joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40aa9d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
and dword [edi + 4], 0
and dword [edi], 0
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
jae 0x40aab9
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
push esi
push dword [edi + 0xc]
call fcn.0041be10
xor eax, eax
inc eax
add esp, 0xc
xor bl, bl
cmp dword [ebp + 0xc], eax
jbe 0x40aadc
xor bl, byte [eax + esi]
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x40aad3
push 8
mov ecx, edi
call fcn.00409542
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
and dword [esi + 0x14], 0
cmp bl, byte [eax]
jne 0x40ab3a
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0040a939
mov edi, eax
test edi, edi
je 0x40ab3a
push 1
mov ecx, esi
call fcn.0040aa23
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [ecx], edi
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
push 3
mov dword [eax + 0x24], ecx
pop ecx
mov dword [eax], 0x28
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
jmp 0x40ab9a
push 1
mov ecx, esi
call fcn.0040aa23
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
push 3
pop ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
xor edx, edx
mov dword [eax], 0x16
xor ecx, ecx
cmp dword [esi + 0x14], edx
jle 0x40ab9a
xor edi, edi
mov eax, dword [esi]
add eax, edi
cmp dword [eax + 0x14], edx
jne 0x40ab86
lea ebx, [eax + 0xc]
mov dword [eax + 0x14], ebx
cmp dword [eax + 0x24], edx
jne 0x40ab91
lea ebx, [eax + 0x1c]
mov dword [eax + 0x24], ebx
inc ecx
add edi, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x40ab77
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40c160
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x10]
push ebx
push esi
lea ebx, [ecx + 8]
movdqu xmm1, xmmword [ebx]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], eax
lea esi, [ecx + 0x18]
jbe 0x40c1e5
mov eax, edi
movdqu xmm2, xmmword [eax]
mov eax, dword [ecx + 4]
mov edx, eax
shl edx, 4
add edx, esi
movdqu xmm0, xmmword [edx]
add edi, 0x10
dec eax
pxor xmm0, xmm2
test eax, eax
jle 0x40c1bc
mov edx, eax
shl edx, 4
add edx, esi
movdqu xmm3, xmmword [edx]
dec eax
sub edx, 0x10
aesdec xmm0, xmm3
test eax, eax
jg 0x40c1ab
cmp byte [ecx + 1], 0
movdqu xmm3, xmmword [esi]
aesdeclast xmm0, xmm3
je 0x40c1cf
pxor xmm0, xmm1
mov eax, dword [esp + 0xc]
add dword [esp + 0xc], 0x10
dec dword [ebp + 0xc]
movdqa xmm1, xmm2
movdqu xmmword [eax], xmm0
jne 0x40c184
pop edi
pop esi
movdqu xmmword [ebx], xmm1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c1f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
mov edi, ecx
mov ebx, dword [edi + 4]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], edi
sub ebx, 6
call fcn.0041be10
xor eax, eax
add esp, 0xc
xor edx, edx
cmp ebx, eax
mov dword [ebp + 8], eax
jle 0x40c262
cmp edx, dword [edi + 4]
jg 0x40c3b0
cmp eax, ebx
jge 0x40c253
lea ecx, [ebp + eax*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40c253
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x18]
mov esi, ecx
inc eax
add ecx, 4
inc dword [ebp + 8]
cmp eax, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40c233
cmp dword [ebp + 8], 4
jne 0x40c25e
inc edx
and dword [ebp + 8], 0
cmp eax, ebx
jl 0x40c222
cmp edx, dword [edi + 4]
jg 0x40c3b0
mov eax, ebx
shl eax, 2
lea ecx, [ebp + eax - 0x3b]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + eax - 0x3a]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + eax - 0x39]
lea eax, [ebp + eax - 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x4375e0
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov al, byte [ebp - 0x38]
xor al, byte [ecx + 0x437700]
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 0x38], al
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x37], cl
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x36], cl
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x35], cl
mov ecx, dword [ebp - 8]
xor al, byte [ecx]
inc dword [ebp - 8]
mov byte [ebp - 0x38], al
cmp ebx, 8
je 0x40c304
cmp ebx, 1
jle 0x40c365
lea ecx, [ebp - 0x34]
lea edi, [ebx - 1]
xor esi, esi
mov al, byte [ecx + esi - 4]
xor byte [ecx + esi], al
inc esi
cmp esi, 4
jl 0x40c2ef
add ecx, 4
dec edi
jne 0x40c2ed
jmp 0x40c362
push 3
lea ecx, [ebp - 0x34]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40c30d
dec edi
jne 0x40c30a
movzx eax, byte [ebp - 0x2c]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x28], al
movzx eax, byte [ebp - 0x2b]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x27], al
movzx eax, byte [ebp - 0x2a]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x26], al
