joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402d24
Capabilities:
Delete file
Get file size
Move file
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
push edi
xor ebx, ebx
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 0xc]
cmp edi, ebx
mov esi, 0x105
je 0x402d8c
cmp byte [edi], bl
je 0x402d8c
push 0x5c
push edi
call fcn.00417580
test eax, eax
pop ecx
pop ecx
jne 0x402db6
push esi
lea eax, [ebp - 0x10c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call fcn.00416e2d
cmp eax, ebx
pop ecx
pop ecx
je 0x402d89
mov byte [eax + 1], bl
push edi
jmp 0x402da0
push esi
lea eax, [ebp - 0x10c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x42e644
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.0040244a
lea eax, [ebp - 0x10c]
mov dword [ebp + 0xc], eax
push ebx
push 0x20
push 4
push ebx
push 3
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x402ebe
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
shl ecx, 0xa
cmp eax, ecx
jbe 0x402e90
cmp eax, 0xffffffff
je 0x402e90
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x41
pop ecx
xor eax, eax
push esi
push dword [ebp + 0xc]
mov byte [ebp - 0x214], bl
lea edi, [ebp - 0x213]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x214]
push 0x2e
push eax
call fcn.00416e2d
cmp eax, ebx
pop ecx
pop ecx
je 0x402e37
mov byte [eax], bl
push 0x42e714
push esi
lea eax, [ebp - 0x214]
push eax
call fcn.0040244a
push 0x80
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x214]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push ebx
push 0x20
push 4
push ebx
push 3
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.00416720
pop ecx
push eax
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402ff6
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push edi
push 0x40
xor eax, eax
mov byte [ebp - 0x108], 0
pop ecx
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
push 0x42e788
mov eax, 0x104
mov edi, 0x42e780
call fcn.00402a00
test eax, eax
mov edi, dword [ebp + 8]
pop ecx
pop ecx
je 0x40305b
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0xc]
push edi
push 0x42e710
push 0x42e778
push 0x42e770
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [edi], 0
jne 0x4030f0
push ebx
push dword [ebp + 0xc]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
mov dword [ebp + 8], eax
call fcn.00416e2d
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x4030df
mov eax, dword [ebp + 8]
push esi
sub eax, ebx
add eax, edi
push eax
lea esi, [ebx + 9]
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.00416af0
push 9
push str.logfiles
push ebx
call fcn.004167b0
add esp, 0x18
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
mov byte [esi], 0x5c
je 0x4030ca
test al, 0x10
je 0x4030ca
mov eax, dword [ebp + 8]
mov byte [eax + edi + 9], 0
jmp 0x4030de
push dword [ebp - 4]
push esi
push ebx
call fcn.00416af0
mov eax, dword [ebp + 8]
add esp, 0xc
mov byte [eax + edi], 0
pop esi
push 0x42e644
push 0x104
push edi
call fcn.0040244a
pop ebx
pop edi
leave
ret
Function at 0x4030f3
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x42c494
call fcn.004174bc
sub esp, 0x14
push ebx
push esi
xor esi, esi
push esi
push esi
push 3
push esi
push esi
push 0x10000000
push dword [ebp + 8]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, esi
jne 0x403131
push str.CreateFile_failed._n
call fcn.00418041
pop ecx
jmp 0x4031e9
push edi
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x40316a
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [ebp + 8]
push 0x42e78c
call fcn.00418041
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4031e8
push dword [ebp - 0x20]
call fcn.00417ee5
push dword [ebp - 0x20]
mov dword [ebp - 0x10], eax
push esi
push eax
call fcn.00417520
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
add esp, 0x10
push esi
push esi
push esi
push ebx
mov dword [ebp - 0x14], esi
call edi
push esi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [0x4362d4]
push dword [ebp - 0x20]
push dword [ebp - 0x10]
call fcn.00401fd3
add esp, 0xc
push esi
push esi
push esi
push ebx
call edi
push esi
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call fcn.0041803c
xor esi, esi
pop ecx
inc esi
pop edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00401bad
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x403708
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x4362c8]
cmp eax, 0xffffffff
jne 0x403729
call fcn.00401e85
cmp dword [0x4362c8], 0
jmp 0x40372b
test eax, eax
je 0x403859
push esi
push edi
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x208], 0
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
mov byte [ebp - 0x30c], 0
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x42e7f4
push dword [ebp + 8]
stosb byte es:[edi], al
call fcn.004176cb
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
mov ecx, 0x103
sub ecx, eax
push ecx
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp + eax - 0x208]
push eax
call fcn.00402408
lea eax, [ebp - 0x30c]
push str._RsInstall_
push eax
call fcn.00416ea0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.00416eb0
add esp, 0x10
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x104], 0
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40380c
push esi
push str.C:Temp
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.00416e2d
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
je 0x40382b
cmp byte [eax + 1], 0
jne 0x40382b
mov byte [eax], 0
lea eax, [ebp - 0x104]
push str.Rs7zSfx.log
push eax
call fcn.00416eb0
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push eax
push 1
push 0x80
call fcn.00403683
add esp, 0x18
leave
ret

Function at 0x40385b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push 0
lea eax, [ebp - 0x100]
push 0x42e700
push eax
call fcn.00416f98
lea eax, [ebp - 0x100]
push eax
push 0x539388
call fcn.00403277
add esp, 0x14
lea eax, [ebp - 0x204]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
leave
ret

Function at 0x403961
Capabilities:
Get common file path

Disassembly:
mov eax, dword [0x5388b8]
push 0xa
cdq
pop ecx
idiv ecx
cmp edx, 9
ja case.default.0x403975
jmp dword [edx*4 + 0x403a00]
call fcn.00401f78
jmp 0x4039e1
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call esi
call esi
pop esi
ret
call fcn.0040385b
call fcn.00401fb8
jmp dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00401f38
call fcn.0040385b
jmp 0x4039c1
call fcn.00401f78
jmp fcn.00401fb8
call fcn.0040385b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp fcn.00401f78
call fcn.00401f38
call fcn.00401f38
jmp dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.0040385b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
jmp fcn.00401f38
call fcn.00401fb8
call fcn.00401fb8
jmp dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
call fcn.00401f38
jmp fcn.0040385b
Function at 0x403a28
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
call fcn.004038a5
mov esi, dword [esp + 0x10]
push esi
call fcn.004024d7
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
xor ebx, ebx
push esi
call edi
cmp eax, 0xffffffff
je 0x403a63
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.004024d7
inc ebx
cmp ebx, 0xa
pop ecx
jl 0x403a43
call fcn.004038a5
push esi
call edi
inc eax
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret

Function at 0x403ac0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
call fcn.00403961
lea eax, [ebp - 8]
push eax
push str.SOFTWARE_risingRAV
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x403b08
push 4
lea eax, [ebp - 4]
push eax
push 4
push 0
push str.Is3MPackage
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x403b0c
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push esi
push edi
call fcn.00403961
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x110], 0
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 4]
push eax
push str.SOFTWARE_risingRAV
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x403ba6
call fcn.004038a5
and dword [ebp - 8], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x42e840
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403ba6
call fcn.00403961
lea eax, [ebp - 0x110]
push str._rsmain.exe
push eax
call fcn.00416eb0
pop ecx
pop ecx
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403ba6
xor esi, esi
inc esi
jmp 0x403bad
call fcn.004038a5
xor esi, esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x403eb9
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x42c4d3
call fcn.004174bc
sub esp, 0x390
push ebx
push esi
push edi
push 0x40
pop ecx
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x298], bl
lea edi, [ebp - 0x297]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x5388c0
stosb byte es:[edi], al
lea eax, [ebp - 0x298]
push str._sCompsVer.inf
push eax
call fcn.00416f98
add esp, 0xc
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x194], bl
lea edi, [ebp - 0x193]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x298]
push eax
push 0x104
lea eax, [ebp - 0x194]
push eax
push 0x42e8dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040188b
push 1
push ebx
