joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4058fe
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax + 4]
test eax, eax
jne 0x40590e
mov eax, dword [sym.imp.MSVCP60.dll_unsigned_short_int_const__private:_static_unsigned_short_int_const____cdecl_std::basic_string_unsigned_short_int__struct_std::char_traits_unsigned_short_int___class_std::allocator_unsigned_short_int__::_Nullstr_void_::_2::_C]
push esi
push 0x420d10
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x405962
mov eax, dword [esp + 0xc]
mov eax, dword [eax + 4]
test eax, eax
jne 0x405933
mov eax, 0x4175e4
mov ecx, dword [esp + 0x10]
push esi
push 1
add eax, ecx
push dword [esp + 0x1c]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
add esp, 0x10
cmp eax, 1
push esi
je 0x40595b
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
xor eax, eax
jmp 0x405965
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
pop esi
ret 0x10

Function at 0x406d7f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 9
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x26]
push dword [ebp + 0x10]
mov word [ebp - 0x28], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x28]
push 0x420dc8
push eax
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
lea eax, [ebp - 0x28]
push dword [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, ebx
je 0x406e0c
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x406e0c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, ebx
je 0x406e0c
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
cmp esi, ebx
je 0x406e0c
push dword [0x4175e0]
mov ecx, dword [ebp + 0x14]
push ebx
call fcn.0040467c
mov ecx, dword [ebp + 0x14]
push esi
push edi
call fcn.004049a9
push 1
pop ebx
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x40aafa
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x416004
call fcn.00412f70
sub esp, 0x14
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
push 0
lea ecx, [ebp - 0x20]
mov bl, 1
mov byte [ebp - 0x20], al
call fcn.00403655
and dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x3fc
mov ecx, esi
call fcn.0040a8c2
mov ecx, esi
call fcn.0040a3b3
mov esi, eax
test esi, esi
je 0x40ab88
mov edx, dword [ebp - 0x1c]
mov eax, 0x4175e4
test edx, edx
mov ecx, eax
je 0x40ab4e
mov ecx, edx
mov ecx, dword [ecx]
cmp ecx, dword [0x41789b]
jne 0x40ab7e
test edx, edx
je 0x40ab5e
mov eax, edx
mov ecx, dword [ebp - 0x18]
push esi
add ecx, 0xfffffffc
push 1
add eax, 4
push ecx
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebx, eax
add esp, 0x10
dec ebx
neg ebx
sbb bl, bl
inc bl
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
jmp 0x40ab8a
xor bl, bl
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.00403655
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40aba8
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x416018
call fcn.00412f70
sub esp, 0x14
mov al, byte [ebp - 0xd]
push ebx
push esi
mov esi, ecx
xor ebx, ebx
lea ecx, [ebp - 0x20]
push ebx
mov byte [ebp - 0x20], al
call fcn.00403655
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
push 0x401
mov dword [ebp - 4], ebx
call fcn.0040a8c2
mov ecx, esi
call fcn.0040a7bf
mov esi, eax
cmp esi, ebx
je 0x40ac16
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
jne 0x40abf6
mov eax, 0x4175e4
push esi
push 1
push dword [ebp - 0x18]
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
mov ebx, eax
push esi
dec ebx
neg ebx
sbb bl, bl
inc bl
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
or dword [ebp - 4], 0xffffffff
push 1
lea ecx, [ebp - 0x20]
call fcn.00403655
mov ecx, dword [ebp - 0xc]
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f6f4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
cmp eax, ecx
mov dword [ebp - 8], edi
jb 0x40f781
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40f741
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x40f763
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x40f83f
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
cmp ecx, edx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
jbe 0x40f7a9
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x40f7b4
xor eax, eax
jmp 0x40f800
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x40f7d1
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00410794
jmp 0x40f7e1
cmp ecx, 2
jne 0x40f7ea
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00410c02
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call sub.MSVCRT.dll_memcpy
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x40f82b
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x40f83f
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x40f6ff
pop edi
pop ebx
leave
ret
Function at 0x4124fa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.00413340
push esi
mov edx, 0x1ff
push edi
xor esi, esi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x100e]
mov word [ebp - 0x1010], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x80e]
mov word [ebp - 0x810], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov edi, 0x800
lea eax, [ebp - 0x1010]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x810]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
lea edi, [ebp - 0xe]
mov word [ebp - 0x10], si
push 0xe
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push esi
push eax
call sub.MSVCRT.dll_memset
push esi
push esi
lea eax, [ebp - 0x10]
push esi
push eax
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.MSVCRT.dll__wsplitpath]
lea eax, [ebp - 0x10]
push 0x42016c
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [ebp - 0x1010]
push esi
push eax
call fcn.004144d6
add esp, 0x30
test al, al
jne 0x4125d1
lea eax, [ebp - 0x810]
push esi
push eax
call fcn.004144d6
pop ecx
test al, al
pop ecx
jne 0x4125d1
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.004144d6
pop ecx
test al, al
pop ecx
jne 0x4125d1
inc al
jmp 0x4125d3
xor al, al
pop edi
pop esi
leave
ret
Function at 0x414064
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x100c
call fcn.00413340
push ebx
push esi
push edi
call fcn.00413ef1
mov edx, 0x1ff
mov ebx, eax
xor esi, esi
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x100a]
mov word [ebp - 0x100c], si
mov word [ebp - 0x80c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
xor eax, eax
lea edi, [ebp - 0x80a]
mov dword [ebp - 4], esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, 0x400
lea ecx, [ebp - 0x80c]
push eax
push ecx
lea ecx, [ebp - 0xc]
mov dword [ebp - 8], esi
push ecx
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
push eax
lea eax, [ebp - 0x100c]
mov dword [ebp - 0xc], esi
push eax
push 0x421ac0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
push dword [ebp + 8]
push ebx
push dword [ebp - 4]
call fcn.00413ff4
add esp, 0xc
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4140f7
Capabilities:
Create thread
Inject dll
Inject thread

Disassembly:
mov eax, 0x416964
call fcn.00412f70
sub esp, 0x20
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
push esi
push 0x43a
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
cmp eax, esi
mov dword [ebp + 8], eax
jne 0x41413c
lea eax, [ebp - 0x1c]
push 0x41cc20
push eax
mov dword [ebp - 0x1c], esi
call sub.MSVCRT.dll__CxxThrowException
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 4
push 0x1000
lea edi, [eax + eax]
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov ebx, eax
cmp ebx, esi
mov dword [ebp - 0x14], ebx
jne 0x414175
lea eax, [ebp - 0x20]
push 0x41cc20
push eax
mov dword [ebp - 0x20], esi
call sub.MSVCRT.dll__CxxThrowException
push esi
push edi
push dword [ebp + 0xc]
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x414199
lea eax, [ebp - 0x24]
push 0x41cc20
push eax
mov dword [ebp - 0x24], esi
call sub.MSVCRT.dll__CxxThrowException
push str.LoadLibraryW
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, esi
jne 0x4141c5
lea eax, [ebp - 0x28]
push 0x41cc20
push eax
mov dword [ebp - 0x28], esi
call sub.MSVCRT.dll__CxxThrowException
push esi
push esi
push ebx
push eax
push esi
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
cmp eax, esi
jne 0x414216
lea eax, [ebp - 0x2c]
push 0x41cc20
push eax
mov dword [ebp - 0x2c], esi
call sub.MSVCRT.dll__CxxThrowException
xor esi, esi
cmp dword [ebp - 0x14], esi
je 0x414202
push 0x8000
push esi
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
cmp dword [ebp + 8], esi
je 0x414210
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x414226
ret
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [ebp - 0x18], 1
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x40de38
nop
mov ecx, 0x6fa10cd5
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data_1
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x54b10577
nop
nop
nop
nop
test eax, eax
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x43b661
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
and edx, edi
or edx, edx
add edx, 0x5128f96d
call fcn.0043b69e
dec edi
push 0xe256ad1e
mov edi, dword [esp]
add esp, 4
add edx, 0xa24d5042
xor dword [eax], ecx
and edx, edi
dec edx
sub edx, 1
inc eax
inc edx
cmp eax, esi
jne fcn.0043b661
or edi, edi
ret
Function at 0x4010e5
Capabilities:
Set current directory

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
cmp edi, 3
jle 0x40110a
cmp byte [edi + esi - 1], 0x5c
jne 0x40110a
and byte [edi + esi - 1], bl
push 1
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
dec eax
neg eax
sbb eax, eax
neg eax
test ebx, ebx
je 0x401121
mov byte [edi + esi - 1], 0x5c
pop edi
pop esi
pop ebx
ret

Function at 0x4014c5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
lea eax, [ebp - 8]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor ebx, ebx
lea eax, [ebp - 0x28]
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x20
push eax
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x401527
push 7
lea eax, [ebp - 0x28]
push str.PKBACK
push eax
call fcn.00401028
add esp, 0xc
test eax, eax
jne 0x401527
mov al, byte [ebp - 0x28]
lea ecx, [ebp - 0x28]
cmp al, bl
je 0x401523
cmp al, 0x2e
je 0x401523
cmp al, 0x20
je 0x401523
mov al, byte [ecx + 1]
inc ecx
jmp 0x401511
cmp byte [ecx], bl
jne 0x40152d
or ax, 0xffff
jmp 0x401559
mov al, byte [ecx]
cmp al, 0x30
jb 0x401537
cmp al, 0x39
jbe 0x40153a
inc ecx
jmp 0x40152d
xor eax, eax
mov dl, byte [ecx]
cmp dl, bl
je 0x401559
movzx edx, dl
lea eax, [eax + eax*4]
shl eax, 1
sub edx, 0x30
js 0x401559
cmp edx, 9
jg 0x401559
add eax, edx
inc ecx
jmp 0x40153c
pop ebx
leave
ret 4

Function at 0x4016ad
Capabilities:
Hash data with crc32

Disassembly:
mov ecx, dword [esp + 4]
push esi
push 8
xor eax, eax
shl ecx, 1
pop esi
sar ecx, 1
mov edx, eax
xor edx, ecx
test dl, 1
je 0x4016cd
shr eax, 1
xor eax, 0xedb88320
jmp 0x4016cf
shr eax, 1
dec esi
jne 0x4016b9
pop esi
ret 4

Function at 0x4016f6
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [0x409400]
mov edx, ecx
dec ecx
test edx, edx
je 0x401729
push edi
lea edx, [ecx + 1]
mov ecx, dword [esp + 8]
push esi
movzx esi, byte [ecx]
movzx edi, al
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x409000]
xor eax, esi
inc ecx
dec edx
jne 0x40170f
pop esi
pop edi
mov dword [0x409400], eax
ret
Function at 0x401e59
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x604
push ebx
push esi
push edi
lea eax, [ebp - 0x320]
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [ebp + 0xc]
xor ebx, ebx
cmp byte [edi], bl
je 0x401e9c
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x320]
push 0x408b64
push eax
call esi
lea eax, [ebp - 0x320]
push edi
push eax
call esi
mov esi, dword [ebp + 0x10]
cmp esi, 0xffffffff
jne 0x401eb8
lea eax, [ebp - 0x320]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x401f75
mov eax, dword [0x408aa4]
test eax, 0x10000
je 0x401f1f
test eax, 0x20000
je 0x401f1f
mov eax, dword [0x409820]
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x408fb4]
cmp eax, ebx
mov dword [ebp - 0x38], 0x640
mov dword [ebp - 0x30], str.Install
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], 1
je 0x401f0f
lea ecx, [ebp - 0x3c]
push ecx
call eax
mov ecx, dword [ebp - 4]
jmp 0x401f14
mov dword [ebp - 0x1c], ebx
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
cmp esi, ebx
je 0x401f39
mov dword [esi], ecx
jmp 0x401f39
lea eax, [ebp - 0x320]
push eax
call fcn.00401f7a
cmp eax, ebx
pop ecx
je 0x401f39
cmp esi, ebx
je 0x401f36
mov dword [esi], eax
push 0x21
pop eax
cmp eax, 0x20
ja 0x401f75
push dword [ebp + 8]
push eax
push 0x17
call fcn.0040108f
push eax
lea eax, [ebp - 0x604]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x604]
push ebx
push str.WinZip_Self_Extractor
push eax
push dword [0x409820]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401f7a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
xor esi, esi
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00401056
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], esi
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [ebp - 0x4c], esi
push dword [ebp + 8]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
push esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], 0xa
mov word [ebp - 0x22], si
mov dword [ebp - 0x20], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop esi
and eax, dword [ebp - 0x10]
leave
ret

Function at 0x4024ee
Capabilities:
Query environment variable

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
ret
Function at 0x403bf6
Capabilities:
Delete file
Set file attributes

Disassembly:
push 0x80
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
dec eax
neg eax
sbb eax, eax
neg eax
ret

Function at 0x403c17
Capabilities:
Get common file path
Get file size
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x520
push ebx
push esi
push edi
xor ebx, ebx
push 4
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
cmp eax, ebx
jne 0x403daa
push dword [ebp + 8]
lea eax, [ebp - 0x520]
push 0x408c4c
push str._hs_hs_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov esi, str._Rename__r_n
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
add esp, 0x10
mov dword [ebp - 4], eax
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x120]
push 0x104
push eax
mov dword [ebp - 8], ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x120]
push eax
call fcn.00401163
pop ecx
lea eax, [ebp - 0x120]
push str.WinInit.Ini
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
push 0x8000080
push 4
push ebx
push ebx
lea eax, [ebp - 0x120]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0xc], esi
je 0x403daa
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
mov eax, dword [ebp - 4]
push ebx
lea eax, [edi + eax + 0xa]
push eax
push ebx
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [ebp - 0x10], eax
je 0x403d92
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
cmp esi, ebx
mov dword [ebp + 8], esi
je 0x403d86
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.00406130
pop ecx
cmp eax, ebx
pop ecx
jne 0x403d33
lea eax, [ebp - 0x1c]
push eax
lea eax, [esi + edi]
push 0x408c24
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
add edi, eax
mov dword [ebp - 8], edi
jmp 0x403d64
push 0xa
push eax
call fcn.00406070
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
je 0x403d61
mov eax, dword [ebp + 8]
inc esi
add eax, edi
sub eax, esi
push eax
mov eax, dword [ebp - 4]
add eax, esi
push esi
push eax
call fcn.00405d20
add esp, 0xc
sub esi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
push dword [ebp - 4]
lea eax, [ebp - 0x520]
push eax
mov eax, dword [ebp - 8]
add eax, esi
push eax
call fcn.00401000
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
add edi, dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc]
push ebx
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403daf
Capabilities:
Check for time delay via gettickcount
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
cmp dword [0x408fbc], 0
push ebx
push esi
push edi
jne 0x403f88
mov esi, dword [ebp + 8]
test esi, esi
je 0x403f6d
cmp byte [esi], 0
je 0x403f6d
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 4
jl 0x403f6d
lea eax, [ebp - 0x10c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
push eax
call fcn.00401163
pop ecx
lea eax, [ebp - 0x10c]
push 0x408c54
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x403f59
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10c]
push eax
call fcn.00401163
cmp byte [ebp - 0x11c], 0
pop ecx
lea eax, [ebp - 0x11c]
jne 0x403e71
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test byte [ebp - 0x24c], 0x10
je 0x403f06
cmp byte [ebp - 0x11c], 0
push 0x408c50
je 0x403eb9
lea eax, [ebp - 0x11c]
push eax
call fcn.004061b0
pop ecx
test eax, eax
pop ecx
je 0x403f41
push 0x408bd0
lea eax, [ebp - 0x11c]
jmp 0x403ed6
lea eax, [ebp - 0x220]
push eax
call fcn.004061b0
pop ecx
test eax, eax
pop ecx
je 0x403f41
push 0x408bd0
lea eax, [ebp - 0x220]
push eax
call fcn.004061b0
pop ecx
test eax, eax
pop ecx
je 0x403f41
push dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push eax
call fcn.00403daf
pop ecx
test al, al
pop ecx
jne 0x403f41
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x403f41
xor bl, bl
call esi
lea edi, [eax + 0x3e8]
call esi
cmp edi, eax
jbe 0x403f30
lea eax, [ebp - 0x10c]
push eax
call fcn.00403bf6
test eax, eax
pop ecx
je 0x403f2e
call fcn.00402366
jmp 0x403f10
mov bl, 1
test bl, bl
jne 0x403f41
lea eax, [ebp - 0x10c]
push eax
call fcn.00403c17
pop ecx
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403e3f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
jmp 0x403f8a
push 0
push str.WinZip_Self_Extractor
push 0x18
call fcn.0040108f
push eax
push dword [0x409820]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403f8f
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov bl, 0x22
cmp byte [eax], bl
je 0x403f9f
add bl, 0xfe
mov cl, byte [eax + 1]
inc eax
xor edx, edx
cmp cl, dl
je 0x403fb3
cmp cl, bl
je 0x403fb3
mov cl, byte [eax + 1]
inc eax
jmp 0x403fa5
cmp byte [eax], dl
je 0x403fb8
inc eax
push edx
push eax
push edx
push edx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]