joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a26a
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a4]
sub esp, 0x424
mov eax, dword [0x41232c]
mov ecx, dword [ebp + 0x3ac]
push ebx
push esi
xor eax, ebp
cmp ecx, dword [0x4147a0]
push edi
mov edi, dword [ebp + 0x3b0]
mov dword [ebp + 0x3a0], eax
mov dword [ebp - 0x78], edi
jae 0x40a40c
mov eax, ecx
sar eax, 5
lea ebx, [eax*4 + 0x4147c0]
mov eax, dword [ebx]
mov esi, ecx
and esi, 0x1f
shl esi, 3
mov al, byte [eax + esi + 4]
test al, 1
mov dword [ebp - 0x80], ebx
je 0x40a40c
and dword [ebp - 0x70], 0
and dword [ebp - 0x7c], 0
cmp dword [ebp + 0x3b4], 0
jne 0x40a2e0
xor eax, eax
jmp 0x40a420
test al, 0x20
je 0x40a2f3
push 2
push 0
push 0
push ecx
call fcn.0040c642
add esp, 0x10
mov eax, dword [ebx]
add eax, esi
test byte [eax + 4], 0x80
je 0x40a388
and dword [ebp - 0x68], 0
cmp dword [ebp + 0x3b4], 0
mov dword [ebp - 0x6c], edi
jbe 0x40a3e9
mov ecx, dword [ebp - 0x6c]
xor edi, edi
sub ecx, dword [ebp - 0x78]
lea eax, [ebp - 0x64]
cmp ecx, dword [ebp + 0x3b4]
jae 0x40a34d
mov edx, dword [ebp - 0x6c]
inc dword [ebp - 0x6c]
mov dl, byte [edx]
inc ecx
cmp dl, 0xa
jne 0x40a33e
inc dword [ebp - 0x7c]
mov byte [eax], 0xd
inc eax
inc edi
mov ebx, dword [ebp - 0x80]
mov byte [eax], dl
inc eax
inc edi
cmp edi, 0x400
jl 0x40a320
mov edi, eax
lea eax, [ebp - 0x64]
sub edi, eax
push 0
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp - 0x64]
push eax
mov eax, dword [ebx]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a3ad
mov eax, dword [ebp - 0x74]
add dword [ebp - 0x70], eax
cmp eax, edi
jl 0x40a3b6
mov eax, dword [ebp - 0x6c]
sub eax, dword [ebp - 0x78]
cmp eax, dword [ebp + 0x3b4]
jb 0x40a315
jmp 0x40a3b6
push 0
lea ecx, [ebp - 0x74]
push ecx
push dword [ebp + 0x3b4]
push edi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40a3ad
mov eax, dword [ebp - 0x74]
and dword [ebp - 0x68], 0
mov dword [ebp - 0x70], eax
jmp 0x40a3b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x70]
test eax, eax
jne 0x40a407
cmp dword [ebp - 0x68], eax
je 0x40a3e6
push 5
pop eax
cmp dword [ebp - 0x68], eax
jne 0x40a3db
mov dword [0x414380], 9
mov dword [0x414384], eax
jmp 0x40a41d
push dword [ebp - 0x68]
call fcn.0040c52d
pop ecx
jmp 0x40a41d
mov edi, dword [ebp - 0x78]
mov eax, dword [ebx]
test byte [eax + esi + 4], 0x40
je 0x40a3fb
cmp byte [edi], 0x1a
je 0x40a2d9
mov dword [0x414380], 0x1c
jmp 0x40a416
sub eax, dword [ebp - 0x7c]
jmp 0x40a420
mov dword [0x414380], 9
and dword [0x414384], 0
or eax, 0xffffffff
mov ecx, dword [ebp + 0x3a0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a704
add ebp, 0x3a4
leave
ret
Function at 0x40b1da
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40b208
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x40b20f
cmp ebx, dword [eax + 4]
jae 0x40b20f
xor eax, eax
jmp 0x40b3ff
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x40b220
xor eax, eax
inc eax
jmp 0x40b3fe
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x40b236
cmp ecx, edx
jae 0x40b37b
cmp dword [eax + 4], 0
je 0x40b23f
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x40b227
cmp dword [ebp + 8], 0
je 0x40b261
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40b37b
cmp eax, esi
jae 0x40b37b
mov eax, dword [0x4144f0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40b286
cmp dword [esi*4 + 0x4144f8], edi
je 0x40b37f
inc esi
cmp esi, eax
jl 0x40b274
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40b3fb
cmp dword [ebp - 8], 0x1000000
jne 0x40b3fb
test byte [ebp - 0xc], 0xcc
je 0x40b304
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40b3fb
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40b3fb
cmp word [eax + 0x18], 0x10b
jne 0x40b3fb
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40b3fb
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x40b304
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x40b304
test byte [ecx + 0x27], 0x80
jne 0x40b37b
