joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9b70
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x4d5951
mov eax, dword fs:[0]
push eax
mov eax, 0x7120
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x711c], eax
push ebx
push ebp
push esi
mov eax, dword [0x4eb984]
xor eax, esp
push eax
lea eax, [esp + 0x7130]
mov dword fs:[0], eax
call fcn.004a7450
test al, al
je 0x4a9dd0
xor ebx, ebx
push ebx
mov ecx, 0x53fdc8
call fcn.0044cd10
lea eax, [esp + 0x10b4]
push eax
mov ecx, 0x53fdc8
call fcn.0044cd10
test al, al
je 0x4a9db7
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x4a9bf0
lea ecx, [esp + 0x10b4]
push ecx
call ebp
cmp eax, 0xffffffff
jne 0x4a9d9d
lea edx, [esp + 0x10b4]
push edx
call fcn.0043ca60
test al, al
je 0x4a9d9d
mov eax, dword [esp + 0x20c4]
push eax
call fcn.0043c310
test al, al
je 0x4a9d90
lea eax, [esp + 0x10b4]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4a9c37
sub eax, edx
sar eax, 1
mov esi, eax
cmp esi, 0x104
jb 0x4a9db7
push 0x800
lea ecx, [esp + 0x6130]
push ecx
push 0x4d7800
lea edx, [esp + 0x10c0]
push edx
call fcn.0045ff20
lea ecx, [esp + 0x10]
call fcn.0047f4c0
mov dword [esp + 0x7138], ebx
lea eax, [esp + 0x612c]
push eax
lea ecx, [esp + 0x14]
call fcn.0047f330
push 2
push ebx
push 2
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x2114]
call fcn.00477a80
mov byte [esp + 0x7138], 1
lea ecx, [esp + 0x107c]
call fcn.00482210
lea ecx, [esp + 0x1084]
call fcn.00482210
lea ecx, [esp + 0x108c]
call fcn.00482210
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0x2108]
call fcn.00478320
test eax, eax
jne 0x4a9d52
jmp 0x4a9cf0
push esi
lea eax, [esp + 0x10b8]
push eax
lea ecx, [esp + 0x74]
push ecx
call fcn.004c3b3a
add esp, 0xc
test eax, eax
jne 0x4a9d52
lea edx, [esp + 0x6c]
push edx
call fcn.0043cb80
cmp byte [esp + 0x1078], bl
je 0x4a9d33
test byte [esp + 0x10ac], 1
je 0x4a9d3d
lea eax, [esp + 0x6c]
push eax
call fcn.0043c580
jmp 0x4a9d3d
lea ecx, [esp + 0x6c]
push ecx
call fcn.0043c500
lea edx, [esp + 0x6c]
push edx
lea ecx, [esp + 0x2108]
call fcn.00478320
test eax, eax
je 0x4a9cf0
lea eax, [esp + 0x10b4]
push eax
call fcn.0043c580
mov byte [esp + 0x7138], bl
lea ecx, [esp + 0x2104]
call fcn.00477cf0
mov dword [esp + 0x7138], 0xffffffff
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x4a9d9d
push eax
call fcn.004c1404
add esp, 4
jmp 0x4a9d9d
lea ecx, [esp + 0x10b4]
push ecx
call fcn.0043c500
lea edx, [esp + 0x10b4]
push edx
mov ecx, 0x53fdc8
call fcn.0044cd10
test al, al
jne 0x4a9bf0
mov ecx, 0x53fda8
call fcn.00485430
push 0x4d79fc
mov ecx, 0x53fdc8
call fcn.0044f550
mov ecx, dword [esp + 0x7130]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x711c]
xor ecx, esp
call fcn.004c0c62
add esp, 0x712c
ret
Function at 0x4ac670
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x3260
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x325c], eax
cmp byte [esp + 0x3268], 0
mov dword [0x534448], 1
je 0x4ac7e9
push ebp
push 0
push 0x800
lea eax, [esp + 0x1268]
push eax
call fcn.0049e210
push 0x800
lea ecx, [esp + 0x1264]
push ecx
call fcn.0045fed0
lea edx, [esp + 0x1260]
push edx
lea eax, [esp + 0x2264]
push str._sRar_
push eax
mov edx, 0x800
call fcn.00495190
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x2264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4ac7e1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
lea ebx, [ebx]
cmp dword [0x534448], 1
jne 0x4ac7df
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x20]
push 0x800
lea edx, [esp + 0x126c]
push edx
