joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475c30
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov eax, 0x1254
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x1250], eax
push ebx
mov ebx, dword [esp + 0x1260]
lea eax, [esp + 4]
push esi
mov esi, dword [esp + 0x1268]
push edi
mov edi, dword [esp + 0x1264]
push eax
cmp edi, 0xffffffff
jne 0x475cdf
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x475d04
push 0x800
lea eax, [esp + 0x260]
push eax
push ebx
call fcn.00484980
test al, al
je 0x475cad
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x475d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x475cd2
cmp eax, 3
je 0x475cd2
cmp eax, 0x12
je 0x475cd2
mov eax, 1
mov byte [esi + 0x1044], al
jmp 0x475dd2
xor eax, eax
mov byte [esi + 0x1044], al
jmp 0x475dd2
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x475d04
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne cl
or eax, 0xffffffff
mov byte [esi + 0x1044], cl
jmp 0x475dd4
push 0x800
push ebx
push esi
call fcn.0049ce90
push 0x800
lea eax, [esp + 0x3c]
push eax
push esi
call fcn.00485380
mov ecx, dword [esp + 0x28]
xor eax, eax
add eax, dword [esp + 0x2c]
mov dword [esi + 0x1000], eax
mov eax, dword [esp + 0xc]
adc ecx, 0
mov dword [esi + 0x1008], eax
mov eax, dword [esp + 0x10]
mov dword [esi + 0x1028], eax
mov eax, dword [esp + 0x14]
mov dword [esi + 0x102c], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x1030], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0x1034], eax
mov eax, dword [esp + 0x20]
mov dword [esi + 0x1038], eax
mov eax, dword [esp + 0x24]
mov dword [esi + 0x103c], eax
lea eax, [esp + 0x20]
mov dword [esi + 0x1004], ecx
lea ecx, [esi + 0x1010]
push eax
call fcn.0049ea10
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x1018]
call fcn.0049ea10
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x1020]
call fcn.0049ea10
test dword [esp + 0xc], 0x400
je 0x475dca
cmp dword [esp + 0x30], 0xa0000003
jne 0x475dca
mov eax, 1
jmp 0x475dcc
xor eax, eax
mov byte [esi + 0x100e], al
mov eax, edi
mov ecx, dword [esp + 0x125c]
pop edi
mov dword [esi + 0x1040], 0
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x1254
ret 0xc
Function at 0x47b880
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x104]
test eax, eax
je 0x47b975
cmp eax, 1
je 0x47b975
push 0x4000
push 0
push dword [esi + 0xd4]
call fcn.00505530
add esp, 0xc
cmp byte [esi + 0x6131], 0
jne 0x47b977
mov eax, dword [esi + 0xe8]
mov ecx, dword [esi + 0x612c]
shr eax, 2
cmp ecx, eax
ja 0x47b977
push ebx
xor ebx, ebx
test ecx, ecx
je 0x47b974
push edi
nop
mov edx, dword [esi + 0xd0]
movzx eax, byte [edx + ebx]
imul ecx, eax, 0x2773
movzx eax, byte [edx + ebx + 1]
xor ecx, eax
movzx eax, byte [edx + ebx + 2]
imul edi, ecx, 0x2773
xor edx, edx
xor edi, eax
mov eax, dword [esi + 0xd8]
mov ecx, edi
and ecx, 0x3ffff
mov word [eax + ecx*2], dx
mov eax, dword [esi + 0xd0]
movzx edx, byte [eax + ebx + 3]
imul eax, edi, 0x2773
xor edx, eax
mov eax, dword [esi + 0xdc]
mov ecx, edx
and ecx, 0x3ffff
mov dword [eax + ecx*4], 0
mov eax, dword [esi + 0xd0]
movzx ecx, byte [eax + ebx + 4]
inc ebx
imul eax, edx, 0x2773
xor ecx, eax
mov eax, dword [esi + 0xe0]
and ecx, dword [esi + 0xec]
mov dword [eax + ecx*4], 0
cmp ebx, dword [esi + 0x612c]
jb 0x47b8e0
pop edi
pop ebx
pop esi
ret
push 0x80000
push 0
push dword [esi + 0xd8]
call fcn.00505530
push 0x100000
push 0
push dword [esi + 0xdc]
call fcn.00505530
mov eax, dword [esi + 0xe8]
shl eax, 2
push eax
push 0
push dword [esi + 0xe0]
call fcn.00505530
add esp, 0x24
pop esi
ret
Function at 0x480370
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xb8
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0xb4], eax
mov ecx, dword [esp + 0xc0]
mov eax, dword [esp + 0xbc]
add ecx, 0xffffff88
push ebx
push ebp
push esi
xor ebx, ebx
mov dword [esp + 0x44], 0
push edi
lea edi, [esp + 0x40]
mov dword [esp + 0x44], 0
add eax, 2
mov dword [esp + 0x40], 0
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], eax
lea ebx, [ebx]
cmp ebx, ecx
jge 0x4804fc
lea edx, [esp + 0x4c]
mov ebp, dword [edi]
sub edx, 2
mov edi, dword [esp + 0x28]
mov ecx, edx
lea esi, [esp + 0x4c]
neg ecx
sub esi, edx
add esi, 0xfffffffd
add edi, ebx
lea eax, [edx + 3]
mov dword [esp + 0x18], esi
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x4c]
add eax, ecx
mov dword [esp + 0x10], edi
mov dword [esp + 0x30], eax
lea eax, [esp + 0x4d]
add eax, ecx
mov dword [esp + 0x3c], eax
lea eax, [esp + 0x4c]
sub eax, edx
dec eax
mov dword [esp + 0x38], eax
lea eax, [esp + 0x4e]
add eax, ecx
mov ecx, dword [esp + 0x1c]
sub ecx, ebx
mov dword [esp + 0x34], eax
dec ecx
mov eax, 0x88888889
mul ecx
mov ecx, edx
shr ecx, 0xa
inc ecx
mov dword [esp + 0x14], ecx
xor eax, eax
jmp 0x480450
mov dl, byte [edi + eax - 1]
movzx ecx, byte [edi + eax - 2]
sub cl, dl
mov byte [esp + eax + 0x4d], dl
mov byte [esp + eax + 0x4c], cl
movzx ecx, byte [edi + eax]
sub cl, dl
mov byte [esp + eax + 0x4e], cl
add eax, 3
cmp eax, 0x78
jl 0x480450
mov ebx, dword [esp + 0x2c]
mov edi, 0x27
mov edi, edi
mov eax, dword [esp + 0x30]
lea ebx, [ebx + 3]
movzx eax, byte [ebx + eax - 3]
sub al, byte [esi + ebx - 3]
movsx eax, al
cdq
mov esi, eax
mov eax, dword [esp + 0x34]
xor esi, edx
sub esi, edx
mov cl, byte [ebx + eax - 3]
mov eax, dword [esp + 0x38]
sub cl, byte [eax + ebx - 3]
movsx eax, cl
cdq
xor eax, edx
sub eax, edx
add esi, eax
mov eax, dword [esp + 0x3c]
movzx eax, byte [ebx + eax - 3]
sub al, byte [ebx - 3]
movsx eax, al
cdq
xor eax, edx
sub eax, edx
add ebp, eax
add ebp, esi
mov esi, dword [esp + 0x18]
sub edi, 1
jne 0x480480
mov edi, dword [esp + 0x10]
add edi, 0x780
sub dword [esp + 0x14], 1
mov dword [esp + 0x10], edi
jne 0x480444
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
mov dword [edi], ebp
inc ebx
add edi, 4
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], edi
cmp ebx, 2
jle 0x4803d0
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
pop edi
pop esi
pop ebp
pop ebx
cmp eax, edx
ja 0x480542
cmp eax, ecx
ja 0x480542
xor eax, eax
mov ecx, dword [esp + 0xb4]
xor ecx, esp
call fcn.00502f8e
add esp, 0xb8
ret 8
cmp ecx, edx
mov ecx, dword [esp + 0xb4]
sbb eax, eax
xor ecx, esp
neg eax
inc eax
call fcn.00502f8e
add esp, 0xb8
ret 8
Function at 0x4844b0
Capabilities:
Get common file path

Disassembly:
sub esp, 0xc
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 8], eax
call fcn.004aecc0
test al, al
jne 0x4844d8
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.00502f8e
add esp, 0xc
ret 0xc
push ebx
push esi
push edi
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov edi, dword [esp + 0x1c]
xor eax, eax
xor bl, bl
mov word [edi], ax
lea eax, [esp + 0xc]
push eax
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x484551
push edi
push dword [esp + 0x10]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x484551
cmp word [edi], 0
je 0x484551
mov esi, dword [esp + 0x20]
push esi
push edi
call fcn.004836c0
push esi
push 0x526fa4
push edi
call fcn.0049ce50
push edi
call fcn.00474160
mov bl, al
test bl, bl
jne 0x484551
cmp byte [esp + 0x24], al
je 0x484551
push 0
push 0
push edi
call fcn.004746e0
test eax, eax
sete bl
mov eax, dword [esp + 0x10]
push dword [esp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x523720]
call esi
mov ecx, dword [esp + 0x14]
mov al, bl
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0xc
ret 0xc

Function at 0x4847a0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
xor eax, eax
push esi
mov esi, dword [esp + 0x14]
push edi
mov word [esi], ax
lea eax, [esp + 8]
push eax
push 1
push 0
push 0x532c68
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, dword [esp + 0x1c]
test eax, eax
jne 0x4847f9
lea eax, [esp + 0xc]
mov dword [esp + 0xc], edi
push eax
push esi
lea eax, [esp + 0x18]
push eax
push 0
push str.AppData
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], 0
je 0x484809
push esi
call fcn.00474160
test al, al
jne 0x484845
push dword [esp + 0x20]
push edi
push esi
call fcn.004844b0
test al, al
jne 0x484845
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push esi
call fcn.00485280
lea ecx, [esi + 4]
cmp eax, ecx
jb 0x484840
cmp word [esi + 2], 0x3a
jne 0x48483d
lea ecx, [esi + 8]
cmp eax, ecx
jb 0x484840
sub eax, 2
xor ecx, ecx
mov word [eax], cx
pop edi
pop esi
add esp, 0xc
ret 0xc
Function at 0x484980
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x1000], eax
push ebx
mov ebx, dword [esp + 0x1010]
push esi
mov esi, dword [esp + 0x1010]
movzx eax, word [esi]
test ax, ax
jne 0x4849b7
xor al, al
jmp 0x484b8e
push edi
push eax
call fcn.0049cc60
mov edi, esi
lea ecx, [edi + 2]
mov ax, word [edi]
add edi, 2
test ax, ax
jne 0x4849c3
movzx eax, word [esi]
sub edi, ecx
sar edi, 1
push ebp
cmp eax, 0x5c
jne 0x4849e4
cmp word [esi + 2], ax
lea ebp, [esi + 2]
je 0x484a1a
push eax
call fcn.0049cc60
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x484ab1
cmp word [esi + 2], 0x3a
lea ebp, [esi + 2]
jne 0x484ab1
movzx eax, word [esi + 4]
cmp eax, 0x5c
je 0x484a1a
cmp eax, 0x2f
jne 0x484ab1
movzx eax, word [esi]
push eax
call fcn.0049cc60
movzx eax, ax
add eax, 0xffffffbf
cmp ax, 0x19
ja 0x484a63
cmp word [ebp], 0x3a
jne 0x484a63
lea eax, [edi + 4]
mov edi, dword [esp + 0x1020]
cmp edi, eax
jbe 0x484b8a
push edi
push 0x52495c
push ebx
call fcn.0049ce90
push edi
push esi
push ebx
call fcn.0049ce50
mov al, 1
jmp 0x484b8c
cmp word [esi], 0x5c
jne 0x484b8a
cmp word [ebp], 0x5c
jne 0x484b8a
mov esi, dword [esp + 0x1020]
lea eax, [edi + 6]
cmp esi, eax
jbe 0x484b8a
push esi
push 0x52495c
push ebx
call fcn.0049ce90
push esi
push 0x532d30
push ebx
call fcn.0049ce50
push esi
push ebp
push ebx
call fcn.0049ce50
mov al, 1
jmp 0x484b8c
lea eax, [esp + 0x10]
push eax
push 0x7ff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x484b8a
cmp eax, 0x7ff
ja 0x484b8a
movzx eax, word [esi]
cmp eax, 0x5c
je 0x484b51
cmp eax, 0x2f
je 0x484b51
push 0x800
lea eax, [esp + 0x14]
push eax
call fcn.004836c0
lea ecx, [esp + 0x10]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x484af7
sub ecx, edx
lea eax, [edi + 4]
mov edi, dword [esp + 0x1020]
sar ecx, 1
add eax, ecx
cmp edi, eax
jbe 0x484b8a
push edi
push 0x52495c
push ebx
call fcn.0049ce90
push edi
lea eax, [esp + 0x14]
push eax
push ebx
call fcn.0049ce50
cmp word [esi], 0x2e
jne 0x484b45
movzx eax, word [esi + 2]
push eax
call fcn.00484d20
test al, al
je 0x484b45
add esi, 4
push edi
push esi
push ebx
call fcn.0049ce50
mov al, 1
jmp 0x484b8c
lea eax, [edi + 6]
mov edi, dword [esp + 0x1020]
cmp edi, eax
jbe 0x484b8a
push edi
push 0x52495c
push ebx
call fcn.0049ce90
xor eax, eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x10]
push edi
push eax
push ebx
call fcn.0049ce50
push edi
push esi
push ebx
call fcn.0049ce50
mov al, 1
jmp 0x484b8c
xor al, al
pop ebp
pop edi
mov ecx, dword [esp + 0x1008]
pop esi
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x1004
ret 0xc
Function at 0x488df0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, 1
push esi
mov esi, dword [esp + 0xc]
xor cl, cl
cmp esi, eax
jbe 0x488e0c
xor cl, byte [eax + edx]
inc eax
cmp eax, esi
jb 0x488e04
cmp cl, byte [edx]
jne 0x488e4d
push esi
push edx
push 0xffffffffffffffff
call fcn.00468fb0
xor edx, edx
not eax
xor ecx, ecx
nop
cmp dword [ecx + 0x54ee7c], eax
jne 0x488e30
cmp dword [ecx + 0x54ee78], esi
je 0x488e3d
add ecx, 0xc
inc edx
cmp ecx, 0x48
jb 0x488e20
pop esi
ret 0xc
lea eax, [edx + edx*2]
mov ecx, dword [eax*4 + 0x54ee80]
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
pop esi
ret 0xc

Function at 0x48abb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x51f80a
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x5513d4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov byte [esi + 0x10], 0
mov dword [ebp - 4], 0
xor ecx, ecx
mov eax, dword [ebp + 8]
mov edx, 0x1c
mov dword [esi + 0x1c], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x24], 0
mov eax, dword [eax + 0x84f0]
mov dword [esi + 0x40], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005030d4
xor edx, edx
mov dword [esi + 0x44], eax
add esp, 4
cmp dword [esi + 0x40], edx
jbe 0x48ac7b
xor ecx, ecx
lea esp, [esp]
mov eax, dword [esi + 0x44]
lea ecx, [ecx + 0x1c]
inc edx
mov dword [ecx + eax - 0x1c], esi
mov eax, dword [esi + 0x44]
mov dword [eax + ecx - 0x18], 0
cmp edx, dword [esi + 0x40]
jb 0x48ac60
cmp byte [ebp + 0xc], 0
je 0x48ac8a
mov dword [esi + 0x3c], 0
jmp 0x48acd4
push 0x338
call fcn.00502d4e
add esp, 4
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
test eax, eax
je 0x48acae
push dword [esi + 0x40]
mov ecx, eax
call fcn.0049dd00
jmp 0x48acb0
xor eax, eax
mov byte [ebp - 4], 0
push 0x4000010
mov dword [esi + 0x3c], eax
call fcn.005030d4
mov ecx, eax
mov dword [esi + 0x1c], eax
not ecx
add esp, 4
inc ecx
and ecx, 0xf
add ecx, eax
mov dword [esi + 0x20], ecx
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4955f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x414
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x410], eax
mov eax, dword [esp + 0x418]
push ebx
push ebp
mov ebp, dword [esp + 0x424]
push esi
push edi
push 5
push eax
push dword [0x58c1f8]
mov dword [esp + 0x28], ecx
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push dword [0x58c1f8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [0x58c1f8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
push edi
call fcn.005097b7
mov esi, eax
add esp, 4
test esi, esi
jne 0x495664
mov dword [ebp], eax
jmp 0x495796
push edi
push ebx
push esi
call fcn.00504fb0
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x20]
movzx ebx, word [esi + 2]
add esp, 0xc
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x14]
push eax
push dword [esp + 0x20]
call fcn.004950f0
test al, al
je 0x4956e7
mov edi, esi
cmp ebx, 0xffff
jne 0x4956ab
lea edi, [esi + 8]
movsx ecx, word [edi + 0xe]
mov eax, 0x51eb851f
imul ecx, dword [esp + 0x10]
imul ecx
mov eax, 0x51eb851f
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
mov word [edi + 0xe], cx
movsx ecx, word [edi + 0x10]
imul ecx, dword [esp + 0x14]
imul ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add eax, edx
mov word [edi + 0x10], ax
xor edx, edx
cmp ebx, 0xffff
mov ebx, 0xffff
sete dl
lea edx, [edx*8 + 0x12]
add edx, esi
cmp word [edx], bx
jne 0x49570c
mov ecx, 2
jmp 0x495721
mov ecx, edx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x495711
sub ecx, edi
sar ecx, 1
inc ecx
cmp word [edx + ecx*2], bx
lea edi, [edx + ecx*2]
jne 0x495731
mov ebx, 2
jmp 0x495748
mov edx, edi
lea ecx, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x495736
sub edx, ecx
sar edx, 1
lea ebx, [edx + 1]
mov ecx, dword [esp + 0x1c]
lea eax, [esp + 0x20]
push 0x200
push eax
push str.CAPTION
push dword [esp + 0x24]
call fcn.004951a0
test al, al
lea eax, [esp + 0x20]
jne 0x49576f
lea eax, [edi + ebx*2]
push eax
call fcn.005097cd
add esp, 4
mov dword [ebp], eax
cmp dword [esp + 0x10], 0x64
jne 0x495794
cmp dword [esp + 0x14], 0x64
jne 0x495794
push esi
call fcn.005097b2
add esp, 4
xor esi, esi
mov eax, esi
mov ecx, dword [esp + 0x420]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00502f8e
add esp, 0x414
ret 8
Function at 0x4968d0
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov eax, 0x2010
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x200c], eax
push esi
mov esi, dword [esp + 0x2018]
push edi
mov edi, dword [esp + 0x2020]
cmp edi, esi
je 0x49690a
push dword [esp + 0x2024]
push esi
push edi
call fcn.0049ce90
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SoftwareWinRARGeneral
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4969df
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x496930
sub ecx, edx
mov eax, 0x7ff
sar ecx, 1
sub eax, ecx
add eax, eax
mov dword [esp + 0xc], eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1018]
push eax
lea eax, [esp + 0x18]
push eax
push 0
push str.LanguageFolder
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4969d5
mov word [esp + 0x14], ax
lea eax, [esp + 0x14]
push 0x800
push eax
lea eax, [esp + 0x101c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0x800
lea eax, [esp + 0x18]
push eax
call fcn.004836c0
push 0x800
push esi
call fcn.00485280
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0049ce50
lea eax, [esp + 0x14]
push eax
call fcn.00474160
test al, al
je 0x4969d5
push dword [esp + 0x2024]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0049ce90
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2014]
pop edi
pop esi
xor ecx, esp
call fcn.00502f8e
add esp, 0x2010
ret 0xc

Function at 0x496a00
Capabilities:
Check os version

Disassembly:
mov eax, 0x1120
call fcn.00502fa0
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x111c], eax
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0x1130]
cmp byte [esi], 0
je 0x496a41
push dword [0x58c1f8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x58c1fc]
mov dword [0x58c1f8], eax
mov byte [esi], 0
lea eax, [esp + 0x124]
push 0x800
test edi, edi
je 0x496a5a
push edi
push eax
call fcn.0049ce90
jmp 0x496a63
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x800
push str.rarlng.dll
lea eax, [esp + 0x12c]
push eax
call fcn.00485380
push 0x800
lea eax, [esp + 0x128]
push eax
push eax
call fcn.004968d0
lea eax, [esp + 8]
mov dword [esp + 8], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0x18], 2
jne 0x496ad1
mov eax, dword [esp + 0xc]
cmp eax, 5
ja 0x496abd
jne 0x496ad1
cmp word [esp + 0x11c], 2
jb 0x496ad1
push 2
push 0
lea eax, [esp + 0x12c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x496adf
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [0x58c1f8], eax
pop edi
setne al
mov byte [esi], al
test al, al
mov eax, dword [esp + 0x1128]
pop esi
mov dword [0x58c1fc], eax
jne 0x496b02
mov dword [0x58c1f8], eax
mov ecx, dword [esp + 0x111c]
xor ecx, esp
call fcn.00502f8e
add esp, 0x1120
ret 8
Function at 0x4974f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
cmp dword [esp + 8], 0
mov edx, dword [esp + 0xc]
push esi
mov esi, ecx
push edi
movups xmm2, xmmword [esi + 8]
lea edi, [esi + 0x18]
jbe 0x497565
mov ecx, dword [esp + 0xc]
mov eax, ecx
add ecx, 0x10
mov dword [esp + 0xc], ecx
mov ecx, dword [esi + 4]
movups xmm3, xmmword [eax]
mov eax, ecx
dec ecx
add eax, eax
movups xmm1, xmmword [edi + eax*8]
pxor xmm1, xmm3
test ecx, ecx
jle 0x497541
mov eax, ecx
shl eax, 4
add eax, edi
movups xmm0, xmmword [eax]
dec ecx
lea eax, [eax - 0x10]
aesdec xmm1, xmm0
test ecx, ecx
jg 0x497531
cmp byte [esi + 1], 0
movups xmm0, xmmword [edi]
aesdeclast xmm1, xmm0
je 0x497553
pxor xmm1, xmm2
mov eax, edx
movaps xmm2, xmm3
add edx, 0x10
sub dword [esp + 0x10], 1
movups xmmword [eax], xmm1
jne 0x497506
pop edi
movups xmmword [esi + 8], xmm2
pop esi
ret 0xc
Function at 0x497a30
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp dword [esp + 8], 0
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
movups xmm1, xmmword [esi + 8]
lea ecx, [esi + 0x18]
jbe 0x497aa6
mov eax, edi
add edi, 0x10
cmp byte [esi + 1], 0
movups xmm0, xmmword [eax]
je 0x497a58
pxor xmm0, xmm1
movups xmm1, xmmword [ecx]
mov edx, dword [esi + 4]
pxor xmm1, xmm0
cmp edx, 1
jle 0x497a84
lea eax, [ecx + 0x10]
lea ecx, [edx - 1]
lea ecx, [ecx]
lea eax, [eax + 0x10]
movups xmm0, xmmword [eax - 0x10]
aesenc xmm1, xmm0
sub ecx, 1
jne 0x497a70
lea ecx, [esi + 0x18]
add edx, edx
movups xmm0, xmmword [ecx + edx*8]
mov edx, dword [esp + 0x14]
mov eax, edx
add edx, 0x10
sub dword [esp + 0x10], 1
aesenclast xmm1, xmm0
mov dword [esp + 0x14], edx
movups xmmword [eax], xmm1
jne 0x497a46
pop edi
movups xmmword [esi + 8], xmm1
pop esi
ret 0xc

Function at 0x497ab0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x14
mov eax, dword [0x5513d4]
xor eax, esp
mov dword [esp + 0x10], eax
push ebp
push edi
mov edi, ecx
mov ebp, 1
cmp dword [edi + 4], ebp
jle 0x497bef
push ebx
push esi
mov esi, 0x10
jmp 0x497ae0
xor eax, eax
movzx ecx, byte [esi + edi + 0x1b]
movzx edx, byte [esi + edi + 0x1a]
movzx ebx, byte [eax + ecx*4 + 0x593578]
xor bl, byte [eax + edx*4 + 0x593178]
movzx ecx, byte [esi + edi + 0x19]
movzx edx, byte [esi + edi + 0x1e]
xor bl, byte [eax + ecx*4 + 0x592d78]
movzx ecx, byte [esi + edi + 0x18]
xor bl, byte [eax + ecx*4 + 0x592978]
movzx ecx, byte [esi + edi + 0x1f]
mov byte [esp + eax + 0x10], bl
movzx ebx, byte [eax + ecx*4 + 0x593578]
xor bl, byte [eax + edx*4 + 0x593178]
movzx ecx, byte [esi + edi + 0x1d]
movzx edx, byte [edi + esi + 0x22]
xor bl, byte [eax + ecx*4 + 0x592d78]
movzx ecx, byte [esi + edi + 0x1c]
xor bl, byte [eax + ecx*4 + 0x592978]
movzx ecx, byte [edi + esi + 0x23]
mov byte [esp + eax + 0x14], bl
movzx ebx, byte [eax + ecx*4 + 0x593578]
xor bl, byte [eax + edx*4 + 0x593178]
movzx ecx, byte [edi + esi + 0x21]
movzx edx, byte [esi + edi + 0x26]
xor bl, byte [eax + ecx*4 + 0x592d78]
movzx ecx, byte [edi + esi + 0x20]
xor bl, byte [eax + ecx*4 + 0x592978]
movzx ecx, byte [esi + edi + 0x27]
mov byte [esp + eax + 0x18], bl
movzx ebx, byte [eax + ecx*4 + 0x593578]
movzx ecx, byte [esi + edi + 0x25]
xor bl, byte [eax + edx*4 + 0x593178]
xor bl, byte [eax + ecx*4 + 0x592d78]
movzx ecx, byte [esi + edi + 0x24]
xor bl, byte [eax + ecx*4 + 0x592978]
mov byte [esp + eax + 0x1c], bl
inc eax
cmp eax, 4
jl 0x497ae2
mov eax, dword [esp + 0x10]
inc ebp
mov dword [edi + esi + 0x18], eax
mov eax, dword [esp + 0x14]
mov dword [edi + esi + 0x1c], eax
mov eax, dword [esp + 0x18]
mov dword [edi + esi + 0x20], eax
mov eax, dword [esp + 0x1c]
mov dword [edi + esi + 0x24], eax
add esi, 0x10
cmp ebp, dword [edi + 4]
jl 0x497ae0
pop esi
pop ebx
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
xor ecx, esp
call fcn.00502f8e
add esp, 0x14
ret