joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402224
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4145c0], eax
cmp byte [0x4145bc], 0
jne 0x40225c
call fcn.004019a8
test al, al
jne 0x40225c
mov dword [0x4145c0], 8
mov dword [ebp - 4], 8
jmp 0x4023bd
xor ecx, ecx
push ebp
push 0x4023b6
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x414045], 0
je 0x40227d
push 0x4145c4
call sub.KERNEL32.DLL_TlsGetValue
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x402298
mov dword [0x4145c0], 9
jmp 0x40238d
dec dword [0x4145ac]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4145b0], eax
test bl, 1
je 0x4022f8
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x4022c8
test edx, 0x80000003
je 0x4022d7
mov dword [0x4145c0], 0xa
jmp 0x40238d
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4022ef
mov dword [0x4145c0], 0xa
jmp 0x40238d
add ebx, edx
mov esi, eax
call fcn.00401b4c
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x414618]
jne 0x402338
sub dword [0x414618], ebx
add dword [0x414614], ebx
cmp dword [0x414614], 0x3c00
jle 0x402329
call fcn.00401e3c
xor eax, eax
mov dword [ebp - 4], eax
call fcn.004038d8
jmp 0x4023bd
mov edx, dword [eax]
test dl, 2
je 0x40235b
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402356
mov dword [0x4145c0], 0xb
jmp 0x40238d
or dword [eax], 1
jmp 0x402384
mov eax, edi
cmp dword [eax + 4], 0
je 0x40236e
cmp dword [eax], 0
je 0x40236e
cmp dword [eax + 8], 0xc
jge 0x40237a
mov dword [0x4145c0], 0xb
jmp 0x40238d
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401b4c
mov edx, ebx
mov eax, esi
call fcn.00401db4
mov eax, dword [0x4145c0]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4023bd
cmp byte [0x414045], 0
je 0x4023b5
push 0x4145c4
call sub.KERNEL32.DLL_TlsSetValue
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x402cc0
Capabilities:
Copy file

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor edx, edx
mov ebx, eax
mov dx, word [eax + 4]
sub edx, 0xd7b0
je 0x402cec
cmp edx, 3
ja 0x402d82
call dword [ebx + 0x24]
test eax, eax
je 0x402cec
call fcn.0040277c
mov word [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x402c98
mov dword [ebx + 0x1c], 0x402894
cmp byte [ebx + 0x48], 0
je 0x402d69
mov eax, 0xc0000000
mov dl, byte [0x413008]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x413064]
mov ecx, 2
sub edi, 3
je 0x402d4b
mov ecx, 3
inc edi
je 0x402d4b
mov eax, 0x40000000
inc edi
mov word [ebx + 4], 0xd7b2
je 0x402d4b
mov eax, 0x80000000
mov word [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_VirtualFree
cmp eax, 0xffffffff
je 0x402d89
mov dword [ebx], eax
jmp 0x402d99
mov dword [ebx + 0x24], 0x402894
cmp edi, 3
je 0x402d79
push 0xfffffffffffffff6
jmp 0x402d7b
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_CopyFileA
jmp 0x402d60
mov eax, 0x66
jmp 0x402d94
mov word [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_GetFullPathNameA
call fcn.0040277c
pop edi
pop esi
pop ebx
ret

Function at 0x403c50
Capabilities:
Copy file

Disassembly:
push ecx
cmp byte [0x414044], 0
je 0x403cb1
cmp word [0x414218], 0xd7b2
jne 0x403c79
cmp dword [0x414220], 0
jbe 0x403c79
mov eax, 0x414214
call dword [0x414230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x41308c
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_CopyFileA
push eax
call sub.KERNEL32.DLL_FormatMessageA
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403cd8
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_CopyFileA
push eax
call sub.KERNEL32.DLL_FormatMessageA
pop edx
ret
cmp byte [0x41302c], 0
jne 0x403ccd
push 0
push 0x413084
push 0x41308c
push 0
call sub.KERNEL32.DLL_InterlockedIncrement
pop edx
ret

