joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000eae0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, ecx
push ebx
sub esp, 0x20
mov dword [ebp - 0x10], eax
movzx ecx, word [edx]
test esi, esi
je 0x1000ec50
mov eax, dword [ebp + 8]
test eax, eax
je 0x1000ebc0
test cx, cx
je 0x1000ec40
mov ebx, edx
nop
add ebx, 2
cmp word [ebx], 0
jne 0x1000eb10
sub ebx, edx
sar ebx, 1
cmp word [esi], 0
je 0x1000eb37
mov eax, esi
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x1000eb28
sub eax, esi
sar eax, 1
add ebx, eax
mov eax, dword [ebp + 8]
cmp word [eax], 0
je 0x1000eb50
add eax, 2
cmp word [eax], 0
jne 0x1000eb40
sub eax, dword [ebp + 8]
sar eax, 1
add ebx, eax
add ebx, 0x4a
mov dword [ebp - 0x14], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edx, dword [ebp - 0x14]
test eax, eax
mov edi, eax
je 0x1000ecba
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edx
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s_AND_Name_s
mov dword [esp + 4], ebx
mov dword [esp + 0x14], eax
mov dword [esp], edi
call fcn.1000ea90
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.100113c0
mov dword [esp], edi
mov ebx, eax
call dword [sym.imp.ucrtbase.dll_free]
add esp, 0x20
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
test esi, esi
je 0x1000ec50
test cx, cx
je 0x1000eca7
mov eax, edx
lea esi, cs:[esi]
add eax, 2
cmp word [eax], 0
jne 0x1000ebd8
sub eax, edx
sar eax, 1
cmp word [esi], 0
je 0x1000ebff
mov ecx, esi
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x1000ebf0
sub ecx, esi
sar ecx, 1
add eax, ecx
lea ebx, [eax + 0x3c]
mov dword [ebp - 0x14], edx
lea eax, [ebx + ebx]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x1000ecba
mov edx, dword [ebp - 0x14]
mov dword [esp + 0x10], esi
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s_AND_Member_s
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xc], edx
call fcn.1000ea90
jmp 0x1000eb92
xor ebx, ebx
jmp 0x1000eb1d
mov eax, edx
test cx, cx
je 0x1000ecae
lea esi, cs:[esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x1000ec60
sub eax, edx
mov ecx, eax
add eax, 0x58
sar ecx, 1
lea ebx, [ecx + 0x2c]
mov dword [ebp - 0x14], edx
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov edi, eax
test eax, eax
je 0x1000ecba
mov edx, dword [ebp - 0x14]
mov dword [esp + 8], str.SELECT__FROM___QUALIFIERS_WHERE_Class_s
mov dword [esp + 4], ebx
mov dword [esp], eax
mov dword [esp + 0xc], edx
call fcn.1000ea90
jmp 0x1000eb92
xor eax, eax
jmp 0x1000ebe5
mov eax, 0x58
mov ebx, 0x2c
jmp 0x1000ec75
mov ebx, 0x8007000e
jmp 0x1000ebb3
Function at 0x1000fae0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x30]
push ebx
lea esi, [ebp - 0x2c]
sub esp, 0x2c
mov dword [ebp - 0x30], 0x10
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetComputerNameW]
sub esp, 8
test eax, eax
je 0x1000fb50
movzx eax, word [ebp - 0x2c]
test ax, ax
je 0x1000fb34
mov ebx, dword [sym.imp.ucrtbase.dll_towupper]
mov edi, esi
lea esi, cs:[esi]
mov dword [esp], eax
add edi, 2
call ebx
mov word [edi - 2], ax
movzx eax, word [edi]
test ax, ax
jne 0x1000fb20
mov dword [esp], esi
call dword [sym.imp.oleaut32.dll_SysAllocString]
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10017bb0
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp + 0x14]
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], str.SELECT__FROM__s_WHERE__s
mov dword [esp], 4
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
call dword [sym.imp.ucrtbase.dll___stdio_common_vswprintf]
leave
ret
Function at 0x1001a830
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov edi, dword [ebp + 8]
mov edx, dword [edi + 8]
mov esi, dword [edi + 4]
test edx, edx
mov dword [ebp - 0x10], edx
je 0x1001a890
add esi, dword [edi + 0xc]
add esi, 0x1a
lea eax, [esi + esi]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x1001a882
mov edx, dword [ebp - 0x10]
mov dword [esp + 0x10], edx
mov eax, dword [edi]
mov dword [esp + 8], str.SELECT__FROM__s_WHERE__s
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0xc], eax
call fcn.10017bb0
add esp, 0x18
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
lea eax, [esi + esi + 0x1e]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_malloc]
mov ebx, eax
test eax, eax
je 0x1001a882
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + str.SELECT__FROM]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x1001a8a8
cmp word [ebx], 0
mov edx, ebx
mov esi, dword [edi]
je 0x1001a8d1
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x1001a8c8
xor eax, eax
lea esi, cs:[esi]
movzx ecx, word [esi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x1001a8d8
add esp, 0x18
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x10020800
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x100310e0]
test eax, eax
je 0x100208b8
mov dword [esp], ebx
call eax
sub esp, 4
test eax, eax
mov dword [ebx + 8], eax
jns 0x10020840
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x1002082c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x100208ed
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
sub esp, 8
mov dword [0x100310e0], eax
test eax, eax
jne 0x1002081d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x1002082e
Function at 0x40140b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
test esi, esi
jbe 0x401438
test cl, 7
je 0x401438
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x423440]
dec esi
inc ecx
jmp 0x401419
cmp esi, 8
jb 0x4014db
mov edx, esi
shr edx, 3
mov dword [ebp + 8], edx
push ebx
mov edx, dword [ecx + 4]
xor eax, dword [ecx]
mov ebx, edx
shr ebx, 0x10
movzx edi, bl
mov edi, dword [edi*4 + 0x423840]
mov ebx, edx
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x423440]
mov ebx, edx
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x423c40]
mov ebx, eax
shr ebx, 0x18
xor edi, dword [ebx*4 + 0x424440]
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
xor edi, dword [ebx*4 + 0x424840]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edi, dword [ebx*4 + 0x424c40]
movzx edx, dl
xor edi, dword [edx*4 + 0x424040]
movzx eax, al
xor edi, dword [eax*4 + 0x425040]
sub esi, 8
add ecx, 8
dec dword [ebp + 8]
mov eax, edi
jne 0x40144a
pop ebx
jmp 0x4014db
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x423440]
dec esi
inc ecx
test esi, esi
ja 0x4014c7
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x403538
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
cmp dword [esi + 0xc], 1
push edi
mov edi, 0x4e20
jne 0x40355f
cmp dword [ebp + 0xc], edi
jbe 0x403554
mov dword [ebp + 0xc], edi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4035c8
mov ecx, esi
call fcn.004034c6
test al, al
je 0x403595
cmp dword [ebp + 0xc], edi
jbe 0x403595
push edi
push dword [ebp + 8]
mov ecx, esi
call fcn.00403538
jmp 0x4035cb
cmp dword [esi + 0xc], 1
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
jne 0x4035ac
call ebx
cmp eax, 0x6d
jne 0x4035ac
xor eax, eax
jmp 0x4035cb
cmp dword [esi + 0xc], 0
jne 0x4035c3
mov edi, 0x8000
cmp dword [ebp + 0xc], edi
jbe 0x4035c3
call ebx
cmp eax, 0x21
je 0x403588
or eax, 0xffffffff
jmp 0x4035cb
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4038be
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d610
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edi
push dword [ebp + 8]
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x403902
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.004065d3
test al, al
je 0x403902
lea eax, [ebp - 0x1000]
push eax
call esi
mov edi, eax
mov eax, edi
pop edi
pop esi
leave
ret 4

Function at 0x40390a
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d610
push ebx
push esi
push dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp + 8]
call esi
test eax, eax
setne bl
test bl, bl
jne 0x403959
push 0x800
lea eax, [ebp - 0x1000]
push eax
push dword [ebp + 8]
call fcn.004065d3
test al, al
je 0x403959
push dword [ebp + 0xc]
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
setne bl
pop esi
mov al, bl
pop ebx
leave
ret 8

Function at 0x403b46
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d610
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
mov edi, dword [ebp + 8]
push 0
push edi
call esi
test eax, eax
jne 0x403b96
push edi
call fcn.00403b22
test al, al
jne 0x403ba9
push 0x800
lea eax, [ebp - 0x1000]
push eax
push edi
call fcn.004065d3
test al, al
je 0x403ba9
push 0
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x403ba9
cmp byte [ebp + 0xc], 0
je 0x403ba5
push dword [ebp + 0x10]
push edi
call fcn.0040390a
xor eax, eax
jmp 0x403bc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x403bbe
cmp eax, 3
je 0x403bbe
xor eax, eax
inc eax
jmp 0x403bc1
push 2
pop eax
pop edi
pop esi
leave
ret 0xc
Function at 0x403ff7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [0x44e114]
call fcn.0040140b
cmp byte [0x4377b9], 0
mov dword [0x44e114], eax
jne 0x40402b
cmp dword [ebp + 0xc], 0
jbe 0x40402b
mov ecx, dword [0x44e210]
pop ebp
jmp fcn.0040333d
pop ebp
ret 8

Function at 0x404828
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1250
call fcn.0040d610
cmp dword [ebp + 8], 0xffffffff
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
lea eax, [ebp - 0x250]
mov edi, 0x800
push eax
jne 0x4048b7
push dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4048e4
push edi
lea eax, [ebp - 0x1250]
push eax
push dword [ebp + 0xc]
call fcn.004065d3
test al, al
je 0x404890
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x1250]
push eax
call ebx
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4048e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4048aa
cmp eax, 3
je 0x4048aa
cmp eax, 0x12
je 0x4048aa
xor eax, eax
inc eax
jmp 0x4048ac
xor eax, eax
mov byte [esi + 0x1044], al
jmp 0x4049af
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4048da
or dword [ebp + 8], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [esi + 0x1044], al
cmp dword [ebp + 8], 0xffffffff
je 0x4049af
push edi
push dword [ebp + 0xc]
push esi
call fcn.0040b3d6
push edi
lea eax, [ebp - 0x224]
push eax
push esi
call fcn.0040645c
push 1
push 0
push 0
push dword [ebp - 0x234]
call fcn.0040dc90
mov ecx, dword [ebp - 0x230]
xor edi, edi
add eax, ecx
mov dword [esi + 0x1000], eax
mov eax, dword [ebp - 0x250]
mov dword [esi + 0x1008], eax
mov eax, dword [ebp - 0x24c]
mov dword [esi + 0x1028], eax
mov eax, dword [ebp - 0x248]
mov dword [esi + 0x102c], eax
mov eax, dword [ebp - 0x244]
mov dword [esi + 0x1030], eax
mov eax, dword [ebp - 0x240]
mov dword [esi + 0x1034], eax
mov eax, dword [ebp - 0x23c]
mov dword [esi + 0x1038], eax
mov eax, dword [ebp - 0x238]
mov dword [esi + 0x103c], eax
lea eax, [ebp - 0x23c]
adc edx, edi
push eax
lea ecx, [esi + 0x1010]
mov dword [esi + 0x1004], edx
call fcn.0040b708
lea eax, [ebp - 0x24c]
push eax
lea ecx, [esi + 0x1018]
call fcn.0040b708
lea eax, [ebp - 0x244]
push eax
lea ecx, [esi + 0x1020]
call fcn.0040b708
and dword [esi + 0x1040], 0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4065d3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.0040d610
push esi
mov esi, dword [ebp + 8]
cmp word [esi], 0
jne 0x4065f1
xor al, al
jmp 0x40677b
push ebx
push edi
push esi
call fcn.00406270
push esi
call fcn.0040d59a
pop ecx
push esi
mov ebx, eax
call fcn.0040650f
test al, al
je 0x40669b
push esi
call fcn.00406270
test al, al
je 0x406648
add ebx, 4
cmp dword [ebp + 0x10], ebx
jbe 0x406777
mov edi, dword [ebp + 0xc]
push 4
push 0x41d640
push edi
call fcn.0040e524
push esi
add edi, 8
push edi
call fcn.0040d5e2
add esp, 0x14
jmp 0x406773
cmp word [esi], 0x5c
jne 0x406777
add esi, 2
cmp word [esi], 0x5c
jne 0x406777
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x406777
mov edi, dword [ebp + 0xc]
push 4
push 0x41d640
push edi
call fcn.0040e524
lea eax, [edi + 8]
push 0x41d638
push eax
call fcn.0040d5e2
push esi
add edi, 0xe
push edi
call fcn.0040d5e2
add esp, 0x1c
jmp 0x406773
lea eax, [ebp - 0x1000]
push eax
mov edi, 0x7ff
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x406777
cmp eax, edi
ja 0x406777
movzx eax, word [esi]
push eax
call fcn.0040618c
test al, al
je 0x406708
add ebx, 6
cmp dword [ebp + 0x10], ebx
jbe 0x406777
mov edi, dword [ebp + 0xc]
push 4
push 0x41d640
push edi
call fcn.0040e524
push 2
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0040e524
push esi
add edi, 0xc
push edi
call fcn.0040d5e2
add esp, 0x20
jmp 0x406773
push 0x800
lea eax, [ebp - 0x1000]
push eax
call fcn.004061a4
lea eax, [ebp - 0x1000]
push eax
call fcn.0040d59a
lea eax, [eax + ebx + 4]
pop ecx
cmp dword [ebp + 0x10], eax
jbe 0x406777
mov edi, dword [ebp + 0xc]
push 4
push 0x41d640
push edi
call fcn.0040e524
lea eax, [ebp - 0x1000]
push eax
lea eax, [edi + 8]
push eax
call fcn.0040d5e2
add esp, 0x14
cmp word [esi], 0x2e
jne 0x406769
movzx eax, word [esi + 2]
push eax
call fcn.0040618c
test al, al
je 0x406769
add esi, 4
push dword [ebp + 0x10]
push esi
push edi
call fcn.0040b403
mov al, 1
jmp 0x406779
xor al, al
pop edi
pop ebx
pop esi
leave
ret 0xc
Function at 0x4082a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
cmp dword [0x427454], ebx
jne 0x4082ba
mov ecx, 0x42744c
call fcn.00408262
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], bl
je 0x408304
mov ecx, dword [0x427454]
cmp ecx, ebx
je 0x408320
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x408341
push str.CryptProtectMemory_failed
mov esi, 0x4325e4
push esi
call fcn.004016f8
pop ecx
pop ecx
mov ecx, esi
call fcn.00416626
push 2
mov ecx, esi
call fcn.00401646
jmp 0x408341
mov ecx, dword [0x427458]
cmp ecx, ebx
je 0x408320
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x408341
push str.CryptUnprotectMemory_failed
jmp 0x4082e5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
cmp esi, ebx
jbe 0x408341
mov dl, al
add dl, 0x4b
mov eax, dword [ebp + 8]
add eax, ecx
mov bl, dl
add bl, cl
xor byte [eax], bl
inc ecx
cmp ecx, esi
jb 0x408331
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40847e
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x422034], 0
push ebx
push esi
push edi
mov edi, 0x400
jne 0x4084c9
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x43bb9c], ax
xor eax, eax
mov word [0x43bb9e], ax
mov dword [0x422034], 0x43bb9c
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040b432
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push 0x422024
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
pop edi
mov word [esi + ebx*2 - 2], ax
pop esi
pop ebx
leave
ret 0x10
Function at 0x408664
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x68
push dword [0x430498]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x43049c], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x4086c6
mov ecx, dword [0x427464]
call fcn.0040c775
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x41d41c
push 0
push 0xc2
push edi
call esi
mov byte [0x43049c], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x60], 0x5c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x5c], eax
je 0x408716
mov ecx, dword [ebp - 0x58]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], 0xa0
mov dword [ebp - 0x5c], 0x40000001
lea ecx, [ebp - 0x60]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x408760
mov eax, dword [ebp - 0x58]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x41d768
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x408bb5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0040d610
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x408bd0
mov byte [ebx], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x408bda
mov byte [eax], 0
test edi, edi
je 0x408c83
movzx eax, word [edi]
test ax, ax
je 0x408c83
push esi
xor esi, esi
xor ecx, ecx
movzx eax, ax
inc edi
inc edi
cmp ax, 0x3d
jne 0x408c13
cmp dword [ebp + 0xc], 0
je 0x408c1f
test esi, esi
jne 0x408c1f
test ebx, ebx
je 0x408c0f
mov byte [ebx], 1
mov esi, edx
jmp 0x408c2e
cmp ax, 0xd
je 0x408c41
cmp ax, 0xa
je 0x408c43
mov word [edx], ax
mov eax, dword [ebp + 0x14]
inc edx
add eax, 0xfffffffe
inc edx
cmp ecx, eax
jge 0x408c39
movzx eax, word [edi]
inc ecx
test ax, ax
jne 0x408bf3
jmp 0x408c43
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x408c43
inc edi
inc edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [edx], ax
test ebx, ebx
je 0x408c7e
mov word [ebx], ax
test esi, esi
je 0x408c7e
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2000]
push eax
push ebx
call fcn.0040b3d6
xor eax, eax
mov word [esi], ax
mov eax, edi
pop esi
jmp 0x408c85
xor eax, eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x408cca
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0040d610
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.0040d211
cmp byte [0x43049d], 0
jne 0x408d5f
push 6
push dword [0x422020]
lea eax, [ebp - 0x1020]
push eax
call fcn.004062f2
push eax
call fcn.0040c22c
test eax, eax
jne 0x408d5f
push 0x41d460
call fcn.0040d1fe
lea eax, [ebp - 0x1020]
push eax
call fcn.0040d59a
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x101e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.0040d520
add esp, 0x10
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x408ec0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0040d610
push ebx
xor ebx, ebx
cmp byte [0x4304e0], bl
je 0x408f45
cmp word [0x427468], bx
je 0x408f45
push esi
push 0x427468
lea esi, [ebp - 0x1008]
call fcn.00408e83
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x408f45
push dword [ebp + 8]
call fcn.0040d59a
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x408f4a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0040d610
cmp byte [0x4304e0], 0
je 0x408ff1
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x200c]
call fcn.00408e83
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x408ff1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408fe8
shr dword [ebp - 4], 1
mov eax, 0x7ff
cmp dword [ebp - 4], eax
jae 0x408fcc
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040b3d6
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x40b8a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x44f244]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x43dbb8]
mov ecx, dword [0x44f24c]
mov dword [0x44f244], eax
movzx eax, al
add eax, dword [0x44f248]
imul eax, eax, 0x8088405
inc eax
mov dword [0x44f248], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x43dbb8]
mov eax, dword [esp + 4]
mov dword [0x44f24c], ecx
ret 4

Function at 0x40b941
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push dword [ebp + 0xc]
call fcn.0040b8fe
push 0xc
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.0040de00
add esp, 0xc
xor esi, esi
lea edx, [ebp + esi - 0xc]
call fcn.0040b884
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.0040b8a4
inc esi
cmp esi, 0xc
jl 0x40b963
movzx ax, byte [ebp - 1]
movzx ecx, ax
mov eax, dword [0x43e10c]
test byte [eax + 0x40], 2
movzx eax, byte [0x44e177]
jne 0x40b99e
movzx eax, byte [0x44e17f]
movzx ecx, cx
cmp ecx, eax
je 0x40b9aa
or eax, 0xffffffff
jmp 0x40b9ef
mov ecx, dword [0x44e120]
mov eax, ecx
cdq
cmp edx, dword [0x43e0ec]
push edi
jl 0x40b9cc
mov edx, dword [0x43e0e8]
jg 0x40b9c8
cmp eax, edx
jbe 0x40b9cc
mov edi, edx
jmp 0x40b9ce
mov edi, ecx
mov esi, dword [0x44e11c]
jmp 0x40b9e8
dec edi
call fcn.0040b884
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.0040b8a4
inc esi
test edi, edi
jne 0x40b9d6
xor eax, eax
pop edi
pop esi
leave
ret 8