joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424348
Capabilities:
Get common file path

Disassembly:
push 0x38
mov eax, 0x454edd
call fcn.00441f1a
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x30], eax
mov esi, 0x104
lea eax, [ebp - 0x40]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edi
call fcn.00415ddc
mov dword [ebp - 4], edi
mov esi, dword [ebp - 0x40]
mov edi, dword [ebp - 0x3c]
mov ebx, dword [sym.imp.kernel32.dll_GetTempPathA]
push esi
sub edi, esi
push edi
call ebx
cmp eax, edi
jbe 0x4243a4
mov esi, eax
lea eax, [ebp - 0x40]
call fcn.00415ddc
mov esi, dword [ebp - 0x40]
mov eax, dword [ebp - 0x3c]
push esi
sub eax, esi
push eax
call ebx
push esi
lea ecx, [ebp - 0x2c]
call fcn.00405b5f
mov eax, dword [ebp - 0x30]
lea edx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00425913
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405e43
test esi, esi
je 0x4243d3
push esi
call fcn.0043af30
pop ecx
mov eax, dword [ebp - 0x30]
call fcn.00441f9d
ret

Function at 0x424a27
Capabilities:
Identify system language via api

Disassembly:
push 4
mov eax, 0x4545a2
call fcn.00441eb1
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 1
call dword [sym.imp.kernel32.dll_GetThreadLocale]
push eax
mov eax, esi
call fcn.0043af30
pop ecx
call dword [sym.imp.kernel32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0043af30
pop ecx
call dword [sym.imp.kernel32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
push eax
mov eax, esi
call fcn.0043af30
mov eax, esi
mov dword [esp], 0x409
call fcn.0043af30
pop ecx
mov eax, esi
call fcn.00441f89
ret

Function at 0x4256a7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x4256af
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne al
ret

Function at 0x4256bf
Capabilities:
Check if file exists
Get file attributes

Disassembly:
cmp dword [eax + 0x14], 0x10
jb 0x4256c7
mov eax, dword [eax]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4256db
test al, 0x10
je 0x4256db
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x4259cd
Capabilities:
Get file version info

Disassembly:
push 0xf0
mov eax, 0x45915b
call fcn.00441f1a
mov eax, dword [ebp + 8]
push eax
mov esi, ebx
mov dword [ebp - 0x54], ebx
call fcn.00406ec6
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebx + 0x1c], esi
mov dword [ebx + 0x20], esi
mov dword [ebx + 0x24], esi
mov byte [ebp - 4], 1
cmp dword [ebx + 0x14], 0x10
mov dword [ebp - 0x40], esi
jb 0x425a09
mov eax, dword [ebx]
jmp 0x425a0b
mov eax, ebx
lea ecx, [ebp - 0x40]
push ecx
push eax
call dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
cmp eax, esi
jne 0x425ac3
push str.System_error
mov dword [ebp - 0x4c], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x464
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ec6
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 2
call fcn.00409545
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfoSize_
push eax
mov byte [ebp - 4], 3
call fcn.0040b58e
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 4
call fcn.0040b3b1
mov esi, eax
push 0x466ad0
push esi
call fcn.0040b58e
pop ecx
pop ecx
mov ecx, dword [sym.imp.version.dll_GetFileVersionInfoSizeA]
push esi
lea edi, [ebp - 0x60]
call fcn.0042aa6f
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x3c]
push ecx
lea esi, [ebp - 0x4c]
mov ecx, eax
call fcn.0041acfa
lea eax, [ebp - 0x3c]
mov dword [esp], 0x46d888
push eax
call fcn.0043af30
mov esi, eax
lea eax, [ebx + 0x1c]
call fcn.0041053c
mov ecx, dword [ebx + 0x1c]
mov eax, dword [ebx + 0x20]
sub eax, ecx
cmp dword [ebx + 0x14], 0x10
jb 0x425adf
mov edx, dword [ebx]
jmp 0x425ae1
mov edx, ebx
mov edi, dword [sym.imp.version.dll_GetFileVersionInfoA]
push ecx
push eax
push dword [ebp - 0x40]
push edx
call edi
test eax, eax
jne 0x425b7f
push str.System_error
mov dword [ebp - 0x4c], str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_FileUtils.cpp
mov dword [ebp - 0x48], str.VersionResource::VersionResource
mov dword [ebp - 0x44], 0x46d
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x50], esp
push ebx
call fcn.00406ec6
lea eax, [ebp - 0xfc]
push eax
mov byte [ebp - 4], 6
call fcn.00409545
lea eax, [ebp - 0xfc]
push str.GetFileVersionInfo_
push eax
mov byte [ebp - 4], 7
call fcn.0040b58e
pop ecx
pop ecx
lea esi, [ebp - 0xfc]
mov byte [ebp - 4], 8
call fcn.0040b3b1
mov esi, eax
push 0x466ad0
push esi
call fcn.0040b58e
pop ecx
pop ecx
mov ecx, edi
push esi
lea edi, [ebp - 0x60]
call fcn.0042aa6f
mov byte [ebp - 4], 9
jmp 0x425aa5
mov eax, ebx
call fcn.00441f9d
ret 4
Function at 0x428cf2
Capabilities:
Check mutex on windows

Disassembly:
push 0xa8
mov eax, 0x458f50
call fcn.00441eb1
push str.Global_MSIExecute
xor esi, esi
push esi
push 0x100000
call dword [sym.imp.kernel32.dll_OpenMutexA]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 1
mov dword [ebp - 4], esi
cmp eax, esi
je 0x428dc4
push dword [ebp + 8]
push eax
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 8], esi
je 0x428da4
cmp dword [0x47d500], 1
jg 0x428da4
lea eax, [ebp - 0xb4]
push eax
call fcn.00409545
lea eax, [ebp - 0xb4]
push str.finish_waiting_for_mutex:
push eax
mov byte [ebp - 4], 1
call fcn.0040b58e
pop ecx
pop ecx
push dword [ebp - 0x14]
lea eax, [ebp - 0xb4]
push eax
call fcn.0040df0e
lea eax, [ebp - 0xb4]
push eax
push 0x1c8
push 1
mov ebx, str.msi::waitForInstallationCompletion
mov edi, str.c:_ade_jenkins_workspace_8_2_build_windows_i586_cygwin_jdk8u241_331_install_src_windows_common_MsiUtils.cpp
mov esi, 0x47d500
call fcn.004078b6
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.0040789c
cmp dword [ebp - 0x14], 0x102
jne 0x428dc4
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x1c]
call fcn.0043af30
pop ecx
mov al, bl
call fcn.00441f89
ret
mov bl, 1
jmp 0x428daf

Function at 0x434134
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x240
lea ebp, [esp - 4]
mov eax, dword [0x479630]
xor eax, ebp
mov dword [ebp + 0x240], eax
push 0x14
mov eax, 0x4566fc
call fcn.00441eb1
xor esi, esi
lea eax, [ebp + 0x38]
push eax
push esi
push esi
push 0x2c
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.shell32.dll_SHGetFolderPathW]
cmp eax, esi
je 0x43418a
push 0xc8
lea esi, [ebp - 0x20]
call fcn.0043af30
push 0x46d720
mov eax, esi
push eax
call fcn.0043af30
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp]
call fcn.00414d60
push 0x4695b4
push eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], esi
call fcn.0043af30
push ebx
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00432e7f
add esp, 0xc
push 1
xor edi, edi
lea esi, [ebp + 0x1c]
call fcn.00414e32
push 1
lea esi, [ebp]
call fcn.00414e32
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x240]
xor ecx, ebp
call fcn.0043a455
add ebp, 0x244
leave
ret

Function at 0x43a455
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x479630]
jne 0x43a45f
repz ret
jmp fcn.004446c5
Function at 0x43af30
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x43af3f
pop dword [ebp - 0x24]
mov eax, 0xfc404b9a
sub eax, 0xfbfc9c5b
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x49546
push 0
mov eax, 0x8753a78f
sub eax, 0x870dd6eb
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x5309
mov edi, eax
mov esi, 0xc96ad1fb
sub esi, 0xc920cbfb
add esi, dword [ebp - 0x24]
mov ebx, 0x94868251
sub ebx, 0xb14db927
mov dword [ebp - 0x18], 0xef3e494
mov edx, dword [esi]
sub dword [ebp - 8], ecx
sub edx, ebx
add dword [ebp - 0x18], ecx
mov dword [edi], edx
xor dword [ebp - 0x20], edi
add edi, 0x5ecd066b
add edi, 0xa132f999
add esi, 4
loop 0x43af98
add eax, 0xf3a23b65
sub eax, 0xf3a0fc6e
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x403535
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, 0x4e20
jne 0x40355c
cmp dword [ebp + 0xc], edi
jbe 0x403551
mov dword [ebp + 0xc], edi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4035c5
mov ecx, esi
call fcn.004034c3
test al, al
je 0x403592
cmp dword [ebp + 0xc], edi
jbe 0x403592
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.00403535
jmp 0x4035c8
cmp dword [esi + 0xc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4035a9
call ebx
cmp eax, 0x6d
jne 0x4035a9
xor eax, eax
jmp 0x4035c8
cmp dword [esi + 0xc], 0
jne 0x4035c0
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x4035c0
call ebx
cmp eax, 0x21
je 0x403585
or eax, 0xffffffff
jmp 0x4035c8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4038bb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d5c0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x4038ff
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.004065d0
test al, al
je 0x4038ff
lea eax, [ebp - 0x1000]
push eax
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x403907
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d5c0
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
setne bl
test bl, bl
jne 0x403956
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.004065d0
test al, al
je 0x403956
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x403b43
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d5c0
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov edi, dword [ebp + 8]
push 0
push edi
call esi
test eax, eax
jne 0x403b93
push edi
call fcn.00403b1f
test al, al
jne 0x403ba6
push 0x800
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.004065d0
test al, al
je 0x403ba6
push 0
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x403ba6
cmp byte [ebp + 0xc], 0
je 0x403ba2
push dword [ebp + 0x10]
push edi
call fcn.00403907
xor eax, eax
jmp 0x403bbe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x403bbb
cmp eax, 3
je 0x403bbb
xor eax, eax
inc eax
jmp 0x403bbe
push 2
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x403ff4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x44e114]
call fcn.0040140b
cmp byte [0x4377b9], 0
mov dword [0x44e114], eax
jne 0x404028
cmp dword [ebp + 0xc], 0
jbe 0x404028
mov ecx, dword [0x44e210]
pop ebp
jmp fcn.0040333a
pop ebp
ret 8

Function at 0x404825
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.0040d5c0
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x250]
mov edi, 0x800
push eax
jne 0x4048b4
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4048e1
push edi
lea eax, [ebp - 0x1250]
push eax
push dword [ebp + 0xc]
call fcn.004065d0
test al, al
je 0x40488d
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1250]
push eax
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4048e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4048a7
cmp eax, 3
je 0x4048a7
cmp eax, 0x12
je 0x4048a7
xor eax, eax
inc eax
jmp 0x4048a9
xor eax, eax
mov byte [esi + 0x1044], al
jmp 0x4049ac
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4048d7
or dword [ebp + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [esi + 0x1044], al
cmp dword [ebp + 8], 0xffffffff
je 0x4049ac
push edi
push dword [ebp + 0xc]
push esi
call fcn.0040b3d3
push edi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.00406459
push 1
push 0
push 0
push dword [ebp - 0x234]
call fcn.0040dc40
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x250]
mov dword [esi + 0x1008], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x1028], eax
mov eax, dword [ebp - 0x248]
mov dword [esi + 0x102c], eax
mov eax, dword [ebp - 0x244]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x1034], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x1038], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x103c], eax
lea eax, [ebp - 0x23c]
adc edx, edi
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x1004], edx
call fcn.0040b705
lea eax, [ebp - 0x24c]
push eax
lea ecx, [esi + 0x1018]
call fcn.0040b705
lea eax, [ebp - 0x244]
push eax
lea ecx, [esi + 0x1020]
call fcn.0040b705
and dword [esi + 0x1040], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4065d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d5c0
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x4065ee
xor al, al
jmp 0x406778
push ebx
push edi
push esi
call fcn.0040626d
push esi
call fcn.0040d54a
pop ecx
push esi
mov ebx, eax
call fcn.0040650c
test al, al
je 0x406698
push esi
call fcn.0040626d
test al, al
je 0x406645
add ebx, 4
cmp dword [ebp + 0x10], ebx
jbe 0x406774
mov edi, dword [ebp + 0xc]
push 4
push 0x41d640
push edi
call fcn.0040e4d4
push esi
add edi, 8
push edi
call fcn.0040d592
add esp, 0x14
jmp 0x406770
cmp word [esi], 0x5c
jne 0x406774
add esi, 2
cmp word [esi], 0x5c
jne 0x406774
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x406774
mov edi, dword [ebp + 0xc]
push 4
push 0x41d640
push edi
call fcn.0040e4d4
lea eax, [edi + 8]
push 0x41d638
push eax
call fcn.0040d592
push esi
add edi, 0xe
push edi
call fcn.0040d592
add esp, 0x1c
jmp 0x406770
lea eax, [ebp - 0x1000]
push eax
mov edi, 0x7ff
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x406774
cmp eax, edi
ja 0x406774
movzx eax, word [esi]
push eax
call fcn.00406189
test al, al
je 0x406705
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x406774
mov edi, dword [ebp + 0xc]
push 4
push 0x41d640
push edi
call fcn.0040e4d4
push 2
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0040e4d4
push esi
add edi, 0xc
push edi
call fcn.0040d592
add esp, 0x20
jmp 0x406770
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.004061a1
lea eax, [ebp - 0x1000]
push eax
call fcn.0040d54a
lea eax, [eax + ebx + 4]
pop ecx
cmp dword [ebp + 0x10], eax
jbe 0x406774
mov edi, dword [ebp + 0xc]
push 4
push 0x41d640
push edi
call fcn.0040e4d4
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0040d592
add esp, 0x14
cmp word [esi], 0x2e
jne 0x406766
movzx eax, word [esi + 2]
push eax
call fcn.00406189
test al, al
je 0x406766
add esi, 4
push dword [ebp + 0x10]
push esi
push edi
call fcn.0040b400
mov al, 1
jmp 0x406776
xor al, al
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x40829e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
cmp dword [0x427454], ebx
jne 0x4082b7
mov ecx, 0x42744c
call fcn.0040825f
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], bl
je 0x408301
mov ecx, dword [0x427454]
cmp ecx, ebx
je 0x40831d
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40833e
push str.CryptProtectMemory_failed
mov esi, 0x4325e4
push esi
call fcn.004016f8
pop ecx
pop ecx
mov ecx, esi
call fcn.004165d6
push 2
mov ecx, esi
call fcn.00401646
jmp 0x40833e
mov ecx, dword [0x427458]
cmp ecx, ebx
je 0x40831d
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40833e
push str.CryptUnprotectMemory_failed
jmp 0x4082e2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
cmp esi, ebx
jbe 0x40833e
mov dl, al
add dl, 0x4b
mov eax, dword [ebp + 8]
add eax, ecx
mov bl, dl
add bl, cl
xor byte [eax], bl
inc ecx
cmp ecx, esi
jb 0x40832e
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40847b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x422034], 0
push ebx
push esi
push edi
mov edi, 0x400
jne 0x4084c6
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x43bb9c], ax
xor eax, eax
mov word [0x43bb9e], ax
mov dword [0x422034], 0x43bb9c
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b42f
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push 0x422024
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
pop edi
mov word [esi + ebx*2 - 2], ax
pop esi
pop ebx
leave
ret 0x10
Function at 0x408661
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x68
push dword [0x430498]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x43049c], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x4086c3
mov ecx, dword [0x427464]
call fcn.0040c72d
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x41d41c
push 0
push 0xc2
push edi
call esi
mov byte [0x43049c], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x60], 0x5c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x5c], eax
je 0x408713
mov ecx, dword [ebp - 0x58]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], 0xa0
mov dword [ebp - 0x5c], 0x40000001
lea ecx, [ebp - 0x60]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x40875d
mov eax, dword [ebp - 0x58]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x41d768
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x408bb2
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040d5c0
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x408bcd
mov byte [ebx], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x408bd7
mov byte [eax], 0
test edi, edi
je 0x408c80
movzx eax, word [edi]
test ax, ax
je 0x408c80
push esi
xor esi, esi
xor ecx, ecx
movzx eax, ax
inc edi
inc edi
cmp ax, 0x3d
jne 0x408c10
cmp dword [ebp + 0xc], 0
je 0x408c1c
test esi, esi
jne 0x408c1c
test ebx, ebx
je 0x408c0c
mov byte [ebx], 1
mov esi, edx
jmp 0x408c2b
cmp ax, 0xd
je 0x408c3e
cmp ax, 0xa
je 0x408c40
mov word [edx], ax
mov eax, dword [ebp + 0x14]
inc edx
add eax, 0xfffffffe
inc edx
cmp ecx, eax
jge 0x408c36
movzx eax, word [edi]
inc ecx
test ax, ax
jne 0x408bf0
jmp 0x408c40
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x408c40
inc edi
inc edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [edx], ax
test ebx, ebx
je 0x408c7b
mov word [ebx], ax
test esi, esi
je 0x408c7b
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2000]
push eax
push ebx
call fcn.0040b3d3
xor eax, eax
mov word [esi], ax
mov eax, edi
pop esi
jmp 0x408c82
xor eax, eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x408cc7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0040d5c0
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.0040d1c9
cmp byte [0x43049d], 0
jne 0x408d5c
push 6
push dword [0x422020]
lea eax, [ebp - 0x1020]
push eax
call fcn.004062ef
push eax
call fcn.0040c1e4
test eax, eax
jne 0x408d5c
push 0x41d460
call fcn.0040d1b6
lea eax, [ebp - 0x1020]
push eax
call fcn.0040d54a
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x101e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0040d4d0
add esp, 0x10
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x408ebd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040d5c0
push ebx
xor ebx, ebx
cmp byte [0x4304e0], bl
je 0x408f42
cmp word [0x427468], bx
je 0x408f42
push esi
push 0x427468
lea esi, [ebp - 0x1008]
call fcn.00408e80
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x408f42
push dword [ebp + 8]
call fcn.0040d54a
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x408f47
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0040d5c0
cmp byte [0x4304e0], 0
je 0x408fee
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x200c]
call fcn.00408e80
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x408fee
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408fe5
shr dword [ebp - 4], 1
mov eax, 0x7ff
cmp dword [ebp - 4], eax
jae 0x408fc9
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040b3d3
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8