push 1
push 0x414538
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x40b218
mov ecx, dword [0x4144f0]
test ecx, ecx
mov edx, ecx
jle 0x40b338
lea eax, [ecx*4 + 0x4144f4]
cmp dword [eax], edi
je 0x40b338
dec edx
sub eax, 4
test edx, edx
jg 0x40b32c
test edx, edx
jne 0x40b369
push 0xf
pop ebx
cmp ecx, ebx
jg 0x40b345
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x40b35d
lea eax, [edx*4 + 0x4144f8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x40b34b
cmp ecx, 0x10
jge 0x40b369
inc ecx
mov dword [0x4144f0], ecx
push 0
push 0x414538
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x40b218
xor eax, eax
jmp 0x40b3fe
test esi, esi
jle 0x40b218
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0x414538
call ebx
test eax, eax
jne 0x40b218
cmp dword [esi*4 + 0x4144f8], edi
je 0x40b3d5
mov eax, dword [0x4144f0]
lea esi, [eax - 1]
test esi, esi
jl 0x40b3c3
cmp dword [esi*4 + 0x4144f8], edi
je 0x40b3bf
dec esi
jns 0x40b3b3
test esi, esi
jge 0x40b3d3
cmp eax, 0x10
jge 0x40b3ce
inc eax
mov dword [0x4144f0], eax
lea esi, [eax - 1]
jmp 0x40b3d5
je 0x40b3ed
xor ecx, ecx
test esi, esi
jl 0x40b3ed
lea eax, [ecx*4 + 0x4144f8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x40b3db
push 0
push 0x414538
call ebx
jmp 0x40b218
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bbb5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x414544], ebx
push esi
push edi
jne 0x40bc35
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x40bc70
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x414544], eax
je 0x40bc70
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x414548], eax
call esi
cmp dword [0x41438c], 2
mov dword [0x41454c], eax
jne 0x40bc35
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x414554], eax
je 0x40bc35
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x414550], eax
mov eax, dword [0x414550]
test eax, eax
je 0x40bc7a
call eax
test eax, eax
je 0x40bc61
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x414554]
test eax, eax
je 0x40bc61
test byte [ebp - 8], 1
jne 0x40bc7a
cmp dword [0x414398], 4
jb 0x40bc74
or byte [ebp + 0x12], 0x20
jmp 0x40bc99
xor eax, eax
jmp 0x40bca9
or byte [ebp + 0x12], 4
jmp 0x40bc99
mov eax, dword [0x414548]
test eax, eax
je 0x40bc99
call eax
mov ebx, eax
test ebx, ebx
je 0x40bc99
mov eax, dword [0x41454c]
test eax, eax
je 0x40bc99
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x414544]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4b4e70
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x72000]
push edi
jmp 0x4b4e8a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b4e91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4e80
mov eax, 1
add ebx, ebx
jne 0x4b4ea3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b4eb4
jne 0x4b4ed3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4ed3
dec eax
add ebx, ebx
jne 0x4b4ec0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b4e98
add ebx, ebx
jne 0x4b4ecf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b4f25
xor ecx, ecx
sub eax, 3
jb 0x4b4eeb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b4f5a
sar eax, 1
mov ebp, eax
jmp 0x4b4ef6
add ebx, ebx
jne 0x4b4ef6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4ec4
inc ecx
add ebx, ebx
jne 0x4b4f04
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b4ec4
add ebx, ebx
jne 0x4b4f11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b4f06
jne 0x4b4f22
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b4f06
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b4f44
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b4f36
jmp 0x4b4e86
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b4f44
add edi, ecx
jmp 0x4b4e86
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b4f62
cmp byte [edi], 0x13
jne 0x4b4f62
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b4f67
lea edi, [esi + 0xb0000]
mov eax, dword [edi]
or eax, eax
