joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4820a0
Capabilities:
Get disk information
Query environment variable

Disassembly:
mov eax, 0x2c08
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x2c04], eax
push edi
push ebx
call fcn.00455740
push 0x3a
push eax
call fcn.004b0312
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
add esp, 8
test eax, eax
je 0x482103
cmp byte [0x53a4c8], 0
jne 0x482103
push 0x31
push 0x65
call fcn.00465ff0
push eax
push 0x528
call fcn.00465ff0
push eax
push esi
call edi
cmp eax, 1
jne 0x48226f
mov byte [0x53a4c8], al
lea edx, [esp + 0x808]
mov eax, ebx
sub edx, ebx
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x482110
lea eax, [esp + 0x808]
push eax
call fcn.00455cc0
push 0x400
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [esp + 8]
xor eax, eax
push ecx
mov word [esp + 0x80a], ax
call fcn.00455740
cmp word [eax], 0
je 0x4821d2
lea edx, [esp + 8]
push edx
call fcn.00434f20
test al, al
jne 0x4821d2
lea esp, [esp]
push 0x14d
call fcn.00465ff0
push eax
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x1010]
push str.__s__n_s
push ecx
mov edx, 0x600
call fcn.00407130
add esp, 0x10
push 0x34
push 0x65
call fcn.00465ff0
push eax
lea edx, [esp + 0x1010]
push edx
push esi
call edi
cmp eax, 6
jne 0x48226f
push 0
lea eax, [esp + 0xc]
push eax
call fcn.004358d0
lea ecx, [esp + 8]
push ecx
call fcn.00434f20
test al, al
je 0x482170
call fcn.00444190
cmp eax, 0x501
jb 0x482287
lea edx, [esp + 0x2408]
push edx
push ebx
call fcn.00455400
lea eax, [esp + 0x1c08]
push eax
lea ecx, [esp + 0x240c]
push ecx
call fcn.00456b30
push 0
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c24]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x482287
test dword [esp + 4], 0x80000
je 0x482287
lea ecx, [esp + 0x1c08]
push ecx
push 0x3b6
call fcn.00465ff0
push eax
lea edx, [esp + 0x1010]
push edx
mov edx, 0x600
call fcn.00407130
add esp, 0xc
push 0x30
push 0x65
call fcn.00465ff0
push eax
lea eax, [esp + 0x1010]
push eax
push esi
call edi
xor al, al
pop edi
mov ecx, dword [esp + 0x2c04]
xor ecx, esp
call fcn.004af72c
add esp, 0x2c08
ret
mov ecx, dword [esp + 0x2c08]
pop edi
xor ecx, esp
mov al, 1
call fcn.004af72c
add esp, 0x2c08
ret
Function at 0x48a4b0
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
mov dword [esp + 0x1c], eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
push ebx
call edi
push ebx
mov esi, eax
call edi
mov ebp, dword [esp + 0x38]
mov edi, eax
lea eax, [esp + 0x1c]
push eax
push 0x18
push ebp
call dword [sym.imp.GDI32.dll_GetObjectW]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push ecx
push edx
push ebx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov dword [esp + 0x40], eax
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x38]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x24]
push 0xcc0020
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x28]
mov edx, eax
neg edx
push edx
push 0
lea edx, [eax - 1]
push edx
push esi
push ecx
push eax
push 0
push 0
push edi
call dword [sym.imp.GDI32.dll_StretchBlt]
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push 0xcc0020
push 0
push 0
push edi
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push esi
call ebp
mov eax, dword [esp + 0x14]
push eax
push edi
call ebp
mov ecx, dword [esp + 0x38]
push ecx
call dword [sym.imp.GDI32.dll_DeleteObject]
push esi
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
call esi
push edi
call esi
mov edx, dword [esp + 0x18]
push ebx
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4

Function at 0x48a680
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x804
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x800], eax
cmp byte [0x5294b8], 0
push esi
mov esi, dword [esp + 0x80c]
je 0x48a6bd
mov eax, dword [esp + 0x810]
push eax
push esi
push 0x5294b8
call fcn.00476860
jmp 0x48a745
push edi
mov edi, dword [esp + 0x814]
push edi
push 0x4c5d80
push esi
push str.TempFolder
push 0x4c5a44
call fcn.0045fc10
xor ecx, ecx
mov word [esp + 8], cx
cmp word [esi], cx
je 0x48a71a
push 0x400
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x48a708
push edi
lea eax, [esp + 0xc]
push eax
push esi
call fcn.0046f3f0
cmp word [esi], 0
je 0x48a71a
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x48a744
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x48a72c
cmp word [esi], 0
jne 0x48a744
mov eax, str._rartemp
mov edx, esi
sub edx, eax
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x48a735
pop edi
push esi
call fcn.004550c0
mov ecx, dword [esp + 0x804]
pop esi
xor ecx, esp
call fcn.004af72c
add esp, 0x804
ret 8
Function at 0x48b040
Capabilities:
Create directory

Disassembly:
mov eax, 0x1004
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebp
mov ebp, dword [esp + 0x1010]
push esi
push 0x3ff
push eax
lea eax, [esp + 0x810]
push eax
call fcn.0046f3f0
cmp byte [esp + 0x1018], 0
je 0x48b0e4
cmp dword [0x520df4], 0
jne 0x48b09b
cmp byte [0x520dfe], 0
jne 0x48b09b
xor edx, edx
jmp 0x48b0a0
mov edx, 1
lea eax, [esp + 0x808]
lea esi, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48b0b0
sub eax, esi
xor ecx, ecx
sar eax, 1
test dl, dl
setne cl
lea edx, [esp + eax*2 + 0x808]
add ecx, 0x61
push ecx
push 0x4cb65c
push edx
mov edx, 2
call fcn.00407130
add esp, 0xc
push 0x400
lea eax, [esp + 0xc]
push eax
call fcn.0048a680
lea ecx, [esp + 8]
push ecx
call fcn.004550c0
lea eax, [esp + 0x808]
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48b106
push edi
lea edi, [esp + 0xc]
sub eax, edx
add edi, 0xfffffffe
jmp 0x48b120
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x48b120
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0x400
lea edx, [esp + 0x10]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
call fcn.00435d80
pop edi
test eax, eax
je 0x48b183
push 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x48b183
lea eax, [esp + 8]
mov edx, ebp
mov ecx, eax
sub edx, ecx
jmp 0x48b170
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x48b170
mov al, 1
jmp 0x48b1a7
lea edx, [esp + 8]
push edx
push 0x1f7
call fcn.00465ff0
push eax
call fcn.00498f80
add esp, 8
mov ecx, 0x5062f4
call fcn.0042c340
xor al, al
mov ecx, dword [esp + 0x1008]
pop esi
pop ebp
xor ecx, esp
call fcn.004af72c
add esp, 0x1004
ret 0xc
Function at 0x48c750
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x404
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x400], eax
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
push 0x200
lea eax, [esp + 0xc]
push eax
push ecx
mov dword [edi], 0x3b8
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0x40
lea edx, [esp + 0xc]
push edx
call fcn.0044bdd0
cmp word [0x53af98], 0
je 0x48c800
lea eax, [esp + 8]
add eax, 0xfffffffe
nop
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x48c7a0
mov ecx, dword [0x4c601c]
mov dx, word [0x4c6020]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48c7c6
sub eax, edx
push 0x53af98
sar eax, 1
push 0x5aa
mov esi, eax
call fcn.00465ff0
push eax
lea eax, [esp + esi*2 + 0x10]
push str._s:__s
mov edx, 0x200
sub edx, esi
push eax
call fcn.00407130
add esp, 0x10
cmp byte [0x53afff], 0
je 0x48c86e
lea eax, [esp + 8]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x48c810
mov ecx, dword [0x4c601c]
mov dx, word [0x4c6020]
mov dword [eax], ecx
mov word [eax + 4], dx
lea eax, [esp + 8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x48c836
sub eax, edx
sar eax, 1
mov esi, eax
mov eax, dword [esp + 0x410]
push eax
push 0x2fd
call fcn.00465ff0
push eax
lea ecx, [esp + esi*2 + 0x10]
mov edx, 0x200
sub edx, esi
push ecx
call fcn.00407130
add esp, 0xc
push 0x80
lea edx, [esp + 0xc]
push edx
add edi, 0x18
push edi
call fcn.0046f3f0
mov ecx, dword [esp + 0x408]
pop edi
pop esi
xor ecx, esp
call fcn.004af72c
add esp, 0x404
ret 4
Function at 0x493090
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x2d0], eax
push esi
mov esi, dword [esp + 0x2dc]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x2c8]
push 0x4c5888
push ecx
mov edx, 0xa
call fcn.00407130
add esp, 0xc
push 0x301
push 0x2b4
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [esi + 0x10], 1
je 0x49311f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4c5d80
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x493182
mov ecx, dword [edi]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x4931d5
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
xor ecx, esp
call fcn.004af72c
add esp, 0x2d4
ret 4
Function at 0x498d80
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x1a64
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x1a60], eax
cmp byte [esp + 0x1a6c], 0
mov dword [0x519f90], 1
je 0x498f2c
push esi
push 0x400
lea eax, [esp + 0xa68]
push eax
call fcn.0048a680
lea ecx, [esp + 0xa64]
push ecx
call fcn.004550c0
lea edx, [esp + 0xa64]
push edx
lea eax, [esp + 0x1268]
push str._sRar_
push eax
mov edx, 0x400
call fcn.00407130
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1268]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
mov dword [esp + 8], esi
cmp esi, 0xffffffff
je 0x498f24
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
push edi
jmp 0x498e30
cmp dword [0x519f90], 1
jne 0x498f21
mov ecx, dword [esp + 0x1c]
sub ecx, dword [esp + 0x28]
cmp ecx, 8
setae byte [esp + 0x13]
xor eax, eax
nop
movzx ecx, word [esp + eax + 0xa70]
mov word [esp + eax + 0x270], cx
add eax, 2
test cx, cx
jne 0x498e50
lea eax, [esp + 0x4c]
mov edx, eax
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x498e70
lea edi, [esp + 0x270]
sub eax, edx
add edi, 0xfffffffe
jmp 0x498e90
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x498e90
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
test byte [esp + 0x20], 0x10
rep movsb byte es:[edi], byte [esi]
je 0x498efc
push 6
lea edx, [esp + 0x50]
push str.Rar_DI
push edx
call fcn.004b1596
add esp, 0xc
test eax, eax
lea eax, [esp + 0x270]
push eax
sete bl
call ebp
test eax, eax
jne 0x498f09
cmp byte [esp + 0x13], al
je 0x498ee9
cmp byte [esp + 0x1a78], al
je 0x498eed
test bl, bl
je 0x498f09
lea ecx, [esp + 0x270]
push ecx
call fcn.0048b4e0
jmp 0x498f09
lea edx, [esp + 0x270]
push edx
call fcn.0048b270
mov esi, dword [esp + 0x14]
lea eax, [esp + 0x20]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x498e30
pop edi
pop ebx
pop ebp
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
cmp byte [esp + 0x1a68], 0
jne 0x498f5a
cmp byte [0x505ce0], 0
je 0x498f5a
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004963e0
mov byte [0x505ce0], al
mov ecx, dword [esp + 0x1a60]
xor ecx, esp
mov dword [0x519f90], 0
call fcn.004af72c
add esp, 0x1a64
ret 8
Function at 0x499720
Capabilities:
Copy file

Disassembly:
mov eax, 0x1004
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x1000], eax
cmp byte [0x505ce0], 0
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxW]
push edi
mov edi, dword [esp + 0x1010]
je 0x499782
cmp byte [0x526240], 0
jne 0x499782
push 0x24
push 0x5f0
call fcn.00465ff0
push eax
push 0x5f1
call fcn.00465ff0
push eax
mov eax, dword [0x51a8cc]
push eax
call ebp
cmp eax, 6
jne 0x499909
push esi
push 0x400
lea ecx, [esp + 0x810]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0x80c]
push edx
mov esi, str.rarreg.key
call fcn.00455740
lea ebx, [ebx]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x4997b0
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push ebx
push 0
lea eax, [esp + 0x814]
push eax
push edi
call esi
lea ecx, [esp + 0x10]
test eax, eax
push ecx
setne bl
call fcn.00455f40
lea edx, [esp + 0x10]
push edx
call fcn.004550c0
lea eax, [esp + 0x10]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x4997f5
mov ecx, dword [str.rarreg.key]
mov edx, dword [0x4c88f4]
mov dword [eax], ecx
mov ecx, dword [0x4c88f8]
mov dword [eax + 4], edx
mov edx, dword [0x4c88fc]
mov dword [eax + 8], ecx
mov ecx, dword [0x4c8900]
mov dword [eax + 0xc], edx
mov dx, word [0x4c8904]
mov dword [eax + 0x10], ecx
test bl, bl
mov word [eax + 0x14], dx
pop ebx
je 0x499849
lea eax, [esp + 0xc]
push eax
call fcn.00435220
jmp 0x499875
push 0
lea ecx, [esp + 0x10]
push ecx
push edi
call esi
xor eax, eax
jmp 0x499860
movzx ecx, word [esp + eax + 0xc]
mov word [esp + eax + 0x80c], cx
add eax, 2
test cx, cx
jne 0x499860
mov edx, dword [0x51a8cc]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [0x51a8cc]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push eax
call esi
push 1
lea ecx, [esp + 0x810]
push ecx
push 0
call fcn.0041c660
mov edx, dword [0x51a8cc]
push 0
push edx
mov byte [0x505ce0], al
call esi
mov ecx, 0x5200a8
call fcn.00449f60
cmp byte [0x505ce0], 0
pop esi
je 0x4998e9
push 0x30
push 0x368
call fcn.00465ff0
push eax
push 0x367
call fcn.00465ff0
push eax
mov eax, dword [0x51a8cc]
push eax
call ebp
jmp 0x499909
lea ecx, [esp + 0x808]
push ecx
call fcn.00435220
push 0x366
call fcn.00465ff0
push eax
call fcn.00498f80
add esp, 4
mov ecx, dword [esp + 0x1008]
pop edi
pop ebp
xor ecx, esp
call fcn.004af72c
add esp, 0x1004
ret 4
Function at 0x499960
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x202c
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x2028], eax
cmp byte [0x519779], 0
je 0x499b75
push ebx
push 0x401
lea eax, [esp + 0x828]
push eax
mov ecx, 0x5209d0
call fcn.00413200
push 1
push 0x4c6624
push 0x4c5f2c
call fcn.0045fc40
test eax, eax
setne bl
test bl, bl
je 0x4999d5
push 0x400
push 0x4c5d80
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.0045fc10
cmp word [esp + 0x24], 0
jne 0x4999e7
lea edx, [esp + 0x24]
push edx
call fcn.00442020
xor eax, eax
lea esp, [esp]
movzx ecx, word [esp + eax + 0x24]
mov word [esp + eax + 0x1028], cx
add eax, 2
test cx, cx
jne 0x4999f0
lea eax, [esp + 0x1028]
push eax
call fcn.004550c0
lea ecx, [esp + 0x824]
push ecx
call fcn.00455740
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x499a21
push esi
push edi
lea edi, [esp + 0x1030]
sub eax, edx
add edi, 0xfffffffe
lea ebx, [ebx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x499a40
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
push 1
push 0
lea edx, [esp + 0x1038]
mov ecx, eax
push edx
and ecx, 3
push 0x5af
rep movsb byte es:[edi], byte [esi]
call fcn.00465ff0
push eax
mov eax, dword [0x51a8cc]
push eax
call fcn.00419c00
pop edi
pop esi
test al, al
je 0x499b74
push 0x400
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x1030]
push edx
call fcn.00455c80
test bl, bl
je 0x499ab7
lea eax, [esp + 0x24]
push eax
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.0045fb40
lea eax, [esp + 0x824]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x499ac1
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x826], cx
lea eax, [esp + 0x1028]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x499ae4
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x102a], dx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea edx, [esp + 4]
lea eax, [esp + 0x824]
lea ecx, [esp + 0x1028]
push edx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x499b74
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
push 0x5b0
call fcn.00465ff0
push eax
call fcn.00498f80
add esp, 0xc
mov ecx, 0x5062f4
call fcn.0042c340
pop ebx
mov ecx, dword [esp + 0x2028]
xor ecx, esp
call fcn.004af72c
add esp, 0x202c
ret
Function at 0x49c240
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
sub esp, 0x80c
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x808], eax
cmp dword [0x51a024], 0
push ebx
mov ebx, dword [esp + 0x814]
jne 0x49c385
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x49c31e
push 0x400
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
push ebx
mov word [esp + 0x24], ax
call ebp
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x519779], 0
je 0x49c2ce
cmp eax, dword [0x5200a8]
je 0x49c2f7
cmp eax, dword [0x52008c]
je 0x49c2f7
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x49c2f7
push 1
lea eax, [esp + 0x18]
push eax
mov ecx, 0x5200a8
call fcn.00449800
cmp eax, 1
je 0x49c383
push 7
push str.rarreg.
