joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099e1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x417354]
jne 0x4099eb
repz ret
jmp fcn.0040e5bc

Function at 0x4122c4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417354]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040c44d
and dword [ebp - 0x14], 0
cmp dword [0x434c28], 0
mov dword [ebp - 0x18], eax
jne 0x412377
push 0x403774
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41241f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403768
push ebx
call edi
test eax, eax
je 0x41241f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403758
push ebx
mov dword [0x434c28], eax
call edi
push eax
call esi
push 0x403744
push ebx
mov dword [0x434c2c], eax
call edi
push eax
call esi
push 0x403728
push ebx
mov dword [0x434c30], eax
call edi
push eax
call esi
mov dword [0x434c38], eax
test eax, eax
je 0x412377
push 0x403710
push ebx
call edi
push eax
call esi
mov dword [0x434c34], eax
mov eax, dword [0x434c34]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4123d0
cmp dword [0x434c38], ecx
je 0x4123d0
push eax
call esi
push dword [0x434c38]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4123d0
test ebx, ebx
je 0x4123d0
call edi
test eax, eax
je 0x4123c7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4123c7
test byte [ebp - 8], 1
jne 0x4123d0
or dword [ebp + 0x10], 0x200000
jmp 0x412403
mov eax, dword [0x434c2c]
cmp eax, dword [ebp - 0x18]
je 0x412403
push eax
call esi
test eax, eax
je 0x412403
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412403
mov eax, dword [0x434c30]
cmp eax, dword [ebp - 0x18]
je 0x412403
push eax
call esi
test eax, eax
je 0x412403
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x434c28]
call esi
test eax, eax
je 0x41241f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412421
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004099e1
leave
ret
Function at 0x414200
Capabilities:
Delete directory
Delete file
Get disk information
Read .ini file

Disassembly:
mov eax, 0x1000
call fcn.00413890
cmp dword [0x6afdfc], 0x37
jne 0x414276
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push 0x403f90
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
lea eax, [esp + 0x404]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x403fb0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call dword [sym.imp.KERNEL32.dll_DebugBreak]
push 0x403fc8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea edx, [esp + 0x804]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
mov eax, dword [0x6b09e0]
mov edx, dword [0x6ace5c]
mov cl, byte [eax + esi + 0x38d6]
mov byte [edx + esi], cl
add esp, 0x1000
ret
Function at 0x414310
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
sub esp, 0x824
cmp dword [0x6afdfc], 0x60b
mov ecx, dword [esp + 0x828]
mov eax, dword [ecx]
mov edx, dword [0x431cec]
push ebx
push ebp
mov ebp, dword [0x431cf4]
push esi
mov esi, dword [ecx + 4]
mov ecx, dword [0x431ce8]
mov dword [esp + 0x20], ecx
mov ecx, dword [0x431cf0]
mov ebx, 0xc6ef3720
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
jne 0x414381
push 0
lea edx, [esp + 0x20]
push edx
push 0
lea eax, [esp + 0x40]
push eax
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CallNamedPipeW]
mov eax, dword [esp + 0x18]
mov dword [esp + 0x1c], 0x20
jmp 0x414394
mov eax, dword [esp + 0x18]
mov ecx, eax
shl ecx, 4
cmp dword [0x6afdfc], 5
mov dword [esp + 0x10], ecx
jne 0x4143be
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasExesLengthW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadIdealProcessor]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
add ecx, dword [esp + 0x2c]
lea edi, [ebx + eax]
shr eax, 5
cmp dword [0x6afdfc], 0x1b
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
jne 0x4143fe
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathW]
push 0x403f18
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetLocaleInfoW]
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
add eax, ebp
xor eax, edi
xor eax, ecx
sub esi, eax
mov dword [esp + 0x14], eax
mov eax, esi
shl eax, 4
cmp dword [0x6afdfc], 0x78c
mov dword [0x6ace60], 0
mov dword [esp + 0x10], eax
jne 0x414443
push 0
lea ecx, [esp + 0x34]
push ecx
push 0
lea edx, [esp + 0x40]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleW]
mov eax, dword [esp + 0x24]
add dword [esp + 0x10], eax
mov eax, esi
shr eax, 5
mov dword [0x6ace68], 0xff6b3619
mov dword [0x6ace6c], 0xffffffff
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x28]
add dword [esp + 0x14], eax
lea ecx, [ebx + esi]
xor dword [esp + 0x10], ecx
mov eax, dword [esp + 0x14]
xor dword [esp + 0x10], eax
mov eax, dword [esp + 0x10]
sub dword [esp + 0x18], eax
cmp dword [0x6afdfc], 0x93
jne 0x4144a5
push 0x403f40
lea edx, [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
jmp 0x4144b2
lea eax, [esp + 0x20]
call fcn.004142a0
mov ebx, dword [esp + 0x20]
dec dword [esp + 0x1c]
jne 0x414390
mov eax, dword [esp + 0x838]
mov ecx, dword [esp + 0x18]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x824
ret 4
Function at 0x403c60
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push ebp
push edi
mov ebp, 1
push esi
push ebx
sub esp, 0x37c
mov esi, dword [esp + 0x390]
lea edi, [esp + 0x28]
mov dword [esp], edi
mov dword [esp + 4], esi
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
mov dword [esp], edi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
sub eax, 2
sub esp, 4
cmp eax, 0xff
ja 0x403dd2
cmp byte [esi + ebx - 1], 0x5c
je 0x403e10
mov dword [esp + 4], 0x4091f7
mov dword [esp], edi
add ebx, 1
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [esp + 0x230]
mov dword [esp], edi
xor ebp, ebp
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
cmp eax, 0xffffffff
mov dword [esp + 0x1c], eax
mov byte [esp + ebx + 0x28], 0
je 0x403dd2
lea esi, [esp + 0x25c]
jmp 0x403d27
mov ebp, 1
lea eax, [esp + 0x230]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
je 0x403dc3
mov dword [esp], esi
call sub.KERNEL32.dll_lstrlenA
add eax, ebx
sub esp, 4
cmp eax, 0x103
ja 0x403d00
lea eax, [esp + 0x12c]
mov dword [esp + 4], edi
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
lea eax, [esp + 0x12c]
mov dword [esp + 4], esi
mov dword [esp], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 4], 0x4091fa
mov dword [esp], esi
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x403d05
mov dword [esp + 4], 0x4091fc
mov dword [esp], esi
call sub.KERNEL32.dll_lstrcmpA
sub esp, 8
test eax, eax
je 0x403d05
test byte [esp + 0x230], 0x10
lea eax, [esp + 0x12c]
mov dword [esp], eax
je 0x403e30
call fcn.00403c60
test eax, eax
jne 0x403d05
jmp 0x403d00
mov eax, dword [esp + 0x1c]
mov dword [esp], eax
call sub.KERNEL32.dll_FindClose
sub esp, 4
mov dword [esp], edi
call sub.KERNEL32.dll_RemoveDirectoryA
sub esp, 4
test eax, eax
jne 0x403e01
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov ebp, 1
mov dword [esp], edi
call sub.KERNEL32.dll_MoveFileExA
sub esp, 0xc
add esp, 0x37c
mov eax, ebp
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x4091f5
mov dword [esp], edi
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
jmp 0x403cc5
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
test eax, eax
jne 0x403d05
lea eax, [esp + 0x12c]
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov ebp, 1
mov dword [esp], eax
call sub.KERNEL32.dll_MoveFileExA
sub esp, 0xc
jmp 0x403d05
Function at 0x403f30
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x36c
lea edi, [esp + 0x18]
mov dword [esp], 0x104
mov dword [esp + 4], edi
call sub.KERNEL32.dll_GetTempPathA
sub esp, 8
mov ebx, eax
cmp byte [esp + eax + 0x17], 0x5c
je 0x403f70
mov dword [esp + 4], 0x40909c
mov dword [esp], edi
add ebx, 1
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp + 4], str..ocra_delete_me
mov dword [esp], edi
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
lea eax, [esp + 0x220]
mov dword [esp], edi
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindFirstFileA
sub esp, 8
cmp eax, 0xffffffff
mov ebp, eax
mov byte [esp + ebx + 0x18], 0
je 0x404033
lea ebx, [esp + 0x11c]
mov dword [esp + 4], edi
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrcpyA
sub esp, 8
lea eax, [esp + 0x24c]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_lstrcatA
sub esp, 8
mov dword [esp], ebx
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
mov dword [esp], ebx