je 0x4b4fdf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb8028]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb817c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b4f94
mov ecx, edi
jns 0x4b4fc3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb8180]
or eax, eax
je 0x4b4fd9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b4fb1
call dword [esi + 0xb8190]
mov ebp, dword [esi + 0xb8184]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b5013
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x401a80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4047f4], eax
mov ecx, ebp
add ecx, 8
mov dword [0x40410c], ecx
mov dword [0x4047f8], 0x30
mov dword [0x4047fc], 2
mov dword [0x404804], 0
mov dword [0x404808], 0
mov dword [0x404800], 0x401fb0
mov eax, 0xffff0000
mov ebx, section..text
and ebx, eax
mov dword [0x404104], ebx
mov dword [0x40480c], ebx
jmp 0x401ae8
mov dword [0x404818], 0xf
mov dword [0x404820], 0x404769
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x404810], eax
mov dword [0x404824], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x404814], eax
push 0x4047f8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x404104]
push 0
push 0
push 0x24e
push 0x320
push 0xd8
push 0xa0
push 0x40000
push str.fomy
push str.windcl
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x4047ec], eax
xor eax, eax
jmp 0x401b76
push eax
push dword [0x4047ec]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x4047ec]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x404828
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x401bbc
push 0x404828
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x404828
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x401b8f
mov eax, dword [0x404830]
jmp 0x401bc7
call 0x401358
ret
Function at 0x4112f0
Capabilities:
Check if file exists
Get common file path
Get disk information
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x800], eax
push esi
push edi
mov edi, dword [esp + 0x814]
push 0x400
push 0x4b1914
lea eax, [esp + 0x10]
push eax
push str.TempFolder
push str.Paths
mov byte [edi], 0
call fcn.00456900
cmp byte [esp + 8], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathA]
jne 0x411354
cmp byte [0x4e6954], 0
je 0x411410
lea ecx, [esp + 8]
push ecx
push 0x400
call esi
push 0x400
lea edx, [esp + 0x40c]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jle 0x411391
cmp eax, 0x400
jae 0x411391
push 0x400
lea ecx, [esp + 0x40c]
push ecx
lea edx, [esp + 0x10]
push edx
call fcn.0049f290
add esp, 0xc
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4113ad
lea ecx, [esp + 8]
push ecx
push 0x400
call esi
push 1
push str.TempRemovableOnly
push str.Paths
call fcn.00456960
test eax, eax
je 0x4113f3
cmp byte [0x4e6954], 0
jne 0x4113f3
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
je 0x4113dd
cmp eax, 5
jne 0x41140a
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4113e7
jmp 0x41140a
lea eax, [esp + 8]
mov edx, edi
mov ecx, eax
sub edx, ecx
lea ecx, [ecx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x411400
push edi
call fcn.0044dfb0
mov ecx, dword [esp + 0x808]
pop edi
pop esi
xor ecx, esp
call fcn.0049dea6
add esp, 0x804
ret 8
Function at 0x414ed0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0xf4
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 4]
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x404], eax
test eax, eax
jne 0x414f20
push eax
push ebx
call fcn.0047ebe0
test eax, eax
je 0x414f15
cmp eax, 0x20
je 0x414f15
push ebx
push eax
push 0x20
push 0x5c8
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 0x10
pop esi
xor al, al
pop ebx
add esp, 0xf4
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Prepare
push eax
call edi
mov dword [esi + 0x490], eax
mov eax, dword [esi + 0x404]
push str.Open
push eax
call edi
mov ecx, dword [esi + 0x404]
push str.OpenW
push ecx
mov dword [esi + 0x494], eax
call edi
mov edx, dword [esi + 0x404]
push str.Close
push edx
