joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47d9c0
Capabilities:
Get graphical window text

Disassembly:
call fcn.0043c9b0
test eax, eax
je 0x47d9cf
jmp dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push edi
mov edi, dword [esp + 0x14]
lea eax, [edi + 1]
push eax
call fcn.0049ec14
mov ecx, dword [esp + 0x10]
add esp, 4
push edi
mov esi, eax
push esi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, dword [esp + 0x10]
push 0x1000000
push edx
push esi
call fcn.0046d330
push esi
call fcn.0049ea65
add esp, 4
pop edi
pop esi
ret 0xc

Function at 0x47dc60
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
push ebx
call edi
push ebx
mov esi, eax
call edi
mov ebp, dword [esp + 0x38]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov dword [esp + 0x40], eax
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x24]
push 0xcc0020
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov edx, eax
neg edx
push edx
push 0
lea edx, [eax - 1]
push edx
push esi
push ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0xcc0020
push 0
push 0
push edi
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov edx, dword [esp + 0x18]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
Function at 0x47de30
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
mov esi, dword [esp + 0x40c]
push edi
mov edi, dword [esp + 0x414]
push edi
push 0x4b1914
push esi
push str.TempFolder
push str.Paths
call fcn.004563a0
cmp byte [esi], 0
mov byte [esp + 8], 0
je 0x47dea6
push 0x400
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x47de95
push edi
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.00464e60
cmp byte [esi], 0
je 0x47dea6
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x47ded0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x47deb7
cmp byte [esi], 0
jne 0x47ded0
mov edx, dword [str._rartemp]
mov dword [esi], edx
mov eax, dword [0x4b4a3c]
mov dword [esi + 4], eax
mov cl, byte [0x4b4a40]
mov byte [esi + 8], cl
push esi
call fcn.0044d9b0
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.0049e0c6
add esp, 0x404
ret 8

Function at 0x47df60
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
test esi, esi
je 0x47df8f
xor eax, eax
mov word [esi], ax
call fcn.0043c9b0
test eax, eax
je 0x47df8f
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x47df8f
pop edi
xor al, al
pop esi
ret 0xc
mov eax, dword [esp + 0xc]
test eax, eax
je 0x47dfaa
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret 0xc
pop edi
mov al, 1
pop esi
ret 0xc

Function at 0x47e080
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x94], eax
lea eax, [esp]
push eax
mov dword [esp + 4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x10], 2
jne 0x47e0d9
mov eax, dword [esp + 4]
cmp eax, 5
ja 0x47e0bf
jne 0x47e0d9
cmp dword [esp + 8], 0
jbe 0x47e0d9
mov eax, 1
mov ecx, dword [esp + 0x94]
xor ecx, esp
call fcn.0049e0c6
add esp, 0x98
ret
mov ecx, dword [esp + 0x94]
xor ecx, esp
xor eax, eax
call fcn.0049e0c6
add esp, 0x98
ret
Function at 0x47ec00
Capabilities:
Create directory

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
mov ebx, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x410]
push 0x400
lea eax, [esp + 0xc]
push eax
call fcn.0047de30
lea ecx, [esp + 8]
push ecx
call fcn.0044d9b0
mov eax, esi
mov edx, esi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47ec41
push edi
lea edi, [esp + 0xc]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47ec50
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0xc]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.0042fb10
pop edi
test eax, eax
je 0x47ec9e
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x47ec9e
