joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c7be0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50937c
mov eax, dword fs:[0]
push eax
sub esp, 0x404
mov eax, dword [0x528af4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [0x53890c]
test eax, eax
je 0x4c7d32
push 0x200
lea ecx, [ebp - 0x410]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esi, dword [0x58f8ac]
cmp esi, 0xa
je 0x4c7c88
mov ecx, 0x5908b0
lea eax, [ebp - 0x410]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4c7c68
test dx, dx
je 0x4c7c64
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4c7c68
add eax, 4
add ecx, 4
test dx, dx
jne 0x4c7c42
xor eax, eax
jmp 0x4c7c6d
sbb eax, eax
or eax, 1
test eax, eax
je 0x4c7c88
push 0x5908b0
push dword [0x53890c]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov esi, dword [0x58f8ac]
test esi, esi
je 0x4c7c9b
cmp esi, 1
je 0x4c7c9b
cmp esi, 2
je 0x4c7c9b
cmp esi, 0xa
jne 0x4c7cbf
push 0x5919b0
push 0x9c
call fcn.004c7b40
push 0x58f8b0
call fcn.00478eb0
push eax
push 0x9b
call fcn.004c7b40
mov eax, dword fs:[0x2c]
mov ecx, dword [0x5ccfa8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x59345c]
cmp eax, dword [ecx + 4]
jle 0x4c7d16
push 0x59345c
call fcn.004ec5e9
add esp, 4
cmp dword [0x59345c], 0xffffffff
jne 0x4c7d16
mov dword [ebp - 4], 0
mov dword [0x593458], 0
mov dword [ebp - 4], 0xffffffff
push 0x59345c
call fcn.004ec5aa
add esp, 4
push 0x64
mov ecx, 0x593458
call fcn.00445370
test al, al
je 0x4c7d32
push dword [0x53890c]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004ebbd8
mov esp, ebp
pop ebp
ret
Function at 0x4ca290
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2008
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x2004], eax
cmp byte [esp + 0x2024], 0
push ebx
mov ebx, dword [esp + 0x201c]
push ebp
mov ebp, dword [esp + 0x2018]
push esi
mov esi, dword [esp + 0x2020]
push edi
mov edi, dword [esp + 0x201c]
je 0x4ca331
push 0x800
push esi
push edi
push str.DefFolder
push str.Extraction
call fcn.0049fec0
cmp word [edi], 0
jne 0x4ca304
mov ecx, edi
sub ecx, esi
movzx eax, word [esi]
lea esi, [esi + 2]
mov word [ecx + esi - 2], ax
test ax, ax
jne 0x4ca2f2
jmp 0x4ca331
push 0x800
lea eax, [esp + 0x1018]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor eax, eax
mov word [esp + 0x2012], ax
lea eax, [esp + 0x1014]
push ebp
push eax
push edi
call fcn.0048e710
movzx eax, word [edi]
test ax, ax
setne byte [esp + 0x13]
test ax, ax
jne 0x4ca34d
push ebp
push edi
mov ecx, 0x55d4d8
call fcn.0043f660
push ebp
push edi
call fcn.00477290
push 0x800
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.0048e710
xor ebx, ebx
cmp word [esp + 0x14], bx
je 0x4ca3a6
xor eax, eax
lea esi, [esp + 0x14]
cmp word [esi], 0x25
jne 0x4ca396
lea ecx, [esp + 0x16]
add eax, ecx
push 0x25
push eax
call fcn.004ecec5
add esp, 8
test eax, eax
je 0x4ca396
mov ecx, 0x5f
mov word [esi], cx
inc ebx
lea esi, [esp + 0x14]
lea eax, [ebx + ebx]
add esi, eax
cmp word [esi], 0
jne 0x4ca373
lea eax, [esp + 0x14]
push eax
call fcn.00478260
mov esi, eax
test esi, esi
je 0x4ca446
lea eax, [esp + 0x14]
cmp esi, eax
jbe 0x4ca446
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x14]
push eax
call fcn.00478260
mov ebx, eax
test ebx, ebx
je 0x4ca424
lea eax, [esp + 0x14]
cmp ebx, eax
jbe 0x4ca424
cmp byte [esp + 0x2030], 0
je 0x4ca410
cmp word [esi + 2], 0
je 0x4ca410
movzx eax, word [esi + 4]
push eax
call fcn.0048e2c0
test al, al
jne 0x4ca410
movzx eax, word [esi - 2]
push eax
call fcn.0048e2c0