Function at 0x404c6c
Capabilities:
Read file on windows

Disassembly:
add esp, 0xffffffe4
push 0x1c
lea edx, [esp + 4]
push edx
push eax
call sub.KERNEL32.DLL_ReadFile
cmp dword [esp + 0x10], 0x1000
jne 0x404c8c
mov eax, dword [esp + 4]
jmp 0x404c8e
xor eax, eax
add esp, 0x1c
ret
Function at 0x404d18
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
push 0x404eac
call sub.KERNEL32.DLL_GetLocaleInfoA
mov esi, eax
test esi, esi
je 0x404d80
push 0x404ebc
push esi
call sub.KERNEL32.DLL_GetModuleFileNameA
mov ebx, eax
test ebx, ebx
je 0x404d80
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x404d80
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetThreadLocale
jmp 0x404ea2
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x404dc0
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x404ea2
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00404d04
mov esi, eax
cmp byte [esi], 0
je 0x404ea2
lea eax, [esi + 1]
call fcn.00404d04
mov esi, eax
cmp byte [esi], 0
je 0x404ea2
jmp 0x404dc6
mov esi, dword [ebp - 4]
add esi, 2
mov ebx, esi
sub ebx, dword [ebp - 4]
lea eax, [ebx + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetThreadLocale
jmp 0x404e85
lea eax, [esi + 1]
call fcn.00404d04
mov edi, eax
mov eax, edi
sub eax, esi
mov edx, eax
add edx, ebx
inc edx
cmp edx, 0x105
jg 0x404ea2
inc eax
push eax
push esi
lea eax, [ebp - 0x24f]
add eax, ebx
push eax
call sub.KERNEL32.DLL_GetThreadLocale
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetCurrentThreadId
mov esi, eax
cmp esi, 0xffffffff
je 0x404ea2
push esi
call sub.KERNEL32.DLL_GetCPInfo
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetVersionExA
lea edx, [ebx + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x404ea2
mov byte [ebp + ebx - 0x24f], 0x5c
mov eax, 0x105
sub eax, ebx
dec eax
push eax
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, ebx
inc eax
push eax
call sub.KERNEL32.DLL_GetThreadLocale
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetVersionExA
inc eax
add ebx, eax
mov esi, edi
cmp byte [esi], 0
jne 0x404de4
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetThreadLocale
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412668
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov byte [ebp - 1], cl
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x41276d
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.00403e64
mov eax, dword [ebp - 0xc]
call fcn.00412520
mov ebx, eax
test bl, bl
jne 0x4126b4
lea eax, [ebp - 0xc]
mov ecx, 1
mov edx, 1
call fcn.004042f8
xor eax, eax
mov dword [ebp - 8], eax
cmp byte [ebp - 1], 0
je 0x4126c5
cmp dword [ebp - 0xc], 0
jne 0x4126ef
lea eax, [ebp - 8]
push eax
mov eax, dword [esi + 0x18]
push eax
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404258
push eax
mov edx, ebx
mov eax, esi
call fcn.00412654
push eax
call sub.oleaut32.dll_SysAllocStringLen
test eax, eax
sete byte [ebp - 2]
jmp 0x412721
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [esi + 0x18]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404258
push eax
mov edx, ebx
mov eax, esi
call fcn.00412654
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 2]
cmp byte [ebp - 2], 0
je 0x412757
cmp dword [esi + 4], 0
setne al
test al, bl
je 0x41274a
push dword [esi + 0x10]
push 0x412788
push dword [ebp - 0xc]
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404128
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov eax, esi
call fcn.00412630
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412774
lea eax, [ebp - 0xc]
call fcn.00403dcc
ret

Function at 0x4128e0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaa0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov esi, eax
lea ebx, [ebp - 0x10]
xor eax, eax
push ebp
push 0x412a21
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x14]
mov eax, 0x412a3c
call fcn.004071f4
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
call fcn.00404258
push eax
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x412a04
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.00404258
push eax
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4129e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, edi
lea eax, [ebp - 0x560]
call fcn.00402ab0
mov edx, 1
lea eax, [ebp - 0x560]
call fcn.00402da0
call fcn.0040275c
push ebx
push 0x400
lea eax, [ebp - 0x414]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetReadFile
push 0
lea edx, [ebp - 0x414]
mov ecx, dword [ebx]
lea eax, [ebp - 0x560]
call fcn.00402c00
call fcn.0040275c
cmp dword [ebx], 0
jne 0x412986
lea eax, [ebp - 0x560]
call fcn.00402c20
call fcn.0040275c
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4129ed
mov eax, dword [ebp - 0xc]
push eax
call sub.wininet.dll_InternetCloseHandle
ret
Function at 0x29a0f42d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x29a0f43c
pop dword [ebp - 0x50]
mov eax, 0x29a0f43c
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x8ac3da55
sub dword [ebp - 0x60], 0x3c71950a
mov dword [ebp - 0x5c], 0xfd27e3b6
add dword [ebp - 0x5c], 0x350b688f
mov dword [ebp - 0x58], 0xe117063f
add dword [ebp - 0x58], 0x6b353def
mov dword [ebp - 0x54], 0xd232a9a1
add dword [ebp - 0x54], 0x2dcd565f
lea eax, [ebp - 0x60]
push eax
mov eax, 0xa9e9988c
add eax, 0x7fb7a800
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe1eee4f1
sub dword [ebp - 0x60], 0x6d7c7b9b
mov dword [ebp - 0x5c], 0x20285024
add dword [ebp - 0x5c], 0x21441151
mov dword [ebp - 0x58], 0x4ea1246c
sub dword [ebp - 0x58], 0xeb31b800
mov dword [ebp - 0x54], 0xaeb66111
sub dword [ebp - 0x54], 0xaeb66111
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c7ab
push 0
call eax
mov ecx, 0x1444b18a
add ecx, 0xebbb9ef0
xor edi, edi
add edi, eax
mov ebx, 0xf21bc5d3
add ebx, 0x37865a2d
add ebx, dword [ebp - 0x50]
mov edx, 0x2bf4db14
sub edx, 0x70ead5b5
xor dword [ebp - 0x30], 0x8a589e3b
mov esi, dword [ebx]
xor dword [ebp - 0x4c], 0x8aaee9e9
sub esi, edx
sub dword [ebp - 0x40], edx
mov dword [edi], esi
mov dword [ebp - 0x30], 0x4f8c46db
add edi, 4
add ebx, 0x140c182b
sub ebx, 0x140c1827
loop 0x29a0f556
add eax, 0x134bb
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd81e3e52
sub ecx, 0xae7e3e52
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x402ed5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x402ee4
pop dword [ebp - 0x48]
mov eax, 0x181b9a1f
sub eax, 0x17db6b3b
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x4b1b8818
sub dword [ebp - 0x58], 0xfcc942cd
mov dword [ebp - 0x54], 0xdcfde6ea
sub dword [ebp - 0x54], 0xaaca9aa5
mov dword [ebp - 0x50], 0x21b2d474
add dword [ebp - 0x50], 0x2a996fba
mov dword [ebp - 0x4c], 0xfda387b6
sub dword [ebp - 0x4c], 0xfda387b6
lea eax, [ebp - 0x58]
push eax
mov eax, 0x2b962c5b
add eax, 0xd4aa54a9
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xc1545786
sub dword [ebp - 0x58], 0x4ce1ee30
mov dword [ebp - 0x54], 0x8f2d65ee
sub dword [ebp - 0x54], 0x4dc10479
mov dword [ebp - 0x50], 0xc4f8dba5
add dword [ebp - 0x50], 0x9e7690c7
mov dword [ebp - 0x4c], 0x4aa2a8e0
add dword [ebp - 0x4c], 0xb55d5720
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3ae3f
push 0
call eax
mov ecx, 0xb57f81dd
sub ecx, 0xb57f2a72
mov edi, eax
mov esi, 0x3e0faa5c
add esi, 0xc23739a4
add esi, dword [ebp - 0x48]
mov ebx, 0x73a37c1c
sub ebx, 0xe2366764
add dword [ebp - 0x10], 0xa2aaff56
mov edx, dword [esi]
xor dword [ebp - 0x2c], 0xe8566b3d
sub edx, ebx
add dword [ebp - 0x18], ecx
mov dword [edi], edx
sub dword [ebp - 0x30], edx
add edi, 0xb60d63f9
add edi, 0x49f29c0b
add esi, 0x8cf524a4
sub esi, 0x8cf524a0
loop 0x403001
add eax, 0x1507f
xor ebx, ebx
add ebx, eax
add eax, 0x5212d968
add eax, 0xaded269d
mov ecx, 0x9dd2aa73
add ecx, 0x626d558d
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x40180f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x40181e
pop dword [ebp - 0x34]
mov eax, 0x3dd3b70c
sub eax, 0x3d939eee
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x9a4002d5
sub dword [ebp - 0x44], 0x4bedbd8a
mov dword [ebp - 0x40], 0x39578afc
sub dword [ebp - 0x40], 0x7243eb7
mov dword [ebp - 0x3c], 0x691ee554
add dword [ebp - 0x3c], 0xe32d5eda
mov dword [ebp - 0x38], 0xa3280633
add dword [ebp - 0x38], 0x5cd7f9cd
lea eax, [ebp - 0x44]
push eax
mov eax, 0xc3e2891b
sub eax, 0xc3a1b8cf
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x2f074fc3
sub dword [ebp - 0x44], 0xba94e66d
mov dword [ebp - 0x40], 0x5da341c9
sub dword [ebp - 0x40], 0x1c36e054
mov dword [ebp - 0x3c], 0x664f9711
sub dword [ebp - 0x3c], 0x2e02aa5
mov dword [ebp - 0x38], 0x751b2695
add dword [ebp - 0x38], 0x8ae4d96b
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xa21dc8ef
add eax, 0x5e230759
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x35e29
push 0
call eax
mov ecx, 0xd73cbe3f
sub ecx, 0xd73c853d
xor ebx, ebx
add ebx, eax
mov esi, 0x41b000
add esi, dword [ebp - 0x34]
mov edx, 0x5bedd47b
sub edx, 0x860bed7d
add dword [ebp - 0x28], esi
mov edi, dword [esi]
xor dword [ebp - 0x10], edi
xor edi, edx
sub dword [ebp - 0x24], esi
mov dword [ebx], edi
add dword [ebp - 0x30], 0x5a2007b5
add ebx, 0x7b89373d
add ebx, 0x8476c8c7
add esi, 4
loop 0x40193c
add eax, 0xd6db
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x401b66
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x401b70
repz ret
jmp fcn.0040324d
Function at 0x4010a9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4225d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
xor eax, eax
mov dword [0x424c48], eax
mov dword [0x424c4c], eax
mov dword [0x424c50], eax
mov dword [0x424c54], eax
mov dword [0x424c58], eax
mov dword [0x424c5c], eax
mov dword [0x424c60], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x401109
push 0x1ad
push str.sfxhead.c
call fcn.00402080
pop ecx
pop ecx
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jne 0x401129
cmp dword [ebp - 0x18], 0xa
jb 0x401166
cmp dword [ebp - 0x18], 0x5a
mov dword [0x424c48], eax
jb 0x401166
mov dword [0x424c4c], eax
jmp 0x401166
cmp dword [ebp - 0x10], 2
jne 0x401166
cmp dword [ebp - 0x1c], 5
mov dword [0x424c50], eax
jb 0x401166
mov dword [0x424c54], eax
jne 0x401156
cmp dword [ebp - 0x18], 2
jne 0x40114c
mov dword [0x424c58], eax
cmp dword [ebp - 0x18], eax
jb 0x401166
mov dword [0x424c5c], eax
cmp dword [ebp - 0x1c], 6
jb 0x401166
mov dword [0x424c5c], eax
mov dword [0x424c60], eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.0040ccb6
add ebp, 0x78
leave
ret

