joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11dc78d0
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x11dd2de0
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x34]
push edi
push 0xffffffffffffffff
push 0
mov ecx, esi
call fcn.11d6c7d0
mov edi, dword [esp + 0x3c]
push 0xffffffffffffffff
push 0
mov ecx, edi
call fcn.11d6c7d0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov ebp, eax
mov eax, dword [0x11dfd190]
test eax, eax
je 0x11dc7988
cmp ebp, eax
jne 0x11dc7988
mov eax, dword [0x11dfd194]
test eax, eax
je 0x11dc7988
cmp ebx, eax
jb 0x11dc7988
add eax, 0x493e0
cmp eax, ebx
jb 0x11dc7988
mov ebp, dword [0x11dfd198]
push 1
inc ebp
push 0x11dfd0b0
lea ecx, [esp + 0x18]
mov dword [0x11dfd198], ebp
call fcn.11d750e0
push 0x11dfd0e0
mov ecx, esi
mov dword [esp + 0x34], 0
call fcn.11d6c9b0
push 0x11dfd0d0
mov ecx, edi
call fcn.11d6c9b0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x10]
jmp 0x11dc79fe
push edi
push esi
mov dword [0x11dfd198], 0
call fcn.11dc7d00
add esp, 8
lea ecx, [esp + 0x1c]
push 1
push 0x11dfd0b0
call fcn.11d750e0
push 0xffffffffffffffff
push 0
mov ecx, 0x11dfd0e0
mov dword [esp + 0x38], 1
mov dword [0x11dfd190], ebp
mov dword [0x11dfd194], ebx
call fcn.11d6c7d0
push esi
mov ecx, 0x11dfd0e0
call fcn.11d6c9b0
push 0xffffffffffffffff
push 0
mov ecx, 0x11dfd0d0
call fcn.11d6c7d0
push edi
mov ecx, 0x11dfd0d0
call fcn.11d6c9b0
mov dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.11d75140
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x11dc7d00
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0x11dd2e46
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x224
push ebx
push ebp
push esi
mov esi, dword [esp + 0x240]
push edi
xor ebx, ebx
push 0xffffffffffffffff
push ebx
mov ecx, esi
call fcn.11d6c7d0
mov ebp, dword [esp + 0x248]
push 0xffffffffffffffff
push ebx
mov ecx, ebp
call fcn.11d6c7d0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x10], 1
mov dword [esp + 0x20], eax
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x10]
test ecx, edx
je 0x11dc7e39
mov edx, dword [0x11df6510]
mov cx, word [0x11df6514]
mov dword [esp + 0x18], edx
add word [esp + 0x18], ax
lea edx, [esp + 0x18]
mov word [esp + 0x1c], cx
push edx
lea ecx, [esp + 0x28]
mov word [esp + 0x22], bx
call fcn.11d666a0
mov eax, dword [esi + 4]
lea ecx, [esp + 0x24]
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x244], ebx
call fcn.11d6cd70
mov edx, dword [0x11dd37d8]
mov dword [esp + 0x14], edx
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x2e]
mov word [esp + 0x2c], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x2c]
push 0x104
lea ecx, [esp + 0x1c]
push eax
push ecx
mov byte [esp + 0x248], 1
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
push edx
mov word [esp + 0x236], bx
call fcn.11d670c0
mov eax, dword [ebp + 4]
lea ecx, [esp + 0x14]
push ecx
push eax
mov ecx, ebp
call fcn.11d6cd70
lea ecx, [esp + 0x14]
mov byte [esp + 0x23c], bl
call fcn.11d66e40
lea ecx, [esp + 0x24]
mov dword [esp + 0x23c], 0xffffffff
call fcn.11d66e40
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x10]
inc eax
shl edx, 1
cmp eax, 0x1a
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], edx
jb 0x11dc7d5b
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x230
ret

