joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5a00
Capabilities:
Get file system object information

Disassembly:
sub esp, 0x2d4
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2d0], eax
push esi
mov esi, dword [esp + 0x2dc]
mov eax, dword [esi + 0x2c]
push edi
add eax, 0x41
push eax
lea ecx, [esp + 0x2c8]
push str._c:_
push ecx
mov edx, 0xa
call fcn.00493540
add esp, 0xc
push 0x301
push 0x2b4
lea edx, [esp + 0x18]
push edx
push 0
lea eax, [esp + 0x2d4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test byte [esi + 0x10], 1
je 0x4b5a8f
mov edi, dword [sym.imp.USER32.dll_GetSysColor]
push 0xd
call edi
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetBkColor]
push 0xe
mov dword [esp + 0x10], eax
call edi
mov edx, dword [esi + 0x18]
push eax
push edx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [esp + 8], eax
mov eax, dword [esi + 0x20]
mov ecx, dword [esi + 0x1c]
mov edx, dword [esi + 0x18]
push ebx
push ebp
push 0
push 0
push 0x4f9a98
lea edi, [esi + 0x1c]
push edi
push 2
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_ExtTextOutW]
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x31
call ebx
push 0x32
mov ebp, eax
call ebx
mov ecx, dword [esi + 0x20]
mov edx, dword [edi]
push 3
push 0
push 0
push eax
mov eax, dword [esp + 0x28]
push ebp
push eax
mov eax, dword [esi + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_DrawIconEx]
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.USER32.dll_DestroyIcon]
lea eax, [esp + 0x24]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4b5af2
mov ecx, dword [edi]
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi + 0x20]
lea edx, [esp + 0x28]
push edx
add eax, 2
push eax
mov eax, dword [esi + 0x18]
lea edx, [ecx + ebp + 7]
push edx
push eax
call dword [sym.imp.GDI32.dll_TextOutW]
test byte [esi + 0x10], 1
pop ebp
pop ebx
je 0x4b5b45
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x18]
push ecx
push edx
call dword [sym.imp.GDI32.dll_SetBkColor]
mov eax, dword [esp + 8]
mov ecx, dword [esi + 0x18]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
xor ecx, esp
call fcn.004df2c4
add esp, 0x2d4
ret 4
Function at 0x4b8ad0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
mov eax, 0x3260
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x325c], eax
cmp byte [esp + 0x3268], 0
mov dword [0x5343a0], 1
je 0x4b8c49
push ebp
push 0
push 0x800
lea eax, [esp + 0x1268]
push eax
call fcn.004ad2b0
push 0x800
lea ecx, [esp + 0x1264]
push ecx
call fcn.00450a60
lea edx, [esp + 0x1260]
push edx
lea eax, [esp + 0x2264]
push str._sRar_
push eax
mov edx, 0x800
call fcn.00493540
add esp, 0xc
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x2264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4b8c41
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebx
lea ebx, [ebx]
cmp dword [0x5343a0], 1
jne 0x4b8c3f
mov ecx, dword [esp + 0x14]
sub ecx, dword [esp + 0x20]
push 0x800
lea edx, [esp + 0x126c]
push edx
lea eax, [esp + 0x270]
cmp ecx, 8
push eax
setae byte [esp + 0x1b]
call fcn.00466930
push 0x800
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0x270]
push edx
call fcn.004669b0
test byte [esp + 0x18], 0x10
je 0x4b8c1e
push 6
lea eax, [esp + 0x48]
push str.Rar_DI
push eax
call fcn.004e3603
add esp, 0xc
lea ecx, [esp + 0x268]
test eax, eax
push ecx
sete bl
call esi
test eax, eax
jne 0x4b8c2b
cmp byte [esp + 0xf], al
je 0x4b8c0b
cmp byte [esp + 0x3270], al
je 0x4b8c0f
test bl, bl
je 0x4b8c2b
lea edx, [esp + 0x268]
push edx
call fcn.004ae2c0
jmp 0x4b8c2b
lea eax, [esp + 0x268]
push eax
call fcn.004adeb0
lea ecx, [esp + 0x18]
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4b8b80
pop ebx
pop esi
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
cmp byte [esp + 0x3264], 0
jne 0x4b8c77
cmp byte [0x51e2c0], 0
je 0x4b8c77
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 1
