joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c096
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
mov edi, ecx
mov ebx, dword [edi]
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], edi
sub ebx, 6
call fcn.0041b890
xor eax, eax
add esp, 0xc
xor edx, edx
cmp ebx, eax
mov dword [ebp + 8], eax
jle 0x40c104
cmp edx, dword [edi]
jg 0x40c24f
cmp eax, ebx
jge 0x40c0f5
lea ecx, [ebp + eax*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40c0f5
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, ecx
inc eax
add ecx, 4
inc dword [ebp + 8]
cmp eax, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40c0d5
cmp dword [ebp + 8], 4
jne 0x40c100
inc edx
and dword [ebp + 8], 0
cmp eax, ebx
jl 0x40c0c5
cmp edx, dword [edi]
jg 0x40c24f
mov eax, ebx
shl eax, 2
lea ecx, [ebp + eax - 0x3b]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp + eax - 0x3a]
mov dword [ebp - 0x10], ecx
lea ecx, [ebp + eax - 0x39]
lea eax, [ebp + eax - 0x3c]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], 0x433798
mov eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
mov al, byte [ebp - 0x38]
xor al, byte [ecx + 0x4338b8]
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 0x38], al
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x4338b8]
xor byte [ebp - 0x37], cl
mov ecx, dword [ebp - 0x14]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x4338b8]
xor byte [ebp - 0x36], cl
mov ecx, dword [ebp - 0x18]
movzx ecx, byte [ecx]
mov cl, byte [ecx + 0x4338b8]
xor byte [ebp - 0x35], cl
mov ecx, dword [ebp - 8]
xor al, byte [ecx]
inc dword [ebp - 8]
mov byte [ebp - 0x38], al
cmp ebx, 8
je 0x40c1a5
cmp ebx, 1
jle 0x40c206
lea ecx, [ebp - 0x34]
lea edi, [ebx - 1]
xor esi, esi
mov al, byte [ecx + esi - 4]
xor byte [ecx + esi], al
inc esi
cmp esi, 4
jl 0x40c190
add ecx, 4
dec edi
jne 0x40c18e
jmp 0x40c203
push 3
lea ecx, [ebp - 0x34]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40c1ae
dec edi
jne 0x40c1ab
movzx eax, byte [ebp - 0x2c]
mov al, byte [eax + 0x4338b8]
xor byte [ebp - 0x28], al
movzx eax, byte [ebp - 0x2b]
mov al, byte [eax + 0x4338b8]
xor byte [ebp - 0x27], al
movzx eax, byte [ebp - 0x2a]
mov al, byte [eax + 0x4338b8]
xor byte [ebp - 0x26], al
movzx eax, byte [ebp - 0x29]
mov al, byte [eax + 0x4338b8]
xor byte [ebp - 0x25], al
push 3
lea ecx, [ebp - 0x24]
pop edi
push 4
pop esi
mov al, byte [ecx - 4]
xor byte [ecx], al
inc ecx
dec esi
jne 0x40c1f7
dec edi
jne 0x40c1f4
mov edi, dword [ebp - 4]
xor ecx, ecx
test ebx, ebx
jle 0x40c247
cmp edx, dword [edi]
jg 0x40c24f
cmp ecx, ebx
jge 0x40c238
lea eax, [ebp + ecx*4 - 0x38]
mov esi, dword [ebp + 8]
cmp esi, 4
jge 0x40c238
lea esi, [esi + edx*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ecx
add eax, 4
inc dword [ebp + 8]
cmp ecx, ebx
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
jl 0x40c218
cmp dword [ebp + 8], 4
jne 0x40c243
inc edx
and dword [ebp + 8], 0
cmp ecx, ebx
jl 0x40c20c
cmp edx, dword [edi]
jle 0x40c134
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40c256
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
xor eax, eax
push edi
inc eax
mov edi, ecx
cmp dword [edi], eax
mov dword [ebp - 8], eax
jle 0x40c2e3
lea eax, [edi + 0x24]
push ebx
mov dword [ebp - 4], eax
push esi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 0xc], 4
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x430798]
xor dl, byte [eax + ebx*4 + 0x430f98]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x431398]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x430b98]
add ecx, 4
mov byte [esi], dl
add esi, 4
dec dword [ebp - 0xc]
jne 0x40c284
inc eax
cmp eax, 4
jl 0x40c273
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0041b890
add dword [ebp - 4], 0x10
add esp, 0xc
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [edi]
jl 0x40c271
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40ca44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
cmp dword [0x4339c0], ebx
jne 0x40ca5d
mov ecx, 0x4339b8
call fcn.0040ca05
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], bl
je 0x40caa7
mov ecx, dword [0x4339c0]
cmp ecx, ebx
je 0x40cac3
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40cae4
push str.CryptProtectMemory_failed
mov esi, 0x42e76c
push esi
call fcn.004063a0
pop ecx
pop ecx
mov ecx, esi
call fcn.004220b4
push 2
mov ecx, esi
call fcn.0040645c
jmp 0x40cae4
mov ecx, dword [0x4339c4]
cmp ecx, ebx
je 0x40cac3
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40cae4
push str.CryptUnprotectMemory_failed
jmp 0x40ca88
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
cmp esi, ebx
jbe 0x40cae4
mov dl, al
add dl, 0x4b
mov eax, dword [ebp + 8]
add eax, ecx
mov bl, dl
add bl, cl
xor byte [eax], bl
inc ecx
cmp ecx, esi
jb 0x40cad4
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40cc89
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x42b0dc], 0
push ebx
push esi
push edi
mov edi, 0x400
jne 0x40ccd4
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x4480cc], ax
xor eax, eax
mov word [0x4480ce], ax
mov dword [0x42b0dc], 0x4480cc
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00410825
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push 0x42b0cc
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
pop edi
mov word [esi + ebx*2 - 2], ax
pop esi
pop ebx
leave
ret 0x10
Function at 0x40cf34
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x68
push dword [0x43c9f8]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x43c9fc], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x40cf96
mov ecx, dword [0x4339cc]
call fcn.00418c03
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x426554
push 0
push 0xc2
push edi
call esi
mov byte [0x43c9fc], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x60], 0x5c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x5c], eax
je 0x40cfe6
mov ecx, dword [ebp - 0x58]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], 0xa0
mov dword [ebp - 0x5c], 0x40000001
lea ecx, [ebp - 0x60]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x40d030
mov eax, dword [ebp - 0x58]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x42681c
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40d3fa
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041a1a0
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x40d415
mov byte [ebx], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40d41f
mov byte [eax], 0
test edi, edi
je 0x40d4c8
movzx eax, word [edi]
test ax, ax
je 0x40d4c8
push esi
xor esi, esi
xor ecx, ecx
movzx eax, ax
inc edi
inc edi
cmp ax, 0x3d
jne 0x40d458
cmp dword [ebp + 0xc], 0
je 0x40d464
test esi, esi
jne 0x40d464
test ebx, ebx
je 0x40d454
mov byte [ebx], 1
mov esi, edx
jmp 0x40d473
cmp ax, 0xd
je 0x40d486
cmp ax, 0xa
je 0x40d488
mov word [edx], ax
mov eax, dword [ebp + 0x14]
inc edx
add eax, 0xfffffffe
inc edx
cmp ecx, eax
jg 0x40d47e
movzx eax, word [edi]
inc ecx
test ax, ax
jne 0x40d438
jmp 0x40d488
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x40d488
inc edi
inc edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [edx], ax
test ebx, ebx
je 0x40d4c3
mov word [ebx], ax
test esi, esi
je 0x40d4c3
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2000]
push eax
push ebx
call fcn.004107c9
xor eax, eax
mov word [esi], ax
mov eax, edi
pop esi
jmp 0x40d4ca
xor eax, eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x40d50f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0041a1a0
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.0041969f
cmp byte [0x43c9fd], 0
jne 0x40d5a4
push 6
push dword [0x42b0c8]
lea eax, [ebp - 0x1020]
push eax
call fcn.0040a11e
push eax
call fcn.00411513
test eax, eax
jne 0x40d5a4
push 0x42666c
call fcn.0041968c
lea eax, [ebp - 0x1020]
push eax
call fcn.00419e8b
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x101e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.00419f00
add esp, 0x10
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x40d705
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041a1a0
push ebx
xor ebx, ebx
cmp byte [0x43ca30], bl
je 0x40d78a
cmp word [0x4339d0], bx
je 0x40d78a
push esi
push 0x4339d0
lea esi, [ebp - 0x1008]
call fcn.0040d6c8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x40d78a
push dword [ebp + 8]
call fcn.00419e8b
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40d78f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.0041a1a0
cmp byte [0x43ca30], 0
je 0x40d836
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x200c]
call fcn.0040d6c8
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40d836
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d82d
shr dword [ebp - 4], 1
mov eax, 0x7ff
cmp dword [ebp - 4], eax
jae 0x40d811
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.004107c9
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x40e387
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp byte [0x43c9de], 0
mov eax, dword [ebp + 0xc]
mov dword [0x43c9e0], eax
mov eax, dword [ebp + 0x10]
mov dword [0x43c9e4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x43c9d8], eax
je 0x40e3b7
xor eax, eax
inc eax
jmp 0x40e3e0
cmp byte [0x43c9df], 0
je 0x40e3c5
push 2
pop eax
jmp 0x40e3e0
push dword [ebp + 8]
push 0x40daf2
push dword [0x43c9f8]
push str.REPLACEFILEDLG
push dword [0x42e764]
call esi
dec eax
je 0x40e432
dec eax
je 0x40e444
dec eax
je 0x40e42b
dec eax
jne 0x40e40f
push dword [ebp + 8]
push 0x40d08a
push dword [0x43c9f8]
push str.RENAMEDLG
push dword [0x42e764]
call esi
test eax, eax
je 0x40e391
mov al, 0x52
jmp 0x40e43f
dec eax
je 0x40e420
dec eax
mov al, 0x4e
jne 0x40e43f
mov byte [0x43c9df], 1
jmp 0x40e43f
mov byte [0x43c9ea], 1
mov al, 0x43
jmp 0x40e43f
mov byte [0x43c9de], 1
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 0x59
pop esi
pop ebp
ret 0x10
mov al, 0x4e
jmp 0x40e43f
Function at 0x410105
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x4102db
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x20], 0
and dword [eax + 0x24], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret 4
Function at 0x410d7e
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov esi, ecx
push 0x20
pop ecx
mov dword [esi], eax
cmp eax, ecx
jbe 0x410d93
mov dword [esi], ecx
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [esi], ebx
jne 0x410d9e
mov dword [esi], edi
cmp dword [esi], ecx
jbe 0x410da4
mov dword [esi], ecx
push ebx
push ecx
push ebx
push ebx
mov byte [esi + 0x190], bl
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push ebx
push edi
push edi
push ebx
mov dword [esi + 0x194], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x198], eax
lea eax, [esi + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [esi + 0x194], ebx
je 0x410de7
cmp dword [esi + 0x198], ebx
jne 0x410e02
push str._nThread_pool_initialization_failed.
mov edi, 0x42e76c
push edi
call fcn.004063a0
pop ecx
pop ecx
push 2
mov ecx, edi
call fcn.0040645c
mov dword [esp + 0x14], ebx
cmp dword [esi], ebx
jbe 0x410e77
push ebp
lea ebp, [esi + 4]
lea eax, [esp + 0x10]
push eax
push ebx
push esi
push 0x410d37
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, ebx
jne 0x410e53
push str.CreateThread_failed
push 0x42e76c
call fcn.004063a0
pop ecx
pop ecx
mov ecx, 0x42e76c
call fcn.004220b4
push 2
mov ecx, 0x42e76c
call fcn.0040645c
mov dword [ebp], edi
mov eax, dword [0x44a73c]
cmp eax, ebx
je 0x410e67
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add ebp, 4
cmp eax, dword [esi]
jb 0x410e0e
pop ebp
pop edi
mov dword [esi + 0x188], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x84], ebx
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x41710a
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x425de6
call fcn.00419b8c
push ecx
push ebx
push esi
mov esi, ecx
push 1
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
call fcn.00409662
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x4b38]
call fcn.00411ba3
lea ecx, [esi + 0x98d0]
call fcn.00412586
lea ecx, [esi + 0xe678]
mov byte [ebp - 4], 5
call fcn.0040a810
push 1
lea ecx, [esi + 0xe6b0]
mov byte [ebp - 4], 6
call fcn.00409662
lea eax, [esi + 0xe6c0]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6d0]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe6e0]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 0xa
mov dword [esi], eax
mov dword [esi + 0x4b34], ebx
mov byte [esi + 0x4c38], bl
mov byte [esi + 0x4c48], bl
mov byte [esi + 0x4c49], bl
mov byte [esi + 0x4c4a], bl
mov dword [esi + 0x1c], 1
call fcn.00410e92
push ebx
mov ecx, esi
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xe6f4], ebx
mov dword [esi + 0xe6f8], ebx
call fcn.0041525a
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x418c1a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
test eax, eax
jl 0x418c4c
cmp dword [ebp - 4], edi
jne 0x418c8d
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x2710
ja 0x418c8d
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x418c39
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x418c39
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
mov esi, eax
cmp esi, edi
jl 0x418ce3
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x4270e8
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x418cda
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, edi
jl 0x418cd1
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
cmp esi, edi
pop edi
pop esi
setge al
pop ebx
leave
ret 8
Function at 0x4194a1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x18]
sub esp, 0x10
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
mov esi, ecx
mov byte [esi + 0x21], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
mov ecx, esi
call fcn.0041943a
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x419508
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push esi
push dword [esi]
sub edi, eax
push 0
push dword [ebp + 0xc]
lea ecx, [eax + 1]
dec edi
mov dword [ebp + 0x18], ecx
dec edi
call ebx
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
push edi
push dword [ebp - 0xc]
xor edi, edi
push dword [ebp + 0x18]
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp dword [esi + 0xc], edi
jne 0x41958a
cmp dword [ebp + 0xc], edi
je 0x4195ad
cmp dword [esi + 0x14], edi
jne 0x4195ad
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x4195ad
push eax
mov ecx, esi
call fcn.00419115
mov esi, eax
cmp esi, edi
je 0x4195ad
push 5
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.00419bab
pop ecx
jmp 0x4195ad
cmp eax, edi
je 0x4195a0
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x1c], 0x64
jbe 0x4195ad
mov ecx, esi
call fcn.00418e1f
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4195b4
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x4270d8
push 1
xor ebx, ebx
push ebx
push 0x427188
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x419685
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x427178
push eax
call dword [ecx]
test eax, eax
jl 0x41967c
cmp byte [ebp + 8], bl
je 0x419607
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x419624
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x419636
push 0x426554
jmp 0x419639
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x41964e
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x41965f
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x419673
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x41969f
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x41de4b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b2a0]
jne 0x41de55
repz ret
jmp fcn.00422a5c
Function at 0x424315
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041decc
and dword [ebp - 4], 0
cmp dword [0x44b370], 0
mov ebx, eax
jne 0x4243c6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x424477
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x424477
push eax
call fcn.0041de5a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44b370], eax
call esi
push eax
call fcn.0041de5a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44b374], eax
call esi
push eax
call fcn.0041de5a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44b378], eax
call esi
push eax
call fcn.0041de5a
pop ecx
mov dword [0x44b380], eax
test eax, eax
je 0x4243c6
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041de5a
pop ecx
mov dword [0x44b37c], eax
mov eax, dword [0x44b37c]
cmp eax, ebx
je 0x42441e
cmp dword [0x44b380], ebx
je 0x42441e
push eax
call fcn.0041ded5
push dword [0x44b380]
mov esi, eax
call fcn.0041ded5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42441e
test edi, edi
je 0x42441e
call esi
test eax, eax
je 0x424415
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424415
test byte [ebp - 0xc], 1
jne 0x42441e
or dword [ebp + 0x10], 0x200000
jmp 0x424457
mov eax, dword [0x44b374]
cmp eax, ebx
je 0x424457
push eax
call fcn.0041ded5
pop ecx
test eax, eax
je 0x424457
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x424457
mov eax, dword [0x44b378]
cmp eax, ebx
je 0x424457
push eax
call fcn.0041ded5
pop ecx
test eax, eax
je 0x424457
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44b370]
call fcn.0041ded5
pop ecx
test eax, eax
je 0x424477
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x424479
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret