joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c8c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, 4
shl eax, 0
cmp dword [eax + 0x100cb710], 0
jne 0x1002c940
mov dword [ebp - 0x24], 0xedb88320
mov dword [ebp - 0x10], 0
jmp 0x1002c8f0
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x100
jae 0x1002c940
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0
jmp 0x1002c911
mov eax, dword [ebp - 0x18]
add eax, 1
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 8
jae 0x1002c931
mov ecx, dword [ebp - 0x14]
shr ecx, 1
mov edx, dword [ebp - 0x14]
and edx, 1
neg edx
and edx, 0xedb88320
xor ecx, edx
mov dword [ebp - 0x14], ecx
jmp 0x1002c908
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax*4 + 0x100cb710], ecx
jmp 0x1002c8e7
mov edx, dword [ebp + 0x10]
not edx
mov dword [ebp + 0x10], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jle 0x1002c9a3
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x1c], 0
je 0x1002c9a1
mov ecx, dword [ebp - 0xc]
shr ecx, 8
mov edx, dword [ebp - 0xc]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
xor ecx, dword [edx*4 + 0x100cb710]
mov dword [ebp - 0x20], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
jmp 0x1002c95a
jmp 0x1002ca19
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 2], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 2]
mov byte [ebp - 1], al
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x1002ca19
movzx edx, byte [ebp - 1]
cmp edx, 0x23
jne 0x1002c9f9
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x1002c9f9
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x1002c9f9
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 8
mov eax, dword [ebp - 0xc]
and eax, 0xff
movzx ecx, byte [ebp - 1]
xor eax, ecx
xor edx, dword [eax*4 + 0x100cb710]
mov dword [ebp - 0xc], edx
jmp 0x1002c9a3
mov eax, dword [ebp - 0xc]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x1002d460
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 0
je 0x1002d475
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.100919bf
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1002d495
xor eax, eax
jmp 0x1002d582
push 2
push 0
mov eax, dword [ebp - 4]
push eax
call fcn.10090f75
add esp, 0xc
test eax, eax
jne 0x1002d4d2
mov ecx, dword [ebp - 4]
push ecx
call fcn.1009161c
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x1002d4d2
push 0
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.10090f75
add esp, 0xc
test eax, eax
je 0x1002d4e5
mov eax, dword [ebp - 4]
push eax
call fcn.10089ef8
add esp, 4
xor eax, eax
jmp 0x1002d582
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
add edx, dword [ebp + 0x14]
push edx
call fcn.1002ef00
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1002d513
mov eax, dword [ebp - 4]
push eax
call fcn.10089ef8
add esp, 4
xor eax, eax
jmp 0x1002d582
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
push 1
mov eax, dword [ebp - 0xc]
push eax
call fcn.10090be4
add esp, 0x10
cmp eax, dword [ebp - 8]
je 0x1002d54a
mov ecx, dword [ebp - 4]
push ecx
call fcn.10089ef8
add esp, 4
mov edx, dword [ebp - 0xc]
push edx
call fcn.1002ef40
add esp, 4
xor eax, eax
jmp 0x1002d582
cmp dword [ebp + 0x14], 0
jle 0x1002d565
mov eax, dword [ebp + 0x14]
push eax
push 0
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp - 8]
push ecx
call fcn.10087140
add esp, 0xc
mov edx, dword [ebp - 4]
push edx
call fcn.10089ef8
add esp, 4
cmp dword [ebp + 0x10], 0
je 0x1002d57f
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x1005c4a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x100cb64c], 0
jne 0x1005c4b4
call fcn.1005c3d0
call fcn.1002ef80
mov dword [ebp - 4], eax
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [0x100cb65c]
push ecx
call dword [sym.imp.USER32.dll_GetClientRect]
mov edx, dword [ebp - 0x38]
sub edx, dword [ebp - 0x40]
cvtsi2ss xmm0, edx
movss dword [ebp - 0x18], xmm0
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x3c]
cvtsi2ss xmm0, eax
movss dword [ebp - 0x1c], xmm0
movss xmm0, dword [ebp - 0x18]
movss dword [ebp - 0x30], xmm0
movss xmm0, dword [ebp - 0x1c]
movss dword [ebp - 0x2c], xmm0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov dword [eax], ecx
mov dword [eax + 4], edx
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov ecx, dword [ebp - 0x28]
sub ecx, dword [0x100cb660]
mov edx, dword [ebp - 0x24]
sbb edx, dword [0x100cb664]
call fcn.100a6de0
cvtsd2ss xmm0, xmm0
mov edx, dword [0x100cb66c]
mov ecx, dword [0x100cb668]
movss dword [ebp - 0x20], xmm0
