joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b4810
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x35d8
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x35d4], eax
cmp dword [0x50f8bc], 0xffffffff
mov eax, dword [esp + 0x35e8]
push ebp
mov ebp, dword [esp + 0x35e0]
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push edi
mov edi, dword [esp + 0x35ec]
mov dword [esp + 0xc], eax
jne 0x4b48b4
push 0x4001
push 0x2b4
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x4fa4b8
call esi
mov edx, dword [esp + 0x7c]
push 0x800
lea eax, [esp + 0x25e4]
push eax
push 0
mov dword [0x56abe4], edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4001
push 0x2b4
lea ecx, [esp + 0x80]
push ecx
push 0
lea edx, [esp + 0x25f0]
push edx
call esi
mov eax, dword [esp + 0x7c]
mov dword [0x50f8bc], eax
push ebx
push 0x800
push edi
lea ecx, [esp + 0x5ec]
push ecx
call fcn.00466b20
push 0x800
lea edx, [esp + 0x5e8]
push edx
mov eax, edx
push eax
call fcn.00450f90
cmp word [ebp], 0
lea ecx, [esp + 0x5e4]
setne bl
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0x40000000
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x330]
test bl, bl
je 0x4b4931
movzx eax, byte [esp + 0x35f4]
push 0x4011
neg eax
push 0x2b4
sbb eax, eax
push edx
and eax, 0x10
push eax
push ecx
jmp 0x4b4946
push 0x4001
push 0x2b4
push edx
push 0
lea eax, [esp + 0x5f4]
push eax
call esi
mov ecx, dword [esp + 0x334]
mov dword [esp + 0x30], ecx
push 0x800
test bl, bl
je 0x4b496c
push ebp
lea edx, [esp + 0x15ec]
push edx
call fcn.00466b20
jmp 0x4b499f
lea eax, [esp + 0x5e8]
push eax
lea ecx, [esp + 0x15ec]
push ecx
call fcn.00466b20
lea edx, [esp + 0x15e4]
push edx
call fcn.00451430
lea eax, [esp + 0x5e4]
push eax
call fcn.00451140
mov dword [esp + 0x28], eax
mov ecx, dword [0x533384]
push 0x66
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x14]
push edx
push 0
mov esi, eax
push 0x104d
push esi
call ebp
mov edi, eax
lea eax, [esp + 0x15e4]
test bl, bl
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
pop ebx
je 0x4b49f7
mov ecx, dword [0x50f8bc]
mov dword [esp + 0x2c], ecx
jmp 0x4b4a01
mov edx, dword [0x56abe4]
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x10]
push eax
push 0
push 0x104c
push esi
call ebp
mov ecx, dword [esp + 0xc]
push ecx
mov dword [esp + 0x50], 2
call fcn.00466c90
lea edx, [esp + 0x44]
push edx
push edi
push 0x1074
push esi
mov dword [esp + 0x68], eax
call ebp
test edi, edi
jne 0x4b4a53
mov eax, 1
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x44]
push eax
push edi
push 0x102b
push esi
call ebp
mov ecx, dword [esp + 0x35e0]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004df824
add esp, 0x35d8
ret 0x10
Function at 0x4b5ef0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2d0], eax
push esi
mov esi, dword [esp + 0x2dc]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x2c8]
push str._c:_
push ecx
mov edx, 0xa
call fcn.00460180
add esp, 0xc
push 0x301
push 0x2b4
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [esi + 0x10], 1
je 0x4b5f7f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4f9a98
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b5fe2
mov ecx, dword [edi]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x4b6035
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
xor ecx, esp
call fcn.004df824
add esp, 0x2d4
ret 4
Function at 0x4b8fb0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x3260
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x325c], eax
cmp byte [esp + 0x3268], 0
mov dword [0x5343a0], 1
je 0x4b9129
push ebp
push 0
push 0x800
lea eax, [esp + 0x1268]
push eax
call fcn.004ad670
push 0x800
lea ecx, [esp + 0x1264]
push ecx
call fcn.00450c80
lea edx, [esp + 0x1260]
push edx
lea eax, [esp + 0x2264]
push str._sRar_
push eax
mov edx, 0x800
call fcn.00460180
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x2264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4b9121
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
lea ebx, [ebx]
cmp dword [0x5343a0], 1
jne 0x4b911f
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x20]
push 0x800
lea edx, [esp + 0x126c]
push edx
lea eax, [esp + 0x270]
cmp ecx, 8
push eax
setae byte [esp + 0x1b]
call fcn.00466b20
push 0x800
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x270]
push edx
call fcn.00466ba0
test byte [esp + 0x18], 0x10
je 0x4b90fe
push 6
lea eax, [esp + 0x48]
push str.Rar_DI
push eax
call fcn.004e3b63
add esp, 0xc
lea ecx, [esp + 0x268]
test eax, eax
push ecx
sete bl
call esi
test eax, eax
jne 0x4b910b
cmp byte [esp + 0xf], al
je 0x4b90eb
cmp byte [esp + 0x3270], al
je 0x4b90ef
test bl, bl
je 0x4b910b
lea edx, [esp + 0x268]
push edx
call fcn.004ae570
jmp 0x4b910b
lea eax, [esp + 0x268]
push eax
call fcn.004ae200
lea ecx, [esp + 0x18]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4b9060
pop ebx
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
cmp byte [esp + 0x3264], 0
jne 0x4b9157
cmp byte [0x51e2c0], 0
je 0x4b9157
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004b5bd0
mov byte [0x51e2c0], al
mov ecx, dword [esp + 0x325c]
xor ecx, esp
mov dword [0x5343a0], 0
call fcn.004df824
add esp, 0x3260
ret 8
Function at 0x4bc820
Capabilities:
Copy file

Disassembly:
mov eax, 0x2004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp byte [0x51e2c0], 0
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [esp + 0x2010]
je 0x4bc882
cmp byte [0x54b8ec], 0
jne 0x4bc882
push 0x24
push 0x5f0
call fcn.004612b0
push eax
push 0x5f1
call fcn.004612b0
push eax
mov eax, dword [0x5354dc]
push eax
call ebp
cmp eax, 6
jne 0x4bc9c8
push ebx
push edi
push 0x800
lea ecx, [esp + 0x1014]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea edx, [esp + 0x1018]
push edx
call fcn.00451310
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
lea eax, [esp + 0x1014]
push eax
push esi
call edi
push 1
push 0x800
lea ecx, [esp + 0x18]
test eax, eax
push ecx
setne bl
call fcn.00451530
push 0x800
lea edx, [esp + 0x14]
push edx
call fcn.00450c80
push 0x800
push str.rarreg.key
lea eax, [esp + 0x18]
push eax
call fcn.00466ba0
test bl, bl
je 0x4bc90c
lea ecx, [esp + 0x10]
push ecx
call fcn.00443160
jmp 0x4bc935
push 0
lea edx, [esp + 0x14]
push edx
push esi
call edi
xor eax, eax
jmp 0x4bc920
movzx ecx, word [esp + eax + 0x10]
mov word [esp + eax + 0x1010], cx
add eax, 2
test cx, cx
jne 0x4bc920
mov eax, dword [0x5354dc]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x5354dc]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push ecx
call esi
push 1
lea edx, [esp + 0x1014]
push edx
call fcn.00436320
mov byte [0x51e2c0], al
mov eax, dword [0x5354dc]
push 0
push eax
call esi
mov ecx, 0x53fd10
call fcn.004919e0
cmp byte [0x51e2c0], 0
pop edi
pop ebx
je 0x4bc9a8
push 0x30
push 0x368
call fcn.004612b0
push eax
push 0x367
call fcn.004612b0
mov ecx, dword [0x5354dc]
push eax
push ecx
call ebp
jmp 0x4bc9c8
lea edx, [esp + 0x1008]
push edx
call fcn.00443160
push 0x366
call fcn.004612b0
push eax
call fcn.004bc000
add esp, 4
mov ecx, dword [esp + 0x2008]
pop esi
pop ebp
xor ecx, esp
call fcn.004df824
add esp, 0x2004
ret 4
Function at 0x4bc9f0
Capabilities:
Copy file

Disassembly:
mov eax, 0x3024
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x3020], eax
cmp byte [0x533389], 0
je 0x4bcbce
push ebx
push 0x800
lea eax, [esp + 0x2028]
push eax
mov ecx, 0x541e38
call fcn.004785d0
push 1
push str.History
push str.General
call fcn.00496890
test eax, eax
setne bl
test bl, bl
je 0x4bca65
push 0x800
push 0x4f9a98
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.00496860
cmp word [esp + 0x24], 0
jne 0x4bca77
lea edx, [esp + 0x24]
push edx
call fcn.00489460
push 0x800
lea eax, [esp + 0x1028]
push eax
lea ecx, [esp + 0x202c]
push ecx
call fcn.00451140
push eax
lea edx, [esp + 0x30]
push edx
call fcn.00450cd0
push 1
push 0
lea eax, [esp + 0x102c]
push eax
push 0x5af
call fcn.004612b0
mov ecx, dword [0x5354dc]
push eax
push ecx
call fcn.0047ad90
test al, al
je 0x4bcbcd
push 0x800
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x102c]
push eax
call fcn.004513e0
test bl, bl
je 0x4bcaf6
lea ecx, [esp + 0x24]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.00496790
lea eax, [esp + 0x2024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bcb00
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4bcb1c
mov eax, 0x7ff
xor edx, edx
mov word [esp + eax*2 + 0x2024], dx
lea eax, [esp + 0x1024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bcb30
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4bcb4c
mov eax, 0x7ff
xor ecx, ecx
mov word [esp + eax*2 + 0x1024], cx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea ecx, [esp + 4]
lea edx, [esp + 0x2024]
lea eax, [esp + 0x1024]
push ecx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4bcbcd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push 0x5b0
call fcn.004612b0
push eax
call fcn.004bc000
add esp, 0xc
mov ecx, 0x5275b8
call fcn.0043d760
pop ebx
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.004df824
add esp, 0x3024
ret
Function at 0x4bcdf0
Capabilities:
Move file

Disassembly:
mov eax, 0x1110
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x110c], eax
cmp byte [0x540d2a], 0
jne 0x4bd031
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
mov ecx, 0x53fd10
xor ebp, ebp
mov dword [esp + 0x10c8], esi
mov dword [esp + 0x10cc], esi
call fcn.0048d070
lea eax, [esp + 0x34]
push eax
mov ecx, 0x53fd10
call fcn.0048d070
test al, al
je 0x4bce76
lea esp, [esp]
lea edi, [esp + 0x13]
lea ebx, [esp + 0x34]
call fcn.004b4700
test al, al
jne 0x4bcf33
mov ecx, ebx
push ecx
mov ecx, 0x53fd10
call fcn.0048d070
test al, al
jne 0x4bce50
push 0
mov ecx, 0x53fd10
call fcn.0048d070
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x53fd10
call fcn.0048d070
test al, al
je 0x4bcf0c
lea eax, [esp + 0x34]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bcea0
sub eax, edx
sar eax, 1
lea edi, [eax + ebp + 1]
lea edx, [edi + edi + 2]
push edx
push esi
call fcn.004df86b
mov esi, eax
add esp, 8
test esi, esi
je 0x4bd02d
lea eax, [esp + 0x34]
mov edx, eax
lea ecx, [ebp + ebp]
sub ecx, edx
lea edx, [ecx + esi]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4bcee0
lea eax, [esp + 0x34]
push eax
mov ecx, 0x53fd10
mov ebp, edi
call fcn.0048d070
test al, al
jne 0x4bce95
test ebp, ebp
jne 0x4bcf8e
push 0x30
push 0x65
call fcn.004612b0
push eax
push 0x14c
call fcn.004612b0
mov ecx, dword [0x5354dc]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4bd02d
cmp byte [esp + 0x1124], 0
je 0x4bcf84
push 0x64
lea edx, [esp + 0x38]
push edx
call fcn.00493380
push eax
push 0x203
call fcn.004612b0
push eax
call fcn.004bc000
movzx eax, byte [esp + 0x1b]
add esp, 8
neg eax
sbb eax, eax
and eax, 0xffffff87
add eax, 0xce
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x5275b8
call fcn.0043d760
jmp 0x4bd02d
call fcn.004bbd80
jmp 0x4bd02d
xor eax, eax
xor edx, edx
mov word [esi + ebp*2], dx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov eax, dword [0x5354dc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 3
cmp byte [esp + 0x1124], dl
je 0x4bcfdb
mov ecx, 0x40
mov word [esp + 0x24], cx
lea edx, [esp + 0x14]
mov edi, 1
add dword [0x534434], edi
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
sub dword [0x534434], edi
push esi
call fcn.004df66f
add esp, 4
test bl, bl
je 0x4bd02d
cmp dword [esp + 0x26], 0
jne 0x4bd02d
mov ecx, 0x53fcf0
call fcn.004a27e0
push 0x4f9a98
mov ecx, 0x53fd10
call fcn.00490780
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110c]
xor ecx, esp
call fcn.004df824
add esp, 0x1110
ret 4
Function at 0x4bf500
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
mov eax, 0x100c
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x534434], 0
push ebx
mov ebx, dword [esp + 0x1014]
jne 0x4bf648
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x4bf5ec
push 0x800
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
push ebx
mov word [esp + 0x24], ax
call ebp
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x533389], 0
je 0x4bf59c
cmp byte [esp + 0x1020], 0
jne 0x4bf5c5
cmp eax, dword [0x53fd10]
je 0x4bf5c5
cmp eax, dword [0x53fcf4]
je 0x4bf5c5
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4bf5c5
push 1
lea eax, [esp + 0x18]
push eax
mov ecx, 0x53fd10
call fcn.00491080
cmp eax, 1
je 0x4bf646
push 7
push str.rarreg.
lea ecx, [esp + 0x1c]
push ecx
call fcn.00451140
push eax
call fcn.00469f30
test eax, eax
jne 0x4bf5ec
lea edx, [esp + 0x14]
push edx
call fcn.004bc820
jmp 0x4bf646
push esi
push 0
call fcn.004aa0d0
mov ecx, 0x551b7c
call fcn.00466ed0
xor esi, esi
test edi, edi
jle 0x4bf626
push 0x800
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x551b7c
call fcn.00466f00
inc esi
cmp esi, edi
jl 0x4bf604
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
shr eax, 0xf
and al, 1
mov byte [esp + 0x14], al
mov edx, dword [esp + 0x14]
push edx
push 0
call fcn.004acbf0
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x100c]
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x100c
ret 8

Function at 0x4bfa60
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2000], eax
push esi
push 0x1000
push 0
lea eax, [esp + 0x100c]
push eax
push str.rarreg.key
push 0x4f9a98
call fcn.004968b0
mov esi, eax
test esi, esi
je 0x4bfaf6
push edi
push 0x800
lea ecx, [esp + 0xc]
push ecx
push str.Rar_RK
call fcn.004adf10
mov edi, eax
test edi, edi
je 0x4bfae6
push edi
push esi
lea edx, [esp + 0x1010]
push 1
push edx
call fcn.004e450e
push edi
call fcn.004e0da1
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.004bc820
lea ecx, [esp + 8]
push ecx
call fcn.00443160
push str.rarreg.key
push 0x4f9a98
call fcn.00496410
pop edi
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.004df824
add esp, 0x2004
ret
Function at 0x4bfb10
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1028
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], 0x50b00
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push str.VerInfo
push str.General
call fcn.004968b0
push 1
push 0x800
lea edx, [esp + 0x30]
push edx
call fcn.00451530
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.00450c80
push 0x800
push str.version.dat
lea ecx, [esp + 0x30]
push ecx
call fcn.00466ba0
push 0x4f9ce8
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x18], 0
call fcn.00443340
mov esi, eax
test esi, esi
je 0x4bfbbd
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004e11c1
push esi
call fcn.004e0da1
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4bfc6c
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x4bfc38
lea ecx, [esp + 0x20]
push ecx
push str.VerInfo
push str.General
call fcn.00496810
push 0x4fb9fc
lea edx, [esp + 0x2c]
push edx
call fcn.00443340
mov esi, eax
test esi, esi
je 0x4bfc18
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.004e450e
push esi
call fcn.004e0da1
add esp, 0x14
mov dword [0x534428], 0
pop esi
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.004df824
add esp, 0x1028
ret
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
push str.VerInfo
push str.General
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call fcn.00496810
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x4bfcb3
cmp dword [esp + 0x10], eax
je 0x4bfcb3
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 8]
push 0x4fb9fc
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call fcn.00443340
mov esi, eax
test esi, esi
je 0x4bfcb3
push esi
push 0xc
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.004e450e
push esi
call fcn.004e0da1
add esp, 0x14
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
xor eax, eax
push 1
xor esi, esi
sub ecx, edx
push eax
sbb esi, eax
push esi
push ecx
call fcn.004e07b0
mov ecx, dword [esp + 8]
xor esi, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
sbb edx, esi
push esi
add eax, ecx
push 0x989680
adc edx, esi
push edx
push eax
call fcn.004e3260
push esi
push 0xe10
push edx
push eax
call fcn.004e3260
push esi
push 0x18
push edx
push eax
call fcn.004e3260
mov dword [0x534428], eax
test eax, eax
jge 0x4bfd16
mov dword [0x534428], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.004df824
add esp, 0x1028
ret
Function at 0x4c32d0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2044
call fcn.004df840
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2040], eax
mov eax, dword [esp + 0x205c]
push ebx
mov ebx, dword [esp + 0x2064]
push ebp
mov ebp, dword [esp + 0x205c]
push esi
mov esi, dword [esp + 0x2058]
push edi
mov edi, dword [esp + 0x2060]
push 0x3c
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x1c], eax
call fcn.004e0730
add esp, 0xc
cmp byte [esp + 0x2068], 0
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x500
jne 0x4c3346
mov dword [esp + 0x18], 0x540
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebp
call fcn.00451140
cmp eax, esi
jne 0x4c3380
push esi
lea edx, [esp + 0x54]
push str.._s
push edx
mov edx, 0x1000
call fcn.00460180
lea eax, [esp + 0x5c]
add esp, 0xc
mov dword [esp + 0x24], eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [esp + 0x14]
mov ebx, 1
push ecx
mov dword [esp + 0x34], ebx
mov byte [0x53338b], bl
call esi
test eax, eax
jne 0x4c33b1
cmp dword [esp + 0x20], eax
je 0x4c33b1
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], eax
call esi
mov byte [0x53338b], 0
test eax, eax
je 0x4c3462
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
je 0x4c3462
cmp byte [esp + 0x2068], 0
jne 0x4c345e
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x4c3412
mov eax, dword [0x56f638]
mov edx, dword [esp + 0x34]
mov dword [eax*4 + 0x56f5f8], ecx
mov dword [eax*4 + 0x56f5b8], edx
inc eax
and eax, 0x8000000f
jns 0x4c340b
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x56f638], eax
jmp 0x4c3454
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
lea ebx, [ebx]
mov eax, dword [esi + 0x56f5b8]
cmp eax, dword [esp + 0x34]
jne 0x4c3448
mov ecx, dword [esi + 0x56f5f8]
push 0
push ecx
call edi
cmp eax, 0x102
jne 0x4c3448
mov edx, dword [esi + 0x56f5f8]
mov dword [esp + 0x4c], edx
add esi, 4
cmp esi, 0x40
jl 0x4c3420
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c345e
mov dword [eax], ecx
mov al, bl
jmp 0x4c3464
xor al, al
mov ecx, dword [esp + 0x2050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df824
add esp, 0x2044
ret 0x1c