Benign windows Download

Main.cpp

Get module handleDynamic library loading via LoadLibraryW

SHA-25627c756a96e68ee0eeda776a196b32b7b63e3055da8263cbdf65855179ecffea1

Evidence

Destructive-action word: delete lines 104–110

  "  a : Add files to archive\n"
  "  b : Benchmark\n"
  "  d : Delete files from archive\n"
  "  e : Extract files from archive (without using directory names)\n"
  "  h : Calculate hash values for files\n"
  "  i : Show information about supported formats\n"
  "  l : List contents of archive\n"

Dynamic library loading via LoadLibraryW lines 532–539

  HMODULE kern = ::GetModuleHandleW(L"kernel32.dll");
  Func_GetProcessMemoryInfo my_GetProcessMemoryInfo = (Func_GetProcessMemoryInfo)
      (void *)::GetProcAddress(kern, "K32GetProcessMemoryInfo");
  if (!my_GetProcessMemoryInfo)
  {
    HMODULE lib = LoadLibraryW(L"Psapi.dll");
    if (lib)
      my_GetProcessMemoryInfo = (Func_GetProcessMemoryInfo)(void *)::GetProcAddress(lib, "GetProcessMemoryInfo");