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x74]
mov dword [ebp - 4], ebx
mov byte [ebp - 0x10], 0x3d
call fcn.004027aa
cmp eax, 0xffffffff
je 0x4040bf
mov byte [ebp + eax - 0x194], bl
lea eax, [ebp - 0x194]
push eax
lea ecx, [ebp - 0x74]
call fcn.0040186e
mov eax, dword [ebp - 0x60]
dec eax
push eax
push 1
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x74]
call fcn.00403e09
cmp dword [ebp - 0x20], 0x10
mov esi, dword [ebp - 0x34]
mov byte [ebp - 4], 1
mov edi, esi
jae 0x403f9c
lea edi, [ebp - 0x34]
mov esi, edi
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x38]
call fcn.00402be2
push 0x418170
push edi
push dword [eax]
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.00402cfd
add esp, 0x14
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x39c], bl
lea edi, [ebp - 0x39b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
push 0x20019
push ebx
push 0x42e8ac
push SysReAllocStringLen
mov dword [ebp - 0x1c], 0x400
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4040b4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x39c]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push str.ForbidInstall
push dword [ebp - 0x14]
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x4040b4
lea eax, [ebp - 0x39c]
push eax
lea ecx, [ebp - 0x90]
call fcn.0040188b
push ebx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x40], 0xf
call fcn.0040154f
lea eax, [ebp - 0x58]
push eax
lea esi, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.00403e47
pop ecx
push ebx
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x58]
call fcn.00402bfe
test eax, eax
jl 0x40409b
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
push ebx
inc esi
push esi
lea ecx, [ebp - 0x58]
call fcn.0040156b
push ebx
push esi
lea ecx, [ebp - 0x90]
call fcn.0040156b
push ebx
push esi
lea ecx, [ebp - 0x38]
call fcn.0040156b
jmp 0x4040c1
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.0040156b
push ebx
push 1
lea ecx, [ebp - 0x90]
call fcn.0040156b
push ebx
lea ecx, [ebp - 0x38]
push 1
call fcn.0040156b
xor esi, esi
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.0040156b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404a68
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
call fcn.00403961
xor ebp, ebp
inc ebp
push 0
mov dword [0x538ad8], ebp
call fcn.0041829d
push eax
call fcn.0041826e
call fcn.0041827b
push str.WinMain
push str._s_Start
mov dword [0x5388b8], eax
call fcn.00403708
mov eax, dword [esp + 0x28]
mov esi, 0x42e710
push esi
push esi
push str.installbegin
push esi
mov ebx, str.true
push ebx
push 0x42ea78
mov edi, str.res_watch_install
push edi
mov dword [0x538acc], eax
call fcn.004243f0
add esp, 0x2c
call fcn.004038a5
push str.E5C53971_D80E_4500_BE0D_761BF3CD8457
push ebp
xor ebp, ebp
push ebp
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x538ae4], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x404b18
push dword [0x538ae4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x538ae4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x2711
jmp 0x404c8f
call fcn.004038a5
call fcn.00403b0c
test eax, eax
je 0x404b45
push esi
push esi
push str.IsInstalled
push esi
push ebx
push 0x42ea40
push edi
call fcn.004243f0
add esp, 0x1c
or eax, 0xffffffff
jmp 0x404c8f
call fcn.00403961
call fcn.00403ac0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, 0x42ea3c
lea edi, [esp + 0x10]
movsw word es:[edi], word [esi]
lea ecx, [esp + 0x10]
push ecx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00403a75
mov edi, eax
cmp edi, ebp
pop ecx
pop ecx
je 0x404c50
lea eax, [edi - 1]
mov dword [0x538ad0], eax
mov ebp, 0x42ea38
mov ebx, 0x5389c8
mov esi, str.SILENT
push esi
call fcn.004178c3
push eax
push esi
push edi
call fcn.0041777d
add esp, 0x10
test eax, eax
je 0x404c2d
mov esi, str.SILENCE
push esi
call fcn.004178c3
push eax
push esi
push edi
call fcn.0041777d
add esp, 0x10
test eax, eax
je 0x404c2d
push ebp
call fcn.004178c3
push eax
push ebp
push edi
call fcn.0041777d
add esp, 0x10
test eax, eax
jne 0x404c37
push ebp
call fcn.004178c3
mov esi, eax
add esi, edi
mov al, byte [esi]
cmp al, 0x27
pop ecx
je 0x404c04
cmp al, 0x22
je 0x404c04
push 0x20
push esi
call fcn.00417580
test eax, eax
pop ecx
pop ecx
jne 0x404c15
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x404c21
movsx eax, al
push eax
inc esi
push esi
call fcn.00417580
test eax, eax
pop ecx
pop ecx
je 0x404c60
sub eax, esi
inc eax
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dword [0x538adc], 1
jmp 0x404c37
mov dword [0x538ad8], 1
