joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ed12
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x4481c8]
test esi, esi
jne 0x40ed30
mov ecx, 0x4481c0
call fcn.0040ec93
mov esi, dword [0x4481c8]
mov eax, dword [ebp + 0xc]
xor ecx, ecx
and eax, 0xfffffff0
cmp byte [ebp + 0x14], cl
setne cl
cmp byte [ebp + 0x10], 0
je 0x40ed7f
test esi, esi
je 0x40eda3
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [0x433260]
call esi
test eax, eax
jne 0x40edc8
push str.CryptProtectMemory_failed
mov esi, 0x440f50
push esi
call fcn.00406df1
pop ecx
pop ecx
mov ecx, esi
call fcn.0041f2f0
push 2
mov ecx, esi
call fcn.00406dec
jmp 0x40edc8
mov esi, dword [0x4481cc]
test esi, esi
je 0x40eda3
push ecx
push eax
push dword [ebp + 8]
mov ecx, esi
call dword [0x433260]
call esi
test eax, eax
jne 0x40edc8
push str.CryptUnprotectMemory_failed
jmp 0x40ed60
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ebx, eax
cmp dword [ebp + 0xc], edx
jbe 0x40edc7
mov esi, dword [ebp + 8]
add bl, 0x4b
lea ecx, [edx + esi]
lea eax, [edx + ebx]
xor byte [ecx], al
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x40edb9
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x40f75f
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x1c], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x40f9e7
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4
Function at 0x40fa88
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x130]
xor esi, esi
lea ebx, [edi + 0x28]
push dword [ebx]
call fcn.004261c4
mov dword [esp + esi*4 + 0x30], eax
lea ebx, [ebx + 4]
inc esi
pop ecx
cmp esi, 0x10
jb 0x40fa9e
push 0x30
lea ebx, [esp + 0x68]
pop ebp
mov ecx, dword [ebx - 0x34]
mov esi, ecx
mov edx, dword [ebx]
mov eax, ecx
rol esi, 0xe
lea ebx, [ebx + 4]
ror eax, 7
xor esi, eax
shr ecx, 3
xor esi, ecx
mov eax, edx
mov ecx, edx
rol eax, 0xd
rol ecx, 0xf
xor ecx, eax
shr edx, 0xa
xor ecx, edx
add esi, ecx
add esi, dword [ebx - 0x3c]
add esi, dword [ebx - 0x18]
mov dword [ebx + 4], esi
sub ebp, 1
jne 0x40faba
mov eax, dword [edi + 4]
xor ebx, ebx
mov ecx, dword [edi]
mov ebp, dword [edi + 0x10]
mov edx, dword [edi + 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [edi + 0xc]
mov dword [esp + 0x20], eax
mov eax, dword [edi + 0x18]
mov dword [esp + 0x1c], ecx
mov ecx, dword [edi + 8]
mov dword [esp + 0x18], eax
mov eax, dword [edi + 0x1c]
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x24], eax
jmp 0x40fb2f
mov edx, dword [esp + 0x28]
mov esi, ebp
mov dword [esp + 0x28], ebp
ror esi, 0xb
mov eax, ebp
rol eax, 7
mov ecx, ebp
xor esi, eax
not ecx
and ecx, dword [esp + 0x18]
mov eax, ebp
ror eax, 6
xor esi, eax
mov eax, edx
and eax, ebp
mov ebp, dword [esp + 0x20]
xor ecx, eax
mov eax, dword [esp + 0x18]
add esi, ecx
mov dword [esp + 0x18], edx
add esi, dword [ebx + 0x433a50]
mov edx, edi
add esi, dword [esp + ebx + 0x2c]
add ebx, 4
add esi, dword [esp + 0x24]
mov dword [esp + 0x24], eax
add ebp, esi
ror edx, 0xd
mov eax, edi
rol eax, 0xa
xor edx, eax
mov eax, edi
ror eax, 2
xor edx, eax
mov eax, dword [esp + 0x14]
mov ecx, eax
and eax, dword [esp + 0x10]
xor ecx, dword [esp + 0x10]
and ecx, edi
xor ecx, eax
mov eax, dword [esp + 0x10]
add edx, ecx
mov dword [esp + 0x10], edi
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x14], eax
lea edi, [edx + esi]
cmp ebx, 0x100
jb 0x40fb2b
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x130]
mov ecx, dword [esp + 0x1c]
add dword [edi], ecx
mov ecx, dword [esp + 0x10]
add dword [edi + 4], ecx
mov ecx, eax
add dword [edi + 8], ecx
mov ecx, dword [esp + 0x20]
add dword [edi + 0xc], ecx
mov ecx, dword [esp + 0x28]
add dword [edi + 0x14], ecx
mov ecx, dword [esp + 0x18]
add dword [edi + 0x18], ecx
add dword [edi + 0x10], ebp
mov ecx, dword [esp + 0x24]
add dword [edi + 0x1c], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 4
Function at 0x41015d
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x4101b6
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 8]
neg eax
sbb eax, eax
and dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
test ecx, ecx
pop ebx
setne al
mov esp, ebp
pop ebp
ret
Function at 0x4109c6
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x410a41
push ebp
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x410b00
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
jne 0x410a1d
push str.CreateThread_failed
push 0x440f50
call fcn.00406df1
pop ecx
pop ecx
mov ecx, 0x440f50
call fcn.0041f2f0
push 2
mov ecx, 0x440f50
call fcn.00406dec
mov dword [edi], ebp
inc dword [esi + 0x104]
mov eax, dword [0x4481d8]
test eax, eax
je 0x410a37
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x4109d6
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x419768
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 0x14]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, ecx
push esi
push 0
push ebp
mov dword [ebx + 8], ebp
mov byte [ebx + 0x26], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x20]
mov ecx, ebx
call fcn.00419464
cmp dword [ebx + 0x1c], 0
je 0x4197a1
push dword [ebx + 0x1c]
call fcn.0042370e
pop ecx
cmp dword [esp + 0x28], 0
jne 0x4197ac
xor eax, eax
jmp 0x4197b6
push dword [esp + 0x28]
call fcn.00427267
pop ecx
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebx + 4], 0
je 0x4197f2
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
push edi
push ebx
push dword [ebx]
sub esi, eax
lea edi, [eax + 1]
push 0
push ebp
sub esi, 2
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push eax
push esi
push dword [esp + 0x2c]
xor esi, esi
push edi
push 0x40000000
push esi
push 0x434484
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebx + 4], eax
pop edi
cmp dword [ebx + 0x10], esi
jne 0x419874
test ebp, ebp
je 0x41988a
cmp dword [ebx + 0x20], esi
jne 0x41988a
cmp dword [ebx + 0x1c], esi
je 0x41988a
push dword [ebx + 0x1c]
mov ecx, ebx
call fcn.0041955c
mov esi, eax
test esi, esi
je 0x41988a
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.0042370e
pop ecx
jmp 0x41988a
test eax, eax
je 0x41988a
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14
Function at 0x419d1c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 0x43536c
push 1
push ebx
push 0x43545c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x419e51
mov eax, dword [ebp - 4]
lea ecx, [ebp - 8]
push esi
push ecx
push 0x43544c
mov esi, dword [eax]
push eax
mov ecx, dword [esi]
call dword [0x433260]
call dword [esi]
test eax, eax
js 0x419e3d
cmp byte [ebp + 8], bl
je 0x419d82
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x433260]
call esi
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x50]
mov ecx, esi
call dword [0x433260]
call esi
cmp dword [ebp + 0x18], ebx
je 0x419db3
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x1c]
mov ecx, esi
call dword [0x433260]
call esi
mov eax, dword [ebp - 4]
push ebx
mov ecx, dword [eax]
mov esi, dword [ecx + 0x44]
mov ecx, esi
cmp dword [ebp + 0x1c], ebx
jne 0x419dca
push 0x4335b4
jmp 0x419dcd
push dword [ebp + 0x1c]
push eax
call dword [0x433260]
call esi
cmp dword [ebp + 0x20], ebx
je 0x419df1
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x2c]
mov ecx, esi
call dword [0x433260]
call esi
cmp dword [ebp + 0x14], ebx
je 0x419e0c
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x24]
mov ecx, esi
call dword [0x433260]
call esi
mov eax, dword [ebp - 8]
push 1
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
mov esi, dword [ecx + 0x18]
mov ecx, esi
call dword [0x433260]
call esi
test eax, eax
js 0x419e2a
mov bl, 1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 8]
mov ecx, esi
call dword [0x433260]
call esi
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x433260]
call esi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x419ee4
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x419f5c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ecx
push esi
push 0x434694
push dword [esp + 0x14]
push dword [0x440ed0]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41a06f
push edi
push esi
push dword [0x440ed0]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x419fb0
push esi
push dword [0x440ed0]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x419fb0
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x419fb7
xor eax, eax
jmp 0x41a06e
push ebx
push ebp
push edi
xor ebp, ebp
push 2
mov dword [esp + 0x1c], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x41a068
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41a061
push edi
push esi
push eax
call fcn.0041f610
add esp, 0xc
mov dword [esp + 0x10], ebp
lea eax, [esp + 0x10]
push eax
push ebp
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41a05a
push ebp
push dword [esp + 0x14]
call fcn.00419ebb
mov ecx, dword [esp + 0x10]
mov edi, eax
push ecx
mov edx, dword [ecx]
mov esi, dword [edx + 8]
mov ecx, esi
call dword [0x433260]
call esi
test edi, edi
je 0x41a05a
mov eax, dword [edi + 8]
mov dword [edi + 8], ebp
test eax, eax
jne 0x41a048
push 0xffffff
lea eax, [esp + 0x18]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x41a048
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov esi, dword [eax]
mov ecx, esi
call dword [0x433260]
mov ecx, edi
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x14]
pop ebp
pop ebx
pop edi
pop esi
pop ecx
pop ecx
ret 4

Function at 0x41a684
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1024
call fcn.0041e4a0
cmp word [0x44946a], 0
je 0x41a720
push esi
push 6
push dword [0x43e5f8]
mov esi, 0x44946a
push esi
call fcn.0040bda5
push eax
call fcn.004118fe
test eax, eax
jne 0x41a71f
push 0x448468
call fcn.0041a462
push 0x800
push esi
lea eax, [ebp - 0x1024]
push eax
call fcn.0040ff76
lea eax, [ebp - 0x1024]
push eax
call fcn.004236f3
xor ecx, ecx
push 0x1e
push ecx
mov word [ebp + eax*2 - 0x1022], cx
lea eax, [ebp - 0x20]
push eax
call fcn.0041f4b0
add esp, 0x10
mov dword [ebp - 0x1c], 3
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1024]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41a77c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x43e610], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x41a7c7
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x45eca8], ax
xor eax, eax
mov word [0x45ecaa], ax
mov dword [0x43e610], 0x45eca8
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fe45
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x43e600
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x41aa10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041e4a0
cmp byte [0x44a470], 0
je 0x41aabe
push 0x800
lea eax, [ebp - 0x200c]
push eax
push dword [ebp + 8]
call fcn.0041bef0
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41aabe
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1000
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41aab5
mov eax, dword [ebp - 4]
mov ecx, 0x7ff
shr eax, 1
mov dword [ebp - 4], eax
cmp eax, ecx
jb 0x41aa99
mov eax, ecx
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.0040ff76
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 8
Function at 0x41ab76
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x2004
call fcn.0041e4a0
mov ecx, dword [esp + 0x2014]
push ebx
xor ebx, ebx
push esi
test ecx, ecx
je 0x41ab91
mov byte [ecx], bl
mov edx, dword [esp + 0x2020]
test edx, edx
je 0x41ab9e
mov byte [edx], bl
mov esi, dword [esp + 0x2010]
test esi, esi
je 0x41ac61
movzx eax, word [esi]
test ax, ax
je 0x41ac61
push ebp
mov ebp, dword [esp + 0x2018]
push edi
mov edi, dword [esp + 0x2020]
mov dword [esp + 0x10], ebx
movzx eax, ax
add esi, 2
cmp eax, 0x3d
jne 0x41abeb
test edi, edi
je 0x41abf5
test ebx, ebx
jne 0x41abf5
test ecx, ecx
je 0x41abe7
mov byte [ecx], 1
mov ebx, ebp
jmp 0x41ac0c
cmp eax, 0xd
je 0x41ac1f
cmp eax, 0xa
je 0x41ac22
mov word [ebp], ax
add ebp, 2
mov eax, dword [esp + 0x202c]
add eax, 0xfffffffe
cmp dword [esp + 0x10], eax
jge 0x41ac1a
movzx eax, word [esi]
inc dword [esp + 0x10]
test ax, ax
jne 0x41abcd
jmp 0x41ac22
mov byte [edx], 1
jmp 0x41ac22
add esi, 2
xor eax, eax
mov word [ebp], ax
test edi, edi
je 0x41ac5b
mov word [edi], ax
test ebx, ebx
je 0x41ac5b
push 0x1000
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [esp + 0x202c]
lea eax, [esp + 0x18]
push eax
push edi
call fcn.0040ff76
xor eax, eax
mov word [ebx], ax
pop edi
mov eax, esi
pop ebp
jmp 0x41ac63
xor eax, eax
pop esi
pop ebx
add esp, 0x2004
ret 0x18

Function at 0x41ac6e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
lea eax, [ebp - 4]
push eax
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
mov ebx, eax
neg ebx
sbb bl, bl
add bl, 1
je 0x41acc9
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [ebp - 4]
dec eax
neg eax
sbb al, al
lea ebx, [eax + 1]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
mov esi, dword [ecx + 0x14]
mov ecx, esi
call dword [0x433260]
call esi
pop esi
jmp 0x41acd1
mov eax, dword [ebp + 8]
xor ecx, ecx
mov word [eax], cx
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x41d1d3
Capabilities:
Hide graphical window

Disassembly:
and dword [0x448454], 0
push 1
push dword [esp + 8]
mov byte [0x448451], 1
mov byte [0x448452], 1
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 2
push dword [esp + 0xc]
call fcn.004012c8
cmp dword [0x44843c], 0
jne 0x41d213
cmp byte [0x448463], 0
je 0x41d21c
cmp dword [0x44845c], 0
jne 0x41d22f
push 0
push 1
push 0x111
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SendMessageW]
ret 4

Function at 0x41d32f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041e4a0
cmp byte [0x44a470], 0
je 0x41d3be
cmp word [0x44a472], 0
je 0x41d3be
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x44a472
call fcn.0041bef0
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41d3bd
push dword [ebp + 8]
call fcn.004236f3
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x41d3c4
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041e4a0
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.0040fcf8
mov esi, eax
test esi, esi
je 0x41d41c
movzx ecx, word [esi]
push ecx
jmp 0x41d407
add esi, 2
movzx eax, word [esi]
push eax
call fcn.0040fe11
test al, al
jne 0x41d400
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b008]
jne 0x40100a
repz ret
jmp fcn.00401828

Function at 0x406403
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403380
and dword [ebp - 4], 0
cmp dword [0x41d250], 0
mov ebx, eax
jne 0x4064b4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406565
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406565
push eax
call fcn.0040330e
mov dword [esp], 0x4189a8
push edi
mov dword [0x41d250], eax
call esi
push eax
call fcn.0040330e
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41d254], eax
call esi
push eax
call fcn.0040330e
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41d258], eax
call esi
push eax
call fcn.0040330e
pop ecx
mov dword [0x41d260], eax
test eax, eax
je 0x4064b4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040330e
pop ecx
mov dword [0x41d25c], eax
mov eax, dword [0x41d25c]
cmp eax, ebx
je 0x40650c
cmp dword [0x41d260], ebx
je 0x40650c
push eax
call fcn.00403389
push dword [0x41d260]
mov esi, eax
call fcn.00403389
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40650c
test edi, edi
je 0x40650c
call esi
test eax, eax
je 0x406503
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x406503
test byte [ebp - 0xc], 1
jne 0x40650c
or dword [ebp + 0x10], 0x200000
jmp 0x406545
mov eax, dword [0x41d254]
cmp eax, ebx
je 0x406545
push eax
call fcn.00403389
pop ecx
test eax, eax
je 0x406545
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x406545
mov eax, dword [0x41d258]
cmp eax, ebx
je 0x406545
push eax
call fcn.00403389
pop ecx
test eax, eax
je 0x406545
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41d250]
call fcn.00403389
pop ecx
test eax, eax
je 0x406565
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x406567
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x417a20
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x41b008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x512dfc]
push ebx
push esi
mov esi, dword [0x512c44]
mov ebx, eax
cmp eax, 0x5dd
jne 0x417a5d
push 0
lea eax, [ebp - 0x404]
push eax
push str.berajowototadosacirokavedevaparezeguvicaxajabaxiwosuf
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x41c000]
call fcn.00417900
cmp dword [0x512dfc], 0x2f
jne 0x417a78
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push esi
call fcn.00417940
add esp, 4
cmp dword [0x512dfc], 0x568
pop esi
pop ebx
jne 0x417aaa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
mov ecx, dword [ebp - 0x408]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetNumaProcessorNode]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
mov esp, ebp
pop ebp
ret
Function at 0x4020e0
Capabilities:
Query environment variable

Disassembly:
push ebp
push esp
pop ebp
push ebx
push esi
push edi
push 0
push 0
push dword [ebp + 8]
push ecx
pop esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push eax
pop edi
xor ebx, ebx
test edi, edi
jne 0x40210d
mov ecx, esi
call fcn.00402180
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
js 0x402172
mov eax, dword [esi]
push esi
pop esi
push 1
pop ecx
sub ecx, dword [eax - 4]
mov eax, dword [eax - 8]
sub eax, edi
or ecx, eax
jge 0x40212a
push edi
push esi
pop ecx
call fcn.00402530
push edi
push dword [esi]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [esi]
or eax, eax
jne 0x402140
xor ecx, ecx
jmp 0x402152
push dword [eax - 8]
push eax
call fcn.004036ac
push eax
pop ecx
add esp, 8
test ecx, ecx
js 0x402172
mov eax, dword [esi]
cmp ecx, dword [eax - 8]
jg 0x402172
mov dword [eax - 0xc], ecx
mov eax, dword [esi]
pop edi
sub edx, edx
pushfd
xor ebx, ebx
inc ebx
popfd
mov word [eax + ecx*2], dx
pop esi
push ebx
pop eax
pop ebx
pop ebp
ret 4
push 0x80070057
call fcn.00402bb0
int3

Function at 0x402a80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
push esp
pop ebp
push ebx
push edi
push edx
pop edi
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402a99
pop edi
pop ebx
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
pop esi
test esi, esi
je 0x402ad4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x402ad0
lea ebx, [ebx]
cmp esi, edx
jae 0x402ad4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x402ac0
cmp esi, edx
jb 0x402adb
pop esi
pop edi
xor eax, eax
pop ebx
pop ebp
ret
sub eax, eax
cmp word [esi], ax
cmove esi, eax
push esi
pop eax
pop esi
pop edi
pop ebx
pop ebp
ret