joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474c90
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0xa0
push ebx
push ebp
mov ebp, dword [esp + 0xac]
push esi
push edi
push ebp
call sub.RASAPI32.dll_RasHangUpA
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x28
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov dword [esp + 0x10], 0xa0
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0xbb8
jae 0x474cf6
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [esp + 0x10]
push eax
push ebp
call sub.RASAPI32.dll_RasGetConnectStatusA
cmp eax, 6
je 0x474cf6
push 0
call ebx
call esi
sub eax, edi
cmp eax, 0xbb8
jb 0x474cd7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x475080
Capabilities:
Create http request

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x4750b8
mov edx, dword [esi + 4]
xor eax, eax
push 0
push 0
mov ecx, dword [edx - 8]
test ecx, ecx
setne al
mov ecx, eax
neg ecx
sbb ecx, ecx
and ecx, edx
neg eax
sbb eax, eax
push ecx
and eax, 2
inc eax
push eax
push str.Mozilla_4.0__compatible__MSIE_6.0__Windows_NT_5.0_
call dword [sym.imp.WININET.dll_InternetOpenA]
mov dword [esi], eax
mov ecx, dword [esi]
xor eax, eax
test ecx, ecx
setne al
pop esi
ret
Function at 0x475d90
Capabilities:
Get socket status

Disassembly:
sub esp, 0x10c
mov eax, dword [ecx]
lea ecx, [esp]
push ecx
push 0
lea edx, [esp + 0x10]
push 0
push edx
push 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], 1
call sub.WS2_32.dll_select
cmp eax, 0xffffffff
jne 0x475dd9
xor eax, eax
add esp, 0x10c
ret 4
mov edx, dword [esp + 0x110]
xor ecx, ecx
test eax, eax
setne cl
mov dword [edx], ecx
mov eax, 1
add esp, 0x10c
ret 4

Function at 0x476250
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4a4030
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
call fcn.00475e00
lea eax, [esp + 4]
lea ecx, [esi + 4]
push eax
mov dword [esp + 0x18], 0
call fcn.00475e80
lea ecx, [esp + 4]
push ecx
lea ecx, [esi + 0x14]
call fcn.00475e80
lea ecx, [esi + 0xc]
call fcn.0049506e
lea ecx, [esi + 0x10]
call fcn.0049506e
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x1c]
call fcn.00477410
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x30]
call fcn.00477410
push 0xffffffffffffffff
push 0
lea ecx, [esi + 0x44]
call fcn.00477410
lea ecx, [esp + 8]
mov dword [esp + 0x14], 1
call fcn.004950e3
lea ecx, [esp + 4]
mov dword [esp + 0x14], 0xffffffff
call fcn.004950e3
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x4974b1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4974e9
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0049553e
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00495516
jmp 0x4974f5
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x498b9f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x498be1
call fcn.0049e921
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x498be1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x498bd8
xor eax, eax
jmp 0x498be9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00498bef
pop edi
pop esi
pop ebx
ret 4

Function at 0x49ee51
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49ee7f
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49ee9d
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0049edb7
jmp 0x49ee9d
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49ee9d
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0049edb7
test edi, edi
mov eax, edi
jne 0x49ee87
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4d3a10
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x79000]
push edi
jmp 0x4d3a2a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4d3a31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d3a20
mov eax, 1
add ebx, ebx
jne 0x4d3a43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4d3a54
jne 0x4d3a73
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d3a73
dec eax
add ebx, ebx
jne 0x4d3a60
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4d3a38
add ebx, ebx
jne 0x4d3a6f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4d3ac5
xor ecx, ecx
sub eax, 3
jb 0x4d3a8b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4d3afa
sar eax, 1
mov ebp, eax
jmp 0x4d3a96
add ebx, ebx
jne 0x4d3a96
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d3a64
inc ecx
add ebx, ebx
jne 0x4d3aa4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4d3a64
add ebx, ebx
jne 0x4d3ab1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4d3aa6
jne 0x4d3ac2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4d3aa6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4d3ae4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4d3ad6
jmp 0x4d3a26
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4d3ae4
add edi, ecx
jmp 0x4d3a26
pop esi
mov edi, esi
mov ecx, 0x3b55
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4d3b02
cmp byte [edi], 0x27
jne 0x4d3b02
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4d3b07
lea edi, [esi + 0xd1000]
mov eax, dword [edi]
or eax, eax
je 0x4d3b7f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xd4738]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xd479c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4d3b34
mov ecx, edi
jns 0x4d3b63
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xd47a0]
or eax, eax
je 0x4d3b79
mov dword [ebx], eax
add ebx, 4
jmp 0x4d3b51
call dword [esi + 0xd47b0]
mov ebp, dword [esi + 0xd47a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4d3bb3
sub esp, 0xffffff80
jmp 0x4766ef
Function at 0x29a01815
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x29a169b8]
jne 0x29a0181f
repz ret
jmp fcn.29a0e56f

Function at 0x29a0646f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x29a0647e
pop dword [ebp - 0x3c]
mov eax, 0x29a0647e
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x46d6786a
add dword [ebp - 0x4c], 0x77bcce1
mov dword [ebp - 0x48], 0xd795941f
add dword [ebp - 0x48], 0x5a9db826
mov dword [ebp - 0x44], 0xfa098ede
add dword [ebp - 0x44], 0x5242b550
mov dword [ebp - 0x40], 0x4e72ccdb
sub dword [ebp - 0x40], 0x4e72ccdb
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x30f702ff
add eax, 0xf8a9fda5
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x8002c00d
sub dword [ebp - 0x4c], 0xb9056b7
mov dword [ebp - 0x48], 0x4ae8ff90
sub dword [ebp - 0x48], 0x97c9e1b
mov dword [ebp - 0x44], 0x6b0fedd3
add dword [ebp - 0x44], 0xf85f7e99
mov dword [ebp - 0x40], 0x6ac0c638
sub dword [ebp - 0x40], 0x6ac0c638
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3b156
push 0
call eax
mov ecx, 0x4ed4
xor edx, edx
add edx, eax
mov edi, 0x3a4dbffb
add edi, 0xef542e05
add edi, dword [ebp - 0x3c]
mov esi, 0xbee9a00d
add dword [ebp - 0x18], 0xd097033a
mov ebx, dword [edi]
add dword [ebp - 0x2c], ebx
xor ebx, esi
xor dword [ebp - 0x24], 0xa0b46568
mov dword [edx], ebx
xor dword [ebp - 8], 0x382431e
add edx, 0x28e6971f
add edx, 0xd71968e5
add edi, 4
loop 0x29a0658c
add eax, 0x4f53d755
add eax, 0xb0ad56ce
xor ebx, ebx
add ebx, eax
add eax, 0xc8f4775a
sub eax, 0xc8f47755
mov ecx, 0x706f9357
add ecx, 0xb9306ca9
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4022a0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x420
mov eax, dword [0x40a020]
xor eax, esp
mov dword [esp + 0x41c], eax
push esi
mov esi, ecx
push edi
mov eax, esi
call fcn.00401a83
push 0x410
lea eax, [esp + 0xe]
push 0
push eax
mov word [esp + 0x14], 0
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
add esp, 0xc
push 0
push 0
call edi
test eax, eax
jne 0x402303
xor al, al
pop edi
pop esi
mov ecx, dword [esp + 0x41c]
xor ecx, esp
call fcn.004064de
add esp, 0x420
ret
cmp eax, 0x208
jae 0x4022ea
lea ecx, [esp + 8]
push ecx
push 0x209
call edi
test eax, eax
je 0x4022ea
cmp eax, 0x208
jae 0x4022ea
lea eax, [esp + 8]
mov word [esp + 0x418], 0
call fcn.00401b4f
mov ecx, dword [esp + 0x424]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.004064de
add esp, 0x420
ret

Function at 0x402510
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x4070a1
mov eax, dword fs:[0]
push eax
sub esp, 0x120
mov eax, dword [0x40a020]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
push edi
mov eax, dword [0x40a020]
xor eax, esp
push eax
lea eax, [esp + 0x130]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [esp + 0x10], esi
mov dword [esi + 0x1048], ebx
mov dword [esi + 0x104c], ebx
mov dword [esi + 0x1050], ebx
push 0x410
push ebx
push esi
mov dword [esp + 0x144], ebx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x410
lea eax, [esi + 0x410]
push ebx
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x400
lea ecx, [esi + 0x820]
push ebx
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x410
lea edx, [esi + 0xc20]
push ebx
push edx
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x110
lea eax, [esp + 0x1c]
push ebx
push eax
mov byte [esi + 0x1030], bl
mov byte [esi + 0x1031], bl
mov dword [esi + 0x1034], ebx
mov byte [esi + 0x1032], bl
mov byte [esi + 0x1038], 1
mov byte [esi + 0x1054], bl
mov dword [esp + 0x20], 0x114
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x402616
cmp dword [esp + 0x18], 6
jb 0x402616
mov byte [esi + 0x1032], 1
call fcn.00402670
mov edi, esi
call fcn.004037c0
mov eax, esi
mov ecx, dword [esp + 0x130]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.004064de
add esp, 0x12c
ret
Function at 0x4037c0
Capabilities:
Get hostname
Get session user name

Disassembly:
sub esp, 0x430
mov eax, dword [0x40a020]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push ebp
xor ebx, ebx
push esi
mov ecx, edi
mov byte [edi + 0x1054], bl
call fcn.004034d0
lea ecx, [edi + 0xc20]
mov eax, ecx
lea esi, [eax + 2]
mov dx, word [eax]
add eax, 2
cmp dx, bx
jne 0x4037f1
sub eax, esi
sar eax, 1
je 0x40380e
lea eax, [edi + 0x1044]
push eax
call fcn.004039a0
push 0x208
lea ecx, [esp + 0x22a]
push ebx
push ecx
mov word [esp + 0x230], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x228]
mov esi, 0x104
push eax
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0x208
lea ecx, [esp + 0x1a]
push ebx
push ecx
mov word [esp + 0x436], bx
mov word [esp + 0x20], bx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x18]
push eax
mov dword [esp + 0x14], esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov eax, dword [edi + 0x1048]
cmp eax, ebx
lea esi, [edi + 0x1044]
mov word [esp + 0x21a], bx
je 0x4038ae
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xa
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
jne 0x4038e3
lea eax, [esp + 0x14]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4038b5
sub eax, edx
sar eax, 1
push 1
add eax, 1
push eax
lea edx, [esp + 0x22c]
push edx
push ebx
mov edx, esi
lea ecx, [esp + 0x24]
call fcn.00403260
jmp 0x40397b
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x403904
mov ecx, dword [esi + 8]
sub ecx, eax
mov eax, 0x9ad70599
imul ecx
add edx, ecx
sar edx, 0xa
mov eax, edx
shr eax, 0x1f
add eax, edx
jne 0x40390a
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ebx, dword [esi + 4]
cmp byte [ebx + 0x69c], 1
je 0x40391d
mov ebp, dword [esi + 8]
cmp ebx, ebp
jmp 0x403950
mov ebp, dword [sym.imp.MSVCR80.dll__wcsicmp]
lea ecx, [esp + 0x224]
push ecx
push ebx
call ebp
add esp, 8
test eax, eax
jne 0x40394a
lea edx, [esp + 0x14]
push edx
add ebx, 0x280
push ebx
call ebp
add esp, 8
test eax, eax
je 0x403982
mov ebp, dword [esi + 8]
cmp dword [esi + 4], ebp
jbe 0x403958
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov ebx, dword [esi + 4]
cmp ebx, dword [esi + 8]
jbe 0x403966
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
cmp ebx, ebp
je 0x40397b
push ebx
mov ebx, dword [esi + 8]
mov eax, ebp
call fcn.00405230
add esp, 4
mov dword [esi + 8], eax
mov byte [edi + 0x1054], 1
mov ecx, dword [esp + 0x438]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004064de
add esp, 0x430
ret
Function at 0x4039a0
Capabilities:
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x407070
mov eax, dword fs:[0]
push eax
sub esp, 0x60
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40a020]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov esi, ecx
xor edi, edi
cmp esi, edi
je 0x403ba5
push edi
push 0x80
push 3
push edi
push edi
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403ba5
push edi
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x7c], edi
push esi
lea edx, [esp + 0x18]
lea ecx, [esp + 0x28]
lea esi, [esp + 0x20]
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.004031a0
test al, al
je 0x403aad
mov esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
mov ecx, esi
add ecx, 0xffffffff
mov eax, ebp
adc eax, 0xffffffff
cmp eax, edi
ja 0x403aad
jb 0x403a5c
cmp ecx, 0xffffe
ja 0x403aad
mov eax, esi
lea ecx, [esp + 0x30]
call fcn.00404850
mov eax, dword [esp + 0x34]
cmp eax, edi
mov dword [esp + 0x14], edi
je 0x403a7b
mov ecx, dword [esp + 0x38]
sub ecx, eax
jne 0x403a85
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov eax, dword [esp + 0x34]
push edi
lea edx, [esp + 0x18]
push edx
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x14]
xor ecx, ecx
cmp ecx, ebp
ja 0x403aad
jb 0x403aa4
cmp eax, esi
jae 0x403aad
lea ecx, [esp + 0x30]
call fcn.00404850
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x34]
cmp esi, edi
je 0x403ba5
mov ebx, dword [esp + 0x38]
sub ebx, esi
jne 0x403ad6
push esi
call sub.MSVCR80.dll_void___cdecl_operator_delete_void__
add esp, 4
jmp 0x403ba5
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
lea eax, [esp + 0x50]
mov byte [esp + 0x7c], 1
call fcn.004053d0
cmp ebx, edi
ja 0x403afe
call dword [sym.imp.MSVCR80.dll__invalid_parameter_noinfo]
mov esi, dword [esp + 0x34]
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x58]
push ecx
mov ecx, ebx
call fcn.00405450
test al, al
je 0x403b93
mov ebx, dword [esp + 0x44]
cmp ebx, edi
mov ecx, dword [esp + 0x48]
jne 0x403b24
xor esi, esi
jmp 0x403b28
mov esi, ecx
sub esi, ebx
mov eax, 0x35ae0b31
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 0xa
imul eax, eax, 0x69d
sub esi, eax
jne 0x403b93
cmp ebx, edi
jne 0x403b4c
xor ecx, ecx
jmp 0x403b4e
sub ecx, ebx
mov eax, 0x35ae0b31
mul ecx
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 0xa
mov esi, ecx
je 0x403b93
mov ebx, dword [esp + 0x84]
push esi
push ebx
call fcn.00404670
imul esi, esi, 0x69d
push esi
lea esi, [esp + 0x44]
call fcn.00404920
push eax
xor edi, edi
mov esi, ebx
call fcn.00404740
push eax
call sub.MSVCR80.dll_memcpy
add esp, 0xc
lea esi, [esp + 0x40]
call fcn.00404820
lea esi, [esp + 0x30]
call fcn.00404820
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x6c
ret 4
Function at 0x4043b0
Capabilities:
Check if file exists
Get file attributes
Query environment variable

Disassembly:
sub esp, 0x85c
mov eax, dword [0x40a020]
xor eax, esp
mov dword [esp + 0x854], eax
push ebx
push ebp
xor ebx, ebx
cmp dword [esp + 0x86c], ebx
push esi
push edi
je 0x404508
mov eax, dword [esp + 0x870]
mov eax, dword [eax]
cmp eax, ebx
je 0x4043f0
cmp byte [eax + 0x1038], bl
je 0x404508
mov ebp, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.COMCTL32.DLL
mov dword [esp + 0x20], 8
mov dword [esp + 0x24], 0xff
call ebp
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InitCommonControlsEx
push eax
mov dword [esp + 0x20], eax
call esi
cmp eax, ebx
je 0x40442a
lea ecx, [esp + 0x1c]
push ecx
call eax
push str.User32.dll
call ebp
push str.MessageBoxW
push eax
mov dword [esp + 0x1c], eax
call esi
mov esi, eax
cmp esi, ebx
je 0x404472
call dword [sym.imp.KERNEL32.dll_GetACP]
cmp eax, 0x3a8
je 0x404464
cmp eax, 0xd698
je 0x404464
push ebx
push 0x408278
push str.The_HaoZip_program_files_may_be_damaged._nPlease_press__OK__goto_the_Official_Website_n_http:__www.haozip.com___download_the_lastest_version_and_reinstall.
jmp 0x40446f
push ebx
push 0x408674
push 0x408688
push ebx
call esi
push 0x7fe
lea edx, [esp + 0x66]
push ebx
push edx
mov word [esp + 0x6c], bx
call sub.MSVCR80.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
add esp, 0xc
push 0x3fe
lea eax, [esp + 0x64]
push eax
push str._programfiles_Internet_Exploreriexplore.exe
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
add eax, 0xffffffff
cmp eax, 0x3fd
ja 0x4044c1
lea ecx, [esp + 0x60]
push ecx
call edi
cmp eax, 0xffffffff
je 0x4044c1
test al, 0x10
je 0x40450f
push 0x3fe
lea edx, [esp + 0x64]
push edx
push str._programfiles_x86__Internet_Exploreriexplore.exe
call esi
add eax, 0xffffffff
cmp eax, 0x3fd
ja 0x4044ec
lea eax, [esp + 0x60]
push eax
call edi
cmp eax, 0xffffffff
je 0x4044ec
test al, 0x10
je 0x40450f
mov eax, dword [esp + 0x14]
cmp eax, ebx
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
je 0x4044fd
push eax
call esi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x404508
push eax
call esi
xor al, al
jmp 0x404598
push 0x38
lea ecx, [esp + 0x2c]
push ebx
push ecx
call sub.MSVCR80.dll_memset
add esp, 0xc
lea edx, [esp + 0x60]
push str.Shell32.dll
mov dword [esp + 0x28], 0x3c
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], edx
mov dword [esp + 0x3c], str.http:__www.haozip.com
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], 1
mov dword [esp + 0x60], ebx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esi, eax
cmp esi, ebx
je 0x404580
push str.ShellExecuteExW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40457d
lea ecx, [esp + 0x24]
push ecx
call eax
push esi
call edi
mov eax, dword [esp + 0x14]
cmp eax, ebx
je 0x40458b
push eax
call edi
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x404596
push eax
call edi
mov al, 1
mov ecx, dword [esp + 0x864]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004064de
add esp, 0x85c
ret 8
Function at 0x4045c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x407258
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x40a020]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
push 0x40a53c
mov dword [esp + 0x10], 0x40a53c
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test esi, esi
mov dword [esp + 0x18], 0
je 0x404629
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x404629
test al, 0x10
jne 0x404629
mov edx, esi
mov ecx, edi
call fcn.00404120
test al, al
push esi
jne 0x404647
push edi
call fcn.004043b0
push 0x40a53c
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push 0x40a53c
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x14
ret
Function at 0x4064de
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a020]
jne 0x4064e8
repz ret
jmp fcn.004069e4

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4018a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x4018b2
pop dword [ebp - 0x48]
mov eax, 0x4018b2
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x49489dc5
add dword [ebp - 0x58], 0x509a786
mov dword [ebp - 0x54], 0xddda84b1
sub dword [ebp - 0x54], 0xaba7386c
mov dword [ebp - 0x50], 0x352bb4ff
sub dword [ebp - 0x50], 0xe8df70d1
mov dword [ebp - 0x4c], 0x66d2a2f
sub dword [ebp - 0x4c], 0x66d2a2f
lea eax, [ebp - 0x58]
push eax
mov eax, 0xa311dba8
add eax, 0x5d2fa4a8
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x63a8eb20
sub dword [ebp - 0x58], 0xef3681ca
mov dword [ebp - 0x54], 0x2e46e9dd
add dword [ebp - 0x54], 0x13257798
mov dword [ebp - 0x50], 0xdef845fd
sub dword [ebp - 0x50], 0x7b88d991
mov dword [ebp - 0x4c], 0x77ffbfcc
sub dword [ebp - 0x4c], 0x77ffbfcc
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x179608da
add eax, 0xe8ab7772
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3d1bc
push 0
call eax
mov ecx, 0x689a7331
add ecx, 0x9765db87
mov ebx, eax
mov esi, 0x791c6def
add esi, 0x87266a11
add esi, dword [ebp - 0x48]
mov edi, 0xe62c16bd
add dword [ebp - 0x18], ebx
mov edx, dword [esi]
add dword [ebp - 0xc], edx
sub edx, edi
mov dword [ebx], edx
xor dword [ebp - 0x28], 0xc9f2c877
add ebx, 0xe86709d7
add ebx, 0x1798f62d
add esi, 4
loop 0x4019c9
add eax, 0x12db3
xor ebx, ebx
add ebx, eax
add eax, 0xc8c91d3b
sub eax, 0xc8c91d36
mov ecx, 0x400000
add ecx, dword [ebp - 0x48]
call ebx
leave
ret