call fcn.100a6de0
cvtsd2ss xmm0, xmm0
movss xmm1, dword [ebp - 0x20]
divss xmm1, xmm0
mov edx, dword [ebp - 4]
movss dword [edx + 8], xmm1
mov eax, dword [ebp - 0x28]
mov dword [0x100cb660], eax
mov ecx, dword [ebp - 0x24]
mov dword [0x100cb664], ecx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1005c58a
mov dword [ebp - 8], 1
jmp 0x1005c591
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 8]
mov byte [eax + 0xd5], cl
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1005c5b9
mov dword [ebp - 0xc], 1
jmp 0x1005c5c0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0xc]
mov byte [eax + 0xd6], cl
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x8000
je 0x1005c5e8
mov dword [ebp - 0x10], 1
jmp 0x1005c5ef
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov cl, byte [ebp - 0x10]
mov byte [eax + 0xd7], cl
mov edx, dword [ebp - 4]
mov byte [edx + 0xd8], 0
mov eax, dword [ebp - 4]
movzx ecx, byte [eax + 0xd4]
test ecx, ecx
je 0x1005c61c
mov dword [ebp - 0x14], 0
jmp 0x1005c62c
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.USER32.dll_SetCursor]
call fcn.1002efb0
mov esp, ebp
pop ebp
ret

Function at 0x1005c700
Capabilities:
Create directory
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0x100bbbf0
call fcn.10095bc4
add esp, 4
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x1005c650
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
pop ebp
ret
Function at 0x100673a0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [0x100c5ce4]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx edx, ax
and edx, 1
je 0x10067407
mov eax, dword [0x100c5ce4]
mov byte [eax + 0x1d], 1
mov ecx, dword [0x100c5ce4]
cmp dword [ecx + 0xc], 0
jl 0x100673f6
mov edx, dword [0x100c5ce4]
cmp dword [edx + 0xc], 0xe
jge 0x100673f6
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x24]
or ecx, 4
mov edx, dword [ebp + 8]
mov dword [edx + 0x24], ecx
mov eax, dword [ebp + 0xc]
mov byte [eax], 0
jmp 0x10067405
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x24]
and edx, 0xfffffffb
mov eax, dword [ebp + 8]
mov dword [eax + 0x24], edx
jmp 0x10067411
mov ecx, dword [0x100c5ce4]
mov byte [ecx + 0x1d], 0
mov esp, ebp
pop ebp
ret 8
Function at 0x1007eeb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100aa725
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1007eede
xor eax, eax
jmp 0x1007eff4
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x24], ecx
cmp dword [ebp - 0x24], 0
jne 0x1007eef1
xor eax, eax
jmp 0x1007eff4
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x18]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x28], eax
jne 0x1007ef06
xor eax, eax
jmp 0x1007eff4
mov ecx, 8
imul edx, ecx, 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + edx + 0x78]
mov dword [ebp - 0x20], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x18]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x1c], 0
jmp 0x1007ef51
mov edx, dword [ebp - 0x1c]
add edx, 1
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax + 0x18]
jae 0x1007efc8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x18]
add ecx, dword [eax + edx*4]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x68]
call fcn.1001f5b0
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x30]
push eax
lea ecx, [ebp - 0x50]
call fcn.1001f5b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x50]
push edx
call fcn.1007ebd0
add esp, 8
mov byte [ebp - 0xd], al
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x50]
call fcn.100215d0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.100215d0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1007efc6
jmp 0x1007efc8
jmp 0x1007ef48
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x1c]
cmp edx, dword [ecx + 0x18]
jb 0x1007efd7
xor eax, eax
jmp 0x1007eff4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x34]
mov dx, word [ecx + eax*2]
mov word [ebp - 0x14], dx
movzx eax, word [ebp - 0x14]
mov ecx, dword [ebp - 0x38]
mov edx, dword [ebp + 8]
add edx, dword [ecx + eax*4]
mov eax, edx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10099d57
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10099bcd
Function at 0x4062b5
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x426d74], 0
push esi
jne 0x4062ec
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4062c6
mov dword [ecx*4 + 0x426d70], eax
inc ecx
cmp ecx, 0x100
jl 0x4062c1
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40631d
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x426d70]
xor eax, esi
inc ecx
dec edx
jne 0x4062ff
pop edi
not eax
pop esi
ret 0xc
Function at 0x404fcb
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30c0
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x30c0]
call fcn.00403804
xor edi, edi
push edi
lea eax, [ebp - 0x30c0]
push eax
push dword [ebp + 8]
push edi
call fcn.004065a4
test al, al
je 0x405170
cmp word [ebp - 0x2440], di
je 0x405170
lea eax, [ebp - 0x2440]
push eax
lea eax, [ebp - 0x2cc0]
push eax
call fcn.00407bb0
push eax
call fcn.0040f0c3
test eax, eax
je 0x405170
lea eax, [ebp - 0x2440]
push eax
push dword [ebp + 8]
call fcn.00407bb0
push eax
call fcn.0040f0c3
test eax, eax
jne 0x405170
mov word [ebp - 0x800], ax
xor ebx, ebx
mov esi, 0x400
cmp word [ebp - 0x800], di
jne 0x4050c1
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push eax
call fcn.0040e873
push ebx
push str.rtmp_d
push esi
lea eax, [ebp - 0x800]
push eax
call fcn.00407bb0
push eax
call fcn.0040b13c
add esp, 0x10
lea eax, [ebp - 0x800]
push eax
push edi
call fcn.00405ce0
test al, al
je 0x4050a9
xor eax, eax
mov word [ebp - 0x800], ax
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40505a
cmp word [ebp - 0x800], di
je 0x405170
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040e873
lea eax, [ebp - 0x2cc0]
push eax
call fcn.00407bb0
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00407bb0
push eax
call fcn.0040af28
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x405170
lea ecx, [ebp - 0x1c20]
call fcn.004053dc
push dword [ebp + 8]
xor bl, bl
push edi
call fcn.00405ce0
test al, al
jne 0x405137
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x1c20]
push edi
call fcn.00405729
mov bl, al
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x405161
lea ecx, [ebp - 0x1c20]
call fcn.00405447
lea ecx, [ebp - 0x1c20]
call fcn.004054cc
lea ecx, [ebp - 0x1c20]
call fcn.004055c1
mov al, 1
jmp 0x405172
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4055e4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x4055fe
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x405611
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x405624
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.0040740d
test eax, eax
je 0x40565d
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40565d
cmp word [eax], bx
je 0x40565d
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x405671
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40568d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40568d
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x4056ef
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x4056bb
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.0040af28
jmp 0x4056c4
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x4056d7
push dword [ebp + 8]
push eax
call fcn.0040adbd
jmp 0x4056e5
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.0040eeb0
push dword [esi + 4]
mov ecx, esi
call fcn.00405420
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x405826
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x40584c
cmp dword [ebp + 0xc], esi
jbe 0x405841
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40589c
mov ecx, edi
call fcn.0040559e
test al, al
je 0x405882
cmp dword [ebp + 0xc], esi
jbe 0x405882
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.00405826
jmp 0x40589f
cmp dword [edi + 0xc], 1
jne 0x405897
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x405897
xor eax, eax
jmp 0x40589f
or eax, 0xffffffff
jmp 0x40589f
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x4072bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
push edi
jne 0x4072df
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov byte [esi + 0x14], 1
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0xc]
mov byte [esi + 0x15], 0
call ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.00407255
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call edi
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x407335
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
push dword [esi]
push 0
push dword [ebp + 0xc]
call edi
mov ecx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
xor edi, edi
push eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
dec ecx
dec ecx
push ecx
push dword [ebp - 0xc]
inc eax
push eax
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp eax, edi
je 0x407380
push 5
push eax
call ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [esi + 0x15], 0
je 0x407395
cmp dword [esi + 0x18], 0x64
jbe 0x407406
mov ecx, esi
call fcn.00406c4c
jmp 0x407406
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4073a6
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 4], edi
push 5
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0x10]
call fcn.0040aefe
imul eax, eax, 0xc
add eax, 0x200
push eax
call fcn.0040ab32
push dword [ebp + 0x10]
mov ebx, eax
push ebx
call fcn.0040af28
push ebx
mov ecx, esi
call fcn.00406b18
test al, al
jne 0x4073e2
push ebx
mov ecx, esi
call fcn.00406b4e
push ebx
mov ecx, esi
call fcn.00406f4d
push ebx
mov esi, eax
call fcn.0040ab4b
cmp esi, edi
je 0x407406
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.0040ab4b
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a046
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
call fcn.00409f63
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov byte [ebp - 1], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
sub edi, dword [ebp - 0x24]
sub esi, eax
sub esi, dword [ebp - 0x20]
inc edi
inc esi
cmp byte [ebp - 1], 0
je 0x40a0d3
cmp byte [ebp + 0x10], 0
jne 0x40a118
imul eax, dword [ebp - 8]
push 0x206
cdq
push 0x64
pop ecx
idiv ecx
add eax, esi
push eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
add eax, edi
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [ebp + 0x10], 0
jne 0x40a118
push 0x400
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
push 0x400
lea eax, [ebp - 0x844]
push eax
push eax
call fcn.00409e1e
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 8
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 5
push dword [ebp + 8]
sub esi, eax
call dword [sym.imp.USER32.dll_GetWindow]
and dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x40a214
cmp dword [ebp + 8], 0x200
jge 0x40a21c
push 0x400
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x844], 0
je 0x40a192
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
push 0x400
lea eax, [ebp - 0x844]
push eax
push eax
call fcn.00409e1e
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [ebp - 1], 0
je 0x40a1fe
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call ebx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 0x204
inc eax
imul eax, dword [ebp - 8]
cdq
push 0x64
pop ecx
idiv ecx
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
inc eax
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
push eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x20]
sub eax, esi
imul eax, dword [ebp - 8]
cdq
idiv ecx
push eax
mov eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x34]
sar ecx, 1
sub eax, ecx
sub eax, dword [ebp - 0x24]
push 0x64
imul eax, dword [ebp - 0xc]
pop ecx
cdq
idiv ecx
push eax
push 0
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp + 0x10], eax
cmp eax, dword [ebp - 0x14]
je 0x40a21c
inc dword [ebp + 8]
test eax, eax
jne 0x40a13c
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a2e8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040abfc
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x40a3f6
cmp ebx, edx
jge 0x40a33d
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x40a33f
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a322
cmp ecx, edx
jne 0x40a347
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x40a30e
cmp eax, 0xa
jg 0x40a3f6
mov dword [ebp - 4], 0x41aeb0
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x41afd0]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x41afd0]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x41afd0]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x41afd0]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x40a3a2
add eax, edx
dec edi
jne 0x40a3a0
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x40a3f6
cmp ebx, edx
jge 0x40a3df
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x40a3e1
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a3c3
cmp ecx, edx
jne 0x40a3e8
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x40a3b5
cmp dword [ebp + 8], 0xa
jle 0x40a35b
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a3fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x417eb0]
xor dl, byte [eax + ebx*4 + 0x4186b0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x418ab0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4182b0]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x40a425
inc eax
cmp eax, edi
jl 0x40a418
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040abfc
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x40a416
pop edi
pop esi
pop ebx
leave
ret