joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Execute command

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x28], eax
push esi
push str.n_
xor esi, esi
call fcn.004011f0
add esp, 4
lea eax, [esp + 0x28]
push eax
push 0x402120
call fcn.004011a0
mov eax, dword [esp + 0x30]
add esp, 8
movsd xmm1, qword [0x402168]
dec eax
movd xmm0, eax
cvtdq2pd xmm0, xmm0
divsd xmm1, xmm0
movsd xmm0, qword [0x402170]
movsd qword [esp + 0x20], xmm1
movsd qword [esp + 8], xmm0
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sin_precise
movsd xmm1, qword [esp + 8]
movsd qword [esp + 0x10], xmm0
movaps xmm0, xmm1
mulsd xmm0, xmm1
movsd qword [esp + 0x18], xmm0
movaps xmm0, xmm1
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_exp_precise
movaps xmm1, xmm0
movsd xmm0, qword [esp + 0x10]
mulsd xmm1, qword [esp + 8]
addsd xmm0, xmm0
addsd xmm1, xmm0
movsd xmm0, qword [esp + 0x18]
mulsd xmm0, qword [esp + 8]
movsd qword [esp + 0x10], xmm1
xorps xmm1, xmm1
subsd xmm0, qword [esp + 0x18]
andps xmm0, xmmword [0x402190]
ucomisd xmm1, xmm0
ja 0x4010ce
sqrtsd xmm0, xmm0
jmp 0x4010d3
call sub.api_ms_win_crt_math_l1_1_0.dll__libm_sse2_sqrt_precise
movsd xmm1, qword [esp + 0x10]
sub esp, 0x10
subsd xmm1, xmm0
movsd xmm0, qword [esp + 0x18]
movsd qword [esp + 8], xmm1
movsd qword [esp], xmm0
push str.region___10.4f__10.4f_n
movsd qword [esp + 0x24], xmm1
call fcn.004011f0
movsd xmm0, qword [esp + 0x1c]
add esp, 0x14
comisd xmm0, xmmword [0x402178]
jb 0x401141
movsd xmm1, qword [0x402160]
comisd xmm1, xmm0
jb 0x401141
movsd xmm1, qword [esp + 0x10]
comisd xmm1, xmmword [0x402180]
jb 0x401141
movsd xmm2, qword [0x402150]
comisd xmm2, xmm1
jb 0x401141
inc esi
addsd xmm0, qword [esp + 0x20]
movsd xmm1, qword [0x402158]
comisd xmm1, xmm0
movsd qword [esp + 8], xmm0
jae 0x401063
push esi
push str.count___d_n
call fcn.004011f0
push str.pause
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, dword [esp + 0x38]
add esp, 0xc
xor eax, eax
pop esi
xor ecx, esp
call fcn.00401226
mov esp, ebp
pop ebp
ret

Function at 0x401a1f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401a5e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401a5e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a5e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401a5e
cmp dword [ecx + 0x74], 0xe
jbe 0x401a5e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret

Function at 0x44998c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x44999b
pop dword [ebp - 0x30]
mov eax, 0x44999b
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x52c56
push 0
mov eax, 0xb462f9db
add eax, 0x4be1b8e1
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x412c1588
sub ecx, 0x412bc24d
xor edx, edx
add edx, eax
mov ebx, 0xdc9ff0ee
sub ebx, 0xdc5772ee
add ebx, dword [ebp - 0x30]
mov edi, 0xbde77f76
sub edi, 0x9c5af324
mov dword [ebp - 4], 0xb7a7e7fa
mov esi, dword [ebx]
mov dword [ebp - 4], 0xd4c07dfd
xor esi, edi
add dword [ebp - 0x28], ebx
mov dword [edx], esi
add dword [ebp - 0x2c], ebx
add edx, 0xe4dcbedf
sub edx, 0xe4dcbedb
add ebx, 4
loop 0x4499f7
add eax, 0x13fbf
xor ebx, ebx
add ebx, eax
add eax, 0x9c0a7195
add eax, 0x63f58e70
mov ecx, 0x97139645
add ecx, 0x692c69bb
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x4035ed
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4035fc
pop dword [ebp - 0x28]
mov eax, 0xc268ac98
add eax, 0x3dd78964
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x50994495
add dword [ebp - 0x38], 0xfdb900b6
mov dword [ebp - 0x34], 0xdec0a4d8
sub dword [ebp - 0x34], 0xac8d5893
mov dword [ebp - 0x30], 0x5ccd0d50
add dword [ebp - 0x30], 0xef7f36de
mov dword [ebp - 0x2c], 0x310c1adb
sub dword [ebp - 0x2c], 0x310c1adb
lea eax, [ebp - 0x38]
push eax
mov eax, 0x188ee484
add eax, 0xe7b18b98
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0xc45ac653
add dword [ebp - 0x38], 0xb017a303
mov dword [ebp - 0x34], 0xac8c9451
sub dword [ebp - 0x34], 0x6b2032dc
mov dword [ebp - 0x30], 0xb6a432d5
sub dword [ebp - 0x30], 0x5334c669
mov dword [ebp - 0x2c], 0x6dee4345
sub dword [ebp - 0x2c], 0x6dee4345
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36475
push 0
call eax
mov ecx, 0x6fbff7d4
add ecx, 0x90404a89
xor ebx, ebx
add ebx, eax
mov edx, 0x21a5a7b5
add edx, 0xde9b204b
add edx, dword [ebp - 0x28]
mov edi, 0x726ed1bc
sub dword [ebp - 0x1c], ecx
mov esi, dword [edx]
sub dword [ebp - 0x18], 0xb05f660
xor esi, edi
mov dword [ebx], esi
xor dword [ebp - 8], eax
add ebx, 4
add edx, 0xf86cb3ab
sub edx, 0xf86cb3a7
loop 0x403715
add eax, 0x55a46623
add eax, 0xaa5c9624
mov ebx, eax
add eax, 0x89b62426
sub eax, 0x89b62421
mov ecx, 0x400000
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4045aa
Capabilities:
Check if file exists

Disassembly:
push 0x1c
mov eax, 0x4068f8
call fcn.0040545b
cmp dword [0x40a010], 0
mov esi, dword [ebp + 8]
jne 0x4045c9
mov al, 1
jmp 0x404692
test esi, esi
je 0x404690
xor ebx, ebx
cmp word [esi], bx
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x404690
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeW]
test eax, eax
jne 0x404690
lea eax, [ebp - 0x28]
push esi
push eax
call fcn.004035ed
pop ecx
pop ecx
mov esi, dword [0x40a010]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], ebx
je 0x404684
lea eax, [ebp - 0x28]
push eax
call fcn.004035ed
pop ecx
test al, al
jne 0x404684
cmp dword [ebp - 0x18], esi
jbe 0x404684
cmp dword [0x40a014], 8
lea eax, [ebp - 0x28]
mov ecx, section..data
cmovae ecx, dword [section..data]
cmp dword [ebp - 0x14], 8
push esi
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x404684
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
test eax, eax
je 0x404684
push 0x407628
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
pop ecx
pop ecx
cmovne ebx, edx
lea ecx, [ebp - 0x28]
call fcn.00401780
mov al, bl
jmp 0x404692
xor al, al
call fcn.00405416
ret
Function at 0x4a3b10
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x4a3b54
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.00409474
add esp, 0x200
pop ebx
ret

Function at 0x4a7b88
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.004a7380
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004a7335
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.004a7380
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004a7335
idiv bh
inc dword [ebx - 0x7a76f33c]
enter 0xfffffffffffffffa, 0xffffffffffffffff
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1002aaee
pop dword [ebp - 8]
mov eax, 0xf4fe4268
sub eax, 0xe4fb977a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x231616a0
add dword [ebp - 0x18], 0x2b3c2eab
mov dword [ebp - 0x14], 0xfee4e6ed
sub dword [ebp - 0x14], 0xccb19aa8
mov dword [ebp - 0x10], 0xadb1da14
sub dword [ebp - 0x10], 0x616595e6
mov dword [ebp - 0xc], 0xfd2c32a1
sub dword [ebp - 0xc], 0xfd2c32a1
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x8f3e62eb
sub dword [ebp - 0x18], 0x1acbf995
mov dword [ebp - 0x14], 0x4d436ae
add dword [ebp - 0x14], 0x3c982ac7
mov dword [ebp - 0x10], 0x47782f19
sub dword [ebp - 0x10], 0xe408c2ad
mov dword [ebp - 0xc], 0x83b425a5
add dword [ebp - 0xc], 0x7c4bda5b
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x56ef18cc
add eax, 0xb913a75c
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x31fe0
push 0
call eax
mov ecx, 0x3619
mov edi, eax
mov esi, 0x10039600
add esi, dword [ebp - 8]
mov ebx, 0xfad12d4b
add ebx, 0xbf8b58da
add dword [ebp - 4], eax
mov edx, dword [esi]
add dword [ebp - 4], 0xfff667c0
xor edx, ebx
mov dword [ebp - 4], 0x35769e15
mov dword [edi], edx
xor dword [ebp - 4], ecx
add edi, 0xd6748f21
sub edi, 0xd6748f1d
add esi, 0xc0e7b82a
add esi, 0x3f1847da
loop 0x1002abff
add eax, 0xcce407ea
sub eax, 0xcce33cb3
mov ebx, eax
add eax, 0x357092a7
add eax, 0xca8f6d5e
mov ecx, 0xa35d011b
add ecx, 0x6ca2fee5
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x401534
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov al, byte [0x412a30]
push edi
push 0x40
mov byte [ebp - 0x104], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
test eax, eax
pop edi
jne 0x401583
lea eax, [ebp - 0x104]
push str.c:_temp
push eax
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push esi
mov esi, dword [ebp + 8]
push esi
push 0
lea eax, [ebp - 0x104]
push 0x4110c0
push eax
call dword [sym.imp.KERNEL32.DLL_GetTempFileNameA]
test eax, eax
jne 0x4015c3
lea eax, [ebp - 0x104]
push eax
push esi
call sub.MSVCRT.dll_strcpy
push esi
call fcn.00404274
push str.zipinsttmp
push esi
call sub.MSVCRT.dll_strcat
add esp, 0x14
jmp 0x4015ca
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov eax, esi
pop esi
leave
ret

Function at 0x4015e6
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
push esi
mov esi, 0x104
push edi
lea eax, [ebp - 0x250]
push esi
push eax
push 0x4110cc
push dword [ebp + 8]
call fcn.004049c7
add esp, 0x10
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x250]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40167a
test byte [ebp - 0x140], 0x10
je 0x401661
cmp byte [ebp - 0x114], 0x2e
je 0x401661
lea eax, [ebp - 0x358]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 8]
call fcn.004049c7
lea eax, [ebp - 0x358]
push eax
call fcn.004015e6
add esp, 0x14
lea eax, [ebp - 0x140]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x401629
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop edi
pop esi
leave
ret

Function at 0x401687
Capabilities:
Delete directory
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x360
push edi
mov edi, dword [ebp + 8]
push edi
call sub.MSVCRT.dll_strlen
cmp eax, 4
pop ecx
jae 0x4016a7
xor eax, eax
jmp 0x401741
push esi
lea eax, [ebp - 0x110]
push edi
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x110]
push eax
call fcn.00404274
push dword [ebp + 0xc]
lea eax, [ebp - 0x110]
push eax
call sub.MSVCRT.dll_strcat
add esp, 0x14
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401739
test byte [ebp - 0x250], 0x17
jne 0x401720
lea eax, [ebp - 0x360]
push 0x104
push eax
lea eax, [ebp - 0x224]
push eax
push edi
call fcn.004049c7
add esp, 0x10
lea eax, [ebp - 0x360]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4016ee
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
pop esi
pop edi
leave
ret
Function at 0x401bcf
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push dword [ebp + 8]
call fcn.004044ca
test eax, eax
pop ecx
je 0x401be9
xor eax, eax
leave
ret
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strcpy
lea eax, [ebp - 0x108]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 0x10
test eax, eax
je 0x401c1e
and byte [eax], 0
lea eax, [ebp - 0x108]
push eax
call fcn.00401bcf
pop ecx
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
leave
ret

Function at 0x401d21
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
lea eax, [ebp - 4]
push 0x2001f
push eax
call fcn.00401c2b
pop ecx
test eax, eax
pop ecx
jne 0x401de6
cmp dword [ebp + 8], eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x401dc4
lea eax, [ebp - 8]
push eax
push str.shellZipInstallercommand
push dword [ebp - 4]
call fcn.00408f30
add esp, 0xc
test eax, eax
jne 0x401de0
mov al, byte [0x412a30]
push edi
push 0x41
mov byte [ebp - 0x110], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10f]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x110]
push eax
call fcn.0040463e
pop ecx
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x510]
push str.__s___i____1_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea eax, [ebp - 0x510]
push eax
push 0x412a30
push dword [ebp - 8]
call fcn.00409008
add esp, 0x18
push dword [ebp - 8]
call ebx
pop edi
jmp 0x401de0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.shellZipInstallercommand
push dword [ebp - 4]
call esi
push str.shellZipInstaller
push dword [ebp - 4]
call esi
pop esi
push dword [ebp - 4]
call ebx
pop ebx
leave
ret

Function at 0x401de8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.MSVCRT.dll__strcmpi]
push edi
mov edi, dword [ebp + 8]
push str.zi.companyname
push edi
call esi
pop ecx
test eax, eax
pop ecx
jne 0x401e11
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
add eax, 0x14e
jmp 0x401e7b
push str.zi.productname
push edi
call esi
pop ecx
test eax, eax
pop ecx
jne 0x401e2c
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
add eax, 0x18f
jmp 0x401e7b
push str.zi.productversion
push edi
call esi
pop ecx
test eax, eax
pop ecx
jne 0x401e47
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x10]
add eax, 0x1d0
jmp 0x401e7b
push str.zi.programfiles
push edi
call esi
pop ecx
test eax, eax
pop ecx
jne 0x401e62
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x10]
add eax, 0x11d
jmp 0x401e7b
push str.zi.zipname
push edi
call esi
pop ecx
pop ecx
push dword [ebp + 0x10]
test eax, eax
jne 0x401e8c
mov eax, dword [ebp + 0x18]
add eax, 0x252
push eax
push dword [ebp + 0xc]
call fcn.0040434a
add esp, 0xc
push 1
pop eax
jmp 0x401e9e
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableA]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
neg eax
pop edi
pop esi
pop ebp
ret
Function at 0x4024b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4024c3
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x4025a4
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x40e2c0]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40e2c0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40e2c0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40e2c0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40e2c0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x40e2c0]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x40e2c0]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x40e2c0]
xor eax, esi
inc edx
dec edi
jne 0x4024e0
pop ebx
cmp dword [ebp + 0x10], 0
je 0x4025c5
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x40e2c0]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x4025aa
pop edi
pop esi
not eax
pop ebp
ret
Function at 0x402759
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
jne 0x402783
test ecx, ecx
jne 0x40278d
test edx, edx
jne 0x40278d
mov eax, edi
jmp 0x4027f9
cmp eax, 0xffffffff
jne 0x40278d
push 0xfffffffffffffffe
pop eax
jmp 0x4027f9
mov edx, dword [esi + 0x24]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x4027f9
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x4027be
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x4027dd
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x402854
push eax
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
add eax, dword [esi + 0x30]
push eax
push ecx
call fcn.00402859
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x402840
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x402854
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x402765
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x403754
Capabilities:
Hide graphical window

Disassembly:
push 0
push 2
push dword [0x412a58]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x403ce9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov esi, ecx
call fcn.00403cda
mov ecx, esi
call fcn.00403e14
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push ebx
push ebx
push 3
push ebx
je 0x403d14
push ebx
push 0x40000000
jmp 0x403d1b
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
cmp ecx, ebx
mov dword [esi], eax
mov dword [ebp + 8], ecx
je 0x403e0a
cmp dword [ebp + 0xc], ebx
je 0x403d4e
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov dword [esi + 8], eax
jmp 0x403e0a
push ebx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
cmp eax, 0x10
mov dword [esi + 0xc], eax
jbe 0x403e03
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], ebx
push 2
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
push 0xfffffffffffffff0
push dword [esi]
stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.DLL_SetFilePointer]
call edi
push ebx
lea eax, [ebp - 0x10]
push 0x10
push eax
push dword [esi]
call fcn.00404b48
add esp, 0x10
test eax, eax
je 0x403e03
cmp dword [ebp - 0xc], 0x76a9f511
jne 0x403dfa
cmp dword [ebp - 8], 0xb8641206
jne 0x403dfa
mov eax, dword [ebp - 0x10]
cmp eax, dword [esi + 0xc]
mov dword [esi + 8], eax
jae 0x403dfa
cmp eax, 0x3e800
jae 0x403dfa
push ebx
push ebx
push eax
push dword [esi]
call edi
xor eax, eax
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x20], ebx
push ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push 0x10
push eax
push dword [esi]
call fcn.00404b48
add esp, 0x10
test eax, eax
je 0x403e03
cmp dword [ebp - 0x20], 0x62ad9188
jne 0x403dfa
cmp dword [ebp - 0x1c], 0x16dbac39
jne 0x403dfa
mov dword [ebp + 8], 1
jmp 0x403e0a
push 0xffffffffffffffff
mov ecx, esi
call fcn.00403cdf
mov ecx, esi
call fcn.00403e14
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 8