joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b6e
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
lea eax, [esp + 4]
push ebp
push esi
mov esi, dword [esp + 0x1264]
push edi
mov edi, dword [esp + 0x1270]
push eax
cmp esi, 0xffffffff
jne 0x404c0d
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ebx
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x404c36
push 0x800
lea eax, [esp + 0x264]
push eax
push ebx
call fcn.00404fa3
test al, al
je 0x404be6
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x264]
push eax
call ebp
mov esi, eax
cmp esi, 0xffffffff
jne 0x404c36
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x404c00
cmp eax, 3
je 0x404c00
cmp eax, 0x12
je 0x404c00
xor eax, eax
inc eax
jmp 0x404c02
xor eax, eax
mov byte [edi + 0x1044], al
jmp 0x404cde
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x404c2d
or esi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [edi + 0x1044], al
cmp esi, 0xffffffff
je 0x404cde
mov ebp, 0x800
push ebp
push ebx
push edi
call fcn.00406e4c
push ebp
lea eax, [esp + 0x40]
push eax
push edi
call fcn.0040531c
mov ecx, dword [esp + 0x2c]
xor eax, eax
add eax, dword [esp + 0x30]
mov dword [edi + 0x1000], eax
mov eax, dword [esp + 0x10]
adc ecx, 0
mov dword [edi + 0x1008], eax
mov eax, dword [esp + 0x14]
mov dword [edi + 0x1028], eax
mov eax, dword [esp + 0x18]
mov dword [edi + 0x102c], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + 0x1030], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x1034], eax
mov eax, dword [esp + 0x24]
mov dword [edi + 0x1038], eax
mov eax, dword [esp + 0x28]
mov dword [edi + 0x103c], eax
lea eax, [esp + 0x24]
mov dword [edi + 0x1004], ecx
lea ecx, [edi + 0x1010]
push eax
call fcn.004070ab
lea eax, [esp + 0x14]
push eax
lea ecx, [edi + 0x1018]
call fcn.004070ab
lea eax, [esp + 0x1c]
push eax
lea ecx, [edi + 0x1020]
call fcn.004070ab
and dword [edi + 0x1040], 0
mov eax, esi
mov ecx, dword [esp + 0x1260]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409f4a
add esp, 0x1254
ret 0xc

Function at 0x404f1b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
xor ebx, ebx
mov word [esi], ax
lea eax, [ebp + 8]
push eax
push 1
push ebx
push str.SoftwareWinRARPaths
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [ebp + 0xc]
test eax, eax
jne 0x404f6e
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push str.AppData
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], bx
je 0x404f7d
push esi
call fcn.0040409d
test al, al
jne 0x404f9a
push dword [ebp + 0x10]
push edi
push esi
call fcn.00404df7
test al, al
jne 0x404f9a
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.004052f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404fa3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
mov edi, dword [esp + 0x1014]
cmp word [esi], 0
jne 0x404fd8
xor al, al
jmp 0x405143
push ebx
push ebp
push esi
call fcn.0040515c
push esi
call fcn.0040d948
pop ecx
push esi
mov ebx, eax
call fcn.00405188
test al, al
je 0x405079
push esi
call fcn.0040515c
test al, al
je 0x40502f
lea eax, [ebx + 4]
cmp dword [esp + 0x1020], eax
jbe 0x40513f
push dword [esp + 0x1020]
push 0x421468
push edi
call fcn.00406e4c
push dword [esp + 0x1020]
jmp 0x405134
push 0x5c
pop eax
cmp word [esi], ax
jne 0x40513f
lea ebp, [esi + 2]
cmp word [ebp], ax
jne 0x40513f
mov esi, dword [esp + 0x1020]
lea eax, [ebx + 6]
cmp esi, eax
jbe 0x40513f
push esi
push 0x421468
push edi
call fcn.00406e4c
push esi
push 0x421474
push edi
call fcn.00406e24
push esi
push ebp
jmp 0x405135
lea eax, [esp + 0x10]
mov ebp, 0x7ff
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40513f
cmp eax, ebp
ja 0x40513f
movzx eax, word [esi]
push eax
call fcn.004051be
test al, al
je 0x4050da
lea eax, [ebx + 6]
mov ebx, dword [esp + 0x1020]
cmp ebx, eax
jbe 0x40513f
push ebx
push 0x421468
push edi
call fcn.00406e4c
xor eax, eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x10]
push ebx
push eax
push edi
call fcn.00406e24
jmp 0x405133
push 0x800
lea eax, [esp + 0x14]
push eax
call fcn.00404d86
lea eax, [esp + 0x10]
push eax
call fcn.0040d948
add ebx, 4
add eax, ebx
mov ebx, dword [esp + 0x1024]
pop ecx
cmp ebx, eax
jbe 0x40513f
push ebx
push 0x421468
push edi
call fcn.00406e4c
push ebx
lea eax, [esp + 0x14]
push eax
push edi
call fcn.00406e24
cmp word [esi], 0x2e
jne 0x405133
movzx eax, word [esi + 2]
push eax
call fcn.004051be
test al, al
je 0x405133
add esi, 4
push ebx
push esi
push edi
call fcn.00406e24
mov al, 1
jmp 0x405141
xor al, al
pop ebp
pop ebx
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.00409f4a
add esp, 0x1004
ret 0xc
Function at 0x40675f
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
cmp esi, edi
je 0x40678c
push dword [ebp + 0x10]
push edi
push esi
call fcn.00406e4c
lea eax, [ebp - 0x2008]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x406861
push edi
call fcn.0040d948
pop ecx
mov ecx, 0x7ff
sub ecx, eax
lea eax, [ebp - 0x200c]
push eax
lea eax, [ebp - 0x2004]
add ecx, ecx
push eax
lea eax, [ebp - 0x2010]
mov dword [ebp - 0x200c], ecx
push eax
push 0
push str.LanguageFolder
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406855
push ebx
mov word [ebp - 0x1004], ax
mov ebx, 0x800
push ebx
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x2004]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push ebx
lea eax, [ebp - 0x1004]
push eax
call fcn.00404d86
push ebx
push edi
call fcn.004052a6
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.00406e24
lea eax, [ebp - 0x1004]
push eax
call fcn.0040409d
pop ebx
test al, al
je 0x406855
push dword [ebp + 0x10]
lea eax, [ebp - 0x1004]
push eax
push esi
call fcn.00406e4c
push dword [ebp - 0x2008]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00409f4a
mov esp, ebp
pop ebp
ret 0xc