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
mov esi, eax
mov dword [esp], 0x4091ff
call sub.KERNEL32.dll_lstrlenA
sub esp, 4
sub esi, eax
mov byte [esp + esi + 0x11c], 0
mov dword [esp], ebx
call fcn.00403f00
lea eax, [esp + 0x220]
mov dword [esp], ebp
mov dword [esp + 4], eax
call sub.KERNEL32.dll_FindNextFileA
sub esp, 8
test eax, eax
jne 0x403fb0
mov dword [esp], ebp
call sub.KERNEL32.dll_FindClose
sub esp, 4
add esp, 0x36c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x404040
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x10
mov esi, dword [esp + 0x20]
jmp 0x40406e
mov eax, dword [esi]
mov edi, dword [eax]
add eax, 4
mov dword [esi], eax
cmp edi, 8
ja 0x404090
mov dword [esp], esi
call dword [edi*4 + 0x408040]
test eax, eax
mov ebx, eax
je 0x40407d
mov ebx, dword [0x40c028]
test ebx, ebx
je 0x404050
mov ebx, 1
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0xd
mov dword [esp + 4], 1
mov dword [esp], str.FATAL_ERROR:
lea esi, [eax + 0x40]
mov dword [esp + 0xc], esi
call sub.msvcrt.dll_fwrite
mov dword [esp + 8], edi
mov dword [esp], esi
mov dword [esp + 4], str.Invalid_opcode__lu.
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], esi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
add esp, 0x10
mov eax, ebx
pop ebx
pop esi
pop edi
ret
Function at 0x4040f0
Capabilities:
Write file on windows

Disassembly:
push edi
push esi
push ebx
sub esp, 0x20
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x30]
mov dword [esp + 8], 4
mov dword [esp + 4], 0x4094dc
lea esi, [ebx + eax - 4]
mov dword [esp], esi
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x404180
mov eax, dword [0x40c024]
test eax, eax
jne 0x404141
add ebx, dword [esi - 4]
lea eax, [esp + 0x1c]
mov dword [esp], eax
mov dword [esp + 0x1c], ebx
call fcn.00404040
add esp, 0x20
pop ebx
pop esi
pop edi
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x15
mov dword [esp + 4], 1
mov dword [esp], str.Good_signature_found.
lea edi, [eax + 0x40]
mov dword [esp + 0xc], edi
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], edi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
jmp 0x404127
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0xd
mov dword [esp + 4], 1
mov dword [esp], str.FATAL_ERROR:
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x1c
mov dword [esp + 4], 1
mov dword [esp], str.Bad_signature_in_executable.
call sub.msvcrt.dll_fwrite
mov dword [esp + 4], ebx
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
add esp, 0x20
xor eax, eax
pop ebx
pop esi
pop edi
ret
Function at 0x404780
Capabilities:
Create process on windows
Write and execute a file
Write file on windows

Disassembly:
push edi
push esi
xor eax, eax
push ebx
mov ecx, 0x11
sub esp, 0x90
lea edx, [esp + 0x4c]
mov ebx, dword [esp + 0xa0]
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xa4]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp], ebx
mov dword [esp + 4], eax
mov dword [esp + 0x4c], 0x44
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x404860
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
sub esp, 8
mov eax, dword [esp + 0x3c]
mov dword [esp + 4], 0x40c02c
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeProcess
sub esp, 8
test eax, eax
je 0x4048c0
mov eax, dword [esp + 0x3c]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, dword [esp + 0x40]
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
add esp, 0x90
pop ebx
pop esi
pop edi
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0xd
mov dword [esp + 4], 1
mov dword [esp], str.FATAL_ERROR:
lea esi, [eax + 0x40]
mov dword [esp + 0xc], esi
call sub.msvcrt.dll_fwrite
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 8], ebx
mov dword [esp], esi
mov dword [esp + 0xc], eax
mov dword [esp + 4], str.Failed_to_create_process___s_:__lu
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], esi
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
add esp, 0x90
pop ebx
pop esi
pop edi
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0xd
mov dword [esp + 4], 1
mov dword [esp], str.FATAL_ERROR:
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
call sub.KERNEL32.dll_GetLastError
mov dword [esp + 4], str.Failed_to_get_exit_status__error__lu_.
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fprintf
mov dword [esp + 4], ebx
mov dword [esp], 0xa
call sub.msvcrt.dll_fputc
jmp 0x404833
Function at 0x405590
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x40c05c
call sub.KERNEL32.dll_EnterCriticalSection
mov ebx, dword [0x40c054]
sub esp, 4
test ebx, ebx
je 0x4055db
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sub.KERNEL32.dll_TlsGetValue
sub esp, 4
mov esi, eax
call sub.KERNEL32.dll_GetLastError
test eax, eax
jne 0x4055d4
test esi, esi
je 0x4055d4
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4055b0
mov dword [esp], 0x40c05c
call sub.KERNEL32.dll_LeaveCriticalSection
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x4057c0
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sub.msvcrt.dll_fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
lea esi, [esi]

Function at 0x405810
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sub.KERNEL32.dll_VirtualQuery
sub esp, 0xc
test eax, eax
je 0x4058e8
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40584e
cmp eax, 4
jne 0x405870
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.msvcrt.dll_memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sub.msvcrt.dll_memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40585e
cmp edx, 4
je 0x40585e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.004057c0
Function at 0x407740
Capabilities:
Accept command line arguments

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call fcn.00405480
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x407776
jmp 0x4077ae
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x407773
cmp al, 9
je 0x407773
cmp al, 0x22
jne 0x407797
jmp 0x4077f6
cmp al, 9
je 0x4077a3
add ebx, 1
movzx eax, byte [ebx]
test al, 0xdf
jne 0x407790
jmp 0x4077a3
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x20
je 0x4077a0
cmp al, 9
je 0x4077a0
test byte [ebp - 0x30], 1
mov esi, 0xa
je 0x4077bd
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.00404920
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
test al, al
je 0x407802
mov edx, ebx
add ebx, 1
movzx eax, byte [ebx]
cmp al, 0x22
jne 0x4077f2
cmp al, 0x22
jne 0x4077a3
lea ebx, [edx + 2]
jmp 0x4077a3
Function at 0x401e75
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll_wcslen]
push esi
mov esi, 0x40a05c
push edi
push esi
call ebx
cmp eax, 0x104
pop ecx
ja 0x402010
lea eax, [ebp - 0x220]
push esi
push eax
call dword [sym.imp.MSVCRT.dll_wcscpy]
mov ax, word [ebp - 0x220]
pop ecx
cmp ax, 0x61
pop ecx
jb 0x401ebe
cmp ax, 0x7a
jbe 0x401eca
cmp ax, 0x41
jb 0x401ee7
cmp ax, 0x5a
ja 0x401ee7
cmp word [ebp - 0x21e], 0x3a
jne 0x401ee7
cmp word [ebp - 0x21c], 0x5c
jne 0x401ee7
mov dword [ebp - 4], 3
jmp 0x401f05
cmp ax, 0x5c
jne 0x402010
cmp word [ebp - 0x21e], ax
jne 0x402010
mov dword [ebp - 4], 2
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401f29
and al, 0x10
neg al
sbb eax, eax
and al, 0x49
add eax, 0xb7
jmp 0x402013
lea ecx, [ebp - 0x220]
call fcn.00401e5e
mov esi, eax
test esi, esi
je 0x40200c
cmp esi, 0xb7
je 0x40200c
lea eax, [ebp - 0x220]
push eax
call ebx
pop ecx
mov edi, eax
lea ecx, [ebp - 0x220]
call fcn.00402018
test eax, eax
jge 0x401f6c
mov eax, esi
jmp 0x402013
cmp eax, dword [ebp - 4]
jb 0x401f65
lea ecx, [edi - 1]
cmp eax, ecx
jne 0x401f8c
cmp edi, 1
je 0x40200c
and word [ebp + eax*2 - 0x220], 0
mov edi, eax
lea ecx, [ebp - 0x220]
call fcn.00401e5e
mov esi, eax
test esi, esi
je 0x401fe3
cmp esi, 0xb7
je 0x401fc6
lea ecx, [ebp - 0x220]
call fcn.00402018
test eax, eax
jl 0x401f65
je 0x401f65
cmp eax, dword [ebp - 4]
jb 0x401f65
and word [ebp + eax*2 - 0x220], 0
jmp 0x401f8c
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401fe3
test al, 0x10
jne 0x401fe3
mov eax, 0xb7
jmp 0x402013
lea eax, [ebp - 0x220]
push eax
call ebx
cmp eax, edi
pop ecx
jae 0x40200c
lea ecx, [ebp - 0x220]
