joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b52d
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00413db0
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [0x42212c]
test eax, eax
je 0x41b5c8
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [0x4220b4]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x42bbd0]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x41b5c8
cmp eax, 1
je 0x41b5e9
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [0x42212c]
test eax, eax
je 0x41b5c8
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x41b595
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x41b5c4
xor eax, eax
inc eax
jmp 0x41b608
cmp edi, eax
jae 0x41b5cc
xor eax, eax
jmp 0x41b608
cmp eax, esi
jae 0x41b5d3
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [0x422150]
mov eax, dword [0x42bbd0]
jmp 0x41b5ec
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [0x4220b8]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41ba5e
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
push edi
mov dword [ebp - 0x10], ebx
jne 0x41ba77
or eax, 0xffffffff
jmp 0x41bad8
push esi
mov esi, dword [eax]
cmp esi, ebx
mov dword [ebp - 4], esi
je 0x41bad4
push 0x3d
push esi
call fcn.0041caa9
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp - 0xc], eax
je 0x41bad4
cmp esi, eax
je 0x41bad4
xor ecx, ecx
cmp byte [eax + 1], bl
mov eax, dword [0x42bbf0]
sete cl
cmp eax, dword [0x42bbf4]
mov dword [ebp - 8], ecx
jne 0x41baba
mov edi, eax
call fcn.0041b9fd
mov dword [0x42bbf0], eax
cmp eax, ebx
jne 0x41bb13
cmp dword [ebp + 0xc], ebx
je 0x41badc
cmp dword [0x42bbf8], ebx
je 0x41badc
call fcn.004199e1
test eax, eax
je 0x41bb13
or eax, 0xffffffff
pop esi
pop edi
pop ebx
leave
ret
cmp dword [ebp - 8], ebx
je 0x41bae5
xor eax, eax
jmp 0x41bad7
push 4
call fcn.00416bcb
cmp eax, ebx
pop ecx
mov dword [0x42bbf0], eax
je 0x41bad4
mov dword [eax], ebx
cmp dword [0x42bbf8], ebx
jne 0x41bb13
push 4
call fcn.00416bcb
cmp eax, ebx
pop ecx
mov dword [0x42bbf8], eax
je 0x41bad4
mov dword [eax], ebx
mov edi, dword [ebp - 0xc]
sub edi, dword [ebp - 4]
push dword [ebp - 4]
mov esi, dword [0x42bbf0]
call fcn.0041b9b0
mov edi, eax
cmp edi, ebx
pop ecx
jl 0x41bb74
cmp dword [esi], ebx
je 0x41bb74
lea esi, [esi + edi*4]
push dword [esi]
call fcn.00414f24
cmp dword [ebp - 8], ebx
pop ecx
jne 0x41bb57
mov eax, dword [ebp - 4]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x41bbb5
mov eax, dword [esi + 4]
mov dword [esi], eax
inc edi
add esi, 4
cmp dword [esi], ebx
jne 0x41bb4e
mov eax, edi
shl eax, 2
push eax
push dword [0x42bbf0]
call fcn.0041a31b
cmp eax, ebx
pop ecx
pop ecx
je 0x41bbb5
jmp 0x41bbb0
cmp dword [ebp - 8], ebx
jne 0x41bc20
cmp edi, ebx
jge 0x41bb83
neg edi
lea eax, [edi*4 + 8]
push eax
push dword [0x42bbf0]
call fcn.0041a31b
cmp eax, ebx
pop ecx
pop ecx
je 0x41bad4
mov edx, dword [ebp - 4]
lea ecx, [eax + edi*4]
mov dword [ecx], edx
mov dword [ecx + 4], ebx
mov ecx, dword [ebp + 8]
mov dword [ecx], ebx
mov dword [0x42bbf0], eax
cmp dword [ebp + 0xc], ebx
je 0x41bc0a
push dword [ebp - 4]
call fcn.00413970
inc eax
inc eax
push eax
call fcn.00416bcb
mov esi, eax
cmp esi, ebx
pop ecx
pop ecx
je 0x41bc0a
push dword [ebp - 4]
push esi
call fcn.00413870
mov eax, esi
sub eax, dword [ebp - 4]
pop ecx
add eax, dword [ebp - 0xc]
pop ecx
mov ecx, dword [ebp - 8]
mov byte [eax], bl
inc eax
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
push ecx
push esi
call dword [0x4220a0]
test eax, eax
jne 0x41bc03
or dword [ebp - 0x10], 0xffffffff
push esi
call fcn.00414f24
pop ecx
cmp dword [ebp - 8], ebx
je 0x41bc18
push dword [ebp - 4]
call fcn.00414f24
pop ecx
mov eax, dword [ebp - 0x10]
jmp 0x41bad7
push dword [ebp - 4]
call fcn.00414f24
mov eax, dword [ebp + 8]
pop ecx
mov dword [eax], ebx
jmp 0x41bae1
Function at 0x41bc33
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x42be14], ebx
push esi
push edi
jne 0x41bcb3
push str.user32.dll
call dword [0x422020]
mov edi, eax
cmp edi, ebx
je 0x41bcee
mov esi, dword [0x42201c]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x42be14], eax
je 0x41bcee
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x42be18], eax
call esi
cmp dword [0x42bbd0], 2
mov dword [0x42be1c], eax
jne 0x41bcb3
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x42be24], eax
je 0x41bcb3
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x42be20], eax
mov eax, dword [0x42be20]
test eax, eax
je 0x41bcf8
call eax
test eax, eax
je 0x41bcdf
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x42be24]
test eax, eax
je 0x41bcdf
test byte [ebp - 8], 1
jne 0x41bcf8
cmp dword [0x42bbdc], 4
jb 0x41bcf2
or byte [ebp + 0x12], 0x20
jmp 0x41bd17
xor eax, eax
jmp 0x41bd27
or byte [ebp + 0x12], 4
jmp 0x41bd17
mov eax, dword [0x42be18]
test eax, eax
je 0x41bd17
call eax
mov ebx, eax
test ebx, ebx
je 0x41bd17
mov eax, dword [0x42be1c]
test eax, eax
je 0x41bd17
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x42be14]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41c7eb
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00413db0
mov eax, dword [0x428f58]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0x42c260]
mov dword [ebp - 4], eax
jae 0x41c92e
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0x42c280]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x41c92e
push 1
push esi
push ebx
call fcn.00416f78
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x41c938
push 2
push esi
push ebx
call fcn.00416f78
add esp, 0xc
cmp eax, 0xffffffff
je 0x41c938
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x41c8d8
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00412c70
push 0x8000
push ebx
call fcn.0041cdc8
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x41c897
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00416bdd
add esp, 0xc
cmp eax, 0xffffffff
je 0x41c8b5
sub edi, eax
test edi, edi
jg 0x41c88c
jmp 0x41c8cb
cmp dword [0x42bbc8], 5
jne 0x41c8c8
mov dword [0x42bbc4], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.0041cdc8
pop ecx
pop ecx
jmp 0x41c918
jge 0x41c918
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00416f78
push ebx
call fcn.00415b84
add esp, 0x10
push eax
call dword [0x42208c]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x41c918
mov dword [0x42bbc4], 0xd
call dword [0x422034]
mov dword [0x42bbc8], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00416f78
add esp, 0xc
mov eax, esi
pop edi
jmp 0x41c93b
mov dword [0x42bbc4], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.0041a58e
leave
ret
Function at 0x41eea7
Capabilities:
Get common file path

Disassembly:
push 0x120
push 0x424ff0
call fcn.0041a270
mov eax, dword [0x428f58]
mov dword [ebp - 0x1c], eax
lea edi, [ebp - 0x124]
and dword [ebp - 0x128], 0
mov eax, edi
push eax
push 0x105
call dword [0x42200c]
mov esi, eax
mov dword [ebp - 0x12c], esi
cmp esi, 0x104
jle 0x41ef4b
and dword [ebp - 4], 0
lea eax, [esi + 1]
add eax, 3
and eax, 0xfffffffc
call fcn.00413db0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x130], edi
jmp 0x41ef38
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x41ef4b
push edi
inc esi
push esi
call dword [0x42200c]
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x41ef66
cmp byte [edi + 1], 0x3a
jne 0x41ef66
movzx eax, byte [edi]
push eax
call fcn.0041532d
pop ecx
mov ebx, eax
sub ebx, 0x40
cmp dword [ebp - 0x128], 0
je 0x41ef76
push edi
call fcn.00414f24
pop ecx
mov eax, ebx
lea esp, [ebp - 0x13c]
mov ecx, dword [ebp - 0x1c]
call fcn.0041a58e
call fcn.0041a2ab
ret