lea ecx, [esp + 0x1c]
push ecx
call fcn.00455740
push eax
call fcn.00476cb0
test eax, eax
jne 0x49c31e
lea edx, [esp + 0x14]
push edx
call fcn.00499720
jmp 0x49c383
push esi
push 0
call fcn.00487170
mov ecx, dword [0x529494]
call fcn.0046f780
xor esi, esi
test edi, edi
jle 0x49c363
jmp 0x49c340
push 0x400
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [0x529494]
call fcn.0046fb70
inc esi
cmp esi, edi
jl 0x49c340
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
shr eax, 0xf
and al, 1
mov byte [esp + 0x14], al
mov edx, dword [esp + 0x14]
push edx
push 0
call fcn.00489b80
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x80c]
pop ebx
xor ecx, esp
call fcn.004af72c
add esp, 0x80c
ret 4

Function at 0x49c440
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x804
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x800], eax
push ebx
mov ebx, dword [esp + 0x80c]
push esi
xor eax, eax
push edi
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x400
lea ecx, [esp + 0x10]
push ecx
push eax
xor edi, edi
call fcn.0046f650
mov esi, eax
test esi, esi
je 0x49c4d5
test edi, edi
jne 0x49c48c
mov edi, 1
jmp 0x49c4b7
movzx edx, word [esp + 0xc]
push edx
mov ecx, 0x5228d0
call fcn.0041cc60
test al, al
jne 0x49c4b7
cmp edi, 1
jne 0x49c4b6
mov ax, word [esp + 0xc]
mov cx, word [esp + 0xe]
mov word [ebx], ax
mov word [ebx + 2], cx
inc edi
push 0x400
lea edx, [esp + 0x10]
push edx
push esi
call fcn.0046f650
mov esi, eax
test esi, esi
jne 0x49c481
cmp edi, 2
jne 0x49c4d5
mov word [ebx], ax
mov ecx, dword [esp + 0x80c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004af72c
add esp, 0x804
ret 4
Function at 0x49ca60
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1804
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x1800], eax
push esi
push 0x1000
push 0
lea eax, [esp + 0x80c]
push eax
push str.rarreg.key
push 0x4c5d80
call fcn.0045fc60
mov esi, eax
test esi, esi
je 0x49caf1
push edi
lea ecx, [esp + 8]
push ecx
push str.Rar_RK
call fcn.0048af50
mov edi, eax
test edi, edi
je 0x49cae1
push edi
push esi
lea edx, [esp + 0x810]
push 1
push edx
call fcn.004b20f8
push edi
call fcn.004b24ae
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.00499720
lea ecx, [esp + 8]
push ecx
call fcn.00435220
push str.rarreg.key
push 0x4c5d80
call fcn.0045f7c0
pop edi
mov ecx, dword [esp + 0x1804]
pop esi
xor ecx, esp
call fcn.004af72c
add esp, 0x1804
ret

Function at 0x49cb10
Capabilities:
Copy file
Move file

Disassembly:
mov eax, 0x182c
call fcn.004af740
mov eax, dword [0x4d88f0]
xor eax, esp
mov dword [esp + 0x1828], eax
push 0
push str.AppDataCopied
push 0x4c5f2c
call fcn.0045fc40
test eax, eax
jne 0x49ccc8
push esi
push 0x401
lea eax, [esp + 0x82c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [esp + 0x828]
push ecx
mov esi, 0x4ccecc
call fcn.00455740
lea esp, [esp]
movzx ecx, word [esi]
mov word [eax], cx
add esi, 2
add eax, 2
test cx, cx
jne 0x49cb70
lea edx, [esp + 0x102c]
push edx
call fcn.00455f40
xor eax, eax
pop esi
jmp 0x49cba0
movzx ecx, word [esp + eax + 0x1028]
mov word [esp + eax + 0x20], cx
add eax, 2
test cx, cx
jne 0x49cba0
lea eax, [esp + 0x20]
push eax
call fcn.004550c0
lea eax, [esp + 0x20]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x49cbc6
mov ecx, dword [0x4ccecc]
mov edx, dword [0x4cced0]
mov dword [eax], ecx
mov ecx, dword [0x4cced4]
mov dword [eax + 4], edx
mov dx, word [0x4cced8]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x824]
push eax
call fcn.00434f20
test al, al
je 0x49ccb7
lea ecx, [esp + 0x20]
push ecx
call fcn.00434f20
test al, al
jne 0x49ccb7
lea eax, [esp + 0x824]
lea edx, [eax + 2]
jmp 0x49cc30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49cc30
sub eax, edx
sar eax, 1
xor edx, edx
mov word [esp + eax*2 + 0x826], dx
lea eax, [esp + 0x20]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x49cc50
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x22], cx
xor eax, eax
mov dword [esp + 8], eax
lea edx, [esp + 0x824]
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
lea eax, [esp + 0x20]
mov ecx, 0x14
push edx
mov dword [esp + 8], 2
mov dword [esp + 0x10], eax
mov word [esp + 0x14], cx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
push 1
push str.AppDataCopied
push 0x4c5f2c
call fcn.0045fb60
mov ecx, dword [esp + 0x1828]
xor ecx, esp
call fcn.004af72c
add esp, 0x182c
ret