joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebx
pcmpeqw mm7, mm7
push ecx
pxor mm6, mm6
push esi
psllw mm7, 0xf
push edi
mov esi, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
sub eax, 4
jl 0x401083
jmp 0x401030
movq mm0, qword [esi]
pxor mm0, mm7
movq mm3, mm0
movq mm1, qword [ebx + esi]
punpcklwd mm0, mm6
pxor mm1, mm7
movq mm2, qword [esi + ebx*2]
movq mm4, mm1
pxor mm2, mm7
add edi, 0x10
prefetcht0 byte [esi + ebx*2 + 0x40]
punpcklwd mm1, mm6
movq mm5, mm2
punpcklwd mm2, mm6
paddd mm0, mm1
punpckhwd mm3, mm6
paddd mm0, mm2
punpckhwd mm4, mm6
paddd mm3, mm4
punpckhwd mm5, mm6
movq qword [edi - 0x10], mm0
paddd mm3, mm5
add esi, 8
movq qword [edi - 8], mm3
sub eax, 4
jge 0x401030
add eax, 4
jle 0x4010b6
push edx
movzx ecx, word [esi]
xor ecx, 0x8000
movzx edx, word [ebx + esi]
xor edx, 0x8000
add ecx, edx
movzx edx, word [esi + ebx*2]
xor edx, 0x8000
add ecx, edx
add esi, 2
mov dword [edi], ecx
add edi, 4
dec eax
jg 0x401089
pop edx
pop edi
pop esi
pop ecx
pop ebx
ret

Function at 0x424062
Capabilities:
Encode data using xor

Disassembly:
lodsb al, byte [esi]
stosd dword es:[edi], eax
mov ebp, 0x9d1104a7
mov ah, byte [eax + edi*8 + 0x34a439a4]
mov ah, 0x57
fdiv dword [esi - 0x65]
movsb byte es:[edi], byte [esi]
cmp dword [esp + esi + 0x76d857b4], esp
wait
xor esi, eax
push ebx
daa
or edx, dword [esi + 0x6d67806]
cmp dword [edi + 0x79], eax
in eax, 0xd9
add eax, 0x44c4c6d9
test byte [esi + eax + 0x59], 0xd3
movsb byte es:[edi], byte [esi]
cld
push edx
jns 0x423fed
push es
pop ecx
shl dword [esp + edi*8 - 0x142686ae], cl
push esp
cwde
movsb byte es:[edi], byte [esi]
aam 0x16
retf
jmp 0x42406a
cmp byte [esp + eax + 0x7a036c53], 0xbd
inc ebx
mov eax, 0xd3862cab
add al, 0xfb
test byte [ebp - 0x56], cl
fsubrp st(4)
popfd
jp 0x42400c
out dx, eax
jl 0x423fe3
invalid
add ah, 0xc
dec eax
les ecx, [eax + ecx*2]
sbb esp, dword [eax]
fdivr qword [esi]
fmulp st(7)
xchg ebp, eax
popfd
jge 0x424048
aam 0x80
invalid
Function at 0x453e09
Capabilities:
Encode data using xor

Disassembly:
test eax, 0x6895a7f9
cmp al, 0xf4
inc ebx
pop ebp
sti
ret 0x7823
mov dword [0x3c712adb], ebp
inc ebx
sub byte [edi + ebx*4], 0x20
std
pop ds
std
mov bl, 0x64
add dl, byte [ecx + 0xd]
jl 0x453d99
inc esp
shl byte [esi + 0xd], 0xda
insb byte es:[edi], dx
push eax
dec ebx
int3
cdq
push ds
mov ah, 0x1e
inc edi
sub dword [eax*2 - 0x4c4c3f28], esp
and bh, cl
jmp 0x453e78
sbb eax, 0xd4efbd97
adc ah, ch
xchg ebx, eax
inc edx
in al, dx
mov bl, 0x84
lds ecx, [esi]
sub dword [ecx + ecx - 0x3c9efdc4], ebx
jae 0x453dad
sub eax, 0x70dd3eb
pop ecx
out 0x61, al
xchg ecx, eax
or dword [eax + 0x210ef430], edi
xchg ecx, eax
xor ebx, dword [edi + edi*8 + 0x1e]
adc byte [edx - 0x1c], 0xb6
arpl word [ebx + 0x3c6cafbb], cx
cmp eax, 0x3a5d7cf7
jne 0x453e21
jmp 0x453df6
adc byte [edx + eax*4 + 0x7481ce5], ah
mov dword [ecx], ebx
pop esp
insb byte es:[edi], dx
popal
test ebx, ecx
xor eax, 0x1a439d21
xchg ebp, eax
mov al, 0x33
mov dl, 0x3a
mov ah, 0x81
std
mov byte [0xd987e504], al
fstp dword [ebp + 0x39]
mov ah, 0xb3
fistp dword [edx + 4]
lea esp, [ebx]
mov dh, 0xff
call dword [ecx - 0x7e]
stc
dec edx
inc esi
sub eax, 0x930eb1a2
mov ebx, edi
dec edi
dec edi
add ah, byte [ebx]
rcr dword [ecx + 0x13e8d9f3], cl
pop esp
movups xmm2, xmmword [ebx]
invalid

Function at 0x4a11ea
Capabilities:
Encode data using xor

Disassembly:
test eax, 0xbbc4a38e
sbb eax, 0x19875443
invalid
jle 0x4a11e4
aas
push ss
xor dl, ch
bnd jl 0x4a11a4
je 0x4a11da
arpl word [eax + edx*2 + 0x66f7da37], si
call 0xbcc24afc
imul edx, dword [edi + 0x7d889103], 0x57
xchg ecx, eax
mov byte [ebp + 0x57], bh
test eax, 0xd9c0a27e
imul eax, dword [ebx - 0x19d14653], 0xf943c5a4
jne 0x4a1244
nop
or edi, dword [0x856ee98d]
aaa
out dx, eax
out dx, eax
mov edx, 0x73479573
dec eax
jae 0x4a1173
inc edi
jae 0x4a1229
outsd dx, dword [esi]
jne 0x4a11bc
ja 0x4a11dc
sub dword [ebx - 0x4883cdfa], edx
jl 0x4a11a3
mov bh, 0x43
inc ebx
pop edi
stosd dword es:[edi], eax
push edi
mov esi, 0xfa90312a
inc ebp
mov ah, 0xc1
cmpsd dword [esi], dword es:[edi]
scasd eax, dword es:[edi]
scasd eax, dword es:[edi]
push es
jp 0x4a11cf
lodsb al, byte [esi]
inc eax
jae 0x4a11eb
push ecx
retf
aaa
xlatb
into
ljmp 0xb1c8
cli
push ebp
or eax, 0xebb1c88c
cdq
add cl, dl
dec ebp
xchg esi, eax
inc edi
jo 0x4a1294
aas
mov cl, byte [edx - 0x2d43d54]
sal bh, 0x58
mov bl, 0x4f
inc esp
sal esp, cl
scasd eax, dword es:[edi]
xor al, 0x96
add al, 0x42
sub byte [edi], bl
int 0x8a
mov esp, dword [ecx - 0x65]
xchg esp, eax
loope 0x4a1270
jbe 0x4a11df
or byte [edi + edx*4], 0xc7
adc byte [esi - 0x61], bh
into
invalid
sti
jbe 0x4a1225
mov ah, 0xa9
mov al, byte [0x1ceb3c2a]
dec edx
test eax, 0xeb3c2aa0
sbb al, 0x4a
push es
xchg esi, eax
cli
sbb ebp, edx
pop eax
loopne 0x4a126e
jno 0x4a12b5
les esp, [ecx - 0xe]
bound eax, qword [edi + 0x78]
xor al, 0xe8
adc bh, byte [eax + 0x1259e839]
pop esp
mov ch, 0x31
adc byte [edx + 0x5489eb63], bl
fisubr dword [ecx + 0x6e]
lcall 0x69da, 0x5489eb63
outsb dx, byte [esi]
ljmp 0x92f4:0xc0d9266
retf
Function at 0x56703d
Capabilities:
Encode data using xor

Disassembly:
hlt
sub ah, al
cmp dword [eax - 0x5b], ebp
mov esp, es
dec ebx
mov eax, dword [0xc8320e4c]
mov word [ebx], cs
pop ds
sub dword [edx + 0x1d], esp
sal byte [eax + 0x53116ef4], 1
mov word [edx + esi], es
sub edx, edi
xchg ebp, eax
mov dl, 0xa0
push ebx
and al, 0x8b
xor byte [edx + 0x7f18663a], al
pop ebp
cmpsd dword [esi], dword es:[edi]
in eax, dx
mov al, byte [0x3f507ea1]
lcall 0x9aae, 0x27cdbb43
scasb al, byte es:[edi]
lcall 0x9226, 0x5154035c
scasb al, byte es:[edi]
lcall 0x9226, 0x5154035c
xchg dword [ebp - 0x54], edi
in al, dx
imul byte [ebx - 0x52e6aaca]
or eax, 0x8602715d
sub eax, edx
xor al, 0x4a
ja 0x567006
sbb al, 0xf4
jno 0x56709f
call 0x3a64c0f1
fsubr qword [eax]
jmp 0x567001
add edx, dword [esi + 0x7a]
ret 0x7076

Function at 0x606349
Capabilities:
Encode data using xor

Disassembly:
hlt
jo 0x606381
aam 0x2a
sbb bh, byte [ecx]
adc byte [edx], bl
aaa
in eax, dx
inc esp
in eax, dx
inc ecx
cmp ebx, ecx
sub bl, byte [esi + eax + 7]
adc bh, byte [edx + ebp*4]
pushal
daa
inc ebp
inc edi
wait
jp 0x6062ea
out dx, eax
adc bh, ch
sub edi, dword [ecx]
lahf
jg 0x6063cb
lea ebx, [eax + ebp*8 + 0x60fe9112]
mov ch, 6
imul byte [esi - 0x5a]
cli
xchg edi, eax
mov ebp, 0xcfa2d65c
bnd jno 0x6063b6
not ah
cmp eax, 0x30731acd
hlt
mov ch, 0xc4
cmpsb byte [esi], byte es:[edi]
mov eax, dword [0x47924bf7]
div dword [eax + 0x614d164]
sbb byte [eax - 0x2f1cd3f5], cl
inc ebp
and ah, byte [edx + eax*4 - 0x5c]
xor ch, al
sar dword [edx - 8], cl
inc edx
mov dword [edx], eax
dec esp
and dh, byte [ecx - 0x71]
sub eax, 0x37ed8f46
inc eax
enter 0x6059, 0x33
cmpsb byte [esi], byte es:[edi]
add cl, ch
sbb ah, byte [edi]
and eax, 0xc223ffd7
adc al, 0x4e
pop ebp
xchg edi, ebx
and ah, byte [ebx + eax*4 + 0x3e]
sub eax, 0x6fa3ec2f
add dl, ch
push edi
mov dword [0x57ea006f], eax
loop 0x6063cf
dec esi
push ebx
arpl word [0xee1bf79a], bp
js 0x6063fc
fsubr qword [edi + ebx - 0x12bd1605]
wait
fist dword [edx]
fcomp qword [ebx]
les ebx, [edi + 0x61]
adc esp, dword [edi + 0x6b]
pop esi
xchg esp, eax
add dword [0xbc856ac6], eax
rcr dword [0xac91beeb], cl
and dword [ebp - 8], ebx
mov esi, 0x23a32ff8
cmp byte [edi], al
cmp eax, 0x217adcdb
invalid
Function at 0x119d1e0
Capabilities:
Encode data using xor

Disassembly:
fsub qword [ecx]
fcomp dword [esi - 0x47]
jbe 0x119d232
add eax, 0x56f80b9f
mov eax, 0x86aa27a9
enter 0x5653, 0x77
and dword [eax + 0x54f97956], eax
into
lock and dword [edx + 0x532177d0], edi
push esi
shl dh, 0x2e
push ecx
mov al, ah
sar dword [ecx + 0x7b52ebd2], 0xcf
jnp 0x119d1b1
jnp 0x119d1b1
and eax, eax
sub dl, ah
and dword [ebx + 0x56], edx
in eax, 0xdd
adc byte [esi + 0x3f], 0x96
insd dword es:[edi], dx
rcr byte [edi], 0x36
call [esp + edi*4 + 0x3d]
arpl word [esi + 0x17], dx
inc edi
sub dword [ebx + 0x73369c68], ecx
invalid
jnp 0x119d23a
fldenv [ecx + 0x363ad39f]
das
xchg ebp, eax
pop es
les edi, [esi - 0x5a]
mov dword [0xb61613ad], eax
clc
das
xchg ecx, eax
cli
jo 0x119d2af
pop ebx
aas
or ebp, edi
fdivr st(7), st(0)
pop ebx
pushfd
inc ecx
invalid
add esp, ecx
movsb byte es:[edi], byte [esi]
mov byte [edi + eax], ch
enter 0x5fb7, 6
push edi
pop edx
inc edi
push 0xffffffffffffffc7
sub dword [edi + 6], eax
enter 0x474a, 6
enter 0x475a, 0x62
invalid
Function at 0x11a1530
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push eax
push 0x40
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x11a1553
mov eax, 1
jmp 0x11a165e
mov edx, dword [ebp + 8]
movzx eax, word [edx]
cmp eax, 0x5a4d
jne 0x11a1569
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x3c], 0
jne 0x11a1573
mov eax, 2
jmp 0x11a165e
mov edx, dword [ebp + 0x10]
push edx
push 0xf8
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
push ecx
mov edx, dword [ebp + 8]
add edx, 0x40
push edx
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x11a159e
mov eax, 1
jmp 0x11a165e
mov eax, dword [ebp + 8]
cmp dword [eax + 0x40], 0x4550
jne 0x11a15c4
mov ecx, dword [ebp + 8]
movzx edx, word [ecx + 0x58]
cmp edx, 0x10b
jne 0x11a15c4
mov eax, dword [ebp + 8]
movzx ecx, word [eax + 0x46]
test ecx, ecx
jne 0x11a15ce
mov eax, 2
jmp 0x11a165e
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x46]
imul eax, eax, 0x28
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x140], eax
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x140]
push eax
call fcn.011b3a10
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x138], eax
mov edx, dword [ebp + 8]
cmp dword [edx + 0x138], 0
jne 0x11a160f
mov eax, 3
jmp 0x11a165e
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
movzx eax, word [edx + 0x54]
lea ecx, [ecx + eax + 0x18]
mov edx, dword [ebp + 8]
mov dword [edx + 0x13c], ecx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x140]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x13c]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x138]
push eax
call dword [ebp + 0xc]
add esp, 0x10
test eax, eax
jne 0x11a165c
mov eax, 1
jmp 0x11a165e
xor eax, eax
pop ebp
ret

Function at 0x11a2000
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x11a2016
xor eax, eax
jmp 0x11a2056
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x3c]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp dword [ecx], 0x4550
jne 0x11a203b
mov edx, dword [ebp - 4]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x11a203f
xor eax, eax
jmp 0x11a2056
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x78]
push ecx
call fcn.011a2060
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x11b4750
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
mov eax, dword [eax + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x11b4780
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp dword [ebp + 8], 0
jne 0x11b4793
xor eax, eax
jmp 0x11b4851
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x11b47ae
xor eax, eax
jmp 0x11b4851
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0x4550
je 0x11b47cc
xor eax, eax
jmp 0x11b4851
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x78]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x1c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x24]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x20]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1c], 0
jmp 0x11b480e
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x11b484f
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
push edx
call fcn.011b3a30
add esp, 8
test eax, eax
jne 0x11b484d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x14]
movzx edx, word [ecx + eax*2]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + edx*4]
mov eax, ecx
jmp 0x11b4851
jmp 0x11b4805
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x406128
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call sub.KERNEL32.dll_TlsAlloc
cmp eax, 0xffffffff
je 0x40614d
mov dword [0x40a0f4], eax
add esp, 0xfffffff8
push 0x4060ec
push eax
call fcn.00407c20
jmp 0x406152
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x406168
mov dword [0x409054], 0x40624c
jmp 0x406172
mov dword [0x409054], 0x406200
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6bdc43dc
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e3d0
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x3ad24b02
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4022f8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x402318
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x402321
cmp byte [ebx], 0
jne 0x402328
xor eax, eax
jmp 0x4023a8
xor esi, esi
jmp 0x40236b
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x402352
cmp dword [ebp - 4], 0
je 0x402352
test esi, esi
jne 0x402352
cmp dword [ebp + 8], 0
je 0x40234e
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x40236b
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x402360
cmp ecx, 0xa
jne 0x402368
cmp ecx, 0xd
jne 0x402370
inc ebx
jmp 0x402370
mov byte [edx], al
inc edx
cmp byte [ebx], 0
jne 0x40232c
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x4023a6
mov eax, dword [ebp - 4]
test esi, esi
mov byte [eax], 0
je 0x4023a6
push 0x1000
lea edx, [ebp - 0x1004]
push edx
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.00406bc0
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x402616
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffffbe0
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [0x40c045], 0
jne 0x40269f
mov eax, esp
call fcn.00405718
mov ecx, 6
mov edx, dword [str.RarSFX]
call fcn.00406c6c
test eax, eax
jne 0x40269f
push 0x40c1f4
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.00406b40
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x400]
mov ecx, 0x1e
xor edx, edx
call fcn.00406ae4
mov dword [esp + 0x404], 3
mov word [esp + 0x410], 0x14
mov eax, esp
mov dword [esp + 0x408], eax
lea edx, [esp + 0x400]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x420
ret

Function at 0x40275a
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x40c05d], 0
je 0x4027d1
cmp byte [0x40dd74], 0
je 0x4027d1
lea edx, [esp + 8]
mov eax, 0x40dd74
call fcn.00402729
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x4027d1
mov eax, ebx
call fcn.00406b40
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x4027d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x40c05d], 0
je 0x402852
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.00402729
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402852
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x40284a
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.00406bc0
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x40293c
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402aa4
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x40cbe4
push 1
push 0
push 0x40cbf4
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402ba3
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402b07
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x402b19
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.00406bc0
lea eax, [ebp - 0x40c]
call fcn.004058c8
cmp byte [ebp - 0x40c], 0
je 0x402b4a
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x40cc14
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402b9a
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402b91
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402bb4
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x402d18
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x40cc94]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x40c019], 0
jne 0x402d74
mov eax, dword [0x40e174]
call fcn.00403fb4
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c099
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x40c019], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [esp], 0x3c
mov edx, esp
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
mov byte [esp + 0x19], 0
mov dword [esp + 4], 1
test bl, bl
je 0x402dce
and dword [esp + 8], 0xbfffffff
or dword [esp + 8], 1
mov dword [esp + 0x14], 0xa0
or dword [esp + 4], 0x40000000
mov ecx, esp
push ecx
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
test bl, bl
je 0x402e22
or dword [esp + 8], 0x40000000
and dword [esp + 8], 0xfffffffe
mov eax, esp
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c0c0
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
add esp, 0x3c
pop edi
pop esi
pop ebx
ret