Function at 0x4204d8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x420506
add al, 0x40
mov byte [ebp + 8], al
lea eax, [ebp + 8]
push eax
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x5c
mov byte [ebp + 0xb], 0
call dword [0x422080]
test eax, eax
je 0x42050b
cmp eax, 1
je 0x42050b
xor eax, eax
inc eax
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42050f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x428f58]
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
mov dword [ebp - 4], eax
je 0x420585
push ebx
call fcn.004204d8
test eax, eax
pop ecx
jne 0x420554
mov dword [0x42bbc8], 0xf
mov dword [0x42bbc4], 0xd
xor eax, eax
mov ecx, dword [ebp - 4]
pop ebx
call fcn.0041a58e
leave
ret
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x108]
push eax
push 0x104
lea eax, [ebp + 8]
add bl, 0x40
push eax
mov byte [ebp + 8], bl
mov byte [ebp + 9], 0x3a
mov byte [ebp + 0xa], 0x2e
mov byte [ebp + 0xb], 0
call dword [0x422040]
jmp 0x420597
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [0x42200c]
test eax, eax
je 0x420547
inc eax
cmp eax, 0x104
ja 0x420547
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4205ce
cmp eax, dword [ebp + 0x10]
jg 0x4205b2
mov eax, dword [ebp + 0x10]
push eax
call fcn.00416bcb
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x4205e2
mov dword [0x42bbc4], 0xc
jmp 0x420547
cmp eax, dword [ebp + 0x10]
jle 0x4205e2
mov dword [0x42bbc4], 0x22
jmp 0x420547
lea eax, [ebp - 0x108]
push eax
push ecx
call fcn.00413870
pop ecx
pop ecx
jmp 0x420549
Function at 0x4206c6
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x425f48
call fcn.0041a270
xor edi, edi
xor ebx, ebx
inc ebx
cmp dword [0x42c004], edi
jne 0x42070a
push edi
push edi
push ebx
push edi
call dword [0x422184]
test eax, eax
je 0x4206f5
mov dword [0x42c004], ebx
jmp 0x42070a
call dword [0x422034]
cmp eax, 0x78
jne 0x42070a
mov dword [0x42c004], 2
mov eax, dword [0x42c004]
cmp eax, ebx
jne 0x42072a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x422184]
jmp 0x4207ed
cmp eax, 2
je 0x420733
cmp eax, edi
jne 0x42075b
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [ebp + 0x18], edi
jne 0x420746
mov eax, dword [0x42bc40]
mov dword [ebp + 0x18], eax
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4220bc]
mov dword [ebp - 0x20], eax
cmp eax, edi
jne 0x420762
xor eax, eax
jmp 0x4207ed
mov dword [ebp - 4], edi
add eax, 3
and eax, 0xfffffffc
call fcn.00413db0
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [ebp - 0x28], esi
or dword [ebp - 4], 0xffffffff
jmp 0x420795
cmp esi, edi
jne 0x4207ab
push dword [ebp - 0x20]
call fcn.00416bcb
pop ecx
mov esi, eax
cmp esi, edi
je 0x42075b
mov dword [ebp - 0x24], ebx
push dword [ebp - 0x20]
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4220bc]
test eax, eax
je 0x4207de
cmp dword [ebp + 0x14], edi
jne 0x4207c8
push edi
push edi
jmp 0x4207ce
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push esi
push ebx
push dword [ebp + 0x18]
call dword [0x42213c]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x24], edi
je 0x4207ea
push esi
call fcn.00414f24
pop ecx
mov eax, dword [ebp - 0x1c]
lea esp, [ebp - 0x34]
call fcn.0041a2ab
ret
Function at 0x4207f6
Capabilities:
Get geographical location

Disassembly:
push 0x18
push 0x425f58
call fcn.0041a270
xor esi, esi
cmp dword [0x42c008], esi
jne 0x42083a
push esi
push esi
xor edi, edi
inc edi
push edi
push esi
call dword [0x422184]
test eax, eax
je 0x420825
mov dword [0x42c008], edi
jmp 0x42083a
call dword [0x422034]
cmp eax, 0x78
jne 0x42083a
mov dword [0x42c008], 2
mov eax, dword [0x42c008]
cmp eax, 2
je 0x42091b
cmp eax, esi
je 0x42091b
cmp eax, 1
jne 0x42087f
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], esi
cmp dword [ebp + 0x18], esi
jne 0x420868
mov eax, dword [0x42bc40]
