joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002f8d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002f8f4
xor eax, eax
jmp 0x1002fa61
push 1
lea eax, [ebp - 8]
push eax
push 0x73ed
lea eax, [ebp + 8]
push eax
push 0xc77
push 0x1bbb
lea eax, [ebp - 0x10]
push eax
call fcn.1002f4e9
add esp, 0x1c
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002f92b
xor eax, eax
jmp 0x1002fa61
push 1
lea eax, [ebp - 0xc]
push eax
push 0x6934
push dword [ebp - 8]
call fcn.1002f2c3
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x1002f94e
xor eax, eax
jmp 0x1002fa61
push 0x584b
push 0x54ba
push 0xadf
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x4322
push 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
call fcn.1002f58e
add esp, 0x28
lea eax, [ebp - 8]
push eax
push 0x7a72
push 0x7cef
lea eax, [ebp - 4]
push eax
push 1
push 0x52ef
push 0x7844
lea eax, [ebp + 8]
push eax
push 0x54b1
call fcn.1002f6be
add esp, 0x24
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002f9de
lea eax, [ebp - 4]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0x850
push 0xc6d
push 0xd9a
call fcn.1002fa65
add esp, 0x18
push dword [ebp - 4]
call fcn.1002e389
pop ecx
test eax, eax
jne 0x1002f9ef
xor eax, eax
jmp 0x1002fa61
lea eax, [ebp - 4]
push eax
push 0x7f1f
push 0x4988
push 1
call fcn.1002f848
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002fa49
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002fa26
xor eax, eax
jmp 0x1002fa61
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002fa3f
xor eax, eax
jmp 0x1002fa61
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002fa5a
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002fa5e
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10043707
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push esi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004373d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1004373b
push 0x23c4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x100437aa
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
add ecx, dword [eax + 0x24]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
lea eax, [ecx + eax*2]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov esi, dword [ebp - 0x30]
add edx, dword [esi]
mov esi, dword [ebp - 8]
mov esi, dword [esi]
mov ax, word [ecx + eax]
mov word [esi + edx], ax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1004394d
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10043982
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax + 0xc], ecx
jmp 0x1004398e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov esp, ebp
pop ebp
ret

Function at 0x10043cac
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10043cc2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10043cf2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
push 0xf
push 5
call fcn.10040ba8
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [ecx + 4], eax
mov esp, ebp
pop ebp
ret
Function at 0x1007b3c6
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10082330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1006c43c
mov dword [ebp - 0x14], eax
cmp dword [0x1073228c], esi
jne 0x1007b4b9
push 0x800
push esi
push 0x10007d8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1007b446
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1007b599
push esi
push esi
push 0x10007d8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1007b599
push 0x10007da4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007b599
push eax
call ebx
push 0x10007db0
push edi
mov dword [0x1073228c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007dc0
push edi
mov dword [0x10732290], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007dd4
push edi
mov dword [0x10732294], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x1073229c], eax
test eax, eax
je 0x1007b4b6
push 0x10007df0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10732298], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1007b4de
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1007b4d1
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1007b4f3
push 4
pop eax
jmp 0x1007b59b
cmp dword [ebp - 0x14], esi
je 0x1007b4f3
push dword [0x1073228c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1007b4d8
mov eax, dword [0x10732298]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1007b551
cmp dword [0x1073229c], edi
je 0x1007b551
push eax
call ebx
push dword [0x1073229c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1007b551
test eax, eax
je 0x1007b551
call ecx
test eax, eax
je 0x1007b546
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1007b546
test byte [ebp - 8], 1
jne 0x1007b551
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1007b581
mov eax, dword [0x10732290]
cmp eax, edi
je 0x1007b57e
push eax
call ebx
test eax, eax
je 0x1007b57e
call eax
mov esi, eax
test esi, esi
je 0x1007b57e
mov eax, dword [0x10732294]
cmp eax, edi
je 0x1007b57e
push eax
call ebx
test eax, eax
je 0x1007b57e
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1073228c]
call ebx
test eax, eax
je 0x1007b599
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1007b59b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10066949
mov esp, ebp
pop ebp
ret
Function at 0x42e001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
call 0x42e00c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x10001070
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [section..data]
push eax
call fcn.1001e1e0
add esp, 4
mov ecx, 0x1010371c
call fcn.10006270
cmp eax, 1
jne 0x10001098
mov eax, 1
jmp 0x100010ce
push 0x100e2180
mov ecx, 0x1010371c
call fcn.10005d20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x100010b7
push 1
call fcn.100c6604
mov ecx, dword [ebp + 0x14]
push ecx
push str.DllRegisterServer
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10001830
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e1105
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], 0
push str.ababc1ab
lea ecx, [ebp - 0x48]
call fcn.10001660
mov dword [ebp - 4], 0
push 0x100e21bc
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x30]
push ecx
call fcn.100011c0
add esp, 0xc
mov byte [ebp - 4], 1
mov edx, dword [ebp + 8]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x14]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
je 0x100018c1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.10001b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10001b10
jmp 0x1000195d
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x4550
je 0x100018f5
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.10001b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10001b10
jmp 0x1000195d
mov edx, dword [ebp - 0x18]
movzx eax, word [edx + 0x18]
cmp eax, 0x10b
je 0x10001920
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.10001b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10001b10
jmp 0x1000195d
lea ecx, [ebp - 0x30]
call fcn.100024f0
lea ecx, [ebp - 0x30]
call fcn.100024d0
push eax
call fcn.100013b0
add esp, 4
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x18]
mov dword [ecx + 4], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.10001b10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10001b10
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x10006710
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e13ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x40]
call fcn.10002ab0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.1001e400
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.1001e440
lea edx, [ebp - 0x40]
push edx
lea ecx, [ebp - 0x28]
call fcn.1001e460
mov eax, dword [ebp - 0x10]
push eax
call fcn.100ca08b
add esp, 4
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x40]
call fcn.10002660
push eax
lea ecx, [ebp - 0x40]
call fcn.100024d0
push eax
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.100bc6b0
add esp, 0x10
test eax, eax
je 0x100067b8
push str.uncompress_failed
call fcn.100026f0
add esp, 4
push 1
call fcn.100c6604
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [ebp - 0x14]
je 0x100067d4
push str.if__origSize___out_len_
call fcn.100026f0
add esp, 4
push 1
call fcn.100c6604
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
lea ecx, [ebp - 0x6c]
call fcn.10002b90
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.100ca070
add esp, 4
lea edx, [ebp - 0x6c]
push edx
mov ecx, dword [ebp + 8]
call fcn.10003f50
mov eax, dword [ebp - 0x1c]
or eax, 1
mov dword [ebp - 0x1c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.10004220
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10001b30
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10001b10
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001e1e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e13d5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
push 0x100e2314
lea ecx, [ebp - 0x24]
call fcn.10001660
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0x20
je 0x1001e24d
push 0x100e2318
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x3c]
push ecx
call fcn.100011c0
add esp, 0xc
mov byte [ebp - 4], 1
push 1
call fcn.100c6604
lea edx, [ebp - 0x3c]
push edx
lea ecx, [ebp - 0x24]
call fcn.10002cf0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.10001b10
lea ecx, [ebp - 0x24]
call fcn.100024f0
lea ecx, [ebp - 0x24]
call fcn.100024d0
push eax
call fcn.100013b0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.10001b10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1004efa0
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xcc
je 0x1004efda
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x198]
mov ecx, dword [eax]
call ecx
add esp, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x78], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0xcc
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x198]
movzx eax, byte [edx + 8]
test eax, eax
je 0x1004f0a7
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x78]
cmp eax, dword [edx + 0x60]
jae 0x1004f06f
mov ecx, dword [ebp + 8]
cmp dword [ecx + 8], 0
je 0x1004f035
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x78]
mov dword [eax + 4], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x60]
mov dword [ecx + 8], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ecx, dword [eax]
call ecx
add esp, 4
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x78]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp + 8]
add ecx, 0x78
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x19c]
mov edx, dword [ecx + 4]
call edx
add esp, 0x10
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x78]
cmp ecx, dword [ebp - 8]
jne 0x1004f06d
xor al, al
jmp 0x1004f0cd
jmp 0x1004efef
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x198]
mov edx, dword [ecx + 4]
call edx
add esp, 4
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x198]
mov eax, dword [edx]
call eax
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x78], 0
jmp 0x1004efda
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 0x41]
test eax, eax
je 0x1004f0bb
mov dword [ebp - 4], 0xce
jmp 0x1004f0c2
mov dword [ebp - 4], 0xcd
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x14], edx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x100d6141
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d5fb7

Function at 0x100d755b
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100d74dd
Function at 0x403f9e
Capabilities:
Encode data using xor
Hash data using sha256
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xcc
mov edx, dword [esp + 0xd0]
push ebx
push ebp
push esi
mov eax, dword [edx + 0xf8]
mov esi, dword [esp + 0xe0]
push edi
push 0x10
mov ebx, dword [eax]
lea edi, [esp + 0xa0]
mov ebp, dword [eax + 4]
xor ebx, 0x510e527f
mov eax, dword [edx + 0xfc]
xor ebp, 0x9b05688c
pop ecx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [edx + 0xf4]
lea edi, [esp + 0x5c]
push 8
pop ecx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
xor ecx, 0x1f83d9ab
xor eax, 0x5be0cd19
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x78]
xor edi, edi
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x74]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x6c]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x70]
mov dword [esp + 0x20], 0x6a09e667
mov dword [esp + 0x28], 0xbb67ae85
mov dword [esp + 0x30], 0x3c6ef372
mov dword [esp + 0x34], 0xa54ff53a
mov dword [esp + 0x10], edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
movzx eax, byte [edi + 0x433690]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + eax*4 + 0x9c]
add eax, ecx
mov ecx, dword [esp + 0x5c]
add ecx, eax
mov esi, ecx
xor esi, ebx
mov ebx, dword [esp + 0x10]
rol esi, 0x10
add edx, esi
mov edi, edx
xor edi, dword [esp + 0x14]
movzx eax, byte [ebx + 0x433691]
ror edi, 0xc
mov eax, dword [esp + eax*4 + 0x9c]
add eax, edi
add eax, ecx
mov ecx, dword [esp + 0x60]
mov dword [esp + 0x20], eax
xor eax, esi
ror eax, 8
mov dword [esp + 0x3c], eax
add eax, edx
mov dword [esp + 0x48], eax
xor eax, edi
ror eax, 7
mov dword [esp + 0x50], eax
movzx eax, byte [ebx + 0x433692]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + eax*4 + 0x9c]
add eax, dword [esp + 0x1c]
add ecx, eax
movzx eax, byte [ebx + 0x433693]
mov esi, ecx
xor esi, ebp
mov ebp, dword [esp + 0x38]
rol esi, 0x10
mov eax, dword [esp + eax*4 + 0x9c]
add edx, esi
mov edi, edx
xor edi, dword [esp + 0x1c]
ror edi, 0xc
add eax, edi
add eax, ecx
mov ecx, dword [esp + 0x64]
mov dword [esp + 0x14], eax
xor eax, esi
ror eax, 8
mov dword [esp + 0x44], eax
add eax, edx
mov dword [esp + 0x58], eax
xor eax, edi
mov edx, dword [esp + 0x30]
ror eax, 7
mov dword [esp + 0x1c], eax
movzx eax, byte [ebx + 0x433694]
mov eax, dword [esp + eax*4 + 0x9c]
add eax, ebp
add ecx, eax
movzx eax, byte [ebx + 0x433695]
mov esi, ecx
xor esi, dword [esp + 0x24]
rol esi, 0x10
mov eax, dword [esp + eax*4 + 0x9c]
add edx, esi
xor ebp, edx
ror ebp, 0xc
add eax, ebp
add eax, ecx
mov dword [esp + 0x40], eax
xor eax, esi
ror eax, 8
mov dword [esp + 0x54], eax
lea ebx, [eax + edx]
invalid
Function at 0x41ce73
Capabilities:
Hide graphical window

Disassembly:
and dword [0x4483a8], 0
push 1
push dword [esp + 8]
mov byte [0x44838d], 1
mov byte [0x44838e], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.00401173
cmp dword [0x45fbe8], 0
jne 0x41ceb3
cmp byte [0x44839b], 0
je 0x41cebc
cmp dword [0x448394], 0
jne 0x41cecf
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41cfcb
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041e040
cmp byte [0x44a3b8], 0
je 0x41d05a
cmp word [0x44a3ba], 0
je 0x41d05a
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x44a3ba
call fcn.0041bb50
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41d059
push dword [ebp + 8]
call fcn.00422655
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x41d05e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041e040
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.0040fcc1
mov esi, eax
test esi, esi
je 0x41d0b6
movzx ecx, word [esi]
push ecx
jmp 0x41d0a1
add esi, 2
movzx eax, word [esi]
push eax
call fcn.0040fddd
test al, al
jne 0x41d09a
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
leave
ret 4

Function at 0x429521
Capabilities:
Encrypt data using chaskey

Disassembly:
in al, dx
inc ebx
add byte [ebx], ch
cli
inc esi
rol eax, 0x17
mov esi, eax
call fcn.00406868
xchg edi, eax
xor edi, edx
call fcn.00406868
ror eax, 0x14
call fcn.0040d10e
add ebx, esp
or esi, edi
test edx, ebp
jo 0x4295bc
mov ecx, 0xe1d32
ror eax, 7
or dword [0x46279c], 0x168e36f4
inc eax
neg eax
xchg esi, eax
inc ebx
add dword [0x462a7c], edi
not esi
xchg esi, eax
not esi
loop 0x42954f
invalid

Function at 0x429588
Capabilities:
Encrypt data using chaskey

Disassembly:
push ds
rol edi, 0xe
or esi, edi
shl eax, 0xd
not esi
inc esi
dec eax
shr esi, 0xd
mov eax, eax
add esi, eax
mov edx, 0x3c35b0e
xor esi, eax
mov ecx, esp
mov eax, 0x1f1f4e8f
not esi
mov ecx, 0x3cd6d5
Function at 0x103aa8
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x50
push ebp
lea eax, [esp + 0x28]
push edi
push eax
call fcn.00103c58
mov ecx, dword [esp + 0x5c]
xor edx, edx
xor ebp, ebp
mov dword [esp + 0xc], 1
mov edi, dword [ecx]
mov dword [esp + 0x10], 8
mov dword [esp + 0x14], 2
mov dword [esp + 0x18], 4
mov dx, word [edi + 0x14]
cmp word [edi + 6], bp
mov dword [esp + 0x1c], 0x10
mov dword [esp + 0x20], 0x80
mov dword [esp + 0x24], 0x20
mov dword [esp + 0x28], 0x40
lea eax, [edx + edi + 0x18]
jbe 0x103ba6
push ebx
push esi
lea ebx, [eax + 0x24]
mov eax, dword [ebx]
mov ecx, eax
mov edx, eax
shr ecx, 0x1d
shr edx, 0x1e
mov esi, eax
and ecx, 1
and edx, 1
shr esi, 0x1f
test eax, 0x2000000
je 0x103b49
mov eax, dword [ebx - 0x14]
mov ecx, dword [ebx - 0x1c]
push 0x4000
push eax
push ecx
call dword [esp + 0x4c]
jmp 0x103b8c
lea edx, [edx + ecx*2]
test eax, 0x4000000
lea ecx, [esi + edx*2]
mov esi, dword [esp + ecx*4 + 0x14]
je 0x103b60
or esi, 0x200
mov edx, dword [ebx - 0x14]
mov ecx, edx
test ecx, ecx
jne 0x103b7b
test al, 0x40
je 0x103b72
mov ecx, dword [edi + 0x20]
jmp 0x103b79
test al, 0x80
je 0x103b8c
mov ecx, dword [edi + 0x24]
test ecx, ecx
jbe 0x103b8c
mov ecx, dword [ebx - 0x1c]
lea eax, [esp + 0x10]
push eax
push esi
push edx
push ecx
call dword [esp + 0x44]
mov edx, dword [esp + 0x64]
xor eax, eax
inc ebp
add ebx, 0x28
mov edi, dword [edx]
mov ax, word [edi + 6]
cmp ebp, eax
jl 0x103b18
pop esi
pop ebx
pop edi
pop ebp
add esp, 0x50
ret