joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4010d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x88], eax
mov edx, dword [ebp - 0xc]
cmp dword [edx + 0x88], 0
jne 0x401104
xor al, al
jmp 0x401129
lea eax, [ebp - 4]
push eax
push 0
mov ecx, dword [ebp - 0xc]
push ecx
push 0x40112d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [ebp - 8], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x4011b1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp + 0x10], eax
call fcn.0041fdb8
mov dword [ebp - 4], eax
mov eax, dword [0x447ad8]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [ebp - 0x10]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 0xc], eax
push 0x4231b0
mov edx, dword [ebp + 8]
push edx
push 0x447ae0
mov ecx, 0x447a48
call fcn.00421780
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [0x447acc], eax
mov ax, word [0x44739c]
mov word [ebp - 0x1c], ax
mov cl, byte [0x44739e]
mov byte [ebp - 0x1a], cl
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 1
lea edx, [ebp - 0x1c]
push edx
mov eax, dword [ebp + 0x10]
push eax
call fcn.00401147
add esp, 8
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4012d5
push str.UnregServer
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401280
push 0
push 0
push 0x64
push 0x447a48
call fcn.00421980
push 0
push 1
mov ecx, 0x447a48
call fcn.00421960
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4012d5
push str.RegServer
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x4012bd
push 0
push 1
push 0x64
push 0x447a48
call fcn.00421980
push 0
push 1
mov ecx, 0x447a48
call fcn.00421940
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x4012d5
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00401147
add esp, 8
mov dword [ebp - 0x18], eax
jmp 0x401239
cmp dword [ebp - 0x14], 0
je 0x40132b
mov ecx, 0x447a48
call fcn.004010d4
push 1
push 4
mov ecx, 0x447a48
call fcn.004219b0
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
lea edx, [ebp - 0x38]
push edx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x401316
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x4012f6
mov ecx, 0x447a48
call fcn.004219d0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x447a48
call fcn.004218e0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40137d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0xb0
jae 0x401407
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
call fcn.0040137d
add esp, 8
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 3
div ecx
test edx, edx
jne 0x4013cb
mov byte [ebp - 0x10], 0
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x401405
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 4
div ecx
test edx, edx
jne 0x4013e9
push 0xe
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x401405
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, 7
div ecx
test edx, edx
jne 0x401405
push 0xe
lea edx, [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x401410
mov eax, dword [ebp + 0xc]
mov dword [eax], 1
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret
Function at 0x401872
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0x64
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x98], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x98], 0
je 0x4018b0
mov eax, dword [ebp - 8]
add eax, 0x7c
mov dword [ebp - 8], eax
jmp 0x401959
push 0
push 0
push 4
push 0
push 0
push 2
push 0x447404
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x401923
push 0x80
call fcn.00421c63
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x401923
push 0
lea edx, [ebp - 8]
push edx
push 4
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 8], 4
jne 0x401923
push 0
lea edx, [ebp - 8]
push edx
push 4
mov eax, dword [ebp - 4]
add eax, 0x630
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.wing.txt
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push 0
push 0
push 0x44741c
push 5
push 0
call dword [sym.imp.KERNEL32.dll_UpdateResourceA]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x98]
mov dword [eax + 0x84], edx
mov eax, dword [ebp - 4]
mov ecx, dword [section..data]
mov dword [eax + 0x7c], ecx
mov edx, dword [ebp - 4]
mov eax, dword [0x424004]
mov dword [edx + 0x80], eax
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x188], 0x443c3c
mov edx, dword [ebp - 4]
mov eax, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [edx + 0x17c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x447390]
mov dword [ecx + 0x78], edx
mov eax, dword [ebp - 4]
mov ecx, dword [0x44738c]
mov dword [eax + 0x74], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 0x150], 0x424008
mov eax, dword [ebp - 4]
push eax
call fcn.0041ff7c
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40422b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x18]
xor eax, eax
mov ax, word [edx + 8]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x18]
push edx
call dword [sym.imp.GDI32.dll_GetDIBits]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x2c], eax
mov word [ebp - 0x28], 0x4d42
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
lea edx, [edx + ecx*4 + 0xe]
mov eax, dword [ebp - 0x18]
add edx, dword [eax + 0x14]
mov dword [ebp - 0x26], edx
mov word [ebp - 0x22], 0
mov word [ebp - 0x20], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x20]
lea edx, [edx + ecx*4 + 0xe]
mov dword [ebp - 0x1e], edx
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe
lea ecx, [ebp - 0x28]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x20]
lea eax, [edx*4 + 0x28]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x14]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404349
mov edx, dword [ebp - 0x2c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x404349
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov esp, ebp
pop ebp
ret
Function at 0x41fdb8
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0
push 1
push 0xd
call fcn.00401a50
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 4], 0
jne 0x41fe28
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0x10], eax
push 0xa
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
push 8
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
push eax
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 4], 0
je 0x41fe3b
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 4], 0
je 0x41fe53
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov eax, dword [ebp - 8]
jmp 0x41ff78
mov dword [ebp - 0x470], 0
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push str.o23ne.doc
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x470], eax
cmp dword [ebp - 0x470], 0xffffffff
jne 0x41fe90
xor eax, eax
jmp 0x41ff78
push 0
push 0x80
push 4
push 0
push 1
push 4
push str.two.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xffffffff
jne 0x41feba
xor eax, eax
jmp 0x41ff78
push 0
lea eax, [ebp - 0x478]
push eax
push 0x448
lea ecx, [ebp - 0x468]
push ecx
mov edx, dword [ebp - 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41ff4f
push 2
push 0
push 0
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x474], eax
push 0
mov ecx, dword [ebp - 0x478]
push ecx
push 0
mov edx, dword [ebp - 0x474]
push edx
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_LockFile]
push 0
lea ecx, [ebp - 0x46c]
push ecx
mov edx, dword [ebp - 0x478]
push edx
lea eax, [ebp - 0x468]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
mov edx, dword [ebp - 0x478]
push edx
push 0
mov eax, dword [ebp - 0x474]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_UnlockFile]
cmp dword [ebp - 0x478], 0x448
je 0x41feba
mov edx, dword [ebp - 0x470]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x421780
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x70], 0x447968
mov ecx, dword [ebp - 0x34]
mov dword [0x447b18], ecx
mov edx, dword [ebp - 0x34]
mov dword [edx], 0x84
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x64], 0x300
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x34]
push eax
call dword [sym.imp.ATL.DLL_AtlModuleInit]
cmp dword [ebp + 0x10], 0
je 0x4217da
push 0x10
mov ecx, dword [ebp + 0x10]
push ecx
push 0x447b08
call fcn.00421cf0
add esp, 0xc
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x18], eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [ebp - 0x10], 1
jbe 0x4218bb
mov ecx, dword [ebp - 0x10]
shl ecx, 1
mov dword [ebp - 0x28], ecx
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x74], 0xffffffff
mov dword [ebp - 0x2c], 0
jmp 0x421824
mov eax, dword [ebp - 0x2c]
add eax, 1
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x20
jge 0x421851
mov ecx, dword [ebp - 0x28]
and ecx, 0x80000000
test ecx, ecx
je 0x421839
jmp 0x421851
mov edx, dword [ebp - 0x28]
shl edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x74]
shr ecx, 1
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x74], ecx
jmp 0x42181b
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x74]
shr ecx, 1
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x74], ecx
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x74]
lea edx, [ecx*4 + 4]
push edx
push 0
mov eax, dword [ebp - 0x34]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x78], eax
mov dword [ebp - 0x30], 0
jmp 0x421894
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
cmp edx, dword [ecx + 0x74]
ja 0x4218b9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0x34]
mov edx, dword [ecx + 0x78]
mov ecx, dword [ebp - 0x30]
mov dword [edx + ecx*4], eax
jmp 0x42188b
jmp 0x4218cf
mov edx, dword [ebp - 0x34]
mov dword [edx + 0x78], 0
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x74], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4219f0
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x4c], eax
cmp dword [ebp - 0x4c], 0
jne 0x421a0d
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x421a54
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x22
je 0x421a3a
mov edx, dword [ebp - 0x4c]
movsx eax, byte [edx]
test eax, eax
jne 0x421a18
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x421a52
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x4c], eax
jmp 0x421a6e
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
cmp edx, 0x20
jle 0x421a6e
mov eax, dword [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x4c], eax
jmp 0x421a54
mov ecx, dword [ebp - 0x4c]
movsx edx, byte [ecx]
test edx, edx
je 0x421a92
mov eax, dword [ebp - 0x4c]
movsx ecx, byte [eax]
cmp ecx, 0x20
jg 0x421a92
mov edx, dword [ebp - 0x4c]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 0x4c], eax
jmp 0x421a6e
mov dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 0x18]
and ecx, 1
test ecx, ecx
je 0x421abb
mov edx, dword [ebp - 0x14]
and edx, 0xffff
mov dword [ebp - 0x50], edx
jmp 0x421ac2
mov dword [ebp - 0x50], 0xa
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x4c]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x48], eax
mov edx, dword [ebp - 0x48]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4022b5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x4022d5
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x4022de
cmp byte [ebx], 0
jne 0x4022e5
xor eax, eax
jmp 0x402365
xor esi, esi
jmp 0x402328
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x40230f
cmp dword [ebp - 4], 0
je 0x40230f
test esi, esi
jne 0x40230f
cmp dword [ebp + 8], 0
je 0x40230b
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x402328
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x40231d
cmp ecx, 0xa
jne 0x402325
cmp ecx, 0xd
jne 0x40232d
inc ebx
jmp 0x40232d
mov byte [edx], al
inc edx
cmp byte [ebx], 0
jne 0x4022e9
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x402363
mov eax, dword [ebp - 4]
test esi, esi
mov byte [eax], 0
je 0x402363
push 0x1000
lea edx, [ebp - 0x1004]
push edx
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.00406714
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40236d
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7c0
mov ebx, eax
mov al, byte [0x40c934]
test al, al
mov byte [esp], dl
lea esi, [esp + 4]
je 0x4023a9
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x40239d
mov edx, 0x40b107
mov eax, ebx
call fcn.004067e8
mov edx, 0x40c934
mov eax, ebx
call fcn.004067e8
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.00406638
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x4023d2
lea edx, [ebx + 1]
jmp 0x4023d4
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x402425
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x4023fd
jmp 0x4023f6
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x4023f6
mov byte [ebx + eax], 0x20
jmp 0x4023fd
inc eax
cmp byte [ebx + eax], 0
jne 0x4023e6
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x402412
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x402424
cmp edx, 0x20
jne 0x40241b
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x40242c
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x4023db
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.004056cc
mov edi, eax
test edi, edi
je 0x402458
mov edx, str..inf
mov eax, edi
call fcn.0040679c
test eax, eax
jne 0x402458
mov dword [esi + 0xc], 0x40b1dc
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00405a68
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x402480
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00405afc
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x4024c3
cmp byte [esp + 1], 0
jne 0x4024c3
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.00406714
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.004067e8
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00405a68
test al, al
je 0x402599
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x4024ed
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x402599
cmp byte [0x40b03d], 0
jne 0x402504
cmp byte [esp], 0
je 0x40254a
push dword [0x40bc5c]
call sub.USER32.DLL_IsWindowVisible
mov ebx, eax
test ebx, ebx
je 0x402522
push 0
push dword [0x40bc5c]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
push 0xffffffffffffffff
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
test ebx, ebx
je 0x40254a
push 1
push dword [0x40bc5c]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x402566
mov edx, str..exe
mov eax, edi
call fcn.0040679c
test eax, eax
je 0x402599
cmp byte [0x40b03d], 0
je 0x402581
cmp byte [esp], 0
jne 0x402581
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x402599
cmp byte [esp], 0
je 0x40258e
mov ecx, 0xc8
jmp 0x402593
mov ecx, 0x3e8
push ecx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop edi
pop esi
pop ebx
ret
Function at 0x4025a3
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffff7e0
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.00406694
mov ecx, eax
mov edx, esp
lea eax, [esp + 0x400]
call fcn.00406768
test eax, eax
jne 0x40263a
push 0x40b1e9
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.00406694
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x800]
mov ecx, 0x1e
xor edx, edx
call fcn.00406638
mov dword [esp + 0x804], 3
mov word [esp + 0x810], 0x14
mov eax, esp
mov dword [esp + 0x808], eax
lea edx, [esp + 0x800]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x820
ret

Function at 0x4026f5
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x40b054], 0
je 0x40276c
cmp byte [0x40cd3c], 0
je 0x40276c
lea edx, [esp + 8]
mov eax, 0x40cd3c
call fcn.004026c4
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x40276c
mov eax, ebx
call fcn.00406694
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x402774
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x40b054], 0
je 0x4027ed
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.004026c4
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4027ed
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4027e5
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.00406714
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x402904
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402a6c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x40bbac
push 1
push 0
push 0x40bbbc
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402b6b
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402acf
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x402ae1
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.00406714
lea eax, [ebp - 0x40c]
call fcn.0040576c
cmp byte [ebp - 0x40c], 0
je 0x402b12
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x40bbdc
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402b62
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402b59
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402b7c
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop esi
pop ebx
ret