lea eax, [esp + 0x270]
cmp ecx, 8
push eax
setae byte [esp + 0x1b]
call fcn.0047ef70
push 0x800
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x270]
push edx
call fcn.0047efb0
test byte [esp + 0x18], 0x10
je 0x4ac7be
push 6
lea eax, [esp + 0x48]
push str.Rar_DI
push eax
call fcn.004c3b3a
add esp, 0xc
lea ecx, [esp + 0x268]
test eax, eax
push ecx
sete bl
call esi
test eax, eax
jne 0x4ac7cb
cmp byte [esp + 0xf], al
je 0x4ac7ab
cmp byte [esp + 0x3270], al
je 0x4ac7af
test bl, bl
je 0x4ac7cb
lea edx, [esp + 0x268]
push edx
call fcn.0049f1d0
jmp 0x4ac7cb
lea eax, [esp + 0x268]
push eax
call fcn.0049ed80
lea ecx, [esp + 0x18]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4ac720
pop ebx
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
cmp byte [esp + 0x3264], 0
jne 0x4ac817
cmp byte [0x4f3598], 0
je 0x4ac817
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004a98f0
mov byte [0x4f3598], al
mov ecx, dword [esp + 0x325c]
xor ecx, esp
mov dword [0x534448], 0
call fcn.004c0c62
add esp, 0x3260
ret 8
Function at 0x4ad040
Capabilities:
Copy file

Disassembly:
mov eax, 0x2004
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp byte [0x4f3598], 0
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [esp + 0x2010]
je 0x4ad0a2
cmp byte [0x54bab4], 0
jne 0x4ad0a2
push 0x24
push 0x5f0
call fcn.004750b0
push eax
push 0x5f1
call fcn.004750b0
push eax
mov eax, dword [0x535584]
push eax
call ebp
cmp eax, 6
jne 0x4ad1e8
push ebx
push edi
push 0x800
lea ecx, [esp + 0x1014]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea edx, [esp + 0x1018]
push edx
call fcn.00460500
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
lea eax, [esp + 0x1014]
push eax
push esi
call edi
push 0x800
lea ecx, [esp + 0x14]
test eax, eax
push ecx
setne bl
call fcn.00460710
push 0x800
lea edx, [esp + 0x14]
push edx
call fcn.0045fed0
push 0x800
push str.rarreg.key
lea eax, [esp + 0x18]
push eax
call fcn.0047efb0
test bl, bl
je 0x4ad12a
lea ecx, [esp + 0x10]
push ecx
call fcn.0043c500
jmp 0x4ad155
push 0
lea edx, [esp + 0x14]
push edx
push esi
call edi
xor eax, eax
jmp 0x4ad140
movzx ecx, word [esp + eax + 0x10]
mov word [esp + eax + 0x1010], cx
add eax, 2
test cx, cx
jne 0x4ad140
mov eax, dword [0x535584]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x535584]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push ecx
call esi
push 1
lea edx, [esp + 0x1014]
push edx
call fcn.004204a0
mov byte [0x4f3598], al
mov eax, dword [0x535584]
push 0
push eax
call esi
mov ecx, 0x53fdc8
call fcn.00451170
cmp byte [0x4f3598], 0
pop edi
pop ebx
je 0x4ad1c8
push 0x30
push 0x368
call fcn.004750b0
push eax
push 0x367
call fcn.004750b0
mov ecx, dword [0x535584]
push eax
push ecx
call ebp
jmp 0x4ad1e8
lea edx, [esp + 0x1008]
push edx
call fcn.0043c500
push 0x366
call fcn.004750b0
push eax
call fcn.004ac840
add esp, 4
mov ecx, dword [esp + 0x2008]
pop esi
pop ebp
xor ecx, esp
call fcn.004c0c62
add esp, 0x2004
ret 4
Function at 0x4ad240
Capabilities:
Copy file

Disassembly:
mov eax, 0x3024
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x3020], eax
cmp byte [0x533431], 0
je 0x4ad41e
push ebx
push 0x800
lea eax, [esp + 0x2028]
push eax
mov ecx, 0x541ef0
call fcn.00415140
push 1
push str.History
push str.General
call fcn.0046c5f0
test eax, eax
setne bl
test bl, bl
je 0x4ad2b5
push 0x800
push 0x4d79fc
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push 0x4d9738
call fcn.0046c5c0
cmp word [esp + 0x24], 0
jne 0x4ad2c7
lea edx, [esp + 0x24]
push edx
call fcn.00448f00
push 0x800