Function at 0x401405
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0040123f
pop ecx
push dword [esp + 0xc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
dec esi
neg esi
sbb esi, esi
neg esi
test edi, edi
je 0x401439
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0040129b
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x401563
Capabilities:
Query environment variable

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
ret

Function at 0x401576
Capabilities:
Hash data with crc32

Disassembly:
push esi
push 8
xor eax, eax
add ecx, ecx
pop esi
sar ecx, 1
mov edx, eax
xor edx, ecx
shr eax, 1
test dl, 1
je 0x401590
xor eax, 0xedb88320
dec esi
test esi, esi
jg 0x40157e
pop esi
ret

Function at 0x4015b3
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
mov eax, dword [0x423bec]
je 0x4015e3
mov ecx, dword [esp + 4]
push esi
movzx edx, byte [ecx]
dec dword [esp + 0xc]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4237e8]
inc ecx
cmp dword [esp + 0xc], 0
jne 0x4015c4
pop esi
mov dword [0x423bec], eax
ret
Function at 0x4017f9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, str.sfxhead.c
jne 0x401817
push 0xc61
push esi
call fcn.00402080
pop ecx
pop ecx
cmp dword [ebp + 0xc], 0
jg 0x40182a
push 0xc62
push esi
call fcn.00402080
pop ecx
pop ecx
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00401379
add esp, 0xc
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [0x424c90]
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
pop esi
jge 0x401856
xor al, al
leave
ret
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00401716
add esp, 0xc
lea eax, [ebp - 8]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 8]
test eax, eax
je 0x40188a
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, 1
leave
ret
Function at 0x402080
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x220]
sub esp, 0x2a0
mov eax, dword [0x4225d0]
xor eax, ebp
mov dword [ebp + 0x21c], eax
mov ecx, dword [0x424ca4]
inc dword [0x424ca4]
test ecx, ecx
mov eax, dword [ebp + 0x228]
push ebx
push esi
push edi
je 0x4020bc
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x22c]
mov ecx, 0x7d4
push eax
call fcn.004022f8
push eax
mov ebx, 0x191
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0040d2ab
add esp, 0x14
cmp eax, 0xffffffff
jne 0x4020f4
push 0xc89
push str.sfxhead.c
call fcn.00402080
push 0x30
mov ecx, 0x7d0
call fcn.004022f8
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x424c90]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
mov esi, 0x104
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.004017f9
lea eax, [ebp + 0x118]
push eax
call fcn.0040d220
add esp, 0x10
test eax, eax
je 0x40214d
push 0x418328
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.0040cd8b
add esp, 0xc
mov edi, str.WZSFX32.RPT
push edi
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.0040cd8b
add esp, 0xc
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4020b4
push 0x418344
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0040cd8b
push eax
call section..text
add esp, 0x10
test al, al
jne 0x4021b5
push 0xc9a
push str.sfxhead.c
call fcn.00402080
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040d220
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.0040188e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 0x7d1
call fcn.004022f8
push eax
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0040d2ab
add esp, 0x10
cmp eax, 0xffffffff
jne 0x40220c
push 0xca2
push str.sfxhead.c
call fcn.00402080
push 0x30
mov ecx, 0x7d0
call fcn.004022f8
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x424c90]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4020b4
Function at 0x402617
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4225d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0040d220
cmp eax, 2
pop ecx
je 0x402642
push 0x494
push str.sfxhead.c
call fcn.00402080
push esi
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.0040d2c7
push eax
call section..text
add esp, 0x10
test al, al
jne 0x402662
push 0x495
jmp 0x402638
push 0x418328
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.0040d2c7
push eax
call section..text
add esp, 0x10
test al, al
jne 0x402686
push 0x496
jmp 0x402638
lea eax, [ebp - 0xc]
push eax
call fcn.0040d220
cmp eax, 8
pop ecx
jae 0x402724
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x20
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4026c6
or ax, 0xffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0040ccb6
leave
ret
push 7
lea eax, [ebp - 0x2c]
push str.PKBACK
push eax
call fcn.0040134e
add esp, 0xc
test eax, eax
jne 0x4026b5
mov al, byte [ebp - 0x2c]
cmp al, bl
lea ecx, [ebp - 0x2c]
je 0x4026b5
cmp al, 0x2e
je 0x4026f6
cmp al, 0x20
je 0x4026f6
inc ecx
mov al, byte [ecx]
cmp al, bl
jne 0x4026e7
cmp byte [ecx], bl
je 0x4026b5
mov al, byte [ecx]
cmp al, 0x30
jb 0x402704
cmp al, 0x39
jbe 0x402707
inc ecx
jmp 0x4026fa
xor eax, eax
jmp 0x40271c
movzx edx, dl
imul eax, eax, 0xa
sub edx, 0x30
cmp edx, 9
ja 0x4026b9
add eax, edx
inc ecx
mov dl, byte [ecx]
cmp dl, bl
jne 0x40270b
jmp 0x4026b9
push 0x497
push dword [0x42201c]
jmp 0x40263d