lea eax, [esp + 8]
mov edx, ebx
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x47ec90
mov al, 1
jmp 0x47ecc2
lea edx, [esp + 8]
push edx
push 0x1f7
call fcn.0045b8f0
push eax
call fcn.0048c7e0
add esp, 8
mov ecx, 0x4c9364
call fcn.00427c70
xor al, al
mov ecx, dword [esp + 0x408]
pop esi
pop ebx
xor ecx, esp
call fcn.0049e0c6
add esp, 0x404
ret 8
Function at 0x47f8c0
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
mov ebp, dword [esp + 0x210]
push esi
push edi
call fcn.0047e080
mov ecx, dword [ebp + 4]
movzx ebx, al
neg ebx
push 0x200
sbb ebx, ebx
lea eax, [esp + 0x14]
push eax
and ebx, 0x40
push ecx
add ebx, 0x40
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edx, ebx
shr edx, 1
push edx
lea eax, [esp + 0x14]
push eax
call fcn.00445050
cmp byte [0x4f67e0], 0
je 0x47f98d
call fcn.0043c9b0
test eax, eax
mov eax, 0x4b2834
jne 0x47f930
mov eax, 0x4b2a74
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47f932
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47f940
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47f960
push 0x4f67e0
sub eax, edx
push 0x5aa
mov esi, eax
call fcn.0045b8f0
push eax
lea ecx, [esp + esi + 0x18]
push str._s:__s
push ecx
call fcn.0049e0d5
add esp, 0x10
cmp byte [0x4f67b5], 0
je 0x47fa0b
call fcn.0043c9b0
test eax, eax
mov eax, 0x4b2834
jne 0x47f9a9
mov eax, 0x4b2a74
mov edx, eax
jmp 0x47f9b0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47f9b0
lea edi, [esp + 0x10]
sub eax, edx
dec edi
mov edi, edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x47f9c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47f9e0
sub eax, edx
mov edx, dword [esp + 0x21c]
push edx
push 0x2fd
mov esi, eax
call fcn.0045b8f0
push eax
lea eax, [esp + esi + 0x18]
push eax
call fcn.0049e0d5
add esp, 0xc
push ebx
lea ecx, [esp + 0x14]
push ecx
lea edx, [ebp + 0x18]
push edx
call fcn.00464e60
call fcn.0047e080
mov ecx, dword [esp + 0x210]
movzx eax, al
neg eax
sbb eax, eax
and eax, 0x190
pop edi
add eax, 0x58
pop esi
mov dword [ebp], eax
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e0c6
add esp, 0x204
ret 8
Function at 0x47fa50
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x200], eax
mov eax, dword [0x4db83c]
test eax, eax
je 0x47fb3c
push esi
push 0x200
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [0x4f7748]
cmp esi, 8
je 0x47fad8
mov ecx, 0x4f6ac8
lea eax, [esp + 4]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x47fab7
test dl, dl
je 0x47fab3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x47fab7
add eax, 2
add ecx, 2
test dl, dl
jne 0x47fa97
xor eax, eax
jmp 0x47fabc
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x47fad8
mov edx, dword [0x4db83c]
push 0x4f6ac8
push edx
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov esi, dword [0x4f7748]
test esi, esi
je 0x47faeb
cmp esi, 1
je 0x47faeb
cmp esi, 2
je 0x47faeb
cmp esi, 8
jne 0x47fb22
push ebx
push edi
push 0x9c
xor ebx, ebx
mov edi, 0x4f6a48
call fcn.0047f630
push 0x4f6b48
call fcn.0044d5b0
push 0x4f7348
mov ebx, eax
call fcn.0044d530
push 0x9b
mov edi, eax
call fcn.0047f630
pop edi
pop ebx
push 0x64
push 2
call fcn.00445300
pop esi
test al, al
je 0x47fb3c
mov eax, dword [0x4db83c]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x200]
xor ecx, esp
call fcn.0049e0c6
add esp, 0x204
ret
Function at 0x482790
Capabilities:
Get common file path
Query environment variable

Disassembly:
sub esp, 0x404
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x400], eax
cmp byte [esp + 0x41c], 0
push ebx
push ebp
mov ebp, dword [esp + 0x410]
push esi
mov esi, dword [esp + 0x418]
push edi
mov edi, dword [esp + 0x420]
je 0x48282c
push 0x400
