joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ee48
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x41ef04
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00408394
mov edx, dword [ebp - 4]
mov eax, 0x41ef1c
call fcn.0041c390
test al, al
je 0x41ee91
lea eax, [ebp - 4]
mov ecx, 8
mov edx, 1
call fcn.004045d4
jmp 0x41eeb4
mov edx, dword [ebp - 4]
mov eax, 0x41ef30
call fcn.0041c390
test al, al
je 0x41eeb4
lea eax, [ebp - 4]
mov ecx, 4
mov edx, 1
call fcn.004045d4
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00408280
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040c110
mov edx, dword [ebp - 8]
lea eax, [ebp - 4]
call fcn.0040410c
mov eax, dword [ebp - 4]
call fcn.00404534
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41ef0b
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404098
ret

Function at 0x41fbd8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
mov esi, edx
mov edx, dword [eax]
dec ecx
test ecx, ecx
jl 0x41fc06
inc ecx
mov ebx, edx
xor bl, byte [esi]
and ebx, 0xff
mov ebx, dword [ebx*4 + 0x4635f0]
shr edx, 8
and edx, 0xffffff
xor ebx, edx
mov edx, ebx
inc esi
dec ecx
jne 0x41fbe4
mov dword [eax], edx
pop esi
pop ebx
ret

Function at 0x420ae4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [eax]
sub ecx, 1
jno 0x420af5
call fcn.00403280
test ecx, ecx
jl 0x420b1a
inc ecx
mov ebx, edx
xor bl, byte [esi]
and ebx, 0xff
mov edi, dword [0x46a378]
mov ebx, dword [edi + ebx*4]
shr edx, 8
xor ebx, edx
mov edx, ebx
add esi, 1
dec ecx
jne 0x420afa
mov dword [eax], edx
pop edi
pop esi
pop ebx
ret

Function at 0x4224a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4224e6
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, esi
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x30]
call fcn.00421954
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4224ed
lea eax, [ebp - 4]
call fcn.00404074
ret
Function at 0x42af80
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42b152
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
call fcn.00421ac0
cmp ebx, eax
jl 0x42afe7
mov dword [ebp - 0x18], ebx
mov byte [ebp - 0x14], 0
lea eax, [ebp - 0x18]
push eax
push 0
lea edx, [ebp - 0x1c]
mov eax, dword [0x46a6bc]
call fcn.00405f6c
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x414698]
call fcn.0040b514
call fcn.00403ab4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov edx, ebx
call fcn.00421aac
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov al, byte [eax + 0x6a]
sub al, 2
jne 0x42b012
mov dl, 1
mov eax, dword [0x41d458]
call fcn.0041e9d8
call fcn.00403ab4
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x6a], 1
jne 0x42b05c
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x20]
call fcn.00404334
cmp eax, 0x64
jge 0x42b04b
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0x10]
call fcn.00428ef4
mov eax, dword [ebp - 0x24]
call fcn.00404334
cmp eax, 0x64
jl 0x42b05c
mov dl, 1
mov eax, dword [0x41d458]
call fcn.0041e9d8
call fcn.00403ab4
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x10]
test al, al
je 0x42b075
mov eax, dword [ebp - 8]
call fcn.0041ec3c
jmp 0x42b10e
push 0xffff
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x414df8]
call fcn.00418028
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x42b0dc
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x42b0cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0xc]
mov edx, ebx
mov eax, dword [ebp - 4]
mov ebx, dword [eax]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b0d2
mov eax, dword [ebp - 0xc]
call fcn.00403340
ret
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x48]
add esp, 0xfffffff8
fstp qword [esp]
wait
mov eax, dword [ebp - 8]
call fcn.0041febc
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x20]
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.0041ff78
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b159
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404098