call fcn.004b56e0
mov byte [0x51e2c0], al
mov ecx, dword [esp + 0x325c]
xor ecx, esp
mov dword [0x5343a0], 0
call fcn.004df2c4
add esp, 0x3260
ret 8
Function at 0x4bc330
Capabilities:
Copy file

Disassembly:
mov eax, 0x2004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2000], eax
cmp byte [0x51e2c0], 0
push ebp
mov ebp, dword [sym.imp.USER32.dll_MessageBoxW]
push esi
mov esi, dword [esp + 0x2010]
je 0x4bc392
cmp byte [0x54b8ec], 0
jne 0x4bc392
push 0x24
push 0x5f0
call fcn.004610c0
push eax
push 0x5f1
call fcn.004610c0
push eax
mov eax, dword [0x5354dc]
push eax
call ebp
cmp eax, 6
jne 0x4bc4d8
push ebx
push edi
push 0x800
lea ecx, [esp + 0x1014]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarreg.key
lea edx, [esp + 0x1018]
push edx
call fcn.004510f0
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
lea eax, [esp + 0x1014]
push eax
push esi
call edi
push 1
push 0x800
lea ecx, [esp + 0x18]
test eax, eax
push ecx
setne bl
call fcn.00451310
push 0x800
lea edx, [esp + 0x14]
push edx
call fcn.00450a60
push 0x800
push str.rarreg.key
lea eax, [esp + 0x18]
push eax
call fcn.004669b0
test bl, bl
je 0x4bc41c
lea ecx, [esp + 0x10]
push ecx
call fcn.00442f40
jmp 0x4bc445
push 0
lea edx, [esp + 0x14]
push edx
push esi
call edi
xor eax, eax
jmp 0x4bc430
movzx ecx, word [esp + eax + 0x10]
mov word [esp + eax + 0x1010], cx
add eax, 2
test cx, cx
jne 0x4bc430
mov eax, dword [0x5354dc]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov ecx, dword [0x5354dc]
mov esi, dword [sym.imp.USER32.dll_FlashWindow]
push 1
push ecx
call esi
push 1
lea edx, [esp + 0x1014]
push edx
call fcn.00436150
mov byte [0x51e2c0], al
mov eax, dword [0x5354dc]
push 0
push eax
call esi
mov ecx, 0x53fd10
call fcn.00491600
cmp byte [0x51e2c0], 0
pop edi
pop ebx
je 0x4bc4b8
push 0x30
push 0x368
call fcn.004610c0
push eax
push 0x367
call fcn.004610c0
mov ecx, dword [0x5354dc]
push eax
push ecx
call ebp
jmp 0x4bc4d8
lea edx, [esp + 0x1008]
push edx
call fcn.00442f40
push 0x366
call fcn.004610c0
push eax
call fcn.004bbb10
add esp, 4
mov ecx, dword [esp + 0x2008]
pop esi
pop ebp
xor ecx, esp
call fcn.004df2c4
add esp, 0x2004
ret 4
Function at 0x4bc500
Capabilities:
Copy file

Disassembly:
mov eax, 0x3024
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x3020], eax
cmp byte [0x533389], 0
je 0x4bc6de
push ebx
push 0x800
lea eax, [esp + 0x2028]
push eax
mov ecx, 0x541e38
call fcn.00478250
push 1
push str.History
push str.General
call fcn.00496520
test eax, eax
setne bl
test bl, bl
je 0x4bc575
push 0x800
push 0x4f9a98
lea ecx, [esp + 0x2c]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.004964f0
cmp word [esp + 0x24], 0
jne 0x4bc587
lea edx, [esp + 0x24]
push edx
call fcn.004890d0
push 0x800
lea eax, [esp + 0x1028]
push eax
lea ecx, [esp + 0x202c]
push ecx
call fcn.00450f20
push eax
lea edx, [esp + 0x30]
push edx
call fcn.00450ab0
push 1
push 0
lea eax, [esp + 0x102c]
push eax
push 0x5af
call fcn.004610c0
mov ecx, dword [0x5354dc]
push eax
push ecx
call fcn.0047aa10
test al, al
je 0x4bc6dd
push 0x800
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x102c]
push eax
call fcn.004511c0
test bl, bl
je 0x4bc606
lea ecx, [esp + 0x24]
push ecx
push str.SaveArcFolder
push str.InterfaceMisc
call fcn.00496420
lea eax, [esp + 0x2024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bc610
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4bc62c
mov eax, 0x7ff
xor edx, edx
mov word [esp + eax*2 + 0x2024], dx
lea eax, [esp + 0x1024]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bc640
sub eax, edx
sar eax, 1
inc eax
cmp eax, 0x7ff
jb 0x4bc65c
mov eax, 0x7ff
xor ecx, ecx
mov word [esp + eax*2 + 0x1024], cx
xor eax, eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 4], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov word [esp + 0x20], ax
lea ecx, [esp + 4]
lea edx, [esp + 0x2024]