mov dword [ebp + 0x18], eax
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x422184]
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ebx, esi
jne 0x420886
xor eax, eax
jmp 0x42092d
mov dword [ebp - 4], esi
lea eax, [ebx + ebx]
add eax, 3
and eax, 0xfffffffc
call fcn.00413db0
mov dword [ebp - 0x18], esp
mov edi, esp
mov dword [ebp - 0x28], edi
or dword [ebp - 4], 0xffffffff
jmp 0x4208bc
cmp edi, esi
jne 0x4208d7
lea eax, [ebx + ebx]
push eax
call fcn.00416bcb
pop ecx
mov edi, eax
cmp edi, esi
je 0x42087f
mov dword [ebp - 0x20], 1
push ebx
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x422184]
test eax, eax
je 0x42090a
push esi
push esi
cmp dword [ebp + 0x14], esi
jne 0x4208f4
push esi
push esi
jmp 0x4208fa
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0xffffffffffffffff
push edi
push esi
push dword [ebp + 0x18]
call dword [0x4220d4]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], esi
je 0x420916
push edi
call fcn.00414f24
pop ecx
mov eax, dword [ebp - 0x1c]
jmp 0x42092d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x4220bc]
lea esp, [ebp - 0x34]
call fcn.0041a2ab
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
mov ecx, 0x89a1ab6
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
nop
mov ecx, 0x1dff48c3
nop
nop
nop
test eax, eax
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
jne 0x43206c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..00cfg
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ecc
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x73326b2b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x25e60165
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x403005
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x40301f
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x403032
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x403045
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.004069f0
test eax, eax
je 0x40307e
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40307e
cmp word [eax], bx
je 0x40307e
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x403092
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4030ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4030ae
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x403110
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x4030dc
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.0040ca0c
jmp 0x4030e5
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x4030f8
push dword [ebp + 8]
push eax
call fcn.00408dfe
jmp 0x403106
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.0040c859
push dword [esi + 4]
mov ecx, esi
call fcn.00402e88
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4031db
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x403201
cmp dword [ebp + 0xc], esi
jbe 0x4031f6
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403251
mov ecx, edi
call fcn.00402fbf
test al, al
je 0x403237
cmp dword [ebp + 0xc], esi
jbe 0x403237
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004031db
jmp 0x403254
cmp dword [edi + 0xc], 1
jne 0x40324c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x40324c
xor eax, eax
jmp 0x403254
or eax, 0xffffffff
jmp 0x403254
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8

Function at 0x403525
Capabilities:
Get file attributes

Disassembly:
call fcn.004069f0
test eax, eax
je 0x403545
mov eax, dword [esp + 8]
test eax, eax
je 0x403545
cmp word [eax], 0
je 0x403545
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x40354f
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret 8
Function at 0x4055bd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
push edi
jne 0x4055e0
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov byte [esi + 0x14], 1
