joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43bfc0
Capabilities:
Access peb ldr_data
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x46d443
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0xc], esi
call fcn.0046097a
lea edi, [esi + 0x64]
mov dword [esp + 0x18], 0
mov dword [edi + 4], 0
mov dword [edi], vtable.CBrush.0
mov eax, dword [esp + 0x2c]
mov ebp, dword [esp + 0x24]
mov ecx, dword [esp + 0x30]
mov dword [esi + 0x3c], eax
mov eax, ebp
mov dword [esi], method.CEdit.virtual_0
mov dword [esi + 0x40], ecx
mov dword [esi + 0x44], 0
mov ecx, dword [eax]
lea edx, [esi + 0x48]
mov byte [esp + 0x18], 1
mov dword [edx], ecx
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov ecx, dword [eax + 8]
mov dword [edx + 8], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x40]
mov dword [edx + 0xc], eax
mov eax, dword [esp + 0x44]
push eax
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
mov ecx, edi
call fcn.00466018
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x20]
push edx
push eax
push ebp
push 0x50800044
mov ecx, esi
call fcn.00467577
test eax, eax
je 0x43c0dc
mov ecx, dword [esp + 0x3c]
call fcn.00466045
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push eax
push 0x30
push ecx
mov dword [esi + 0x58], eax
call ebp
mov edi, dword [esp + 0x34]
test edi, edi
je 0x43c0a0
push edi
mov ecx, esi
call fcn.004636a0
mov ecx, esi
call fcn.0043c240
cmp dword [esp + 0x38], 1
jne 0x43c0d5
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edx, dword [esi + 0x1c]
push 0xffffffffffffffff
not ecx
dec ecx
push ecx
push 0xb1
push edx
call ebp
mov eax, dword [esi + 0x1c]
push 0
push 0
push 0xb7
push eax
call ebp
mov ecx, esi
call fcn.004637db
mov ecx, dword [esp + 0x10]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 0x28
Function at 0x43eb00
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x43eb33
push esi
call fcn.00441c00
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x43eb2c
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x43ebb9
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x43eba2
mov eax, dword [esi + 8]
test eax, eax
je 0x43eb57
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x43eb9e
cmp eax, 2
je 0x43eba2
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x43eb4a
cmp eax, 3
je 0x43eb7d
cmp eax, 1
jne 0x43eb4a
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x43eb4a
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x43eb4a
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.0043ebe0
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x43ebc8
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.0043ebe0
add esp, 4
pop esi
ret

Function at 0x449f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x449f86
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x449f86
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x449f67
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret
Function at 0x44aac0
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0044ac10
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x44aae0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x44aac1
Capabilities:
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0044ac10
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov dword [esi], eax
cmp eax, 0xffffffff
pop esi
jne 0x44aae0
xor eax, eax
pop ecx
ret
lea ecx, [esp]
push 4
push ecx
push 0x1001
push 0xffff
push eax
mov dword [esp + 0x14], 0
call sub.WS2_32.dll_setsockopt
mov eax, 1
pop ecx
ret

Function at 0x44ab10
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push esi
push edi
mov dword [esp + 8], eax
mov edi, ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x10], eax
push ecx
mov dword [esp + 0x18], eax
mov word [esp + 0xc], 2
call sub.WS2_32.dll_htons
mov esi, dword [esp + 0x1c]
mov word [esp + 0xa], ax
push esi
call sub.WS2_32.dll_inet_addr
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x44ab67
push esi
call sub.WS2_32.dll_gethostbyname
test eax, eax
je 0x44ab7d
mov edx, dword [eax + 0xc]
mov eax, dword [edx]
mov ecx, dword [eax]
mov dword [esp + 0xc], ecx
lea edx, [esp + 8]
push 0x10
push edx
mov ecx, edi
call fcn.0044aba0
pop edi
pop esi
add esp, 0x10
ret 8
push 0x2726
call sub.WS2_32.dll_WSASetLastError
pop edi
xor eax, eax
pop esi
add esp, 0x10
ret 8

Function at 0x44aba0
Capabilities:
Connect socket

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [ecx]
push edx
push eax
call sub.WS2_32.dll_connect
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret 8

Function at 0x44ac30
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x44ac79
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4
Function at 0x44b0f0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46d970
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.0044aca0
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.0044ad20
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.0044ad20
lea ecx, [esi + 0xc]
call fcn.0045f356
lea ecx, [esi + 0x10]
call fcn.0045f356
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.0044d550
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.0044d550
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.0044d550
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.0045f3cb
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.0045f3cb
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x44bd98
Capabilities:
Get hostname

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x46db98
push eax
mov dword fs:[0], esp
sub esp, 0x64
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
test eax, eax
je 0x44bda8
call fcn.0044c2c0
mov edi, dword [esp + 0x7c]
test edi, edi
je 0x44be8b
cmp byte [edi], 0
je 0x44be8b
mov eax, dword [esp + 0x8c]
test eax, eax
jg 0x44bdcd
mov eax, 0x7d0
mov ecx, esi
mov dword [esi + 8], eax
call fcn.0044aac0
test eax, eax
jne 0x44bded
push 0x49a460
lea ecx, [esi + 0x38]
call fcn.0045f508
jmp 0x44be8b
mov eax, dword [esp + 0x80]
mov ecx, esi
push eax
push edi
call fcn.0044ab10
test eax, eax
jne 0x44be1c
mov ecx, esi
call fcn.0044ac10
push edi
add esi, 0x38
push 0x49a43c
push esi
call fcn.0045d367
add esp, 0xc
jmp 0x44be8b
push 0xdc
mov ecx, esi
mov dword [esi + 4], 1
call fcn.0044cb40
test eax, eax
je 0x44be84
lea ecx, [esp + 8]
push 0x64
push ecx
call sub.WS2_32.dll_gethostname
mov eax, dword [esp + 0x88]
mov ecx, dword [esp + 0x84]
lea edx, [esp + 0x8c]
mov dword [esp + 0x8c], 1
push edx
push eax
lea edx, [esp + 0x10]
push ecx
push edx
mov ecx, esi
call fcn.0044bf60
test eax, eax
jne 0x44bea0
push edi
lea eax, [esi + 0x38]
push 0x49a418
push eax
call fcn.0045d367
add esp, 0xc
mov ecx, esi
call fcn.0044c2c0
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x64]
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
mov eax, dword [esp + 0x8c]
test eax, eax
je 0x44bf48
mov ecx, dword [0x49a6d0]
mov dword [esp + 0x7c], ecx
lea edx, [esp + 8]
lea eax, [esp + 0x7c]
push edx
push str.HELO__s_r_n
push eax
mov dword [esp + 0x80], 0
call fcn.0045d367
mov edx, dword [esp + 0x88]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
mov ecx, esi
call fcn.0044abc0
test eax, eax
jne 0x44bf0a
push 0x49a3fc
lea ecx, [esi + 0x38]
call fcn.0045f508
jmp 0x44bf1a
push 0xfa
mov ecx, esi
call fcn.0044cb40
test eax, eax
jne 0x44bf37
mov ecx, esi
call fcn.0044c2c0
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045f3cb
jmp 0x44be8b
lea ecx, [esp + 0x7c]
mov dword [esp + 0x74], 0xffffffff
call fcn.0045f3cb
mov ecx, dword [esp + 0x6c]
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x70
ret 0x14
Function at 0x46176f
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4617a7
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0045f826
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0045f7fe
jmp 0x4617b3
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x462e5d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x462e9f
call fcn.00468a21
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x462e9f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x462e96
xor eax, eax
jmp 0x462ea7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00462ead
pop edi
pop esi
pop ebx
ret 4

