joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b370
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x108
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x120]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x120]
push edx
push ebx
push eax
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x48b3e1
jl 0x48b450
and eax, 0xffff
pop edi
pop esi
or eax, 0x80070000
pop ebx
add esp, 0x108
ret 0x14
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x120]
cmp eax, ecx
jne 0x48b44b
cmp eax, 1
je 0x48b3ff
cmp eax, 2
jbe 0x48b44b
cmp eax, 4
ja 0x48b44b
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x124]
mov ecx, eax
lea esi, [esp + 0x14]
mov ebx, ecx
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
cmp dword [esp + 0x128], eax
jb 0x48b44b
mov ecx, eax
mov edi, edx
mov edx, ecx
lea esi, [esp + 0x14]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0x14
mov eax, 0x8007000d
pop edi
pop esi
pop ebx
add esp, 0x108
ret 0x14

Function at 0x48bd70
Capabilities:
Check os version

Disassembly:
sub esp, 0x9c
xor eax, eax
push edi
mov word [esp + 5], ax
mov ecx, 0x24
lea edi, [esp + 0x10]
mov dword [esp + 8], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
mov byte [esp + 4], 0
push ecx
mov byte [esp + 0xb], al
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
jne 0x48bdc0
mov eax, 0x80900006
add esp, 0x9c
ret 8
cmp dword [esp + 0x18], 2
jne 0x48bdd5
cmp dword [esp + 0xc], 5
ja 0x48bdd5
cmp dword [esp + 0x10], 1
jb 0x48be3f
mov eax, dword [esp + 0xa4]
mov dword [esp], 0
mov cl, byte [esp]
push 0
mov dl, byte [eax + 0x32]
xor dl, cl
and dl, 0xf
xor dl, cl
mov cl, byte [eax + 0x36]
and dl, 0x7f
mov byte [esp + 5], cl
mov ecx, dword [eax + 0xc]
mov byte [esp + 4], dl
lea edx, [esp + 8]
push edx
mov edx, dword [eax + 0x10]
push ecx
mov ecx, dword [esp + 0xac]
push edx
lea eax, [esp + 0x10]
push 4
push eax
push 0x24054
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp eax, 1
jne 0x48be39
xor eax, eax
add esp, 0x9c
ret 8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, 0x80900018
add esp, 0x9c
ret 8
Function at 0x48c820
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor ebp, ebp
mov al, byte [edi]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
and eax, 0xff
mov ecx, eax
shr eax, 4
and ecx, 0xf
mov bl, byte [eax*4 + 0x4a0f48]
mov al, byte [edi + 1]
mov dl, byte [ecx*4 + 0x4a0f48]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
and eax, 0xff
shl dl, 4
mov ecx, eax
or dl, bl
shr eax, 4
mov byte [edi], dl
and ecx, 0xf
mov bl, byte [eax*4 + 0x4a0f48]
mov al, byte [edi + 2]
mov dl, byte [ecx*4 + 0x4a0f48]
mov byte [esp + 0x14], al
mov eax, dword [esp + 0x14]
and eax, 0xff
shl dl, 4
mov ecx, eax
or dl, bl
and ecx, 0xf
mov byte [edi + 1], dl
shr eax, 4
mov dl, byte [ecx*4 + 0x4a0f48]
mov cl, byte [eax*4 + 0x4a0f48]
mov al, byte [edi + 3]
shl dl, 4
mov byte [esp + 0x14], al
or dl, cl
mov ecx, dword [esp + 0x14]
mov byte [edi + 2], dl
and ecx, 0xff
mov edx, ecx
shr ecx, 4
and edx, 0xf
mov bl, byte [ecx*4 + 0x4a0f48]
xor ecx, ecx
mov cl, byte [edi]
mov al, byte [edx*4 + 0x4a0f48]
mov edx, ecx
and ecx, 3
and edx, 0xfffffffc
shl edx, 3
shl al, 4
or edx, ecx
mov ecx, 4
or al, bl
or edx, ecx
xor ebx, ebx
mov byte [edi + 3], al
mov bl, byte [edi + 2]
and eax, 0xff
shl edx, 8
or edx, ebx
xor ebx, ebx
mov bl, byte [edi + 1]
mov dword [esp + 0x14], ecx
shl eax, 9
or eax, ebx
or ah, 1
shl eax, 0xf
mov esi, eax
mov eax, dword [esp + 0x18]
shl edx, 0xf
cmp eax, ecx
jbe 0x48c9da
mov ecx, edx
mov eax, edx
and ecx, 0x3fc0000
mov ebx, esi
shr eax, 6
xor ecx, eax
mov eax, edx
shr ecx, 3
and eax, 0x7f8000
and ebx, 0xf00000
xor ecx, eax
shr ecx, 0xf
mov eax, ecx
xor ecx, 0xff
shl eax, 0x18
shr edx, 8
or edx, eax
mov eax, esi
shr eax, 4
and eax, 0xff0000
add ecx, ebp
xor eax, ebx
mov ebx, esi
shr eax, 1
and ebx, 0x7f8000
xor eax, ebx
mov ebx, esi
shr eax, 4
and ebx, 0x78000
xor eax, ebx
mov ebx, esi
shr ebx, 0x1c
shr eax, 0xb
xor eax, dword [ebx*4 + 0x4a0f88]
shr esi, 8
mov ebx, eax
xor eax, 0xff
shl ebx, 0x18
lea ebp, [ecx + eax]
mov ecx, dword [esp + 0x14]
or esi, ebx
xor ebx, ebx
mov bl, byte [ecx + edi]
mov eax, ebp
and eax, 0xff
mov bl, byte [ebx + 0x4a0e48]
xor bl, al
mov eax, dword [esp + 0x18]
sar ebp, 8
mov byte [ecx + edi], bl
inc ecx
cmp ecx, eax
mov dword [esp + 0x14], ecx
jb 0x48c92d
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x4061c6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00405ec4
pop ebp
int3