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0xc]
mov byte [esi + 0x15], 0
call ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.00405556
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call edi
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x405636
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
push dword [esi]
push 0
push dword [ebp + 0xc]
call edi
mov ecx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
xor edi, edi
push eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
dec ecx
dec ecx
push ecx
push dword [ebp - 0xc]
inc eax
push eax
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [esi + 4], eax
cmp eax, edi
je 0x405681
push 5
push eax
call ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [esi + 0x15], 0
je 0x405696
cmp dword [esi + 0x18], 0x64
jbe 0x405707
mov ecx, esi
call fcn.00404f1c
jmp 0x405707
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4056a7
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 4], edi
push 5
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0x10]
call fcn.00408d0b
imul eax, eax, 6
add eax, 0x100
push eax
call fcn.00408a4a
push dword [ebp + 0x10]
mov ebx, eax
push ebx
call fcn.00408dfe
push ebx
mov ecx, esi
call fcn.00404e22
test al, al
jne 0x4056e3
push ebx
mov ecx, esi
call fcn.00404e52
push ebx
mov ecx, esi
call fcn.00405282
push ebx
mov esi, eax
call fcn.00408a63
cmp esi, edi
je 0x405707
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push esi
call fcn.00408a63
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x4087e8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
call fcn.00408711
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov byte [ebp - 1], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
sub edi, dword [ebp - 0x24]
sub esi, eax
sub esi, dword [ebp - 0x20]
inc edi
inc esi
cmp byte [ebp - 1], 0
je 0x408875
cmp byte [ebp + 0x10], 0
jne 0x4088b5
imul eax, dword [ebp - 8]
push 0x206
cdq
push 0x64
pop ecx
idiv ecx
add eax, esi
push eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
add eax, edi
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [ebp + 0x10], 0
jne 0x4088b5
push 0x400
lea eax, [ebp - 0x444]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
lea eax, [ebp - 0x444]
push eax
push eax
call fcn.0040862d
lea eax, [ebp - 0x444]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
push 8
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 5
push dword [ebp + 8]
sub esi, eax
call dword [sym.imp.USER32.dll_GetWindow]
and dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x4089ab
cmp dword [ebp + 8], 0x200
jge 0x4089b3
push 0x400
lea eax, [ebp - 0x444]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp byte [ebp - 0x444], 0
je 0x408929
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
lea eax, [ebp - 0x444]
push eax
push eax
call fcn.0040862d
lea eax, [ebp - 0x444]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp byte [ebp - 1], 0
je 0x408995
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call ebx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 0x204
inc eax
imul eax, dword [ebp - 8]
cdq
push 0x64
pop ecx
idiv ecx
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
inc eax
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
push eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x20]
sub eax, esi
imul eax, dword [ebp - 8]
cdq
idiv ecx
push eax
mov eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x34]
sar ecx, 1
sub eax, ecx
sub eax, dword [ebp - 0x24]
push 0x64
imul eax, dword [ebp - 0xc]
pop ecx
cdq
idiv ecx
push eax
push 0
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp + 0x10], eax
cmp eax, dword [ebp - 0x14]
je 0x4089b3
inc dword [ebp + 8]
test eax, eax
jne 0x4088d9
pop edi
pop esi
pop ebx
leave
ret 0xc