joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d573e
Capabilities:
Encode data using base64
Execute anti-debugging instructions
Parse pe header

Disassembly:
jb 0x696342
mov ecx, dword [esp + 0xc30]
push ecx
jmp 0x67a096
mov dword [esp + 0xc40], edi
test cx, 0x735
mov byte [esp + 0xc30], 0
cmp sp, di
clc
cmp dword [esp + 0x938], ebx
jmp 0x65d93a
push edx
jmp 0x652fef
call fcn.004509e1
lea esp, [esp + 4]
cmp bp, 0x74f4
mov byte [esp + 0x1bf0], 6
cmc
mov dword [esp + 0x938], esi
clc
mov dword [esp + 0x934], edi
jmp 0x427a2b
jb 0x652ffd
mov edx, dword [esp + 0x924]
jmp 0x63e8ea
call fcn.004509e1
add esp, 4
jmp 0x696342
mov dword [esp + 0xc44], esi
jmp 0x569695
push 0xef2f3dbf
call fcn.006e23bd
call fcn.00404c50
cmp dword [esp + 0xc44], ebx
jmp 0x5322ce
Function at 0x6e1729
Capabilities:
Get disk information

Disassembly:
call fcn.0046ecd5
lea esp, [esp + 0x18]
ror di, 0x87
btr ebx, edi
test bh, 0x35
pop edi
sar al, 0x34
rcr si, 0x8f
pop esi
shr cx, 0x9a
rcr ecx, cl
mov al, 1
add ecx, esi
bt ebx, 0x94
add bl, 0xa8
pop ebx
mov ecx, esp
bts ecx, edx
mov ecx, dword [ebp - 4]
cmp ch, 0xed
xor ecx, ebp
jmp 0x5e8523
je 0x6e5c90
inc edi
cmp esp, esi
cmp di, 0x5b
jmp 0x5ebedc
sar eax, 1
mov esi, 0x6f9a1333
mov esi, edx
mov esi, eax
cwde
push esi
lea eax, [ebp - 0x8c]
jmp 0x5ef738
push edi
jmp 0x5390c4
je 0x68ab2d
test esi, esi
jmp 0x6b877b
add eax, 2
test esi, 0x798b253a
cmp al, 0x49
test cx, cx
jne 0x60929e
sub eax, edx
jmp 0x55f31a
mov word [ebp - 0xc], di
mov word [ebp - 0xa], ax
jmp 0x680690
push edi
jmp 0x5c3ccf
call fcn.0046ec66
lea edx, [ebx + esi*2]
jmp 0x6c1812
call fcn.0046ebc0
add esp, 0xc
cmp esi, 0x27181735
test eax, eax
jmp 0x54e73c
push ecx
push 0x104
jmp 0x5bd909
mov dword [ebp - 0x90], esi
mov word [ebp - 0xc], ax
jmp 0x6ddd5d
call fcn.0046e186
mov esp, ebp
mov bp, di
pop ebp
jmp 0x41820c
jl 0x69298a
pop edi
rol cl, cl
mov bx, sp
pop esi
sub al, al
pop ebx
inc ch
mov ecx, dword [ebp - 4]
test ah, cl
xor ecx, ebp
jmp 0x41367b
push ebx
jmp 0x610600
push edx
jmp 0x5a6995
je 0x54e742
lea eax, [ebp - 0x8c]
rcr dh, cl
sal edx, cl
lea edx, [eax + 2]
clc
lea ecx, [ecx]
add cx, ax
bt cx, di
ror cx, cl
mov cx, word [eax]
jmp 0x594fcc
push eax
jmp 0x5cb475
ret
push 0x104
jmp 0x56444a
call fcn.0046e186
mov esp, ebp
movzx ebp, dx
mov ebp, 0x4d2b78bb
pop ebp
jmp 0x610622
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
test eax, eax
jmp 0x60927d
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
add bx, dx
sub bl, 0xaf
xor bx, ax
xor al, al
cmovle ebx, esi
pop ebx
jmp 0x634ebc
mov edi, 0x41
movzx cx, al
mov edi, edi
push 0x40
bswap ecx
jmp 0x6d4f7a
je 0x68ab2d
push edi
jmp 0x69297f
push edx
jmp 0x625bf2
mov word [ebp - 0x8c], cx
call fcn.00473d40
lea esp, [esp + 0xc]
test sp, bp
cmp eax, esp
cmp esp, 0x292d4863
test ebx, ebx
jmp 0x58b2b3
lea ecx, [ebp - 0x8c]
movsx ax, ch
not al
cdq
push ecx
cwd
lea edx, [ebp - 0xc]
movsx eax, bp
cwde
mov al, 0x50
mov eax, 0x3a
jmp 0x5f69a3
mov dword [ebp - 0xa], eax
jmp 0x6f9f09
push ebp
bt eax, esi
mov ebp, esp
lea esp, [esp - 0x90]
stc
mov eax, dword [0x520628]
sar edx, cl
stc
xor eax, ebp
mov dword [ebp - 4], eax
ror edx, cl
rcl dh, 0x8e
push ebx
mov ebx, dword [ebp + 8]
shl dh, cl
bswap edx
btr edx, ebp
push esi
bt edx, eax
shl esi, 0xe2
mov esi, ecx
and edx, esi
stc
sub ecx, ecx
movzx dx, dh
cmovno edx, eax
push 0x7e
movzx edx, cx
xor eax, eax
push ecx
movzx dx, ah
setae dl
lea edx, [ebp - 0x8a]
push edx
jmp 0x5dfb0e
mov edi, dword [ebp - 0x90]
xchg cx, cx
lea ecx, [ebp - 0xc]
jmp 0x5d35f9
mov word [ebp - 6], ax
jmp 0x6d1821
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x7ffe540c
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword fs:[0x30]
push eax
pop eax
xor eax, ecx
xor eax, ecx
and al, 0xff
push bx
inc esp
inc esp
add al, 0
add al, 4
sub al, 4
add al, 0
not eax
not eax
and al, 0xff
pushf
popf
inc esi
dec esi
not eax
not eax
add al, 0
add al, 4
sub al, 4
inc esi
dec esi
stc
push eax
pop eax
call 0x7ffe5446
pop edx
stc
xor dx, dx
push es
pop ds
push edx
cdq
pop edx
add edx, 0xd5e0
push es
pop ds
inc esi
dec esi
clc
xor ecx, ecx
push eax
pop eax
mov cl, 0x1e
add al, 0
add al, 4
sub al, 4
xor byte [ecx + edx], 0x89
loop 0x7ffe5467
stc
push dword fs:[0x24]
not eax
not eax
inc esi
dec esi
pop dword [edx + 0xa]
push bx
inc esp
inc esp
stc
mov cl, 0xff
push edx
loop 0x7ffe5485
mov dword [edx + 0x11], 0xffffacbb
pushf
popf
mov ecx, dword [eax + 0x2c]
and al, 0xff
inc esi
dec esi
mov dword [edx + 0x1b], ecx
and al, 0xff
xor eax, ecx
xor eax, ecx
mov dword [edx + 0x100], ecx
push es
pop ds
pushal
inc eax
popal
mov dword [eax + 0x2c], esp
stc
push 0
not eax
not eax
and al, 0xff
push 0
xor eax, ecx
xor eax, ecx
inc esi
dec esi
push 0
not eax
not eax
cld
push 0
xor eax, ecx
xor eax, ecx
push eax
pop eax
push 0x30
not eax
not eax
push 0x20
push 0
stc
push 0
add al, 4
sub al, 4
push eax
pop eax
add edx, 0xffff7f38
xor eax, ecx
xor eax, ecx
push edx
and al, 0xff
push edx
and al, 0xff
push 0
and al, 0xff
inc esi
dec esi
cld
call dword [edx + 0x820b]
inc esi
dec esi
add esp, 0x3f8
cld
xor eax, eax
inc eax
pushal
inc eax
popal
ret 0xc
Function at 0x46ae2d
Capabilities:
Encode data using xor

Disassembly:
jae 0x46ae80
inc ebx
or al, 0x31
xor ebp, ebx
mov esp, 0x2b644487
push ss
scasb al, byte es:[edi]
nop
xchg esp, eax
popal
jns 0x46ae69
adc bh, byte [ebp - 0x6628efa3]
cmc
stosd dword es:[edi], eax
sub al, 0xdc
popal
inc esi
adc al, 0xd
jmp 0xd3895da6
stc
inc esp
invalid
adc cl, 0
retf 0x2fdb

Function at 0x48093d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x37622ad9
daa
push edx
push edi
adc al, 0x89
sub ebp, dword [ecx - 0x79]
mov ebp, 0x45e16a01
invalid

Function at 0x628c85
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x630388
cmp edx, dword [eax]
je 0x628ca7
add eax, 8
inc ecx
cmp eax, 0x630418
jl 0x628c98
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x630388]
jne 0x628dd5
mov eax, dword [0x639d10]
cmp eax, 1
je 0x628daf
test eax, eax
jne 0x628cd8
cmp dword [0x6302b0], 1
je 0x628daf
cmp edx, 0xfc
je 0x628dd5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x628d0f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00629670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00629b00
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x628d52
lea eax, [ebp - 0x1a4]
push eax
call fcn.00629b00
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62d99c
push edi
call fcn.0062b9d0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00629670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00629680
lea eax, [ebp - 0xa0]
push 0x62d97c
push eax
call fcn.00629680
push dword [esi + 0x63038c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00629680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062b944
add esp, 0x2c
pop edi
jmp 0x628dd5
lea eax, [ebp + 8]
lea esi, [esi + 0x63038c]
push 0
push eax
push dword [esi]
call fcn.00629b00
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x42e072
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x3a391239
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x42e0d2
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x3d752d6a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x42e0c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4021cf
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x4021ef
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x4021f8
cmp byte [ebx], 0
jne 0x4021ff
xor eax, eax
jmp 0x402294
xor esi, esi
jmp 0x402257
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x402229
cmp dword [ebp - 4], 0
je 0x402229
test esi, esi
jne 0x402229
cmp dword [ebp + 8], 0
je 0x402225
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x402257
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x402237
cmp ecx, 0xa
jne 0x40223f
cmp ecx, 0xd
jne 0x40225c
inc ebx
jmp 0x40225c
xor ecx, ecx
mov cl, al
cmp ecx, 0x5c
jne 0x402254
xor ecx, ecx
mov cl, byte [ebx]
cmp ecx, 0x6e
jne 0x402254
inc ebx
mov al, 0xa
mov byte [edx], al
inc edx
cmp byte [ebx], 0
jne 0x402203
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x402292
mov edx, dword [ebp - 4]
test esi, esi
mov byte [edx], 0
je 0x402292
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.0040d908
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4024c5
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffff7e0
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.0040d888
mov ecx, eax
mov edx, esp
lea eax, [esp + 0x400]
call fcn.0040d95c
test eax, eax
jne 0x40255c
push 0x4121ec
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.0040d888
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x800]
mov ecx, 0x1e
xor edx, edx
call fcn.0040d808
mov dword [esp + 0x804], 3
mov word [esp + 0x810], 0x14
mov eax, esp
mov dword [esp + 0x808], eax
lea edx, [esp + 0x800]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x820
ret

Function at 0x402617
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x41205c], 0
je 0x40268e
cmp byte [0x4138c8], 0
je 0x40268e
lea edx, [esp + 8]
mov eax, 0x4138c8
call fcn.004025e6
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x40268e
mov eax, ebx
call fcn.0040d888
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x402800
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402968
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x412760
push 1
push 0
push 0x412770
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402a67
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x4029cb
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x4029dd
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.0040d908
lea eax, [ebp - 0x40c]
call fcn.004058c4
cmp byte [ebp - 0x40c], 0
je 0x402a0e
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x412790
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402a5e
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402a55
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402b90
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x412810]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x412021], 0
jne 0x402bec
mov eax, dword [0x413cc8]
call fcn.00403f80
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x412099
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x412021], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [esp], 0x3c
mov edx, esp
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
and dword [esp + 8], 0xbfffffff
mov byte [esp + 0x19], 0
test bl, bl
je 0x402c38
or dword [esp + 8], 1
mov dword [esp + 0x14], 0xa0
jmp 0x402c43
and dword [esp + 8], 0xfffffffe
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x40000001
mov eax, esp
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x4120c0
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
add esp, 0x3c
pop edi
pop esi
pop ebx
ret
Function at 0x4035e0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov ebx, 0x4134c0
mov eax, 0x418044
call fcn.0040e0a8
call sub.KERNEL32.DLL_GetCommandLineA
mov esi, eax
test esi, esi
je 0x403617
xor eax, eax
mov al, byte [esi]
cmp eax, 0x22
jne 0x403617
lea eax, [esi + 1]
mov edx, 0x22
call fcn.0040d898
mov esi, eax
test esi, esi
je 0x403683
mov edx, 0x4120f6
mov eax, esi
call fcn.0040d8dc
mov esi, eax
test eax, eax
je 0x403636
mov eax, ebx
mov edx, esi
call fcn.0040d908
xor ecx, ecx
xor eax, eax
jmp 0x403675
and edx, 0xff
cmp edx, 0x20
je 0x403649
mov cl, 1
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x2d
je 0x403658
cmp edx, 0x2f
jne 0x403674
xor edx, edx
mov dl, byte [ebx + eax + 1]
cmp edx, 0x73
je 0x403668
cmp edx, 0x53
jne 0x403674
mov dword [0x412058], 1
jmp 0x40367c
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x40363c
test cl, cl
jne 0x403683
mov byte [ebx], 0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x64
mov dword [0x41802c], ebx
mov dword [0x418028], ebx
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x4138c0], eax
push 0x65
push dword [0x418028]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x4138c4], eax
mov eax, esp
call fcn.00404f08
push 0x400
push 0x4130c0
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov edx, 0x4130c0
mov eax, 0x418030
call fcn.004046f0
lea eax, [esp + 8]
call fcn.00403e38
lea eax, [esp + 0x20]
call fcn.00403e38
lea edx, [esp + 8]
mov dword [0x413cc8], edx
lea ecx, [esp + 0x20]
mov dword [0x413ccc], ecx
call fcn.0040100c
cmp dword [0x412054], 0
jle 0x40371c
mov eax, dword [0x412048]
call fcn.0040d78c
push dword [0x4138c0]
call sub.GDI32.DLL_DeleteObject
mov eax, dword [0x4138c4]
test eax, eax
je 0x403736
push eax
call sub.GDI32.DLL_DeleteObject
lea eax, [esp + 0x20]
mov edx, 2
call fcn.00403e58
lea eax, [esp + 8]
mov edx, 2
call fcn.00403e58
mov eax, esp
mov edx, 2
call fcn.00404f84
cmp dword [0x41801c], 0
jne 0x40377f
cmp dword [0x412818], 0
je 0x40377f
mov eax, 0x41801c
mov edx, 0xff
call fcn.0040b414
mov dword [0x412818], 2
push dword [0x41801c]
call sub.KERNEL32.DLL_ExitProcess
add esp, 0x38
pop esi
pop ebx
ret
Function at 0x403e80
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x403ea1
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00403f94
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
mov eax, dword [ebx + 4]
test eax, eax
je 0x403ee7
push eax
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
add ecx, 0xfffffffe
push ecx
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
je 0x403f38
push 5
push edi
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x403f76
mov eax, dword [ebx + 4]
test eax, eax
je 0x403f50
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov edx, dword [ebp + 8]
mov eax, ebx
call fcn.00404320
mov ebx, eax
test ebx, ebx
je 0x403f76
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.0040d78c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x404160
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x4041c6
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x4041d7
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x4041c6
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [esp + 8]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [esp + 8]
push eax
call sub.USER32.DLL_DispatchMessageA
push esp
push esi
mov edx, dword [esi]
call dword [edx + 0x48]
test eax, eax
jl 0x40417e
cmp dword [esp], 0
je 0x40417e
xor ebx, ebx
cmp dword [esp], 0
je 0x404221
lea eax, [esp + 4]
push eax
push 0x4127a0
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x404221
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x404217
push edi
mov ecx, dword [esp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x404bc0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ac
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov esi, edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00404dbc
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push esi
call sub.USER32.DLL_GetWindowRect
lea edx, [ebp - 0x44]
push edx
push esi
call sub.USER32.DLL_GetClientRect
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
inc ecx
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
inc eax
sub eax, dword [ebp - 0x38]
test bl, bl
mov dword [ebp - 0x18], eax
je 0x404c57
cmp byte [ebp + 8], 0
jne 0x404c57
mov eax, dword [ebp - 0x3c]
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x38]
imul dword [ebp - 0x10]
cdq
mov edi, 0x64
idiv edi
add ecx, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0x206
push eax
push ecx
push 0
push 0
push 0
push esi
call sub.USER32.DLL_SetWindowPos
cmp byte [ebp + 8], 0
jne 0x404c95
push 0x400
lea eax, [ebp - 0x444]
push eax
push esi
call sub.USER32.DLL_GetWindowTextA
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x444]
lea edx, [ebp - 0x444]
mov eax, dword [ebp - 4]
call fcn.00404a44
lea edx, [ebp - 0x444]
push edx
push esi
call sub.USER32.DLL_SetWindowTextA
push 8
call sub.USER32.DLL_GetSystemMetrics
sub dword [ebp - 0x18], eax
push 5
push esi
call sub.USER32.DLL_GetWindow
mov edi, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
jmp 0x404da3
push 0x400
lea eax, [ebp - 0x844]
push eax
push edi
call sub.USER32.DLL_GetWindowTextA
cmp byte [ebp - 0x844], 0
je 0x404cf4
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x844]
lea edx, [ebp - 0x844]
mov eax, dword [ebp - 4]
call fcn.00404a44
lea edx, [ebp - 0x844]
push edx
push edi
call sub.USER32.DLL_SetWindowTextA
test bl, bl
je 0x404d93
lea ecx, [ebp - 0x854]
push ecx
push edi
call sub.USER32.DLL_GetWindowRect
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0x404d1c
adc edx, 0
sub eax, edx
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x18]
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x854]
inc eax
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x850]
inc eax
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
push 0x204
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ecx
push 0
push edi
call sub.USER32.DLL_SetWindowPos
push 2
push edi
call sub.USER32.DLL_GetWindow
mov edi, eax
cmp edi, dword [ebp - 0x1c]
je 0x404db3
inc esi
test edi, edi
je 0x404db3
cmp esi, 0x200
jl 0x404cb3
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4