
cmp edx, 0xffffffff
je 0x4ef0a0
push edx
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x5c18d0], 0xffffffff
mov ecx, 0x5c58ea
call fcn.00499fa0
cmp esi, 0x4c7
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
test bl, bl
je 0x4ef0e3
push 0x5c18c8
push 0x10000
push 0x4ef670
call fcn.0050a474
add esp, 0xc
jmp 0x4ef108
mov eax, dword [0x5c18d0]
cmp eax, 0xffffffff
je 0x4ef0fe
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x5c18d0], 0xffffffff
mov ecx, 0x5c58ea
call fcn.00499fa0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4f01d0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5219bc
mov eax, dword fs:[0]
push eax
mov eax, 0x1004
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x4f0245
push 0x537fb4
push esi
call fcn.00483700
test al, al
jne 0x4f0220
push esi
call fcn.004f0560
test al, al
je 0x4f0245
push 0x30
push 0x65
call fcn.00496b20
push eax
push 0x596
call fcn.00496b20
push eax
push dword [0x558aa8]
call fcn.004d6c50
jmp 0x4f039a
cmp byte [0x558b34], 0
jne 0x4f0281
push 0
push 0
push 1
push 0
push 0
push esi
push 0
call fcn.004f18c0
test al, al
jne 0x4f039a
push esi
push 0x201
call fcn.00496b20
push eax
call fcn.004db310
add esp, 8
jmp 0x4f039a
push 1
call fcn.004d08b0
push 1
push 0x800
push 0x5665be
push str.Rar_EX
call fcn.004d5920
test al, al
je 0x4f039a
push 0x800
push 0x56fafa
mov ecx, 0x57b208
call fcn.00406070
mov eax, dword [0x57b20c]
mov ecx, 0x570afc
push 0x524704
mov dword [0x56caa0], eax
call fcn.0049cf80
push 0x800
lea eax, [ebp - 0x1010]
mov dword [0x56ba8c], 2
push eax
push esi
push 0x5665be
call fcn.00484d90
push 0
push 0
mov ecx, 0x57b208
call fcn.00405be0
cmp byte [0x558b37], 0
jne 0x4f039a
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5ee5e0]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5c9b14]
cmp eax, dword [ecx + 4]
jle 0x4f0370
push 0x5c9b14
call fcn.005039c4
add esp, 4
cmp dword [0x5c9b14], 0xffffffff
jne 0x4f0370
mov dword [ebp - 4], 0
mov ecx, 0x5c59f0
call fcn.004eec30
push 0x5221b0
call fcn.0050370b
mov dword [ebp - 4], 0xffffffff
push 0x5c9b14
call fcn.00503985
add esp, 8
push 0
lea eax, [ebp - 0x1010]
mov ecx, 0x5c59f0
push eax
call fcn.004f0810
push 0x5c59f0
push 0x10000
push 0x4ef670
call fcn.0050a474
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00502f8e
mov esp, ebp
pop ebp
ret 4