lea eax, [esp + 0x1024]
push ecx
mov dword [esp + 0xc], 2
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
je 0x4bc6dd
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push 0x5b0
call fcn.004610c0
push eax
call fcn.004bbb10
add esp, 0xc
mov ecx, 0x5275b8
call fcn.0043d530
pop ebx
mov ecx, dword [esp + 0x3020]
xor ecx, esp
call fcn.004df2c4
add esp, 0x3024
ret
Function at 0x4bc900
Capabilities:
Move file

Disassembly:
mov eax, 0x1110
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x110c], eax
cmp byte [0x540d2a], 0
jne 0x4bcb41
push ebx
push ebp
push esi
xor esi, esi
push edi
push esi
mov ecx, 0x53fd10
xor ebp, ebp
mov dword [esp + 0x10c8], esi
mov dword [esp + 0x10cc], esi
call fcn.0048cce0
lea eax, [esp + 0x34]
push eax
mov ecx, 0x53fd10
call fcn.0048cce0
test al, al
je 0x4bc986
lea esp, [esp]
lea edi, [esp + 0x13]
lea ebx, [esp + 0x34]
call fcn.004b4210
test al, al
jne 0x4bca43
mov ecx, ebx
push ecx
mov ecx, 0x53fd10
call fcn.0048cce0
test al, al
jne 0x4bc960
push 0
mov ecx, 0x53fd10
call fcn.0048cce0
lea ecx, [esp + 0x34]
push ecx
mov ecx, 0x53fd10
call fcn.0048cce0
test al, al
je 0x4bca1c
lea eax, [esp + 0x34]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4bc9b0
sub eax, edx
sar eax, 1
lea edi, [eax + ebp + 1]
lea edx, [edi + edi + 2]
push edx
push esi
call fcn.004df30b
mov esi, eax
add esp, 8
test esi, esi
je 0x4bcb3d
lea eax, [esp + 0x34]
mov edx, eax
lea ecx, [ebp + ebp]
sub ecx, edx
lea edx, [ecx + esi]
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4bc9f0
lea eax, [esp + 0x34]
push eax
mov ecx, 0x53fd10
mov ebp, edi
call fcn.0048cce0
test al, al
jne 0x4bc9a5
test ebp, ebp
jne 0x4bca9e
push 0x30
push 0x65
call fcn.004610c0
push eax
push 0x14c
call fcn.004610c0
mov ecx, dword [0x5354dc]
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x4bcb3d
cmp byte [esp + 0x1124], 0
je 0x4bca94
push 0x64
lea edx, [esp + 0x38]
push edx
call fcn.00492fa0
push eax
push 0x203
call fcn.004610c0
push eax
call fcn.004bbb10
movzx eax, byte [esp + 0x1b]
add esp, 8
neg eax
sbb eax, eax
and eax, 0xffffff87
add eax, 0xce
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, 0x5275b8
call fcn.0043d530
jmp 0x4bcb3d
call fcn.004bb890
jmp 0x4bcb3d
xor eax, eax
xor edx, edx
mov word [esi + ebp*2], dx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov word [esp + 0x30], ax
mov eax, dword [0x5354dc]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], 3
cmp byte [esp + 0x1124], dl
je 0x4bcaeb
mov ecx, 0x40
mov word [esp + 0x24], cx
lea edx, [esp + 0x14]
mov edi, 1
add dword [0x534434], edi
push edx
mov dword [esp + 0x20], esi
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete bl
sub dword [0x534434], edi
push esi
call fcn.004df10f
add esp, 4
test bl, bl
je 0x4bcb3d
cmp dword [esp + 0x26], 0
jne 0x4bcb3d
mov ecx, 0x53fcf0
call fcn.004a2480
push 0x4f9a98
mov ecx, 0x53fd10
call fcn.004903d0
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x110c]
xor ecx, esp
call fcn.004df2c4
add esp, 0x1110
ret 4
Function at 0x4bf010
Capabilities:
Get file attributes
Log keystrokes via polling

Disassembly:
mov eax, 0x100c
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1008], eax
cmp dword [0x534434], 0
push ebx
mov ebx, dword [esp + 0x1014]
jne 0x4bf154
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_DragQueryFileW]
push edi
push 0
push 0
push 0xffffffffffffffff
push ebx
call ebp
mov edi, eax
cmp edi, 1
jne 0x4bf0ef
push 0x800
lea ecx, [esp + 0x18]
xor eax, eax
push ecx
push eax
push ebx
mov word [esp + 0x24], ax
call ebp
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp byte [0x533389], 0
je 0x4bf0a2
cmp eax, dword [0x53fd10]
je 0x4bf0c8
cmp eax, dword [0x53fcf4]
je 0x4bf0c8
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
jne 0x4bf0c8
lea eax, [esp + 0x14]
push eax
mov ecx, 0x53fd10
call fcn.00490eb0
test al, al
jne 0x4bf152
push 7
push str.rarreg.