Function at 0x468f51
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x468f7f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x468f9d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00468eb7
jmp 0x468f9d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x468f9d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00468eb7
test edi, edi
mov eax, edi
jne 0x468f87
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x4012c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4012cf
pop dword [ebp - 0x3c]
mov eax, 0x4012cf
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x47f1433f
sub dword [ebp - 0x4c], 0xf99efdf4
mov dword [ebp - 0x48], 0xb14bfed9
sub dword [ebp - 0x48], 0x7f18b294
mov dword [ebp - 0x44], 0xc8464691
sub dword [ebp - 0x44], 0x7bfa0263
mov dword [ebp - 0x40], 0x92c1ad67
sub dword [ebp - 0x40], 0x92c1ad67
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x55d73038
sub dword [ebp - 0x4c], 0xe164c6e2
mov dword [ebp - 0x48], 0xa09061c3
sub dword [ebp - 0x48], 0x5f24004e
mov dword [ebp - 0x44], 0x6d122f08
sub dword [ebp - 0x44], 0x9a2c29c
mov dword [ebp - 0x40], 0x1f46c263
add dword [ebp - 0x40], 0xe0b93d9d
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x37b20
push 0
call eax
mov ecx, 0x64966292
add ecx, 0x9b69d975
xor esi, esi
add esi, eax
mov edx, 0x41b000
add edx, dword [ebp - 0x3c]
mov ebx, 0xc46a688c
mov dword [ebp - 0xc], 0x4750a4db
mov edi, dword [edx]
mov dword [ebp - 0x2c], 0x75a1468d
sub edi, ebx
sub dword [ebp - 0x1c], 0x2069d6cb
mov dword [esi], edi
xor dword [ebp - 0x2c], 0xe6d30cba
add esi, 0x7a4a0f41
sub esi, 0x7a4a0f3d
add edx, 4
loop 0x4013d8
add eax, 0xe0004956
add eax, 0x20009999
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x402049
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push esi
call fcn.004022b2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x405938], eax
cmp eax, 0xffffffff
je 0x4020a6
push 0x70
push 1
call fcn.0040248c
add esp, 8
mov esi, eax
test esi, esi
je 0x4020a6
push esi
mov eax, dword [0x405938]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4020a6
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov eax, 1
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x50], 0x405090
mov dword [esi + 0x14], 1
jmp 0x4020a8
xor eax, eax
pop esi
ret

Function at 0x4020aa
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push esi
mov eax, dword [0x405938]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
jne 0x402109
push 0x70
push 1
call fcn.0040248c
add esp, 8
mov esi, eax
test esi, esi
je 0x4020ff
push esi
mov eax, dword [0x405938]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4020ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x14], 1
mov dword [esi + 0x50], 0x405090
jmp 0x402109
push 0x10
call fcn.004015e0
add esp, 4
mov eax, esi
pop esi
ret

Function at 0x405938
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
xor ebx, ebx
mov dword [0x40c68c], ebx
xor ebx, ebx
mov dword [0x40c688], ebx
mov dword [0x40c678], eax
mov dword [0x40c67c], edx
cmp dword [0x40c678], 0
je 0x405a21
mov eax, dword [0x40c678]
mov dword [ecx], eax
mov edi, dword [0x40c678]
mov ax, word [edi]
not ax
cmp ax, 0x5a4d
je 0x405a21
mov esi, dword [edi + 0x3c]
add esi, edi
push 0xf8
push esi
call fcn.0040500c
test eax, eax
jne 0x405a21
cmp dword [esi], 0x4550
jne 0x405a21
mov eax, esi
call fcn.00405920
test al, al
jne 0x405a21
mov ebx, esi
add ebx, 0xf8
mov ax, word [esi + 6]
cmp ax, 0x64
jae 0x405a21
movzx eax, ax
dec eax
test eax, eax
jl 0x405a21
inc eax
mov esi, eax
mov edx, 0x404e2c
mov eax, ebx
mov ecx, 8
call fcn.00405200
test eax, eax
jne 0x405a1b
mov eax, dword [ebx + 0x14]
add eax, edi
mov dword [0x40c680], eax
mov eax, dword [0x40c680]
call fcn.00405920
test al, al
jne 0x405a21
mov eax, dword [0x40c680]
mov dword [ebp - 4], eax
mov eax, dword [ebx + 0xc]
mov dword [0x40c684], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x40c684]
mov dword [eax], edx
jmp 0x405a21
add ebx, 0x28
dec esi
jne 0x4059d1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x40261a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 0x10], 0
je 0x40263a
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
cmp dword [ebp + 0xc], 0
je 0x402646
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
test ebx, ebx
je 0x40264f
cmp byte [ebx], 0
jne 0x402656
xor eax, eax
jmp 0x402707
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x4026b4
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x402688
cmp dword [ebp - 4], 0
je 0x402688
cmp dword [ebp - 8], 0
jne 0x402688
cmp dword [ebp + 0x10], 0
je 0x402683
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov dword [ebp - 8], edx
jmp 0x4026b3
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x402696
cmp ecx, 0xa
jne 0x40269e
cmp ecx, 0xd
jne 0x4026b9
inc ebx
jmp 0x4026b9
mov byte [edx], al
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp esi, eax
jle 0x4026b3
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x4026b9
inc esi
cmp byte [ebx], 0
jne 0x40265f
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x402705
mov edx, dword [ebp - 4]
mov byte [edx], 0
cmp dword [ebp - 8], 0
je 0x402705
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov ecx, dword [ebp + 8]
dec ecx
lea edx, [ebp - 0x1008]
mov eax, dword [ebp - 4]
call fcn.0040fd2c
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov byte [edx + ecx - 1], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40270f
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7c0
mov ebx, eax
mov eax, ebx
mov byte [esp], dl
lea esi, [esp + 4]
call fcn.0040fc9c
cmp eax, 0x3f6
jae 0x402942
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.0040fc1c
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x40275c
lea edx, [ebx + 1]
jmp 0x40275e
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x4027af
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x402787
jmp 0x402780
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x402780
mov byte [ebx + eax], 0x20
jmp 0x402787
inc eax
cmp byte [ebx + eax], 0
jne 0x402770
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x40279c
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x4027ae
cmp edx, 0x20
jne 0x4027a5
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x4027b6
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x402765
cmp byte [0x415cfe], 0
je 0x4027c6
mov dword [esi + 0x14], 0x415cfe
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.004062b0
mov edi, eax
test edi, edi
je 0x4027f2
mov edx, str..inf
mov eax, edi
call fcn.0040fda4
test eax, eax
jne 0x4027f2
mov dword [esi + 0xc], str.Install
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00406e60
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x40281a
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00406f2c
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x40285d
cmp byte [esp + 1], 0
jne 0x40285d
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.0040fd1c
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.0040fdf0
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00406e60
test al, al
je 0x402942
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x402887
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x402942
cmp byte [0x4158f4], 0
jne 0x40289e
cmp byte [esp], 0
je 0x4028f4
mov ebx, dword [0x416180]
test ebx, ebx
je 0x4028b2
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x4028b6
xor eax, eax
jmp 0x4028bb
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x4028ce
push 0
push dword [0x416180]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
mov eax, dword [esi + 0x38]
call fcn.0040294c
test ebx, ebx
je 0x4028f4
push 1
push dword [0x416180]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x402910
mov edx, str..exe
mov eax, edi
call fcn.0040fda4
test eax, eax
je 0x402942
cmp byte [0x4158f4], 0
je 0x40292b
cmp byte [esp], 0
jne 0x40292b
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x402942
mov edx, 0xc8
cmp byte [esp], 0
jne 0x40293c
add edx, 0x320
push edx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop edi
pop esi
pop ebx
ret
Function at 0x40297a
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffffbe0
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [0x415044], 0
jne 0x402a03
mov eax, esp
call fcn.00405f84
mov ecx, 6
mov edx, dword [str.RarSFX]
call fcn.0040fdc8
test eax, eax
jne 0x402a03
push 0x41523d
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.0040fc9c
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x400]
mov ecx, 0x1e
xor edx, edx
call fcn.0040fc1c
mov dword [esp + 0x404], 3
mov word [esp + 0x410], 0x14
mov eax, esp
mov dword [esp + 0x408], eax
lea edx, [esp + 0x400]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x420
ret

Function at 0x402aec
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x4158fc], 0
je 0x402b63
cmp byte [0x416e3c], 0
je 0x402b63
lea edx, [esp + 8]
mov eax, 0x416e3c
call fcn.00402abb
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x402b63
mov eax, ebx
call fcn.0040fc9c
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x402b6b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x4158fc], 0
je 0x402be4
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.00402abb
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402be4
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x402bdc
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.0040fd1c
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x402ca8
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret