joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403f85
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, esi
call fcn.00401411
push 2
mov ecx, esi
call fcn.00402535
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push 1
call edi
mov ecx, dword [esi]
and word [ecx], 0
and dword [esi + 4], 0
test eax, eax
jbe 0x403fd8
lea ebx, [eax + 1]
push ebx
mov ecx, esi
call fcn.00402535
push eax
push ebx
call edi
mov edi, dword [esi]
push edi
call fcn.00401117
and word [edi + eax*2], 0
pop ecx
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
and dword [ebp + 8], 0
lea ecx, [eax + 0xf]
mov dword [ebp - 4], ecx
lea ebx, [eax + eax]
push dword [ebp - 4]
mov ecx, esi
call fcn.00402535
push dword [ebp + 8]
add eax, ebx
push dword [ebp + 0xc]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [esi]
push edi
call fcn.00401117
and word [edi + eax*2], 0
add esp, 0x10
push dword [esi]
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40402d
inc dword [ebp + 8]
cmp dword [ebp + 8], 0xfff
jl 0x403fe8
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x404034
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [0x41738c], esi
jle 0x404088
mov eax, dword [0x417390]
mov eax, dword [eax + esi*4]
add eax, 0xc
push eax
lea ecx, [ebp - 0xc]
call fcn.004012f7
lea eax, [ebp - 0xc]
push eax
call fcn.00403b7f
mov eax, dword [0x417390]
mov eax, dword [eax + esi*4]
pop ecx
push dword [ebp - 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push dword [ebp - 0xc]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
inc esi
cmp esi, dword [0x41738c]
pop ecx
jl 0x404045
pop esi
leave
ret
Function at 0x404405
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2a4
push ebx
push esi
push edi
call fcn.00401f47
push 3
call fcn.00401f9d
push 0x28
mov dword [0x417764], eax
call fcn.00401f9d
push 2
mov dword [0x417760], eax
call fcn.00401f9d
push 5
mov dword [0x41775c], eax
call fcn.00401f9d
push 0x15
mov dword [0x417758], eax
call fcn.00401f9d
push 0x16
mov dword [0x417754], eax
call fcn.00401f9d
push 0x17
mov dword [0x417750], eax
call fcn.00401f9d
add esp, 0x1c
xor ebx, ebx
mov dword [0x41774c], eax
mov dword [0x417744], ebx
mov dword [0x417748], ebx
mov edi, 0x417384
xor esi, esi
push esi
push ebx
lea eax, [ebp - 0x2a4]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x404529
push ebx
lea eax, [ebp - 0x98]
push 0x41440c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x18]
call fcn.00401411
lea ecx, [ebp - 0xc]
call fcn.00401411
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x18]
call fcn.00401329
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xc]
call fcn.00401329
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00402f6c
cmp dword [esi + 0x41735c], ebx
jne 0x404519
push dword [esi + 0x417360]
lea ecx, [ebp - 0x18]
call fcn.00401329
lea eax, [ebp - 0x2a4]
push eax
lea ecx, [ebp - 0xc]
call fcn.00401329
lea eax, [ebp - 0x18]
push eax
mov ecx, edi
call fcn.00402f6c
add esi, 8
cmp esi, 0x28
jb 0x4044e9
lea ecx, [ebp - 0x18]
call fcn.00402425
inc ebx
cmp ebx, 0x40
jl 0x404480
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404aff
Capabilities:
Create process on windows
Get disk information
Self delete
Set file attributes
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, dword [ebp + 8]
cmp word [esi + 2], 0x3a
jne 0x404cb1
movzx eax, word [esi + 4]
cmp ax, 0x5c
je 0x404b29
cmp ax, 0x2f
jne 0x404cb1
mov ax, word [esi]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xc], 0x5c
mov word [ebp - 0xa], bx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0x404cb1
lea eax, [ebp - 0x28]
push str.7ZSfx_03x.cmd
push eax
call fcn.00403f85
pop ecx
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x404c7b
push edi
lea ecx, [ebp - 0x1c]
call fcn.00401411
push str.:Repeat_r_n
lea ecx, [ebp - 0x1c]
call fcn.00401329
mov edi, str.del__
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040254d
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004013e2
mov esi, 0x414498
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040254d
push str.if_exist__
lea ecx, [ebp - 0x1c]
call fcn.0040254d
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004013e2
push str.__goto_Repeat_r_n
lea ecx, [ebp - 0x1c]
call fcn.0040254d
push edi
lea ecx, [ebp - 0x1c]
call fcn.0040254d
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.004013e2
push esi
lea ecx, [ebp - 0x1c]
call fcn.0040254d
mov esi, dword [ebp - 0x18]
push 1
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.00402776
mov eax, dword [eax]
add esp, 0xc
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x34]
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
pop edi
je 0x404c8c
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x18]
jne 0x404c8c
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push ebx
push dword [ebp - 0x28]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov esi, dword [ebp + 8]
pop ecx
push dword [ebp - 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
jmp 0x404cb7
push dword [ebp - 0x28]
call fcn.00402c86
push dword [ebp - 0x1c]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x28]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
push dword [ebp + 8]
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0x10
jmp 0x404cb8
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x40653f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp + 8]
push eax
mov dword [ecx], eax
call fcn.00406501
add esp, 0x1c
leave
ret
Function at 0x408676
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop edx
mov esi, eax
and esi, 1
dec esi
not esi
and esi, 0xedb88320
shr eax, 1
xor eax, esi
dec edx
jne 0x40867e
mov dword [ecx*4 + 0x417920], eax
inc ecx
cmp ecx, 0x100
jb 0x408679
mov edx, 0x800
jmp 0x4086cb
mov eax, dword [ecx*4 + 0x417520]
mov esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x417920]
inc ecx
mov dword [ecx*4 + 0x41791c], eax
cmp ecx, edx
jb 0x4086aa
mov dword [0x417800], 0x412070
call fcn.0040d806
test eax, eax
pop esi
jne 0x4086ed
mov dword [0x417800], 0x411f90
ret
Function at 0x40d9a5
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40d9cb
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40d9cb
xor al, al
jmp 0x40d9eb
push 1
push 0
push 0
push dword [ebp - 4]
call fcn.00411d50
mov ecx, eax
xor eax, eax
add ecx, esi
adc edx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x4113ce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x4113e7
leave
ret
add dword [ebp + 0x10], 5
or dword [ebp + 0xc], 0xffffffff
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [edi + ecx - 4]
mov dword [ebp - 4], ecx
lea esi, [eax + edi]
jmp 0x41140a
mov al, byte [esi]
and al, 0xfe
cmp al, 0xe8
je 0x41140f
inc esi
cmp esi, dword [ebp - 4]
jb 0x411401
mov eax, esi
sub eax, edi
cmp esi, dword [ebp - 4]
mov dword [ebp - 8], eax
jae 0x411504
mov ecx, eax
sub ecx, dword [ebp + 0xc]
cmp ecx, 3
jbe 0x411463
xor edx, edx
mov cl, byte [esi + 4]
test cl, cl
mov dword [ebp + 0xc], eax
je 0x41143a
cmp cl, 0xff
jne 0x41148e
xor ebx, ebx
mov bh, cl
movzx ecx, byte [esi + 2]
mov bl, byte [esi + 3]
shl ebx, 8
or ebx, ecx
movzx ecx, byte [esi + 1]
shl ebx, 8
or ebx, ecx
mov edi, ebx
cmp dword [ebp + 0x18], 0
je 0x41149c
lea ebx, [edi + eax]
add ebx, dword [ebp + 0x10]
jmp 0x4114a3
dec ecx
shl edx, cl
and edx, 7
je 0x41142b
movzx ecx, byte [edx + 0x414b90]
mov ebx, esi
sub ebx, ecx
cmp byte [edx + 0x414b88], 0
mov cl, byte [ebx + 4]
je 0x41148b
test cl, cl
je 0x41148b
cmp cl, 0xff
jne 0x41142b
mov dword [ebp + 0xc], eax
and edx, 3
add edx, edx
or edx, 1
inc eax
jmp 0x4113fc
sub edi, eax
sub edi, dword [ebp + 0x10]
mov ebx, edi
test edx, edx
je 0x4114d7
movzx edi, byte [edx + 0x414b90]
push 0x18
shl edi, 3
pop ecx
sub ecx, edi
mov eax, ebx
shr eax, cl
test al, al
je 0x4114c2
cmp al, 0xff
jne 0x4114d4
mov eax, dword [ebp - 8]
push 0x20
pop ecx
sub ecx, edi
xor edi, edi
inc edi
shl edi, cl
dec edi
xor edi, ebx
jmp 0x411455
mov eax, dword [ebp - 8]
mov edi, dword [ebp + 8]
mov ecx, ebx
shr ecx, 0x18
and cl, 1
dec cl
not cl
mov byte [esi + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [esi + 3], cl
mov ecx, ebx
shr ecx, 8
mov byte [esi + 2], cl
mov byte [esi + 1], bl
add eax, 5
jmp 0x4113fc
mov esi, eax
sub esi, dword [ebp + 0xc]
push 3
lea ecx, [esi - 1]
shl edx, cl
pop edi
and edx, 7
cmp edi, esi
sbb ecx, ecx
not ecx
pop edi
and ecx, edx
mov edx, dword [ebp + 0x14]
pop esi
mov dword [edx], ecx
pop ebx
leave
ret
Function at 0x4a3760
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x85000]
push edi
or ebp, 0xffffffff
jmp 0x4a3782
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4a3789
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a3778
mov eax, 1
add ebx, ebx
jne 0x4a379b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4a37ac
jne 0x4a37cb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a37cb
dec eax
add ebx, ebx
jne 0x4a37b8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4a3790
add ebx, ebx
jne 0x4a37c7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4a381d
xor ecx, ecx
sub eax, 3
jb 0x4a37e3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4a3852
sar eax, 1
mov ebp, eax
jmp 0x4a37ee
add ebx, ebx
jne 0x4a37ee
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a37bc
inc ecx
add ebx, ebx
jne 0x4a37fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4a37bc
add ebx, ebx
jne 0x4a3809
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4a37fe
jne 0x4a381a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4a37fe
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4a383c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4a382e
jmp 0x4a377e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4a383c
add edi, ecx
jmp 0x4a377e
pop esi
mov edi, esi
mov ecx, 0x26a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4a385a
cmp byte [edi], 8
jne 0x4a385a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4a385f
lea edi, [esi + 0xa1000]
mov eax, dword [edi]
or eax, eax
je 0x4a38d7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xa8bb8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xa8bf4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4a388c
mov ecx, edi
jns 0x4a38bb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xa8bf8]
or eax, eax
je 0x4a38d1
mov dword [ebx], eax
add ebx, 4
jmp 0x4a38a9
call dword [esi + 0xa8c08]
popal
jmp 0x402584
Function at 0x4860a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x54000]
push edi
or ebp, 0xffffffff
jmp 0x4860c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4860c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4860b8
mov eax, 1
add ebx, ebx
jne 0x4860db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4860ec
jne 0x48610b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48610b
dec eax
add ebx, ebx
jne 0x4860f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4860d0
add ebx, ebx
jne 0x486107
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48615d
xor ecx, ecx
sub eax, 3
jb 0x486123
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x486192
sar eax, 1
mov ebp, eax
jmp 0x48612e
add ebx, ebx
jne 0x48612e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4860fc
inc ecx
add ebx, ebx
jne 0x48613c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4860fc
add ebx, ebx
jne 0x486149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48613e
jne 0x48615a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48613e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48617c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48616e
jmp 0x4860be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48617c
add edi, ecx
jmp 0x4860be
pop esi
mov edi, esi
mov ecx, 0x124b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48619a
cmp byte [edi], 0x16
jne 0x48619a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48619f
lea edi, [esi + 0x83000]
mov eax, dword [edi]
or eax, eax
je 0x486217
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8a79c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8a7f4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4861cc
mov ecx, edi
jns 0x4861fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8a7fc]
or eax, eax
je 0x486211
mov dword [ebx], eax
add ebx, 4
jmp 0x4861e9
call dword [esi + 0x8a7f8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x486248
cmp al, 0xef
ja 0x48623b
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x48621d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x48622a
mov ebp, dword [esi + 0x8a800]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48627c
sub esp, 0xffffff80
jmp 0x4205e0
Function at 0x404b10
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24c0
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x24c0]
call fcn.00403517
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x24c0]
push eax
push dword [ebp + 0xc]
push edi
call fcn.00406007
test al, al
je 0x404ca9
cmp byte [ebp - 0x24c0], bl
je 0x404ca9
cmp byte [ebp - 0x1840], bl
je 0x404ca9
lea eax, [ebp - 0x1840]
push eax
lea eax, [ebp - 0x24c0]
push eax
call fcn.004073b4
push eax
call fcn.0040dae4
test eax, eax
je 0x404ca9
lea eax, [ebp - 0x1840]
push eax
push edi
call fcn.004073b4
push eax
call fcn.0040dae4
test eax, eax
jne 0x404ca9
mov esi, 0x400
push esi
push edi
lea eax, [ebp - 0x400]
push eax
call fcn.0040dbc0
push ebx
push str.rtmp_d
lea eax, [ebp - 0x400]
push eax
call fcn.004073b4
push eax
call fcn.0040a5e9
add esp, 0xc
push 0
lea eax, [ebp - 0x400]
push eax
call fcn.0040572e
test al, al
je 0x404be8
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x404ba2
push 0
lea eax, [ebp - 0x400]
push eax
call fcn.0040572e
test al, al
jne 0x404ca9
push esi
push edi
lea eax, [ebp - 0x800]
push eax
call fcn.0040dbc0
lea eax, [ebp - 0x24c0]
push eax
call fcn.004073b4
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.004073b4
push eax
call fcn.0040a450
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test eax, eax
je 0x404ca9
lea ecx, [ebp - 0x1420]
call fcn.00404e8a
push 0
push edi
xor bl, bl
call fcn.0040572e
test al, al
jne 0x404c70
push 1
push 0
push edi
lea ecx, [ebp - 0x1420]
call fcn.0040519f
mov bl, al
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x400]
push eax
call esi
test bl, bl
je 0x404c9a
lea ecx, [ebp - 0x1420]
call fcn.00404ef5
lea ecx, [ebp - 0x1420]
call fcn.00404f73
lea ecx, [ebp - 0x1420]
call fcn.0040503b
mov al, 1
jmp 0x404cab
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x405299
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x4052bf
cmp dword [ebp + 0xc], esi
jbe 0x4052b4
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40530f
mov ecx, edi
call fcn.00405018
test al, al
je 0x4052f5
cmp dword [ebp + 0xc], esi
jbe 0x4052f5
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.00405299
jmp 0x405312
cmp dword [edi + 0xc], 1
jne 0x40530a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x40530a
xor eax, eax
jmp 0x405312
or eax, 0xffffffff
jmp 0x405312
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x40585a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x405871
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00405583

Function at 0x405b5d
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax + 4], ebx
jne 0x405b28
cmp dword [eax + 0xc], ebx
je 0x405bcb
mov edi, dword [eax + 0xc]
add edi, esi
push edi
call dword [ebp - 0xc0]
mov dword [ebp + 0xc], eax
call fcn.00405583
sti
add edx, dword [eax - 0x24]
cmp dword [ebp + 0xc], ebx
jne 0x405b57
push edi
call dword [ebp - 0xb8]
cmp eax, ebx
mov dword [ebp + 0xc], eax
je 0x405d72
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax + 0x10]
mov eax, dword [eax]
cmp eax, ebx
lea edi, [ecx + esi]
jne 0x405b6b
mov dword [ebp + 0x10], edi
jmp 0x405b70
add eax, esi
invalid
inc ebp

Function at 0x40645e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00405561
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.00405593
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00405548
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.00405583
xchg byte [ecx + 0x468d6e1], cl
add dword [eax], eax
add byte [ebp - 0x12b7b], cl
call dword [eax - 1]
xchg ebp, eax
sub al, 0xfc
invalid
Function at 0x40b702
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
lea eax, [ebp - 0x420]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [0x41a815], 0
jne 0x40b791
push 6
push dword [0x41409c]
lea eax, [ebp - 0x420]
push eax
call fcn.004073b4
push eax
call fcn.0040a596
test eax, eax
jne 0x40b791
push 0x41234c
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x420]
push eax
call fcn.0040a35d
push 0x1e
mov byte [ebp + eax - 0x41f], 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.0040a262
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
leave
ret

Function at 0x40b850
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
push ebx
push esi
xor esi, esi
inc esi
xor ebx, ebx
mov dword [0x419f70], esi
cmp dword [0x419f80], ebx
je 0x40b87a
push 0x7d
call fcn.004098d0
push eax
push esi
push dword [0x419f80]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x419f80]
mov dword [0x419f6c], ebx
mov dword [0x419f68], esi
cmp eax, ebx
je 0x40b8ca
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x41a824], ebx
jne 0x40b8c1
cmp byte [0x41a814], bl
jne 0x40b8c1
push ebx
push esi
push 0x111
push dword [0x419f80]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40b8c1
call fcn.0040a806
cmp dword [0x419f78], 2
jne 0x40b8bc
cmp byte [0x419f88], bl
pop esi
pop ebx
je 0x40b8d9
jmp fcn.0040b702
ret

Function at 0x40b908
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp byte [0x419f90], bl
je 0x40b984
cmp byte [0x418ed0], bl
je 0x40b984
push esi
push 0x418ed0
lea esi, [ebp - 0x408]
call fcn.0040b8da
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop esi
test eax, eax
jne 0x40b984
push dword [ebp + 8]
call fcn.0040a35d
inc eax
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4