push esi
push ebp
push str.DefFolder
push str.Extraction
call fcn.004563a0
cmp byte [ebp], 0
jne 0x4827fc
mov edx, ebp
mov eax, esi
sub edx, esi
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4827f0
jmp 0x482830
push 0x400
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x10]
mov edx, ebp
mov ecx, eax
mov byte [esp + 0x40f], 0
sub edx, ecx
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x482820
jmp 0x482830
mov byte [ebp], 0
mov al, byte [ebp]
test al, al
setne bl
test al, al
jne 0x482848
push ebp
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push ebp
call fcn.0044d9b0
cmp byte [esp + 0x424], 0
jne 0x482860
test bl, bl
je 0x48295d
push 1
push str.AppendName
push str.Extraction
call fcn.00456400
test eax, eax
je 0x48295d
push 0x400
push edi
lea edx, [esp + 0x18]
push edx
call fcn.00464e60
cmp byte [esp + 0x10], 0
je 0x4828b4
lea esi, [esp + 0x10]
cmp byte [esi], 0x25
jne 0x4828ae
lea eax, [esi + 1]
push 0x25
push eax
call fcn.0049dd30
add esp, 8
test eax, eax
je 0x4828ae
mov byte [esi], 0x5f
inc esi
cmp byte [esi], 0
jne 0x482894
lea ecx, [esp + 0x10]
push ecx
call fcn.0044d530
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4828c0
mov edi, ebp
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4828d0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push ebp
rep movsb byte es:[edi], byte [esi]
call fcn.0044d8c0
mov esi, eax
test esi, esi
je 0x48295d
cmp esi, ebp
jbe 0x48295d
push ebp
mov byte [esi], 0
call fcn.0044d8c0
mov edi, eax
test edi, edi
je 0x482949
cmp edi, ebp
jbe 0x482949
cmp byte [esp + 0x428], 0
je 0x482937
cmp byte [esi + 1], 0
je 0x482937
movsx edx, byte [esi + 2]
push edx
call fcn.00464c70
test al, al
jne 0x482937
movsx eax, byte [esi - 1]
push eax
call fcn.00464c70
test al, al
jne 0x482946
push str..tar
push edi
call fcn.00464e20
test eax, eax
jne 0x482949
mov byte [edi], 0
dec esi
cmp esi, ebp
jbe 0x48295d
mov edi, edi
cmp byte [esi], 0x2e
jne 0x48295d
mov byte [esi], 0
dec esi
cmp esi, ebp
ja 0x482950
push 0
push ebp
call fcn.0044e0c0
mov ecx, dword [esp + 0x410]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0049e0c6
add esp, 0x404
ret 0x18
Function at 0x482980
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x4af8bb
mov eax, dword fs:[0]
push eax
mov eax, 0x2cb4
call fcn.0049e650
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x2cb0], eax
push ebx
push ebp
mov eax, dword [0x4c0390]
xor eax, esp
push eax
lea eax, [esp + 0x2cc0]
mov dword fs:[0], eax
mov eax, dword [esp + 0x2cd0]
mov ebp, dword [esp + 0x2cd4]
lea ecx, [esp + 0x1cbc]
push ecx
push str.Rar_DIXXXXXX
mov dword [esp + 0x14], eax
call fcn.0047ec00
test al, al
je 0x482b92
push 0x400
lea edx, [esp + 0x24c0]
push edx
lea eax, [esp + 0x20c4]
push eax
call fcn.0047df60
push 0
lea ecx, [esp + 0x1cc0]
push ecx
call fcn.0047df10
call fcn.0047aeb0
call fcn.00476d00
push 0x4e79ac
push 0x4e75ac
mov ecx, 0x4e0c18
call fcn.004134e0
mov edx, dword [0x4e0e20]
mov ecx, dword [0x4e81ac]
push edi
push esi
mov dword [0x4e614c], edx
mov dword [0x4e5d38], 4
mov dword [0x4e5778], 2
call fcn.00465140
push 0
push 0
mov ecx, 0x4e0c18
call fcn.00416070
lea ecx, [esp + 0x10b4]
xor bl, bl
call fcn.00432c50
mov dword [esp + 0x2cc8], 0
push 0x4b175c
lea ecx, [esp + 0x10b8]
call fcn.00432c90
lea ecx, [esp + 0xc28]
call fcn.00467be0
lea ecx, [esp + 0xc4c]
call fcn.00467be0
lea ecx, [esp + 0xc70]
call fcn.00467be0
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x10bc]
call fcn.004330f0
test al, al
je 0x482b41
cmp byte [esp + 0xc24], 0
je 0x482af3
push 0
lea ecx, [esp + 0x18]
push ecx
lea ecx, [esp + 0x10bc]
call fcn.004330f0
test al, al
jne 0x482ad0
jmp 0x482b41