lea eax, [esp + 0x1028]
push eax
lea ecx, [esp + 0x202c]
push ecx
call fcn.00460330
push eax
lea edx, [esp + 0x30]
push edx
call fcn.0045ff20
push 1
push 0
lea eax, [esp + 0x102c]
push eax
push 0x5af
call fcn.004750b0
mov ecx, dword [0x535584]
push eax
push ecx
call fcn.0041c4b0
test al, al
je 0x4ad41d
push 0x800
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x102c]
push eax
call fcn.004605d0
test bl, bl
je 0x4ad346
lea ecx, [esp + 0x24]
push ecx
push str.SaveArcFolder
push 0x4d9738
call fcn.0046c4f0
lea eax, [esp + 0x2024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ad350
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4ad36c
mov eax, 0x7ff
xor edx, edx
mov word [esp + eax*2 + 0x2024], dx
lea eax, [esp + 0x1024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ad380
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4ad39c
mov eax, 0x7ff
xor ecx, ecx
mov word [esp + eax*2 + 0x1024], cx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea ecx, [esp + 4]
lea edx, [esp + 0x2024]
lea eax, [esp + 0x1024]
push ecx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4ad41d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push 0x5b0
call fcn.004750b0
push eax
call fcn.004ac840
add esp, 0xc
mov ecx, 0x51f7e8
call fcn.00433750
pop ebx
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.004c0c62
add esp, 0x3024
ret
Function at 0x4ad640
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
mov eax, 0x1074
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x1070], eax
cmp byte [0x540de2], 0
jne 0x4ad85f
push ebx
push esi
push edi
xor edi, edi
push edi
mov ecx, 0x53fdc8
xor esi, esi
call fcn.0044cd10
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x53fdc8
call fcn.0044cd10
test al, al
je 0x4ad6c1
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [esp + 0x2c]
push ecx
call ebx
cmp eax, 0xffffffff
jne 0x4ad6ae
lea edx, [esp + 0x2c]
push edx
call fcn.0043ca60
test al, al
jne 0x4ad76f
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x53fdc8
call fcn.0044cd10
test al, al
jne 0x4ad690
push 0
mov ecx, 0x53fdc8
call fcn.0044cd10
lea edx, [esp + 0x2c]
push edx
mov ecx, 0x53fdc8
call fcn.0044cd10
test al, al
je 0x4ad748
lea eax, [esp + 0x2c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4ad6e7
sub eax, edx
sar eax, 1
lea ebx, [eax + edi + 1]
lea eax, [ebx + ebx + 2]
push eax
push esi
call fcn.004c1492
mov esi, eax
add esp, 8
test esi, esi
je 0x4ad85c
lea eax, [esp + 0x2c]
mov edx, eax
lea ecx, [edi + edi]
sub ecx, edx
lea edx, [ecx + esi]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4ad720
lea eax, [esp + 0x2c]
push eax
mov ecx, 0x53fdc8
mov edi, ebx
call fcn.0044cd10
test al, al
jne 0x4ad6e0
test edi, edi
jne 0x4ad7bd
push 0x30
push 0x65
call fcn.004750b0
push eax
push 0x14c
call fcn.004750b0
mov ecx, dword [0x535584]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4ad85c
cmp byte [esp + 0x1084], 0
je 0x4ad7b3
push 0x64
lea ecx, [esp + 0x30]
push ecx
call fcn.00453030
push eax
push 0x203
call fcn.004750b0
push eax
call fcn.004ac840
add esp, 8
push 0xce
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x51f7e8
call fcn.00433750
jmp 0x4ad85c
call fcn.004a9b70
jmp 0x4ad85c
xor eax, eax
xor edx, edx
mov word [esi + edi*2], dx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov eax, dword [0x535584]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
cmp byte [esp + 0x1084], dl
je 0x4ad80a
mov ecx, 0x40
mov word [esp + 0x1c], cx
lea edx, [esp + 0xc]
mov edi, 1
add dword [0x5344dc], edi
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
sub dword [0x5344dc], edi
push esi
call fcn.004c1404
add esp, 4
test bl, bl
je 0x4ad85c
cmp dword [esp + 0x1e], 0
jne 0x4ad85c
mov ecx, 0x53fda8
call fcn.00485430
push 0x4d79fc
mov ecx, 0x53fdc8
call fcn.0044f550
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1070]
xor ecx, esp
call fcn.004c0c62
add esp, 0x1074
ret 4
Function at 0x4afcc0
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
mov eax, 0x100c
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x5344dc], 0
push ebx
mov ebx, dword [esp + 0x1014]
jne 0x4afe04
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x4afda2
push 0x800
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
push ebx
mov word [esp + 0x24], ax
call ebp
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x533431], 0
je 0x4afd52
cmp eax, dword [0x53fdc8]
je 0x4afd7b
cmp eax, dword [0x53fdac]
je 0x4afd7b
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4afd7b
push 1
lea eax, [esp + 0x18]
push eax
mov ecx, 0x53fdc8
call fcn.00450820
cmp eax, 1
je 0x4afe02
push 7
push str.rarreg.
lea ecx, [esp + 0x1c]
push ecx
call fcn.00460330
push eax
call fcn.004869c0
test eax, eax
jne 0x4afda2
lea edx, [esp + 0x14]
push edx
call fcn.004ad040
jmp 0x4afe02
push esi
push 0
call fcn.0049ab50
mov ecx, 0x551d54
call fcn.0047f300
xor esi, esi
test edi, edi
jle 0x4afde2
lea ebx, [ebx]
push 0x800
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x551d54
call fcn.0047f330
inc esi
cmp esi, edi
jl 0x4afdc0
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
shr eax, 0xf
and al, 1
mov byte [esp + 0x14], al
mov edx, dword [esp + 0x14]
push edx
push 0
call fcn.0049d730
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x100c]
pop ebx
xor ecx, esp
call fcn.004c0c62
add esp, 0x100c
ret 4

Function at 0x4b0220
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x2000], eax
push esi
push 0x1000
push 0
lea eax, [esp + 0x100c]
push eax
push str.rarreg.key
push 0x4d79fc
call fcn.0046c610
mov esi, eax
test esi, esi
je 0x4b02b6
push edi
push 0x800
lea ecx, [esp + 0xc]
push ecx
push str.Rar_RK
call fcn.0049ea90
mov edi, eax
test edi, edi
je 0x4b02a6
push edi
push esi
lea edx, [esp + 0x1010]
push 1
push edx
call fcn.004c3690
push edi
call fcn.004c34b2
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.004ad040
lea ecx, [esp + 8]
push ecx
call fcn.0043c500
push str.rarreg.key
push 0x4d79fc
call fcn.0046c170
pop edi
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.004c0c62
add esp, 0x2004
ret
Function at 0x4b02d0
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x302c
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x3028], eax
push 0
push str.AppDataCopied
push str.General
call fcn.0046c5f0
test eax, eax
jne 0x4b0428
push 0x801
lea eax, [esp + 0x1028]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.Themes
lea ecx, [esp + 0x102c]
push ecx
call fcn.00460500
push 0x800
lea edx, [esp + 0x202c]
push edx
call fcn.00460710
push 0x801
lea eax, [esp + 0x24]
push eax
push str.Themes
lea ecx, [esp + 0x2034]
push ecx
call fcn.0045ff20
lea edx, [esp + 0x1024]
push edx
call fcn.0043ca60
test al, al
je 0x4b0417
lea eax, [esp + 0x20]
push eax
call fcn.0043ca60
test al, al
jne 0x4b0417
lea eax, [esp + 0x1024]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b0390
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x1026], cx
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b03b0
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x22], dx
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1024]
mov dword [esp + 8], eax
lea eax, [esp]
lea ecx, [esp + 0x20]
mov edx, 0x14
push eax
mov dword [esp + 8], 2
mov dword [esp + 0x10], ecx
mov word [esp + 0x14], dx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 1
push str.AppDataCopied
push str.General
call fcn.0046c510
mov ecx, dword [esp + 0x3028]
xor ecx, esp
call fcn.004c0c62
add esp, 0x302c
ret
Function at 0x4b0440
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1028
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], 0x50005
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push str.VerInfo
push str.General
call fcn.0046c610
push 0x800
lea edx, [esp + 0x2c]
push edx
call fcn.00460710
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.0045fed0
push 0x800
push str.version.dat
lea ecx, [esp + 0x30]
push ecx
call fcn.0047efb0
push 0x4d94b8
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x18], 0
call fcn.0043c890
mov esi, eax
test esi, esi
je 0x4b04eb
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004c4096
push esi
call fcn.004c34b2
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4b059a
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x4b0566
lea ecx, [esp + 0x20]
push ecx
push str.VerInfo
push str.General
call fcn.0046c570
push 0x4d83b4
lea edx, [esp + 0x2c]
push edx
call fcn.0043c890
mov esi, eax
test esi, esi
je 0x4b0546
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.004c3690
push esi
call fcn.004c34b2
add esp, 0x14
mov dword [0x5344d0], 0
pop esi
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.004c0c62
add esp, 0x1028
ret
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
push str.VerInfo
push str.General
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call fcn.0046c570
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x4b05e1
cmp dword [esp + 0x10], eax
je 0x4b05e1
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 8]
push 0x4d83b4
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call fcn.0043c890
mov esi, eax
test esi, esi
je 0x4b05e1
push esi
push 0xc
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.004c3690
push esi
call fcn.004c34b2
add esp, 0x14
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
xor eax, eax
push 1
xor esi, esi
sub ecx, edx
push eax
sbb esi, eax
push esi
push ecx
call fcn.004c13d0
mov ecx, dword [esp + 8]
xor esi, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
sbb edx, esi
push esi
add eax, ecx
push 0x989680
adc edx, esi
push edx
push eax
call fcn.004c2750
push esi
push 0xe10
push edx
push eax
call fcn.004c2750
push esi
push 0x18
push edx
push eax
call fcn.004c2750
mov dword [0x5344d0], eax
test eax, eax
jge 0x4b0644
mov dword [0x5344d0], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.004c0c62
add esp, 0x1028
ret
Function at 0x4b3c10
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2044
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x2040], eax
mov eax, dword [esp + 0x205c]
push ebx
mov ebx, dword [esp + 0x2064]
push ebp
mov ebp, dword [esp + 0x205c]
push esi
mov esi, dword [esp + 0x2058]
push edi
mov edi, dword [esp + 0x2060]
push 0x3c
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x1c], eax
call fcn.004c16b0
add esp, 0xc
cmp byte [esp + 0x2068], 0
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x500
jne 0x4b3c86
mov dword [esp + 0x18], 0x540
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebp
call fcn.00460330
cmp eax, esi
jne 0x4b3cc0
push esi
lea edx, [esp + 0x54]
push str.._s
push edx
mov edx, 0x1000
call fcn.00495190
lea eax, [esp + 0x5c]
add esp, 0xc
