joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10102a80
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
sub esp, 8
mov dword [esp + 4], edx
cmp ecx, 0x80
jge 0x10102a9f
lea edx, [ecx - 0x41]
cmp edx, 0x19
lea eax, [ecx + 0x20]
cmova eax, ecx
add esp, 8
ret
cmp ecx, 0x10000
jge 0x10102b4a
push ebx
push ebp
xor edx, edx
mov ebx, 0xa2
push esi
push edi
mov dword [esp + 0x10], edx
or ebp, 0xffffffff
nop dword [eax]
lea eax, [edx + ebx]
mov esi, ecx
cdq
sub eax, edx
mov edi, eax
sar edi, 1
movzx edx, word [edi*4 + 0x1012a1b0]
lea eax, [edi - 1]
sub esi, edx
mov edx, edi
cmovs edx, ebp
test esi, esi
mov ebp, edx
lea edx, [edi + 1]
cmovs edx, dword [esp + 0x10]
cmovs ebx, eax
mov dword [esp + 0x10], edx
cmp ebx, edx
jge 0x10102ac0
movzx edx, word [ebp*4 + 0x1012a1b0]
movzx eax, byte [ebp*4 + 0x1012a1b3]
add eax, edx
cmp ecx, eax
jge 0x10102b2e
movzx eax, byte [ebp*4 + 0x1012a1b2]
xor edx, ecx
and edx, eax
test edx, 1
jne 0x10102b2e
shr eax, 1
movzx eax, word [eax*2 + 0x1012b618]
add eax, ecx
movzx ecx, ax
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
je 0x10102b58
xor edx, edx
cmp eax, 2
sete dl
add esp, 8
jmp fcn.100dbd30
lea eax, [ecx - 0x10400]
cmp eax, 0x27
lea eax, [ecx + 0x28]
jbe 0x10102b5a
mov eax, ecx
add esp, 8
ret

Function at 0x10111166
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10110de3
Function at 0x100014f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
jne 0x1000152a
cmp byte [0x10020dd0], 0
jne 0x1000152a
push 0
push 0
push dword [ebp + 8]
push 0x10001450
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x1000152a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x10020dd0], 1
mov eax, 1
pop ebp
ret 0xc
Function at 0x10004200
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1002000c]
xor eax, ebp
mov dword [ebp - 8], eax
cmp byte [0x100203a8], 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], ecx
je 0x100043d6
mov eax, dword [0x100203d8]
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x24], 0x7f7fffff
mov dword [ebp - 0x20], 0x7f7fffff
cmp eax, 1
jne 0x10004286
mov al, byte [ecx + 0x24]
and al, 1
jmp 0x100042a2
test eax, eax
jne 0x10004291
mov eax, 1
jmp 0x1000429d
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
and eax, 0x8000
test eax, eax
setne al
test al, al
je 0x100043d6
push ecx
push ebx
call fcn.100036f0
test al, al
je 0x100043d6
mov eax, dword [0x10020380]
sub eax, 0
je 0x100042da
sub eax, 1
je 0x100042d1
mov dword [ebp - 0x18], 0
jmp 0x100042e1
mov dword [ebp - 0x18], 2
jmp 0x100042e1
mov dword [ebp - 0x18], 1
mov esi, dword [0x10021244]
lea eax, [ebp - 0x18]
mov ecx, dword [0x10021240]
sub esi, ecx
push eax
mov eax, 0x66666667
imul esi
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
mov edx, dword [0x10021244]
push eax
call fcn.10002240
mov eax, dword [ebx]
lea ecx, [ebp - 0x14]
add esp, 8
push ecx
mov ecx, ebx
call dword [eax + 0x3b4]
mov eax, dword [0x10021244]
mov esi, dword [0x10021240]
mov dword [ebp - 0x4c], eax
cmp esi, eax
je 0x100043d6
nop word [eax + eax]
lea edx, [esi + 8]
lea ecx, [ebp - 0x14]
call fcn.10003520
test al, al
je 0x1000436d
mov ecx, dword [ebp - 0x48]
mov eax, dword [ecx]
call dword [eax + 0x5ec]
cmp eax, 0x40
jne 0x10004388
movss xmm0, dword [esi + 0x24]
comiss xmm0, dword [0x1001c858]
jbe 0x10004388
add esi, 0x28
cmp esi, dword [ebp - 0x4c]
jne 0x10004340
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.10017968
mov esp, ebp
pop ebp
ret 0xc
cmp byte [0x10020364], 0
mov edi, ebx
movups xmm0, xmmword [esi + 8]
mov eax, dword [esi]
mov dword [ebp - 0x44], eax
mov eax, dword [esi + 4]
movups xmmword [ebp - 0x3c], xmm0
mov dword [ebp - 0x40], eax
movups xmm0, xmmword [esi + 0x18]
movups xmmword [ebp - 0x2c], xmm0
je 0x100043bb
push 1
mov ecx, edi
call fcn.10001c20
test al, al
je 0x100043d6
mov esi, dword [ebp - 0x50]
lea eax, [ebp - 0x30]
push eax
push esi
push edi
call fcn.10003f00
cmp byte [0x100203c8], 0
je 0x100043d6
or dword [esi + 0x24], 1
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017968
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10014610
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [0x10020df0]
push ebx
push esi
push edi
mov eax, dword [ecx]
call dword [eax + 0x20]
mov edi, eax
test edi, edi
je 0x10014665
mov ebx, dword [ebp + 8]
nop word [eax + eax]
mov ecx, dword [edi + 8]
mov esi, 0x1505
movsx edx, byte [ecx]
inc ecx
test edx, edx
je 0x10014654
mov eax, esi
lea ecx, [ecx + 1]
shl esi, 5
add esi, edx
movsx edx, byte [ecx - 1]
add esi, eax
test edx, edx
jne 0x10014640
push ebx
call fcn.10014ed0
cmp eax, esi
je 0x1001466e
mov edi, dword [edi + 0x10]
test edi, edi
jne 0x10014630
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
push dword [ebp + 0xc]
push dword [edi + 0xc]
call fcn.10014680
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10014680
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x1002000c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x44], eax
cmp dword [ecx + 4], edi
jle 0x1001472b
xor ebx, ebx
nop dword [eax]
mov eax, dword [ecx]
mov esi, 0x1505
add eax, ebx
movups xmm0, xmmword [eax + 0x10]
movups xmm1, xmmword [eax]
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [eax + 0x20]
movups xmmword [ebp - 0x20], xmm0
movq xmm0, qword [eax + 0x30]
movd eax, xmm1
movq qword [ebp - 0x10], xmm0
movsx edx, byte [eax]
lea ecx, [eax + 1]
test edx, edx
je 0x100146f8
mov eax, esi
lea ecx, [ecx + 1]
shl esi, 5
add esi, edx
movsx edx, byte [ecx - 1]
add esi, eax
test edx, edx
jne 0x100146e4
push dword [ebp - 0x44]
call fcn.10014ed0
cmp esi, eax
je 0x10014758
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1001471f
push dword [ebp - 0x44]
mov ecx, 0x10020e6c
push eax
call fcn.10014680
mov ecx, eax
test ecx, ecx
jne 0x10014740
mov ecx, dword [ebp - 0x48]
inc edi
add ebx, 0x3c
cmp edi, dword [ecx + 4]
jl 0x100146b0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017968
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp - 0x14]
pop edi
pop esi
add eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017968
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10017968
mov esp, ebp
pop ebp
ret 8

Function at 0x10014ed0
Capabilities:
Hash data using djb2

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, 0x1505
push esi
movsx esi, byte [edx]
inc edx
test esi, esi
je 0x10014ef8
mov ecx, eax
lea edx, [edx + 1]
shl eax, 5
add eax, esi
movsx esi, byte [edx - 1]
add eax, ecx
test esi, esi
jne 0x10014ee4
pop esi
pop ebp
ret 4
Function at 0x10015830
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1002000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 4
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x10015943
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1001593c
mov ebx, 1
nop dword [eax]
cmp dword [ebp - 0x20], 0x10
jb 0x100158ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x14], eax
jne 0x100158ff
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp - 0x18], eax
je 0x100158ff
mov edx, dword [esi]
test edx, edx
jne 0x100158c8
push 0x200
push edx
push dword [0x1002103c]
mov dword [esi + 4], 0x80
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edx, eax
mov dword [esi], edx
test edx, edx
je 0x10015924
lea edi, [esi + 8]
jmp 0x100158f2
mov eax, dword [esi + 4]
lea edi, [esi + 8]
cmp dword [edi], eax
jb 0x100158f2
add eax, eax
mov dword [esi + 4], eax
shl eax, 2
push eax
push edx
push 0
push dword [0x1002103c]
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov edx, eax
test edx, edx
je 0x10015956
mov dword [esi], edx
mov ecx, dword [edi]
mov eax, dword [ebp - 0x18]
mov dword [edx + ecx*4], eax
inc dword [edi]
mov edi, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x10015880
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
je 0x1001593c
mov eax, dword [esi]
xor ebx, ebx
test eax, eax
je 0x1001593c
push eax
push ebx
push dword [0x1002103c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017968
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x24]
jmp 0x10015924

Function at 0x10015960
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov dword [edi], 0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
call fcn.10015830
test eax, eax
jne 0x10015991
mov eax, 9
pop edi
mov esp, ebp
pop ebp
ret
cmp dword [edi], 0
je 0x100159e2
push esi
xor esi, esi
cmp dword [edi + 8], esi
jbe 0x100159da
push ebx
nop
mov eax, dword [edi]
push dword [eax + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov ebx, eax
test ebx, ebx
je 0x100159d3
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
mov edx, dword [ebp - 4]
mov ecx, ebx
call fcn.100156c0
add esp, 4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [edi + 8]
jb 0x100159a0
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100159f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1002000c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
imul esi, ecx, 0x2c
mov ebx, edx
push edi
add esi, dword [0x10022260]
mov eax, dword [esi]
mov cl, byte [esi + 0x14]
and cl, 1
lea edi, [eax - 5]
cmove edi, eax
movzx eax, cl
lea ecx, [ebp - 8]
push ecx
push 0x40
lea eax, [eax*2 + 5]
push eax
push edi
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10015a51
pop edi
pop esi
mov eax, 0xa
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10017968
mov esp, ebp
pop ebp
ret
test ebx, ebx
je 0x10015a72
mov byte [edi], 0xe9
mov eax, dword [esi + 4]
sub eax, edi
sub eax, 5
mov dword [edi + 1], eax
test byte [esi + 0x14], 1
je 0x10015a93
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x10015a93
mov eax, dword [esi + 0xc]
test byte [esi + 0x14], 1
mov dword [edi], eax
je 0x10015a8d
mov ax, word [esi + 0x10]
mov word [edi + 4], ax
mov al, byte [esi + 0x12]
mov byte [edi + 6], al
jmp 0x10015a93
mov al, byte [esi + 0x10]
mov byte [edi + 4], al
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov cl, bl
xor eax, eax
add cl, cl
shl bl, 2
xor cl, byte [esi + 0x14]
and cl, 2
xor cl, byte [esi + 0x14]
xor bl, cl
and bl, 4
xor bl, cl
mov ecx, dword [ebp - 4]
pop edi
mov byte [esi + 0x14], bl
xor ecx, ebp
pop esi
pop ebx
call fcn.10017968
mov esp, ebp
pop ebp
ret
Function at 0x10015af0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [0x10022268]
sub esp, 0x10
push ebx
push esi
xor esi, esi
mov ebx, ecx
test edx, edx
je 0x10015b24
mov eax, dword [0x10022260]
add eax, 0x14
nop
movzx ecx, byte [eax]
shr ecx, 1
and ecx, 1
cmp ecx, ebx
jne 0x10015b2c
inc esi
add eax, 0x2c
cmp esi, edx
jb 0x10015b10
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp esi, 0xffffffff
je 0x10015be2
test ebx, ebx
lea ecx, [ebp - 0x10]
setne al
or edx, 0xffffffff
push eax
call fcn.10015960
add esp, 4
mov dword [ebp - 4], eax
test eax, eax
jne 0x10015be2
mov ecx, dword [0x10022268]
push edi
cmp esi, ecx
jae 0x10015b9a
imul edi, esi, 0x2c
mov eax, dword [0x10022260]
movzx eax, byte [edi + eax + 0x14]
shr eax, 1
and eax, 1
cmp eax, ebx
je 0x10015b8f
mov edx, ebx
mov ecx, esi
call fcn.100159f0
mov dword [ebp - 4], eax
test eax, eax
jne 0x10015b9a
mov ecx, dword [0x10022268]
jmp 0x10015b92
mov eax, dword [ebp - 4]
inc esi
add edi, 0x2c
cmp esi, ecx
jb 0x10015b64
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x10015be1
xor esi, esi
cmp dword [ebp - 8], esi
jbe 0x10015bcf
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov edi, eax
test edi, edi
je 0x10015bc9
push edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [ebp - 8]
jb 0x10015ba8
push ebx
push 0
push dword [0x1002103c]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5be9a2
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
add dword [eax], 0
push ebx
push esi
push edi
mov dword [ebp - 0x66], ecx
add byte [ebp - 0x30], dl
mov dword [ebp - 0x2c], eax
mov eax, 0x1c
call 0x8ea8954e
add byte [ebp - 0x2c], dl
mov eax, dword [edx + 0x2f0]
add dl, dl
call 0x7a340fe
add byte [0x9cdc6c], bh
add byte [eax + eax], dh
xor eax, 0x9cdc6c
mov al, byte [0x54eb00]
push dword [0xdc6c]
call fcn.00b0d1e6
enter 0x4500, 0xffffffffffffffe8
or byte [eax], al
cmp dword [0x50], 1
je 0x5cc3a3
mov ecx, dword [ebp - 0x2c]
cmp byte [ecx + 0x8b], 0
je 0x5bea54
mov ebx, dword [edx]
call fcn.005ec1b6
test al, al
add byte [eax], al
mov word [ebp - 0x18], 0x6014
add byte [edx], al
popal
xchg ebp, eax
add byte [ebp + 0xfc45], cl
pop edx
dec ebp
add bh, bh
inc ebp
mov al, byte [0x68ba0000]
sbb eax, dword [eax]
add al, ch
add byte [eax], al
add eax, dword [eax]
dec dword [ebp - 0xc]
retf 0xfc00
mov eax, dword [ebp]
add byte [edx], dh
add eax, dword fs:[eax]
mov ebx, dword [edi]
add al, ch
invalid
push ss
ret 0xf8fc
stc
push edx
mov al, byte [0xb242c222]
bound ebx, qword [0x558e4652]
push cs
outsd dx, dword [esi]
ljmp 0xf000
mov dword [0xcf436d5f], eax
push esp
add edx, dword [edx - 0x47b6c4fd]
or esi, dword [ecx + 0x72b39db4]
inc edx
add byte [ebx], 0xe4
pushfd
inc ebp
jnp 0x5cc3f0
adc bh, byte [eax + 0x33]
adc eax, 0xb90c6623
xlatb
loopne 0x5cc3e3
adc edi, ebx
and edi, ecx
xor al, byte [edx - 0x1fb37f38]
loope 0x5cc42d
jbe 0x5cc414
pushal
pop edx
push eax
xchg esi, eax
loop 0x5cc386
xlatb
xchg dword [eax + edx*8], ebp
loop 0x5cc41e
cmp bh, cl
add bh, byte [edi + edx*8 - 0x1d]
xchg esp, eax
jl 0x5cc3bb
xlatb
jecxz 0x5cc37a
bnd ret
push edx
jecxz 0x5cc468
push ebp
push 0xffffffffffffff92
push ss
fmul dword [esi]
add byte [ecx - 0x2e], 0x7c
outsb dx, byte [esi]
call dword [edx + 0x12df0c33]
and byte [ecx], 2
or eax, 0xf924554
pop eax
jl 0x5cc39e
cmp bh, byte [ebp - 0x3d7e7c80]
mov esp, 0xdcccba9b
push ss
salc
and esp, dword [edi]
ret 0x9bbc
xor ebp, esi
shr esi, 0x4a
sbb esp, ecx
pop esi
add al, dl
sal byte [edx - 0x7d], cl
popal
psraw mm6, qword [ebx + 0x47830372]
std
loope 0x5cc3e2
jb 0x5cc434
add dword [edi - 3], 0xffffffae
scasb al, byte es:[edi]
fbstp tbyte [edi - 0x6d]
sub eax, 0xc49133c2
or eax, 0x9ae38cc6
nop
sar byte [0x9ffb737e], cl
cwde
cmpsb byte [esi], byte es:[edi]
mov dh, 0xa7
inc eax
mov dl, 0x38
push 0xa51263d3
out 0x90, al
mov dword [0xbe4ceb98], eax
xlatb
xchg edx, eax
cdq
push 0x57bc1cac
fld xword [eax]
or edx, edx
adc ecx, dword [edx - 0x73]
loope 0x5cc48d
ret 0x62f3
push 0x9a4f609f
adc ebx, dword [esi - 0x4dfea39d]
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp + 0x94], eax
mov eax, dword [ebp + 0xa0]
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x74]
push eax
push 1
xor ebx, ebx
push ebx
push str.SoftwareWinRAR
mov edi, 0x80000002
push edi
mov byte [ebp - 0x70], bl
call esi
test eax, eax
jne 0x401075
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push str.exe32
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x70], bl
jne 0x4010bd
lea eax, [ebp - 0x74]
push eax
push 1
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsWinRAR.exe
push edi
call esi
test eax, eax
jne 0x4010b8
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push 0x408198
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x70], bl
je 0x4010f7
lea eax, [ebp - 0x70]
push 0x5c
push eax
call fcn.00401790
pop ecx
pop ecx
cmp eax, ebx
je 0x4010f7
mov edi, dword [ebp - 0x7c]
mov byte [eax], bl
lea eax, [ebp - 0x70]
mov edx, edi
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x4010dc
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x4010e7
mov esi, str._rarext.dll
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004017bd
add ebp, 0x98
leave
ret 4

Function at 0x4017bd
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x4017c7
repz ret
jmp fcn.00401e11
Function at 0x4024e6
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x40a018]
je 0x402501
inc edi
cmp edi, 0x17
jb 0x4024f2
cmp edi, 0x17
jae 0x402681
push ebp
push 3
call fcn.004043e0
pop ecx
cmp eax, 1
je 0x40264d
push 3
call fcn.004043e0
pop ecx
test eax, eax
jne 0x402535
cmp dword [0x40a010], 1
je 0x40264d
cmp ebx, 0xfc
je 0x402680
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x40b0e8
push ebp
call fcn.0040437b
add esp, 0xc
test eax, eax
je 0x40256b
push esi
push esi
push esi
push esi
push esi
call fcn.00403993
add esp, 0x14
push 0x104
mov esi, 0x40b101
push esi
push 0
mov byte [0x40b205], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4025af
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040437b
add esp, 0xc
test eax, eax
je 0x4025af
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00403993
add esp, 0x14
push esi
call fcn.004042f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4025f4
push esi
call fcn.004042f0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x40b3fc
push 0x40882c
sub ecx, eax
push ecx
push eax
call fcn.00404238
add esp, 0x14
test eax, eax
je 0x4025f4
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00403993
add esp, 0x14
jmp 0x4025f6
xor esi, esi
push 0x408828
push ebx
push ebp
call fcn.004041c7
add esp, 0xc
test eax, eax
je 0x402616
push esi
push esi
push esi
push esi
push esi
call fcn.00403993
add esp, 0x14
push dword [edi*8 + 0x40a01c]
push ebx
push ebp
call fcn.004041c7
add esp, 0xc
test eax, eax
je 0x402638
push esi
push esi
push esi
push esi
push esi
call fcn.00403993
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00404060
add esp, 0xc
jmp 0x402680
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x402680
cmp ebp, 0xffffffff
je 0x402680
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x40a01c]
push dword [esi]
call fcn.004042f0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x402b78
Capabilities:
Query environment variable

Disassembly:
push ecx
push ecx
mov eax, dword [0x40b508]
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebx, ebx
xor esi, esi
push 2
pop ebp
cmp eax, ebx
jne 0x402bc1
call edi
mov esi, eax
cmp esi, ebx
je 0x402ba8
mov dword [0x40b508], 1
jmp 0x402bca
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x78
jne 0x402bbc
mov eax, ebp
mov dword [0x40b508], eax
jmp 0x402bc1
mov eax, dword [0x40b508]
cmp eax, 1
jne 0x402c4e
cmp esi, ebx
jne 0x402bdd
call edi
mov esi, eax
cmp esi, ebx
jne 0x402bdd
xor eax, eax
jmp 0x402ca6
mov eax, esi
cmp word [esi], bx
je 0x402bf2
add eax, ebp
cmp word [eax], bx
jne 0x402be4
add eax, ebp
cmp word [eax], bx
jne 0x402be4
mov edi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
push ebx
push ebx
sub eax, esi
push ebx
sar eax, 1
inc eax
push eax
push esi
push ebx
push ebx
mov dword [esp + 0x34], eax
call edi
mov ebp, eax
cmp ebp, ebx
je 0x402c43
push ebp
call fcn.00404c6b
pop ecx
mov dword [esp + 0x10], eax
cmp eax, ebx
je 0x402c43
push ebx
push ebx
push ebp
push eax
push dword [esp + 0x24]
push esi
push ebx
push ebx
call edi
test eax, eax
jne 0x402c3f
push dword [esp + 0x10]
call fcn.00404bdd
pop ecx
mov dword [esp + 0x10], ebx
mov ebx, dword [esp + 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
jmp 0x402ca6
cmp eax, ebp
je 0x402c56
cmp eax, ebx
jne 0x402bd6
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
mov esi, eax
cmp esi, ebx
je 0x402bd6
cmp byte [esi], bl
je 0x402c74
inc eax
cmp byte [eax], bl
jne 0x402c6a
inc eax
cmp byte [eax], bl
jne 0x402c6a
sub eax, esi
inc eax
mov ebp, eax
push ebp
call fcn.00404c6b
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x402c92
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
jmp 0x402bd6
push ebp
push esi
push edi
call fcn.00401900
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret