joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b645
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x42b72c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42b712
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x42b6c9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x42b6c7
push 0x1a00
push 0xab0
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
jmp 0x42b710
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x42b6eb
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffff1
jl 0x42b710
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x42b70e
push 0x1416
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x42b6e0
jmp 0x42b72a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0
push 0xd19
push dword [ebp - 0x38]
call fcn.004314a6
add esp, 0xc
jmp 0x42b748
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 1
call fcn.0042a244
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x42c2dd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42c39b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x42c372
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x42c359
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x42c357
push 0x9b0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x42c370
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x42c399
push 0x1202
push 0x7992
push 0
push 0xde4
push 0x5f95
push 0
push 0x393e
push 1
call fcn.00429458
add esp, 0x20
jmp 0x42c3cd
lea eax, [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x42c3bb
push 0
call fcn.0043286b
pop ecx
jmp 0x42c3cd
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0
call fcn.00429f97
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42d135
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x42d1ce
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x42d1ac
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x42d198
mov byte [ebp - 1], 0
push 0
push 0
push 0x8a3
push 0x6896
lea eax, [ebp - 1]
push eax
push 0x62d0
call fcn.00431656
add esp, 0x18
jmp 0x42d1aa
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x42d1c9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0
push 0xb6f
push dword [ebp - 0x1c]
push 0x5f65
call fcn.00434851
add esp, 0x10
jmp 0x42d294
lea eax, [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x42d223
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x30]
push 1
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.0042ae85
add esp, 0x10
jmp 0x42d294
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x42d259
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x42d257
push 0x23e5
push 0x10f8
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x42d294
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 6
jmp 0x42d27b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x13
je 0x42d294
mov dword [ebp - 0x50], 0x64fd9e2a
cmp dword [ebp - 0x50], 0
je 0x42d292
jmp 0x42d294
jmp 0x42d270
mov esp, ebp
pop ebp
ret
Function at 0x431fb2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x4320eb
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43205f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43203d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x2c]
mov dword [eax], 1
jmp 0x43205a
push 0
push 0xca1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
jmp 0x4320e9
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x4320ad
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x4320ab
push 0x9b0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x4320e9
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
cmp dword [eax], 0
je 0x4320dd
push 0xfffffffffffffffc
pop eax
test eax, eax
je 0x4320dd
mov dword [ebp - 4], 1
jmp 0x4320e1
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x432103
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x68], eax
push 1
push dword [ebp - 0x68]
push 0x6c8
call fcn.00430310
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x437fd4
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x43809a
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43804e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43803a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x438038
push 0
push 1
push 1
call fcn.0042be07
add esp, 0xc
jmp 0x43804c
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x43804c
call dword [sym.imp.USER32.dll_DestroyCaret]
jmp 0x438098
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x43808e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x438098
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x4380ba
lea eax, [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
push eax
push 1
call fcn.004303c2
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x468180
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x47627f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x489484]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00466035
mov dword [ebp - 0x14], eax
cmp dword [0xa834f0], esi
jne 0x476372
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4762ff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x476452
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x476452
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x476452
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0xa834f0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0xa834f4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0xa834f8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa83500], eax
test eax, eax
je 0x47636f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0xa834fc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x476397
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x47638a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x4763ac
push 4
pop eax
jmp 0x476454
cmp dword [ebp - 0x14], esi
je 0x4763ac
push dword [0xa834f0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x476391
mov eax, dword [0xa834fc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x47640a
cmp dword [0xa83500], edi
je 0x47640a
push eax
call ebx
push dword [0xa83500]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x47640a
test eax, eax
je 0x47640a
call ecx
test eax, eax
je 0x4763ff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4763ff
test byte [ebp - 8], 1
jne 0x47640a
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x47643a
mov eax, dword [0xa834f4]
cmp eax, edi
je 0x476437
push eax
call ebx
test eax, eax
je 0x476437
call eax
mov esi, eax
test esi, esi
je 0x476437
mov eax, dword [0xa834f8]
cmp eax, edi
je 0x476437
push eax
call ebx
test eax, eax
je 0x476437
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0xa834f0]
call ebx
test eax, eax
je 0x476452
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x476454
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004654db
mov esp, ebp
pop ebp
ret
Function at 0x403340
Capabilities:
Enumerate gui resources
Get hostname

Disassembly:
mov eax, 0x1c0c
call fcn.0040cdc0
mov eax, dword [0xa6c52c]
mov ecx, dword [0xa6c49c]
shr eax, 3
test eax, eax
jbe 0x403472
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteProfileSectionW]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetNumberFormatA]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jmp 0x403390
cmp dword [0xa6c52c], 0x959
jne 0x403454
push 0
lea eax, [esp + 0x20]
push eax
push 0
push 0
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x820]
push ecx
push 0
call ebx
push 0
push 0
call esi
push 0
call ebp
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoExW]
push 0
push 0
lea edx, [esp + 0x1024]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasW]
push 0
push 0
call esi
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
push 0
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_BeginUpdateResourceW]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x1420]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0x402d38
push 0x402d48
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
mov eax, dword [esp + 0x10]
push eax
call fcn.00403160
add dword [esp + 0x10], 8
sub dword [esp + 0x14], 1
jne 0x403390
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c0c
ret
Function at 0x403d40
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xffffffc0
mov eax, 0x1830
call fcn.0040cdc0
cmp dword [0xa6c52c], 0xc
push ebx
push ebp
push esi
push edi
jne 0x403e23
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push 0
lea eax, [esp + 0x444]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesW]
push 0
call dword [sym.imp.KERNEL32.dll__lclose]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll__hwrite]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleFontSize]
push 0
push 0
lea ecx, [esp + 0xc48]
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push 0
push 0x402df8
push 0x402e14
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
push 0
lea edx, [esp + 0x44]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryA]
push 0x402e30
call dword [sym.imp.KERNEL32.dll_FindAtomA]
push 0
lea eax, [esp + 0x1044]
push eax
push 0x402e64
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapSize]
push 0x402e70
call dword [sym.imp.KERNEL32.dll_AddAtomW]
push 0
push 0
call fcn.00403edf
mov eax, esp
mov dword [eax], 0
mov dword [eax + 4], 0
call fcn.0040421a
fstp st(0)
add esp, 8
mov edi, dword [sym.imp.USER32.dll_SetCaretPos]
mov ebx, dword [sym.imp.USER32.dll_CharLowerBuffW]
mov ebp, dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
cmp esi, 0x9458
jge 0x403e55
push 0
push 0
call edi
push 0
lea ecx, [esp + 0x1044]
push ecx
call ebx
push 0
call ebp
inc esi
cmp esi, 0x14ee8
jl 0x403e37
mov edx, dword [0x45f6d4]
mov eax, dword [0x45f6a8]
mov dword [0xa6c52c], edx
mov dword [0xa6de34], eax
call fcn.00403580
pop edi
xor eax, eax
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x4072e3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45eab0]
jne 0x4072ed
repz ret
jmp fcn.0040a61b
Function at 0x40a1ad
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00405648
and dword [ebp - 4], 0
cmp dword [0x45ffa8], 0
mov ebx, eax
jne 0x40a25e
push 0x4023cc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40a30f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4023c0
push edi
call esi
test eax, eax
je 0x40a30f
push eax
call fcn.004055d6
mov dword [esp], 0x4023b0
push edi
mov dword [0x45ffa8], eax
call esi
push eax
call fcn.004055d6
mov dword [esp], 0x40239c
push edi
mov dword [0x45ffac], eax
call esi
push eax
call fcn.004055d6
mov dword [esp], 0x402380
push edi
mov dword [0x45ffb0], eax
call esi
push eax
call fcn.004055d6
pop ecx
mov dword [0x45ffb8], eax
test eax, eax
je 0x40a25e
push 0x402368
push edi
call esi
push eax
call fcn.004055d6
pop ecx
mov dword [0x45ffb4], eax
mov eax, dword [0x45ffb4]
cmp eax, ebx
je 0x40a2b6
cmp dword [0x45ffb8], ebx
je 0x40a2b6
push eax
call fcn.00405651
push dword [0x45ffb8]
mov esi, eax
call fcn.00405651
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40a2b6
test edi, edi
je 0x40a2b6
call esi
test eax, eax
je 0x40a2ad
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40a2ad
test byte [ebp - 0xc], 1
jne 0x40a2b6
or dword [ebp + 0x10], 0x200000
jmp 0x40a2ef
mov eax, dword [0x45ffac]
cmp eax, ebx
je 0x40a2ef
push eax
call fcn.00405651
pop ecx
test eax, eax
je 0x40a2ef
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40a2ef
mov eax, dword [0x45ffb0]
cmp eax, ebx
je 0x40a2ef
push eax
call fcn.00405651
pop ecx
test eax, eax
je 0x40a2ef
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45ffa8]
call fcn.00405651
pop ecx
test eax, eax
je 0x40a30f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40a311
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x42e072
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x435d4a85
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xfa37c6d
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x5eab61
Capabilities:
Encode data using xor

Disassembly:
sub esp, dword [edi - 0x40ef5d14]
pop ds
push eax
insb byte es:[edi], dx
sub al, 0x3a
cmpsd dword [esi], dword es:[edi]
mov edx, 0xc523332c
cmp byte [edx + 0x68b2797d], ch
imul ecx, dword [ebx + 1], 0x3332fb2e
and edi, dword [esi - 0x43]
mov dl, 0x2f
mov bh, 0xe6
push es
mov byte [0x69c85410], al
insb byte es:[edi], dx
sub al, 0x3a
test al, 7
sub al, 0x33
and ebx, dword [esi - 0x55]
mov byte [0x6e6aac1], al
push esi
sub byte [ebp + 0x4b8bc682], bh
add dword [esi - 5], ebx
insb byte es:[edi], dx
cmp ah, byte [edi + 0x23332c8a]
invalid
Function at 0x41c093
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x44073c], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x41c0de
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x461ce8], ax
xor eax, eax
mov word [0x461cea], ax
mov dword [0x44073c], 0x461ce8
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004117ea
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x44072c
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x41c3ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041ffd0
cmp byte [0x453898], 0
je 0x41c45c
push 0x800
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.0041d834
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c45c
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c453
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41c437
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0041192f
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8

Function at 0x41eb43
Capabilities:
Hide graphical window

Disassembly:
and dword [0x45188c], 0
push 1
push dword [esp + 8]
mov byte [0x44a46d], 1
mov byte [0x44a46e], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.004012b3
cmp dword [0x461cd4], 0
jne 0x41eb83
cmp byte [0x44a47b], 0
je 0x41eb8c
cmp dword [0x44a474], 0
jne 0x41eb9f
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41ec9b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041ffd0
cmp byte [0x453898], 0
je 0x41ed2a
cmp word [0x45389a], 0
je 0x41ed2a
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x45389a
call fcn.0041d834
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ed29
push dword [ebp + 8]
call fcn.00424fa3
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4