joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a8a0
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x4e4308], 0
jne 0x47a8ee
push edi
mov edi, dword [0x4f6348]
test edi, edi
je 0x47a8ed
push esi
push 0x4e4308
push str.Rar_CMXXXXXX
call fcn.0047f030
mov esi, eax
test esi, esi
je 0x47a8ec
mov eax, edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47a8d0
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049fd82
push esi
call fcn.0049fba6
add esp, 0x14
pop esi
pop edi
ret

Function at 0x47b520
Capabilities:
Write file on windows

Disassembly:
push 1
call fcn.0047b480
jmp fcn.0047a8a0

Function at 0x47b530
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x254
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x250], eax
push ebx
mov ebx, dword [esp + 0x25c]
push esi
push edi
mov edi, dword [esp + 0x268]
xor esi, esi
push esi
lea eax, [esp + 0x10]
push str.Profiles_d
push eax
mov byte [edi], 0
call fcn.0049e635
add esp, 0xc
push 0x200
push 0x4b1914
lea ecx, [esp + 0x64]
push ecx
push str.Name
lea edx, [esp + 0x1c]
push edx
call fcn.004568e0
cmp byte [esp + 0x5c], 0
je 0x47b64f
lea eax, [esp + 0x5c]
push eax
push ebx
call fcn.00465330
test eax, eax
je 0x47b5e0
inc esi
push esi
lea ecx, [esp + 0x10]
push str.Profiles_d
push ecx
call fcn.0049e635
add esp, 0xc
push 0x200
push 0x4b1914
lea edx, [esp + 0x64]
push edx
push str.Name
lea eax, [esp + 0x1c]
push eax
call fcn.004568e0
cmp byte [esp + 0x5c], 0
jne 0x47b596
jmp 0x47b64f
push 0
push 1
push esi
call fcn.00479d50
push 0
push str.ImmExec
lea ecx, [esp + 0x14]
push ecx
call fcn.00456940
test eax, eax
setne al
mov byte [edi], al
test al, al
je 0x47b64f
cmp byte [0x4e4308], 0
jne 0x47b64f
mov edi, dword [0x4f6348]
test edi, edi
je 0x47b64f
push 0x4e4308
push str.Rar_CMXXXXXX
call fcn.0047f030
mov esi, eax
test esi, esi
je 0x47b64f
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47b633
push esi
sub eax, edx
push eax
push 1
push edi
call fcn.0049fd82
push esi
call fcn.0049fba6
add esp, 0x14
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0x254
ret 8
Function at 0x47ded0
Capabilities:
Get graphical window text

Disassembly:
call fcn.0043cdb0
test eax, eax
je 0x47dedf
jmp dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [edi + 1]
push eax
call fcn.0049f174
mov ecx, dword [esp + 0x10]
add esp, 4
push edi
mov esi, eax
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [esp + 0x10]
push 0x1000000
push edx
push esi
call fcn.0046d830
push esi
call fcn.0049efc5
add esp, 4
pop edi
pop esi
ret 0xc

Function at 0x47e170
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
push ebx
call edi
push ebx
mov esi, eax
call edi
mov ebp, dword [esp + 0x38]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov dword [esp + 0x40], eax
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x24]
push 0xcc0020
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov edx, eax
neg edx
push edx
push 0
lea edx, [eax - 1]
push edx
push esi
push ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0xcc0020
push 0
push 0
push edi
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov edx, dword [esp + 0x18]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x47e340
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push edi
mov edi, dword [esp + 0x414]
push edi
push 0x4b1914
push esi
push str.TempFolder
push str.Paths
call fcn.004568e0
cmp byte [esi], 0
mov byte [esp + 8], 0
je 0x47e3b6
push 0x400
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x47e3a5
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.00465370
cmp byte [esi], 0
je 0x47e3b6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x47e3e0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x47e3c7
cmp byte [esi], 0
jne 0x47e3e0
mov edx, dword [str._rartemp]
mov dword [esi], edx
mov eax, dword [0x4b4ad4]
mov dword [esi + 4], eax
mov cl, byte [0x4b4ad8]
mov byte [esi + 8], cl
push esi
call fcn.0044df70
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.0049e626
add esp, 0x404
ret 8

Function at 0x47e470
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
test esi, esi
je 0x47e49f
xor eax, eax
mov word [esi], ax
call fcn.0043cdb0
test eax, eax
je 0x47e49f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x47e49f
pop edi
xor al, al
pop esi
ret 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47e4ba
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret 0xc
pop edi
mov al, 1
pop esi
ret 0xc

Function at 0x47e590
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x47e5e9
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x47e5cf
jne 0x47e5e9
cmp dword [esp + 8], 0
jbe 0x47e5e9
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0049e626
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.0049e626
add esp, 0x98
ret
Function at 0x47f110
Capabilities:
Create directory

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x410]
push 0x400
lea eax, [esp + 0xc]
push eax
call fcn.0047e340
lea ecx, [esp + 8]
push ecx
call fcn.0044df70
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47f151
push edi
lea edi, [esp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47f160
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0xc]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0042fef0
pop edi
test eax, eax
je 0x47f1ae
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x47f1ae
lea eax, [esp + 8]
mov edx, ebx
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x47f1a0
mov al, 1
jmp 0x47f1d2
lea edx, [esp + 8]
push edx
push 0x1f7
call fcn.0045be10
push eax
call fcn.0048cd40
add esp, 8
mov ecx, 0x4c93ac
call fcn.00428050
xor al, al
mov ecx, dword [esp + 0x408]
pop esi
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0x404
ret 8
Function at 0x47fdd0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
push edi
call fcn.0047e590
mov ecx, dword [ebp + 4]
movzx ebx, al
neg ebx
push 0x200
sbb ebx, ebx
lea eax, [esp + 0x14]
push eax
and ebx, 0x40
push ecx
add ebx, 0x40
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, ebx
shr edx, 1
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00445570
cmp byte [0x4f6828], 0
je 0x47fe9d
call fcn.0043cdb0
test eax, eax
mov eax, 0x4b28cc
jne 0x47fe40
mov eax, 0x4b2b0c
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47fe42
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47fe50
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47fe70
push 0x4f6828
sub eax, edx
push 0x5aa
mov esi, eax
call fcn.0045be10
push eax
lea ecx, [esp + esi + 0x18]
push str._s:__s
push ecx
call fcn.0049e635
add esp, 0x10
cmp byte [0x4f67fd], 0
je 0x47ff1b
call fcn.0043cdb0
test eax, eax
mov eax, 0x4b28cc
jne 0x47feb9
mov eax, 0x4b2b0c
mov edx, eax
jmp 0x47fec0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47fec0
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47fed0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47fef0
sub eax, edx
mov edx, dword [esp + 0x21c]
push edx
push 0x2fd
mov esi, eax
call fcn.0045be10
push eax
lea eax, [esp + esi + 0x18]
push eax
call fcn.0049e635
add esp, 0xc
push ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [ebp + 0x18]
push edx
call fcn.00465370
call fcn.0047e590
mov ecx, dword [esp + 0x210]
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x190
pop edi
add eax, 0x58
pop esi
mov dword [ebp], eax
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0x204
ret 8
Function at 0x47ff60
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [0x4db884]
test eax, eax
je 0x48004c
push esi
push 0x200
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [0x4f7790]
cmp esi, 8
je 0x47ffe8
mov ecx, 0x4f6b10
lea eax, [esp + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47ffc7
test dl, dl
je 0x47ffc3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47ffc7
add eax, 2
add ecx, 2
test dl, dl
jne 0x47ffa7
xor eax, eax
jmp 0x47ffcc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47ffe8
mov edx, dword [0x4db884]
push 0x4f6b10
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov esi, dword [0x4f7790]
test esi, esi
je 0x47fffb
cmp esi, 1
je 0x47fffb
cmp esi, 2
je 0x47fffb
cmp esi, 8
jne 0x480032
push ebx
push edi
push 0x9c
xor ebx, ebx
mov edi, 0x4f6a90
call fcn.0047fb40
push 0x4f6b90
call fcn.0044db70
push 0x4f7390
mov ebx, eax
call fcn.0044daf0
push 0x9b
mov edi, eax
call fcn.0047fb40
pop edi
pop ebx
push 0x64
push 2
call fcn.00445820
pop esi
test al, al
je 0x48004c
mov eax, dword [0x4db884]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.0049e626
add esp, 0x204
ret
Function at 0x482cd0
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x400], eax
cmp byte [esp + 0x41c], 0
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x418]
push edi
mov edi, dword [esp + 0x420]
je 0x482d6c
push 0x400
push esi
push ebp
push str.DefFolder
push str.Extraction
call fcn.004568e0
cmp byte [ebp], 0
jne 0x482d3c
mov edx, ebp
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x482d30
jmp 0x482d70
push 0x400
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x10]
mov edx, ebp
mov ecx, eax
mov byte [esp + 0x40f], 0
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x482d60
jmp 0x482d70
mov byte [ebp], 0
mov al, byte [ebp]
test al, al
setne bl
test al, al
jne 0x482d88
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebp
call fcn.0044df70
cmp byte [esp + 0x424], 0
jne 0x482da0
test bl, bl
je 0x482e9d
push 1
push str.AppendName
push str.Extraction
call fcn.00456940
test eax, eax
je 0x482e9d
push 0x400
push edi
lea edx, [esp + 0x18]
push edx
call fcn.00465370
cmp byte [esp + 0x10], 0
je 0x482df4
lea esi, [esp + 0x10]
cmp byte [esi], 0x25
jne 0x482dee
lea eax, [esi + 1]
push 0x25
push eax
call fcn.0049e290
add esp, 8
test eax, eax
je 0x482dee
mov byte [esi], 0x5f
inc esi
cmp byte [esi], 0
jne 0x482dd4
lea ecx, [esp + 0x10]
push ecx
call fcn.0044daf0
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x482e00
mov edi, ebp
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x482e10
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.0044de80
mov esi, eax
test esi, esi
je 0x482e9d
cmp esi, ebp
jbe 0x482e9d
push ebp
mov byte [esi], 0
call fcn.0044de80
mov edi, eax
test edi, edi
je 0x482e89
cmp edi, ebp
jbe 0x482e89
cmp byte [esp + 0x428], 0
je 0x482e77
cmp byte [esi + 1], 0
je 0x482e77
movsx edx, byte [esi + 2]
push edx
call fcn.00465180
test al, al
jne 0x482e77
movsx eax, byte [esi - 1]
push eax
call fcn.00465180
test al, al
jne 0x482e86
push str..tar
push edi
call fcn.00465330
test eax, eax
jne 0x482e89
mov byte [edi], 0
dec esi
cmp esi, ebp
jbe 0x482e9d
mov edi, edi
cmp byte [esi], 0x2e
jne 0x482e9d
mov byte [esi], 0
dec esi
cmp esi, ebp
ja 0x482e90
push 0
push ebp
call fcn.0044e680
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0x404
ret 0x18
Function at 0x482ec0
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x4afdeb
mov eax, dword fs:[0]
push eax
mov eax, 0x2cb4
call fcn.0049ebb0
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x2cb0], eax
push ebx
push ebp
mov eax, dword [0x4c03a0]
xor eax, esp
push eax
lea eax, [esp + 0x2cc0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2cd0]
mov ebp, dword [esp + 0x2cd4]
lea ecx, [esp + 0x1cbc]
push ecx
push str.Rar_DIXXXXXX
mov dword [esp + 0x14], eax
call fcn.0047f110
test al, al
je 0x4830d2
push 0x400
lea edx, [esp + 0x24c0]
push edx
lea eax, [esp + 0x20c4]
push eax
call fcn.0047e470
push 0
lea ecx, [esp + 0x1cc0]
push ecx
call fcn.0047e420
call fcn.0047b3d0
call fcn.00477200
push 0x4e79f4
push 0x4e75f4
mov ecx, 0x4e0c60
call fcn.00413520
mov edx, dword [0x4e0e68]
mov ecx, dword [0x4e81f4]
push edi
push esi
mov dword [0x4e6194], edx
mov dword [0x4e5d80], 4
mov dword [0x4e57c0], 2
call fcn.00465650
push 0
push 0
mov ecx, 0x4e0c60
call fcn.004160e0
lea ecx, [esp + 0x10b4]
xor bl, bl
call fcn.00433040
mov dword [esp + 0x2cc8], 0
push 0x4b175c
lea ecx, [esp + 0x10b8]
call fcn.00433080
lea ecx, [esp + 0xc28]
call fcn.004680f0
lea ecx, [esp + 0xc4c]
call fcn.004680f0
lea ecx, [esp + 0xc70]
call fcn.004680f0
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10bc]
call fcn.004334e0
test al, al
je 0x483081
cmp byte [esp + 0xc24], 0
je 0x483033
push 0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10bc]
call fcn.004334e0
test al, al
jne 0x483010
jmp 0x483081
call fcn.0043cdb0
test eax, eax
je 0x483066
cmp word [esp + 0x414], 0
je 0x483066
test ebp, ebp
je 0x483070
lea edx, [esp + 0x10]
push edx
push ebp
push 0x400
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x483070
test ebp, ebp
je 0x483070
xor ecx, ecx
mov word [ebp], cx
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0042fda0
mov bl, 1
lea ecx, [esp + 0x24bc]
push ecx
lea edx, [esp + 0x20c0]
push edx
call fcn.0047e420
test bl, bl
jne 0x4830a8
lea eax, [esp + 0x1cbc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, 0x4dc218
mov byte [0x4dc244], 0
call fcn.00464fc0
mov dword [esp + 0x2cc8], 0xffffffff
lea ecx, [esp + 0x10b4]
call fcn.00433060
mov al, bl
mov ecx, dword [esp + 0x2cc0]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x2cb0]
xor ecx, esp
call fcn.0049e626
add esp, 0x2cc0
ret 8
Function at 0x484b50
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x868
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x864], eax
push ebx
push esi
mov esi, dword [esp + 0x874]
push edi
push esi
push 0x6c
call fcn.0045be10
push eax
lea eax, [esp + 0x414]
push eax
call fcn.0049e635
add esp, 0xc
push 0
push esi
call fcn.0047f4d0
test al, al
jne 0x484c29
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
je 0x484bf9
lea ecx, [esp + 0xc]
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x484be0
test dl, dl
je 0x484bdc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x484be0
add eax, 2
add ecx, 2
test dl, dl
jne 0x484bc0
xor eax, eax
jmp 0x484be5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x484bf9
push 0
lea edx, [esp + 0x10]
push edx
call fcn.0047f4d0
test al, al
jne 0x484c29
push 0x15
push 0x66
call fcn.0045be10
mov ecx, dword [0x4dc210]
push eax
lea eax, [esp + 0x414]
push eax
push ecx
call edi
cmp eax, 2
je 0x484c45
push 0
push esi
call fcn.0047f4d0
test al, al
je 0x484ba3
mov ecx, 0x4dff38
call fcn.00440db0
test al, al
je 0x484c45
push 0
push 0
mov ecx, 0x4dff38
call fcn.004413b0
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e626
add esp, 0x868
ret 4
Function at 0x484c60
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x178
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0x174], eax
push esi
mov esi, dword [esp + 0x180]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x174]
push str._c:_
push ecx
call fcn.0049e635
add esp, 0xc
push 0x301
push 0x160
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x180]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test byte [esi + 0x10], 1
je 0x484cea
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4b1914
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x484d50
sub eax, ecx
mov ecx, dword [edi]
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x484d9d
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x17c]
pop edi
pop esi
xor ecx, esp
call fcn.0049e626
add esp, 0x178
ret 4
Function at 0x48a600
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
sub esp, 0xd54
mov eax, dword [0x4c03a0]
xor eax, esp
mov dword [esp + 0xd50], eax
cmp byte [esp + 0xd5c], 0
mov dword [0x4dbca0], 1
je 0x48a79d
push esi
push 0x400
lea eax, [esp + 0x558]
push eax
call fcn.0047e340
lea ecx, [esp + 0x554]
push ecx
call fcn.0044df70
lea edx, [esp + 0x554]
push edx
lea eax, [esp + 0x958]
push str._sRar_
push eax
call fcn.0049e635
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x958]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [esp + 8], esi
cmp esi, 0xffffffff
je 0x48a795
push ebx
push edi
jmp 0x48a6a0
cmp dword [0x4dbca0], 1
jne 0x48a793
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x24]
cmp ecx, 8
setae byte [esp + 0xf]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x55c]
mov byte [esp + eax + 0x15c], cl
inc eax
test cl, cl
jne 0x48a6c0
lea eax, [esp + 0x48]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48a6e0
lea edi, [esp + 0x15c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48a6f1
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x1c], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x48a76c
push 6
lea edx, [esp + 0x4c]
push str.Rar_DI
push edx
call fcn.0049f7bf
add esp, 0xc
test eax, eax
jne 0x48a736
call fcn.0043cdb0
cmp eax, 4
je 0x48a736
mov bl, 1
jmp 0x48a738
xor bl, bl
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x48a77b
cmp byte [esp + 0xf], al
je 0x48a759
cmp byte [esp + 0xd64], al
je 0x48a75d
test bl, bl
je 0x48a77b
lea ecx, [esp + 0x15c]
push ecx
call fcn.0047f270
jmp 0x48a77b
push 0
lea edx, [esp + 0x160]
push edx
call fcn.0047f480
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x48a6a0
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp byte [esp + 0xd58], 0
jne 0x48a7cb
cmp byte [0x4c8d98], 0
je 0x48a7cb
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.00487180
mov byte [0x4c8d98], al
mov ecx, dword [esp + 0xd50]
xor ecx, esp
mov dword [0x4dbca0], 0
call fcn.0049e626
add esp, 0xd54
ret 8