lea ecx, [esp + 0x1c]
push ecx
call fcn.00450f20
push eax
call fcn.00469c50
test eax, eax
jne 0x4bf0ef
lea edx, [esp + 0x14]
push edx
call fcn.004bc330
jmp 0x4bf152
push esi
push 0
call fcn.004a9d00
mov ecx, 0x551b7c
call fcn.00466ce0
xor esi, esi
test edi, edi
jle 0x4bf132
jmp 0x4bf110
push 0x800
lea eax, [esp + 0x1c]
push eax
push esi
push ebx
call ebp
lea ecx, [esp + 0x18]
push ecx
mov ecx, 0x551b7c
call fcn.00466d10
inc esi
cmp esi, edi
jl 0x4bf110
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
push 1
shr eax, 0xf
and al, 1
mov byte [esp + 0x14], al
mov edx, dword [esp + 0x14]
push edx
push 0
call fcn.004ac830
pop esi
pop edi
pop ebp
mov ecx, dword [esp + 0x100c]
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x100c
ret 4

Function at 0x4bf570
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x2004
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2000], eax
push esi
push 0x1000
push 0
lea eax, [esp + 0x100c]
push eax
push str.rarreg.key
push 0x4f9a98
call fcn.00496540
mov esi, eax
test esi, esi
je 0x4bf606
push edi
push 0x800
lea ecx, [esp + 0xc]
push ecx
push str.Rar_RK
call fcn.004adbc0
mov edi, eax
test edi, edi
je 0x4bf5f6
push edi
push esi
lea edx, [esp + 0x1010]
push 1
push edx
call fcn.004e3fae
push edi
call fcn.004e0841
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.004bc330
lea ecx, [esp + 8]
push ecx
call fcn.00442f40
push str.rarreg.key
push 0x4f9a98
call fcn.004960a0
pop edi
mov ecx, dword [esp + 0x2004]
pop esi
xor ecx, esp
call fcn.004df2c4
add esp, 0x2004
ret
Function at 0x4bf620
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1028
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x1024], eax
push esi
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x20], 0x50a00
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0xc
push 0
lea ecx, [esp + 0xc]
push ecx
push str.VerInfo
push str.General
call fcn.00496540
push 1
push 0x800
lea edx, [esp + 0x30]
push edx
call fcn.00451310
push 0x800
lea eax, [esp + 0x2c]
push eax
call fcn.00450a60
push 0x800
push str.version.dat
lea ecx, [esp + 0x30]
push ecx
call fcn.004669b0
push 0x4f9ce8
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x18], 0
call fcn.00443120
mov esi, eax
test esi, esi
je 0x4bf6cd
push esi
push 0xc
lea eax, [esp + 0x18]
push 1
push eax
call fcn.004e0c61
push esi
call fcn.004e0841
add esp, 0x14
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
je 0x4bf77c
mov ecx, dword [esp + 0x10]
push 0xc
cmp ecx, eax
je 0x4bf748
lea ecx, [esp + 0x20]
push ecx
push str.VerInfo
push str.General
call fcn.004964a0
push 0x4fb9fc
lea edx, [esp + 0x2c]
push edx
call fcn.00443120
mov esi, eax
test esi, esi
je 0x4bf728
push esi
push 0xc
lea eax, [esp + 0x24]
push 1
push eax
call fcn.004e3fae
push esi
call fcn.004e0841
add esp, 0x14
mov dword [0x534428], 0
pop esi
mov ecx, dword [esp + 0x1024]
xor ecx, esp
call fcn.004df2c4
add esp, 0x1028
ret
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x1c]
push str.VerInfo
push str.General
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
call fcn.004964a0
mov ecx, dword [esp + 4]
mov eax, dword [esp + 0x1c]
cmp ecx, eax
jne 0x4bf7c3
cmp dword [esp + 0x10], eax
je 0x4bf7c3
mov edx, dword [esp + 0xc]
mov dword [esp + 0x10], ecx
mov ecx, dword [esp + 8]
push 0x4fb9fc
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], edx
call fcn.00443120
mov esi, eax
test esi, esi
je 0x4bf7c3
push esi
push 0xc
lea ecx, [esp + 0xc]
push 1
push ecx
call fcn.004e3fae
push esi
call fcn.004e0841
add esp, 0x14
mov edx, dword [esp + 0xc]
mov ecx, dword [esp + 0x24]
xor eax, eax
push 1
xor esi, esi
sub ecx, edx
push eax
sbb esi, eax
push esi
push ecx
call fcn.004e0250
mov ecx, dword [esp + 8]
xor esi, esi
sub eax, ecx
mov ecx, dword [esp + 0x20]
sbb edx, esi
push esi
add eax, ecx
push 0x989680
adc edx, esi
push edx
push eax
call fcn.004e2d00
push esi
push 0xe10
push edx
push eax
call fcn.004e2d00
push esi
push 0x18
push edx
push eax
call fcn.004e2d00
mov dword [0x534428], eax
test eax, eax
jge 0x4bf826
mov dword [0x534428], 0x168
mov ecx, dword [esp + 0x1028]
pop esi
xor ecx, esp
call fcn.004df2c4
add esp, 0x1028
ret
Function at 0x4c2de0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x2044
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x2040], eax
mov eax, dword [esp + 0x205c]
push ebx
mov ebx, dword [esp + 0x2064]
push ebp
mov ebp, dword [esp + 0x205c]
push esi
mov esi, dword [esp + 0x2058]
push edi
mov edi, dword [esp + 0x2060]
push 0x3c
lea ecx, [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x1c], eax
call fcn.004e01d0
add esp, 0xc
cmp byte [esp + 0x2068], 0
mov dword [esp + 0x14], 0x3c
mov dword [esp + 0x18], 0x500
jne 0x4c2e56
mov dword [esp + 0x18], 0x540
push esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], ebp
call fcn.00450f20
cmp eax, esi
jne 0x4c2e90
push esi
lea edx, [esp + 0x54]
push str.._s
push edx
mov edx, 0x1000
call fcn.00493540
lea eax, [esp + 0x5c]
add esp, 0xc
mov dword [esp + 0x24], eax
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
lea ecx, [esp + 0x14]
mov ebx, 1
push ecx
mov dword [esp + 0x34], ebx
mov byte [0x53338b], bl
call esi
test eax, eax
jne 0x4c2ec1
cmp dword [esp + 0x20], eax
je 0x4c2ec1
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x24], eax
call esi
mov byte [0x53338b], 0
test eax, eax
je 0x4c2f72
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x483
je 0x4c2f72
cmp byte [esp + 0x2068], 0
jne 0x4c2f6e
mov ecx, dword [esp + 0x4c]
test ecx, ecx
je 0x4c2f22
mov eax, dword [0x56f638]
mov edx, dword [esp + 0x34]
mov dword [eax*4 + 0x56f5f8], ecx
mov dword [eax*4 + 0x56f5b8], edx
inc eax
and eax, 0x8000000f
jns 0x4c2f1b
dec eax
or eax, 0xfffffff0
inc eax
mov dword [0x56f638], eax
jmp 0x4c2f64
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
lea ebx, [ebx]
mov eax, dword [esi + 0x56f5b8]
cmp eax, dword [esp + 0x34]
jne 0x4c2f58
mov ecx, dword [esi + 0x56f5f8]
push 0
push ecx
call edi
cmp eax, 0x102
jne 0x4c2f58
mov edx, dword [esi + 0x56f5f8]
mov dword [esp + 0x4c], edx
add esi, 4
cmp esi, 0x40
jl 0x4c2f30
mov ecx, dword [esp + 0x4c]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4c2f6e
mov dword [eax], ecx
mov al, bl
jmp 0x4c2f74
xor al, al
mov ecx, dword [esp + 0x2050]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004df2c4
add esp, 0x2044
ret 0x1c
Function at 0x4c2f90
Capabilities:
Query environment variable

Disassembly:
push 0xffffffffffffffff
push 0x4f7d4b
mov eax, dword fs:[0]
push eax
mov eax, 0x6060
call fcn.004df2e0
mov eax, dword [0x50fb70]
xor eax, esp
mov dword [esp + 0x605c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0x6074]
mov dword fs:[0], eax
mov eax, dword [esp + 0x6088]
mov ebp, dword [esp + 0x6084]
push eax
mov edi, ecx
call fcn.00450f20
mov ecx, edi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4c2ff0
sub ecx, esi
mov edx, eax