movzx eax, byte [ebp - 0x29]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x25], al
push 3
lea ecx, [ebp - 0x24]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40c356
dec edi
jne 0x40c353
mov edi, dword [ebp - 4]
xor ecx, ecx
test ebx, ebx
jle 0x40c3a7
cmp edx, dword [edi + 4]
jg 0x40c3b0
cmp ecx, ebx
jge 0x40c398
lea eax, [ebp + ecx*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40c398
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x18]
mov esi, eax
inc ecx
add eax, 4
inc dword [ebp + 8]
cmp ecx, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40c378
cmp dword [ebp + 8], 4
jne 0x40c3a3
inc edx
and dword [ebp + 8], 0
cmp ecx, ebx
jl 0x40c36b
cmp edx, dword [edi + 4]
jle 0x40c293
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c3b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
inc eax
mov edi, ecx
cmp dword [edi + 4], eax
mov dword [ebp - 8], eax
jle 0x40c446
lea eax, [edi + 0x28]
push ebx
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 0xc], 4
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x4345e0]
xor dl, byte [eax + ebx*4 + 0x434de0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4351e0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4349e0]
add ecx, 4
mov byte [esi], dl
add esi, 4
dec dword [ebp - 0xc]
jne 0x40c3e6
inc eax
cmp eax, 4
jl 0x40c3d5
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0041be10
add dword [ebp - 4], 0x10
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 4]
jl 0x40c3d3
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40cbe8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
cmp dword [0x437808], ebx
jne 0x40cc01
mov ecx, 0x437800
call fcn.0040cba9
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
xor edx, edx
sub eax, ecx
cmp byte [ebp + 0x14], bl
setne dl
cmp byte [ebp + 0x10], bl
je 0x40cc53
mov ecx, dword [0x437808]
cmp ecx, ebx
je 0x40cc6f
push edx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40cc90
push str.CryptProtectMemory_failed
mov esi, 0x4325ac
push esi
call fcn.00406381
pop ecx
pop ecx
mov ecx, esi
call fcn.00401000
push 2
mov ecx, esi
call fcn.004062f8
jmp 0x40cc90
mov ecx, dword [0x43780c]
cmp ecx, ebx
je 0x40cc6f
push edx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40cc90
push str.CryptUnprotectMemory_failed
jmp 0x40cc34
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
cmp esi, ebx
jbe 0x40cc90
mov dl, al
add dl, 0x4b
mov eax, dword [ebp + 8]
add eax, ecx
mov bl, dl
add bl, cl
xor byte [eax], bl
inc ecx
cmp ecx, esi
jb 0x40cc80
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x40ce48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x42f0dc], 0
push ebx
push esi
push edi
mov edi, 0x400
jne 0x40ce93
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x44bf24], ax
xor eax, eax
mov word [0x44bf26], ax
mov dword [0x42f0dc], 0x44bf24
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004107ed
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push 0x42f0cc
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
pop edi
mov word [esi + ebx*2 - 2], ax
pop esi
pop ebx
leave
ret 0x10
Function at 0x40cf89
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x68
push dword [0x440844]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x440848], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x40cfeb
mov ecx, dword [0x437814]
call fcn.00418d09
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x42a724
push 0
push 0xc2
push edi
call esi
mov byte [0x440848], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x60], 0x5c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x5c], eax
je 0x40d03b
mov ecx, dword [ebp - 0x58]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], 0xa0
mov dword [ebp - 0x5c], 0x40000001
lea ecx, [ebp - 0x60]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x40d085
mov eax, dword [ebp - 0x58]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x42a7f8
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40d472
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041a670
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x40d48d
mov byte [ebx], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40d497
mov byte [eax], 0
test edi, edi
je 0x40d540
movzx eax, word [edi]
test ax, ax
je 0x40d540
push esi
xor esi, esi
xor ecx, ecx
movzx eax, ax
inc edi
inc edi
cmp ax, 0x3d
jne 0x40d4d0
cmp dword [ebp + 0xc], 0
je 0x40d4dc
test esi, esi
jne 0x40d4dc
test ebx, ebx
je 0x40d4cc
mov byte [ebx], 1
mov esi, edx
jmp 0x40d4eb
cmp ax, 0xd
je 0x40d4fe
cmp ax, 0xa
je 0x40d500
mov word [edx], ax
mov eax, dword [ebp + 0x14]
inc edx
add eax, 0xfffffffe
inc edx
cmp ecx, eax
jge 0x40d4f6
movzx eax, word [edi]
inc ecx
test ax, ax
jne 0x40d4b0
jmp 0x40d500
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x40d500
inc edi
inc edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [edx], ax
test ebx, ebx
je 0x40d53b
mov word [ebx], ax
test esi, esi
je 0x40d53b
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2000]
push eax
push ebx
call fcn.00410792
xor eax, eax
mov word [esi], ax
mov eax, edi
pop esi
jmp 0x40d542
xor eax, eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x40d587
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0041a670
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.00419819
cmp byte [0x440849], 0
jne 0x40d61c
push 6
push dword [0x42f0c8]
lea eax, [ebp - 0x1020]
push eax
call fcn.0040a108
push eax
call fcn.00411a07
test eax, eax
jne 0x40d61c
push 0x42a644
call fcn.00419806
lea eax, [ebp - 0x1020]
push eax
call fcn.0041a32f
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x101e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0041a3a0
add esp, 0x10
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x40d77d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041a670
push ebx
xor ebx, ebx
cmp byte [0x440878], bl
je 0x40d802
cmp word [0x437818], bx
je 0x40d802
push esi
push 0x437818
lea esi, [ebp - 0x1008]
call fcn.0040d740
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x40d802
push dword [ebp + 8]
call fcn.0041a32f
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40d807
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041a670
cmp byte [0x440878], 0
je 0x40d8ae
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x200c]
call fcn.0040d740
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40d8ae
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d8a5
shr dword [ebp - 4], 1
mov eax, 0x7ff
cmp dword [ebp - 4], eax
jae 0x40d889
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.00410792
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x40e156
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0041a670
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x40e371
push esi
call fcn.0041a32f
pop ecx
cmp eax, 0x7f6
jae 0x40e371
push edi
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.0041a3a0
movzx ecx, word [esi]
add esp, 0xc
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0x1c0
cmp cx, 0x22
jne 0x40e1b1
lea eax, [esi + 2]
mov dword [ebp - 0x38], eax
jmp 0x40e1b4
mov dword [ebp - 0x38], esi
xor eax, eax
cmp cx, bx
je 0x40e20a
mov ecx, esi
cmp word [ecx], 0x22
jne 0x40e1dc
jmp 0x40e1cc
cmp word [esi + eax*2], 0x22
je 0x40e1d5
inc eax
cmp word [esi + eax*2], bx
jne 0x40e1c5
jmp 0x40e1dc
push 0x20
pop ecx
mov word [esi + eax*2], cx
cmp word [esi + eax*2], 0x20
je 0x40e1f6
cmp word [esi + eax*2 + 2], 0x2f
je 0x40e1f6
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40e1bd
jmp 0x40e20a
lea eax, [esi + eax*2]
cmp word [eax], 0x20
jne 0x40e204
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x40e216
cmp word [eax], bx
jne 0x40e22b
cmp byte [ebp + 0xc], bl
jne 0x40e22b
cmp word [0x44187a], bx
je 0x40e22b
mov dword [ebp - 0x34], 0x44187a
push dword [ebp - 0x38]
mov dword [ebp - 0x2c], 1
call fcn.0040a297
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40e257
push str..inf
push eax
call fcn.004119e6
test eax, eax
jne 0x40e257
mov dword [ebp - 0x3c], str.Install
push dword [ebp - 0x38]
call fcn.0040902d
test al, al
je 0x40e280
push 0x800
lea eax, [ebp - 0x1048]
push eax
push dword [ebp - 0x38]
call fcn.0040a769
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40e370
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
mov edi, 0x3e8
cmp byte [0x440870], bl
jne 0x40e2b5
cmp byte [ebp + 0xc], bl
jne 0x40e2b5
cmp byte [0x44085d], bl
je 0x40e312
cmp dword [ebp + 8], ebx
je 0x40e2d1
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40e2d1
push ebx
push dword [ebp + 8]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10]
call fcn.0040d548
cmp byte [0x44085d], bl
je 0x40e312
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40e312
mov eax, dword [ebp - 0xc]
add eax, edi
cmp eax, dword [0x440860]
jbe 0x40e312
mov dword [0x440860], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x40e331
push 0x42a8ec
push dword [ebp - 8]
call fcn.004119e6
test eax, eax
je 0x40e35f
cmp byte [0x440870], bl
je 0x40e34a
cmp byte [ebp + 0xc], bl
jne 0x40e34a
mov dword [0x440864], 0x1b58
jmp 0x40e35f
xor eax, eax
cmp byte [ebp + 0xc], bl
sete al
dec eax
and eax, 0xfffffce0
add eax, edi
mov dword [0x440864], eax
cmp byte [ebp - 1], bl
je 0x40e370
cmp byte [ebp + 0xc], bl
je 0x40e370
push 1
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40fb3c
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 1
call fcn.00410a29
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x44e5b0
call fcn.00411adc
mov esi, 0x7002
push esi
push ebx
push 0x439820
call fcn.0041a3a0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
cmp edi, ebx
je 0x40fbeb
push edi
call fcn.0040d33c
cmp byte [0x440879], bl
je 0x40fbe5
push str.winrarsfxmappingfile.tmp
push ebx
mov edi, 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40fbda
push esi
push ebx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x40fbd3
push esi
push edi
push 0x439820
call fcn.0041be10
add esp, 0xc
push 0x439822
mov byte [edi], 1
call fcn.0040d2e8
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40fbeb
push edi
call fcn.0040d2e8
push 0x800
mov esi, 0x438820
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.sfxname
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x64
push edi
mov dword [0x4325a4], edi
mov dword [0x4325a8], edi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x65
push dword [0x4325a8]
mov dword [0x43881c], eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
lea ecx, [ebp - 8]
mov dword [0x438818], eax
call fcn.00419bde
push esi
mov ecx, 0x4325bc
call fcn.0040c09b
lea ecx, [ebp - 0x60]
call fcn.00418cb5
lea ecx, [ebp - 0x34]
call fcn.00418cb5
push 0x64
call fcn.0041994e
push 0x64
mov dword [ebp - 0x40], eax
call fcn.0041994e
push ebx
push 0x40f277
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x60]
mov dword [0x437814], eax
push str.STARTDLG
lea eax, [ebp - 0x34]
push edi
mov dword [0x437810], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [ebp - 0x34]
mov dword [0x437810], ebx
mov dword [0x437814], ebx
call fcn.00418cda
lea ecx, [ebp - 0x60]
call fcn.00418cda
lea ecx, [ebp - 8]
call fcn.00419c38
cmp byte [0x440870], bl
je 0x40fcca
call fcn.0040d587
mov ecx, 0x44be20
call fcn.0040cdf1
cmp dword [0x440858], ebx
jbe 0x40fce8
push dword [0x44084c]
call fcn.0041a086
pop ecx
push dword [0x43881c]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x438818]
cmp eax, ebx
je 0x40fd02
push eax
call esi
cmp dword [0x4325ac], ebx
jne 0x40fd21
cmp byte [0x44083c], bl
je 0x40fd21
push 0xff
mov ecx, 0x4325ac
call fcn.00406257
mov eax, dword [0x440868]
mov byte [0x44083c], 1
cmp eax, ebx
je 0x40fd43
push eax
call fcn.0040d548
push dword [0x440868]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x440864]
cmp eax, ebx
je 0x40fd53
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [0x440860]
pop edi
pop esi
cmp eax, ebx
pop ebx
ja 0x40fd6a
mov eax, dword [0x4325ac]
leave
ret 0x10
Function at 0x4100ce
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x4102a4
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4
Function at 0x410e06
Capabilities:
Create thread

Disassembly:
push ecx
push ebp
push esi
mov esi, ecx
xor ebp, ebp
cmp dword [esi], ebp
jbe 0x410e81
push ebx
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x410da8
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebx, eax
test ebx, ebx
jne 0x410e5d
push str.CreateThread_failed
push 0x4325ac
call fcn.00406381
pop ecx
pop ecx
mov ecx, 0x4325ac
call fcn.00401000
push 2
mov ecx, 0x4325ac
call fcn.004062f8
mov dword [edi], ebx
inc dword [esi + 0x84]
mov eax, dword [0x44e58c]
test eax, eax
je 0x410e77
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebp
add edi, 4
cmp ebp, dword [esi]
jb 0x410e16
pop edi
pop ebx
pop esi
pop ebp
pop ecx
ret

Function at 0x417214
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x42946d
call fcn.0041a05c
push ecx
push ebx
push esi
mov esi, ecx
push 1
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
call fcn.004094a8
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x4b38]
call fcn.00412089
lea ecx, [esi + 0x98d0]
call fcn.00412aa2
lea ecx, [esi + 0xe65c]
mov byte [ebp - 4], 5
call fcn.0040a81b
push 1
lea ecx, [esi + 0xe694]
mov byte [ebp - 4], 6
call fcn.004094a8
lea eax, [esi + 0xe6a4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6b4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6c4]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xa
mov dword [esi], eax
mov dword [esi + 0x4b34], ebx
mov byte [esi + 0x4c38], bl
mov byte [esi + 0x4c48], bl
mov byte [esi + 0x4c49], bl
mov byte [esi + 0x4c4a], bl
mov dword [esi + 0x1c], 1
call fcn.00410c7f
push ebx
mov ecx, esi
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xe6d8], ebx
mov dword [esi + 0xe6dc], ebx
call fcn.00415371
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4