mov dword [esp + 0x24], eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [esp + 0x14]
mov ebx, 1
push ecx
mov dword [esp + 0x34], ebx
mov byte [0x533433], bl
call esi
test eax, eax
jne 0x4b3cf1
cmp dword [esp + 0x20], eax
je 0x4b3cf1
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], eax
call esi
mov byte [0x533433], 0
test eax, eax
je 0x4b3da2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
je 0x4b3da2
cmp byte [esp + 0x2068], 0
jne 0x4b3d9e
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x4b3d52
mov eax, dword [0x57a8e8]
mov edx, dword [esp + 0x34]
mov dword [eax*4 + 0x57a8a8], ecx
mov dword [eax*4 + 0x57a868], edx
inc eax
and eax, 0x8000000f
jns 0x4b3d4b
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x57a8e8], eax
jmp 0x4b3d94
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
lea ebx, [ebx]
mov eax, dword [esi + 0x57a868]
cmp eax, dword [esp + 0x34]
jne 0x4b3d88
mov ecx, dword [esi + 0x57a8a8]
push 0
push ecx
call edi
cmp eax, 0x102
jne 0x4b3d88
mov edx, dword [esi + 0x57a8a8]
mov dword [esp + 0x4c], edx
add esi, 4
cmp esi, 0x40
jl 0x4b3d60
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4b3d9e
mov dword [eax], ecx
mov al, bl
jmp 0x4b3da4
xor al, al
mov ecx, dword [esp + 0x2050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004c0c62
add esp, 0x2044
ret 0x1c
Function at 0x4b3dc0
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4d5c9b
mov eax, dword fs:[0]
push eax
mov eax, 0x6060
call fcn.004c0c80
mov eax, dword [0x4eb984]
xor eax, esp
mov dword [esp + 0x605c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4eb984]
xor eax, esp
push eax
lea eax, [esp + 0x6074]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6088]
mov ebp, dword [esp + 0x6084]
push eax
mov edi, ecx
call fcn.00460330
mov ecx, edi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4b3e20
sub ecx, esi
mov edx, eax
sar ecx, 1
lea ebx, [edx + 2]
mov si, word [edx]
add edx, 2
test si, si
jne 0x4b3e34
sub edx, ebx
sar edx, 1
lea ecx, [edx + ecx + 1]
cmp ecx, 0x1000
jae 0x4b3f7c
push 0x1000
lea edx, [esp + 0x4074]
push edx
push eax
push edi
call fcn.0045ff20
lea ecx, [esp + 0x14]
call fcn.0047f4c0
mov dword [esp + 0x607c], 0
push 0x1000
push 0x4d79fc
lea eax, [esp + 0x1078]
push eax
push str.ViewerIgnoreModifications
push str.Viewer
call fcn.0046c5c0
cmp word [esp + 0x1070], si
je 0x4b3ebc
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x107c]
push edx
call fcn.0047f8d0
push 0x800
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
call fcn.0047f5e0
test al, al
je 0x4b3f68
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ecx]
push 0x800
lea ecx, [esp + 0x3074]
push ecx
lea edx, [esp + 0x78]
push edx
call edi
lea eax, [esp + 0x3072]
push 0x4df894
push eax
call fcn.004c46d6
mov esi, eax
add esp, 8
test esi, esi
je 0x4b3fa8
xor ecx, ecx
mov word [esi], cx
add esi, 4
cmp word [esi], cx
jne 0x4b3f25
mov esi, 0x4d7800
push 4
push ebp
lea edx, [esp + 0x3078]
push edx
call fcn.00452910
test al, al
je 0x4b3f4d
push 4
lea eax, [esp + 0x4074]
push eax
push esi
call fcn.00452910
test al, al
jne 0x4b3fb1
push 0x800
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esp + 0x1c]
call fcn.0047f5e0
test al, al
jne 0x4b3ee0
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0040bde0
xor al, al
mov ecx, dword [esp + 0x6074]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x605c]
xor ecx, esp
call fcn.004c0c62
add esp, 0x606c
ret 8
lea esi, [esp + 0x3070]
jmp 0x4b3f39
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0040bde0
mov al, 1
jmp 0x4b3f7e