test al, al
jne 0x4ca41f
push str..tar
push ebx
call fcn.00491ab0
test eax, eax
jne 0x4ca424
xor eax, eax
mov word [ebx], ax
sub esi, 2
lea eax, [esp + 0x14]
cmp esi, eax
jbe 0x4ca446
nop
cmp word [esi], 0x2e
jne 0x4ca446
xor eax, eax
mov word [esi], ax
sub esi, 2
lea eax, [esp + 0x14]
cmp esi, eax
ja 0x4ca430
push 0x800
lea eax, [esp + 0x18]
push eax
call fcn.00478eb0
push eax
push 0x594488
call fcn.0048e710
push 0x594488
call fcn.004c42c0
push 0
push 0x594488
call fcn.00478c30
cmp byte [esp + 0x202c], 0
jne 0x4ca487
cmp byte [esp + 0x13], 0
je 0x4ca4ae
push 1
push str.AppendName
push str.Extraction
call fcn.0049fd30
test eax, eax
je 0x4ca4ae
push ebp
lea eax, [esp + 0x18]
push eax
call fcn.00478eb0
push eax
push edi
call fcn.0048e6d0
push edi
call fcn.004c42c0
push 0
push edi
call fcn.00478c30
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x2008
ret 0x1c
Function at 0x4ca4e0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1008
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x100c]
lea ecx, [esp]
push 0x800
push ecx
push eax
mov ecx, 0x55d4d8
call fcn.00440000
push 0x802
lea eax, [esp + 4]
push eax
call fcn.00477290
push 0x802
push 0x50bc14
lea eax, [esp + 8]
push eax
call fcn.0048e6d0
push 1
push 0x50b8c4
push 0
lea eax, [esp + 0xc]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1008
ret 4

Function at 0x4cb610
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x325c
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x3258], eax
cmp byte [esp + 0x3264], 0
mov dword [0x538a08], 1
je 0x4cb783
push esi
push 0
push 0x800
lea eax, [esp + 0x1264]
push eax
call fcn.004c3a00
push 0x800
lea eax, [esp + 0x1260]
push eax
call fcn.00477290
lea eax, [esp + 0x125c]
push eax
push str._sRar_
lea eax, [esp + 0x2264]
push 0x800
push eax
call fcn.004028e0
add esp, 0x10
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x2260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4cb77b
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push ebx
cmp dword [0x538a08], 1
jne 0x4cb778
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0x20]
cmp eax, 8
lea eax, [esp + 0x1268]
push 0x800
push eax
lea eax, [esp + 0x270]
setae bh
push eax
call fcn.0048e710
push 0x800
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x270]
push eax
call fcn.0048e6d0
test byte [esp + 0x18], 0x10
je 0x4cb75b
push 6
lea eax, [esp + 0x48]
push str.Rar_DI
push eax
call fcn.004f2e5f
add esp, 0xc
test eax, eax
lea eax, [esp + 0x268]
sete bl
push eax
call ebp
test eax, eax
jne 0x4cb768
test bh, bh
je 0x4cb748
cmp byte [esp + 0x3270], al
je 0x4cb74c
test bl, bl
je 0x4cb768
lea eax, [esp + 0x268]
push eax
call fcn.004c3220
jmp 0x4cb768
lea eax, [esp + 0x268]
push eax
call fcn.004c3150
lea eax, [esp + 0x18]
push eax
push esi
call edi
test eax, eax
jne 0x4cb6c1
pop ebx
pop edi
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp byte [esp + 0x3260], 0
jne 0x4cb7b1
cmp byte [0x5656f4], 0
je 0x4cb7b1
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004d5610
mov byte [0x5656f4], al
mov ecx, dword [esp + 0x3258]
xor ecx, esp
mov dword [0x538a08], 0
call fcn.004ebbd8
add esp, 0x325c
ret 8
Function at 0x4ce790
Capabilities:
Delete file

Disassembly:
mov eax, 0x1110
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x110c], eax
cmp byte [0x55e51a], 0
jne 0x4ce9e1
cmp byte [esp + 0x1114], 0
jne 0x4ce7db
call fcn.004cea00
mov ecx, dword [esp + 0x110c]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1110
ret 4
push ebp
push edi
xor edi, edi
mov ecx, 0x55d4d8
push edi
xor ebp, ebp
mov dword [esp + 0x10c0], edi
mov dword [esp + 0x10c4], edi
call fcn.0043fa90
lea eax, [esp + 0x2c]
mov ecx, 0x55d4d8
push eax
call fcn.0043fa90
test al, al
je 0x4ce83a
lea ecx, [ecx]
lea eax, [esp + 0xb]
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004d2b80
test al, al
lea eax, [esp + 0x2c]
jne 0x4ce961
push eax
mov ecx, 0x55d4d8
call fcn.0043fa90
test al, al
jne 0x4ce810
push ebx
push esi
push 0
mov ecx, 0x55d4d8
call fcn.0043fa90
lea eax, [esp + 0x34]
mov ecx, 0x55d4d8
push eax
call fcn.0043fa90
test al, al
je 0x4ce9b4
nop
lea ecx, [esp + 0x34]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ce867
sub ecx, edx
sar ecx, 1
lea ebx, [ecx + edi]
lea eax, [ebx*2 + 4]
push eax
push ebp
call fcn.004f2533
mov esi, eax
add esp, 8
test esi, esi
je 0x4ce9d4
lea ecx, [esp + 0x34]
mov ebp, esi
lea edx, [edi + edi]
mov eax, ecx
sub edx, eax
add edx, esi
movzx eax, word [ecx]
lea ecx, [ecx + 2]
mov word [edx + ecx - 2], ax
test ax, ax
jne 0x4ce8a3
lea eax, [esp + 0x34]
mov ecx, 0x55d4d8
push eax
lea edi, [ebx + 1]
call fcn.0043fa90
test al, al
jne 0x4ce860
test edi, edi
je 0x4ce9b4
xor eax, eax
mov word [esi + edi*2], ax
inc dword [0x539a60]
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov eax, dword [0x538900]
mov dword [esp + 0x14], eax
mov eax, 0x40
mov word [esp + 0x24], ax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], 3
mov dword [esp + 0x20], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
push esi
sete bl
dec dword [0x539a60]
call fcn.004f252e
add esp, 4
test bl, bl
je 0x4ce9dd
cmp dword [esp + 0x26], 0
jne 0x4ce9dd
mov ecx, 0x543e78
call fcn.004aced0
push 0x50b8c4
mov ecx, 0x55d4d8
call fcn.00442c60
jmp 0x4ce9dd
push 0x64
push eax
call fcn.00445730
push eax
push 0x203
call fcn.00488530
push eax
call fcn.004cf640
add esp, 8
push 0x204
call fcn.00488530
push eax
call fcn.004cf7d0
movzx eax, byte [esp + 0xf]
add esp, 4
neg eax
sbb eax, eax
and eax, 0xffffff87
add eax, 0xce
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x56df60
call fcn.00463320
jmp 0x4ce9df
push 0x30
push 0x65
call fcn.00488530
push eax
push 0x14c
call fcn.00488530
push eax
push dword [0x538900]
call fcn.004c4910
push ebp
call fcn.004f252e
add esp, 4
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x110c]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x1110
ret 4
Function at 0x4cedd0
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x2cc], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2e4]
mov eax, dword [edi + 0x2c]
add eax, 0x41
push eax
push str._c:_
lea eax, [esp + 0x2d0]
push 0xa
push eax
call fcn.004028e0
add esp, 0x10
lea eax, [esp + 0x14]
push 0x301
push 0x2b4
push eax
push 0
lea eax, [esp + 0x2d8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [edi + 0x10], 1
je 0x4cee5a
mov esi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call esi
push eax
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov ebx, eax
call esi
push eax
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebp, eax
jmp 0x4cee62
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
push 0
push 0
push 0x50b8c4
lea eax, [edi + 0x1c]
push eax
push 2
push dword [edi + 0x20]
push dword [eax]
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call esi
push 0x32
mov dword [esp + 0x14], eax
call esi
mov esi, dword [esp + 0x10]
push 3
push 0
push 0
push eax
push esi
push dword [esp + 0x28]
push dword [edi + 0x20]
push dword [edi + 0x1c]
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0x104
