joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443870
Capabilities:
Move file

Disassembly:
mov eax, 0x2004
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x2000], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileW]
push esi
mov esi, dword [esp + 0x2014]
push edi
mov edi, dword [esp + 0x201c]
push edi
push esi
call ebp
test eax, eax
setne bl
test bl, bl
jne 0x4438ee
push 0x800
lea eax, [esp + 0x1014]
push eax
push esi
call fcn.00452410
test al, al
je 0x4438ee
push 0x800
lea ecx, [esp + 0x14]
push ecx
push edi
call fcn.00452410
test al, al
je 0x4438ee
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x1014]
push eax
call ebp
test eax, eax
setne al
jmp 0x4438f0
mov al, bl
mov ecx, dword [esp + 0x2010]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x2004
ret 8

Function at 0x443910
Capabilities:
Delete file

Disassembly:
mov eax, 0x1004
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x443966
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00452410
test al, al
je 0x443966
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x443968
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x1004
ret 4

Function at 0x443990
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1004
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push esi
call edi
test eax, eax
setne bl
test bl, bl
jne 0x4439e6
push 0x800
lea eax, [esp + 0x10]
push eax
push esi
call fcn.00452410
test al, al
je 0x4439e6
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
setne al
jmp 0x4439e8
mov al, bl
mov ecx, dword [esp + 0x100c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x1004
ret 4

Function at 0x443cf0
Capabilities:
Delete file

Disassembly:
xor eax, eax
sub esp, 0x20
cmp dword [ecx + 0x10], eax
jbe 0x443d48
mov dword [ecx + 0x10], eax
mov ecx, dword [ecx]
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0x10], eax
mov dword [esp], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov word [esp + 0x1c], ax
lea edx, [esp]
mov eax, 0x54
push edx
mov dword [esp + 8], 3
mov word [esp + 0x14], ax
mov dword [esp + 0xc], ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb eax, eax
inc eax
add esp, 0x20
ret
mov al, 1
add esp, 0x20
ret
Function at 0x443ff0
Capabilities:
Check if file exists
Create directory

Disassembly:
mov eax, 0x1004
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x100c]
push edi
push esi
call fcn.00451470
movzx eax, word [eax]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp ax, 0x2e
je 0x444035
cmp ax, 0x20
je 0x444035
push 0
push esi
call edi
test eax, eax
jne 0x444061
push esi
call fcn.00443780
cmp eax, 0xffffffff
jne 0x44407d
push 0x800
lea eax, [esp + 0xc]
push eax
push esi
call fcn.00452410
test al, al
je 0x44407d
push 0
lea ecx, [esp + 0xc]
push ecx
call edi
test eax, eax
je 0x44407d
cmp byte [esp + 0x1014], 0
je 0x444079
mov edx, dword [esp + 0x1018]
push edx
push esi
call fcn.004437f0
xor eax, eax
jmp 0x444097
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x444092
cmp eax, 3
mov eax, 1
jne 0x444097
mov eax, 2
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004e34f4
add esp, 0x1004
ret 0xc
Function at 0x4455a0
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
push ebp
push esi
mov esi, dword [esp + 0x126c]
push edi
mov edi, dword [esp + 0x1268]
cmp edi, 0xffffffff
jne 0x44564f
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
lea eax, [esp + 0x10]
push eax
push ebx
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x445683
push 0x800
lea ecx, [esp + 0x264]
push ecx
push ebx
call fcn.00452410
test al, al
je 0x44561c
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call ebp
mov edi, eax
cmp edi, 0xffffffff
jne 0x445683
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x445638
cmp eax, 3
je 0x445638
cmp eax, 0x12
je 0x445638
mov eax, 1
jmp 0x44563a
xor eax, eax
mov byte [esi + 0x1044], al
mov dword [esi + 0x1040], 0
jmp 0x445762
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x445683
or edi, 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne dl
mov byte [esi + 0x1044], dl
mov dword [esi + 0x1040], 0
jmp 0x445762
push 0x800
push ebx
push esi
call fcn.00467570
push 0x800
lea eax, [esp + 0x40]
push eax
push esi
call fcn.00451be0
mov ecx, dword [esp + 0x2c]
push 1
push 0
push 0
push ecx
call fcn.004e4480
mov ecx, dword [esp + 0x30]
xor ebx, ebx
add eax, ecx
mov ecx, dword [esp + 0x18]
adc edx, ebx
mov dword [esi + 0x1000], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x1004], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x1028], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1008], edx
mov edx, dword [esp + 0x1c]
mov dword [esi + 0x102c], ecx
mov ecx, dword [esp + 0x24]
mov dword [esi + 0x1034], eax
mov dword [esi + 0x1030], edx
mov edx, dword [esp + 0x28]
lea eax, [esp + 0x24]
mov dword [esi + 0x1038], ecx
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x103c], edx
call fcn.004688f0
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esi + 0x1018]
call fcn.004688f0
lea edx, [esp + 0x1c]
push edx
lea ecx, [esi + 0x1020]
call fcn.004688f0
test dword [esp + 0x10], 0x400
je 0x445754
cmp dword [esp + 0x34], 0xa0000003
jne 0x445754
lea eax, [ebx + 1]
jmp 0x445756
xor eax, eax
mov byte [esi + 0x100e], al
mov dword [esi + 0x1040], ebx
mov ecx, dword [esp + 0x1260]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x1254
ret 0xc
Function at 0x449a30
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xd4]
push 0x4000
push 0
push eax
call fcn.004e4400
add esp, 0xc
cmp byte [esp + 8], 0
je 0x449b21
cmp byte [esi + 0x6135], 0
jne 0x449b21
mov ecx, dword [esi + 0xe8]
mov eax, dword [esi + 0x6130]
shr ecx, 2
cmp eax, ecx
ja 0x449b21
xor edx, edx
test eax, eax
jbe 0x449b63
push ebx
push edi
jmp 0x449a90
mov eax, dword [esi + 0xd0]
movzx edi, byte [eax + edx + 1]
lea ecx, [eax + edx]
movzx eax, byte [ecx]
movzx ecx, byte [ecx + 2]
imul eax, eax, 0x2773
xor eax, edi
mov edi, dword [esi + 0xd8]
imul eax, eax, 0x2773
xor eax, ecx
mov ecx, eax
imul eax, eax, 0x2773
and ecx, 0x3ffff
xor ebx, ebx
mov word [edi + ecx*2], bx
mov ecx, dword [esi + 0xd0]
movzx ecx, byte [ecx + edx + 3]
mov edi, dword [esi + 0xdc]
xor ecx, eax
mov eax, ecx
imul ecx, ecx, 0x2773
and eax, 0x3ffff
mov dword [edi + eax*4], ebx
mov eax, dword [esi + 0xd0]
movzx eax, byte [eax + edx + 4]
xor eax, ecx
and eax, dword [esi + 0xec]
mov ecx, dword [esi + 0xe0]
inc edx
mov dword [ecx + eax*4], ebx
cmp edx, dword [esi + 0x6130]
jb 0x449a90
pop edi
pop ebx
pop esi
ret 4
mov edx, dword [esi + 0xd8]
push 0x80000
push 0
push edx
call fcn.004e4400
mov eax, dword [esi + 0xdc]
push 0x100000
push 0
push eax
call fcn.004e4400
mov ecx, dword [esi + 0xe8]
mov edx, dword [esi + 0xe0]
add ecx, ecx
add ecx, ecx
push ecx
push 0
push edx
call fcn.004e4400
add esp, 0x24
pop esi
ret 4
Function at 0x44c360
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb4
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0xb0], eax
mov eax, dword [esp + 0xb8]
push ebx
mov ebx, dword [esp + 0xc0]
push ebp
xor edx, edx
push esi
add ebx, 0xffffff88
push edi
add eax, 2
lea edi, [esp + 0x20]
mov dword [esp + 0x28], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x20], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], edi
mov edi, edi
cmp edx, ebx
jge 0x44c4c3
lea eax, [esp + 0x48]
sub eax, 2
lea ecx, [eax + 3]
mov dword [esp + 0x34], ecx
lea ecx, [esp + 0x48]
sub ecx, eax
add ecx, 0xfffffffd
mov dword [esp + 0x3c], ecx
mov ecx, eax
neg ecx
lea esi, [esp + ecx + 0x48]
mov dword [esp + 0x44], esi
lea esi, [esp + ecx + 0x49]
mov dword [esp + 0x30], esi
lea esi, [esp + 0x48]
sub esi, eax
lea eax, [esp + ecx + 0x4a]
mov ecx, dword [esp + 0x14]
sub ebx, edx
mov dword [esp + 0x40], eax
dec ebx
mov eax, 0x88888889
mul ebx
dec esi
mov ebp, edx
shr ebp, 0xa
mov dword [esp + 0x2c], esi
mov esi, dword [edi]
mov dword [esp + 0x10], ecx
inc ebp
mov eax, dword [esp + 0x10]
xor edi, edi
lea ebx, [ebx]
movzx edx, byte [eax - 2]
mov cl, byte [eax - 1]
sub dl, cl
mov byte [esp + edi + 0x48], dl
movzx edx, byte [eax]
sub dl, cl
mov byte [esp + edi + 0x49], cl
mov byte [esp + edi + 0x4a], dl
add edi, 3
add eax, 3
cmp edi, 0x78
jl 0x44c420
mov ecx, dword [esp + 0x34]
mov edi, 0x27
mov edi, edi
mov eax, dword [esp + 0x40]
movzx edx, byte [eax + ecx]
mov eax, dword [esp + 0x2c]
sub dl, byte [eax + ecx]
add ecx, 3
movsx eax, dl
cdq
mov ebx, eax
xor ebx, edx
sub ebx, edx
mov edx, dword [esp + 0x44]
mov al, byte [edx + ecx - 3]
mov edx, dword [esp + 0x3c]
sub al, byte [edx + ecx - 3]
movsx eax, al
cdq
xor eax, edx
sub eax, edx
add ebx, eax
mov eax, dword [esp + 0x30]
movzx edx, byte [eax + ecx - 3]
sub dl, byte [ecx - 3]
movsx eax, dl
cdq
xor eax, edx
sub eax, edx
add eax, esi
sub edi, 1
lea esi, [eax + ebx]
jne 0x44c450
add dword [esp + 0x10], 0x780
sub ebp, 1
jne 0x44c414
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x38]
mov edx, dword [esp + 0x18]
mov dword [edi], esi
inc dword [esp + 0x14]
inc edx
add edi, 4
cmp edx, 2
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edi
jle 0x44c3b0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, ecx
ja 0x44c50d
cmp eax, edx
ja 0x44c50d
xor eax, eax
mov ecx, dword [esp + 0xb0]
xor ecx, esp
call fcn.004e34f4
add esp, 0xb4
ret 8
cmp edx, ecx
mov ecx, dword [esp + 0xb0]
sbb eax, eax
neg eax
xor ecx, esp
inc eax
call fcn.004e34f4
add esp, 0xb4
ret 8
Function at 0x451620
Capabilities:
Get common file path

Disassembly:
sub esp, 8
call fcn.004984e0
test al, al
jne 0x451632
add esp, 8
ret 0xc
push ebx
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push 0x1a
xor ecx, ecx
push 0
mov word [esi], cx
xor bl, bl
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x4516ae
mov eax, dword [esp + 8]
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x4516ae
cmp word [esi], 0
je 0x4516ae
push edi
mov edi, dword [esp + 0x1c]
push edi
push esi
call fcn.00451500
push edi
push 0x4ff068
push esi
call fcn.004675f0
push esi
call fcn.00443cc0
mov bl, al
pop edi
test bl, bl
jne 0x4516ae
cmp byte [esp + 0x1c], 0
je 0x4516ae
push 0
push 0
push esi
call fcn.00443ff0
test eax, eax
sete bl
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
mov al, bl
pop ebx
add esp, 8
ret 0xc

Function at 0x451d40
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
lea ecx, [esp + 0x10]
push ecx
push 1
xor eax, eax
push eax
push str.SoftwareWinRARPaths
push SysReAllocString
mov word [esi], ax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x14]
test eax, eax
jne 0x451d98
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.AppData
push ecx
mov dword [esp + 0x2c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x451da8
push esi
call fcn.00443cc0
test al, al
jne 0x451de5
mov eax, dword [esp + 0x18]
push eax
push edi
push esi
call fcn.00451620
test al, al
jne 0x451de5
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.00451a10
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x451de0
cmp word [esi + 2], 0x3a
jne 0x451ddd
add esi, 8
cmp eax, esi
jb 0x451de0
sub eax, 2
xor edx, edx
mov word [eax], dx
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x452410
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [esp + 0x1010]
movzx eax, word [edi]
test ax, ax
jne 0x452447
xor al, al
jmp 0x452645
push eax
call fcn.004671f0
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x452452
push ebx
sub eax, edx
sar eax, 1
push edi
mov ebx, eax
call fcn.004522a0
test al, al
je 0x45253c
movzx eax, word [edi]
push eax
call fcn.004671f0
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x4524cb
cmp word [edi + 2], 0x3a
jne 0x4524cb
add ebx, 4
cmp dword [esp + 0x101c], ebx
jbe 0x452642
push 4
push 0x4ff100
push esi
call fcn.004e7058
add esp, 0xc
sub esi, edi
mov eax, edi
lea edx, [esi + 8]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4524b5
mov al, 1
jmp 0x452644
cmp word [edi], 0x5c
jne 0x452642
add edi, 2
cmp word [edi], 0x5c
jne 0x452642
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x452642
push 4
push 0x4ff100
push esi
call fcn.004e7058
mov eax, 0x4ff0f8
mov ecx, esi
add esp, 0xc
sub ecx, eax
lea edx, [ecx + 8]
mov edi, edi
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x452510
sub esi, edi
mov eax, edi
lea edx, [esi + 0xe]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x452526
mov al, 1
jmp 0x452644
lea edx, [esp + 0xc]
push edx
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x452642
cmp eax, 0x7ff
ja 0x452642
movzx eax, word [edi]
push eax
call fcn.004514d0
test al, al
je 0x4525b9
add ebx, 6
cmp dword [esp + 0x101c], ebx
jbe 0x452642
push 4
push 0x4ff100
push esi
call fcn.004e7058
push 2
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esi + 8]
push edx
call fcn.004e7058
add esp, 0x18
sub esi, edi
mov eax, edi
lea edx, [esi + 0xc]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4525a3
mov al, 1
jmp 0x452644
push 0x800
lea eax, [esp + 0x10]
push eax
call fcn.00451500
lea eax, [esp + 0xc]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4525d0
sub eax, edx
sar eax, 1
lea ecx, [eax + ebx + 4]
mov ebx, dword [esp + 0x101c]
cmp ebx, ecx
jbe 0x452642
push 4
push 0x4ff100
push esi
call fcn.004e7058
lea eax, [esp + 0x18]
mov edx, esi
mov ecx, eax
sub edx, ecx
add esp, 0xc
add edx, 8
jmp 0x452610
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x452610
cmp word [edi], 0x2e
jne 0x452636
movzx edx, word [edi + 2]
push edx
call fcn.004514d0
test al, al
je 0x452636
add edi, 4
push ebx
push edi
push esi
call fcn.004675f0
mov al, 1
jmp 0x452644
xor al, al
pop ebx
mov ecx, dword [esp + 0x1008]
pop edi
pop esi
xor ecx, esp
call fcn.004e34f4
add esp, 0x1004
ret 0xc
Function at 0x456590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
mov dword [esi + 4], 0
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x8000
jb 0x4565b5
mov eax, 0x8000
mov edi, dword [esp + 0x10]
push ebx
push eax
mov eax, dword [esi + 0xc]
push edi
push eax
call fcn.004e4090
mov eax, 1
add esp, 0xc
xor bl, bl
cmp ebp, eax
jbe 0x4565db
xor bl, byte [eax + edi]
inc eax
cmp eax, ebp
jb 0x4565d3
push 8
mov ecx, esi
call fcn.00446150
mov esi, dword [esp + 0x1c]
mov dword [esi + 0x14], 0
cmp bl, byte [edi]
pop ebx
jne 0x45661c
push ebp
push edi
push 0xffffffffffffffff
call fcn.00439380
xor edx, edx
not eax
xor ecx, ecx
cmp dword [ecx + 0x5132f4], eax
jne 0x456613
cmp dword [ecx + 0x5132f0], ebp
je 0x45668b
add ecx, 0xc
inc edx
cmp ecx, 0x48
jb 0x456603
push 1
mov ecx, esi
call fcn.00456500
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
mov dword [esi + 0x14], ecx
lea edx, [eax + eax*4]
mov eax, dword [esi]
lea eax, [eax + edx*8]
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
mov ecx, 3
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
lea edx, [eax + 0x1c]
xor ecx, ecx
mov dword [eax], 0x16
mov dword [eax + 0x24], edx
cmp dword [esi + 0x14], ecx
jle 0x456685
xor edx, edx
lea esp, [esp]
mov eax, dword [esi]
add eax, edx
cmp dword [eax + 0x14], 0
jne 0x456670
lea edi, [eax + 0xc]
mov dword [eax + 0x14], edi
cmp dword [eax + 0x24], 0
jne 0x45667c
lea edi, [eax + 0x1c]
mov dword [eax + 0x24], edi
inc ecx
add edx, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x456660
pop edi
pop esi
pop ebp
ret 0xc
lea ecx, [edx + edx*2]
mov edi, dword [ecx*4 + 0x5132f8]
test edi, edi
je 0x45661c
push 1
mov ecx, esi
call fcn.00456500
mov eax, dword [esi + 0x14]
mov ecx, dword [esi]
lea edx, [eax + 1]
mov dword [esi + 0x14], edx
lea eax, [eax + eax*4]
lea eax, [ecx + eax*8]
lea ecx, [eax + 0xc]
mov dword [ecx], edi
pop edi
mov dword [eax + 0x14], ecx
mov ecx, 3
lea edx, [eax + 0x1c]
pop esi
mov dword [eax], 0x28
mov dword [eax + 0x24], edx
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
pop ebp
ret 0xc
Function at 0x461740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x418
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x414], eax
mov eax, dword [esp + 0x41c]
push ebx
mov ebx, dword [esp + 0x424]
push ebp
push esi
push edi
push 5
push eax
mov dword [esp + 0x1c], eax
mov eax, dword [0x52c134]
push eax
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, dword [0x52c134]
mov esi, eax
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [0x52c134]
push esi
push edx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
call fcn.004e3b96
mov edi, eax
add esp, 4
test edi, edi
jne 0x4617b9
mov dword [ebx], eax
jmp 0x4618f9
push esi
push ebp
push edi
call fcn.004e4090
xor eax, eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x1c], eax
mov eax, dword [edi]
add esp, 0xc
and eax, 0xffff0000
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x1c]
cmp eax, 0xffff0000
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
push edx
push eax
sete bl
call fcn.00461120
mov ebp, dword [esp + 0x1c]
test al, al
je 0x461840
mov ecx, edi
test bl, bl
je 0x461806
lea ecx, [edi + 8]
movsx edx, word [ecx + 0xe]
imul edx, ebp
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
movsx edx, word [ecx + 0x10]
imul edx, dword [esp + 0x10]
mov word [ecx + 0xe], ax
mov eax, 0x51eb851f
imul edx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [ecx + 0x10], ax
xor ecx, ecx
test bl, bl
setne cl
mov eax, 0xffff
lea ecx, [ecx*4 + 9]
cmp word [edi + ecx*2], ax
lea edx, [edi + ecx*2]
jne 0x461863
mov eax, 2
jmp 0x461880
mov eax, edx
lea esi, [eax + 2]
jmp 0x461870
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x461870
sub eax, esi
sar eax, 1
inc eax
lea edx, [edx + eax*2]
mov ecx, 0xffff
cmp word [edx], cx
jne 0x461894
mov eax, 2
jmp 0x4618b0
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4618a0
sub eax, esi
sar eax, 1
inc eax
mov ecx, dword [esp + 0x14]
push ecx
push 1
push 0x200
lea ecx, [esp + 0x30]
push ecx
mov ecx, dword [esp + 0x28]
lea edx, [edx + eax*2]
push edx
call fcn.00460f40
lea eax, [esp + 0x24]
push eax
call fcn.004e7e9c
mov ecx, dword [esp + 0x24]
add esp, 4
mov dword [ecx], eax
cmp ebp, 0x64
jne 0x4618f7
cmp dword [esp + 0x10], ebp
jne 0x4618f7
push edi
call fcn.004e3342
add esp, 4
xor edi, edi
mov eax, edi
mov ecx, dword [esp + 0x424]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x418
ret 8
Function at 0x4619f0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x2010
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x200c], eax
push ebx
mov ebx, dword [esp + 0x2020]
push esi
mov esi, dword [esp + 0x201c]
push edi
mov edi, dword [esp + 0x2024]
cmp edi, esi
je 0x461a2c
push ebx
push esi
push edi
call fcn.00467570
lea eax, [esp + 0xc]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x461afd
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x461a52
sub eax, edx
sar eax, 1
mov ecx, 0x7ff
sub ecx, eax
add ecx, ecx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x101c]
push eax
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x1c]
push ecx
push 0
push str.LanguageFolder
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x461af2
push 0x800
lea ecx, [esp + 0x1c]
push ecx
lea edx, [esp + 0x1020]
push edx
mov word [esp + 0x24], ax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x800
lea eax, [esp + 0x1c]
push eax
call fcn.00451500
push 0x800
push esi
call fcn.00451a10
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.004675f0
lea edx, [esp + 0x18]
push edx
call fcn.00443cc0
test al, al
je 0x461af2
push ebx
lea eax, [esp + 0x1c]
push eax
push edi
call fcn.00467570
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2018]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004e34f4
add esp, 0x2010
ret 0xc

Function at 0x461be0
Capabilities:
Check os version

Disassembly:
mov eax, 0x1118
call fcn.004e3510
mov eax, dword [0x514bc0]
xor eax, esp
mov dword [esp + 0x1114], eax
push esi
mov esi, ecx
cmp byte [esi], 0
je 0x461c1b
mov eax, dword [0x52c134]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [0x52c130]
mov dword [0x52c134], ecx
mov byte [esi], 0
mov eax, dword [esp + 0x1124]
lea edx, [esp + 0x118]
test eax, eax
je 0x461c41
sub edx, eax
nop
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x461c30
jmp 0x461c4f
push 0x800
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarlng.dll
lea eax, [esp + 0x120]
push eax
call fcn.00451be0
push 0x800
lea ecx, [esp + 0x11c]
push ecx
mov edx, ecx
push edx
call fcn.004619f0
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x14], 2
jne 0x461cbb
mov eax, dword [esp + 8]
cmp eax, 5
ja 0x461ca7
jne 0x461cbb
cmp dword [esp + 0xc], 1
jbe 0x461cbb
push 2
push 0
lea ecx, [esp + 0x120]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x461cc9
lea edx, [esp + 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x52c134], eax
setne al
mov byte [esi], al
test al, al
mov eax, dword [esp + 0x1120]
pop esi
mov dword [0x52c130], eax
jne 0x461ceb
mov dword [0x52c134], eax
mov ecx, dword [esp + 0x1114]
xor ecx, esp
call fcn.004e34f4
add esp, 0x1118
ret 8