mov dword [esi + 0x498], eax
call edi
mov dword [esi + 0x49c], eax
mov eax, dword [esi + 0x404]
push str.GetNextName
push eax
call edi
mov ecx, dword [esi + 0x404]
push str.GetListItem
push ecx
mov dword [esi + 0x4a0], eax
call edi
mov edx, dword [esi + 0x404]
push str.Extract
push edx
mov dword [esi + 0x4a4], eax
call edi
mov dword [esi + 0x4a8], eax
mov eax, dword [esi + 0x404]
push str.GetComment
push eax
call edi
cmp dword [esi + 0x490], 0
mov dword [esi + 0x4ac], eax
je 0x41515e
cmp dword [esi + 0x494], 0
jne 0x414fe4
cmp dword [esi + 0x498], 0
je 0x41515e
push 0xf4
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0049e460
push 0x88
lea edi, [esi + 0x408]
push 0
push edi
mov dword [esp + 0x24], 0xf4
mov dword [esp + 0x28], 0x4103a0
mov dword [esp + 0x2c], 0x4104f0
mov dword [esp + 0x30], 0x410510
mov dword [esp + 0x34], 0x410520
mov dword [esp + 0x38], 0x413e90
mov dword [esp + 0x3c], 0x410780
mov dword [esp + 0x40], 0x4107a0
mov dword [esp + 0x44], 0x4107b0
mov dword [esp + 0x48], 0x413ed0
mov dword [esp + 0x4c], 0x413ef0
mov dword [esp + 0x50], 0x4109d0
mov dword [esp + 0x54], 0x410c10
mov dword [esp + 0x58], 0x410c20
mov dword [esp + 0x5c], 0x410c80
mov dword [esp + 0x60], 0x413eb0
mov dword [esp + 0x64], 0x410d00
mov dword [esp + 0x68], 0x410d40
mov dword [esp + 0x6c], 0x410d70
mov dword [esp + 0x70], 0x410d80
mov dword [esp + 0x74], 0x410d90
mov dword [esp + 0x78], 0x410da0
mov dword [esp + 0x7c], 0x410db0
mov dword [esp + 0x80], 0x410e40
mov dword [esp + 0x84], 0x410ed0
mov dword [esp + 0x88], 0x411040
mov dword [esp + 0x8c], fcn.00410960
mov dword [esp + 0x90], fcn.004105c0
mov dword [esp + 0x94], fcn.00410860
mov dword [esp + 0x98], 0x410d20
call fcn.0049e460
mov eax, dword [esi + 0x490]
add esp, 0x18
push edi
lea edx, [esp + 0x10]
push edx
mov dword [edi], 0x88
call eax
cmp dword [esi + 0x488], 0
je 0x41516a
mov ecx, dword [esi + 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
mov dword [esi + 0x404], 0
call fcn.0044db30
push eax
push 0x42e
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 8
pop edi
pop esi
xor al, al
pop ebx
add esp, 0xf4
ret
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0xf4
ret
Function at 0x47a830
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x4e42b0], 0
jne 0x47a87e
push edi
mov edi, dword [0x4f66d0]
test edi, edi
je 0x47a87d
push esi
push 0x4e42b0
push str.Rar_CMXXXXXX
call fcn.0047efc0
mov esi, eax
test esi, esi
je 0x47a87c
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47a860
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049f602
push esi
call fcn.0049f426
add esp, 0x14
pop esi
pop edi
ret

Function at 0x47b4b0
Capabilities:
Write file on windows

Disassembly:
push 1
call fcn.0047b410
jmp fcn.0047a830

Function at 0x47b4c0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
mov ebx, dword [esp + 0x25c]
push esi
push edi
mov edi, dword [esp + 0x268]
xor esi, esi
push esi
lea eax, [esp + 0x10]
push str.Profiles_d
push eax
mov byte [edi], 0
call fcn.0049deb5
add esp, 0xc
push 0x200
push 0x4b1914
lea ecx, [esp + 0x64]
push ecx
push str.Name
lea edx, [esp + 0x1c]
push edx
call fcn.00456900
cmp byte [esp + 0x5c], 0
je 0x47b5df
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.004652e0
test eax, eax
je 0x47b570
inc esi
push esi
lea ecx, [esp + 0x10]
push str.Profiles_d
push ecx
call fcn.0049deb5
add esp, 0xc
push 0x200
push 0x4b1914
lea edx, [esp + 0x64]
push edx
push str.Name
lea eax, [esp + 0x1c]
push eax
call fcn.00456900
cmp byte [esp + 0x5c], 0
jne 0x47b526
jmp 0x47b5df
push 0
push 1
push esi
call fcn.00479d00
push 0
push str.ImmExec
lea ecx, [esp + 0x14]
push ecx
call fcn.00456960
test eax, eax
setne al
mov byte [edi], al
test al, al
je 0x47b5df
cmp byte [0x4e42b0], 0
jne 0x47b5df
mov edi, dword [0x4f66d0]
test edi, edi
je 0x47b5df
push 0x4e42b0
push str.Rar_CMXXXXXX
call fcn.0047efc0
mov esi, eax
test esi, esi
je 0x47b5df
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47b5c3
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049f602
push esi
call fcn.0049f426
add esp, 0x14
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049dea6
add esp, 0x254
ret 8
Function at 0x47e2d0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push edi
mov edi, dword [esp + 0x414]
push edi
push 0x4b1914
push esi
push str.TempFolder
push str.Paths
call fcn.00456900
cmp byte [esi], 0
mov byte [esp + 8], 0
je 0x47e346
push 0x400
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x47e335
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.00465320
cmp byte [esi], 0
je 0x47e346
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x47e370
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x47e357
cmp byte [esi], 0
jne 0x47e370
mov edx, dword [str._rartemp]
mov dword [esi], edx
mov eax, dword [0x4b4a74]
mov dword [esi + 4], eax
mov cl, byte [0x4b4a78]
mov byte [esi + 8], cl
push esi
call fcn.0044dfb0
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.0049dea6
add esp, 0x404
ret 8

Function at 0x47e400
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
test esi, esi
je 0x47e42f
xor eax, eax
mov word [esi], ax
call fcn.0043ca60
test eax, eax
je 0x47e42f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x47e42f
pop edi
xor al, al
pop esi
ret 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47e44a
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret 0xc
pop edi
mov al, 1
pop esi
ret 0xc

Function at 0x47e520
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x47e579
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x47e55f
jne 0x47e579
cmp dword [esp + 8], 0
jbe 0x47e579
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0049dea6
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.0049dea6
add esp, 0x98
ret
Function at 0x48e230
Capabilities:
Copy file

Disassembly:
mov eax, 0x1030
call fcn.0049e430
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x102c], eax
cmp dword [0x4dbc5c], 0
je 0x48e427
push 0
lea eax, [esp + 0x428]
push eax
mov ecx, 0x4e0c08
call fcn.00413690
push 1
push str.History
push str.General
call fcn.00456960
test eax, eax
setne al
mov byte [esp + 3], al
test al, al
je 0x48e2a5
push 0x400
push 0x4b1914
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.00456900
cmp byte [esp + 0x24], 0
jne 0x48e2b6
lea edx, [esp + 0x24]
push edx
call fcn.0043ad00
xor eax, eax
jmp 0x48e2c0
mov cl, byte [esp + eax + 0x24]
mov byte [esp + eax + 0x828], cl
inc eax
test cl, cl
jne 0x48e2c0
lea eax, [esp + 0x828]
push eax
call fcn.0044dfb0
lea ecx, [esp + 0x424]
push ecx
call fcn.0044db30
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e2f0
push esi
push edi
lea edi, [esp + 0x830]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48e303
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 1
push 0
lea edx, [esp + 0x838]
mov ecx, eax
push edx
and ecx, 3
push 0x5af
rep movsb byte es:[edi], byte [esi]
call fcn.0045bde0
push eax
mov eax, dword [0x4dc1c8]
push eax
call fcn.00418f60
pop edi
pop esi
test al, al
je 0x48e427
push 0x400
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x830]
push edx
call fcn.0044dff0
cmp byte [esp + 3], 0
je 0x48e379
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.004567c0
lea eax, [esp + 0x424]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e383
sub eax, edx
mov byte [esp + eax + 0x425], cl
lea eax, [esp + 0x828]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48e3a0
sub eax, edx
mov byte [esp + eax + 0x829], cl
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea eax, [esp + 4]
lea ecx, [esp + 0x424]
lea edx, [esp + 0x828]
push eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je 0x48e427
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
push 0x5b0
call fcn.0045bde0
push eax
call fcn.0048e100
add esp, 0xc
mov ecx, 0x4c9364
call fcn.00427d40
mov ecx, dword [esp + 0x102c]
xor ecx, esp
call fcn.0049dea6
add esp, 0x1030
ret