joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fe650
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1018
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x1014], eax
push esi
mov esi, dword [esp + 0x1020]
push edi
mov edi, dword [esp + 0x1028]
push esi
call fcn.004a2df0
test al, al
je 0x4fe6ef
movzx eax, word [esi]
push eax
push 0x56c0b4
lea eax, [esp + 0x10]
push 0xa
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [esp + 0x1c]
push 0x800
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4fe6d6
cmp eax, 0x800
jae 0x4fe6d6
cmp word [esp + 0x1c], 0x25
je 0x4fe6d6
push dword [esp + 0x102c]
lea eax, [esp + 0x20]
push eax
push edi
call fcn.004bdae0
jmp 0x4fe6ef
movzx eax, word [esi]
push eax
push str._c:_
push dword [esp + 0x1034]
push edi
call fcn.00404ce0
add esp, 0x10
mov ecx, dword [esp + 0x101c]
pop edi
pop esi
xor ecx, esp
call fcn.00530218
add esp, 0x1018
ret 0xc
Function at 0x4fe850
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5543a7
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x58cb30]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x56980c
push dword [ebp + 8]
push dword [0x5d3758]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x4fe9e8
push esi
push dword [0x5d3758]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x4fe9e8
push esi
push dword [0x5d3758]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4fe9e8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4fe9e8
push edi
push 2
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x4fe9d1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x4fe9ca
push edi
push esi
push eax
call fcn.00531d40
add esp, 0xc
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4fe9c3
mov esi, dword [ebp - 0x10]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], 0
test edi, edi
je 0x4fe96d
mov dword [edi], 0x56c0a4
mov byte [ebp - 4], 1
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [edi], 0x56c0ac
mov dword [ebp - 0x14], 0
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [edi + 8], eax
mov eax, dword [ebp - 0x14]
mov dword [edi + 4], eax
mov byte [ebp - 4], 0
jmp 0x4fe96f
xor edi, edi
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x55770c]
call esi
test edi, edi
je 0x4fe9c3
mov eax, dword [edi + 8]
mov dword [edi + 8], 0
test eax, eax
jne 0x4fe9b1
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0xffffff
push eax
lea eax, [ebp - 0x14]
mov ecx, edi
push eax
call fcn.004fe710
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x55770c]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4ff080
Capabilities:
Set environment variable

Disassembly:
sub esp, 0x18
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
mov esi, dword [esp + 0x20]
push esi
call fcn.004a2df0
test al, al
je 0x4ff0c1
movzx eax, word [esi]
push eax
push 0x56c0c8
lea eax, [esp + 0xc]
push 0xa
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [esp + 4]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
call fcn.00530218
add esp, 0x18
ret 4
Function at 0x4ff0e0
Capabilities:
Set current directory

Disassembly:
push ebx
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
setne bl
test eax, eax
jne 0x4ff115
push dword [esp + 8]
push 0x627
call fcn.004b7300
push eax
call fcn.005037c0
add esp, 8
mov ecx, 0x5d381c
call fcn.004885d0
mov al, bl
pop ebx
ret 4
Function at 0x502300
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x404
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x400], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x414]
lea eax, [esp + 0xc]
push 0x200
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [0x5f9aa0], 0
mov ebx, 0x200
je 0x502390
push ebx
push 0x55d234
lea eax, [esp + 0x14]
push eax
call fcn.004bda80
lea esi, [esp + 0xc]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x502357
push 0x5f9aa0
sub esi, ecx
push 0x5aa
sar esi, 1
call fcn.004b7300
push eax
mov eax, ebx
sub eax, esi
push 0x568e2c
push eax
lea eax, [esp + 0x1c]
lea eax, [eax + esi*2]
push eax
call fcn.00404ce0
add esp, 0x14
cmp byte [0x5f9a51], 0
je 0x5023e8
push 0x200
push 0x55d234
lea eax, [esp + 0x14]
push eax
call fcn.004bda80
lea esi, [esp + 0xc]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x5023b4
push dword [esp + 0x418]
sub esi, ecx
push 0x2fd
sar esi, 1
call fcn.004b7300
push eax
sub ebx, esi
lea eax, [esp + 0x14]
lea eax, [eax + esi*2]
push ebx
push eax
call fcn.00404ce0
add esp, 0x10
push 0x80
lea eax, [esp + 0x10]
push eax
call fcn.004d8c60
push 0x80
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 0x18]
push eax
call fcn.004bdae0
mov ecx, dword [esp + 0x40c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x404
ret 8

Function at 0x502bb0
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1404
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x1400], eax
mov eax, dword [esp + 0x1408]
push esi
mov esi, dword [esp + 0x1410]
push edi
push eax
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
lea eax, [esp + 8]
push 0xa00
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea edx, [esp + 8]
mov ecx, esi
mov edi, edi
mov ax, word [ecx]
cmp ax, word [edx]
jne 0x502c26
test ax, ax
je 0x502c22
mov ax, word [ecx + 2]
cmp ax, word [edx + 2]
jne 0x502c26
add ecx, 4
add edx, 4
test ax, ax
jne 0x502c00
xor eax, eax
jmp 0x502c2b
sbb eax, eax
or eax, 1
test eax, eax
je 0x502c37
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esp + 0x1408]
pop edi
pop esi
xor ecx, esp
call fcn.00530218
add esp, 0x1404
ret 8
Function at 0x502c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5544e1
mov eax, dword fs:[0]
push eax
sub esp, 0x7c0
mov eax, dword [0x58cb30]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [0x5943e8], 0
je 0x502e40
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6355f8]
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x5fb014]
cmp eax, dword [ecx + 4]
jg 0x502e5a
push 0x64
mov ecx, 0x5fb010
call fcn.00463870
test al, al
jne 0x502cc5
mov byte [0x5f9a50], 1
jmp 0x502e40
push 0x200
lea eax, [ebp - 0x410]
mov byte [0x5f9a50], 0
push eax
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [0x5f644c]
cmp eax, 0xa
je 0x502dc6
cmp eax, 9
je 0x502dc6
mov edx, 0x5f8450
lea ecx, [ebp - 0x410]
mov si, word [ecx]
cmp si, word [edx]
jne 0x502d2c
test si, si
je 0x502d28
mov si, word [ecx + 2]
cmp si, word [edx + 2]
jne 0x502d2c
add ecx, 4
add edx, 4
test si, si
jne 0x502d06
xor ecx, ecx
jmp 0x502d31
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x502dc6
push 0x5f8450
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x5f644c]
cmp eax, 3
jne 0x502ddf
cmp dword [0x5f6448], 0
je 0x502dcb
push 0x3ac
lea eax, [ebp - 0x7bc]
push 0
push eax
call fcn.00532770
mov eax, dword [0x5943e8]
add esp, 0xc
mov dword [ebp - 0x7c8], eax
lea eax, [ebp - 0x7cc]
mov dword [ebp - 0x7cc], 0x3bc
mov dword [ebp - 0x7c4], 0x7b
push dword [0x5f9b04]
mov dword [ebp - 0x7c0], 4
push eax
call fcn.00502300
lea eax, [ebp - 0x7cc]
push eax
push 1
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov eax, dword [0x5f644c]
cmp eax, 3
jne 0x502ddf
push 0x5f9550
push 0x9d
call fcn.00502bb0
mov eax, dword [0x5f644c]
test eax, eax
je 0x502df2
cmp eax, 1
je 0x502df2
cmp eax, 2
je 0x502df2
cmp eax, 0xa
jne 0x502e34
push 0x5f9550
push 0x9d
call fcn.00502bb0
push 0x5f6450
call fcn.004a3770
push eax
push 0x9c
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push 0x9c
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call fcn.004d8ef0
push dword [0x5943e8]
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00530218
mov esp, ebp
pop ebp
ret
push 0x5fb014
call fcn.00530ada
add esp, 4
cmp dword [0x5fb014], 0xffffffff
jne 0x502ca9
mov dword [ebp - 4], 0
mov dword [0x5fb010], 0
mov dword [ebp - 4], 0xffffffff
push 0x5fb014
call fcn.00530a90
add esp, 4
jmp 0x502ca9
Function at 0x5075f0
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2008
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x2004], eax
cmp byte [esp + 0x2024], 0
push ebx
mov ebx, dword [esp + 0x201c]
push ebp
mov ebp, dword [esp + 0x2018]
push esi
mov esi, dword [esp + 0x2020]
push edi
mov edi, dword [esp + 0x201c]
je 0x50768d
push 0x800
push esi
push edi
push str.DefFolder
push str.Extraction
call fcn.004d0210
cmp word [edi], 0
jne 0x507658
push ebp
push esi
push edi
call fcn.004bdae0
jmp 0x50768d
push 0x800
lea eax, [esp + 0x1018]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x507688
cmp eax, 0x800
jae 0x507688
push ebp
lea eax, [esp + 0x1018]
push eax
push edi
call fcn.004bdae0
jmp 0x50768d
xor eax, eax
mov word [edi], ax
movzx eax, word [edi]
mov ecx, eax
mov dword [esp + 0x10], ecx
test ax, ax
jne 0x5076a7
push ebp
push edi
mov ecx, 0x5c6810
call fcn.0045d220
push ebp
push edi
call fcn.004a1860
push 0x800
push ebx
lea eax, [esp + 0x1c]
push eax
call fcn.004bdae0
mov ax, word [esp + 0x14]
xor ebx, ebx
test ax, ax
je 0x50770f
xor ecx, ecx
movzx edx, ax
lea esi, [esp + 0x14]
lea ebp, [ebx + 0x5f]
cmp dx, 0x25
jne 0x5076f4
lea eax, [esp + 0x16]
add eax, ecx
push 0x25
push eax
call fcn.005317e5
add esp, 8
test eax, eax
je 0x5076f4
mov word [esi], bp
inc ebx
lea esi, [esp + 0x14]
lea ecx, [ebx + ebx]
add esi, ecx
movzx eax, word [esi]
mov edx, eax
test ax, ax
jne 0x5076d6
mov ebp, dword [esp + 0x2020]
lea eax, [esp + 0x14]
push eax
call fcn.004a2790
mov esi, eax
test esi, esi
je 0x5077aa
lea eax, [esp + 0x14]
cmp esi, eax
jbe 0x5077aa
xor eax, eax
mov word [esi], ax
lea eax, [esp + 0x14]
push eax
call fcn.004a2790
mov ebx, eax
test ebx, ebx
je 0x507789
lea eax, [esp + 0x14]
cmp ebx, eax
jbe 0x507789
cmp byte [esp + 0x2030], 0
je 0x507775
cmp word [esi + 2], 0
je 0x507775
movzx eax, word [esi + 4]
push eax
call fcn.004bd6b0
test al, al
jne 0x507775
movzx eax, word [esi - 2]
push eax
call fcn.004bd6b0
test al, al
jne 0x507784
push str..tar
push ebx
call fcn.004c1ba0
test eax, eax
jne 0x507789
xor eax, eax
mov word [ebx], ax
sub esi, 2
lea eax, [esp + 0x14]
cmp esi, eax
jbe 0x5077aa
cmp word [esi], 0x2e
jne 0x5077aa
xor eax, eax
mov word [esi], ax
sub esi, 2
lea eax, [esp + 0x14]
cmp esi, eax
ja 0x507794
push 0x800
lea eax, [esp + 0x18]
push eax
call fcn.004a3770
push eax
push 0x5ff880
call fcn.004bdae0
push 0x5ff880
call fcn.004fdb40
push 0
push 0x5ff880
call fcn.004a34a0
cmp byte [esp + 0x202c], 0
jne 0x5077ec
cmp word [esp + 0x10], 0
je 0x507813
push 1
push str.AppendName
push str.Extraction
call fcn.004cffa0
test eax, eax
je 0x507813
push ebp
lea eax, [esp + 0x18]
push eax
call fcn.004a3770
push eax
push edi
call fcn.004bda80
push edi
call fcn.004fdb40
push 0
push edi
call fcn.004a34a0
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x2008
ret 0x1c
Function at 0x507840
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1008
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x1004], eax
mov eax, dword [esp + 0x100c]
lea ecx, [esp]
push 0x800
push ecx
push eax
mov ecx, 0x5c6810
call fcn.0045dd10
push 0x802
lea eax, [esp + 4]
push eax
call fcn.004a1860
push 0x802
push 0x558b90
lea eax, [esp + 8]
push eax
call fcn.004bda80
push 1
push 0x558718
push 0
lea eax, [esp + 0xc]
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x1004]
xor ecx, esp
call fcn.00530218
add esp, 0x1008
ret 4

Function at 0x508850
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x325c
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x3258], eax
cmp byte [esp + 0x3264], 0
push ebx
mov bh, byte [esp + 0x3264]
mov dword [0x5943fc], 1
je 0x5089be
push edi
push 0
push 0x800
lea eax, [esp + 0x1268]
push eax
call fcn.004fd1a0
push 0x800
lea eax, [esp + 0x1264]
push eax
call fcn.004a1860
lea eax, [esp + 0x1260]
push eax
push str._sRar_
lea eax, [esp + 0x2268]
push 0x800
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x2264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x5089b6
push esi
jmp 0x508900
cmp dword [0x5943fc], 1
jne 0x5089b5
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x1264]
sub esi, dword [esp + 0x1c]
push 0x800
push eax
lea eax, [esp + 0x26c]
push eax
call fcn.004bdae0
push 0x800
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x26c]
push eax
call fcn.004bda80
test byte [esp + 0x14], 0x10
je 0x508994
push 6
lea eax, [esp + 0x44]
push str.Rar_DI
push eax
call fcn.0053968d
add esp, 0xc
test eax, eax
lea eax, [esp + 0x264]
sete bl
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x5089a1
cmp esi, 8
jb 0x508981
test bh, bh
je 0x508985
test bl, bl
je 0x5089a1
lea eax, [esp + 0x264]
push eax
call fcn.004fc940
jmp 0x5089a1
lea eax, [esp + 0x264]
push eax
call fcn.004fc870
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x508900
pop esi
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
test bh, bh
pop ebx
jne 0x508a5c
call fcn.0047f3b0
test al, al
je 0x508a5c
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.0047f3c0
test al, al
je 0x5089f4
mov byte [esp], 1
jmp 0x508a54
push 0xfff
push 0
lea eax, [esp + 0x1260]
push eax
push str.rarkey
push 0x558718
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004cfdc0
test eax, eax
jne 0x508a41
push 0x1000
push eax
lea eax, [esp + 0x1260]
push eax
push str.rarkey
push 0x558718
call fcn.004d0040
test eax, eax
jne 0x508a41
mov byte [esp], al
jmp 0x508a54
push 1
push eax
lea eax, [esp + 0x1260]
push eax
call fcn.0047ea60
mov byte [esp], al
push dword [esp]
call fcn.0047f600
mov ecx, dword [esp + 0x3258]
xor ecx, esp
mov dword [0x5943fc], 0
call fcn.00530218
add esp, 0x325c
ret 8
Function at 0x50dc60
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d0
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x2cc], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2e4]
mov eax, dword [edi + 0x2c]
add eax, 0x41
push eax
push str._c:_
lea eax, [esp + 0x2d0]
push 0xa
push eax
call fcn.00404ce0
add esp, 0x10
lea eax, [esp + 0x14]
push 0x301
push 0x2b4
push eax
push 0
lea eax, [esp + 0x2d8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [edi + 0x10], 1
je 0x50dcec
push 0xd
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov ebx, eax
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebp, eax
jmp 0x50dcf4
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x10]
push 0
push 0
push 0x558718
lea eax, [edi + 0x1c]
push eax
push 2
push dword [edi + 0x20]
push dword [eax]
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_ExtTextOutW]
push 0x31
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x32
mov dword [esp + 0x14], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 3
push 0
push 0
push eax
push dword [esp + 0x20]
push dword [esp + 0x28]
push dword [edi + 0x20]
push dword [edi + 0x1c]
push dword [edi + 0x18]
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_DestroyIcon]
push 0x104
lea eax, [esp + 0x24]
push eax
call fcn.004fe5a0
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x50dd63
mov ecx, dword [esp + 0x10]
sub eax, edx
sar eax, 1
add ecx, 7
push eax
lea eax, [esp + 0x24]
push eax
mov eax, dword [edi + 0x20]
add eax, 2
push eax
mov eax, dword [edi + 0x1c]
add eax, ecx
push eax
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [edi + 0x10], 1
je 0x50ddaf
push ebx
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_SetBkColor]
push ebp
push dword [edi + 0x18]
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2dc]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00530218
add esp, 0x2d0
ret 4
Function at 0x50de70
Capabilities:
Get file attributes
List drag and drop files
Open clipboard
Read clipboard data

Disassembly:
mov eax, 0x200c
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x2008], eax
push ebp
mov ebp, dword [esp + 0x2014]
push edi
mov edi, ebp
test ebp, ebp
jne 0x50deb0
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x50e013
push 0xf
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
push ebx
test edi, edi
je 0x50df85
cmp dword [0x5933dc], 0
je 0x50df85
cmp dword [0x5933d8], 0
jne 0x50df85
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
mov ebx, eax
cmp ebx, 1
jne 0x50df93
xor eax, eax
push 0x800
mov word [esp + 0x18], ax
lea eax, [esp + 0x18]
push eax
push 0
push edi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x5943f4], 0
je 0x50df3b
test ebp, ebp
je 0x50df60
cmp eax, dword [0x5c6838]
je 0x50df60
cmp eax, dword [0x59545c]
je 0x50df60
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x50df60
push 1
lea eax, [esp + 0x18]
mov ecx, 0x5c6810
push eax
call fcn.0045e1d0
cmp eax, 1
je 0x50df85
push 7
push 0x56da70
lea eax, [esp + 0x1c]
push eax
call fcn.004a3770
push eax
call fcn.004c1bf0
test eax, eax
jne 0x50df93
lea eax, [esp + 0x14]
push eax
call fcn.00510a60
xor bl, bl
test ebp, ebp
jne 0x50dfe1
call dword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x50dfe8
push esi
push 0
call fcn.004f84c0
mov ecx, 0x5b432c
call fcn.004bddc0
xor esi, esi
test ebx, ebx
je 0x50dfdc
jmp 0x50dfb0
push 0x800
lea eax, [esp + 0x101c]
push eax
push esi
push edi
call dword [sym.imp.SHELL32.dll_DragQueryFileW]
lea eax, [esp + 0x1018]
mov ecx, 0x5b432c
push eax
call fcn.004bdbd0
inc esi
cmp esi, ebx
jb 0x50dfb0
mov bl, 1
pop esi
jmp 0x50df87
push edi
call dword [sym.imp.SHELL32.dll_DragFinish]
test bl, bl
pop ebx
je 0x50e013
cmp byte [esp + 0x201c], 0
je 0x50dffe
mov byte [0x5abf72], 1
push 0
push 0
push 0x800e
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_PostMessageW]
mov ecx, dword [esp + 0x2010]
pop edi
pop ebp
xor ecx, esp
call fcn.00530218
add esp, 0x200c
ret 8
Function at 0x510a60
Capabilities:
Copy file

Disassembly:
mov eax, 0x2008
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x2004], eax
push esi
push edi
mov edi, dword [esp + 0x2014]
call fcn.0047f3b0
test al, al
je 0x510ac1
cmp byte [0x5abf54], 0
jne 0x510ac1
push 0x5f0
call fcn.004b7300
push 0x5f1
mov esi, eax
call fcn.004b7300
push 0x24
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
cmp eax, 6
jne 0x510c03
push 0x800
lea eax, [esp + 0x1010]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea eax, [esp + 0x1014]
push eax
call fcn.004a3880
push 0
lea eax, [esp + 0x1010]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 1
mov esi, eax
lea eax, [esp + 0x10]
push 0x800
push eax
call fcn.004a2900
push 0x800
lea eax, [esp + 0x10]
push eax
call fcn.004a1860
push 0x800
push str.rarreg.key
lea eax, [esp + 0x14]
push eax
call fcn.004bda80
lea eax, [esp + 0xc]
test esi, esi
je 0x510b44
push eax
call fcn.00490db0
jmp 0x510b65
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0x800
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1014]
push eax
call fcn.004bdae0
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_FlashWindow]
push 1
lea eax, [esp + 0x1010]
push eax
call fcn.0047f1e0
mov byte [esp + 8], al
push dword [esp + 8]
call fcn.0047f600
push 0
push dword [0x5933dc]
call dword [sym.imp.USER32.dll_FlashWindow]
mov ecx, 0x5c6810
call fcn.00461830
call fcn.0047f3b0
test al, al
je 0x510be3
push 0x368
call fcn.004b7300
push 0x367
mov esi, eax
call fcn.004b7300
push 0x40
push esi
push eax
push dword [0x5933dc]
call fcn.004feae0
jmp 0x510c03
lea eax, [esp + 0x100c]
push eax
call fcn.00490db0
push 0x366
call fcn.004b7300
push eax
call fcn.005037c0
add esp, 4
mov ecx, dword [esp + 0x200c]
pop edi
pop esi
xor ecx, esp
call fcn.00530218
add esp, 0x2008
ret 4
Function at 0x5132e0
Capabilities:
Copy file

Disassembly:
mov eax, 0x3024
call fcn.00530230
mov eax, dword [0x58cb30]
xor eax, esp
mov dword [esp + 0x3020], eax
cmp byte [0x5943f4], 0
je 0x5134dd
push ebx
push 0x800
lea eax, [esp + 0x2028]
mov ecx, 0x5c3bd0
push eax
call fcn.004099c0
push 1
push 0x558eb0
push 0x558ad0
call fcn.004cffa0
test eax, eax
setne bl
test eax, eax
je 0x513355
push 0x800
push 0x558718
lea eax, [esp + 0x2c]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.004d0210
cmp word [esp + 0x24], 0
jne 0x51336c
push 0x800
lea eax, [esp + 0x28]
push eax
call fcn.004575a0
push 0x800
lea eax, [esp + 0x1028]
push eax
lea eax, [esp + 0x202c]
push eax
call fcn.004a3770
push eax
lea eax, [esp + 0x30]
push eax
call fcn.004a2fb0
push 0x5af
call fcn.004b7300
push 1
push 0
lea ecx, [esp + 0x102c]
push ecx
push eax
push dword [0x5933dc]
call fcn.0040cb80
test al, al
je 0x5134dc
push 0x800
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x102c]
push eax
call fcn.004a27b0
test bl, bl
je 0x5133ea
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.004d0d50
lea ecx, [esp + 0x2024]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5133f4
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
cmp eax, 0x7ff
jae 0x51341c
add eax, eax
cmp eax, 0x1000
jae 0x5134f2
jmp 0x513421
mov eax, 0xffe
xor ecx, ecx
mov word [esp + eax + 0x2024], cx
lea ecx, [esp + 0x1024]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x513435
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
cmp eax, 0x7ff
jae 0x51345d
add eax, eax
cmp eax, 0x1000
jae 0x5134f2
jmp 0x513462
mov eax, 0xffe
xor ecx, ecx
mov dword [esp + 8], 2
mov word [esp + eax + 0x1024], cx
xor eax, eax
mov word [esp + 0x20], ax
lea eax, [esp + 0x2024]
mov dword [esp + 0xc], eax
lea eax, [esp + 0x1024]
mov dword [esp + 0x10], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 8], ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x5134dc
cmp dword [esp + 0x16], 0
jne 0x5134dc
push dword [esp + 0x10]
push dword [esp + 0x10]
push 0x5b0
call fcn.004b7300
push eax
call fcn.005037c0
add esp, 0xc
mov ecx, 0x5d381c
call fcn.004885d0
pop ebx
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.00530218
add esp, 0x3024
ret
call fcn.0053013d
int3