lea eax, [esp + 0x24]
push eax
call fcn.004c4860
lea ecx, [esp + 0x20]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4ceed0
sub ecx, edx
lea eax, [esp + 0x20]
sar ecx, 1
push ecx
push eax
mov eax, dword [edi + 0x20]
add eax, 2
push eax
mov eax, dword [edi + 0x1c]
add eax, 7
add eax, esi
push eax
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [edi + 0x10], 1
je 0x4cef18
push ebx
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_SetBkColor]
push ebp
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2dc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x2d0
ret 4
Function at 0x4cef40
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
mov eax, 0x100c
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x539a60], 0
push ebx
mov ebx, dword [esp + 0x1014]
jne 0x4cf084
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x4cf02b
xor eax, eax
push 0x800
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
push eax
push 0
push ebx
call ebp
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x53898c], 0
je 0x4cefdb
cmp byte [esp + 0x1020], 0
jne 0x4cf004
cmp eax, dword [0x55d500]
je 0x4cf004
cmp eax, dword [0x543e7c]
je 0x4cf004
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4cf004
push 1
lea eax, [esp + 0x18]
mov ecx, 0x55d4d8
push eax
call fcn.00440680
cmp eax, 1
je 0x4cf082
push 7
push str.rarreg.
lea eax, [esp + 0x1c]
push eax
call fcn.00478eb0
push eax
call fcn.00491b00
test eax, eax
jne 0x4cf02b
lea eax, [esp + 0x14]
push eax
call fcn.004d2930
jmp 0x4cf082
push esi
push 0
call fcn.004bf8d0
mov ecx, 0x55029c
call fcn.0048e9d0
xor esi, esi
test edi, edi
jle 0x4cf065
push 0x800
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea eax, [esp + 0x18]
mov ecx, 0x55029c
push eax
call fcn.0048e7f0
inc esi
cmp esi, edi
jl 0x4cf043
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
push 1
and al, 1
or byte [0x54a026], al
push 0
call fcn.004ba420
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x100c]
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x100c
ret 8
Function at 0x4d2930
Capabilities:
Copy file

Disassembly:
mov eax, 0x2004
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp byte [0x5656f4], 0
push esi
mov esi, dword [esp + 0x200c]
je 0x4d298e
cmp byte [0x54a00c], 0
jne 0x4d298e
push 0x24
push 0x5f0
call fcn.00488530
push eax
push 0x5f1
call fcn.00488530
push eax
push dword [0x538900]
call fcn.004c4910
cmp eax, 6
jne 0x4d2aed
push ebx
push 0x800
lea eax, [esp + 0x100c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea eax, [esp + 0x1010]
push eax
call fcn.00478fb0
push 0
lea eax, [esp + 0x100c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
test eax, eax
lea eax, [esp + 0xc]
push 0x800
push eax
setne bl
call fcn.004783d0
push 0x800
lea eax, [esp + 0xc]
push eax
call fcn.00477290
push 0x800
push str.rarreg.key
lea eax, [esp + 0x10]
push eax
call fcn.0048e6d0
test bl, bl
lea eax, [esp + 8]
pop ebx
je 0x4d2a16
push eax
call fcn.00468f10
jmp 0x4d2a45
push 0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
xor ecx, ecx
jmp 0x4d2a30
movzx eax, word [esp + ecx + 4]
lea ecx, [ecx + 2]
mov word [esp + ecx + 0x1002], ax
test ax, ax
jne 0x4d2a30
push dword [0x538900]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push dword [0x538900]
call esi
push 1
lea eax, [esp + 0x1008]
push eax
call fcn.0045b980
push 0
push dword [0x538900]
mov byte [0x5656f4], al
call esi
mov ecx, 0x55d4d8
call fcn.004437b0
cmp byte [0x5656f4], 0
je 0x4d2acd
push 0x30
push 0x368
call fcn.00488530