ret
Function at 0x42b160
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x42b286
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
call fcn.00421ac0
cmp ebx, eax
jl 0x42b1be
mov dword [ebp - 8], ebx
mov byte [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0
lea edx, [ebp - 0xc]
mov eax, dword [0x46a6bc]
call fcn.00405f6c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x414698]
call fcn.0040b514
call fcn.00403ab4
mov edx, ebx
mov eax, dword [esi + 0x30]
call fcn.00421aac
mov ebx, eax
mov al, byte [ebx + 0x6a]
sub al, 2
jne 0x42b1e2
mov dl, 1
mov eax, dword [0x41d458]
call fcn.0041e9d8
call fcn.00403ab4
cmp byte [ebx + 0x6a], 1
jne 0x42b227
lea edx, [ebp - 0x10]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x10]
call fcn.00404334
cmp eax, 0x64
jge 0x42b216
lea edx, [ebp - 0x14]
mov eax, ebx
call fcn.00428ef4
mov eax, dword [ebp - 0x14]
call fcn.00404334
cmp eax, 0x64
jl 0x42b227
mov dl, 1
mov eax, dword [0x41d458]
call fcn.0041e9d8
call fcn.00403ab4
mov eax, dword [ebx + 0xac]
shl eax, 9
cdq
add eax, dword [ebx + 0xa0]
adc edx, dword [ebx + 0xa4]
push edx
push eax
mov eax, dword [esi + 4]
call fcn.00417bf4
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
cmp edx, 0
jne 0x42b256
cmp eax, 0
je 0x42b26b
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x24]
push edx
push eax
mov edx, dword [esi + 4]
mov eax, edi
call fcn.00417e70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b28d
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00404098
ret
Function at 0x42c0d8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 4], ecx
mov dword [esp], edx
mov ebx, eax
mov eax, dword [ebx + 0x2c]
sub eax, dword [ebx + 0x28]
cmp eax, dword [esp]
jge 0x42c107
mov ecx, 0xf0
mov edx, 0x42c228
mov eax, 0x42c260
call fcn.00404054
mov eax, dword [esp + 4]
cmp eax, dword [esp]
je 0x42c12e
mov eax, dword [esp]
dec eax
cmp eax, dword [esp + 4]
je 0x42c12e
mov ecx, 0xf2
mov edx, 0x42c228
mov eax, 0x42c2a8
call fcn.00404054
mov eax, dword [ebx + 0x28]
mov edx, dword [esp]
cmp edx, dword [esp + 4]
jle 0x42c13b
inc eax
mov edx, dword [ebx + 0x18]
mov dword [esp + 8], edx
mov ecx, dword [ebx + 0x1c]
mov edx, dword [ebx + 0x20]
mov esi, dword [esp + 4]
dec esi
test esi, esi
jl 0x42c17b
inc esi
shl edx, 5
movzx edi, byte [eax + 2]
xor edx, edi
and edx, 0x3fff
mov edi, eax
and edi, dword [ebx + 0x5c]
mov ebp, dword [esp + 8]
lea ebp, [ebp + edi*4]
mov edi, dword [ecx + edx*4]
mov dword [ebp], edi
mov dword [ecx + edx*4], eax
inc eax
dec esi
jne 0x42c152
mov esi, dword [esp + 8]
mov dword [ebx + 0x18], esi
mov dword [ebx + 0x1c], ecx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x28], eax
cmp byte [ebx + 4], 0
je 0x42c1b4
mov eax, dword [esp]
add dword [ebx + 0x44], eax
mov eax, dword [esp]
add dword [ebx + 0x48], eax
cmp byte [ebx + 0x34], 0
je 0x42c1ce
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x42c1ce
mov eax, ebx
call fcn.0042c630
jmp 0x42c1ce
mov edx, eax
sub edx, dword [ebx + 0x44]
cmp edx, dword [ebx + 0x60]
jl 0x42c1ce
mov byte [ebx + 4], 1
sub eax, dword [ebx + 0x60]
sub eax, dword [ebx + 0x44]
add dword [ebx + 0x44], eax
add dword [ebx + 0x48], eax
cmp word [ebx + 0x3a], 0
je 0x42c206
mov eax, dword [esp]
add dword [ebx + 0x10], eax
mov esi, dword [ebx + 0x10]
test esi, 0xfff
jne 0x42c206
mov dword [esp + 0xc], esi
fild dword [esp + 0xc]
fmul dword [0x42c2e4]
fild qword [ebx + 0x50]
fdivp st(1)
call fcn.00402b98
mov edx, eax
mov eax, dword [ebx + 0x3c]
call dword [ebx + 0x38]
mov eax, dword [ebx + 0x44]
cmp eax, dword [ebx + 0x40]
jb 0x42c215
mov eax, ebx
call fcn.0042c630
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42f254
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
test esi, esi
jne 0x42f27c
mov ecx, 0xf8
mov edx, 0x42f304
mov eax, 0x42f33c
call fcn.00404054
mov edx, esi
mov eax, ebx
call fcn.0042f370
mov dword [ebp - 8], 0xc
mov edi, dword [ebp - 4]
lea esi, [ebp - 0x14]
mov eax, dword [ebx + 0x10]
and eax, 0xffff
or eax, 2
mov edx, eax
xor edx, 1
imul edx, eax
shr edx, 8
xor dl, byte [edi]
mov byte [esi], dl
mov edx, dword [ebx + 8]
mov al, byte [esi]
call fcn.0041fc0c
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
and eax, 0xff
add dword [ebx + 0xc], eax
imul eax, dword [ebx + 0xc], 0x8088405
inc eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx + 0xc]
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.0041fc0c
mov dword [ebx + 0x10], eax
inc esi
inc edi
dec dword [ebp - 8]
jne 0x42f292
mov al, byte [ebp + 0xb]
cmp al, byte [ebp - 9]
sete al
mov byte [ebx + 4], al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42f370
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebx, eax
mov dword [ebx + 8], 0x12345678
mov dword [ebx + 0xc], 0x23456789
mov dword [ebx + 0x10], 0x34567890
mov eax, dword [esp]
call fcn.00404334
mov esi, eax
test esi, esi
jle 0x42f3de
mov edi, 1
mov eax, dword [esp]
mov al, byte [eax + edi - 1]
mov edx, dword [ebx + 8]
call fcn.0041fc0c
mov ebp, eax
mov dword [ebx + 8], ebp
and ebp, 0xff
add dword [ebx + 0xc], ebp
imul ebp, dword [ebx + 0xc], 0x8088405
inc ebp
mov dword [ebx + 0xc], ebp
mov eax, ebp
shr eax, 0x18
mov edx, dword [ebx + 0x10]
call fcn.0041fc0c
mov dword [ebx + 0x10], eax
inc edi
dec esi
jne 0x42f3a2
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x458026
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
xor ebx, ebx
jmp 0x4580de
mov eax, dword [ebp + 8]
add dword [ebp + 8], 4
mov eax, dword [eax]
cdq
xor eax, edx
sub eax, edx
mov ecx, eax
shr ecx, 9
add eax, ecx
cmp eax, 0x100
jae 0x458076
movsx edx, byte [eax + 0x4699d8]
mov ecx, 9
sub ecx, edx
shl eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x469ad8]
shl edx, 8
add eax, edx
add ebx, eax
jmp 0x4580de
cmp eax, 0x10000
jae 0x45808e
mov edx, eax
shr edx, 8
movsx edx, byte [edx + 0x4699d8]
add edx, 8
jmp 0x4580b5
cmp eax, 0x1000000
jae 0x4580a6
mov ecx, eax
shr ecx, 0x10
movsx edx, byte [ecx + 0x4699d8]
add edx, 0x10
jmp 0x4580b5
mov ecx, eax
shr ecx, 0x18
movsx edx, byte [ecx + 0x4699d8]
add edx, 0x18
lea ecx, [edx - 9]
shr eax, cl
and eax, 0xff
movzx eax, byte [eax + 0x469ad8]
mov ecx, edx
shl ecx, 8
add eax, ecx
mov edx, eax
add ebx, eax
test esi, esi
je 0x4580de
cmp esi, edx
jg 0x4580de
or eax, 0xffffffff
jmp 0x4580ef
mov edx, dword [ebp + 0xc]
add dword [ebp + 0xc], 0xffffffff
test edx, edx
jne 0x458035
mov eax, ebx
pop esi
pop ebx
pop ebp
ret

Function at 0x45fc90
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov edi, eax
mov byte [ebp - 5], 0
mov ebx, 0x15
mov esi, 0x80000080
push ebx
push 0
mov eax, edi
call fcn.00404534
push eax
call sub.advapi32.dll_OpenSCManagerA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x45fd61
xor eax, eax
push ebp
push 0x45fd5a
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
mov eax, dword [ebp - 4]
call fcn.00404534
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_OpenServiceA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x45fd43
xor eax, eax
push ebp
push 0x45fd3c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x2c]
mov edx, 0x1c
call fcn.0040659c
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x45fd25
mov al, byte [ebp - 0x28]
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fd43
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45fd61
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_CloseServiceHandle
ret
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4606b0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x46070b
push dword fs:[eax]
mov dword fs:[eax], esp
cmp bl, 1
cmc
sbb eax, eax
push eax
lea eax, [ebp - 4]
call fcn.004059f4
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [eax]
call dword [eax + 0x28]
call fcn.00405b04
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x30]
call fcn.00405b04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x460712
lea eax, [ebp - 4]
call fcn.004059f4
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x2d1e50f2
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x40df3bbf
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4012a7
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.004041c2
pop ecx
push dword [esp + 0xc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea edi, [eax - 1]
neg edi
sbb edi, edi
neg edi
test esi, esi
je 0x4012d6
push dword [esp + 0xc]
call fcn.004020c1
pop ecx
mov eax, edi
pop edi
pop esi
ret

Function at 0x401bd3
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x426db4]
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401c00
push edi
mov edi, dword [esp + 0xc]
movzx ecx, byte [edi]
movzx eax, dl
xor ecx, eax
shr edx, 8
xor edx, dword [ecx*4 + 0x4263a0]
inc edi
sub esi, 1
jne 0x401be7
pop edi
mov dword [0x426db4], edx
pop esi
ret
Function at 0x403041
Capabilities:
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push 0x105
push esi
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x403064
cmp byte [esi], 0
je 0x403064
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x4030b2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0xc]
push eax
call fcn.0040c200
pop ecx
cmp eax, 8
jae 0x403175
push esi
xor esi, esi
lea eax, [ebp - 0x2c]
push esi
push esi
push esi
push esi
push esi
push 0x20
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x403115
mov eax, 0xffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00408980
mov esp, ebp
pop ebp
ret 4
push 7
lea eax, [ebp - 0x2c]
push str.PKBACK
push eax
call fcn.0040375e
add esp, 0xc
test eax, eax
jne 0x4030ff
mov cl, byte [ebp - 0x2c]
lea eax, [ebp - 0x2c]
jmp 0x403141
cmp cl, 0x2e
je 0x403145
cmp cl, 0x20
je 0x403145
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x403134
cmp byte [eax], 0
je 0x4030ff
mov cl, byte [eax]
cmp cl, 0x30
jb 0x403156
cmp cl, 0x39
jbe 0x40316a
inc eax
jmp 0x40314a
movzx ecx, cl
sub ecx, 0x30
imul esi, esi, 0xa
cmp ecx, 9
ja 0x403170
add esi, ecx
inc eax
mov cl, byte [eax]
test cl, cl
jne 0x403159
mov ax, si
jmp 0x403104
push 0x417
push str.sfxhead.c
call fcn.00404463
int3

Function at 0x40395f
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
xor ecx, ecx
push esi
push 8
add edx, edx
pop esi
sar edx, 1
mov eax, ecx
xor eax, edx
shr ecx, 1
test al, 1
je 0x40397d
xor ecx, 0xedb88320
dec esi
test esi, esi
jg 0x40396b
mov eax, ecx
pop esi
ret 4
Function at 0x404220
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp + 0x398], eax
push edi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
js 0x404324
lea eax, [ebp - 0x80]
mov edi, 0x209
push eax
lea eax, [ebp - 0x7c]
mov dword [ebp - 0x80], edi
push eax
push str.winzip_shellopencommand
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
test eax, eax
jne 0x404324
push ebx
push esi
lea esi, [ebp - 0x7c]
cmp word [ebp - 0x7c], ax
je 0x40429e
xor ebx, ebx
push 4
push str.___1
push esi
call fcn.0040bfd8
add esp, 0xc
test eax, eax
je 0x40429e
add esi, 2
cmp word [esi], bx
jne 0x404282
push 0x105
mov ebx, 0x426920
push ebx
call fcn.00405fe5
lea ecx, [ebp - 0x7c]
mov eax, esi
sub eax, ecx
add eax, 2
push ebx
sar eax, 1
sub edi, eax
lea eax, [esi + 2]
push str.__s_
push edi
push eax
call fcn.00404596
mov eax, dword [0x423040]
add esp, 0x18
pop esi
pop ebx
test eax, 0x1000
je 0x404309
test eax, 0x8000
jne 0x404309
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x7a
pop ecx
push 0x69
lea eax, [ebp + eax*2 - 0x84]
mov word [eax], cx
pop ecx
mov word [eax + 2], cx
push 0x70
pop ecx
mov word [eax + 4], cx
push 0xffffffffffffffff
lea eax, [ebp - 0x7c]
push 0x41b350
push eax
call fcn.004045b2
add esp, 0xc
neg eax
sbb eax, eax
neg eax
jmp 0x40434a
push 0
push 0x7d0
call fcn.004037d9
push eax
push 0x40e
call fcn.004037d9
push eax
push dword [0x426378]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
pop edi
call fcn.00408980
lea esp, [ebp + 0x39c]
pop ebp
ret
Function at 0x404463
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x11c]
sub esp, 0x19c
mov eax, dword [0x4231a4]
xor eax, ebp
mov dword [ebp + 0x118], eax
mov eax, dword [0x423b88]
mov ecx, eax
mov edx, dword [ebp + 0x124]
inc eax
mov dword [0x423b88], eax
push esi
test ecx, ecx
je 0x40449e
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x128]
push edx
push 0x7d4
call fcn.004037d9
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x30
push 0x7d0
call fcn.004037d9
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x426378]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
push str.WZSFX32.RPT
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x404496
push 0x41b3b8
lea eax, [ebp - 0x7c]
push 0x191
push eax
call fcn.0040c191
add esp, 0xc
lea eax, [ebp - 0x80]
push 0
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.0040c200
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.00403bdc
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.WZSFX32.RPT
push 0x7d1
call fcn.004037d9
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x30
push 0x7d0
call fcn.004037d9
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x426378]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x404496
Function at 0x4045b2
Capabilities:
Create process on windows

Disassembly:
sub esp, 0xfe8
mov eax, dword [0x4231a4]
xor eax, esp
mov dword [esp + 0xfe4], eax
push ebx
mov ebx, dword [esp + 0xff0]
lea eax, [esp + 0xa20]
push ebp
mov ebp, dword [esp + 0xffc]
push esi
mov esi, dword [esp + 0xffc]
push edi
push ebx
push 0x2e3
push eax
call fcn.0040bef1
xor edi, edi
add esp, 0xc
cmp word [esi], di
je 0x404629
push 0x41b2f0
lea eax, [esp + 0xa30]
push 0x2e3
push eax
call fcn.0040bef1
push esi
lea eax, [esp + 0xa3c]
push 0x2e3
push eax
call fcn.0040be7c
add esp, 0x18
cmp ebp, 0xffffffff
jne 0x404681
push 0x10
lea eax, [esp + 0x14]
push edi
push eax
call fcn.004037ab
push 0x44
pop edi
push edi
xor ecx, ecx
lea eax, [esp + 0x30]
push ecx
push eax
call fcn.004037ab
add esp, 0x18
mov dword [esp + 0x20], edi
lea eax, [esp + 0x10]
xor edi, edi
push eax
lea eax, [esp + 0x24]
push eax
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0xa4c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x404681
mov eax, dword [esp + 0x10]
jmp 0x4047b9
lea eax, [esp + 0x464]
push eax
push edi
push ebx
call dword [sym.imp.SHELL32.dll_FindExecutableW]
mov edi, eax
cmp edi, 0x1f
jne 0x4046f8
mov ebp, 0x100
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x427
call fcn.004037d9
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edi, edi
push eax
push edi
push edi
call esi
push ebx
lea eax, [esp + 0x68]
push eax
lea eax, [esp + 0x46c]
push 0x2e3
push eax
call fcn.00404596
add esp, 0x10
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.004037d9
push eax
push edi
push edi
call esi
push 0x10
jmp 0x40479b
cmp edi, 0x20
jbe 0x40473e
xor eax, eax
xor ecx, ecx
cmp word [esi], cx
push 1
cmovne eax, esi
push ecx
push eax
mov eax, dword [0x423040]
and eax, 0x20000
neg eax
push ebx
sbb eax, eax
and eax, 0x41b2f4
push eax
push dword [0x426378]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov edi, eax
test ebp, ebp
je 0x404735
mov dword [ebp], edi
cmp edi, 0x20
jbe 0x40473e
mov eax, edi
jmp 0x4047b9
mov ebp, 0x100
lea eax, [esp + 0x64]
push ebp
push eax
push 0xffffffffffffffff
push 0x400
call fcn.004037d9
mov esi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
push eax
xor eax, eax
push eax
push eax
call esi
push ebx
push edi
lea eax, [esp + 0x6c]
push eax
lea eax, [esp + 0x470]
push 0x2e3
push eax
call fcn.00404596
add esp, 0x14
lea eax, [esp + 0x264]
push ebp
push eax
push 0xffffffffffffffff
push 0x7d0
call fcn.004037d9
push eax
xor ebx, ebx
push ebx
push ebx
call esi
push ebx
lea eax, [esp + 0x268]
push eax
lea eax, [esp + 0x46c]
push eax
push dword [0x426378]
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0xff4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00408980
add esp, 0xfe8
ret