joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b8ae
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, 0x400
push ebx
push esi
push edi
push eax
mov eax, dword fs:[0x30]
mov edi, edx
push 0
mov ebx, ecx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x40b8e4
mov eax, 0xc0000017
jmp 0x40ba74
mov eax, 0x400
push eax
push 0
push esi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x10], 0x4000000
mov eax, 0x400
push eax
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x40b924
mov edi, 0xc0000017
jmp 0x40ba60
mov ecx, edi
mov eax, 0x400
mov word [ebp - 0x1e], ax
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40b932
push 0
lea eax, [ebp - 0x20]
mov dword [ebp - 0x1c], edi
push eax
lea eax, [ebp - 0x10]
sub ecx, edx
push eax
mov word [ebp - 0x20], cx
call dword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea eax, [ebp - 8]
push eax
mov eax, 0x400
push eax
push esi
push 1
lea eax, [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.ntdll.dll_NtQueryValueKey]
mov edi, eax
test edi, edi
jns 0x40b984
push dword [ebp - 0xc]
mov ecx, dword fs:[0x30]
push 0
push dword [ecx + 0x18]
jmp 0x40ba5a
mov ecx, dword [ebp + 0xc]
mov eax, dword [esi + 4]
mov dword [ecx], eax
cmp eax, 4
je 0x40ba41
cmp eax, 3
je 0x40ba41
mov ebx, dword [ebp + 8]
xor ecx, ecx
mov word [ebp - 0x18], cx
cmp eax, 2
jne 0x40b9bd
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, 0x400
mov word [ebp - 0x16], ax
jmp 0x40b9dd
push dword [ebp - 0xc]
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ecx, 0x3200
mov dword [ebp - 0x14], ebx
mov word [ebp - 0x16], cx
mov ax, word [esi + 0xc]
mov word [ebp - 0x28], ax
mov ax, word [esi + 0xc]
mov word [ebp - 0x26], ax
mov eax, dword [esi + 8]
add eax, esi
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x28]
push 0
push eax
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.ntdll.dll_RtlUnicodeStringToAnsiString]
mov eax, dword [ebp + 0xc]
cmp dword [eax], 2
jne 0x40ba60
mov eax, 0x3200
push eax
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_ExpandEnvironmentStringsA]
mov dword [ebp - 8], eax
test eax, eax
jne 0x40ba2e
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov edi, eax
jmp 0x40ba3c
mov ecx, 0x3200
cmp eax, ecx
jb 0x40ba3c
mov edi, 0xc0000023
push dword [ebp - 0x14]
jmp 0x40ba4f
mov eax, dword [esi + 8]
push dword [ebp - 0xc]
mov ecx, dword [esi + eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword fs:[0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword fs:[0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c29d
Capabilities:
Encode data using base64

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 4], ecx
xor esi, esi
xor edi, edi
mov eax, ecx
cmp ebx, 2
jae 0x40c2bd
xor eax, eax
jmp 0x40c370
mov edx, dword [ebp + 8]
push 3
pop ecx
movzx eax, byte [eax]
dec ebx
shl esi, 8
add esi, eax
mov eax, dword [ebp - 4]
inc eax
inc edi
mov dword [ebp - 4], eax
cmp edi, ecx
jne 0x40c31f
mov eax, esi
shr eax, 0x12
push 0x3f
pop edi
and eax, edi
mov al, byte [eax + 0x403e90]
mov byte [edx], al
mov eax, esi
shr eax, 0xc
and eax, edi
mov al, byte [eax + 0x403e90]
mov byte [edx + 1], al
mov eax, esi
shr eax, 6
and esi, edi
and eax, edi
mov al, byte [eax + 0x403e90]
mov byte [edx + 2], al
mov al, byte [esi + 0x403e90]
xor esi, esi
mov byte [edx + 3], al
add edx, 4
mov eax, dword [ebp - 4]
xor edi, edi
test ebx, ebx
jne 0x40c2c3
test edi, edi
je 0x40c36e
sub ecx, edi
shl ecx, 3
shl esi, cl
mov eax, esi
shr eax, 0x12
and eax, 0x3f
mov al, byte [eax + 0x403e90]
mov byte [edx], al
mov eax, esi
shr eax, 0xc
and eax, 0x3f
mov al, byte [eax + 0x403e90]
mov byte [edx + 1], al
cmp edi, 2
jne 0x40c362
shr esi, 6
and esi, 0x3f
mov al, byte [esi + 0x403e90]
jmp 0x40c364
mov al, 0x3d
mov byte [edx + 2], al
mov byte [edx + 3], 0x3d
add edx, 4
mov eax, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40c9a4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40cdd8
call fcn.0040cc58
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40ca04
cmp eax, 0xffffffff
je 0x40ca04
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40c9fd
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40c9fd
cmp edx, 0x10000000
jae 0x40c9fd
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40c9fa
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0040cc9d
ret 4