Function at 0x11dcb432
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ebp, [esi + 0x42c]
lea edi, [esi + 0x2c]
mov ecx, 0x100
xor eax, eax
push ebx
mov dword [esi], ebx
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [ebp], ebx
push 0x80
push 3
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x20]
push ebx
lea edi, [esi + 0xc]
push 7
push closesocket
push eax
mov dword [esi + 8], ebx
mov dword [edi], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], ebx
mov dword [esi + 0x18], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esi + 4], eax
je 0x11dcb4c2
cmp eax, ebx
je 0x11dcb4c2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esi + 4]
mov dword [esi + 8], eax
push ebx
push ebp
lea eax, [esi + 0x2c]
push 0x400
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x11dcb4ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x11dcb675
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 4]
cmp eax, 0xffffffff
je 0x11dcb7c7
xor edx, edx
cmp eax, edx
je 0x11dcb7c7
mov ebx, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x14], edx
lea eax, [ebx + ecx]
cmp eax, ebx
jb 0x11dcb6aa
cmp eax, ecx
jb 0x11dcb6aa
xor ecx, ecx
jmp 0x11dcb6af
mov ecx, 1
mov edi, dword [esi + 0xc]
mov dword [esp + 0x14], ecx
cmp ecx, edi
jl 0x11dcb6c9
jg 0x11dcb7c7
cmp eax, dword [esi + 8]
ja 0x11dcb7c7
cmp ecx, edx
jne 0x11dcb6e3
cmp eax, dword [esi + 0x42c]
ja 0x11dcb6e3
lea eax, [ebx + esi + 0x2c]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
mov ebp, dword [esi + 0x1c]
cmp ebp, edx
je 0x11dcb728
mov ecx, dword [esi + 0x28]
mov dword [esp + 0x1c], edx
mov edx, dword [esi + 0x24]
lea edi, [edx + ecx]
cmp edi, ecx
jb 0x11dcb703
cmp edi, edx
jb 0x11dcb703
xor edx, edx
jmp 0x11dcb708
mov edx, 1
cmp ecx, ebx
ja 0x11dcb728
cmp dword [esp + 0x14], edx
jg 0x11dcb728
jl 0x11dcb718
cmp eax, edi
ja 0x11dcb728
mov eax, ebp
pop edi
sub eax, ecx
pop esi
add eax, ebx
pop ebp
pop ebx
add esp, 0x10
ret 8
mov eax, dword [esp + 0x28]
mov ecx, esi
push eax
call fcn.11dcb7e0
test eax, eax
je 0x11dcb7c7
cmp ebx, 0x7fffffff
push 0
push 0
jbe 0x11dcb776
mov ecx, dword [esi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push closesocket
push ecx
call edi
cmp eax, 0xffffffff
je 0x11dcb7b7
mov eax, dword [esi + 4]
push 1
lea edx, [ebx - 0x7fffffff]
push 0
push edx
push eax
call edi
cmp eax, 0xffffffff
je 0x11dcb7b7
jmp 0x11dcb786
mov ecx, dword [esi + 4]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x11dcb7b7
mov ebp, dword [esp + 0x28]
mov edx, dword [esi + 0x1c]
mov eax, dword [esi + 4]
lea edi, [esi + 0x24]
push 0
push edi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x11dcb7b7
cmp dword [edi], ebp
jne 0x11dcb7b7
mov eax, dword [esi + 0x1c]
mov dword [esi + 0x28], ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8
xor eax, eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esi], eax
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 8
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x406243
pop dword [ebp - 0x40]
mov eax, 0x21a747bd
sub eax, 0x2166e57a
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0xaffd2e1c
add dword [ebp - 0x50], 0x9e55172f
mov dword [ebp - 0x4c], 0xbcb0dbbe
add dword [ebp - 0x4c], 0x75827087
mov dword [ebp - 0x48], 0x6ffd0ba8
add dword [ebp - 0x48], 0xdc4f3886
mov dword [ebp - 0x44], 0xa28412ef
add dword [ebp - 0x44], 0x5d7bed11
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x25e8ab84
sub dword [ebp - 0x50], 0xb176422e
mov dword [ebp - 0x4c], 0xe8cfc13f
add dword [ebp - 0x4c], 0x589ca036
mov dword [ebp - 0x48], 0x294a8053
add dword [ebp - 0x48], 0x3a24ec19
mov dword [ebp - 0x44], 0x55c75b41
add dword [ebp - 0x44], 0xaa38a4bf
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3059f
push 0
call eax
mov ecx, 0x77480621
add ecx, 0x88b8272f
mov edi, eax
mov esi, 0xa6087db4
sub esi, 0xa5c199b4
add esi, dword [ebp - 0x40]
mov ebx, 0xc98c49a3
add ebx, 0x729e32c5
mov edx, dword [esi]
xor dword [ebp - 0x20], 0x7d6d80f6
sub edx, ebx
mov dword [edi], edx
mov dword [ebp - 0x18], 0xd5cd93a9
add edi, 0x7fbd0912
add edi, 0x8042f6f2
add esi, 0x67be02d2
sub esi, 0x67be02ce
loop 0x40635b
add eax, 0xf07b57bb
sub eax, 0xf07aafa8
mov ebx, eax
add eax, 5
mov ecx, 0xa07031b4
sub ecx, 0xa03031b4
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x4010a9
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x417420]
xor eax, ebp
mov dword [ebp + 0x74], eax
xor eax, eax
mov dword [0x419a00], eax
mov dword [0x419a04], eax
mov dword [0x419a08], eax
mov dword [0x419a0c], eax
mov dword [0x419a10], eax
mov dword [0x419a14], eax
mov dword [0x419a18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x401109
push 0x1ad
push str.sfxhead.c
call fcn.00402018
pop ecx
pop ecx
xor eax, eax
inc eax
cmp dword [ebp - 0x10], eax
jne 0x401129
cmp dword [ebp - 0x18], 0xa
jb 0x401166
cmp dword [ebp - 0x18], 0x5a
mov dword [0x419a00], eax
jb 0x401166
mov dword [0x419a04], eax
jmp 0x401166
cmp dword [ebp - 0x10], 2
jne 0x401166
cmp dword [ebp - 0x1c], 5
mov dword [0x419a08], eax
jb 0x401166
mov dword [0x419a0c], eax
jne 0x401156
cmp dword [ebp - 0x18], 2
jne 0x40114c
mov dword [0x419a10], eax
cmp dword [ebp - 0x18], eax
jb 0x401166
mov dword [0x419a14], eax
cmp dword [ebp - 0x1c], 6
jb 0x401166
mov dword [0x419a14], eax
mov dword [0x419a18], eax
mov ecx, dword [ebp + 0x74]
xor ecx, ebp
call fcn.00408b86
add ebp, 0x78
leave
ret

Function at 0x401405
Capabilities:
Set current directory

Disassembly:
push esi
push edi
push dword [esp + 0xc]
call fcn.0040123f
pop ecx
push dword [esp + 0xc]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov esi, eax
dec esi
neg esi
sbb esi, esi
neg esi
test edi, edi
je 0x401439
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.0040129b
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
ret

Function at 0x401563
Capabilities:
Query environment variable

Disassembly:
push dword [esp + 0xc]
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
ret

Function at 0x401576
Capabilities:
Hash data with crc32

Disassembly:
push esi
push 8
xor eax, eax
add ecx, ecx
pop esi
sar ecx, 1
mov edx, eax
xor edx, ecx
shr eax, 1
test dl, 1
je 0x401590
xor eax, 0xedb88320
dec esi
test esi, esi
jg 0x40157e
pop esi
ret

Function at 0x4015b3
Capabilities:
Encode data using xor

Disassembly:
cmp dword [esp + 8], 0
mov eax, dword [0x4189ac]
je 0x4015e3
mov ecx, dword [esp + 4]
push esi
movzx edx, byte [ecx]
dec dword [esp + 0xc]
movzx esi, al
xor edx, esi
shr eax, 8
xor eax, dword [edx*4 + 0x4185a8]
inc ecx
cmp dword [esp + 0xc], 0
jne 0x4015c4
pop esi
mov dword [0x4189ac], eax
ret
Function at 0x402018
Capabilities:
Terminate process
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x220]
sub esp, 0x2a0
mov eax, dword [0x417420]
xor eax, ebp
mov dword [ebp + 0x21c], eax
mov ecx, dword [0x419a58]
inc dword [0x419a58]
test ecx, ecx
mov eax, dword [ebp + 0x228]
push ebx
push esi
push edi
je 0x402054
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push dword [ebp + 0x22c]
mov ecx, 0x7d4
push eax
call fcn.004021f6
push eax
mov ebx, 0x191
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0040917b
add esp, 0x14
cmp eax, 0xffffffff
jne 0x40208c
push 0xc89
push str.sfxhead.c
call fcn.00402018
push 0x30
mov ecx, 0x7d0
call fcn.004021f6
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x419a48]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
mov esi, 0x104
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.004017f9
lea eax, [ebp + 0x118]
push eax
call fcn.004090f0
add esp, 0x10
test eax, eax
je 0x4020e5
push 0x413328
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.00408c5b
add esp, 0xc
mov edi, str.WZSFX32.RPT
push edi
lea eax, [ebp + 0x118]
push esi
push eax
call fcn.00408c5b
add esp, 0xc
push 0
push 0x20
push 2
push 0
push 1
push 0x40000000
lea eax, [ebp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40204c
push 0x413344
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.00408c5b
push eax
call section..text
add esp, 0x10
test al, al
jne 0x40214d
push 0xc9a
push str.sfxhead.c
call fcn.00402018
push 0
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004090f0
pop ecx
push eax
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call fcn.0040188e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov ecx, 0x7d1
call fcn.004021f6
push eax
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.0040917b
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4021a4
push 0xca2
push str.sfxhead.c
call fcn.00402018
push 0x30
mov ecx, 0x7d0
call fcn.004021f6
push eax
lea eax, [ebp - 0x7c]
push eax
push dword [0x419a48]
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40204c
Function at 0x402515
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x417420]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.004090f0
cmp eax, 2
pop ecx
je 0x402540
push 0x494
push str.sfxhead.c
call fcn.00402018
push esi
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.00409197
push eax
call section..text
add esp, 0x10
test al, al
jne 0x402560
push 0x495
jmp 0x402536
push 0x413328
lea eax, [ebp - 0xc]
push 8
push eax
call fcn.00409197
push eax
call section..text
add esp, 0x10
test al, al
jne 0x402584
push 0x496
jmp 0x402536
lea eax, [ebp - 0xc]
push eax
call fcn.004090f0
cmp eax, 8
pop ecx
jae 0x402622
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x20
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4025c4
or ax, 0xffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00408b86
leave
ret
push 7
lea eax, [ebp - 0x2c]
push str.PKBACK
push eax
call fcn.0040134e
add esp, 0xc
test eax, eax
jne 0x4025b3
mov al, byte [ebp - 0x2c]
cmp al, bl
lea ecx, [ebp - 0x2c]
je 0x4025b3
cmp al, 0x2e
je 0x4025f4
cmp al, 0x20
je 0x4025f4
inc ecx
mov al, byte [ecx]
cmp al, bl
jne 0x4025e5
cmp byte [ecx], bl
je 0x4025b3
mov al, byte [ecx]
cmp al, 0x30
jb 0x402602
cmp al, 0x39
jbe 0x402605
inc ecx
jmp 0x4025f8
xor eax, eax
jmp 0x40261a
movzx edx, dl
imul eax, eax, 0xa
sub edx, 0x30
cmp edx, 9
ja 0x4025b7
add eax, edx
inc ecx
mov dl, byte [ecx]
cmp dl, bl
jne 0x402609
jmp 0x4025b7
push 0x497
push dword [0x41701c]
jmp 0x40253b
Function at 0x4038b5
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x5a8]
sub esp, 0x628
mov eax, dword [0x417420]
xor eax, ebp
mov dword [ebp + 0x5a4], eax
mov eax, dword [ebp + 0x5b0]
mov ecx, dword [ebp + 0x5b8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x5b4]
push eax
mov dword [ebp - 0x28], eax
mov esi, 0x2e3
lea eax, [ebp - 0x24]
push esi
push eax
mov dword [ebp - 0x2c], ecx
call fcn.00409197
push eax
call section..text
add esp, 0x10
test al, al
jne 0x403917
push 0xe3a
push str.sfxhead.c
call fcn.00402018
xor ebx, ebx
cmp byte [edi], bl
je 0x40395f
push 0x4133ec
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.00408c5b
push eax
call section..text
add esp, 0x10
test al, al
jne 0x403940
push 0xe3d
jmp 0x40390d
push edi
lea eax, [ebp - 0x24]
push esi
push eax
call fcn.00408c5b
push eax
call section..text
add esp, 0x10
test al, al
jne 0x40395f
push 0xe3e
jmp 0x40390d
cmp dword [ebp - 0x2c], 0xffffffff
jne 0x4039ac
push 0x10
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.00401379
push 0x44
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.00401379
add esp, 0x18
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
mov dword [ebp - 0x80], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4039ac
mov eax, dword [ebp - 0x3c]
jmp 0x403a84
lea eax, [ebp + 0x2c0]
push eax
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.SHELL32.dll_FindExecutableA]
cmp eax, 0x1f
jne 0x4039f3
push dword [ebp - 0x28]
mov ecx, 0x422
call fcn.004021f6
push eax
lea eax, [ebp + 0x2c0]
push esi
push eax
call fcn.0040917b
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4039ef
push 0xe5e
jmp 0x40390d
push 0x10
jmp 0x403a64
cmp eax, 0x20
jbe 0x403a35
mov al, byte [edi]
neg al
push 1
push ebx
sbb eax, eax
and eax, edi
push eax
mov eax, dword [0x417060]
push dword [ebp - 0x28]
and eax, 0x20000
neg eax
sbb eax, eax
and eax, str.Install
push eax
push dword [0x419a48]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 0x2c]
cmp ecx, ebx
je 0x403a30
mov dword [ecx], eax
cmp eax, 0x20
ja 0x403a84
push dword [ebp - 0x28]
mov ecx, 0x400
push eax
call fcn.004021f6
push eax
lea eax, [ebp + 0x2c0]
push esi
push eax
call fcn.0040917b
add esp, 0x14
cmp eax, 0xffffffff
jne 0x403a63
push 0xea7
jmp 0x40390d
push ebx
mov ecx, 0x7d0
call fcn.004021f6
push eax
lea eax, [ebp + 0x2c0]
push eax
push dword [0x419a48]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov ecx, dword [ebp + 0x5a4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408b86
add ebp, 0x5a8
leave
ret
Function at 0x403a9c
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x417420]
xor eax, ebp
mov dword [ebp + 0x198], eax
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x403ae7
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push str.winzip_shellopencommand
push 0x80000000
mov dword [ebp - 0x80], 0x105
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x403b12
push 0
mov ecx, 0x7d0
call fcn.004021f6
push eax
mov ecx, 0x40e
call fcn.004021f6
push eax
push dword [0x419a48]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x403bb2
push ebx
xor ebx, ebx
cmp byte [ebp - 0x78], bl
lea eax, [ebp - 0x78]
je 0x403b2d
cmp byte [eax], 0x20
je 0x403b27
inc eax
cmp byte [eax], bl
jne 0x403b1d
cmp byte [eax], bl
je 0x403b2d
mov byte [eax], bl
push 0x4198c0
push str.__s_
lea eax, [ebp + 0x90]
push 0x107
push eax
call fcn.0040917b
add esp, 0x10
cmp eax, 0xffffffff
jne 0x403b5f
push 0xec8
push str.sfxhead.c
call fcn.00402018
mov eax, dword [0x417060]
test ax, 0x1000
je 0x403b92
test ax, ax
js 0x403b92
lea eax, [ebp + 0x90]
push eax
call fcn.004090f0
pop ecx
lea ecx, [ebp + 0x90]
sub ecx, 4
add eax, ecx
mov byte [eax], 0x7a
inc eax
mov byte [eax], 0x69
mov byte [eax + 1], 0x70
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x90]
push eax
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x7c], ebx
call fcn.004038b5
add esp, 0xc
test eax, eax
setne al
pop ebx
mov ecx, dword [ebp + 0x198]
xor ecx, ebp
call fcn.00408b86
add ebp, 0x19c
leave
ret

Function at 0x403bc7
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, 0x7000
push esi
push 0
push dword [0x418404]
call fcn.00401379
mov eax, dword [0x418596]
add esp, 0xc
test eax, eax
jg 0x403bf2
and dword [0x4199cc], 0
xor eax, eax
pop esi
ret
cmp eax, esi
ja 0x403bf8
mov esi, eax
push esi
push dword [0x418404]
push dword [0x417004]
call fcn.0040894d
add esp, 0xc
cmp dword [0x4199f8], 0
mov dword [0x4199cc], eax
je 0x403c64
cmp eax, 0xffffffff
je 0x403c64
cmp eax, esi
je 0x403c70
test eax, eax
jl 0x403c64
mov ecx, dword [0x41700c]
mov edx, dword [0x4199fc]
inc ecx
call fcn.00402632
mov eax, dword [0x4199cc]
test eax, eax
jne 0x403c5d
push esi
push dword [0x418404]
push dword [0x417004]
call fcn.0040894d
add esp, 0xc
mov dword [0x4199cc], eax
cmp eax, 0xffffffff
je 0x403c64
mov esi, eax
cmp eax, esi
je 0x403c70
push 2
pop ecx
jmp fcn.00403346
mov esi, dword [0x418404]
mov ecx, dword [0x417040]
mov dword [0x4199c8], esi
test byte [ecx + 0x28], 1
je 0x403cc2
mov byte [0x4199c7], 1
test word [ecx + 0x28], 0x1300
jne 0x403cce
push edi
mov edi, eax
test edi, edi
je 0x403cba
dec edi
call fcn.00408599
xor byte [esi], al
movzx eax, byte [esi]
push eax
call fcn.004085b3
inc esi
test edi, edi
pop ecx
jne 0x403c9e
mov eax, dword [0x4199cc]
mov byte [0x4199c7], 0
pop edi
mov ecx, eax
dec eax
mov dword [0x4199cc], eax
mov eax, ecx
pop esi
ret
push 0xf71
push dword [0x41701c]
call fcn.00402018
int3
Function at 0x4085b3
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x423ae8]
mov ecx, eax
xor ecx, dword [esp + 4]
shr eax, 8
mov edx, 0xff
and ecx, edx
xor eax, dword [ecx*4 + 0x4185a8]
mov ecx, dword [0x423af0]
mov dword [0x423ae8], eax
movzx eax, al
add eax, dword [0x423aec]
imul eax, eax, 0x8088405
inc eax
mov dword [0x423aec], eax
shr eax, 0x18
xor eax, ecx
and eax, edx
shr ecx, 8
xor ecx, dword [eax*4 + 0x4185a8]
mov eax, dword [esp + 4]
mov dword [0x423af0], ecx
ret

Function at 0x408643
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x417420]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [0x4199f4]
mov esi, ecx
call fcn.0040860b
push 0xc
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.00401329
add esp, 0x10
xor esi, esi
lea edx, [ebp + esi - 0x10]
call fcn.00408599
xor byte [edx], al
movzx eax, byte [edx]
push eax
call fcn.004085b3
inc esi
cmp esi, 0xc
pop ecx
jl 0x408672
cmp dword [0x4199f0], 0
movzx ax, byte [ebp - 5]
movzx eax, ax
pop esi
je 0x4086b1
movzx cx, byte [0x41858f]
cmp ax, cx
je 0x4086bb
or eax, 0xffffffff
jmp 0x4086bd
movzx cx, byte [0x418595]
jmp 0x4086a7
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00408b86
leave
ret

Function at 0x408b86
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417420]
jne 0x408b90
repz ret
jmp fcn.0040a798