joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c6c54
Capabilities:
Encrypt data using aes

Disassembly:
mov word [esp], dx
add esp, 3
jmp 0x6c6c61
lea esp, [esp + 1]
and edx, ecx
pushal
pop word [esp + 0xb]
lea esp, [esp + 2]
jmp 0x6c6c88
mov edx, dword [edx*4 + 0x6a2ae0]
sub esp, 0xe
add esp, 0xd
lea esp, [esp + 1]
jmp 0x6c6cff
and edx, ecx
call fcn.006c6c9b
mov dword [esi], edi
lea edi, [edx + edx]
mov di, 0x4ec1
jmp 0x6c723c
and ebx, ecx
push esp
call fcn.006c6dab
and byte [eax + 0xfb8492e], bh
push cs
xchg ebp, eax
add eax, 0x842a9f6c
aaa
push ds
imul ecx, dword [eax - 0x6a5c575], 0xdfeb54f9
aaa
scasd eax, dword es:[edi]
aas
pop edx
test eax, 0x56c05f74
xor eax, eax
jae 0x6c6d53
mov edi, dword [edx]
pop edx
stc
stc
push esp
jmp 0x6c6d28
sal byte [ebx - 3], 0xcc
pop edi
cmpsb byte [esi], byte es:[edi]
rcl dword [edx - 0x75]
xlatb
int3
push edx
mov edx, edi
lea edx, [edx*4]
lea edx, [edx + 0x6a2ee0]
jmp 0x6c6d41
and edi, ecx
sub esp, 0x18
push word [esp + 0xb]
lea esp, [esp + 2]
jmp 0x6c6d5a
lea esp, [esp + 2]
mov edi, dword [edi*4 + 0x6a2ae0]
push esp
add esp, 3
lea esp, [esp + 1]
jmp 0x6c6d7c
mov edi, edx
shr edi, 0x18
sub esp, 0xc
cmc
push word [esp + 0xb]
jmp 0x6c6df0
mov ebx, dword [ebx*4 + 0x6a2ae0]
mov di, word [esp]
lea edi, [edi + edi]
mov di, word [esp]
jmp 0x6c6e20

Function at 0x6c6ccf
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
mov dword [esp], eax
pushal
jmp 0x6c6ce5
mov edx, dword [esi + 4]
call 0x6c6ccf
xor esp, dword [esi - 0x77]
cmp al, 0x24
jmp 0x6c6d06
lea esp, [esp + 0x40]
xor edi, dword [edx*4 + 0x6a3ae0]
mov dl, byte [esp]
mov dh, bh
mov edx, dword [esp]
jmp 0x6c6cc6

Function at 0x6c6e98
Capabilities:
Encrypt data using aes

Disassembly:
push ecx
mov ecx, edx
lea ecx, [ecx*4]
jmp 0x6c6ea3
clc
clc
pushal
jmp 0x6c6e65
add esp, 1
lea esp, [esp + 3]
and edx, ecx
jmp 0x6c6e80
lea ecx, [ecx + 0x6a2ae0]
mov edx, dword [ecx]
pop ecx
sub esp, 0x10
jmp 0x6c6f01
and edx, ecx
call fcn.006c6eea

Function at 0x6c6eea
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
lea esp, [esp + 0x34]
xor edi, dword [edx*4 + 0x6a3ae0]
jmp 0x6c6ed0

Function at 0x6c6fff
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 0x1c]
xor edi, dword [ebx*4 + 0x6a32e0]
movzx ebx, byte [esi + 0xd]
clc
sub esp, 2
jmp 0x6c7085
mov word [esp + 2], sp
jmp 0x6c6fd8
pushal
call 0x6c7006
lea ebp, [ebp*4]
lea ebp, [ebp + 0x6a2ae0]
mov edx, dword [ebp]
pop ebp
stc
jmp 0x6c7064
stc
and edx, ecx
pushal
lea esp, [esp + 0x40]
jmp 0x6c70b5
mov edx, dword [esi + 0xc]
jmp 0x6c708f
lea esp, [esp + 2]
and edx, ecx
pushal
push ebp
jmp 0x6c702e
mov dword [esi + 8], edi
mov ebx, dword [ebx*4 + 0x6a2ae0]
lea edi, [ecx - 0x4b]
jmp 0x6c70f2
xor edi, dword [edx*4 + 0x6a3ae0]
jmp 0x6c706e
mov edi, edx
call 0x6c709e
Function at 0x6c727e
Capabilities:
Encrypt data using aes

Disassembly:
lea esp, [esp + 4]
xor edi, dword [edx*4 + 0x6a3ae0]
push esp
lea esp, [esp + 1]
mov byte [esp + 1], bh
jmp 0x6c72e0
xor dword [ebx + 0x47b4ad3d], ebp
neg byte [ebx + 0x16fb9c0e]
cmpsb byte [esi], byte es:[edi]
pop ds
xchg cx, ax
mov byte [esp + 2], dh
mov byte [esp + 2], bh
jmp 0x6c7253
in al, 0x17
cmpsb byte [esi], byte es:[edi]
add bl, byte [esi + 0x63a66b0c]
outsd dx, dword [esi]
jbe 0x6c726e
lea esp, [esp + 3]
and al, 3
dec dword [ebp - 4]
pushal
mov word [esp + 0x16], bx
call fcn.006c72c1
jle 0x6c72d5
jno 0x6c7306
jecxz 0x6c731a
mov al, byte [0xec8360e3]
or byte [ebp + 0x33642464], cl
cmp al, 0x9d
loopne 0x6c7339
xor ch, byte [edx]
push 0
cwde
push cs
imul ebx, dword [eax - 0x689b8ae1], 0x324648d
ljmp 0x228b:0x59ea1f78

Function at 0x6cd2a6
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp], dh
pop word [esp]
call fcn.006cd27f
pushal
lea esp, [esp + 0x20]
jmp 0x6cd31e
call fcn.006cd34e
mov word [esp], dx
jmp 0x6cd353
dec dword [esp + 8]
not ah
pushal
pop word [esp + 0x17]
jmp 0x6cd426
lea esp, [esp + 0x20]
push edi
mov edi, 0xdf7fc0f6
pushal
jmp 0x6cd45d
mov eax, dword [esp + 4]
clc
pushal
mov dword [esp + 5], ebp
jmp 0x6cd2fe
lea esp, [esp + 4]
dec dword [esp + 8]
pushal
pop word [esp + 0x13]
push edx
jmp 0x6cd386
lea esp, [esp + 0x1b]
push word [esp + 4]
lea esp, [esp + 3]
lea esp, [esp + 4]
je 0x6cd2e8
jmp 0x6cd2ca
pop dword [esp + 0x18]
lea esp, [esp + 2]
lea esp, [esp + 0x1c]
mov al, byte [edx]
pushal
jmp 0x6cd40f
mov eax, dword [esp + 8]
jmp 0x6cd3e5
stc
lea esp, [esp + 8]
popal
test eax, eax
pushal
jmp 0x6cd36a
inc edx
sub esp, 0xc
pushal
sub esp, 0x10
add esp, 5
jmp 0x6cd3ca
lea esp, [esp + 3]
lea esp, [esp + 0x34]
test eax, eax
call fcn.006cd3f5
js 0x38f54cfd
movsd dword es:[edi], dword [esi]
aam 0x47
out dx, al
stc
fadd dword [ecx + 0x54]
inc ecx
push esp
mov word [esp], dx
pop word [esp]
lea esp, [esp + 2]
jmp 0x6cd3b9
push word [esp + 1]
lea esp, [esp + 2]
lea esp, [esp + 0x20]
mov byte [ecx], al
setb al
jmp 0x6cd397
pop eax
lea esp, [esp + 2]
pushal
rdtsc
mov dword [esp + 0x1c], edi
jmp 0x6cd619
sub esp, 0xc
pop dx
lea edi, [edx + edx]
mov dl, 0xbc
lea esp, [esp + 2]
mov dword [esp + 8], ecx
jmp 0x6cd3ae
popal
lea esp, [esp + 0x18]
pop edi
call fcn.006cd516
pushal
lea esp, [esp + 0xb]
push dword [esp + 0xa]
lea esp, [esp + 1]
jmp 0x6cd712
add ecx, ebp
jmp 0x6cd6f3
xor edx, edx
sub esp, 0x12
lea esp, [esp + 2]
jmp 0x6cd659
mov ecx, dword [ebp + 0x3c]
bswap eax
xchg dh, dl
mov eax, dword [esp]
xchg dx, ax
jmp 0x6cd66f
mov ebp, dword [esp + 0x2c]
setl ah
clc
mov cx, bp
inc ecx
jmp 0x6cd686
rdtsc
mov dword [esp + 0x1c], ebp
lea ebp, [ecx*4]
lea esp, [esp + 0x1c]
jmp 0x6cd6a5
pop dword [esp]
lea esp, [esp + 2]
lea esp, [esp + 8]
cmp word [ecx + 0x18], ax
call fcn.006cd722
fld dword [edx + ebx*8 - 0x43]
dec esp
invalid
lea esp, [esp + 0x10]
mov eax, 0x10b
mov dword [esp + 0x14], edx
sub esp, 0xe
jmp 0x6cd6d6
lea esp, [esp + 0x18]
sub esp, 0x24
seto cl
shl cl, 3
pushal
jmp 0x6cd6c3
Function at 0x6cd3f5
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 4]
jmp 0x6cd442
jne 0x6cd2ca
je 0x6cd2e8
outsb dx, byte [esi]
out 0x74, al
adc ebp, esi
push ecx
pushfd
sbb ecx, dword [ebx - 0x126e212]
leave
push 0x660cec83
pop edx

Function at 0x7724c5
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dword [esp + 0xc]
bswap ebp
popal
lea ebx, [edx + edi]
bswap ebx
xchg edi, eax
jmp 0x772440
lea edx, [ecx + 0x1b]
bsf di, si
mov cl, ch
rol bx, cl
pop bx
jmp 0x772389
pop dword [esp + 0x12]
pop ecx
xchg dx, cx
stc
pop dword [esp + 0x18]
sub esp, 0xe
jmp 0x77239f
lea ebx, [eax + 1]
mov bl, 0x88
btr ecx, edx
mov edx, ebp
btr ebx, edx
mov word [esp + 0xe], sp
jmp 0x7723b6
xchg bh, cl
push word [esp + 8]
mov ax, 0x8789
xchg word [esp + 7], bx
not dh
xchg ah, bl
jmp 0x772427
lea esp, [esp + 1]
pop di
pop eax
xchg bx, si
cmc
pop dx
jmp 0x7723e3
neg ch
rdtsc
pop dword [esp + 2]
xchg esi, eax
neg dx
inc cl
jmp 0x772457
xchg dword [esp + 5], ecx
pop ebp
cpuid
pop bx
mov dword [esp + 4], ebp
add esp, 0
jmp 0x77240f
mov cl, ch
mov ecx, 0xad0439b0
inc bp
mov di, word [esp + 0xe]
add di, 0xb116
rdtsc
jmp 0x772400
mov al, 0xfe
lea esp, [esp + 1]
clc
xchg ecx, ebp
add esp, 3
call fcn.007724a8
cdq
setg dl
or dword [eax - 0x4053a2de], esi
xchg byte [esi - 0x43f09931], al
fiadd word [ebx - 0x1478eb14]
xchg bh, cl
bsf bx, si
sub esp, 0x14
xchg ebx, ebp
lea ebp, [esi*4]
sub esp, 0x1c
jmp 0x7723cf
jmp 0x772473
Function at 0x772898
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
xchg byte [esp], dl
mov si, dx
jmp 0x77286c
mov byte [esp], ch
lea eax, [edi*4]
rdtsc
call 0x772898
sbb byte [ebp + 0x3c97641d], cl
mov bl, byte [esi]
mov ebx, gs
nop
out dx, eax
mul cl
xchg dword [esp + 4], eax
btc ecx, ebx
call fcn.0077281a
push edx
mov eax, 0xcac50110
mov si, 0xfea5
jmp 0x772a26
bswap esi
mov byte [esp + 1], dh
lea ebp, [ebx + esi]
lea ecx, [eax + edi]
mov al, 0x6e
add esp, 0
jmp 0x7729c2
mov word [esp + 6], sp
add esp, 5
rcr edx, 5
not ah
mov si, word [esp + 3]
mov dh, byte [esp + 1]
jmp 0x7728c4
bsr bx, cx
bswap ebp
not esi
mov ebx, 0x84b3dc5c
mov ah, byte [esp + 9]
xchg bh, cl
jmp 0x7728ed
mov bx, word [esp]
cpuid
bsf bp, si
rdtsc
mov ch, byte [esp + 7]
xchg ebx, eax
jmp 0x77291a
and si, 0x84ca
setl bh
rdtsc
lea esp, [esp + 0xd]
pop word [esp + 1]
xchg dword [esp + 0x14], ebp
jmp 0x7729aa
lea esp, [esp + 4]
mov bx, sp
mov ebx, esi
pushal
mov ch, byte [esp + 6]
mov di, bx
jmp 0x772949
lea esi, [eax - 0xc1]
add esp, 0x13
xchg bx, si
bswap ebp
sub esp, 0x10
mov cl, 0xa
jmp 0x7729fe
xchg word [esp + 0x19], bp
lea edi, [edx + edi]
mov word [esp + 0x12], dx
stc
jmp 0x772985
xchg dword [esp], edi
lea eax, [edx*4]
sub esp, 8
push dword [esp + 7]
rcr ebx, 0x1f
xchg ebx, ebp
jmp 0x772972
mov cl, 0x2a
mov ebp, dword [esp + 0xb]
cpuid
xchg word [esp + 3], si
mov dl, dh
mov byte [esp + 8], ah
jmp 0x772b09
add esp, 0xf
mov dl, dh
bswap ebx
mov byte [esp + 2], ah
bsf di, si
lea eax, [edi*4]
jmp 0x7729da
mov al, 0xee
push dword [esp + 2]
bsf dx, si
pop eax
bsr dx, cx
lea edx, [edi*4]
jmp 0x772936
mov dl, 0x74
add esp, 0xd
mov ecx, esi
mov bp, word [esp + 1]
mov ebp, ecx
mov byte [esp + 3], ch
jmp 0x772a66
pop bp
neg ch
pop ebp
cpuid
push edx
popal
jmp 0x772a41
mov esi, dword [esp + 2]
push dword [esp]
xchg ch, dl
lea esp, [esp + 2]
cpuid
mov ax, di
jmp 0x772ae0
xchg dh, al
btc ebp, ebx
mov eax, ecx
xchg ebp, edx
pop ebx
xchg byte [esp + 0x2e], bl
jmp 0x772a5b
sub esp, 0x1e
xchg cx, dx
lea eax, [edx*4]
sub esp, 0xe
mov byte [esp + 0x20], ah
mov cl, ch
jmp 0x772a80
cpuid
lea eax, [ecx*4]
mov byte [esp + 1], ah
call fcn.00772ab4
cpuid
bswap esi
pop word [esp + 4]
inc dl
setg ah
not ch
jmp 0x772b20
add al, 0xfe
ret 0x9f0f
mov esi, 0x8b4b2889
je 0x772b30
mov esi, dword [esp + 9]
xchg ebx, ecx
btr ecx, edx
or dword [edi - 0x2e4cf035], eax
mov dl, dh
mov bx, dx
mov di, 0xadb5
jmp 0x772a9c
pushal
mov dx, sp
ror edi, 0x11
lea esp, [esp + 0x14]
neg dh
inc ax
jmp 0x772b7b
dec edx
out dx, al
pushal
not byte [ecx - 0x62ef71a0]
or eax, 0x6c47a754
push word [esp + 1]
mov dword [esp + 3], eax
call fcn.00772b45
loopne 0x772be3
loopne 0x772afa
jb 0x772b05
ljmp 0x9a0f:0xcea7b405
setp ch
shr dh, 7
lea edx, [eax + 0x71]
cpuid
mov bx, word [esp]
add esp, 0xf
jmp 0x772b61
Function at 0x772b45
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr di, cx
pop dword [esp]
mov dx, word [esp + 6]
cld
jmp 0x772b8f
lea esp, [esp + 5]
xchg di, ax
mov bh, byte [esp + 1]
btr ecx, esp
mov eax, 0xcfbe0caa
bswap edx
jmp 0x773c6f
mov ax, sp
xchg byte [esp], cl
xchg ebp, ebx
neg cx
setp ch
mov al, ah
jmp 0x772c95
xchg esi, edx
xchg di, ax
lea ebp, [eax - 0x91]
cld
mov dh, byte [esp]
lea edi, [eax + edx]
jmp 0x772bd3
mov byte [esp], dh
shr dh, 7
setg dh
mov edx, 0x7b0dfc7a
sub esp, 0x1e
bswap ecx
jmp 0x772c76
lea esp, [esp]
mov ecx, 0xcc2b875c
not bh
mov dx, word [esp]
setae ah
bswap ecx
jmp 0x772c02
rcr bh, 3
mov bl, bh
bswap ecx
mov dword [esp], esi
cmc
xchg edx, eax
jmp 0x772d4a
xchg bp, cx
not ch
rdtsc
mov ecx, dword [esp + 5]
xchg ah, bl
xor dl, ch
jmp 0x772c41
lea ecx, [edx + edi]
inc edi
lea esp, [esp + 0x17]
pop word [esp + 1]
lea eax, [edi*4]
xchg esi, eax
jmp 0x772c5e
rdtsc
stc
bsf dx, si
mov esi, 0xe4c81288
neg bp
btr esi, edx
jmp 0x772c2c
inc al
pop dword [esp + 4]
mov cx, 0x8a37
xchg word [esp + 0x13], bp
jmp 0x772cd4
xchg word [esp + 3], cx
mov cl, ch
mov si, di
mov dh, byte [esp + 5]
inc bl
push dword [esp]
jmp 0x772ca9
add esp, 0x17
not esi
xchg ebp, eax
not si
bswap esi
mov ax, sp
jmp 0x772d30
pop word [esp]
neg bp
sub esp, 0xc
mov ax, bx
call fcn.00772d12
inc edi
out dx, al
stc
fdivr dword [ebx]
add dx, 0x7956
xchg byte [esp + 0xf], al
push esp
mov ebp, dword [esp + 1]
mov byte [esp], bh
mov si, 0x5e47
jmp 0x772cbf
push word [esp + 2]
rdtsc
mov word [esp], di
btc ebx, ebx
mov word [esp], di
rdtsc
jmp 0x772ce4
xchg byte [esp + 4], cl
lea ecx, [eax + edx]
sub esp, 0x10
mov dx, di
xchg byte [esp + 0x13], dl
lea ebp, [ecx - 0x17f04b65]
jmp 0x772cfb
mov ax, sp
not bx
mov ax, 0x5df3
pop bx
rdtsc
sub cx, 0xafb8
jmp 0x772bef
lea esi, [edx + edi]
xchg word [esp], si
xchg ebp, ebx
neg bh
lea ebx, [esp + ebx]
inc ax
jmp 0x772eef
xchg word [esp], bp
mov di, word [esp + 1]
lea esp, [esp]
xchg cx, bp
xchg dh, al
cpuid
jmp 0x773548

Function at 0x773308
Capabilities:
Parse pe header

Disassembly:
push word [esp + 1]
mov byte [esp + 3], ah
mov dword [esp], eax
pop word [esp + 1]
jmp 0x773338
push dword [esp + 4]
lea esp, [esp + 1]
mov dword [esp + 0x8c], edi
jmp 0x773365
pop word [esp]
lea esp, [esp + 1]
pushal
push edx
push dword [esp + 1]
mov byte [esp + 0x19], dh
jmp 0x773321
lea esp, [esp + 0x8c]
jmp 0x7733c6
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x7733b0

Function at 0x77331f
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
lea esp, [esp + 5]
lea esp, [esp + 2]
mov byte [esp], ch
lea esp, [esp]
mov byte [esp], ah
pushal
jmp 0x773358
jmp 0x7732f4
lea esp, [esp + 1]
mov dword [esp + 0x64], esi
call fcn.00773308

Function at 0x77337d
Capabilities:
Parse pe header

Disassembly:
mov word [esp], di
call fcn.0077331f
mov al, byte [0x34c5a22c]
fbstp tbyte [esi + 0x3bc8a939]
fimul dword [eax + 0x1aef881a]
clc
sti
ror byte [ebp + 0x661b2464], cl
pop dword [esp]
Function at 0x4015a9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x456220]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, ecx
push 0xc35
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, eax
test edi, edi
je 0x40160f
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.004329b0
add esp, 0xc
push 0x400
lea eax, [ebp - 0x804]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x40160f
add esi, 0x10
lea eax, [ebp - 0x804]
call fcn.00401639
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0043253e
leave
ret
Function at 0x4023e1
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
xor ebx, ebx
push str.advapi32.dll
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov byte [esi + 0x18], bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp eax, ebx
mov dword [esi + 0x1c], eax
je 0x40247d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RegCreateKeyExW
push eax
call edi
push str.RegQueryValueW
push dword [esi + 0x1c]
mov dword [esi], eax
call edi
push str.RegSetValueW
push dword [esi + 0x1c]
mov dword [esi + 4], eax
call edi
push str.RegQueryValueExW
push dword [esi + 0x1c]
mov dword [esi + 8], eax
call edi
push str.RegSetValueExW
push dword [esi + 0x1c]
mov dword [esi + 0xc], eax
call edi
push str.RegCloseKey
push dword [esi + 0x1c]
mov dword [esi + 0x10], eax
call edi
cmp dword [esi], ebx
mov dword [esi + 0x14], eax
pop edi
je 0x40247d
cmp dword [esi + 4], ebx
je 0x40247d
cmp dword [esi + 8], ebx
je 0x40247d
cmp dword [esi + 0xc], ebx
je 0x40247d
cmp dword [esi + 0x10], ebx
je 0x40247d
cmp eax, ebx
je 0x40247d
mov byte [esi + 0x18], 1
mov eax, esi
pop ebx
ret

Function at 0x403b12
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push 0x44
mov esi, eax
xor ebx, ebx
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.004329b0
push 0x10
lea eax, [ebp - 0x14]
push ebx
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.004329b0
add esp, 0x18
cmp dword [esi + 0x18], 8
mov dword [ebp - 0x30], 1
mov word [ebp - 0x2c], 5
jb 0x403b58
mov esi, dword [esi + 4]
jmp 0x403b5b
add esi, 4
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x403b69
mov eax, dword [eax + 4]
jmp 0x403b6c
add eax, 4
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x5c]
push ecx
push esi
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403b98
cmp dword [ebp - 0x14], ebx
je 0x403b94
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x403b9a
xor al, al
pop esi
pop ebx
leave
ret 4
Function at 0x404a9e
Capabilities:
Accept command line arguments

Disassembly:
push 0x28
mov eax, 0x4422bf
call fcn.00434958
mov eax, dword [ebp + 8]
xor esi, esi
cmp dword [eax + 0x18], 8
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x30], esi
jb 0x404ac0
mov eax, dword [eax + 4]
jmp 0x404ac3
add eax, 4
lea ecx, [ebp - 0x30]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, eax
cmp ebx, esi
jne 0x404ad8
xor al, al
jmp 0x404b2b
xor edi, edi
cmp dword [ebp - 0x30], esi
jle 0x404b17
jmp 0x404ae3
xor esi, esi
mov eax, dword [ebx + edi*4]
lea ecx, [ebp - 0x2c]
call fcn.0040161d
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
je 0x404b02
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x34]
call fcn.00404b72
or dword [ebp - 4], 0xffffffff
push esi
push 1
lea esi, [ebp - 0x2c]
call fcn.0040117c
inc edi
cmp edi, dword [ebp - 0x30]
jl 0x404ae1
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 0x34]
call fcn.004010bf
test eax, eax
setne al
call fcn.004349db
ret 4
Function at 0x407105
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b8
mov eax, dword [0x456220]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x18], 8
jb 0x407126
mov eax, dword [eax + 4]
jmp 0x407129
add eax, 4
push 0x100
push 0x2b4
lea ecx, [ebp - 0x2b8]
push ecx
push 0
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x407150
mov eax, dword [ebp - 0x2b8]
mov dword [esi + 0x18], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043253e
leave
ret 4
Function at 0x409d21
Capabilities:
Get graphical window text

Disassembly:
push 0x294
mov eax, 0x443b82
call fcn.00434958
lea eax, [ebp - 0x258]
mov edi, ecx
push 0x27f4
push eax
mov dword [ebp - 0x264], edi
call fcn.00403ac3
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x240], 8
mov eax, dword [ebp - 0x254]
jae 0x409d64
lea eax, [ebp - 0x254]
mov esi, dword [sym.imp.USER32.dll_SetWindowTextW]
push eax
push dword [edi + 4]
call esi
push 0x20a
lea eax, [ebp - 0x220]
push 0
push eax
call fcn.004329b0
add esp, 0xc
push 0x3ec
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
mov dword [ebp - 0x260], eax
je 0x409ddf
push eax
call ebx
test eax, eax
je 0x409ddf
push 0x104
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x260]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x409ddf
and word [ebp - 0x18], 0
lea esi, [edi + 0x298]
lea eax, [ebp - 0x220]
call fcn.00401639
jmp 0x409e08
push dword [ebp - 0x260]
call ebx
test eax, eax
je 0x409e08
lea eax, [edi + 0x298]
cmp dword [eax + 0x18], 8
jb 0x409dfc
mov eax, dword [eax + 4]
jmp 0x409dff
add eax, 4
push eax
push dword [ebp - 0x260]
call esi
add edi, 0x298
lea ecx, [ebp - 0x280]
call fcn.0040c43e
push 0xffffffffffffffff
push edi
xor ebx, ebx
mov byte [ebp - 4], 1
call fcn.004010f4
push ebx
push 1
lea esi, [ebp - 0x280]
mov byte [ebp - 4], bl
call fcn.0040117c
push 0x44712c
push edi
call fcn.0040d729
mov ebx, dword [ebp - 0x264]
cmp byte [ebx + 0x90], 0
pop ecx
pop ecx
je 0x409f52
cmp dword [ebx + 0x88], 0
je 0x409f52
lea ecx, [ebx + 0x74]
mov eax, edi
call fcn.0040d59a
test eax, eax
je 0x409f52
lea esi, [ebp - 0x2a0]
call fcn.004023e1
lea eax, [ebx + 0x324]
lea esi, [ebp - 0x23c]
mov byte [ebp - 4], 2
call fcn.004010a0
mov byte [ebp - 4], 3
call fcn.0040d7cc
push 0x25
push 0x3a
call fcn.0040d6ae
push 0x25
push 0x5c
call fcn.0040d6ae
mov ebx, str.SoftwareHaoZip_SFX
add esp, 0x10
mov eax, ebx
lea ecx, [ebp - 0x280]
call fcn.0040161d
lea eax, [ebp - 0x280]
lea esi, [ebp - 0x2a0]
mov byte [ebp - 4], 4
call fcn.00402490
push 0
push 1
lea esi, [ebp - 0x280]
mov byte [ebp - 0x259], al
mov byte [ebp - 4], 3
call fcn.0040117c
cmp byte [ebp - 0x259], 0
je 0x409f38
mov eax, ebx
lea ecx, [ebp - 0x280]
call fcn.0040161d
lea eax, [ebp - 0x23c]
push eax
mov ecx, edi
lea eax, [ebp - 0x280]
lea esi, [ebp - 0x2a0]
mov byte [ebp - 4], 5
call fcn.004025c6
push 0
push 1
lea esi, [ebp - 0x280]
call fcn.0040117c
push 0
push 1
lea esi, [ebp - 0x23c]
call fcn.0040117c
lea eax, [ebp - 0x2a0]
call fcn.00402481
push 0
push 1
lea esi, [ebp - 0x258]
call fcn.0040117c
call fcn.004349db
ret
Function at 0x40c334
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x398]
sub esp, 0x418
mov eax, dword [0x456220]
xor eax, ebp
mov dword [ebp + 0x394], eax
push esi
push edi
xor edi, edi
push 0x40e
lea eax, [ebp - 0x7a]
push edi
push eax
mov esi, ecx
mov word [ebp - 0x7c], di
call fcn.004329b0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 0x3a0]
mov dword [ebp - 0x80], edi
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
je 0x40c387
xor al, al
jmp 0x40c3c0
lea eax, [ebp - 0x7c]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
jne 0x40c3a8
cmp dword [ebp - 0x80], edi
je 0x40c383
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x40c383
lea eax, [ebp - 0x7c]
call fcn.00401639
cmp dword [ebp - 0x80], edi
je 0x40c3be
push dword [ebp - 0x80]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov al, 1
mov ecx, dword [ebp + 0x394]
pop edi
xor ecx, ebp
pop esi
call fcn.0043253e
add ebp, 0x398
leave
ret

Function at 0x40c3d7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push esi
push 0x38
xor esi, esi
lea eax, [ebp - 0x38]
push esi
push eax
call fcn.004329b0
add esp, 0xc
mov dword [ebp - 0x3c], 0x3c
mov dword [ebp - 0x38], esi
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], str.regedit
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 4], esi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
pop esi
je 0x40c43a
push 0x20
pop eax
cmp eax, dword [ebp - 0x1c]
sbb eax, eax
neg eax
leave
ret
xor al, al
leave
ret
Function at 0x40c43e
Capabilities:
Query environment variable

Disassembly:
push 0x2c
mov eax, 0x4420b5
call fcn.00434958
push 1
lea eax, [ebp - 0x30]
mov esi, ecx
xor ebx, ebx
push eax
mov dword [ebp - 0x30], ebx
xor eax, eax
mov ecx, edi
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x30], 0x25
call fcn.00404cf1
cmp eax, 0xffffffff
mov eax, edi
jne 0x40c47d
call fcn.004010a0
mov eax, esi
jmp 0x40c518
lea esi, [ebp - 0x2c]
call fcn.004010a0
mov dword [ebp - 4], ebx
cmp dword [edi + 0x18], 8
lea eax, [edi + 4]
mov dword [ebp - 0x38], eax
jb 0x40c496
mov eax, dword [eax]
push ebx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push eax
call ebx
mov esi, eax
test esi, esi
jne 0x40c4ab
mov eax, edi
jmp 0x40c501
xor ecx, ecx
push 2
pop edx
lea eax, [esi + 2]
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004324b6
cmp dword [edi + 0x18], 8
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x38]
pop ecx
jb 0x40c4d1
mov eax, dword [eax]
lea ecx, [esi + 1]
push ecx
push dword [ebp - 0x30]
push eax
call ebx
test eax, eax
jbe 0x40c4f5
cmp eax, esi
ja 0x40c4f5
mov ecx, dword [ebp - 0x30]
and word [ecx + eax*2], 0
mov eax, ecx
lea esi, [ebp - 0x2c]
call fcn.00401639
push dword [ebp - 0x30]
call fcn.0043308c
pop ecx
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x34]
call fcn.004010a0
push 0
push 1
lea esi, [ebp - 0x2c]
call fcn.0040117c
mov eax, dword [ebp - 0x34]
call fcn.004349db
ret