Function at 0x406ac0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sbb bh, bh
jne 0x406ad8
call fcn.00405e89
add esp, 0xc
mov dword [ebp - 0x39c], eax
call fcn.00405ec4
sub al, 0xc6
movsd dword es:[edi], dword [esi]
inc ebp
and byte [ebp - 0x514], 0
and byte [ebp - 0x513], 0
mov byte [ebp - 0x512], 0xe3
and byte [ebp - 0x511], 0
mov byte [ebp - 0x510], 0x5b
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
mov byte [ebp - 0x507], 0x66
mov byte [ebp - 0x506], 0x79
invalid
test ebx, edi
cli
invalid

Function at 0x409470
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00409424
test al, al
jne 0x409491
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4094dd
xor eax, eax
push ebp
push 0x4094cd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403414
push eax
call sub.kernel32.dll_DeleteFileA
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError_1
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4094d4
lea eax, [ebp - 0xc]
call fcn.00409460
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4099b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x409a0a
inc esi
xor edi, edi
cmp edi, 1
jne 0x4099d6
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep
jmp 0x4099e4
cmp edi, 1
jle 0x4099e4
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00409470
test eax, eax
jne 0x409a0a
call sub.kernel32.dll_GetLastError_1
cmp eax, 2
je 0x409a0a
call sub.kernel32.dll_GetLastError_1
cmp eax, 3
je 0x409a0a
inc edi
dec esi
jne 0x4099c6
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8
Function at 0x1822b38
Capabilities:
Encode data using xor

Disassembly:
not al
push 0xeb14b503
stc
bt dx, 9
stc
ror al, 2
pushfd
bt ecx, ebp
cmp al, 0xb9
mov byte [ecx], al
cmp cx, 0x2f1f
push 0xc69e7897
test ecx, 0xc33c3095
cmp al, 0xc3
add ecx, 1
mov byte [esp + 4], dl
test ah, ah
call fcn.01825299
inc edi
sal dword [edx + 0x33], 1
div byte ss:[ecx + 0x6ce78b03]
sbb ch, byte [esp + ebx*2]
arpl word gs:[edx + 0x2c], sp
pushfd
in eax, dx
pop ebx
mov ebp, 0x2448eeed
test eax, 0xaf9bc109
sbb al, 0xb8
mov byte [ebp + 0x2dfcb66b], ch
add dword [edx], 4
xor al, byte [esi - 0xc]
push 0x7b
mov al, 0xda
fstp xword [edi - 0x32048345]
inc edi
sbb ecx, dword [ecx + 0x69]
add ah, byte [ecx + edi*8 + 0x1d1d6fff]
mov al, 0x6a
inc dword [ebx]
push ss
shr dl, 1
jl 0x1822b5f
cdq
pop ebx
mov bl, byte [ebp - 0x313365a5]
retf 0xc4c4

Function at 0x1828844
Capabilities:
Resolve function by parsing pe exports

Disassembly:
pushfd
xchg dword [esp], ebp
bsf bp, di
xadd ax, bp
sar ax, 0xf
and ax, 0x8eea
mov ebp, esp
pushfd
bswap ax
sub esp, 0x14
jmp 0x285b406
jmp 0x18289c3
jmp 0x182644a
movsx di, al
mov edi, dword [ebp + 8]
pushfd
lea esp, [esp + 0xc]
call fcn.01820310
pushfd
lea esp, [esp + 4]
jne 0x1588698
push 0xcf7ed737
mov eax, dword [edx + 8]
mov byte [esp], 0x22
pushal
pushfd
pushfd
lea esp, [esp + 0x2c]
jmp fcn.0156e7bf
jmp 0x285be16
jo 0x156d5b5
push ebp
pushfd
mov bp, word [esp]
aam 0x38
lea ebp, [esp + 4]
bts eax, 0x1f
or al, ch
pushfd
clc
sub esp, 0x10
ror al, cl
aam 0xbc
shr ax, 8
push esi
lea eax, [edi + 0x3bcde2cf]
shrd eax, ecx, cl
cwde
aas
push edi
btr ax, di
shl ah, 2
das
aaa
push ebx
test cx, sp
bswap ax
push edx
cmp ecx, 0x88ab1a8f
mov eax, dword [ebp + 8]
pushfd
test eax, eax
call fcn.01587ffa
push eax
invalid
push 0x715a05a7
push dword [esp]
lea esp, [esp + 0x48]
jne 0x156e7b6
bts cx, cx
mov ecx, dword [ebx]
pushfd
or ecx, ecx
jmp 0x285a451
pushal
bt bx, dx
call fcn.018252c2
bt sp, cx
pushal
pushal
cmp bh, cl
or eax, eax
jmp 0x181f76d
lea esp, [esp + 4]
je 0x156e7b6
movsx dx, dl
lea edx, [ebx + 4]
movzx si, cl
movzx esi, word [edx + 0x1a]
movzx di, dl
push 0xf9d76567
pushfd
lea edi, [0x1000c07b]
lea esi, [esi + edx + 0x1c]
jmp 0x1822505
push esi
movsx eax, cl
push edi
neg al
push 0xe85628b0
mov dword [esp], ebx
push edi
neg ax
pushal
shl al, 1
mov dword [esp + 0x20], edx
movsx ax, bl
and al, bl
lahf
mov eax, dword [ebp + 8]
cmc
test eax, eax
jmp 0x1828593
push edi
lea esp, [esp + 0x24]
je 0x156f76f
movzx dx, al
bts si, 0xe
bsr dx, cx
stc
mov esi, dword [eax + 0x3c]
rcl dl, cl
neg dx
setge dl
sbb dx, cx
add esi, eax
sal dh, 4
xor dx, 0xd61d
bsr dx, bx
mov edx, dword [esi + 0x78]
stc
cmc
test edx, edx
push 0xa1e32a24
lea esp, [esp + 4]
je 0x156f76f
sub cl, 0x48
cmc
rcl cx, 1
add edx, eax
movsx cx, al
clc
mov ecx, dword [esi + 0x7c]
jmp 0x285804e
Function at 0x401225
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40a01c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [0x40a020], 0x401219
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
mov dword [0x40a038], eax
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
lea eax, [0x40803c]
fnstenv [eax]
push 0
push 0x40a030
push 0x40a02c
push 0x40a028
call sub.CRTDLL.DLL___GetMainArgs
mov ecx, 0x408058
mov edx, dword [ecx]
or edx, edx
je 0x40129f
call ecx
push dword [0x40a030]
push dword [0x40a02c]
push dword [0x40a028]
mov dword [0x40a014], esp
call fcn.004012d4
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401a44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp edi, 1
je 0x401ad2
cmp edi, 4
jne 0x401ac7
mov eax, dword [sym.imp.CRTDLL.DLL__iob]
add eax, 0x40
push eax
push 1
push 7
push str.signal
call sub.CRTDLL.DLL_fwrite
push 0xa
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0xc]
call sub.CRTDLL.DLL__itoa
add esp, 0x1c
lea ecx, [ebp - 0x80]
or eax, 0xffffffff
inc eax
cmp byte [ecx + eax], 0
jne 0x401a8b
mov ebx, dword [sym.imp.CRTDLL.DLL__iob]
add ebx, 0x40
push ebx
push 1
push eax
lea esi, [ebp - 0x80]
push esi
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
mov eax, dword [sym.imp.CRTDLL.DLL__iob]
add eax, 0x40
push eax
push 1
push 1
push 0x40a210
call sub.CRTDLL.DLL_fwrite
add esp, 0x10
jmp 0x401ad2
cmp edi, 3
je 0x401ad2
push dword [ebp + 0xc]
call edi
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x434004]
jne 0x40100a
repz ret
jmp fcn.00401a32

Function at 0x40947b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x434004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00402662
and dword [ebp - 0x14], 0
cmp dword [0x436728], 0
mov dword [ebp - 0x18], eax
jne 0x40952e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4095d6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4095d6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x436728], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x43672c], eax
call edi
push eax
call esi
push 0x4328e8
push ebx
mov dword [0x436730], eax
call edi
push eax
call esi
mov dword [0x436738], eax
test eax, eax
je 0x40952e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x436734], eax
mov eax, dword [0x436734]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409587
cmp dword [0x436738], ecx
je 0x409587
push eax
call esi
push dword [0x436738]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409587
test ebx, ebx
je 0x409587
call edi
test eax, eax
je 0x40957e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40957e
test byte [ebp - 8], 1
jne 0x409587
or dword [ebp + 0x10], 0x200000
jmp 0x4095ba
mov eax, dword [0x43672c]
cmp eax, dword [ebp - 0x18]
je 0x4095ba
push eax
call esi
test eax, eax
je 0x4095ba
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4095ba
mov eax, dword [0x436730]
cmp eax, dword [ebp - 0x18]
je 0x4095ba
push eax
call esi
test eax, eax
je 0x4095ba
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x436728]
call esi
test eax, eax
je 0x4095d6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4095d8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x42fdf0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x4380fc]
push ebx
push esi
mov esi, dword [0x437e1c]
mov ebx, eax
cmp eax, 0x5dd
jne 0x42fe12
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x4351d0]
call fcn.0042fcd0
cmp dword [0x4380fc], 0x2f
jne 0x42fe2d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.0042fd10
add esp, 4
cmp dword [0x4380fc], 0x568
pop esi
pop ebx
jne 0x42fe5a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x4535c0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
call fcn.00443050
cmp eax, 0x600
jb 0x4535e3
movzx ecx, byte [esp + 8]
mov esi, dword [esi]
mov eax, dword [esi]
mov edx, dword [eax + 0x10]
push ecx
push esi
call edx
pop esi
ret 4
mov eax, dword [esi + 8]
mov cl, byte [esp + 8]
mov byte [eax + 0xb0], cl
mov eax, dword [esi + 0xc]
test eax, eax
je 0x453666
push ebx
push edi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
inc edi
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004afe20
add esp, 4
mov ebx, eax
mov eax, dword [esi + 0xc]
push edi
push ebx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0xffffffffffffffff
push 0
push 0xb1
push ecx
call edi
mov edx, dword [esi + 0xc]
push 1
push 8
push 0x102
push edx
call edi
mov eax, dword [esi + 0xc]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
push ebx
call fcn.004afc55
add esp, 4
pop edi
pop ebx
pop esi
ret 4

Function at 0x4563d0
Capabilities:
Get common file path

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
push 0x1a
push 0
mov byte [esi], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x456457
mov edx, dword [esp + 4]
push esi
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x456457
cmp byte [esi], 0
je 0x456457
push esi
call fcn.004562d0
mov eax, esi
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x456417
mov ecx, dword [str.WinRAR]
mov dword [eax], ecx
mov dx, word [0x4c9438]
mov word [eax + 4], dx
mov cl, byte [0x4c943a]
push 0
push esi
mov byte [eax + 6], cl
call fcn.00432430
test al, al
jne 0x456483
push 0
push 0
push 0
push esi
call fcn.00432c70
test eax, eax
je 0x456483
push 0x400
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call fcn.00455d90
lea edx, [esi + 2]
cmp eax, edx
jb 0x456480
cmp byte [esi + 1], 0x3a
jne 0x45647f
add esi, 4
cmp eax, esi
jb 0x456480
dec eax
mov byte [eax], 0
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x14]
call eax
pop esi
add esp, 8
ret 4
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42a004]
jne 0x40100a
repz ret
jmp fcn.00401a91

Function at 0x405ebb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42a004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040408b
and dword [ebp - 0x14], 0
cmp dword [0x42c6fc], 0
mov dword [ebp - 0x18], eax
jne 0x405f6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x406016
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x406016
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42c6fc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42c700], eax
call edi
push eax
call esi
push 0x42805c
push ebx
mov dword [0x42c704], eax
call edi
push eax
call esi
mov dword [0x42c70c], eax
test eax, eax
je 0x405f6e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42c708], eax
mov eax, dword [0x42c708]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405fc7
cmp dword [0x42c70c], ecx
je 0x405fc7
push eax
call esi
push dword [0x42c70c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405fc7
test ebx, ebx
je 0x405fc7
call edi
test eax, eax
je 0x405fbe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405fbe
test byte [ebp - 8], 1
jne 0x405fc7
or dword [ebp + 0x10], 0x200000
jmp 0x405ffa
mov eax, dword [0x42c700]
cmp eax, dword [ebp - 0x18]
je 0x405ffa
push eax
call esi
test eax, eax
je 0x405ffa
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405ffa
mov eax, dword [0x42c704]
cmp eax, dword [ebp - 0x18]
je 0x405ffa
push eax
call esi
test eax, eax
je 0x405ffa
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42c6fc]
call esi
test eax, eax
je 0x406016
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x406018
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401000
leave
ret

Function at 0x426400
Capabilities:
Get disk information

Disassembly:
mov eax, dword [0x42e0dc]
push ebx
push esi
mov esi, dword [0x42ddfc]
mov ebx, eax
cmp eax, 0x5dd
jne 0x426422
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov eax, dword [0x42b1c0]
call fcn.004262f0
cmp dword [0x42e0dc], 0x2f
jne 0x42643d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push esi
call fcn.00426330
add esp, 4
cmp dword [0x42e0dc], 0x568
pop esi
pop ebx
jne 0x42646a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
ret
Function at 0x100089d5
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.10008b85
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x10008ad3
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x10008a76
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x10008ab9
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x10008a8d
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x10008aa8
test al, 0x40
je 0x10008a9f
mov ecx, dword [edi + 0x20]
jmp 0x10008aa6
test al, 0x80
je 0x10008ab9
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x10008ab9
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x10008a45
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret