joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bedf
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edi, dword [esp + 0x10]
test edi, edi
jle 0x42bf14
cmp edi, dword [esi + 0xc]
jge 0x42bf14
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42bf14
cmp edi, dword [eax + 8]
jge 0x42bf14
mov eax, dword [eax + 0xc]
mov edi, dword [eax + edi*4]
jmp 0x42bf16
xor edi, edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebx
ret 4

Function at 0x42c01a
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x42c04e
jmp fcn.004210c2
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x42c0bf
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0x1c]
push esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp eax, ebx
jle 0x42c1b8
cmp eax, dword [edi + 0xc]
jge 0x42c1b8
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
cmp esi, ebx
je 0x42c110
mov ecx, dword [ebp + 8]
cmp ecx, dword [esi + 8]
jl 0x42c1a1
cmp dword [ebp + 0xc], ebx
je 0x42c1a1
jmp 0x42c13a
push 0x10
call fcn.0042bdab
cmp eax, ebx
je 0x42c126
mov ecx, eax
call fcn.0042c011
mov esi, eax
jmp 0x42c128
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
mov dword [edi + 0x14], esi
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x42c151
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x42c161
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
jne 0x42c173
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004210c2
mov ecx, dword [esi + 8]
mov dword [esi + 0xc], eax
mov edx, dword [edi + 0xc]
sub edx, ecx
shl edx, 2
push edx
lea eax, [eax + ecx*4]
push ebx
push eax
call fcn.004127b0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp eax, ebx
je 0x42c1b3
cmp ecx, dword [esi + 8]
jge 0x42c1b3
mov edx, dword [ebp + 0xc]
mov dword [eax + ecx*4], edx
push dword [ebp - 4]
jmp 0x42c1b9
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x42c277
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x42c2a5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x42c2c3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0042c1e1
jmp 0x42c2c3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x42c2c3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.0042c1e1
test edi, edi
mov eax, edi
jne 0x42c2ad
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x442178]
test ecx, ecx
je 0x42c376
jmp 0x42c276
ret 8

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x40250d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 0x10], 0
je 0x40252d
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
cmp dword [ebp + 0xc], 0
je 0x402539
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
test ebx, ebx
je 0x402542
cmp byte [ebx], 0
jne 0x402549
xor eax, eax
jmp 0x4025fa
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x4025a7
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x40257b
cmp dword [ebp - 4], 0
je 0x40257b
cmp dword [ebp - 8], 0
jne 0x40257b
cmp dword [ebp + 0x10], 0
je 0x402576
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov dword [ebp - 8], edx
jmp 0x4025a6
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x402589
cmp ecx, 0xa
jne 0x402591
cmp ecx, 0xd
jne 0x4025ac
inc ebx
jmp 0x4025ac
mov byte [edx], al
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp esi, eax
jle 0x4025a6
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x4025ac
inc esi
cmp byte [ebx], 0
jne 0x402552
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x4025f8
mov edx, dword [ebp - 4]
mov byte [edx], 0
cmp dword [ebp - 8], 0
je 0x4025f8
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov ecx, dword [ebp + 8]
dec ecx
lea edx, [ebp - 0x1008]
mov eax, dword [ebp - 4]
call fcn.00407038
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov byte [edx + ecx - 1], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402602
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7c0
mov ebx, eax
mov eax, ebx
mov byte [esp], dl
lea esi, [esp + 4]
call fcn.00406fa8
cmp eax, 0x3f6
jae 0x402835
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.00406f4c
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x40264f
lea edx, [ebx + 1]
jmp 0x402651
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x4026a2
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x40267a
jmp 0x402673
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x402673
mov byte [ebx + eax], 0x20
jmp 0x40267a
inc eax
cmp byte [ebx + eax], 0
jne 0x402663
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x40268f
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x4026a1
cmp edx, 0x20
jne 0x402698
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x4026a9
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x402658
cmp byte [0x40d0da], 0
je 0x4026b9
mov dword [esi + 0x14], 0x40d0da
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405bc0