mov word [ebp + eax*2 - 0x220], 0x5c
call fcn.00401e5e
test eax, eax
jne 0x402013
jmp 0x401fe3
xor eax, eax
jmp 0x402013
push 0x7b
pop eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4021de
Capabilities:
Set registry value

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, edx
mov edi, ecx
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [esp + 0x10]
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
ret 4
Function at 0x402224
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
push ebx
xor ebx, ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_wcscpy]
push edi
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x264]
mov dword [ebp - 8], 1
push eax
mov eax, dword [ebp - 4]
dec eax
push ebx
neg eax
sbb eax, eax
push ebx
and al, 0xeb
mov word [ebp - 0x264], bx
add eax, 0x17
push eax
push dword [ebp - 0xc]
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x402347
lea ecx, [ebp - 0x264]
call fcn.00401377
lea eax, [ebp - 0x264]
push dword [0x40a010]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
cmp dword [ebp - 4], ebx
pop ecx
pop ecx
je 0x4022a4
lea ecx, [ebp - 0x264]
call fcn.00401e5e
lea ecx, [ebp - 0x264]
call fcn.00401377
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
pop ecx
lea edi, [ebp + eax*2 - 0x264]
test ebx, ebx
mov eax, str.7_Zip_File_Manager.lnk
je 0x4022d2
mov eax, str.7_Zip_Help.lnk
push eax
push edi
call esi
lea eax, [ebp - 0x4bc]
push 0x40a05c
push eax
call esi
add esp, 0x10
mov eax, str.7zFM.exe
test ebx, ebx
je 0x4022f5
mov eax, str.7_zip.chm
push eax
lea eax, [ebp - 0x4bc]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
cmp dword [ebp - 4], 0
pop ecx
pop ecx
jne 0x40231a
lea eax, [ebp - 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x402333
lea edx, [ebp - 0x4bc]
lea ecx, [ebp - 0x264]
call fcn.00402359
test eax, eax
je 0x402333
and dword [ebp - 8], 0
inc ebx
cmp ebx, 2
jb 0x4022c4
cmp dword [ebp - 4], 0
je 0x402345
cmp dword [ebp - 8], 0
jne 0x402354
xor ebx, ebx
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jb 0x40223e
pop edi
pop esi
pop ebx
leave
ret

Function at 0x404869
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
push edi
xor edx, edx
mov ecx, 0x40a500
push 8
mov eax, edx
pop esi
mov edi, eax
and edi, 1
dec edi
not edi
and edi, 0xedb88320
shr eax, 1
xor eax, edi
dec esi
jne 0x404877
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x40a900
jb 0x404872
cmp edx, 0x800
jae 0x4048d0
lea ecx, [edx*4 + 0x40a500]
mov eax, dword [ecx - 0x400]
mov edx, eax
and edx, 0xff
shr eax, 8
mov edx, dword [edx*4 + 0x40a500]
xor edx, eax
mov dword [ecx], edx
add ecx, 4
cmp ecx, 0x40c500
jb 0x4048a9
mov eax, 0x4048fc
mov esi, 0x4049b0
mov dword [0x40c504], eax
mov dword [0x40a4e0], eax
mov dword [0x40c500], esi
call fcn.0040588b
test eax, eax
jne 0x4048f9
mov dword [0x40a4e0], esi
pop edi
pop esi
ret
Function at 0x404b1b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
test edi, edi
je 0x404b74
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x404b3e
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404b6c
test ecx, ecx
je 0x404b74
test edi, edi
jbe 0x404b74
jmp 0x404b33
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404b76
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x404b7d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 4], edx
mov ebx, ecx
mov edi, dword [esi]
test edi, edi
je 0x404bd6
and dword [esi], 0
mov eax, 0x400000
cmp edi, eax
ja 0x404ba0
mov eax, edi
lea ecx, [ebp + 8]
push 0
and dword [ebp + 8], 0
push ecx
push eax
push dword [ebp - 4]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
add dword [ebp - 4], ecx
add dword [esi], ecx
sub edi, ecx
test eax, eax
je 0x404bce
test ecx, ecx
je 0x404bd6
test edi, edi
jbe 0x404bd6
jmp 0x404b95
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x404bd8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4