joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b7eb0
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x35d8
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x35d4], eax
cmp dword [0x514904], 0xffffffff
mov eax, dword [esp + 0x35e8]
push ebp
mov ebp, dword [esp + 0x35e0]
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push edi
mov edi, dword [esp + 0x35ec]
mov dword [esp + 0xc], eax
jne 0x4b7f54
push 0x4001
push 0x2b4
lea ecx, [esp + 0x80]
push ecx
push 0
push 0x4fe4d8
call esi
mov edx, dword [esp + 0x7c]
push 0x800
lea eax, [esp + 0x25e4]
push eax
push 0
mov dword [0x570cbc], edx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4001
push 0x2b4
lea ecx, [esp + 0x80]
push ecx
push 0
lea edx, [esp + 0x25f0]
push edx
call esi
mov eax, dword [esp + 0x7c]
mov dword [0x514904], eax
push ebx
push 0x800
push edi
lea ecx, [esp + 0x5ec]
push ecx
call fcn.00467570
push 0x800
lea edx, [esp + 0x5e8]
push edx
mov eax, edx
push eax
call fcn.00451860
cmp word [ebp], 0
lea ecx, [esp + 0x5e4]
setne bl
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], 0x40000000
mov dword [esp + 0x1c], 0
mov dword [esp + 0x28], ecx
lea edx, [esp + 0x330]
test bl, bl
je 0x4b7fd1
movzx eax, byte [esp + 0x35f4]
push 0x4011
neg eax
push 0x2b4
sbb eax, eax
push edx
and eax, 0x10
push eax
push ecx
jmp 0x4b7fe6
push 0x4001
push 0x2b4
push edx
push 0
lea eax, [esp + 0x5f4]
push eax
call esi
mov ecx, dword [esp + 0x334]
mov dword [esp + 0x30], ecx
push 0x800
test bl, bl
je 0x4b800c
push ebp
lea edx, [esp + 0x15ec]
push edx
call fcn.00467570
jmp 0x4b803f
lea eax, [esp + 0x5e8]
push eax
lea ecx, [esp + 0x15ec]
push ecx
call fcn.00467570
lea edx, [esp + 0x15e4]
push edx
call fcn.00451d00
lea eax, [esp + 0x5e4]
push eax
call fcn.00451a10
mov dword [esp + 0x28], eax
mov ecx, dword [0x538304]
push 0x66
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
lea edx, [esp + 0x14]
push edx
push 0
mov esi, eax
push 0x104d
push esi
call ebp
mov edi, eax
lea eax, [esp + 0x15e4]
test bl, bl
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
pop ebx
je 0x4b8097
mov ecx, dword [0x514904]
mov dword [esp + 0x2c], ecx
jmp 0x4b80a1
mov edx, dword [0x570cbc]
mov dword [esp + 0x2c], edx
lea eax, [esp + 0x10]
push eax
push 0
push 0x104c
push esi
call ebp
mov ecx, dword [esp + 0xc]
push ecx
mov dword [esp + 0x50], 2
call fcn.004676d0
lea edx, [esp + 0x44]
push edx
push edi
push 0x1074
push esi
mov dword [esp + 0x68], eax
call ebp
test edi, edi
jne 0x4b80f3
mov eax, 1
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], eax
lea eax, [esp + 0x44]
push eax
push edi
push 0x102b
push esi
call ebp
mov ecx, dword [esp + 0x35e0]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.004e34f4
add esp, 0x35d8
ret 0x10
Function at 0x4b95b0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x2d0], eax
push esi
mov esi, dword [esp + 0x2dc]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x2c8]
push str._c:_
push ecx
mov edx, 0xa
call fcn.00458640
add esp, 0xc
push 0x301
push 0x2b4
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [esi + 0x10], 1
je 0x4b963f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4fdab8
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0x104
lea edx, [esp + 0x28]
push edx
call fcn.004b23c0
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b96b1
mov ecx, dword [esi + 0x20]
sub eax, edx
mov edx, dword [edi]
sar eax, 1
push eax
lea eax, [esp + 0x28]
push eax
add ecx, 2
push ecx
mov ecx, dword [esi + 0x18]
lea eax, [edx + ebp + 7]
push eax
push ecx
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x4b9704
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 0x18]
push edx
push eax
call dword [sym.imp.GDI32.dll_SetBkColor]
mov ecx, dword [esp + 8]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
xor ecx, esp
call fcn.004e34f4
add esp, 0x2d4
ret 4
Function at 0x4bc760
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x3260
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x325c], eax
cmp byte [esp + 0x3268], 0
mov dword [0x539320], 1
je 0x4bc8d9
push ebp
push 0
push 0x800
lea eax, [esp + 0x1268]
push eax
call fcn.004b0c20
push 0x800
lea ecx, [esp + 0x1264]
push ecx
call fcn.00451500
lea edx, [esp + 0x1260]
push edx
lea eax, [esp + 0x2264]
push str._sRar_
push eax
mov edx, 0x800
call fcn.00458640
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x2264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4bc8d1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
lea ebx, [ebx]
cmp dword [0x539320], 1
jne 0x4bc8cf
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x20]
push 0x800
lea edx, [esp + 0x126c]
push edx
lea eax, [esp + 0x270]
cmp ecx, 8
push eax
setae byte [esp + 0x1b]
call fcn.00467570
push 0x800
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x270]
push edx
call fcn.004675f0
test byte [esp + 0x18], 0x10
je 0x4bc8ae
push 6
lea eax, [esp + 0x48]
push str.Rar_DI
push eax
call fcn.004e76f5
add esp, 0xc
lea ecx, [esp + 0x268]
test eax, eax
push ecx
sete bl
call esi
test eax, eax
jne 0x4bc8bb
cmp byte [esp + 0xf], al
je 0x4bc89b
cmp byte [esp + 0x3270], al
je 0x4bc89f
test bl, bl
je 0x4bc8bb
lea edx, [esp + 0x268]
push edx
call fcn.004b1b20
jmp 0x4bc8bb
lea eax, [esp + 0x268]
push eax
call fcn.004b17b0
lea ecx, [esp + 0x18]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4bc810
pop ebx
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
cmp byte [esp + 0x3264], 0
jne 0x4bc907
cmp byte [0x523300], 0
je 0x4bc907
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004b9290
mov byte [0x523300], al
mov ecx, dword [esp + 0x325c]
xor ecx, esp
mov dword [0x539320], 0
call fcn.004e34f4
add esp, 0x3260
ret 8
Function at 0x4c0070
Capabilities:
Copy file

Disassembly:
mov eax, 0x2004
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp byte [0x523300], 0
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [esp + 0x2010]
je 0x4c00d2
cmp byte [0x550914], 0
jne 0x4c00d2
push 0x24
push 0x5f0
call fcn.00461b20
push eax
push 0x5f1
call fcn.00461b20
push eax
mov eax, dword [0x53a464]
push eax
call ebp
cmp eax, 6
jne 0x4c0218
push ebx
push edi
push 0x800
lea ecx, [esp + 0x1014]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea edx, [esp + 0x1018]
push edx
call fcn.00451be0
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
lea eax, [esp + 0x1014]
push eax
push esi
call edi
push 1
push 0x800
lea ecx, [esp + 0x18]
test eax, eax
push ecx
setne bl
call fcn.00451d40
push 0x800
lea edx, [esp + 0x14]
push edx
call fcn.00451500
push 0x800
push str.rarreg.key
lea eax, [esp + 0x18]
push eax
call fcn.004675f0
test bl, bl
je 0x4c015c
lea ecx, [esp + 0x10]
push ecx
call fcn.00443910
jmp 0x4c0185
push 0
lea edx, [esp + 0x14]
push edx
push esi
call edi
xor eax, eax
jmp 0x4c0170
movzx ecx, word [esp + eax + 0x10]
mov word [esp + eax + 0x1010], cx
add eax, 2
test cx, cx
jne 0x4c0170
mov eax, dword [0x53a464]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x53a464]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push ecx
call esi
push 1
lea edx, [esp + 0x1014]
push edx
call fcn.00436970
mov byte [0x523300], al
mov eax, dword [0x53a464]
push 0
push eax
call esi
mov ecx, 0x544c98
call fcn.00493570
cmp byte [0x523300], 0
pop edi
pop ebx
je 0x4c01f8
push 0x30
push 0x368
call fcn.00461b20
push eax
push 0x367
call fcn.00461b20
mov ecx, dword [0x53a464]
push eax
push ecx
call ebp
jmp 0x4c0218
lea edx, [esp + 0x1008]
push edx
call fcn.00443910
push 0x366
call fcn.00461b20
push eax
call fcn.004bf990
add esp, 4
mov ecx, dword [esp + 0x2008]
pop esi
pop ebp
xor ecx, esp
call fcn.004e34f4
add esp, 0x2004
ret 4
Function at 0x4c0240
Capabilities:
Copy file

Disassembly:
mov eax, 0x3024
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x3020], eax
cmp byte [0x538309], 0
je 0x4c0425
push ebx
push 0x800
lea eax, [esp + 0x2028]
push eax
mov ecx, 0x546dc0
call fcn.004790c0
push 1
push str.History
push str.General
call fcn.00499a90
test eax, eax
setne bl
test bl, bl
je 0x4c02b5
push 0x800
push 0x4fdab8
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.00499a60
cmp word [esp + 0x24], 0
jne 0x4c02c7
lea edx, [esp + 0x24]
push edx
call fcn.0048ae40
push 0x800
lea eax, [esp + 0x1028]
push eax
lea ecx, [esp + 0x202c]
push ecx
call fcn.00451a10
push eax
lea edx, [esp + 0x30]
push edx
call fcn.00451550
push 1
push 0
lea eax, [esp + 0x102c]
push eax
push 0x5af
call fcn.00461b20
mov ecx, dword [0x53a464]
push eax
push ecx
call fcn.0047bbc0
test al, al
je 0x4c0424
push 0x800
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x102c]
push eax
call fcn.00451cb0
test bl, bl
je 0x4c0346
lea ecx, [esp + 0x24]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.004999f0
lea eax, [esp + 0x2024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c0350
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4c036c
mov eax, 0x7ff
xor edx, edx
mov word [esp + eax*2 + 0x2024], dx
lea eax, [esp + 0x1024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c0380
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4c039c
mov eax, 0x7ff
xor ecx, ecx
mov word [esp + eax*2 + 0x1024], cx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea ecx, [esp + 4]
lea edx, [esp + 0x2024]
lea eax, [esp + 0x1024]
push ecx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4c0424
cmp dword [esp + 0x16], 0
jne 0x4c0424
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push 0x5b0
call fcn.00461b20
push eax
call fcn.004bf990
add esp, 0xc
mov ecx, 0x52c138
call fcn.0043dd70
pop ebx
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.004e34f4
add esp, 0x3024
ret
Function at 0x4c0640
Capabilities:
Move file

Disassembly:
mov eax, 0x1110
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x110c], eax
cmp byte [0x545cb2], 0
jne 0x4c0881
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
mov ecx, 0x544c98
xor ebp, ebp
mov dword [esp + 0x10c8], esi
mov dword [esp + 0x10cc], esi
call fcn.0048ec20
lea eax, [esp + 0x34]
push eax
mov ecx, 0x544c98
call fcn.0048ec20
test al, al
je 0x4c06c6
lea esp, [esp]
lea edi, [esp + 0x13]
lea ebx, [esp + 0x34]
call fcn.004b7da0
test al, al
jne 0x4c0783
mov ecx, ebx
push ecx
mov ecx, 0x544c98
call fcn.0048ec20
test al, al
jne 0x4c06a0
push 0
mov ecx, 0x544c98
call fcn.0048ec20
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x544c98
call fcn.0048ec20
test al, al
je 0x4c075c
lea eax, [esp + 0x34]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4c06f0
sub eax, edx
sar eax, 1
lea edi, [eax + ebp + 1]
lea edx, [edi + edi + 2]
push edx
push esi
call fcn.004e353b
mov esi, eax
add esp, 8
test esi, esi
je 0x4c087d
lea eax, [esp + 0x34]
mov edx, eax
lea ecx, [ebp + ebp]
sub ecx, edx
lea edx, [ecx + esi]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4c0730
lea eax, [esp + 0x34]
push eax
mov ecx, 0x544c98
mov ebp, edi
call fcn.0048ec20
test al, al
jne 0x4c06e5
test ebp, ebp
jne 0x4c07de
push 0x30
push 0x65
call fcn.00461b20
push eax
push 0x14c
call fcn.00461b20
mov ecx, dword [0x53a464]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4c087d
cmp byte [esp + 0x1124], 0
je 0x4c07d4
push 0x64
lea edx, [esp + 0x38]
push edx
call fcn.00494f10
push eax
push 0x203
call fcn.00461b20
push eax
call fcn.004bf990
movzx eax, byte [esp + 0x1b]
add esp, 8
neg eax
sbb eax, eax
and eax, 0xffffff87
add eax, 0xce
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x52c138
call fcn.0043dd70
jmp 0x4c087d
call fcn.004bf570
jmp 0x4c087d
xor eax, eax
xor edx, edx
mov word [esi + ebp*2], dx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov eax, dword [0x53a464]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 3
cmp byte [esp + 0x1124], dl
je 0x4c082b
mov ecx, 0x40
mov word [esp + 0x24], cx
lea edx, [esp + 0x14]
mov edi, 1
add dword [0x5393bc], edi
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
sub dword [0x5393bc], edi
push esi
call fcn.004e3342
add esp, 4
test bl, bl
je 0x4c087d
cmp dword [esp + 0x26], 0
jne 0x4c087d
mov ecx, 0x544c78
call fcn.004a5c00
push 0x4fdab8
mov ecx, 0x544c98
call fcn.00492300
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110c]
xor ecx, esp
call fcn.004e34f4
add esp, 0x1110
ret 4
Function at 0x4c2d80
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
mov eax, 0x100c
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x5393bc], 0
push ebx
mov ebx, dword [esp + 0x1014]
jne 0x4c2ec8
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x4c2e6c
push 0x800
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
push ebx
mov word [esp + 0x24], ax
call ebp
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x538309], 0
je 0x4c2e1c
cmp byte [esp + 0x1020], 0
jne 0x4c2e45
cmp eax, dword [0x544c98]
je 0x4c2e45
cmp eax, dword [0x544c7c]
je 0x4c2e45
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4c2e45
push 1
lea eax, [esp + 0x18]
push eax
mov ecx, 0x544c98
call fcn.00492c10
cmp eax, 1
je 0x4c2ec6
push 7
push str.rarreg.
lea ecx, [esp + 0x1c]
push ecx
call fcn.00451a10
push eax
call fcn.0046a970
test eax, eax
jne 0x4c2e6c
lea edx, [esp + 0x14]
push edx
call fcn.004c0070
jmp 0x4c2ec6
push esi
push 0
call fcn.004ad5d0
mov ecx, 0x556ba4
call fcn.00467910
xor esi, esi
test edi, edi
jle 0x4c2ea6
push 0x800
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x556ba4
call fcn.00467940
inc esi
cmp esi, edi
jl 0x4c2e84
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
shr eax, 0xf
and al, 1
mov byte [esp + 0x14], al
mov edx, dword [esp + 0x14]
push edx
push 0
call fcn.004b0150
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x100c]
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x100c
ret 8

Function at 0x4c32e0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x2000], eax
push esi
push 0x1000
push 0
lea eax, [esp + 0x100c]
push eax
push str.rarreg.key
push 0x4fdab8
call fcn.00499ab0
mov esi, eax
test esi, esi
je 0x4c3376
push edi
push 0x800
lea ecx, [esp + 0xc]
push ecx
push str.Rar_RK
call fcn.004b14c0
mov edi, eax
test edi, edi
je 0x4c3366
push edi
push esi
lea edx, [esp + 0x1010]
push 1
push edx
call fcn.004e8056
push edi
call fcn.004e4b91
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.004c0070
lea ecx, [esp + 8]
push ecx
call fcn.00443910
push str.rarreg.key
push 0x4fdab8
call fcn.00499630
pop edi
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.004e34f4
add esp, 0x2004
ret
Function at 0x4c3390
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1028
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], 0x51500
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push str.VerInfo
push str.General
call fcn.00499ab0
push 1
push 0x800
lea edx, [esp + 0x30]
push edx
call fcn.00451d40
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.00451500
push 0x800
push str.version.dat
lea ecx, [esp + 0x30]
push ecx
call fcn.004675f0
push 0x4fdd08
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x18], 0
call fcn.00443af0
mov esi, eax
test esi, esi
je 0x4c343d
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004e4fb1
push esi
call fcn.004e4b91
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4c3509
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x4c34d5
lea ecx, [esp + 0x20]
push ecx
push str.VerInfo
push str.General
call fcn.00499a30
call fcn.004984d0
test al, al
jne 0x4c34a1
push 0x4ffb24
lea edx, [esp + 0x2c]
push edx
call fcn.00443af0
mov esi, eax
test esi, esi
je 0x4c34a1
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.004e8056
push esi
call fcn.004e4b91
add esp, 0x14
call fcn.004984f0
movzx ecx, al
neg ecx
sbb ecx, ecx
and ecx, 0xfffffe98
add ecx, 0x168
mov dword [0x5393b0], ecx
pop esi
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.004e34f4
add esp, 0x1028
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov dword [esp + 8], ecx
lea ecx, [esp + 0x14]
push ecx
push str.VerInfo
push str.General
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], eax
call fcn.00499a30
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x4c3559
cmp dword [esp + 0x10], eax
je 0x4c3559
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.004984d0
test al, al
jne 0x4c3559
push 0x4ffb24
lea ecx, [esp + 0x2c]
push ecx
call fcn.00443af0
mov esi, eax
test esi, esi
je 0x4c3559
push esi
push 0xc
lea edx, [esp + 0xc]
push 1
push edx
call fcn.004e8056
push esi
call fcn.004e4b91
add esp, 0x14
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x24]
xor ecx, ecx
push 1
xor esi, esi
sub edx, eax
push ecx
sbb esi, ecx
push esi
push edx
call fcn.004e4480
mov ecx, dword [esp + 8]
xor esi, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
sbb edx, esi
push esi
add eax, ecx
push 0x989680
adc edx, esi
push edx
push eax
call fcn.004e6f30
push esi
push 0xe10
push edx
push eax
call fcn.004e6f30
push esi
push 0x18
push edx
push eax
call fcn.004e6f30
mov dword [0x5393b0], eax
test eax, eax
jge 0x4c35bc
mov dword [0x5393b0], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.004e34f4
add esp, 0x1028
ret
Function at 0x4c6be0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2044
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x2040], eax
mov eax, dword [esp + 0x205c]
push ebx
mov ebx, dword [esp + 0x2064]
push ebp
mov ebp, dword [esp + 0x205c]
push esi
mov esi, dword [esp + 0x2058]
push edi
mov edi, dword [esp + 0x2060]
push 0x3c
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x1c], eax
call fcn.004e4400
add esp, 0xc
cmp byte [esp + 0x2068], 0
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x500
jne 0x4c6c56
mov dword [esp + 0x18], 0x540
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebp
call fcn.00451a10
cmp eax, esi
jne 0x4c6c90
push esi
lea edx, [esp + 0x54]
push str.._s
push edx
mov edx, 0x1000
call fcn.00458640
lea eax, [esp + 0x5c]
add esp, 0xc
mov dword [esp + 0x24], eax
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [esp + 0x14]
mov ebx, 1
push ecx
mov dword [esp + 0x34], ebx
mov byte [0x53830b], bl
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x4c6cee
call ebp
cmp eax, 0x4c7
jne 0x4c6cd6
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c6ccf
mov dword [eax], 0
mov al, bl
jmp 0x4c6d94
cmp dword [esp + 0x20], 0
je 0x4c6cee
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], 0
call edi
mov esi, eax
mov byte [0x53830b], 0
test esi, esi
je 0x4c6d92
call ebp
cmp eax, 0x483
je 0x4c6d92
cmp byte [esp + 0x2068], 0
jne 0x4c6d8e
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x4c6d47
mov eax, dword [0x575710]
mov edx, dword [esp + 0x34]
mov dword [eax*4 + 0x5756d0], ecx
mov dword [eax*4 + 0x575690], edx
inc eax
and eax, 0x8000000f
jns 0x4c6d40
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x575710], eax
jmp 0x4c6d84
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
nop
mov eax, dword [esi + 0x575690]
cmp eax, dword [esp + 0x34]
jne 0x4c6d78
mov ecx, dword [esi + 0x5756d0]
push 0
push ecx
call edi
cmp eax, 0x102
jne 0x4c6d78
mov edx, dword [esi + 0x5756d0]
mov dword [esp + 0x4c], edx
add esi, 4
cmp esi, 0x40
jl 0x4c6d50
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c6d8e
mov dword [eax], ecx
mov al, bl
jmp 0x4c6d94
xor al, al
mov ecx, dword [esp + 0x2050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x2044
ret 0x1c