Function at 0x406873
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x10a0]
mov eax, 0x1120
call fcn.00409f60
mov eax, dword [0x42a664]
xor eax, ebp
mov dword [ebp + 0x109c], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10ac]
mov ebx, ecx
call fcn.004069e9
lea eax, [ebp + 0x9c]
mov esi, 0x800
push esi
test edi, edi
je 0x4068bb
push edi
push eax
call fcn.00406e4c
jmp 0x4068c4
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.rarlng.dll
lea eax, [ebp + 0x9c]
push eax
call fcn.0040531c
push esi
lea eax, [ebp + 0x9c]
push eax
push eax
call fcn.0040675f
lea eax, [ebp - 0x80]
mov dword [ebp - 0x80], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 2
pop eax
cmp dword [ebp - 0x70], eax
jne 0x406920
cmp dword [ebp - 0x7c], 5
ja 0x40690e
jne 0x406920
cmp word [ebp + 0x94], ax
jb 0x406920
push eax
push 0
lea eax, [ebp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x40692d
lea eax, [ebp + 0x9c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x42cfe8], eax
pop edi
setne al
mov byte [ebx], al
test al, al
mov eax, dword [ebp + 0x10a8]
pop esi
pop ebx
jne 0x40694b
mov dword [0x42cfe8], eax
mov ecx, dword [ebp + 0x109c]
xor ecx, ebp
mov dword [0x42cfec], eax
call fcn.00409f4a
lea esp, [ebp + 0x10a0]
pop ebp
ret 8
Function at 0x407f2f
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x5a4
mov eax, dword [0x42a664]
xor eax, esp
mov dword [esp + 0x5a0], eax
push ebp
push esi
mov esi, dword [esp + 0x5b4]
xor ebp, ebp
push edi
mov edi, dword [esp + 0x5b4]
cmp word [esi], bp
je 0x40800a
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebp
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40800a
push ebx
lea eax, [esp + 0x18]
mov ebx, ebp
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x407fdc
lea eax, [esp + 0x20]
push eax
push esi
push str._s_s
lea eax, [esp + 0x1bc]
push 0x200
push eax
call fcn.00403379
add esp, 0x14
lea eax, [esp + 0x1b0]
push eax
push edi
call fcn.00407f2f
lea eax, [esp + 0x18]
inc ebx
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ebx
push dword [esp + 0x30]
mov dword [esp + 0x30], 0xc8
call ebp
test eax, eax
je 0x407f98
push dword [esp + 0x14]
call fcn.00407584
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
pop ebx
test eax, eax
jne 0x40800a
inc dword [0x4321e8]
mov ecx, dword [esp + 0x5ac]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.00409f4a
add esp, 0x5a4
ret 8

Function at 0x408086
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x42a664]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push edi
push ebx
push esi
call fcn.00407666
test al, al
jne 0x408100
push 0x200
lea eax, [ebp - 0x404]
push eax
push ebx
push esi
call fcn.004083d2
test al, al
je 0x408100
lea eax, [ebp - 0x408]
push eax
push 0x20006
push 0
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x408100
push edi
push dword [ebp - 0x408]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x408]
call fcn.00407584
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409f4a
mov esp, ebp
pop ebp
ret 0xc

Function at 0x408140
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407989
test al, al
je 0x408165
mov eax, dword [ebp - 4]
jmp 0x4081b5
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408435
mov edi, eax
mov dword [ebp + 0x14], 4
test edi, edi
je 0x4081b2
push ebx
lea eax, [ebp + 0x14]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
neg ebx
push edi
sbb bl, bl
call fcn.00407584
add bl, 1
pop ebx
je 0x4081b2
cmp dword [ebp + 0x14], 0
je 0x4081b2
mov esi, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4081d5
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov eax, dword [0x42a664]
xor eax, esp
mov dword [esp + 0x810], eax
mov ecx, dword [esp + 0x820]
lea edx, [esp + 0x10]
mov eax, dword [esp + 0x81c]
push ebx
mov ebx, dword [esp + 0x82c]
push ebp
mov ebp, dword [esp + 0x820]
push esi
push edi
mov edi, dword [esp + 0x834]
push 0x400
push edx
push ecx
push eax
push ebp
mov dword [esp + 0x24], eax
mov dword [esp + 0x2c], ecx
call fcn.00407d2e
test al, al
jne 0x408249
mov esi, dword [esp + 0x83c]
push esi
push ebx
push edi
call fcn.00406e4c
cmp byte [0x42a1b1], 0
sete al
jmp 0x40826a
lea eax, [esp + 0x20]
push eax
call fcn.00407a41
test eax, eax
jne 0x408259
mov eax, ebx
mov esi, dword [esp + 0x83c]
push esi
push eax
push edi
call fcn.00406e4c
mov al, 1
test al, al
je 0x408272
mov al, 1
jmp 0x4082e9
push dword [esp + 0x10]
push ebp
call fcn.00408435
mov ebp, eax
xor eax, eax
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x4082dd
lea ecx, [esi + esi]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x10]
push ecx
push edi
lea ecx, [esp + 0x24]
push ecx
push eax
push dword [esp + 0x28]
push ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
push ebp
sbb al, al
inc al
mov byte [esp + 0x18], al
call fcn.00407584
cmp byte [esp + 0x14], 0
je 0x4082dd
mov eax, dword [esp + 0x10]
shr eax, 1
test esi, esi
jne 0x4082ce
xor eax, eax
mov word [edi], ax
jmp 0x4082e5
dec esi
cmp eax, esi
jb 0x4082d5
mov eax, esi
xor ecx, ecx
mov word [edi + eax*2], cx
jmp 0x4082e5
push esi
push ebx
push edi
call fcn.00406e4c
mov al, byte [esp + 0x14]
mov ecx, dword [esp + 0x820]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409f4a
add esp, 0x814
ret 0x18

Function at 0x4084be
Capabilities:
Set registry value

Disassembly:
sub esp, 0x808
mov eax, dword [0x42a664]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
mov ebx, dword [esp + 0x814]
lea eax, [esp + 8]
push ebp
mov ebp, dword [esp + 0x81c]
push esi
mov esi, dword [esp + 0x824]
push edi
mov edi, dword [esp + 0x81c]
push 0x400
push eax
push ebp
push ebx
push edi
call fcn.00407d2e
test al, al
jne 0x408513
cmp byte [0x42a1b1], al
sete al
jmp 0x408522
push 1
push esi
lea eax, [esp + 0x1c]
push eax
call fcn.004075d9
mov al, 1
test al, al
je 0x40852a
xor eax, eax
jmp 0x408568
lea eax, [esp + 0x10]
push eax
push ebx
push edi
call fcn.00407e07
mov edi, eax
test edi, edi
je 0x408562
push esi
call fcn.0040d948
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push ebp
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov esi, eax
call fcn.00407584
jmp 0x408566
mov esi, dword [esp + 0x10]
mov eax, esi
mov ecx, dword [esp + 0x814]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409f4a
add esp, 0x808
ret 0x10
Function at 0x40882d
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x4227fc
push 1
push ebx
push 0x42281c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4088fe
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x42280c
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x4088f5
cmp byte [ebp + 8], bl
je 0x408880
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x40889d
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
push ebx
mov ecx, dword [eax]
cmp dword [ebp + 0x1c], ebx
jne 0x4088af
push 0x4202f0
jmp 0x4088b2
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x4088c7
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4088d8
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
js 0x4088ec
mov bl, 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x40894a
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x409b2d
Capabilities:
Accept command line arguments
Create process on windows
Query environment variable

Disassembly:
sub esp, 0x808
mov eax, dword [0x42a664]
xor eax, esp
mov dword [esp + 0x804], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x818]
push edi
push 1
call fcn.00407067
xor ebx, ebx
mov ecx, 0x42d000
push ebx
push esi
call fcn.00406873
push str.uninstall.lng
mov ecx, 0x42d008
call fcn.00405b70
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
push str.riched20.dll
call fcn.00407006
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
mov ebp, str.RARICON
push ebp
push dword [0x42cfe8]
mov edi, eax
call esi
mov dword [0x433208], eax
test eax, eax
jne 0x409bb6
mov eax, dword [0x42cfec]
cmp eax, dword [0x42cfe8]
je 0x409bb6
push ebp
push eax
call esi
mov dword [0x433208], eax
push str.MS_Shell_Dlg
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x2bc
push ebx
push ebx
push ebx
push 0xfffffffffffffff4
call fcn.00408907
push eax
call dword [sym.imp.GDI32.dll_CreateFontW]
mov dword [0x43320c], eax
xor eax, eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
push 0x400
push eax
push str.sfxcmd
mov byte [esp + 0x1e], bl
mov byte [esp + 0x1f], bl
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [esp + 0x13]
push eax
lea eax, [esp + 0x16]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
call fcn.00408ea7
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x13]
push ecx
lea ecx, [esp + 0x16]
push ecx
push eax
push ebx
call fcn.00408ea7
cmp byte [esp + 0x12], bl
je 0x409cf9
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamW]
push ebx
push 0x409103
push ebx
push str.SETUPDLG
push dword [0x42cfe8]
call esi
test eax, eax
je 0x409cf9
call fcn.00408b40
cmp byte [0x434261], bl
jne 0x409cb4
push ebx
push 0x408c29
push ebx
push str.DONEDLG
push dword [0x42cfe8]
call esi
call fcn.004015b8
test eax, eax
je 0x409cb4
cmp byte [0x434260], bl
jne 0x409cb4
call fcn.00408e6e
test al, al
jne 0x409cb4
push 0x40
push 0x13ed
call fcn.00406967
push eax
push 0x140a
call fcn.00406967
push eax
push ebx
call fcn.00408961
cmp word [0x433210], bx
je 0x409cf9
cmp byte [0x434260], bl
jne 0x409cf9
cmp byte [0x434261], bl
jne 0x409cf9
cmp byte [0x434262], bl
jne 0x409cf9
mov esi, 0x433210
push esi
call fcn.0040409d
test al, al
je 0x409cf9
push 1
push 0x4202f0
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp byte [esp + 0x13], bl
je 0x409d04
call fcn.004094ce
test edi, edi
je 0x409d0f
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
call dword [sym.imp.ole32.dll_OleUninitialize]
push dword [0x43320c]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [0x433208]
call esi
mov ecx, dword [esp + 0x814]
mov eax, dword [0x434264]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00409f4a
add esp, 0x808
ret 0x10
Function at 0x40f2b3
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40f24f
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x40f26d
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40f2cb
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x40f2b2
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40f2bb
pop ebp
or byte [esp + eax - 0x80], dh
or al, 8
add bh, byte [ecx]
pop ebp
adc byte [ebp + eax + 3], dh
enter 0x980, 4
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x40f2c5
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x40f2a7
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x40f231
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x40f318
dec eax
je 0x40f30f
sub eax, 3
je 0x40f306
mov dword [ebp - 4], 0x40
jmp 0x40f335
mov dword [ebp - 4], 4
jmp 0x40f31b
mov dword [ebp - 4], 0x20
jmp 0x40f31b
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x40f367
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x40f2e7
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0040eb78
mov edx, eax
mov eax, dword [0x1475ff5a]
push 1
push esi
call edi
mov eax, esi
jmp 0x40f373
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40f794
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
invalid

Function at 0x40ffa2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x40ffce
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
invalid
invalid
invalid
invalid
Function at 0x410000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push esp
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040eb78
into
inc ebx
inc ecx
or byte [ebp - 0x72b7b], 0xff
push eax
call fcn.0040eb88
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0040eb3d
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0040eb78
jmp [edi + 0x31]
les esi, [ebx - 0x73]
test esi, ebx
clc
invalid
test eax, ebp
clc
invalid

Function at 0x41b9ba
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041b839