call fcn.0043c9b0
test eax, eax
je 0x482b26
cmp word [esp + 0x414], 0
je 0x482b26
test ebp, ebp
je 0x482b30
lea edx, [esp + 0x10]
push edx
push ebp
push 0x400
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x482b30
test ebp, ebp
je 0x482b30
xor ecx, ecx
mov word [ebp], cx
mov edx, dword [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.0042f9c0
mov bl, 1
lea ecx, [esp + 0x24bc]
push ecx
lea edx, [esp + 0x20c0]
push edx
call fcn.0047df10
test bl, bl
jne 0x482b68
lea eax, [esp + 0x1cbc]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, 0x4dc1d0
mov byte [0x4dc1fc], 0
call fcn.00464ab0
mov dword [esp + 0x2cc8], 0xffffffff
lea ecx, [esp + 0x10b4]
call fcn.00432c70
mov al, bl
mov ecx, dword [esp + 0x2cc0]
mov dword fs:[0], ecx
pop ecx
pop ebp
pop ebx
mov ecx, dword [esp + 0x2cb0]
xor ecx, esp
call fcn.0049e0c6
add esp, 0x2cc0
ret 8
Function at 0x484610
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x868
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x864], eax
push ebx
push esi
mov esi, dword [esp + 0x874]
push edi
push esi
push 0x6c
call fcn.0045b8f0
push eax
lea eax, [esp + 0x414]
push eax
call fcn.0049e0d5
add esp, 0xc
push 0
push esi
call fcn.0047efc0
test al, al
jne 0x4846e9
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, dword [sym.imp.USER32.dll_MessageBoxA]
push 0x400
lea ecx, [esp + 0x10]
push ecx
push esi
call ebx
test eax, eax
je 0x4846b9
lea ecx, [esp + 0xc]
mov eax, esi
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4846a0
test dl, dl
je 0x48469c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4846a0
add eax, 2
add ecx, 2
test dl, dl
jne 0x484680
xor eax, eax
jmp 0x4846a5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4846b9
push 0
lea edx, [esp + 0x10]
push edx
call fcn.0047efc0
test al, al
jne 0x4846e9
push 0x15
push 0x66
call fcn.0045b8f0
mov ecx, dword [0x4dc1c8]
push eax
lea eax, [esp + 0x414]
push eax
push ecx
call edi
cmp eax, 2
je 0x484705
push 0
push esi
call fcn.0047efc0
test al, al
je 0x484663
mov ecx, 0x4dfef0
call fcn.004409b0
test al, al
je 0x484705
push 0
push 0
mov ecx, 0x4dfef0
call fcn.00440f30
mov ecx, dword [esp + 0x870]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0049e0c6
add esp, 0x868
ret 4
Function at 0x484720
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x178
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x174], eax
push esi
mov esi, dword [esp + 0x180]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x174]
push str._c:_
push ecx
call fcn.0049e0d5
add esp, 0xc
push 0x301
push 0x160
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x180]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test byte [esi + 0x10], 1
je 0x4847aa
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4b1914
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea ecx, [eax + 1]
lea ecx, [ecx]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x484810
sub eax, ecx
mov ecx, dword [edi]
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x48485d
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x17c]
pop edi
pop esi
xor ecx, esp
call fcn.0049e0c6
add esp, 0x178
ret 4
Function at 0x48a0a0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
sub esp, 0xd54
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0xd50], eax
cmp byte [esp + 0xd5c], 0
mov dword [0x4dbc58], 1
je 0x48a23d
push esi
push 0x400
lea eax, [esp + 0x558]
push eax
call fcn.0047de30
lea ecx, [esp + 0x554]
push ecx
call fcn.0044d9b0
lea edx, [esp + 0x554]
push edx
lea eax, [esp + 0x958]
push str._sRar_
push eax
call fcn.0049e0d5
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x958]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [esp + 8], esi
cmp esi, 0xffffffff
je 0x48a235
push ebx
push edi
jmp 0x48a140
cmp dword [0x4dbc58], 1
jne 0x48a233
mov ecx, dword [esp + 0x18]
sub ecx, dword [esp + 0x24]
cmp ecx, 8
setae byte [esp + 0xf]
xor eax, eax
nop
mov cl, byte [esp + eax + 0x55c]
mov byte [esp + eax + 0x15c], cl
inc eax
test cl, cl
jne 0x48a160
lea eax, [esp + 0x48]
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48a180
lea edi, [esp + 0x15c]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48a191
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x1c], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x48a20c
push 6
lea edx, [esp + 0x4c]
push str.Rar_DI
push edx
call fcn.0049f25f
add esp, 0xc
test eax, eax
jne 0x48a1d6
call fcn.0043c9b0
cmp eax, 4
je 0x48a1d6
mov bl, 1
jmp 0x48a1d8
xor bl, bl
lea eax, [esp + 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x48a21b
cmp byte [esp + 0xf], al
je 0x48a1f9
cmp byte [esp + 0xd64], al
je 0x48a1fd
test bl, bl
je 0x48a21b
lea ecx, [esp + 0x15c]
push ecx
call fcn.0047ed60
jmp 0x48a21b
push 0
lea edx, [esp + 0x160]
push edx
call fcn.0047ef70
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x48a140
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp byte [esp + 0xd58], 0
jne 0x48a26b
cmp byte [0x4c8d50], 0
je 0x48a26b
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.00486c40
mov byte [0x4c8d50], al
mov ecx, dword [esp + 0xd50]
xor ecx, esp
mov dword [0x4dbc58], 0
call fcn.0049e0c6
add esp, 0xd54
ret 8
Function at 0x48ce20
Capabilities:
Copy file

Disassembly:
mov eax, 0x1030
call fcn.0049e650
mov eax, dword [0x4c0390]
xor eax, esp
mov dword [esp + 0x102c], eax
cmp dword [0x4dbc5c], 0
je 0x48d017
push 0
lea eax, [esp + 0x428]
push eax
mov ecx, 0x4e0c18
call fcn.004134e0
push 1
push str.History
push str.General
call fcn.00456400
test eax, eax
setne al
mov byte [esp + 3], al
test al, al
je 0x48ce95
push 0x400
push 0x4b1914
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.004563a0
cmp byte [esp + 0x24], 0
jne 0x48cea6
lea edx, [esp + 0x24]
push edx
call fcn.0043ac40
xor eax, eax
jmp 0x48ceb0
mov cl, byte [esp + eax + 0x24]
mov byte [esp + eax + 0x828], cl
inc eax
test cl, cl
jne 0x48ceb0
lea eax, [esp + 0x828]
push eax
call fcn.0044d9b0
lea ecx, [esp + 0x424]
push ecx
call fcn.0044d530
mov edx, eax
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48cee0
push esi
push edi
lea edi, [esp + 0x830]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x48cef3
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 1
push 0
lea edx, [esp + 0x838]
mov ecx, eax
push edx
and ecx, 3
push 0x5af
rep movsb byte es:[edi], byte [esi]
call fcn.0045b8f0
push eax
mov eax, dword [0x4dc1c8]
push eax
call fcn.00418db0
pop edi
pop esi
test al, al
je 0x48d017
push 0x400
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x830]
push edx
call fcn.0044d9f0
cmp byte [esp + 3], 0
je 0x48cf69
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.00456260
lea eax, [esp + 0x424]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48cf73
sub eax, edx
mov byte [esp + eax + 0x425], cl
lea eax, [esp + 0x828]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x48cf90
sub eax, edx
mov byte [esp + eax + 0x829], cl
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea eax, [esp + 4]
lea ecx, [esp + 0x424]
lea edx, [esp + 0x828]
push eax
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
je 0x48d017
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ecx
push edx
push 0x5b0
call fcn.0045b8f0
push eax
call fcn.0048c7e0
add esp, 0xc
mov ecx, 0x4c9364
call fcn.00427c70
mov ecx, dword [esp + 0x102c]
xor ecx, esp
call fcn.0049e0c6
add esp, 0x1030
ret