joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a77b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0041a860
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x40a799
xor al, al
jmp 0x40a923
push ebx
push edi
push esi
call fcn.0040a1e9
push esi
call fcn.0041a523
pop ecx
push esi
mov ebx, eax
call fcn.0040a690
test al, al
je 0x40a843
push esi
call fcn.0040a1e9
test al, al
je 0x40a7f0
add ebx, 4
cmp dword [ebp + 0x10], ebx
jbe 0x40a91f
mov edi, dword [ebp + 0xc]
push 4
push 0x42a6cc
push edi
call fcn.0041c603
push esi
add edi, 8
push edi
call fcn.0041a56b
add esp, 0x14
jmp 0x40a91b
cmp word [esi], 0x5c
jne 0x40a91f
add esi, 2
cmp word [esi], 0x5c
jne 0x40a91f
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40a91f
mov edi, dword [ebp + 0xc]
push 4
push 0x42a6cc
push edi
call fcn.0041c603
lea eax, [edi + 8]
push 0x42a6c4
push eax
call fcn.0041a56b
push esi
add edi, 0xe
push edi
call fcn.0041a56b
add esp, 0x1c
jmp 0x40a91b
lea eax, [ebp - 0x1000]
push eax
mov edi, 0x7ff
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x40a91f
cmp eax, edi
ja 0x40a91f
movzx eax, word [esi]
push eax
call fcn.00409fe5
test al, al
je 0x40a8b0
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x40a91f
mov edi, dword [ebp + 0xc]
push 4
push 0x42a6cc
push edi
call fcn.0041c603
push 2
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0041c603
push esi
add edi, 0xc
push edi
call fcn.0041a56b
add esp, 0x20
jmp 0x40a91b
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.0040a00a
lea eax, [ebp - 0x1000]
push eax
call fcn.0041a523
lea eax, [eax + ebx + 4]
pop ecx
cmp dword [ebp + 0x10], eax
jbe 0x40a91f
mov edi, dword [ebp + 0xc]
push 4
push 0x42a6cc
push edi
call fcn.0041c603
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0041a56b
add esp, 0x14
cmp word [esi], 0x2e
jne 0x40a911
movzx eax, word [esi + 2]
push eax
call fcn.00409fe5
test al, al
je 0x40a911
add esi, 4
push dword [ebp + 0x10]
push esi
push edi
call fcn.0041097e
mov al, 1
jmp 0x40a921
xor al, al
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x40ac5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
and dword [edi + 4], 0
and dword [edi], 0
mov eax, 0x8000
cmp dword [ebp + 0xc], eax
jae 0x40ac78
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push eax
push esi
push dword [edi + 0xc]
call fcn.0041c000
xor eax, eax
inc eax
add esp, 0xc
xor bl, bl
cmp dword [ebp + 0xc], eax
jbe 0x40ac9b
xor bl, byte [eax + esi]
inc eax
cmp eax, dword [ebp + 0xc]
jb 0x40ac92
push 8
mov ecx, edi
call fcn.004096da
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
and dword [esi + 0x14], 0
cmp bl, byte [eax]
jne 0x40acf9
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.0040aaf8
mov edi, eax
test edi, edi
je 0x40acf9
push 1
mov ecx, esi
call fcn.0040abe2
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [ecx], edi
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
push 3
mov dword [eax + 0x24], ecx
pop ecx
mov dword [eax], 0x28
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
jmp 0x40ad59
push 1
mov ecx, esi
call fcn.0040abe2
mov eax, dword [esi + 0x14]
lea ecx, [eax + 1]
imul eax, eax, 0x28
add eax, dword [esi]
mov dword [esi + 0x14], ecx
lea ecx, [eax + 0xc]
mov dword [eax + 0x14], ecx
lea ecx, [eax + 0x1c]
mov dword [eax + 0x24], ecx
push 3
pop ecx
mov dword [eax + 0x18], ecx
mov dword [eax + 8], ecx
xor edx, edx
mov dword [eax], 0x16
xor ecx, ecx
cmp dword [esi + 0x14], edx
jle 0x40ad59
xor edi, edi
mov eax, dword [esi]
add eax, edi
cmp dword [eax + 0x14], edx
jne 0x40ad45
lea ebx, [eax + 0xc]
mov dword [eax + 0x14], ebx
cmp dword [eax + 0x24], edx
jne 0x40ad50
lea ebx, [eax + 0x1c]
mov dword [eax + 0x24], ebx
inc ecx
add edi, 0x28
cmp ecx, dword [esi + 0x14]
jl 0x40ad36
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x40c31f
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
push ecx
cmp dword [ebp + 0xc], 0
mov eax, dword [ebp + 0x10]
push ebx
push esi
lea ebx, [ecx + 8]
movdqu xmm1, xmmword [ebx]
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], eax
lea esi, [ecx + 0x18]
jbe 0x40c3a4
mov eax, edi
movdqu xmm2, xmmword [eax]
mov eax, dword [ecx + 4]
mov edx, eax
shl edx, 4
add edx, esi
movdqu xmm0, xmmword [edx]
add edi, 0x10
dec eax
pxor xmm0, xmm2
test eax, eax
jle 0x40c37b
mov edx, eax
shl edx, 4
add edx, esi
movdqu xmm3, xmmword [edx]
dec eax
sub edx, 0x10
aesdec xmm0, xmm3
test eax, eax
jg 0x40c36a
cmp byte [ecx + 1], 0
movdqu xmm3, xmmword [esi]
aesdeclast xmm0, xmm3
je 0x40c38e
pxor xmm0, xmm1
mov eax, dword [esp + 0xc]
add dword [esp + 0xc], 0x10
dec dword [ebp + 0xc]
movdqa xmm1, xmm2
movdqu xmmword [eax], xmm0
jne 0x40c343
pop edi
pop esi
movdqu xmmword [ebx], xmm1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c3b1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
mov edi, ecx
mov ebx, dword [edi + 4]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], edi
sub ebx, 6
call fcn.0041c000
xor eax, eax
add esp, 0xc
xor edx, edx
cmp ebx, eax
mov dword [ebp + 8], eax
jle 0x40c421
cmp edx, dword [edi + 4]
jg 0x40c56f
cmp eax, ebx
jge 0x40c412
lea ecx, [ebp + eax*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40c412
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x18]
mov esi, ecx
inc eax
add ecx, 4
inc dword [ebp + 8]
cmp eax, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40c3f2
cmp dword [ebp + 8], 4
jne 0x40c41d
inc edx
and dword [ebp + 8], 0
cmp eax, ebx
jl 0x40c3e1
cmp edx, dword [edi + 4]
jg 0x40c56f
mov eax, ebx
shl eax, 2
lea ecx, [ebp + eax - 0x3b]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + eax - 0x3a]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + eax - 0x39]
lea eax, [ebp + eax - 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x4375e0
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov al, byte [ebp - 0x38]
xor al, byte [ecx + 0x437700]
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 0x38], al
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x37], cl
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x36], cl
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x437700]
xor byte [ebp - 0x35], cl
mov ecx, dword [ebp - 8]
xor al, byte [ecx]
inc dword [ebp - 8]
mov byte [ebp - 0x38], al
cmp ebx, 8
je 0x40c4c3
cmp ebx, 1
jle 0x40c524
lea ecx, [ebp - 0x34]
lea edi, [ebx - 1]
xor esi, esi
mov al, byte [ecx + esi - 4]
xor byte [ecx + esi], al
inc esi
cmp esi, 4
jl 0x40c4ae
add ecx, 4
dec edi
jne 0x40c4ac
jmp 0x40c521
push 3
lea ecx, [ebp - 0x34]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40c4cc
dec edi
jne 0x40c4c9
movzx eax, byte [ebp - 0x2c]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x28], al
movzx eax, byte [ebp - 0x2b]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x27], al
movzx eax, byte [ebp - 0x2a]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x26], al
movzx eax, byte [ebp - 0x29]
mov al, byte [eax + 0x437700]
xor byte [ebp - 0x25], al
push 3
lea ecx, [ebp - 0x24]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40c515
dec edi
jne 0x40c512
mov edi, dword [ebp - 4]
xor ecx, ecx
test ebx, ebx
jle 0x40c566
cmp edx, dword [edi + 4]
jg 0x40c56f
cmp ecx, ebx
jge 0x40c557
lea eax, [ebp + ecx*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40c557
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x18]
mov esi, eax
inc ecx
add eax, 4
inc dword [ebp + 8]
cmp ecx, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40c537
cmp dword [ebp + 8], 4
jne 0x40c562
inc edx
and dword [ebp + 8], 0
cmp ecx, ebx
jl 0x40c52a
cmp edx, dword [edi + 4]
jle 0x40c452
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c576
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
inc eax
mov edi, ecx
cmp dword [edi + 4], eax
mov dword [ebp - 8], eax
jle 0x40c605
lea eax, [edi + 0x28]
push ebx
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 0xc], 4
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x4345e0]
xor dl, byte [eax + ebx*4 + 0x434de0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x4351e0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4349e0]
add ecx, 4
mov byte [esi], dl
add esi, 4
dec dword [ebp - 0xc]
jne 0x40c5a5
inc eax
cmp eax, 4
jl 0x40c594
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0041c000
add dword [ebp - 4], 0x10
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edi + 4]
jl 0x40c592
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40cda7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
cmp dword [0x437808], ebx
jne 0x40cdc0
mov ecx, 0x437800
call fcn.0040cd68
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
xor edx, edx
sub eax, ecx
cmp byte [ebp + 0x14], bl
setne dl
cmp byte [ebp + 0x10], bl
je 0x40ce12
mov ecx, dword [0x437808]
cmp ecx, ebx
je 0x40ce2e
push edx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40ce4f
push str.CryptProtectMemory_failed
mov esi, 0x4325ac
push esi
call fcn.004063ad
pop ecx
pop ecx
mov ecx, esi
call fcn.00401000
push 2
mov ecx, esi
call fcn.00406353
jmp 0x40ce4f
mov ecx, dword [0x43780c]
cmp ecx, ebx
je 0x40ce2e
push edx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40ce4f
push str.CryptUnprotectMemory_failed
jmp 0x40cdf3
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
cmp esi, ebx
jbe 0x40ce4f
mov dl, al
add dl, 0x4b
mov eax, dword [ebp + 8]
add eax, ecx
mov bl, dl
add bl, cl
xor byte [eax], bl
inc ecx
cmp ecx, esi
jb 0x40ce3f
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x40d007
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x42f0dc], 0
push ebx
push esi
push edi
mov edi, 0x400
jne 0x40d052
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x44bf24], ax
xor eax, eax
mov word [0x44bf26], ax
mov dword [0x42f0dc], 0x44bf24
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004109ac
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push 0x42f0cc
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
pop edi
mov word [esi + ebx*2 - 2], ax
pop esi
pop ebx
leave
ret 0x10
Function at 0x40d148
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x68
push dword [0x440844]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x440848], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x40d1aa
mov ecx, dword [0x437814]
call fcn.00418f00
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x42a724
push 0
push 0xc2
push edi
call esi
mov byte [0x440848], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x60], 0x5c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x5c], eax
je 0x40d1fa
mov ecx, dword [ebp - 0x58]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], 0xa0
mov dword [ebp - 0x5c], 0x40000001
lea ecx, [ebp - 0x60]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x40d244
mov eax, dword [ebp - 0x58]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x42a7f8
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40d631
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041a860
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x40d64c
mov byte [ebx], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40d656
mov byte [eax], 0
test edi, edi
je 0x40d6ff
movzx eax, word [edi]
test ax, ax
je 0x40d6ff
push esi
xor esi, esi
xor ecx, ecx
movzx eax, ax
inc edi
inc edi
cmp ax, 0x3d
jne 0x40d68f
cmp dword [ebp + 0xc], 0
je 0x40d69b
test esi, esi
jne 0x40d69b
test ebx, ebx
je 0x40d68b
mov byte [ebx], 1
mov esi, edx
jmp 0x40d6aa
cmp ax, 0xd
je 0x40d6bd
cmp ax, 0xa
je 0x40d6bf
mov word [edx], ax
mov eax, dword [ebp + 0x14]
inc edx
add eax, 0xfffffffe
inc edx
cmp ecx, eax
jge 0x40d6b5
movzx eax, word [edi]
inc ecx
test ax, ax
jne 0x40d66f
jmp 0x40d6bf
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x40d6bf
inc edi
inc edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [edx], ax
test ebx, ebx
je 0x40d6fa
mov word [ebx], ax
test esi, esi
je 0x40d6fa
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2000]
push eax
push ebx
call fcn.00410951
xor eax, eax
mov word [esi], ax
mov eax, edi
pop esi
jmp 0x40d701
xor eax, eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x40d746
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0041a860
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.00419a10
cmp byte [0x440849], 0
jne 0x40d7db
push 6
push dword [0x42f0c8]
lea eax, [ebp - 0x1020]
push eax
call fcn.0040a2a0
push eax
call fcn.00411bf2
test eax, eax
jne 0x40d7db
push 0x42a644
call fcn.004199fd
lea eax, [ebp - 0x1020]
push eax
call fcn.0041a523
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x101e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0041a590
add esp, 0x10
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x40d93c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041a860
push ebx
xor ebx, ebx
cmp byte [0x440878], bl
je 0x40d9c1
cmp word [0x437818], bx
je 0x40d9c1
push esi
push 0x437818
lea esi, [ebp - 0x1008]
call fcn.0040d8ff
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x40d9c1
push dword [ebp + 8]
call fcn.0041a523
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40d9c6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041a860
cmp byte [0x440878], 0
je 0x40da6d
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x200c]
call fcn.0040d8ff
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40da6d
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40da64
shr dword [ebp - 4], 1
mov eax, 0x7ff
cmp dword [ebp - 4], eax
jae 0x40da48
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.00410951
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x40e315
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1048
call fcn.0041a860
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp word [esi], bx
je 0x40e530
push esi
call fcn.0041a523
pop ecx
cmp eax, 0x7f6
jae 0x40e530
push edi
push 0x3c
pop edi
push edi
lea eax, [ebp - 0x48]
push ebx
push eax
call fcn.0041a590
movzx ecx, word [esi]
add esp, 0xc
mov dword [ebp - 0x48], edi
mov dword [ebp - 0x44], 0x1c0
cmp cx, 0x22
jne 0x40e370
lea eax, [esi + 2]
mov dword [ebp - 0x38], eax
jmp 0x40e373
mov dword [ebp - 0x38], esi
xor eax, eax
cmp cx, bx
je 0x40e3c9
mov ecx, esi
cmp word [ecx], 0x22
jne 0x40e39b
jmp 0x40e38b
cmp word [esi + eax*2], 0x22
je 0x40e394
inc eax
cmp word [esi + eax*2], bx
jne 0x40e384
jmp 0x40e39b
push 0x20
pop ecx
mov word [esi + eax*2], cx
cmp word [esi + eax*2], 0x20
je 0x40e3b5
cmp word [esi + eax*2 + 2], 0x2f
je 0x40e3b5
inc eax
lea ecx, [esi + eax*2]
cmp word [ecx], bx
jne 0x40e37c
jmp 0x40e3c9
lea eax, [esi + eax*2]
cmp word [eax], 0x20
jne 0x40e3c3
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
cmp eax, ebx
je 0x40e3d5
cmp word [eax], bx
jne 0x40e3ea
cmp byte [ebp + 0xc], bl
jne 0x40e3ea
cmp word [0x44187a], bx
je 0x40e3ea
mov dword [ebp - 0x34], 0x44187a
push dword [ebp - 0x38]
mov dword [ebp - 0x2c], 1
call fcn.0040a42f
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40e416
push str..inf
push eax
call fcn.00411bd1
test eax, eax
jne 0x40e416
mov dword [ebp - 0x3c], 0x42a8f8
push dword [ebp - 0x38]
call fcn.004091c5
test al, al
je 0x40e43f
push 0x800
lea eax, [ebp - 0x1048]
push eax
push dword [ebp - 0x38]
call fcn.0040a928
lea eax, [ebp - 0x1048]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x40e52f
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
mov edi, 0x3e8
cmp byte [0x440870], bl
jne 0x40e474
cmp byte [ebp + 0xc], bl
jne 0x40e474
cmp byte [0x44085d], bl
je 0x40e4d1
cmp dword [ebp + 8], ebx
je 0x40e490
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40e490
push ebx
push dword [ebp + 8]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0x10]
call fcn.0040d707
cmp byte [0x44085d], bl
je 0x40e4d1
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x40e4d1
mov eax, dword [ebp - 0xc]
add eax, edi
cmp eax, dword [0x440860]
jbe 0x40e4d1
mov dword [0x440860], eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x40e4f0
push 0x42a8ec
push dword [ebp - 8]
call fcn.00411bd1
test eax, eax
je 0x40e51e
cmp byte [0x440870], bl
je 0x40e509
cmp byte [ebp + 0xc], bl
jne 0x40e509
mov dword [0x440864], 0x1b58
jmp 0x40e51e
xor eax, eax
cmp byte [ebp + 0xc], bl
sete al
dec eax
and eax, 0xfffffce0
add eax, edi
mov dword [0x440864], eax
cmp byte [ebp - 1], bl
je 0x40e52f
cmp byte [ebp + 0xc], bl
je 0x40e52f
push 1
push dword [ebp + 8]
call esi
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40fcfb
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 1
call fcn.00410be8
xor ebx, ebx
push ebx
call dword [sym.imp.ole32.dll_OleInitialize]
mov ecx, 0x44e5b0
call fcn.00411cc7
mov esi, 0x7002
push esi
push ebx
push 0x439820
call fcn.0041a590
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
cmp edi, ebx
je 0x40fdaa
push edi
call fcn.0040d4fb
cmp byte [0x440879], bl
je 0x40fda4
push str.winrarsfxmappingfile.tmp
push ebx
mov edi, 0xf001f
push edi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x40fd99
push esi
push ebx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
je 0x40fd92
push esi
push edi
push 0x439820
call fcn.0041c000
add esp, 0xc
push 0x439822
mov byte [edi], 1
call fcn.0040d4a7
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40fdaa
push edi
call fcn.0040d4a7
push 0x800
mov esi, 0x438820
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
push str.sfxname
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
push 0x64
push edi
mov dword [0x4325a4], edi
mov dword [0x4325a8], edi
call dword [sym.imp.USER32.dll_LoadIconW]
push 0x65
push dword [0x4325a8]
mov dword [0x43881c], eax
call dword [sym.imp.USER32.dll_LoadBitmapW]
lea ecx, [ebp - 8]
mov dword [0x438818], eax
call fcn.00419dd5
push esi
mov ecx, 0x4325bc
call fcn.0040c25a
lea ecx, [ebp - 0x60]
call fcn.00418eac
lea ecx, [ebp - 0x34]
call fcn.00418eac
push 0x64
call fcn.00419b45
push 0x64
mov dword [ebp - 0x40], eax
call fcn.00419b45
push ebx
push 0x40f436
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x60]
mov dword [0x437814], eax
push str.STARTDLG
lea eax, [ebp - 0x34]
push edi
mov dword [0x437810], eax
call dword [sym.imp.USER32.dll_DialogBoxParamW]
lea ecx, [ebp - 0x34]
mov dword [0x437810], ebx
mov dword [0x437814], ebx
call fcn.00418ed1
lea ecx, [ebp - 0x60]
call fcn.00418ed1
lea ecx, [ebp - 8]
call fcn.00419e2f
cmp byte [0x440870], bl
je 0x40fe89
call fcn.0040d746
mov ecx, 0x44be20
call fcn.0040cfb0
cmp dword [0x440858], ebx
jbe 0x40fea7
push dword [0x44084c]
call fcn.0041a27a
pop ecx
push dword [0x43881c]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
mov eax, dword [0x438818]
cmp eax, ebx
je 0x40fec1
push eax
call esi
cmp dword [0x4325ac], ebx
jne 0x40fee0
cmp byte [0x44083c], bl
je 0x40fee0
push 0xff
mov ecx, 0x4325ac
call fcn.004062b2
mov eax, dword [0x440868]
mov byte [0x44083c], 1
cmp eax, ebx
je 0x40ff02
push eax
call fcn.0040d707
push dword [0x440868]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x440864]
cmp eax, ebx
je 0x40ff12
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [0x440860]
pop edi
pop esi
cmp eax, ebx
pop ebx
ja 0x40ff29
mov eax, dword [0x4325ac]
leave
ret 0x10
Function at 0x41028d
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x410463
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4