joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490ad0
Capabilities:
Move file

Disassembly:
mov eax, 0x1054
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1050], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
mov ecx, 0x52d6c0
xor esi, esi
call fcn.00444460
push edi
lea eax, [esp + 0x30]
push eax
mov ecx, 0x52d6c0
call fcn.00444460
test al, al
je 0x490b9e
lea ecx, [esp + 0x85c]
push ecx
lea edx, [esp + 0x30]
push edx
call fcn.00455800
lea eax, [esp + 0x85c]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x490b30
sub eax, edx
sar eax, 1
lea ebx, [eax + edi + 1]
lea eax, [ebx + ebx + 2]
push eax
push esi
call fcn.004aefee
mov esi, eax
add esp, 8
test esi, esi
je 0x490c64
lea eax, [esp + 0x85c]
mov edx, eax
lea ecx, [edi + edi]
sub ecx, edx
lea edx, [ecx + esi]
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x490b70
push 0
lea eax, [esp + 0x30]
push eax
mov ecx, 0x52d6c0
mov edi, ebx
call fcn.00444460
test al, al
jne 0x490b13
test edi, edi
jne 0x490bc5
push 0x30
push 0x65
call fcn.00465ec0
push eax
push 0x14c
call fcn.00465ec0
mov ecx, dword [0x527edc]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x490c64
xor eax, eax
xor edx, edx
mov word [esi + edi*2], dx
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov word [esp + 0x28], ax
mov eax, dword [0x527edc]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], 3
cmp byte [esp + 0x1064], dl
je 0x490c12
mov ecx, 0x40
mov word [esp + 0x1c], cx
lea edx, [esp + 0xc]
mov edi, 1
add dword [0x527634], edi
push edx
mov dword [esp + 0x18], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
sub dword [0x527634], edi
push esi
call fcn.004aef60
add esp, 4
test bl, bl
je 0x490c64
cmp dword [esp + 0x1e], 0
jne 0x490c64
mov ecx, 0x52d698
call fcn.004755e0
push 0x4c5d70
mov ecx, 0x52d6c0
call fcn.00447100
mov ecx, dword [esp + 0x105c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x1054
ret 4
Function at 0x492710
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x2d0], eax
push esi
mov esi, dword [esp + 0x2dc]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x2c8]
push 0x4c5878
push ecx
mov edx, 0xa
call fcn.004a5ca0
add esp, 0xc
push 0x301
push 0x2b4
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [esi + 0x10], 1
je 0x49279f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4c5d70
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x492802
mov ecx, dword [edi]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x492855
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x2d4
ret 4
Function at 0x4983f0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x1a64
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1a60], eax
cmp byte [esp + 0x1a6c], 0
mov dword [0x5275a0], 1
je 0x49859c
push esi
push 0x400
lea eax, [esp + 0xa68]
push eax
call fcn.00489d10
lea ecx, [esp + 0xa64]
push ecx
call fcn.004554c0
lea edx, [esp + 0xa64]
push edx
lea eax, [esp + 0x1268]
push str._sRar_
push eax
mov edx, 0x400
call fcn.004a5ca0
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1268]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 8], esi
cmp esi, 0xffffffff
je 0x498594
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
push edi
jmp 0x4984a0
cmp dword [0x5275a0], 1
jne 0x498591
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x28]
cmp ecx, 8
setae byte [esp + 0x13]
xor eax, eax
nop
movzx ecx, word [esp + eax + 0xa70]
mov word [esp + eax + 0x270], cx
add eax, 2
test cx, cx
jne 0x4984c0
lea eax, [esp + 0x4c]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4984e0
lea edi, [esp + 0x270]
sub eax, edx
add edi, 0xfffffffe
jmp 0x498500
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x498500
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x20], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x49856c
push 6
lea edx, [esp + 0x50]
push str.Rar_DI
push edx
call fcn.004b1016
add esp, 0xc
test eax, eax
lea eax, [esp + 0x270]
push eax
sete bl
call ebp
test eax, eax
jne 0x498579
cmp byte [esp + 0x13], al
je 0x498559
cmp byte [esp + 0x1a78], al
je 0x49855d
test bl, bl
je 0x498579
lea ecx, [esp + 0x270]
push ecx
call fcn.0048abd0
jmp 0x498579
lea edx, [esp + 0x270]
push edx
call fcn.0048a960
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4984a0
pop edi
pop ebx
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp byte [esp + 0x1a68], 0
jne 0x4985ca
cmp byte [0x5132f0], 0
je 0x4985ca
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.00495a70
mov byte [0x5132f0], al
mov ecx, dword [esp + 0x1a60]
xor ecx, esp
mov dword [0x5275a0], 0
call fcn.004aedbb
add esp, 0x1a64
ret 8
Function at 0x498d90
Capabilities:
Copy file

Disassembly:
mov eax, 0x1004
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1000], eax
cmp byte [0x5132f0], 0
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
mov edi, dword [esp + 0x1010]
je 0x498df2
cmp byte [0x533858], 0
jne 0x498df2
push 0x24
push 0x5f0
call fcn.00465ec0
push eax
push 0x5f1
call fcn.00465ec0
push eax
mov eax, dword [0x527edc]
push eax
call ebp
cmp eax, 6
jne 0x498f79
push esi
push 0x400
lea ecx, [esp + 0x810]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x80c]
push edx
mov esi, str.rarreg.key
call fcn.00455b40
lea ebx, [ebx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x498e20
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push 0
lea eax, [esp + 0x814]
push eax
push edi
call esi
lea ecx, [esp + 0x10]
test eax, eax
push ecx
setne bl
call fcn.00456340
lea edx, [esp + 0x10]
push edx
call fcn.004554c0
lea eax, [esp + 0x10]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x498e65
mov ecx, dword [str.rarreg.key]
mov edx, dword [0x4c8fac]
mov dword [eax], ecx
mov ecx, dword [0x4c8fb0]
mov dword [eax + 4], edx
mov edx, dword [0x4c8fb4]
mov dword [eax + 8], ecx
mov ecx, dword [0x4c8fb8]
mov dword [eax + 0xc], edx
mov dx, word [0x4c8fbc]
mov dword [eax + 0x10], ecx
test bl, bl
mov word [eax + 0x14], dx
pop ebx
je 0x498eb9
lea eax, [esp + 0xc]
push eax
call fcn.00432710
jmp 0x498ee5
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
call esi
xor eax, eax
jmp 0x498ed0
movzx ecx, word [esp + eax + 0xc]
mov word [esp + eax + 0x80c], cx
add eax, 2
test cx, cx
jne 0x498ed0
mov edx, dword [0x527edc]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x527edc]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push eax
call esi
push 1
lea ecx, [esp + 0x810]
push ecx
push 0
call fcn.0041c0c0
mov edx, dword [0x527edc]
push 0
push edx
mov byte [0x5132f0], al
call esi
mov ecx, 0x52d6c0
call fcn.00448b20
cmp byte [0x5132f0], 0
pop esi
je 0x498f59
push 0x30
push 0x368
call fcn.00465ec0
push eax
push 0x367
call fcn.00465ec0
push eax
mov eax, dword [0x527edc]
push eax
call ebp
jmp 0x498f79
lea ecx, [esp + 0x808]
push ecx
call fcn.00432710
push 0x366
call fcn.00465ec0
push eax
call fcn.004985f0
add esp, 4
mov ecx, dword [esp + 0x1008]
pop edi
pop ebp
xor ecx, esp
call fcn.004aedbb
add esp, 0x1004
ret 4
Function at 0x498fd0
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x202c
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x2028], eax
cmp byte [0x526d89], 0
je 0x4991e5
push ebx
push 0x401
lea eax, [esp + 0x828]
push eax
mov ecx, 0x52dfe8
call fcn.00412e90
push 1
push str.History
push str.General
call fcn.0045fbd0
test eax, eax
setne bl
test bl, bl
je 0x499045
push 0x400
push 0x4c5d70
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.0045fba0
cmp word [esp + 0x24], 0
jne 0x499057
lea edx, [esp + 0x24]
push edx
call fcn.00440c00
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x24]
mov word [esp + eax + 0x1028], cx
add eax, 2
test cx, cx
jne 0x499060
lea eax, [esp + 0x1028]
push eax
call fcn.004554c0
lea ecx, [esp + 0x824]
push ecx
call fcn.00455b40
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x499091
push esi
push edi
lea edi, [esp + 0x1030]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4990b0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 1
push 0
lea edx, [esp + 0x1038]
mov ecx, eax
push edx
and ecx, 3
push 0x5af
rep movsb byte es:[edi], byte [esi]
call fcn.00465ec0
push eax
mov eax, dword [0x527edc]
push eax
call fcn.00419900
pop edi
pop esi
test al, al
je 0x4991e4
push 0x400
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1030]
push edx
call fcn.00456080
test bl, bl
je 0x499127
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.0045fad0
lea eax, [esp + 0x824]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x499131
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x826], cx
lea eax, [esp + 0x1028]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x499154
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x102a], dx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea edx, [esp + 4]
lea eax, [esp + 0x824]
lea ecx, [esp + 0x1028]
push edx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4991e4
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 0x5b0
call fcn.00465ec0
push eax
call fcn.004985f0
add esp, 0xc
mov ecx, 0x513904
call fcn.004298d0
pop ebx
mov ecx, dword [esp + 0x2028]
xor ecx, esp
call fcn.004aedbb
add esp, 0x202c
ret
Function at 0x49b870
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
sub esp, 0x80c
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x808], eax
cmp dword [0x527634], 0
push ebx
mov ebx, dword [esp + 0x814]
jne 0x49b9b5
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x49b94e
push 0x400
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
push ebx
mov word [esp + 0x24], ax
call ebp
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x526d89], 0
je 0x49b8fe
cmp eax, dword [0x52d6c0]
je 0x49b927
cmp eax, dword [0x52d69c]
je 0x49b927
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x49b927
push 1
lea eax, [esp + 0x18]
push eax
mov ecx, 0x52d6c0
call fcn.004483d0
cmp eax, 1
je 0x49b9b3
push 7
push str.rarreg.
lea ecx, [esp + 0x1c]
push ecx
call fcn.00455b40
push eax
call fcn.00477db0
test eax, eax
jne 0x49b94e
lea edx, [esp + 0x14]
push edx
call fcn.00498d90
jmp 0x49b9b3
push esi
push 0
call fcn.00486900
mov ecx, dword [0x536aac]
call fcn.0046f5f0
xor esi, esi
test edi, edi
jle 0x49b993
jmp 0x49b970
push 0x400
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x536aac]
call fcn.0046f9e0
inc esi
cmp esi, edi
jl 0x49b970
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
shr eax, 0xf
and al, 1
mov byte [esp + 0x14], al
mov edx, dword [esp + 0x14]
push edx
push 0
call fcn.004892e0
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x80c]
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x80c
ret 4

Function at 0x49ba50
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, dword [esp + 0x80c]
push esi
xor eax, eax
push edi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x400
lea ecx, [esp + 0x10]
push ecx
push eax
xor edi, edi
call fcn.0046f4c0
mov esi, eax
test esi, esi
je 0x49bae5
test edi, edi
jne 0x49ba9c
mov edi, 1
jmp 0x49bac7
movzx edx, word [esp + 0xc]
push edx
mov ecx, 0x52fee8
call fcn.0041c6c0
test al, al
jne 0x49bac7
cmp edi, 1
jne 0x49bac6
mov ax, word [esp + 0xc]
mov cx, word [esp + 0xe]
mov word [ebx], ax
mov word [ebx + 2], cx
inc edi
push 0x400
lea edx, [esp + 0x10]
push edx
push esi
call fcn.0046f4c0
mov esi, eax
test esi, esi
jne 0x49ba91
cmp edi, 2
jne 0x49bae5
mov word [ebx], ax
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004aedbb
add esp, 0x804
ret 4
Function at 0x49c070
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1804
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1800], eax
push esi
push 0x1000
push 0
lea eax, [esp + 0x80c]
push eax
push str.rarreg.key
push 0x4c5d70
call fcn.0045fbf0
mov esi, eax
test esi, esi
je 0x49c101
push edi
lea ecx, [esp + 8]
push ecx
push str.Rar_RK
call fcn.0048a640
mov edi, eax
test edi, edi
je 0x49c0f1
push edi
push esi
lea edx, [esp + 0x810]
push 1
push edx
call fcn.004b1c88
push edi
call fcn.004b203e
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.00498d90
lea ecx, [esp + 8]
push ecx
call fcn.00432710
push str.rarreg.key
push 0x4c5d70
call fcn.0045f750
pop edi
mov ecx, dword [esp + 0x1804]
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x1804
ret

Function at 0x49c120
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x182c
call fcn.004af5f0
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x1828], eax
push 0
push str.AppDataCopied
push str.General
call fcn.0045fbd0
test eax, eax
jne 0x49c2d8
push esi
push 0x401
lea eax, [esp + 0x82c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x828]
push ecx
mov esi, str.Themes
call fcn.00455b40
lea esp, [esp]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x49c180
lea edx, [esp + 0x102c]
push edx
call fcn.00456340
xor eax, eax
pop esi
jmp 0x49c1b0
movzx ecx, word [esp + eax + 0x1028]
mov word [esp + eax + 0x20], cx
add eax, 2
test cx, cx
jne 0x49c1b0
lea eax, [esp + 0x20]
push eax
call fcn.004554c0
lea eax, [esp + 0x20]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x49c1d6
mov ecx, dword [str.Themes]
mov edx, dword [0x4ccec0]
mov dword [eax], ecx
mov ecx, dword [0x4ccec4]
mov dword [eax + 4], edx
mov dx, word [0x4ccec8]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x824]
push eax
call fcn.00432420
test al, al
je 0x49c2c7
lea ecx, [esp + 0x20]
push ecx
call fcn.00432420
test al, al
jne 0x49c2c7
lea eax, [esp + 0x824]
lea edx, [eax + 2]
jmp 0x49c240
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49c240
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x826], dx
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49c260
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x22], cx
xor eax, eax
mov dword [esp + 8], eax
lea edx, [esp + 0x824]
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
lea eax, [esp + 0x20]
mov ecx, 0x14
push edx
mov dword [esp + 8], 2
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 1
push str.AppDataCopied
push str.General
call fcn.0045faf0
mov ecx, dword [esp + 0x1828]
xor ecx, esp
call fcn.004aedbb
add esp, 0x182c
ret
Function at 0x49c2f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x428
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x424], eax
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x1c], 0x40a00
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea ecx, [esp + 8]
push ecx
push str.VerInfo
push str.General
call fcn.0045fbf0
lea edx, [esp + 0x24]
push edx
call fcn.004562c0
lea eax, [esp + 0x24]
push eax
call fcn.00456000
lea eax, [esp + 0x24]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x49c348
mov ecx, dword [str.version.dat]
mov edx, dword [0x4cceec]
mov dword [eax], ecx
mov ecx, dword [0x4ccef0]
push esi
mov dword [eax + 4], edx
lea edx, [esp + 0x28]
push 0x4c79e8
push edx
mov dword [eax + 8], ecx
mov dword [esp + 0x18], 0
call fcn.004b37c4
mov esi, eax
add esp, 8
test esi, esi
je 0x49c3a3
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004b1faa
push esi
call fcn.004b203e
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x49c455
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x49c421
lea ecx, [esp + 0x20]
push ecx
push str.VerInfo
push str.General
call fcn.0045fb50
lea edx, [esp + 0x28]
push 0x4c86e0
push edx
call fcn.004b37c4
mov esi, eax
add esp, 8
test esi, esi
je 0x49c401
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.004b1c88
push esi
call fcn.004b203e
add esp, 0x14
mov dword [0x527628], 0
pop esi
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.004aedbb
add esp, 0x428
ret
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
push str.VerInfo
push str.General
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call fcn.0045fb50
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x49c49f
cmp dword [esp + 0x10], eax
je 0x49c49f
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x28]
push 0x4c86e0
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call fcn.004b37c4
mov esi, eax
add esp, 8
test esi, esi
je 0x49c49f
push esi
push 0xc
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.004b1c88
push esi
call fcn.004b203e
add esp, 0x14
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
xor eax, eax
push 1
xor esi, esi
sub ecx, edx
push eax
sbb esi, eax
push esi
push ecx
call fcn.004afc40
mov ecx, dword [esp + 8]
xor esi, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
sbb edx, esi
push esi
add eax, ecx
push 0x989680
adc edx, esi
push edx
push eax
call fcn.004b0290
push esi
push 0xe10
push edx
push eax
call fcn.004b0290
push esi
push 0x18
push edx
push eax
call fcn.004b0290
mov dword [0x527628], eax
test eax, eax
jge 0x49c502
mov dword [0x527628], 0x168
mov ecx, dword [esp + 0x428]
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x428
ret
Function at 0x49d020
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
sub esp, 0x810
mov eax, dword [0x4d8620]
xor eax, esp
mov dword [esp + 0x80c], eax
mov eax, dword [0x536aac]
push esi
xor esi, esi
cmp dword [eax + 0x20], esi
je 0x49d204
push esi
push 1
push 0x5362aa
mov ecx, 0x52dfe8
call fcn.004166e0
cmp eax, 1
jne 0x49d204
cmp dword [0x5326fc], 3
mov dword [esp + 8], esi
mov dword [esp + 0xc], esi
mov dword [esp + 4], esi
push eax
jne 0x49d08c
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14]
push edx
mov ecx, 0x52dfe8
call fcn.00413150
jmp 0x49d0a0
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
push ecx
mov ecx, 0x52dfe8
call fcn.00413070
cmp dword [esp + 4], esi
je 0x49d204
mov ecx, dword [0x536aac]
push 0x400
lea edx, [esp + 0x14]
push edx
call fcn.0046fcf0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x49d111
push esi
push esi
push 0x7fffffff
push 0x7fffffff
lea ecx, [esp + 0x20]
push ecx
push esi
call fcn.0040b080
cmp al, 0x43
je 0x49d0ee
cmp al, 0x4e
jne 0x49d111
mov edx, dword [esp + 8]
push edx
call fcn.004afa05
add esp, 4
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.004aedbb
add esp, 0x810
ret
push edi
push esi
push 0x4c86e0
lea eax, [esp + 0x1c]
push eax
call fcn.00432bd0
mov edi, eax
cmp edi, esi
jne 0x49d166
lea ecx, [esp + 0x14]
push ecx
push 0x1f6
call fcn.00465ec0
push eax
push 0x5362aa
call fcn.00498be0
mov edx, dword [esp + 0x18]
push edx
call fcn.004afa05
add esp, 0x10
pop edi
pop esi
mov ecx, dword [esp + 0x80c]
xor ecx, esp
call fcn.004aedbb
add esp, 0x810
ret
mov eax, dword [0x5326fc]
cmp eax, 3
jne 0x49d1bb
push edi
push 0xff
call fcn.004b2c44
push edi
push 0xfe
call fcn.004b2c44
add esp, 0x10
cmp dword [esp + 8], esi
jbe 0x49d1e6
nop
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + esi*2]
push edi
push ecx
call fcn.004b2c44
mov edx, dword [esp + 0x18]
movzx eax, byte [edx + esi*2 + 1]
push edi
push eax
call fcn.004b2c44
inc esi
add esp, 0x10
cmp esi, dword [esp + 8]
jb 0x49d190
jmp 0x49d1e6
cmp eax, 2
jne 0x49d1d1
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push ecx
push eax
push eax
call dword [sym.imp.USER32.dll_CharToOemBuffA]
mov edx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push edi
push edx
push 1
push eax
call fcn.004b1c88
add esp, 0x10
push edi
call fcn.004b203e
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004afa05
mov edx, dword [esp + 0x18]
push edx
call fcn.004afa05
add esp, 0xc
pop edi
mov ecx, dword [esp + 0x810]
pop esi
xor ecx, esp
call fcn.004aedbb
add esp, 0x810
ret