push eax
push 0x367
call fcn.00488530
push eax
push dword [0x538900]
call fcn.004c4910
pop esi
mov ecx, dword [esp + 0x2000]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x2004
ret 4
lea eax, [esp + 0x1004]
push eax
call fcn.00468f10
push 0x366
call fcn.00488530
push eax
call fcn.004cf640
add esp, 4
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.004ebbd8
add esp, 0x2004
ret 4
Function at 0x4d2b80
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
mov edi, dword [esp + 0x14]
push ebx
mov byte [edi], 0
call fcn.00478eb0
push 3
mov esi, eax
push 0x513544
push esi
call fcn.00491b00
test eax, eax
je 0x4d2bb8
push 3
push 0x51354c
push esi
call fcn.00491b00
test eax, eax
jne 0x4d2bdb
movzx eax, word [esi + 6]
push eax
call fcn.004f779e
add esp, 4
test eax, eax
je 0x4d2bdb
movzx eax, word [esi + 8]
cmp eax, 0x2e
je 0x4d2c56
test ax, ax
je 0x4d2c56
push 3
push 0x513554
push esi
call fcn.00491b00
test eax, eax
je 0x4d2c1f
push 3
push 0x51355c
push esi
call fcn.00491b00
test eax, eax
je 0x4d2c1f
push 3
push 0x513564
push esi
call fcn.00491b00
test eax, eax
je 0x4d2c1f
push 3
push 0x50f73c
push esi
call fcn.00491b00
test eax, eax
jne 0x4d2c2d
movzx eax, word [esi + 6]
cmp eax, 0x2e
je 0x4d2c56
test ax, ax
je 0x4d2c56
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4d2c4e
push ebx
call fcn.00469360
test al, al
je 0x4d2c4e
pop edi
pop esi
mov eax, 1
pop ebx
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
ret 8
mov al, 1
mov byte [edi], al
pop edi
pop esi
pop ebx
ret 8
Function at 0x4d4610
Capabilities:
Copy file

Disassembly:
mov eax, 0x3024
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x3020], eax
cmp byte [0x53898c], 0
je 0x4d4804
push ebx
push 0x800
lea eax, [esp + 0x2028]
mov ecx, 0x55a850
push eax
call fcn.00404e00
push 1
push str.History
push str.General
call fcn.0049fd30
test eax, eax
setne bl
test bl, bl
je 0x4d4685
push 0x800
push 0x50b8c4
lea eax, [esp + 0x2c]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.0049fec0
cmp word [esp + 0x24], 0
jne 0x4d4697
lea eax, [esp + 0x24]
push eax
call fcn.0043aa80
push 0x800
lea eax, [esp + 0x1028]
push eax
lea eax, [esp + 0x202c]
push eax
call fcn.00478eb0
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004789f0
push 1
push 0
lea eax, [esp + 0x102c]
push eax
push 0x5af
call fcn.00488530
push eax
push dword [0x538900]
call fcn.00407460
test al, al
je 0x4d4803
push 0x800
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x102c]
push eax
call fcn.00478280
test bl, bl
je 0x4d4715
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.004a08d0
lea ecx, [esp + 0x2024]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d4720
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x7ff
jb 0x4d473d
mov ecx, 0x7ff
add ecx, ecx
cmp ecx, 0x1000
jae 0x4d4819
xor eax, eax
mov word [esp + ecx + 0x2024], ax
lea ecx, [esp + 0x1024]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4d4760
sub ecx, edx
sar ecx, 1
inc ecx
cmp ecx, 0x7ff
jb 0x4d477d
mov ecx, 0x7ff
add ecx, ecx
cmp ecx, 0x1000
jae 0x4d4819
xor eax, eax
mov dword [esp + 8], 2
mov word [esp + ecx + 0x1024], ax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x2024]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1024]
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4d4803
cmp dword [esp + 0x16], 0
jne 0x4d4803
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0x5b0
call fcn.00488530
push eax
call fcn.004cf640
add esp, 0xc
mov ecx, 0x56df60
call fcn.00463320
pop ebx
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.004ebbd8
add esp, 0x3024
ret
call fcn.004ebafc
int3
Function at 0x4d56e0
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x35d8
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x35d4], eax
cmp dword [0x5278d8], 0xffffffff
push ebx
mov ebx, dword [esp + 0x35e4]
push ebp
mov ebp, dword [esp + 0x35f0]
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push edi
mov edi, dword [esp + 0x35ec]
jne 0x4d5786
push 0x4001
push 0x2b4
lea eax, [esp + 0x84]
push eax
push 0
push 0x50bc14
call esi
mov eax, dword [esp + 0x80]
mov dword [0x599490], eax
lea eax, [esp + 0x25e4]
push 0x800
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x84]
push eax
push 0
lea eax, [esp + 0x25f4]
push eax
call esi
mov eax, dword [esp + 0x80]
mov dword [0x5278d8], eax
push 0x800
push ebx
lea eax, [esp + 0x5ec]
push eax
call fcn.0048e710
push 0x800
lea eax, [esp + 0x5e8]
push eax
push eax
call fcn.00479040
cmp word [edi], 0
lea eax, [esp + 0x5e4]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x330]
setne bl
mov dword [esp + 0x14], 3
mov byte [esp + 0x13], bl
mov dword [esp + 0x18], 0x40000000
mov dword [esp + 0x1c], 0
test bl, bl
je 0x4d5802
push 0x4011
push 0x2b4
push eax
movzx eax, byte [esp + 0x3600]
neg eax
sbb eax, eax
and eax, 0x10
push eax
jmp 0x4d580f
push 0x4001
push 0x2b4
push eax
push 0
lea eax, [esp + 0x5f4]
push eax
call esi
mov eax, dword [esp + 0x334]
mov dword [esp + 0x30], eax
push 0x800
test bl, bl
je 0x4d583d
push edi
lea eax, [esp + 0x15ec]
push eax
call fcn.0048e710
jmp 0x4d5870
lea eax, [esp + 0x5e8]
push eax
lea eax, [esp + 0x15ec]
push eax
call fcn.0048e710
lea eax, [esp + 0x15e4]
push eax
call fcn.00478f10
lea eax, [esp + 0x5e4]
push eax
call fcn.00478eb0
mov dword [esp + 0x28], eax
push 0x66
push dword [0x53890c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov esi, eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x104d
push esi
call edi
cmp byte [esp + 0x13], 0
mov ebx, eax
lea eax, [esp + 0x15e4]
mov dword [esp + 0x14], 3
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], eax
je 0x4d58c9
mov ecx, dword [0x5278d8]
mov dword [esp + 0x30], ecx
jmp 0x4d58d2
mov eax, dword [0x599490]
mov dword [esp + 0x30], eax
lea eax, [esp + 0x14]
push eax
push 0
push 0x104c
push esi
call edi
push ebp
mov dword [esp + 0x54], 2
call fcn.0048e0b0
mov dword [esp + 0x5c], eax
lea eax, [esp + 0x48]
push eax
push ebx
push 0x1074
push esi
call edi
test ebx, ebx
jne 0x4d5923
lea eax, [esp + 0x48]
mov dword [esp + 0x58], 1
push eax
push ebx
push 0x102b
push esi
mov dword [esp + 0x64], 1
call edi
mov ecx, dword [esp + 0x35e4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004ebbd8
add esp, 0x35d8
ret 0x10
Function at 0x4d7df0
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.004ebbf0
mov eax, dword [0x528af4]
xor eax, esp
mov dword [esp + 0x2000], eax
push edi
push 0x1000
push 0
lea eax, [esp + 0x100c]
push eax
push str.rarreg.key
push 0x50b8c4
call fcn.0049fd50
mov edi, eax
test edi, edi
je 0x4d7e86
push esi
push 0x800
lea eax, [esp + 0xc]
push eax
push 0x514c50
call fcn.004c3d00
mov esi, eax
test esi, esi
je 0x4d7e76
push esi
push edi
lea eax, [esp + 0x1010]
push 1
push eax
call fcn.004f2dfc
push esi
call fcn.004f2a17
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.004d2930
lea eax, [esp + 8]
push eax
call fcn.00468f10
push str.rarreg.key
push 0x50b8c4
call fcn.0049f910
pop esi
mov ecx, dword [esp + 0x2004]
pop edi
xor ecx, esp
call fcn.004ebbd8
add esp, 0x2004
ret