Function at 0x40ca60
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40ca9e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40ca96
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40caa0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40ca86
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40cb70
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x40cba1
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40cba1
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x40cba1
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x1002b221
Capabilities:
Terminate process

Disassembly:
jmp 0x100480a6
jmp fcn.10051f56
cmp ecx, dword [0x100912e0]
jne 0x100480b0
repz ret
jmp 0x1002b834
Function at 0x1002c3f1
Capabilities:
Terminate process

Disassembly:
jmp 0x1004ed2f
mov edi, edi
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.1002c653
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x1002c83d
Capabilities:
Accept command line arguments

Disassembly:
jmp 0x1004dd15
push 8
push 0x1008d668
call fcn.1002c2a2
mov eax, dword [ebp + 0xc]
cmp eax, 1
jne 0x1004dda3
call fcn.1002b212
test eax, eax
jne 0x1004dd39
xor eax, eax
jmp 0x1004de71
call fcn.1002bdc5
test eax, eax
jne 0x1004dd49
call fcn.1002b9dd
jmp 0x1004dd32
call fcn.1002c28e
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10095410], eax
call fcn.1002b05a
mov dword [0x10092e94], eax
call fcn.1002c19e
test eax, eax
jns 0x1004dd73
call fcn.1002bd8e
jmp 0x1004dd42
call fcn.1002b11d
test eax, eax
js 0x1004dd9c
call fcn.1002c8e7
test eax, eax
js 0x1004dd9c
push 0
call fcn.1002c88d
pop ecx
test eax, eax
jne 0x1004dd9c
inc dword [0x10092e90]
jmp 0x1004de6e
call fcn.1002bb9a
jmp 0x1004dd6c
xor edi, edi
cmp eax, edi
jne 0x1004de04
cmp dword [0x10092e90], edi
jle 0x1004dd32
dec dword [0x10092e90]
mov dword [ebp - 4], edi
cmp dword [0x10092ef0], edi
jne 0x1004ddc7
call fcn.1002b64f
cmp dword [ebp + 0x10], edi
jne 0x1004dddb
call fcn.1002bb9a
call fcn.1002bd8e
call fcn.1002b9dd
mov dword [ebp - 4], 0xfffffffe
call fcn.1004ddee
jmp 0x1004de6e
cmp eax, 2
jne 0x1004de62
call fcn.1002b14f
push 0x214
push 1
call fcn.1002b0aa
pop ecx
pop ecx
mov esi, eax
cmp esi, edi
je 0x1004dd32
push esi
push dword [0x100917fc]
push dword [0x100936ac]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
call eax
test eax, eax
je 0x1004de56
push edi
push esi
call fcn.1002c694
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esi], eax
or dword [esi + 4], 0xffffffff
jmp 0x1004de6e
push esi
call fcn.1002c810
pop ecx
jmp 0x1004dd32
cmp eax, 3
jne 0x1004de6e
push edi
call fcn.1002b94c
pop ecx
xor eax, eax
inc eax
call fcn.1002c0f9
ret 0xc
Function at 0x1d23e64
Capabilities:
Encrypt data using speck

Disassembly:
mov al, byte [edi - 1]
pushfd
mov byte [ebp - 2], al
pushfd
push esi
pushfd
lea esp, [esp + 0x48]
jmp fcn.010e23cc
add dword [ebp - 0x20], eax
cmp dl, 0x1b
bt di, bp
cmp al, 0x3c
cmp dword [ebp - 0x20], 0xffffffff
jmp 0x1cd756e
adc dh, al
xor byte [0xcedc0fd6], al
and dh, dh
inc esi
frstor dword [ebp + 0x3bff7952]
jns 0x1cd7562
invalid
cmp eax, esi
inc esp
and al, 4
jl 0x1cd7553
mov byte [esp + 4], 0x7c
jmp 0x10dcc52
in al, 0x56
inc eax
call [ebp + ecx*4 + 0xf082464]
test esp, ebx
push esp
inc eax
jmp dword [eax - 0x18]
pushfd
lea esp, [esp + 8]
jne 0x10dca55
pushal
call fcn.010df803
adc eax, ecx
jle 0x1cd7561
xor edx, esp
cmpsd dword [esi], dword es:[edi]
loopne 0x1cd75c4
daa
cmp al, 0x9c
js 0x1cd75e5
xchg ebx, eax
sbb byte [edi - 0x56e91009], ah
aaa
sub dword [ebp - 0x1bc1cd90], 0xffffffde
imul edx, dword [edx + 0x64], 0x4c
dec esp
das
cmp al, 0x5d
inc esp
add byte [ebp - 0x5a], 8
enter 0x758a, 0xffffffffffffffc6
and eax, 0x2da4fb95
jns 0x1cd759f
dec ah
mov edx, 0x561b831e
arpl word [edi + ebp*8 - 0x10a11a2f], si
scasd eax, dword es:[edi]
inc edx
inc ebp
and dword [eax], eax
out 0x3f, al
sub dl, 0xdd
push es
fcom st(0)
iretd
pop es
xchg byte [eax - 0x5b], bl
or al, 0x89
js 0x1cd75c7
cwde
push si
mov ecx, esp
jnp 0x1cd7638
pop es
or eax, 0x9747731c
dec ebp
cmp ebp, dword [esi - 0x27]
in eax, 0x51
or byte [esi + 0x49], dh
frstor dword [ebp + 0x14033753]
cmpsd dword [esi], dword es:[edi]
jnp 0x1cd75e9
scasd eax, dword es:[edi]
cmp byte [edi + 0x2b], cl
xchg esp, eax
inc esp
movsb byte es:[edi], byte [esi]
aas
add dword [esi], 0x3cf6c8f3
invalid
pushal
push dword [esp]
lea esp, [esp + 0x34]
call fcn.01d20e68
push esi
jmp 0x10df19a

Function at 0x1d24bb3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
bswap edi
and al, 0xfc
sal di, 1
add di, si
sub eax, ecx
pushal
push 0x5eeec2a2
pop edi
mov esp, eax
movzx di, dl
pushfd
call fcn.01d25e2e
push dword [esp]
fadd dword [ebp]
push 0x28dbc6e0
mov byte [esp + 8], 0x38
lea esp, [esp + 0xc]
jmp 0x1d265ff
mov word [ebp], ax
mov byte [esp + 8], 0x28
lea esp, [esp + 0x30]
jmp 0x1d25443
or al, 0x9d
lea eax, [edi + 0x50]
jb 0x1d25be0
bt ecx, 0x1d
test bp, 0xdf4b
cmp ebp, eax
pushal
push 0xe3551da9
jmp 0x1d25cbb
cmp cl, ch
cmp ebp, eax
pushfd
pushfd
lea esp, [esp + 8]
ja 0x1d265ff
neg dl
lahf
sal dx, cl
test cl, bh
mov edx, esp
adc ch, 0x48
sar cx, 7
push 0xa93c8b61
lea ecx, [edi + 0x40]
ror di, cl
xor ah, 0x87
call fcn.01d24eea
call 0x1d24bb3
pushfd
pop dword [esp + 0x38]
pushfd
mov byte [esp + 4], 0x9f
mov byte [esp], cl
push dword [esp + 0x3c]
pop dword [ebp]
push ebp
pushfd
push esi
lea esp, [esp + 0x4c]
jmp 0x1d25443
pushfd
lea esp, [esp + 0x28]
ja 0x1d265ff
aaa
das
bt cx, 5
bt ebx, 0x12
mov edx, esp
dec ah
and ecx, 0x495cddf9
lea ecx, [edi + 0x40]
bsr di, bx
sub ecx, edx
push 0xbe41fb14
ror di, cl
lea eax, [ebp - 0x80]
jmp 0x1d24b94

Function at 0x1d257b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push dword [esp + 0x40]
popfd
push ebp
push ecx
push 0x77c3927e
lea esp, [esp + 0x50]
jmp 0x1d265ff
Function at 0x1d266d2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
rep movsb byte es:[edi], byte [esi]
rol si, 0xd
pushfd
sub di, 0x7cbf
cmc
mov edi, dword [esp + 0x34]
movzx si, dl
mov esi, dword [esp + 0x38]
std
jmp 0x1d25398
Function at 0x4010d7
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov eax, dword [esp + 4]
ret

Function at 0x4010ea
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
mov ebx, eax
jle 0x401112
lea eax, [ebx + esi - 1]
cmp byte [eax], 0x5c
jne 0x401112
mov edi, 1
mov byte [eax], 0
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
dec eax
cmp eax, 1
sbb eax, eax
inc eax
test edi, edi
je 0x401129
mov byte [ebx + esi - 1], 0x5c
pop edi
pop esi
pop ebx
ret

Function at 0x401452
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push dword [ebp + 8]
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
lea ecx, [ebp - 0x28]
push eax
push eax
push eax
lea edx, [ebp - 8]
push eax
push eax
push 0x20
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x401486
mov ax, 0xffff
jmp 0x4014f2
push 7
lea eax, [ebp - 0x28]
push str.PKBACK
push eax
call fcn.00401028
add esp, 0xc
test eax, eax
je 0x4014a3
mov ax, 0xffff
jmp 0x4014f2
cmp byte [ebp - 0x28], 0
lea edx, [ebp - 0x28]
je 0x4014bc
mov al, byte [edx]
cmp al, 0x2e
je 0x4014bc
cmp al, 0x20
je 0x4014bc
inc edx
cmp byte [edx], 0
jne 0x4014ac
cmp byte [edx], 0
jne 0x4014c7
mov ax, 0xffff
jmp 0x4014f2
mov al, byte [edx]
cmp al, 0x30
jb 0x4014d1
cmp al, 0x39
jbe 0x4014d4
inc edx
jmp 0x4014c7
xor eax, eax
cmp byte [edx], al
je 0x4014f2
imul eax, eax, 0xa
movzx ecx, byte [edx]
sub ecx, 0x30
js 0x4014f2
cmp ecx, 9
jg 0x4014f2
add eax, ecx
inc edx
cmp byte [edx], 0
jne 0x4014da
mov esp, ebp
pop ebp
ret 4

Function at 0x401687
Capabilities:
Encode data using xor

Disassembly:
push esi
mov ecx, dword [0x408430]
mov esi, dword [esp + 0xc]
mov eax, esi
dec esi
test eax, eax
je 0x4016ba
mov edx, dword [esp + 8]
mov al, byte [edx]
inc edx
xor al, cl
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x408030]
xor eax, ecx
mov ecx, eax
mov eax, esi
dec esi
test eax, eax
jne 0x40169d
pop esi
mov dword [0x408430], ecx
ret

Function at 0x401784
Capabilities:
Get disk information

Disassembly:
push ebp
mov eax, dword [esp + 8]
mov ebp, esp
sub esp, 4
mov al, byte [eax]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], 0
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, 1
mov esp, ebp
cmp ecx, eax
mov eax, ecx
adc eax, 0xffffffff
pop ebp
ret 4
Function at 0x401dbf
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x12c
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x148]
cmp edi, 0xffffffff
jne 0x401de9
push 1
push dword [esp + 0x144]
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x401eeb
mov esi, dword [esp + 0x140]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [esi + eax]
cmp ebp, esi
jbe 0x401e09
cmp byte [ebp], 0x5c
je 0x401e0f
dec ebp
cmp ebp, esi
ja 0x401dfe
cmp byte [ebp], 0x5c
jne 0x401e1b
mov al, byte [ebp - 1]
cmp al, 0x3a
je 0x401e1a
cmp al, 0x5c
jne 0x401e1b
inc ebp
mov bl, byte [ebp]
push esi
lea eax, [esp + 0x14]
mov byte [ebp], 0
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov byte [ebp], bl
cmp bl, 0x5c
jne 0x401e37
inc ebp
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x14]
push eax
push ebp
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x1f
jne 0x401e68
push esi
push 0x2d
call fcn.0040107b
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
jmp 0x401ed3
cmp eax, 0x20
jbe 0x401eb9
mov eax, dword [esp + 0x144]
mov ecx, 0
push 1
push 0
cmp byte [eax], 1
adc ecx, 0xffffffff
and ecx, eax
mov eax, dword [0x4079ec]
push ecx
and eax, 0x20000
push esi
cmp eax, 1
mov eax, 0
adc eax, 0xffffffff
and eax, str.Install
push eax
push dword [0x4086f0]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
test edi, edi
je 0x401eb4
mov dword [edi], eax
cmp eax, 0x20
ja 0x401eeb
push esi
push eax
push 0xd
call fcn.0040107b
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0
lea ecx, [esp + 0x14]
push str.WinZip_Self_Extractor
push ecx
push dword [0x4086f0]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x12c
ret

Function at 0x401ef6
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x401fbc
lea eax, [ebp - 4]
lea ecx, [ebp - 0x10c]
mov dword [ebp - 4], 0x105
push eax
push ecx
push str.winzip_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x401fbc
cmp byte [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
je 0x401f54
cmp byte [eax], 0x20
je 0x401f54
inc eax
cmp byte [eax], 0
jne 0x401f49
push 0x407d78
inc eax
push str.__s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
test byte [0x4079ed], 0x10
je 0x401f9b
test byte [0x4079ed], 0x80
jne 0x401f9b
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [ebp + eax - 0x10f]
dec eax
mov byte [eax], 0x7a
inc eax
mov byte [eax], 0x69
mov byte [eax + 1], 0x70
push 0xffffffffffffffff
lea eax, [ebp - 0x10c]
push 0x407a8c
push eax
call fcn.00401dbf
add esp, 0xc
cmp eax, 1
sbb cl, cl
inc cl
mov al, cl
jmp 0x401fd9
push 0
push str.WinZip_Self_Extractor
push 0x1a
call fcn.0040107b
push eax
push dword [0x4086f0]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4022cd
Capabilities:
Query environment variable

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
ret

Function at 0x40236b
Capabilities:
Get common file path

Disassembly:
push esi
push 0xfa
mov esi, dword [esp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40239f
push esi
call fcn.00402316
add esp, 4
test eax, eax
je 0x40239f
push esi
call fcn.00402276
add esp, 4
test eax, eax
mov eax, 1
je 0x4023a1
xor eax, eax
pop esi
ret

Function at 0x403972
Capabilities:
Encode data using xor

Disassembly:
push esi
xor eax, eax
push edi
cmp dword [0x40856e], eax
ja 0x403988
mov dword [0x40854c], eax
jmp 0x403a6b
mov esi, 0x800
cmp dword [0x40856e], esi
ja 0x40399b
mov esi, dword [0x40856e]
push esi
xor edi, edi
push dword [0x408548]
push dword [0x40790c]
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [0x40854c], eax
cmp dword [0x40791c], edi
je 0x403a0d
cmp eax, 0xffffffff
je 0x403a0d
cmp eax, esi
je 0x403a0d
cmp eax, edi
jl 0x403a0d
mov eax, dword [0x407920]
push eax
mov ax, word [0x407924]
inc ax
push eax
call fcn.004012a4
cmp dword [0x40854c], edi
jne 0x4039fe
push esi
push dword [0x408548]
push dword [0x40790c]
call dword [sym.imp.KERNEL32.dll__lread]
mov dword [0x40854c], eax
cmp dword [0x40854c], 0xffffffff
je 0x403a0d
mov esi, dword [0x40854c]
cmp dword [0x40854c], esi
je 0x403a1c
push 2
call fcn.00401c6e
mov eax, dword [0x40854c]
mov ecx, dword [0x408548]
sub dword [0x40856e], eax
mov dword [0x40857c], ecx
cmp dword [0x407910], 0
je 0x403a60
mov esi, ecx
lea edi, [eax - 1]
test eax, eax
je 0x403a60
call fcn.0040518b
xor byte [esi], al
movzx eax, byte [esi]
push eax
inc esi
call fcn.004051a4
add esp, 4
mov eax, edi
dec edi
test eax, eax
jne 0x403a45
mov eax, dword [0x40854c]
dec dword [0x40854c]
pop edi
pop esi
ret
Function at 0x4051a4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [esp + 4]
mov edx, 0xff
xor eax, dword [0x408000]
mov ecx, dword [0x408000]
shr ecx, 8
and eax, edx
mov eax, dword [eax*4 + 0x408030]
xor eax, ecx
mov dword [0x408000], eax
and eax, edx
add dword [0x408004], eax
mov eax, dword [0x408004]
imul eax, eax, 0x8088405
inc eax
mov ecx, dword [0x408008]
shr ecx, 8
mov dword [0x408004], eax
shr eax, 0x18
xor eax, dword [0x408008]
and eax, edx
mov eax, dword [eax*4 + 0x408030]
xor eax, ecx
mov dword [0x408008], eax
ret

Function at 0x40529b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov eax, dword [0x407918]
mov ebp, esp
sub esp, 0xc
push esi
push edi
push eax
call fcn.00405208
add esp, 4
lea ecx, [ebp - 0xc]
xor edi, edi
push 0xc
push dword [ebp + 8]
push ecx
call section..text
add esp, 0xc
lea esi, [ebp + edi - 0xc]
call fcn.0040518b
inc edi
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.004051a4
add esp, 4
cmp edi, 0xc
jl 0x4052c4
cmp dword [0x407914], 0
movzx cx, byte [ebp - 1]
je 0x405305
mov ax, word [0x408566]
shr ax, 8
cmp ax, cx
je 0x405317
mov eax, 0xffffffff
jmp 0x405319
mov eax, dword [0x40856a]
shr eax, 0x18
cmp ax, cx
mov eax, 0xffffffff
jne 0x405319
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411bb0
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
cmp eax, 0x129
je 0x411bfd
cmp eax, 0x1388
jne 0x411c81
push eax
mov eax, dword [edi + 4]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x411beb
lea esi, [edi + 0x514]
call fcn.004121f0
lea eax, [edi + 0x514]
call fcn.0040a840
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_KillTimer]
push 0x129
push ecx
call esi
xor eax, eax
lea edx, [ebp - 8]
push edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [edi + 4]
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x18]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x18], eax
jg 0x411c63
cmp eax, dword [ebp - 0x10]
jge 0x411c63
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0x14], ecx
jg 0x411c63
cmp ecx, dword [ebp - 0xc]
jge 0x411c63
push ecx
push eax
call dword [sym.imp.USER32.dll_WindowFromPoint]
cmp eax, dword [edi + 4]
je 0x411c81
mov edx, dword [edi + 4]
push 0
push 0
push 0x5867
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [edi + 4]
push 0x129
push eax
call esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x411f50
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x50c], edi
jne 0x411f74
mov eax, 0x80004005
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [ebx + 0x55c]
cmp ecx, eax
je 0x411f98
cmp eax, dword [ebx + 4]
jne 0x411f92
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
jmp 0x411f98
mov dword [ebx + 0x55c], eax
mov ecx, ebx
call fcn.00412280
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x411fb5
lea esi, [ebx + 0x4f8]
call fcn.004121f0
lea eax, [ebx + 0x4f8]
call fcn.0040a840
mov esi, dword [sym.imp.USER32.dll_SendInput]
xor eax, eax
push 0x1c
mov dword [ebp - 0x18], eax
lea edx, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
push edx
mov eax, 0x11
xor ecx, ecx
push 1
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], ax
mov word [ebp - 0x16], cx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], edi
call esi
mov ecx, 0x56
mov word [ebp - 0x18], cx
push 0x1c
mov eax, 1
lea ecx, [ebp - 0x1c]
push ecx
xor edx, edx
push eax
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x16], dx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], edi
call esi
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, 0x56
xor eax, eax
push 1
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], dx
mov word [ebp - 0x16], ax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 3
mov dword [ebp - 0xc], edi
call esi
push 0x1c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, 0x11
xor eax, eax
push 1
mov dword [ebp - 0x1c], 1
mov word [ebp - 0x18], dx
mov word [ebp - 0x16], ax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 2
mov dword [ebp - 0xc], edi
call esi
mov edx, dword [ebx + 4]
push edi
push 0x1f4
push 0x1388
push edx
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4