joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48ad30
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
push ebx
call edi
push ebx
mov esi, eax
call edi
mov ebp, dword [esp + 0x38]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov dword [esp + 0x40], eax
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x24]
push 0xcc0020
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov edx, eax
neg edx
push edx
push 0
lea edx, [eax - 1]
push edx
push esi
push ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0xcc0020
push 0
push 0
push edi
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov edx, dword [esp + 0x18]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4

Function at 0x48af00
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x800], eax
cmp byte [0x52a4b8], 0
push esi
mov esi, dword [esp + 0x80c]
je 0x48af3d
mov eax, dword [esp + 0x810]
push eax
push esi
push 0x52a4b8
call fcn.004770e0
jmp 0x48afc5
push edi
mov edi, dword [esp + 0x814]
push edi
push 0x4c6d80
push esi
push str.TempFolder
push str.Paths
call fcn.00460470
xor ecx, ecx
mov word [esp + 8], cx
cmp word [esi], cx
je 0x48af9a
push 0x400
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x48af88
push edi
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0046fc70
cmp word [esi], 0
je 0x48af9a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48afc4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x48afac
cmp word [esi], 0
jne 0x48afc4
mov eax, str._rartemp
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x48afb5
pop edi
push esi
call fcn.00455810
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004affec
add esp, 0x804
ret 8
Function at 0x48b8d0
Capabilities:
Create directory

Disassembly:
mov eax, 0x1004
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebp
mov ebp, dword [esp + 0x1010]
push esi
push 0x3ff
push eax
lea eax, [esp + 0x810]
push eax
call fcn.0046fc70
cmp byte [esp + 0x1018], 0
je 0x48b974
cmp dword [0x521df4], 0
jne 0x48b92b
cmp byte [0x521dfe], 0
jne 0x48b92b
xor edx, edx
jmp 0x48b930
mov edx, 1
lea eax, [esp + 0x808]
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48b940
sub eax, esi
xor ecx, ecx
sar eax, 1
test dl, dl
setne cl
lea edx, [esp + eax*2 + 0x808]
add ecx, 0x61
push ecx
push 0x4cc65c
push edx
mov edx, 2
call fcn.00407130
add esp, 0xc
push 0x400
lea eax, [esp + 0xc]
push eax
call fcn.0048af00
lea ecx, [esp + 8]
push ecx
call fcn.00455810
lea eax, [esp + 0x808]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48b996
push edi
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xfffffffe
jmp 0x48b9b0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x48b9b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x400
lea edx, [esp + 0x10]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00436470
pop edi
test eax, eax
je 0x48ba13
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x48ba13
lea eax, [esp + 8]
mov edx, ebp
mov ecx, eax
sub edx, ecx
jmp 0x48ba00
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x48ba00
mov al, 1
jmp 0x48ba37
lea edx, [esp + 8]
push edx
push 0x1f7
call fcn.00466860
push eax
call fcn.004997e0
add esp, 8
mov ecx, 0x5072f4
call fcn.0042caa0
xor al, al
mov ecx, dword [esp + 0x1008]
pop esi
pop ebp
xor ecx, esp
call fcn.004affec
add esp, 0x1004
ret 0xc
Function at 0x48bff0
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 8
push ebx
lea eax, [esp + 4]
push eax
push 0x4ce584
push 1
push 0
push 0x4ce674
xor bl, bl
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x48c0f2
mov eax, dword [esp + 4]
mov ecx, dword [eax]
lea edx, [esp + 8]
push edx
push 0x4ce5c4
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x48c0e6
push esi
mov esi, dword [esp + 0x1c]
cmp byte [esp + 0x14], bl
je 0x48c04e
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x14]
push 2
push esi
push eax
call edx
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x18]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
mov eax, dword [esp + 0x24]
test eax, eax
je 0x48c074
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x1c]
push ecx
call eax
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 8]
push 0
test ecx, ecx
jne 0x48c091
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
push 0x4c6d80
push eax
call edx
jmp 0x48c09a
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x44]
call eax
mov ecx, dword [esp + 0x2c]
test ecx, ecx
je 0x48c0af
mov eax, dword [esp + 8]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x2c]
call eax
mov ecx, dword [esp + 0x20]
test ecx, ecx
je 0x48c0c4
mov eax, dword [esp + 8]
mov edx, dword [eax]
push ecx
push eax
mov eax, dword [edx + 0x24]
call eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push 1
push esi
push eax
call edx
pop esi
test eax, eax
jl 0x48c0da
mov bl, 1
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov al, bl
pop ebx
add esp, 8
ret 0x1c

Function at 0x48c790
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1804
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x1800], eax
mov eax, dword [esp + 0x1808]
mov ecx, dword [0x51a774]
push ebx
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0x600
lea edx, [esp + 0xc08]
mov ebx, eax
push edx
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x600
lea eax, [esp + 8]
push eax
push edi
push esi
call fcn.00455d40
lea ecx, [esp + 0xc04]
lea eax, [esp + 4]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48c816
test dx, dx
je 0x48c812
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48c816
add eax, 4
add ecx, 4
test dx, dx
jne 0x48c7f0
xor eax, eax
jmp 0x48c81b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x48c82b
lea ecx, [esp + 4]
push ecx
push ebx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esp + 0x1804]
pop ebx
xor ecx, esp
call fcn.004affec
add esp, 0x1804
ret 4
Function at 0x48ca90
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4c4a4e
mov eax, dword fs:[0]
push eax
sub esp, 0x404
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
mov eax, dword [0x4d98f0]
xor eax, esp
push eax
lea eax, [esp + 0x410]
mov dword fs:[0], eax
mov eax, dword [0x51a774]
test eax, eax
je 0x48cbd9
push 0x200
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [0x53da48]
cmp esi, 8
je 0x48cb47
mov ecx, 0x53c548
lea eax, [esp + 0xc]
jmp 0x48cb00
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x48cb26
test dx, dx
je 0x48cb22
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x48cb26
add eax, 4
add ecx, 4
test dx, dx
jne 0x48cb00
xor eax, eax
jmp 0x48cb2b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x48cb47
mov edx, dword [0x51a774]
push 0x53c548
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [0x53da48]
test esi, esi
je 0x48cb5a
cmp esi, 1
je 0x48cb5a
cmp esi, 2
je 0x48cb5a
cmp esi, 8
jne 0x48cb8d
push 0x9c
mov edi, 0x53c448
xor esi, esi
call fcn.0048c790
push 0x53ce48
call fcn.00455e90
push 0x53d648
mov edi, eax
call fcn.00455e10
push 0x9b
mov esi, eax
call fcn.0048c790
test byte [0x53da54], 1
jne 0x48cbbd
or dword [0x53da54], 1
mov dword [esp + 0x418], 0
mov dword [0x53da50], 0
mov dword [esp + 0x418], 0xffffffff
push 0x64
mov ecx, 0x53da50
call fcn.0044c090
test al, al
je 0x48cbd9
mov eax, dword [0x51a774]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x410]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.004affec
add esp, 0x410
ret
Function at 0x48cfe0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x404
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
push 0x200
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [edi], 0x3b8
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x40
lea edx, [esp + 0xc]
push edx
call fcn.0044c4c0
cmp word [0x53bf98], 0
je 0x48d090
lea eax, [esp + 8]
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x48d030
mov ecx, dword [0x4c7018]
mov dx, word [0x4c701c]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48d056
sub eax, edx
push 0x53bf98
sar eax, 1
push 0x5aa
mov esi, eax
call fcn.00466860
push eax
lea eax, [esp + esi*2 + 0x10]
push str._s:__s
mov edx, 0x200
sub edx, esi
push eax
call fcn.00407130
add esp, 0x10
cmp byte [0x53bfff], 0
je 0x48d0fe
lea eax, [esp + 8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x48d0a0
mov ecx, dword [0x4c7018]
mov dx, word [0x4c701c]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48d0c6
sub eax, edx
sar eax, 1
mov esi, eax
mov eax, dword [esp + 0x410]
push eax
push 0x2fd
call fcn.00466860
push eax
lea ecx, [esp + esi*2 + 0x10]
mov edx, 0x200
sub edx, esi
push ecx
call fcn.00407130
add esp, 0xc
push 0x80
lea edx, [esp + 0xc]
push edx
add edi, 0x18
push edi
call fcn.0046fc70
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.004affec
add esp, 0x404
ret 4
Function at 0x48ff90
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x800], eax
cmp byte [esp + 0x81c], 0
push ebx
push ebp
mov ebp, dword [esp + 0x810]
push esi
mov esi, dword [esp + 0x818]
push edi
mov edi, dword [esp + 0x820]
je 0x490037
push 0x400
push esi
push ebp
push str.DefFolder
push str.Extraction
call fcn.00460470
cmp word [ebp], 0
jne 0x490001
mov edx, ebp
mov eax, esi
sub edx, esi
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x48fff0
jmp 0x49003d
push 0x400
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
lea eax, [esp + 0x10]
mov word [esp + 0x80e], cx
mov edx, ebp
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x490026
jmp 0x49003d
xor edx, edx
mov word [ebp], dx
movzx eax, word [ebp]
test ax, ax
setne bl
test ax, ax
jne 0x490057
push 0x400
push ebp
call fcn.0048c120
push ebp
call fcn.00455810
cmp byte [esp + 0x824], 0
jne 0x49006f
test bl, bl
je 0x490192
push 1
push str.AppendName
push str.Extraction
call fcn.004604a0
test eax, eax
je 0x490192
push 0x400
push edi
lea eax, [esp + 0x18]
push eax
call fcn.0046fc70
xor edi, edi
cmp word [esp + 0x10], di
je 0x4900d8
xor eax, eax
lea esi, [esp + 0x10]
cmp word [esi], 0x25
jne 0x4900c8
lea ecx, [esp + eax + 0x12]
push 0x25
push ecx
call fcn.004b0bd2
add esp, 8
test eax, eax
je 0x4900c8
mov edx, 0x5f
mov word [esi], dx
inc edi
lea eax, [edi + edi]
cmp word [esp + eax + 0x10], 0
lea esi, [esp + eax + 0x10]
jne 0x4900a7
lea eax, [esp + 0x10]
push eax
call fcn.00455e90
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4900e4
mov edi, ebp
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4900f6
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.00456220
mov esi, eax
test esi, esi
je 0x490192
cmp esi, ebp
jbe 0x490192
xor ecx, ecx
push ebp
mov word [esi], cx
call fcn.00456220
mov edi, eax
test edi, edi
je 0x490178
cmp edi, ebp
jbe 0x490178
cmp byte [esp + 0x828], 0
je 0x490164
cmp word [esi + 2], 0
je 0x490164
movzx edx, word [esi + 4]
push edx
call fcn.0046fa10
test al, al
jne 0x490164
movzx eax, word [esi - 2]
push eax
call fcn.0046fa10
test al, al
jne 0x490173
push str..tar
push edi
call fcn.00477400
test eax, eax
jne 0x490178
xor ecx, ecx
mov word [edi], cx
sub esi, 2
cmp esi, ebp
jbe 0x490192
nop
cmp word [esi], 0x2e
jne 0x490192
xor edx, edx
mov word [esi], dx
sub esi, 2
cmp esi, ebp
ja 0x490180
push 0
push ebp
call fcn.004558e0
mov ecx, dword [esp + 0x810]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004affec
add esp, 0x804
ret 0x18
Function at 0x4901c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [esp + 0x80c]
push edi
lea ecx, [esp + 4]
push ecx
push eax
call fcn.00455b50
lea edx, [esp + 4]
push edx
call fcn.00455810
lea edi, [esp + 4]
add edi, 0xfffffffe
jmp 0x490200
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x490200
mov eax, dword [0x4c779c]
push 1
push 0x4c6d80
push 0
lea ecx, [esp + 0x10]
push ecx
push str.open
push 0
mov dword [edi], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x808]
pop edi
xor ecx, esp
call fcn.004affec
add esp, 0x808
ret 4
Function at 0x491ca0
Capabilities:
Move file

Disassembly:
mov eax, 0x1054
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x1050], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov ecx, 0x5210a8
xor esi, esi
call fcn.00445f70
push edi
lea eax, [esp + 0x30]
push eax
mov ecx, 0x5210a8
call fcn.00445f70
test al, al
je 0x491d6e
lea ecx, [esp + 0x85c]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00455b50
lea eax, [esp + 0x85c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x491d00
sub eax, edx
sar eax, 1
lea ebx, [eax + edi + 1]
lea eax, [ebx + ebx + 2]
push eax
push esi
call fcn.004b024f
mov esi, eax
add esp, 8
test esi, esi
je 0x491e34
lea eax, [esp + 0x85c]
mov edx, eax
lea ecx, [edi + edi]
sub ecx, edx
lea edx, [ecx + esi]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x491d40
push 0
lea eax, [esp + 0x30]
push eax
mov ecx, 0x5210a8
mov edi, ebx
call fcn.00445f70
test al, al
jne 0x491ce3
test edi, edi
jne 0x491d95
push 0x30
push 0x65
call fcn.00466860
push eax
push 0x14c
call fcn.00466860
mov ecx, dword [0x51b8cc]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x491e34
xor eax, eax
xor edx, edx
mov word [esi + edi*2], dx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov eax, dword [0x51b8cc]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
cmp byte [esp + 0x1064], dl
je 0x491de2
mov ecx, 0x40
mov word [esp + 0x1c], cx
lea edx, [esp + 0xc]
mov edi, 1
add dword [0x51b024], edi
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
sub dword [0x51b024], edi
push esi
call fcn.004b01c1
add esp, 4
test bl, bl
je 0x491e34
cmp dword [esp + 0x1e], 0
jne 0x491e34
mov ecx, 0x521088
call fcn.00475fd0
push 0x4c6d80
mov ecx, 0x5210a8
call fcn.00448c00
mov ecx, dword [esp + 0x105c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004affec
add esp, 0x1054
ret 4
Function at 0x4938e0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x2d0], eax
push esi
mov esi, dword [esp + 0x2dc]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x2c8]
push 0x4c6888
push ecx
mov edx, 0xa
call fcn.00407130
add esp, 0xc
push 0x301
push 0x2b4
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [esi + 0x10], 1
je 0x49396f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4c6d80
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4939d2
mov ecx, dword [edi]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x493a25
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
xor ecx, esp
call fcn.004affec
add esp, 0x2d4
ret 4
Function at 0x4995e0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x1a64
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x1a60], eax
cmp byte [esp + 0x1a6c], 0
mov dword [0x51af90], 1
je 0x49978c
push esi
push 0x400
lea eax, [esp + 0xa68]
push eax
call fcn.0048af00
lea ecx, [esp + 0xa64]
push ecx
call fcn.00455810
lea edx, [esp + 0xa64]
push edx
lea eax, [esp + 0x1268]
push str._sRar_
push eax
mov edx, 0x400
call fcn.00407130
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1268]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 8], esi
cmp esi, 0xffffffff
je 0x499784
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
push edi
jmp 0x499690
cmp dword [0x51af90], 1
jne 0x499781
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x28]
cmp ecx, 8
setae byte [esp + 0x13]
xor eax, eax
nop
movzx ecx, word [esp + eax + 0xa70]
mov word [esp + eax + 0x270], cx
add eax, 2
test cx, cx
jne 0x4996b0
lea eax, [esp + 0x4c]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4996d0
lea edi, [esp + 0x270]
sub eax, edx
add edi, 0xfffffffe
jmp 0x4996f0
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4996f0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x20], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x49975c
push 6
lea edx, [esp + 0x50]
push str.Rar_DI
push edx
call fcn.004b1e56
add esp, 0xc
test eax, eax
lea eax, [esp + 0x270]
push eax
sete bl
call ebp
test eax, eax
jne 0x499769
cmp byte [esp + 0x13], al
je 0x499749
cmp byte [esp + 0x1a78], al
je 0x49974d
test bl, bl
je 0x499769
lea ecx, [esp + 0x270]
push ecx
call fcn.0048bd70
jmp 0x499769
lea edx, [esp + 0x270]
push edx
call fcn.0048bb00
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x499690
pop edi
pop ebx
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp byte [esp + 0x1a68], 0
jne 0x4997ba
cmp byte [0x506ce0], 0
je 0x4997ba
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.00496c30
mov byte [0x506ce0], al
mov ecx, dword [esp + 0x1a60]
xor ecx, esp
mov dword [0x51af90], 0
call fcn.004affec
add esp, 0x1a64
ret 8
Function at 0x499f80
Capabilities:
Copy file

Disassembly:
mov eax, 0x1004
call fcn.004b0000
mov eax, dword [0x4d98f0]
xor eax, esp
mov dword [esp + 0x1000], eax
cmp byte [0x506ce0], 0
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
mov edi, dword [esp + 0x1010]
je 0x499fe2
cmp byte [0x527240], 0
jne 0x499fe2
push 0x24
push 0x5f0
call fcn.00466860
push eax
push 0x5f1
call fcn.00466860
push eax
mov eax, dword [0x51b8cc]
push eax
call ebp
cmp eax, 6
jne 0x49a169
push esi
push 0x400
lea ecx, [esp + 0x810]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x80c]
push edx
mov esi, str.rarreg.key
call fcn.00455e90
lea ebx, [ebx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x49a010
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push 0
lea eax, [esp + 0x814]
push eax
push edi
call esi
lea ecx, [esp + 0x10]
test eax, eax
push ecx
setne bl
call fcn.00456690
lea edx, [esp + 0x10]
push edx
call fcn.00455810
lea eax, [esp + 0x10]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x49a055
mov ecx, dword [str.rarreg.key]
mov edx, dword [0x4c98f4]
mov dword [eax], ecx
mov ecx, dword [0x4c98f8]
mov dword [eax + 4], edx
mov edx, dword [0x4c98fc]
mov dword [eax + 8], ecx
mov ecx, dword [0x4c9900]
mov dword [eax + 0xc], edx
mov dx, word [0x4c9904]
mov dword [eax + 0x10], ecx
test bl, bl
mov word [eax + 0x14], dx
pop ebx
je 0x49a0a9
lea eax, [esp + 0xc]
push eax
call fcn.00435910
jmp 0x49a0d5
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
call esi
xor eax, eax
jmp 0x49a0c0
movzx ecx, word [esp + eax + 0xc]
mov word [esp + eax + 0x80c], cx
add eax, 2
test cx, cx
jne 0x49a0c0
mov edx, dword [0x51b8cc]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x51b8cc]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push eax
call esi
push 1
lea ecx, [esp + 0x810]
push ecx
push 0
call fcn.0041cd70
mov edx, dword [0x51b8cc]
push 0
push edx
mov byte [0x506ce0], al
call esi
mov ecx, 0x5210a8
call fcn.0044a650
cmp byte [0x506ce0], 0
pop esi
je 0x49a149
push 0x30
push 0x368
call fcn.00466860
push eax
push 0x367
call fcn.00466860
push eax
mov eax, dword [0x51b8cc]
push eax
call ebp
jmp 0x49a169
lea ecx, [esp + 0x808]
push ecx
call fcn.00435910
push 0x366
call fcn.00466860
push eax
call fcn.004997e0
add esp, 4
mov ecx, dword [esp + 0x1008]
pop edi
pop ebp
xor ecx, esp
call fcn.004affec
add esp, 0x1004
ret 4