sar ecx, 1
lea ebx, [edx + 2]
mov si, word [edx]
add edx, 2
test si, si
jne 0x4c3004
sub edx, ebx
sar edx, 1
lea ecx, [edx + ecx + 1]
cmp ecx, 0x1000
jae 0x4c314c
push 0x1000
lea edx, [esp + 0x4074]
push edx
push eax
push edi
call fcn.00450ab0
lea ecx, [esp + 0x14]
call fcn.00466ea0
mov dword [esp + 0x607c], 0
push 0x1000
push 0x4f9a98
lea eax, [esp + 0x1078]
push eax
push str.ViewerIgnoreModifications
push str.Viewer
call fcn.004964f0
cmp word [esp + 0x1070], si
je 0x4c308c
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x107c]
push edx
call fcn.0049dac0
push 0x800
lea eax, [esp + 0x74]
push eax
lea ecx, [esp + 0x1c]
call fcn.00466f20
test al, al
je 0x4c3138
mov edi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ecx]
push 0x800
lea ecx, [esp + 0x3074]
push ecx
lea edx, [esp + 0x78]
push edx
call edi
lea eax, [esp + 0x3072]
push 0x501ffc
push eax
call fcn.004e380d
mov esi, eax
add esp, 8
test esi, esi
je 0x4c3178
xor ecx, ecx
mov word [esi], cx
add esi, 4
cmp word [esi], cx
jne 0x4c30f5
mov esi, 0x4fa890
push 4
push ebp
lea edx, [esp + 0x3078]
push edx
call fcn.004468d0
test al, al
je 0x4c311d
push 4
lea eax, [esp + 0x4074]
push eax
push esi
call fcn.004468d0
test al, al
jne 0x4c3181
push 0x800
lea ecx, [esp + 0x74]
push ecx
lea ecx, [esp + 0x1c]
call fcn.00466f20
test al, al
jne 0x4c30b0
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0041cb40
xor al, al
mov ecx, dword [esp + 0x6074]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x605c]
xor ecx, esp
call fcn.004df2c4
add esp, 0x606c
ret 8
lea esi, [esp + 0x3070]
jmp 0x4c3109
mov dword [esp + 0x607c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.0041cb40
mov al, 1
jmp 0x4c314e

Function at 0x4c42f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push 0x533390
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4c4329
push 0x40
push 0x2bc
call fcn.004610c0
push eax
push 0x2bd
call fcn.004610c0
push eax
mov eax, dword [0x5354dc]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop esi
ret
push 0
push 0x533390
mov ecx, esi
call fcn.004c3790
pop esi
ret
Function at 0x4c4e70
Capabilities:
Create thread

Disassembly:
push 0xffffffffffffffff
push 0x4f7e7e
mov eax, dword fs:[0]
push eax
push ebx
push esi
mov eax, dword [0x50fb70]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
test byte [0x57788c], 1
jne 0x4c4ec9
or dword [0x57788c], 1
mov dword [esp + 0x14], 0
mov ecx, 0x573768
call fcn.004c2600
push 0x4f89b0
call fcn.004e356f
add esp, 4
mov dword [esp + 0x14], 0xffffffff
mov esi, dword [esp + 0x1c]
push 1
push esi
mov ecx, 0x573768
call fcn.004c3670
mov bl, byte [esp + 0x20]
push 0
test bl, bl
push 0x573768
sete al
movzx ecx, al
push ecx
push 0
push 0
push esi
push 0
call fcn.004c2de0
test al, al
jne 0x4c4f48
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [0x573770]
cmp eax, 0xffffffff
je 0x4c4f21
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x573770], 0xffffffff
mov ecx, 0x57778a
call fcn.00464200
cmp esi, 0x4c7
sete al
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8
test bl, bl
je 0x4c4f65
push 0x573768
push 0x10000
push 0x4c4340
call fcn.004e47a2
add esp, 0xc
jmp 0x4c4f8a
mov eax, dword [0x573770]
cmp eax, 0xffffffff
je 0x4c4f80
push eax
call dword [sym.imp.KERNEL32.dll_FindCloseChangeNotification]
mov dword [0x573770], 0xffffffff
mov ecx, 0x57778a
call fcn.00464200
mov al, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0xc
ret 8