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00403a75
mov edi, eax
test edi, edi
pop ecx
pop ecx
jne 0x404b8a
xor ebp, ebp
cmp dword [0x538ad8], ebp
push ebp
je 0x404c67
call fcn.0040413f
jmp 0x404c79
mov eax, 0x271a
jmp 0x404c8f
push 0x40484f
push ebp
push 0x65
push dword [esp + 0x28]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push str.WinMain
push str._s_End
call fcn.00403708
mov eax, dword [0x538ae8]
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 0x10
Function at 0x404cd3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push edi
push 0x40
pop ecx
xor eax, eax
xor ebx, ebx
mov byte [ebp - 0x104], bl
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x208], bl
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x104
lea eax, [ebp - 0x104]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.00416e2d
cmp eax, ebx
pop ecx
pop ecx
je 0x404d80
mov byte [eax], bl
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00416ea0
lea eax, [ebp - 0x208]
push str._rsdebug.ini
push eax
call fcn.00416eb0
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
push ebx
push str.IsDebug
push str.Debug
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, ebx
mov dword [0x436300], eax
setne al
jmp 0x404d82
xor al, al
pop edi
pop ebx
leave
ret

Function at 0x405d62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
mov eax, dword [0x436300]
cmp eax, 0xffffffff
jne 0x405d83
call fcn.00404cd3
cmp dword [0x436300], 0
jmp 0x405d85
test eax, eax
je 0x405eb3
push esi
push edi
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x208], 0
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
mov byte [ebp - 0x30c], 0
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x42e7f4
push dword [ebp + 8]
stosb byte es:[edi], al
call fcn.004176cb
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
pop ecx
pop ecx
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
mov ecx, 0x103
sub ecx, eax
push ecx
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp + eax - 0x208]
push eax
call fcn.00402408
lea eax, [ebp - 0x30c]
push str._RsInstall_
push eax
call fcn.00416ea0
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x30c]
push eax
call fcn.00416eb0
add esp, 0x10
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x104], 0
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x405e66
push esi
push str.C:Temp
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.00416e2d
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
je 0x405e85
cmp byte [eax + 1], 0
jne 0x405e85
mov byte [eax], 0
lea eax, [ebp - 0x104]
push str.Rs7zSfx.log
push eax
call fcn.00416eb0
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push eax
push 1
push 0x80
call fcn.00403683
add esp, 0x18
leave
ret
Function at 0x407e7b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x407e94
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + ecx - 4]
mov dword [ebp - 4], ecx
lea esi, [eax + edi]
jmp 0x407eb7
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x407ebc
inc esi
cmp esi, dword [ebp - 4]
jb 0x407eae
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 4]
mov dword [ebp - 8], eax
jae 0x407fb0
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x407ef2
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp + 0xc], eax
je 0x407f1f
cmp cl, 0xff
je 0x407f1f
and edx, 3
shl edx, 1
or edx, 1
inc eax
jmp 0x407ea9
dec ecx
shl edx, cl
and edx, 7
je 0x407ed8
movzx ecx, byte [edx + 0x42ee78]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x42ee70], 0
mov cl, byte [ebx + 4]
je 0x407f1a
test cl, cl
je 0x407f1a
cmp cl, 0xff
jne 0x407ed8
mov dword [ebp + 0xc], eax
jmp 0x407ee7
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x407f48
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x407f4f
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x407f83
movzx edi, byte [edx + 0x42ee78]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
mov eax, ebx
shr eax, cl
test al, al
je 0x407f6e
cmp al, 0xff
jne 0x407f80
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x407f3a
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x407ea9
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret

Function at 0x40bb16
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x538cd0], 0
jne 0x40bb50
push esi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040b5f8
mov eax, dword [eax]
pop ecx
pop ecx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00407bd8
pop ecx
test esi, esi
pop esi
jmp 0x40bb5e
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x40bb64
mov al, 1
leave
ret
xor al, al
leave
ret