joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d7f0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x410120
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push ebx
push ebp
push esi
push edi
push 1
mov ebp, ecx
call fcn.0040cf30
mov ecx, ebp
call fcn.0040c280
push 1
mov ecx, ebp
call fcn.0040b6f0
xor esi, esi
lea ecx, [esp + 0x2c]
mov dword [esp + 0x10], esi
call fcn.0040e84c
lea ecx, [esp + 0x18]
mov dword [esp + 0x48], esi
call fcn.0040e84c
mov ecx, dword [esp + 0x50]
push 0x3b
lea eax, [esp + 0x30]
push eax
push ecx
mov byte [esp + 0x54], 1
call fcn.0040af50
mov eax, dword [esp + 0x40]
add esp, 0xc
cmp eax, esi
mov dword [esp + 0x14], esi
jle 0x40d9a1
lea ebx, [ebx]
test esi, esi
jl 0x40d9d9
cmp esi, eax
jge 0x40d9d9
mov edx, dword [esp + 0x30]
push 0x2c
lea ecx, [esp + 0x1c]
lea eax, [edx + esi*4]
push ecx
push eax
call fcn.0040af50
mov eax, dword [esp + 0x2c]
add esp, 0xc
test eax, eax
jle 0x40d990
cmp eax, 1
jle 0x40d8c5
mov ecx, dword [esp + 0x1c]
add ecx, 4
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.MSVCR71.dll_atoi]
add esp, 4
mov dword [esp + 0x50], eax
jmp 0x40d8cd
mov dword [esp + 0x50], 0x64
mov eax, dword [esp + 0x20]
mov ebx, 2
cmp eax, ebx
jle 0x40d901
mov ecx, dword [esp + 0x1c]
add ecx, 8
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push eax
call dword [sym.imp.MSVCR71.dll_atoi]
add esp, 4
cmp eax, 1
je 0x40d903
cmp eax, ebx
jne 0x40d901
mov ebx, 1
jmp 0x40d903
xor ebx, ebx
mov eax, dword [esp + 0x20]
test eax, eax
jle 0x40d9d9
test ebp, ebp
mov edi, dword [esp + 0x1c]
jne 0x40d91b
xor eax, eax
jmp 0x40d91e
mov eax, dword [ebp + 0x20]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x101f
push eax
call esi
push eax
call sub.MFC71.DLL_CWnd::FromHandle
mov edx, dword [eax + 0x20]
push 0
push 0
push 0x1200
push edx
call esi
mov ecx, edi
mov esi, eax
call dword [sym.imp.MFC71.DLL_ATL::CSimpleStringT::operator_char_const_]
push 1
mov ecx, ebp
mov edi, eax
call fcn.0040b6f0
mov eax, dword [esp + 0x50]
push 0xffffffffffffffff
push eax
push ebx
push edi
push esi
mov ecx, ebp
call sub.MFC71.DLL_CListCtrl::InsertColumn
mov esi, eax
test esi, esi
jl 0x40d97b
push 1
push esi
mov ecx, ebp
call fcn.0040bb70
mov eax, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
mov esi, dword [esp + 0x14]
setge cl
or eax, ecx
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
inc esi
cmp esi, eax
mov dword [esp + 0x14], esi
jl 0x40d870
lea ecx, [esp + 0x18]
mov byte [esp + 0x48], 0
call sub.MFC71.DLL_CStringArray::CStringArray
lea ecx, [esp + 0x2c]
mov dword [esp + 0x48], 0xffffffff
call sub.MFC71.DLL_CStringArray::CStringArray
mov ecx, dword [esp + 0x40]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x3c
ret 4
call sub.MFC71.DLL_AfxThrowInvalidArgException
int3
Function at 0x40ecb4
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4130e0
call fcn.0040eeb4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40ecf4
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40ecf4
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40ed0c
cmp eax, 0x20b
je 0x40ecf9
mov dword [ebp - 0x1c], ebx
jmp 0x40ed20
cmp dword [ecx + 0x84], 0xe
jbe 0x40ecf4
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40ed1a
cmp dword [ecx + 0x74], 0xe
jbe 0x40ecf4
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x4161d0], 0xffffffff
or dword [0x4161d4], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x416188]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x416184]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4161cc], eax
call fcn.0040efb2
call fcn.0040f052
cmp dword [0x4160c0], ebx
jne 0x40ed80
push fcn.0040f052
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0040f040
push 0x41601c
push 0x416018
call sub.MSVCR71.dll__initterm
push 0x40eff6
call fcn.0040eb37
mov eax, dword [0x416180]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x41617c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x40edd4
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x416014
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40ee52
cmp al, bl
je 0x40edfe
cmp dword [ebp - 0x20], ebx
jne 0x40ee52
mov al, byte [esi]
cmp al, bl
je 0x40ee0e
cmp al, 0x20
ja 0x40ee0e
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40edfe
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x40ee2a
movzx eax, word [ebp - 0x54]
jmp 0x40ee2d
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.0040f15a
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x40ee4a
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x40eea7
cmp al, 0x22
jne 0x40ee61
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x40ee74
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x40edec
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040eeef
ret
Function at 0x406000
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x4a616b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x4042d4
call fcn.00406c61
push 4
mov dword [esp + 0x18], 0
call fcn.00407a93
mov edi, eax
add esp, 4
test edi, edi
je 0x406074
push ebx
call fcn.00406b39
mov dword [edi], eax
call fcn.004068f8
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406c22
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x406068
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406c4a
pop ebx
jmp 0x406076
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408501
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9790]
jne 0x40850b
repz ret
jmp fcn.0040ca5c
Function at 0x4118e2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4a9790]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040b045
and dword [ebp - 0x14], 0
cmp dword [0x4ab390], 0
mov dword [ebp - 0x18], eax
jne 0x411995
push 0x40379c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411a3d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403790
push ebx
call edi
test eax, eax
je 0x411a3d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403780
push ebx
mov dword [0x4ab390], eax
call edi
push eax
call esi
push 0x40376c
push ebx
mov dword [0x4ab394], eax
call edi
push eax
call esi
push 0x403750
push ebx
mov dword [0x4ab398], eax
call edi
push eax
call esi
mov dword [0x4ab3a0], eax
test eax, eax
je 0x411995
push 0x403738
push ebx
call edi
push eax
call esi
mov dword [0x4ab39c], eax
mov eax, dword [0x4ab39c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4119ee
cmp dword [0x4ab3a0], ecx
je 0x4119ee
push eax
call esi
push dword [0x4ab3a0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4119ee
test ebx, ebx
je 0x4119ee
call edi
test eax, eax
je 0x4119e5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4119e5
test byte [ebp - 8], 1
jne 0x4119ee
or dword [ebp + 0x10], 0x200000
jmp 0x411a21
mov eax, dword [0x4ab394]
cmp eax, dword [ebp - 0x18]
je 0x411a21
push eax
call esi
test eax, eax
je 0x411a21
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411a21
mov eax, dword [0x4ab398]
cmp eax, dword [ebp - 0x18]
je 0x411a21
push eax
call esi
test eax, eax
je 0x411a21
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4ab390]
call esi
test eax, eax
je 0x411a3d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411a3f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408501
leave
ret
Function at 0x4a4260
Capabilities:
Delete directory
Get common file path
Manipulate console buffer

Disassembly:
mov eax, 0x100c
call fcn.004122e0
cmp dword [0x82f124], 0x37
jne 0x4a42fa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetSystemPowerState]
push 0
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea ecx, [esp + 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea edx, [esp + 4]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea eax, [esp + 0x810]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FoldStringW]
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReplaceFileW]
mov ecx, dword [0x830118]
mov dword [esp], ecx
mov eax, 0x5d1
add dword [esp], eax
mov edx, dword [esp]
mov al, byte [edx + esi]
mov ecx, dword [0x4b0174]
mov byte [ecx + esi], al
add esp, 0x100c
ret
Function at 0x4a4590
Capabilities:
Accept command line arguments
Enumerate files on windows
Manipulate console buffer
Move file

Disassembly:
mov eax, dword [0x82f124]
sub esp, 0xa8c
push ebx
push ebp
push esi
mov esi, dword [0x4b0174]
push edi
shr eax, 3
xor edi, edi
cmp eax, edi
jbe 0x4a47a6
mov dword [esp + 0x30], 0x9e3779b9
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], eax
jmp 0x4a45d6
mov esi, dword [esp + 0x24]
xor edi, edi
cmp dword [0x82f124], 0x1c
jne 0x4a45ed
lea eax, [esp + 0x40]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov ecx, dword [esi + 4]
mov eax, dword [esi]
mov edx, dword [0x4aa2d0]
mov ebx, dword [0x4aa2d8]
mov ebp, dword [0x4aa2dc]
mov dword [esp + 0x14], ecx
mov ecx, dword [0x4aa2d4]
mov dword [esp + 0x1c], eax
mov esi, 0xc6ef3720
mov dword [esp + 0x38], edx
mov dword [esp + 0x34], ecx
mov dword [esp + 0x2c], 0x20
jmp 0x4a4636
mov eax, dword [esp + 0x1c]
xor edi, edi
mov edx, eax
shr edx, 5
add edx, ebp
mov ecx, eax
shl ecx, 4
mov dword [esp + 0x20], edx
add ecx, ebx
lea edx, [esi + eax]
xor ecx, edx
mov dword [esp + 0x10], ecx
mov dword [0x82f094], edi
mov eax, dword [esp + 0x20]
add dword [0x82f094], eax
mov eax, dword [0x82f094]
mov dword [esp + 0x3c], eax
mov dword [esp + 0x20], edi
mov eax, dword [esp + 0x3c]
add dword [esp + 0x20], eax
mov eax, dword [esp + 0x10]
xor eax, dword [esp + 0x20]
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x20], ecx
mov eax, dword [esp + 0x20]
sub dword [esp + 0x14], eax
mov edx, dword [esp + 0x14]
shl edx, 4
mov dword [esp + 0x10], edx
mov eax, dword [esp + 0x38]
add dword [esp + 0x10], eax
cmp dword [0x82f124], 0x1be
mov eax, dword [esp + 0x14]
lea edi, [esi + eax]
jne 0x4a46cd
lea eax, [esp + 0x44]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, dword [esp + 0x14]
shr eax, 5
add eax, dword [esp + 0x34]
cmp dword [0x82f124], 0x979
mov dword [0x82f098], 0xff6b3619
mov dword [0x82f09c], 0xffffffff
mov dword [esp + 0x20], eax
jne 0x4a4717
push 0
lea ecx, [esp + 0x29c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalGetAtomNameW]
lea edx, [esp + 0x48]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
xor dword [esp + 0x10], edi
mov eax, dword [esp + 0x20]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x1c], eax
mov dword [esp + 0x18], 0
mov eax, dword [esp + 0x30]
add dword [esp + 0x18], eax
sub esi, dword [esp + 0x18]
dec dword [esp + 0x2c]
jne 0x4a4630
cmp dword [0x82f124], 0x8d4
jne 0x4a475b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
cmp dword [0x82f124], 0x17
jne 0x4a4795
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_MoveFileWithProgressW]
lea edx, [esp + 0x48]
push edx
push 0x403f40
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
add esi, 8
dec dword [esp + 0x28]
mov dword [esp + 0x24], esi
jne 0x4a45d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa8c
ret
Function at 0x4034d0
Capabilities:
Delete directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc44
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
push ebx
push esi
xor esi, esi
cmp dword [0x4d3590], 0x594
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], eax
jne 0x403515
push 0x402b50
call dword [sym.imp.KERNEL32.dll_DeleteVolumeMountPointW]
push 0x402bac
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAddAtomW]
mov eax, dword [0x422d28]
mov edi, dword [0x422d2c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], esi
call fcn.004034c9
mov eax, dword [0x422d30]
add dword [ebp - 0x14], 0x23f
mov ebx, dword [0x422d34]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov eax, dword [ebp - 0xc]
mov ecx, eax
shl ecx, 4
cmp dword [0x4d3590], 0xc
mov dword [ebp - 4], ecx
jne 0x4035b2
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x444]
push eax
push esi
push 0x402bc4
push 0x402bd8
push 0x402be8
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push esi
lea eax, [ebp - 0x844]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
lea eax, [ebp - 0x28]
push eax
push esi
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadConsoleInputA]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x20]
add dword [ebp - 4], ecx
mov ecx, dword [0x4d3590]
cmp ecx, 0xfa9
jne 0x4035d0
mov dword [0x4d2b2c], 0xedeb2e40
cmp ecx, 0x3eb
jne 0x4035de
mov dword [0x4d24dc], esi
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 0x10]
shr eax, cl
mov dword [0x4d2b28], 0xf4ea3dee
add eax, ebx
mov ecx, eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor ecx, dword [ebp - 4]
cmp dword [0x4d3590], 0x213
mov dword [ebp - 0x18], ecx
jne 0x40361d
push esi
push 0x402bfc
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 0x18]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
cmp dword [0x4d3590], 0xc
jne 0x403666
lea eax, [ebp - 0x18]
push eax
push esi
push esi
lea eax, [ebp - 0x30]
push eax
push esi
push esi
push esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_BackupWrite]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_PrepareTape]
push esi
lea eax, [ebp - 0xc44]
push eax
push 0x402c28
call dword [sym.imp.KERNEL32.dll_GetVolumePathNameW]
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
lea edx, [ecx + eax]
mov ecx, dword [ebp - 0x10]
shr eax, cl
add eax, edi
xor eax, edx
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
call fcn.004034c2
dec dword [ebp - 0x1c]
jne 0x40354a
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
mov dword [eax], ecx
mov ecx, dword [ebp - 8]
pop esi
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x4036b6
Capabilities:
Create pipe
Get common file path
Terminate thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4d3590]
mov ecx, dword [0x4d24e0]
sub esp, 0xc34
push ebx
push esi
shr eax, 3
xor esi, esi
push edi
cmp eax, esi
jbe 0x4037af
mov ebx, ecx
mov dword [ebp - 4], eax
cmp dword [0x4d3590], 0x959
jne 0x40379d
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputA]
xor eax, eax
mov word [ebp - 8], ax
lea edi, [ebp - 6]
stosw word es:[edi], ax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 8]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FillConsoleOutputCharacterW]
push esi
push esi
lea eax, [ebp - 0xc30]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402c90
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0x402cf8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerW]
push esi
push esi
push esi
push esi
push esi
push esi
push 0x402d28
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
call fcn.004034d0
add ebx, 8
dec dword [ebp - 4]
jne 0x4036df
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40564b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422494]
jne 0x405655
repz ret
jmp fcn.00408e6c

Function at 0x40ac8b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406c16
and dword [ebp - 4], 0
cmp dword [0x424108], 0
mov ebx, eax
jne 0x40ad3c
push 0x4021bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40aded
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4021b0
push edi
call esi
test eax, eax
je 0x40aded
push eax
call fcn.00406ba4
mov dword [esp], 0x4021a0
push edi
mov dword [0x424108], eax
call esi
push eax
call fcn.00406ba4
mov dword [esp], 0x40218c
push edi
mov dword [0x42410c], eax
call esi
push eax
call fcn.00406ba4
mov dword [esp], 0x402170
push edi
mov dword [0x424110], eax
call esi
push eax
call fcn.00406ba4
pop ecx
mov dword [0x424118], eax
test eax, eax
je 0x40ad3c
push 0x402158
push edi
call esi
push eax
call fcn.00406ba4
pop ecx
mov dword [0x424114], eax
mov eax, dword [0x424114]
cmp eax, ebx
je 0x40ad94
cmp dword [0x424118], ebx
je 0x40ad94
push eax
call fcn.00406c1f
push dword [0x424118]
mov esi, eax
call fcn.00406c1f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40ad94
test edi, edi
je 0x40ad94
call esi
test eax, eax
je 0x40ad8b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40ad8b
test byte [ebp - 0xc], 1
jne 0x40ad94
or dword [ebp + 0x10], 0x200000
jmp 0x40adcd
mov eax, dword [0x42410c]
cmp eax, ebx
je 0x40adcd
push eax
call fcn.00406c1f
pop ecx
test eax, eax
je 0x40adcd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40adcd
mov eax, dword [0x424110]
cmp eax, ebx
je 0x40adcd
push eax
call fcn.00406c1f
pop ecx
test eax, eax
je 0x40adcd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424108]
call fcn.00406c1f
pop ecx
test eax, eax
je 0x40aded
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40adef
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4026ac
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffff7e0
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.0040ea54
mov ecx, eax
mov edx, esp
lea eax, [esp + 0x400]
call fcn.0040eb28
test eax, eax
jne 0x402743
push 0x4131f8
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.0040ea54
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x800]
mov ecx, 0x1e
xor edx, edx
call fcn.0040e9d4
mov dword [esp + 0x804], 3
mov word [esp + 0x810], 0x14
mov eax, esp
mov dword [esp + 0x808], eax
lea edx, [esp + 0x800]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x820
ret

Function at 0x4027fe
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x413054], 0
je 0x402875
cmp byte [0x414960], 0
je 0x402875
lea edx, [esp + 8]
mov eax, 0x414960
call fcn.004027cd
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x402875
mov eax, ebx
call fcn.0040ea54
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x40287d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x413054], 0
je 0x4028f6
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.004027cd
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4028f6
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4028ee
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.0040ead4
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x4029e0
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret

Function at 0x4029ea
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret