joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100148c4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100148d3
pop dword [ebp - 0x50]
mov eax, 0xb132071f
sub eax, 0xa130be4c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x945911d5
sub dword [ebp - 0x60], 0x4606cc8a
mov dword [ebp - 0x5c], 0x7369f5f5
add dword [ebp - 0x5c], 0xbec95650
mov dword [ebp - 0x58], 0x2b02afc0
add dword [ebp - 0x58], 0x2149946e
mov dword [ebp - 0x54], 0x288fc5e5
sub dword [ebp - 0x54], 0x288fc5e5
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x2eec6bc9
sub dword [ebp - 0x60], 0xba7a0273
mov dword [ebp - 0x5c], 0x8c456710
sub dword [ebp - 0x5c], 0x4ad9059b
mov dword [ebp - 0x58], 0xe905a4bb
add dword [ebp - 0x58], 0x7a69c7b1
mov dword [ebp - 0x54], 0x1a16fa71
add dword [ebp - 0x54], 0xe5e9058f
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0x3283c60c
sub eax, 0x2281d570
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x39e23
push 0
call eax
mov ecx, 0x4342
mov ebx, eax
mov esi, 0x5c01c8de
add esi, 0xb400d122
add esi, dword [ebp - 0x50]
mov edi, 0x9a8dc336
add dword [ebp - 0x1c], 0x57969e4e
mov edx, dword [esi]
xor dword [ebp - 0x4c], 0x12bcaf8f
xor edx, edi
sub dword [ebp - 0x48], 0x54375db9
mov dword [ebx], edx
sub dword [ebp - 0x10], ebx
add ebx, 4
add esi, 0xc7af35a3
sub esi, 0xc7af359f
loop 0x100149e4
add eax, 0xb7a2e616
sub eax, 0xb7a1e63b
mov ebx, eax
add eax, 0xc856873d
add eax, 0x37a978c8
mov ecx, 0x99627148
sub ecx, 0x89627148
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.100148c4
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.100148c4
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.100148c4
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.100148c4
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.100148c4
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x40295b
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4121c4], 0
jne 0x402969
call fcn.00402931
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402996
test cl, 7
je 0x402996
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
dec esi
inc ecx
jmp 0x402977
cmp esi, 8
jb 0x402a1a
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4121c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4121c0]
dec edi
jne 0x4029a0
xor edx, edx
test esi, esi
jbe 0x402a3a
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4121c0]
inc edx
cmp edx, esi
jb 0x402a21
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x404091
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24c0
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x24c0]
call fcn.00402e5c
mov edi, dword [ebp + 8]
xor ebx, ebx
push ebx
lea eax, [ebp - 0x24c0]
push eax
push dword [ebp + 0xc]
push edi
call fcn.0040553c
test al, al
je 0x40422a
cmp byte [ebp - 0x24c0], bl
je 0x40422a
cmp byte [ebp - 0x1840], bl
je 0x40422a
lea eax, [ebp - 0x1840]
push eax
lea eax, [ebp - 0x24c0]
push eax
call fcn.004068e9
push eax
call fcn.0040b959
test eax, eax
je 0x40422a
lea eax, [ebp - 0x1840]
push eax
push edi
call fcn.004068e9
push eax
call fcn.0040b959
test eax, eax
jne 0x40422a
mov esi, 0x400
push esi
push edi
lea eax, [ebp - 0x400]
push eax
call fcn.0040ba35
push ebx
push str.rtmp_d
lea eax, [ebp - 0x400]
push eax
call fcn.004068e9
push eax
call fcn.00408abc
add esp, 0xc
push 0
lea eax, [ebp - 0x400]
push eax
call fcn.00404c5e
test al, al
je 0x404169
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x404123
push 0
lea eax, [ebp - 0x400]
push eax
call fcn.00404c5e
test al, al
jne 0x40422a
push esi
push edi
lea eax, [ebp - 0x800]
push eax
call fcn.0040ba35
lea eax, [ebp - 0x24c0]
push eax
call fcn.004068e9
push eax
lea eax, [ebp - 0x800]
push eax
call fcn.004068e9
push eax
call fcn.00408923
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileA]
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test eax, eax
je 0x40422a
lea ecx, [ebp - 0x1420]
call fcn.0040440b
push 0
push edi
xor bl, bl
call fcn.00404c5e
test al, al
jne 0x4041f1
push 1
push 0
push edi
lea ecx, [ebp - 0x1420]
call fcn.00404720
mov bl, al
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x400]
push eax
call esi
test bl, bl
je 0x40421b
lea ecx, [ebp - 0x1420]
call fcn.00404476
lea ecx, [ebp - 0x1420]
call fcn.004044f4
lea ecx, [ebp - 0x1420]
call fcn.004045bc
mov al, 1
jmp 0x40422c
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4045df
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x4045f9
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x40460c
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x40461f
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.0040639c
test eax, eax
je 0x404658
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x404658
cmp word [eax], bx
je 0x404658
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x40466c
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404688
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x404688
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x4046ea
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x4046b6
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.0040c25e
jmp 0x4046bf
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x4046d2
push dword [ebp + 8]
push eax
call fcn.00408923
jmp 0x4046e0
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.0040c06b
push dword [esi + 4]
mov ecx, esi
call fcn.0040444f
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4047e1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x404807
cmp dword [ebp + 0xc], esi
jbe 0x4047fc
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x404857
mov ecx, edi
call fcn.00404599
test al, al
je 0x40483d
cmp dword [ebp + 0xc], esi
jbe 0x40483d
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004047e1
jmp 0x40485a
cmp dword [edi + 0xc], 1
jne 0x404852
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x404852
xor eax, eax
jmp 0x40485a
or eax, 0xffffffff
jmp 0x40485a
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x404a94
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x404b94
mov eax, dword [esi + 0xc]
test eax, eax
je 0x404ac1
dec eax
je 0x404ab6
dec eax
jne 0x404ac1
push 0xfffffffffffffff4
jmp 0x404ab8
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x404b10
cmp dword [ebp + 0xc], edi
jbe 0x404b2b
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x404ae8
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x404b2b
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x404ad8
jmp 0x404b27
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x404b8e
cmp byte [esi + 0x14], 0
je 0x404b8e
cmp dword [esi + 0xc], 0
jne 0x404b8e
push 0
lea eax, [esi + 0x17]
mov edi, 0x412c7c
push eax
mov ecx, edi
call fcn.00402cc4
test al, al
je 0x404b81
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x404ac9
test eax, eax
jbe 0x404ac9
push 0
mov ecx, esi
call fcn.00404524
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.004049fc
jmp 0x404ac9
lea eax, [esi + 0x17]
push eax
push 0
mov ecx, edi
call fcn.00402e31
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x404c5e
Capabilities:
Get file attributes

Disassembly:
call fcn.0040639c
test eax, eax
je 0x404c7e
mov eax, dword [esp + 8]
test eax, eax
je 0x404c7e
cmp word [eax], 0
je 0x404c7e
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x404c88
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8

Function at 0x404cb2
Capabilities:
Get file attributes

Disassembly:
call fcn.0040639c
test eax, eax
je 0x404cd2
mov eax, dword [esp + 8]
test eax, eax
je 0x404cd2
cmp word [eax], 0
je 0x404cd2
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x404cdc
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x404cdf
Capabilities:
Set file attributes

Disassembly:
call fcn.0040639c
test eax, eax
je 0x404d03
mov eax, dword [esp + 8]
test eax, eax
je 0x404d03
cmp word [eax], 0
je 0x404d03
push dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x404d11
push dword [esp + 0xc]
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
ret 0xc
Function at 0x404d8f
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0040639c
mov esi, dword [ebp + 0xc]
test eax, eax
je 0x404db4
test esi, esi
je 0x404db4
cmp word [esi], 0
je 0x404db4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x404dbf
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x404dd9
cmp byte [ebp + 0x10], 0
je 0x404dd5
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.00404cdf
xor eax, eax
jmp 0x404df1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x404dee
cmp eax, 3
je 0x404dee
xor eax, eax
inc eax
jmp 0x404df1
push 2
pop eax
pop esi
pop ebp
ret 0x10
Function at 0x4091f2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0x67
push dword [0x417f80]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x418814], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x409254
mov ecx, dword [0x416ecc]
call fcn.00405993
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x410552
push 0
push 0xc2
push edi
call esi
mov byte [0x418814], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x40]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x40], 0x3c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x27], 0
mov dword [ebp - 0x3c], eax
je 0x4092a4
mov ecx, dword [ebp - 0x38]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x2c], 0xa0
mov dword [ebp - 0x3c], 0x40000001
lea ecx, [ebp - 0x40]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x4092ee
mov eax, dword [ebp - 0x38]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x40]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x410588
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x409b2a
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
lea eax, [ebp - 0x420]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
cmp byte [0x418815], 0
jne 0x409bb9
push 6
push dword [0x41209c]
lea eax, [ebp - 0x420]
push eax
call fcn.004068e9
push eax
call fcn.00408a69
test eax, eax
jne 0x409bb9
push 0x4102f4
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea eax, [ebp - 0x420]
push eax
call fcn.00408830
push 0x1e
mov byte [ebp + eax - 0x41f], 0
push 0
lea eax, [ebp - 0x20]
push eax
call fcn.00408786
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x420]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
leave
ret

Function at 0x409c78
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
push ebx
push esi
xor esi, esi
inc esi
xor ebx, ebx
mov dword [0x417f70], esi
cmp dword [0x417f80], ebx
je 0x409ca2
push 0x7d
call fcn.00408670
push eax
push esi
push dword [0x417f80]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [0x417f80]
mov dword [0x417f6c], ebx
mov dword [0x417f68], esi
cmp eax, ebx
je 0x409cf2
push esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [0x418824], ebx
jne 0x409ce9
cmp byte [0x418814], bl
jne 0x409ce9
push ebx
push esi
push 0x111
push dword [0x417f80]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x409ce9
call fcn.00408cd9
cmp dword [0x417f78], 2
jne 0x409ce4
cmp byte [0x417f88], bl
pop esi
pop ebx
je 0x409d01
jmp fcn.00409b2a
ret
Function at 0x409d30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
xor ebx, ebx
cmp byte [0x417f90], bl
je 0x409dac
cmp byte [0x416ed0], bl
je 0x409dac
push esi
push 0x416ed0
lea esi, [ebp - 0x408]
call fcn.00409d02
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop esi
test eax, eax
jne 0x409dac
push dword [ebp + 8]
call fcn.00408830
inc eax
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x408]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x409db1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
cmp byte [0x417f90], 0
je 0x409e33
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x40c]
call fcn.00409d02
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop esi
test eax, eax
jne 0x409e33
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x40c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x400
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409e2a
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 8]
call fcn.00408923
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 4

Function at 0x409f8b
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp byte [0x417ede], 0
mov eax, dword [ebp + 0x10]
mov dword [0x417ee0], eax
mov eax, dword [ebp + 0x14]
mov dword [0x417ee4], eax
mov eax, dword [ebp + 0x18]
mov dword [0x417ed8], eax
je 0x409fbb
xor eax, eax
inc eax
jmp 0x409fe4
cmp byte [0x417edf], 0
je 0x409fc9
push 2
pop eax
jmp 0x409fe4
push dword [ebp + 0xc]
push 0x409343
push dword [0x417f80]
push str.REPLACEFILEDLG
push dword [0x412c74]
call esi
dec eax
je 0x40a045
dec eax
je 0x40a024
dec eax
je 0x40a03e
dec eax
jne 0x40a017
push dword [ebp + 0xc]
push 0x40963f
push dword [0x417f80]
push str.RENAMEDLG
push dword [0x412c74]
call esi
test eax, eax
je 0x409f95
mov eax, dword [ebp + 8]
mov byte [eax], 0x52
jmp 0x40a056
dec eax
je 0x40a02c
dec eax
jne 0x40a056
mov byte [0x417edf], 1
mov eax, dword [ebp + 8]
mov byte [eax], 0x4e
jmp 0x40a056
mov eax, dword [ebp + 8]
mov dword [0x417f78], 1
mov byte [eax], 0x43
jmp 0x40a056
mov byte [0x417ede], 1
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
mov byte [eax], 0x59
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop esi
pop ebp
ret 0x18
Function at 0x40a0f8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push esi
mov esi, eax
push esi
call fcn.00408830
cmp eax, 0x3f6
jae 0x40a30c
push ebx
push edi
push 0x3c
pop edi
push edi
xor ebx, ebx
push ebx
lea eax, [ebp - 0x44]
push eax
call fcn.00408786
mov cl, byte [esi]
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], 0x5c0
cmp cl, 0x22
jne 0x40a140
lea eax, [esi + 1]
mov dword [ebp - 0x34], eax
jmp 0x40a143
mov dword [ebp - 0x34], esi
xor eax, eax
cmp cl, bl
je 0x40a188
mov ecx, esi
cmp byte [ecx], 0x22
jne 0x40a164
jmp 0x40a158
cmp byte [eax + esi], 0x22
je 0x40a160
inc eax
cmp byte [eax + esi], bl
jne 0x40a152
jmp 0x40a164
mov byte [eax + esi], 0x20
cmp byte [eax + esi], 0x20
je 0x40a17b
cmp byte [eax + esi + 1], 0x2f
je 0x40a17b
inc eax
lea ecx, [eax + esi]
cmp byte [ecx], bl
jne 0x40a14b
jmp 0x40a188
add eax, esi
cmp byte [eax], 0x20
jne 0x40a184
mov byte [eax], bl
inc eax
mov dword [ebp - 0x30], eax
cmp byte [ebp + 8], bl
jne 0x40a19c
cmp byte [0x418392], bl
je 0x40a19c
mov dword [ebp - 0x30], 0x418392
push dword [ebp - 0x34]
mov dword [ebp - 0x28], 1
call fcn.00406b9e
mov dword [ebp - 8], eax
cmp eax, ebx
je 0x40a1c8
push str..inf
push eax
call fcn.00408a46
test eax, eax
jne 0x40a1c8
mov dword [ebp - 0x38], str.Install
push ebx
push dword [ebp - 0x34]
call fcn.00404c5e
mov byte [ebp - 1], al
cmp al, bl
je 0x40a1f0
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x34]
call fcn.00404d19
lea eax, [ebp - 0x844]
mov dword [ebp - 0x34], eax
cmp byte [ebp + 8], bl
je 0x40a22f
cmp byte [ebp - 1], bl
jne 0x40a22f
push dword [ebp - 0x34]
lea eax, [ebp - 0x444]
push eax
call fcn.00408923
push str..exe
lea eax, [ebp - 0x444]
push eax
call fcn.00408a8e
push ebx
lea eax, [ebp - 0x444]
push eax
call fcn.00404c5e
test al, al
je 0x40a30a
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea eax, [ebp - 0x44]
push eax
call edi
test eax, eax
setne al
cmp al, bl
jne 0x40a261
and dword [ebp - 0x40], 0xfffffbff
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x34], esi
call edi
test eax, eax
setne al
cmp al, bl
je 0x40a30a
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
mov byte [ebp - 1], bl
cmp byte [0x417f88], bl
jne 0x40a277
cmp byte [ebp + 8], bl
je 0x40a2ae
mov eax, dword [0x417f80]
cmp eax, ebx
je 0x40a298
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x40a298
push ebx
push dword [0x417f80]
call esi
mov byte [ebp - 1], 1
push 0x7d0
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push dword [ebp - 0xc]
call fcn.00409aeb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 8], ebx
je 0x40a2cd
push str..exe
push dword [ebp - 8]
call fcn.00408a46
test eax, eax
je 0x40a2fb
cmp byte [0x417f88], bl
je 0x40a2e1
cmp byte [ebp + 8], bl
jne 0x40a2e1
push 0x1b58
jmp 0x40a2f5
xor eax, eax
cmp byte [ebp + 8], bl
sete al
dec eax
and eax, 0xfffffce0
add eax, 0x3e8
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [ebp - 1], bl
je 0x40a30a
push 1
push dword [0x417f80]
call esi
pop edi
pop ebx
pop esi
leave
ret 4