mov edi, eax
test edi, edi
je 0x4026e5
mov edx, str..inf
mov eax, edi
call fcn.004070b0
test eax, eax
jne 0x4026e5
mov dword [esi + 0xc], str.Install
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.004060f0
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x40270d
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00406184
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x402750
cmp byte [esp + 1], 0
jne 0x402750
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.00407028
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.004070fc
lea eax, [esp + 0x440]
xor edx, edx
call fcn.004060f0
test al, al
je 0x402835
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x40277a
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x402835
cmp byte [0x40ccd0], 0
jne 0x402791
cmp byte [esp], 0
je 0x4027e7
mov ebx, dword [0x40d55c]
test ebx, ebx
je 0x4027a5
push ebx
call sub.USER32.DLL_IsWindowVisible
test eax, eax
jne 0x4027a9
xor eax, eax
jmp 0x4027ae
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x4027c1
push 0
push dword [0x40d55c]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
mov eax, dword [esi + 0x38]
call fcn.0040283f
test ebx, ebx
je 0x4027e7
push 1
push dword [0x40d55c]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x402803
mov edx, str..exe
mov eax, edi
call fcn.004070b0
test eax, eax
je 0x402835
cmp byte [0x40ccd0], 0
je 0x40281e
cmp byte [esp], 0
jne 0x40281e
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x402835
mov edx, 0xc8
cmp byte [esp], 0
jne 0x40282f
add edx, 0x320
push edx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop edi
pop esi
pop ebx
ret
Function at 0x40286d
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffffbe0
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [0x40c044], 0
jne 0x4028f6
mov eax, esp
call fcn.00405ab0
mov ecx, 6
mov edx, dword [str.RarSFX]
call fcn.004070d4
test eax, eax
jne 0x4028f6
push 0x40c22e
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.00406fa8
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x400]
mov ecx, 0x1e
xor edx, edx
call fcn.00406f4c
mov dword [esp + 0x404], 3
mov word [esp + 0x410], 0x14
mov eax, esp
mov dword [esp + 0x408], eax
lea edx, [esp + 0x400]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x420
ret

Function at 0x4029df
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x40ccd8], 0
je 0x402a56
cmp byte [0x40e23c], 0
je 0x402a56
lea edx, [esp + 8]
mov eax, 0x40e23c
call fcn.004029ae
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x402a56
mov eax, ebx
call fcn.00406fa8
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x402a5e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x40ccd8], 0
je 0x402ad7
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.004029ae
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x402ad7
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x402acf
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.00407028
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x402bc0
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402d28
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x40cc20
push 1
push 0
push 0x40cc30
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402e27
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402d8b
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x402d9d
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.00407028
lea eax, [ebp - 0x40c]
call fcn.00405c60
cmp byte [ebp - 0x40c], 0
je 0x402dce
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x40cc50
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402e1e
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402e15
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402e38
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x402f9c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x40d55c]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x40c018], 0
jne 0x402ff8
mov eax, dword [0x40e63c]
call fcn.0040434c
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c095
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x40c018], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [esp], 0x3c
mov edx, esp
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
mov byte [esp + 0x19], 0
mov dword [esp + 4], 1
test bl, bl
je 0x403052
and dword [esp + 8], 0xbfffffff
or dword [esp + 8], 1
mov dword [esp + 0x14], 0xa0
or dword [esp + 4], 0x40000000
mov ecx, esp
push ecx
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
test bl, bl
je 0x4030a6
or dword [esp + 8], 0x40000000
and dword [esp + 8], 0xfffffffe
mov eax, esp
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push 0x40c0bc
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
add esp, 0x3c
pop edi
pop esi
pop ebx
ret
Function at 0x4037b0
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
mov eax, 0x40ee50
push ebx
call fcn.00406c9c
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
test ebx, ebx
je 0x4037de
mov eax, ebx
call fcn.0040397c
push ebx
push str.sfxcmd
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push 0x400
push 0x40de34
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x40de34
push str.sfxname
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
mov dword [0x40d58c], eax
push 0x64
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x40e234], eax
push 0x65
push dword [0x40d58c]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x40e238], eax
lea eax, [ebp - 8]
call fcn.004054f0
mov edx, 0x40de34
mov eax, 0x40d594
call fcn.00404c54
lea eax, [ebp - 0x20]
call fcn.004041bc
lea eax, [ebp - 0x38]
call fcn.004041bc
push 0
push 0x4010a3
lea edx, [ebp - 0x20]
push 0
mov dword [0x40e63c], edx
lea ecx, [ebp - 0x38]
push str.STARTDLG
push ebx
mov dword [0x40e640], ecx
call sub.USER32.DLL_DialogBoxParamA
xor eax, eax
mov dword [0x40d55c], eax
xor edx, edx
mov dword [0x40e640], edx
mov dword [0x40e63c], edx
cmp dword [0x40d564], 0
jne 0x4038ba
cmp dword [0x40d570], 0
jne 0x4038ba
cmp dword [0x40c05c], 0
jne 0x4038ba
mov ecx, 4
mov edx, dword [0x40c048]
xor eax, eax
call fcn.004019a0
lea eax, [ebp - 0x38]
mov edx, 2
call fcn.004041e0
lea eax, [ebp - 0x20]
mov edx, 2
call fcn.004041e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00405564
cmp byte [0x40ccd0], 0
je 0x4038ef
call fcn.0040286d
mov eax, 0x40dda8
mov ecx, 0x80
xor edx, edx
call fcn.00406f4c
cmp dword [0x40c054], 0
jle 0x403913
mov eax, dword [0x40c048]
call fcn.00406d64
push dword [0x40e234]
call sub.GDI32.DLL_DeleteObject
mov eax, dword [0x40e238]
test eax, eax
je 0x40392d
push eax
call sub.GDI32.DLL_DeleteObject
cmp dword [0x40d580], 0
jne 0x40394e
cmp dword [0x40d564], 0
je 0x40394e
mov eax, 0x40d580
mov edx, 0xff
call fcn.00406b44
mov dword [0x40d564], 2
mov eax, dword [0x40c05c]
test eax, eax
je 0x403966
call fcn.0040283f
push dword [0x40d580]
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403af4
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov dword [0x40d574], 1
mov ebx, dword [0x40d55c]
test ebx, ebx
je 0x403b1c
mov eax, 0x7d
call fcn.00402b08
push eax
push 1
push ebx
call sub.USER32.DLL_SetDlgItemTextA
xor edx, edx
mov dword [0x40d578], edx
mov dword [0x40d57c], 1
mov eax, dword [0x40d55c]
test eax, eax
je 0x403b75
push 1
push eax
call sub.USER32.DLL_ShowWindow
cmp dword [0x40c054], 0
jne 0x403b6c
cmp byte [0x40c018], 0
jne 0x403b6c
push 0
push 1
push 0x111
push dword [0x40d55c]
call sub.USER32.DLL_SendMessageA
jmp 0x403b6c
call fcn.00402b84
cmp dword [0x40d564], 2
jne 0x403b67
cmp byte [0x40ccd0], 0
je 0x403b83
call fcn.0040286d
pop ebx
ret
Function at 0x404208
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x40422d
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x14], 1
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00404364
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
mov eax, dword [ebx + 4]
test eax, eax
je 0x404273
push eax
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
add ecx, 0xfffffffe
push ecx
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
je 0x4042c4
push 5
push edi
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x404341
mov eax, dword [ebx + 4]
test eax, eax
je 0x4042dc
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp + 8]
call fcn.00406fa8
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x100
call fcn.00406d50
mov edi, eax
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.00407028
mov edx, edi
mov eax, ebx
call fcn.004049a0
test al, al
jne 0x40431d
mov edx, edi
mov eax, ebx
call fcn.004049d8
mov edx, edi
mov eax, ebx
call fcn.00404818
mov ebx, eax
mov eax, edi
call fcn.00406d64
test ebx, ebx
je 0x404341
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.00406d64
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404558
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x4045be
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x4045cf
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x4045be
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [esp + 8]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [esp + 8]
push eax
call sub.USER32.DLL_DispatchMessageA
push esp
push esi
mov edx, dword [esi]
call dword [edx + 0x48]
test eax, eax
jl 0x404576
cmp dword [esp], 0
je 0x404576
xor ebx, ebx
cmp dword [esp], 0
je 0x404619
lea eax, [esp + 4]
push eax
push 0x40cc60
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x404619
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x40460f
push edi
mov ecx, dword [esp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret