joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438090
Capabilities:
Contain obfuscated stackstrings
Open clipboard
Read clipboard data

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x2c
xor eax, eax
mov dword [esp], 0
call dword [sym.imp.USER32.dll_OpenClipboard]
sub esp, 4
xor ebx, ebx
cmp eax, 0
je 0x4381e9
xor eax, eax
mov dword [esp], 0
mov dword [esp + 4], 0
call dword [sym.imp.USER32.dll_GetWindowLongW]
sub esp, 8
mov dword [esp], 1
call dword [sym.imp.USER32.dll_GetClipboardData]
sub esp, 4
mov edi, eax
cmp edi, 0
setne al
jmp 0x4380e8
xor ebx, ebx
test al, 1
jne 0x4380f3
jmp 0x4381e3
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
sub esp, 4
mov esi, eax
mov dword [esp], esi
call fcn.0040cb20
mov ebp, eax
xor ebx, ebx
cmp ebp, 0
je 0x4381d5
mov al, byte [esp + 0x10]
mov byte [esp + 0x14], al
mov byte [esp + 0x18], 0x71
mov byte [esp + 0x19], 0x5f
mov byte [esp + 0x1a], 0x5d
mov byte [esp + 0x1b], 0x59
mov byte [esp + 0x1c], 0x56
mov byte [esp + 0x1d], 0x56
mov byte [esp + 0x1e], 0x59
mov byte [esp + 0x1f], 0x4b
mov byte [esp + 0x20], 0x58
mov byte [esp + 0x21], 0x11
mov byte [esp + 0x22], 0x4e
mov byte [esp + 0x23], 0x49
mov byte [esp + 0x24], 0x4c
mov byte [esp + 0x25], 0xbf
mov eax, 0xe
mov byte [esp + eax + 0x18], 0
add eax, 1
cmp eax, 0x12
jne 0x438169
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
cmp eax, 0x12
jae 0x4381b3
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0xc]
movzx ecx, byte [esp + ecx + 0x18]
mov dword [esp + 4], eax
mov dword [esp], ecx
call fcn.0043c430
mov ecx, dword [esp + 0xc]
mov byte [esp + ecx + 0x18], al
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
jmp 0x43817e
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x40]
mov dword [esp], eax
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
call fcn.0040d6e0
sub esp, 0xc
mov bl, al
and bl, 1
jmp 0x4381d5
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
sub esp, 4
jmp 0x4381e3
call dword [sym.imp.USER32.dll_CloseClipboard]
and bl, 1
movzx eax, bl
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x446a62
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x28
mov ebx, dword [esp + 0x3c]
movzx esi, word [ebx]
mov dword [esp + 4], 0x90aeddf
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x4469e6
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00446f40
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x4469c0
xor ecx, ecx
cmp dword [esp + 4], esi
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x453b1c]
mov esi, dword [ebx + 0x3c]
mov edi, dword [ebx + esi]
mov dword [esp + 4], 0xd7d60418
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x446a46
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.00446fa0
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x446a20
xor ecx, ecx
cmp edi, dword [esp + 4]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x453b24]
mov eax, dword [case.0x446a51.4]
nop
nop
nop
jmp eax
mov edx, dword [ebx + esi + 0x78]
cmp dword [ebx + esi + 0x7c], 0
sete al
test edx, edx
sete cl
or cl, al
movzx ecx, cl
xor eax, eax
jmp dword [ecx*4 + 0x453b3c]
mov eax, dword [ebx + edx + 0x20]
add eax, ebx
mov dword [esp + 0x24], eax
mov eax, dword [ebx + edx + 0x24]
add eax, ebx
mov dword [esp + 0x20], eax
mov eax, dword [ebx + edx + 0x1c]
add eax, ebx
mov dword [esp + 0x1c], eax
mov esi, dword [0x455604]
xor eax, eax
test esi, esi
sete al
mov dword [esp + 0x10], edx
jmp dword [eax*4 + 0x453b44]
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4488d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [esp + 0x38]
movzx edi, word [esi]
mov dword [esp + 4], 0xb9bad5f7
mov dword [esp + 8], 0
mov dword [esp], 0
mov eax, dword [esp]
cmp eax, 7
ja 0x448926
nop
nop
nop
mov eax, dword [esp]
movzx eax, byte [esp + eax + 4]
push dword [esp]
push eax
call fcn.0044a920
add esp, 8
mov ecx, dword [esp]
mov byte [esp + ecx + 4], al
inc dword [esp]
mov eax, dword [esp]
cmp eax, 8
jb 0x448900
xor eax, eax
cmp dword [esp + 4], edi
setne al
jmp dword [eax*4 + 0x454130]
mov edi, dword [esi + 0x3c]
mov ebx, dword [esi + edi]
mov dword [esp], 0xe3e2a450
mov dword [esp + 4], 0
mov eax, dword [esp + 4]
cmp eax, 3
ja 0x448989
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, dword [esp + 4]
movzx eax, byte [esp + eax]
push dword [esp + 4]
push eax
call fcn.0044a970
add esp, 8
mov ecx, dword [esp + 4]
mov byte [esp + ecx], al
inc dword [esp + 4]
mov eax, dword [esp + 4]
cmp eax, 4
jb 0x448960
xor ecx, ecx
cmp ebx, dword [esp]
setne cl
xor eax, eax
jmp dword [ecx*4 + 0x454148]
mov ebx, dword [esi + edi + 0x78]
mov edi, dword [esi + edi + 0x7c]
test edi, edi
sete cl
test ebx, ebx
sete dl
or dl, cl
movzx ecx, dl
jmp dword [ecx*4 + 0x454150]
mov eax, dword [esi + ebx + 0x20]
add eax, esi
mov dword [esp + 0x20], eax
mov eax, dword [esi + ebx + 0x24]
add eax, esi
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], edi
mov eax, dword [esi + ebx + 0x1c]
add eax, esi
mov dword [esp + 0x14], eax
mov eax, dword [0x454174]
mov dword [esp + 0xc], ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp eax
mov ecx, dword [case.0x448993.1]
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
jmp ecx
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
mov esi, 0x43c64a18
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x432060
mov eax, section..tls
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5a862d0a
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x40170c
Capabilities:
Encode data using xor

Disassembly:
push esi
mov ecx, dword [0x406964]
mov esi, dword [esp + 0xc]
mov eax, esi
dec esi
test eax, eax
je 0x40173f
mov edx, dword [esp + 8]
mov al, byte [edx]
inc edx
xor al, cl
movzx eax, al
shr ecx, 8
mov eax, dword [eax*4 + 0x406e50]
xor eax, ecx
mov ecx, eax
mov eax, esi
dec esi
test eax, eax
jne 0x401722
pop esi
mov dword [0x406964], ecx
ret

Function at 0x401cc5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp eax, 0x1f
jbe 0x401ce5
mov eax, 1
jmp 0x401d1d
push dword [ebp + 8]
push eax
push 5
call fcn.0040107b
push eax
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x12c]
push 0
push str.WinZip_Self_Extractor
push ecx
push dword [0x407360]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x401d21
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x401dce
push 0x105
lea eax, [ebp - 0x108]
push eax
push 0x4067e4
push 0x4067e0
push 0xf
call fcn.0040107b
push eax
call dword [sym.imp.KERNEL32.dll_GetProfileStringA]
test eax, eax
je 0x401dce
cmp byte [ebp - 0x108], 0
lea esi, [ebp - 0x108]
je 0x401d7e
cmp byte [esi], 0x20
je 0x401d83
inc esi
cmp byte [esi], 0
jne 0x401d73
cmp byte [esi], 0x20
jne 0x401d86
mov byte [esi], 0
lea eax, [ebp - 0x108]
push eax
call fcn.00401747
push eax
push 0xe
call fcn.0040107b
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x401dce
push 0x406a68
mov byte [esi], 0x20
push str.__s_
inc esi
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
call fcn.00401cc5
add esp, 4
jmp 0x401deb
push 0
push str.WinZip_Self_Extractor
push 0x12
call fcn.0040107b
push eax
push dword [0x407360]
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40240c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 0x10], 0
je 0x40242c
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
cmp dword [ebp + 0xc], 0
je 0x402438
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
test ebx, ebx
je 0x402441
cmp byte [ebx], 0
jne 0x402448
xor eax, eax
jmp 0x4024f9
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x4024a6
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x40247a
cmp dword [ebp - 4], 0
je 0x40247a
cmp dword [ebp - 8], 0
jne 0x40247a
cmp dword [ebp + 0x10], 0
je 0x402475
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov dword [ebp - 8], edx
jmp 0x4024a5
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x402488
cmp ecx, 0xa
jne 0x402490
cmp ecx, 0xd
jne 0x4024ab
inc ebx
jmp 0x4024ab
mov byte [edx], al
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp esi, eax
jle 0x4024a5
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x4024ab
inc esi
cmp byte [ebx], 0
jne 0x402451
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x4024f7
mov edx, dword [ebp - 4]
mov byte [edx], 0
cmp dword [ebp - 8], 0
je 0x4024f7
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov ecx, dword [ebp + 8]
dec ecx
lea edx, [ebp - 0x1008]
mov eax, dword [ebp - 4]
call fcn.0040f7a8
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov byte [edx + ecx - 1], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402778
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffffbe0
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
cmp byte [0x414045], 0
jne 0x402801
mov eax, esp
call fcn.00405c40
mov ecx, 6
mov edx, dword [str.RarSFX]
call fcn.0040f844
test eax, eax
jne 0x402801
push 0x414203
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.0040f718
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x400]
mov ecx, 0x1e
xor edx, edx
call fcn.0040f698
mov dword [esp + 0x404], 3
mov word [esp + 0x410], 0x14
mov eax, esp
mov dword [esp + 0x408], eax
lea edx, [esp + 0x400]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x420
ret

Function at 0x4028ea
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x41405d], 0
je 0x402961
cmp byte [0x415978], 0
je 0x402961
lea edx, [esp + 8]
mov eax, 0x415978
call fcn.004028b9
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x402961
mov eax, ebx
call fcn.0040f718
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x402969
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x41405d], 0
je 0x4029e2
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.004028b9
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4029e2
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4029da
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.0040f798
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x402aa8
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402c10
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x41474c
push 1
push 0
push 0x41475c
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402d0f
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402c73
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x402c85
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.0040f798
lea eax, [ebp - 0x40c]
call fcn.00406060
cmp byte [ebp - 0x40c], 0
je 0x402cb6
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x41477c
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402d06
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402cfd
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402d20
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x402e84
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x4148bc]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x414019], 0
jne 0x402ee0
mov eax, dword [0x415d78]
call fcn.0040435c
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x414099
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x414019], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [esp], 0x3c
mov edx, esp
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
mov byte [esp + 0x19], 0
mov dword [esp + 4], 1
test bl, bl
je 0x402f3a
and dword [esp + 8], 0xbfffffff
or dword [esp + 8], 1
mov dword [esp + 0x14], 0xa0
or dword [esp + 4], 0x40000000
mov ecx, esp
push ecx
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
test bl, bl
je 0x402f8e
or dword [esp + 8], 0x40000000
and dword [esp + 8], 0xfffffffe
mov eax, esp
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push 0x4140c0
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
add esp, 0x3c
pop edi
pop esi
pop ebx
ret
Function at 0x403894
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
mov eax, 0x41a4fc
push ebx
mov ebx, 0x415570
push esi
call fcn.00410068
call sub.KERNEL32.DLL_GetCommandLineA
mov esi, eax
test esi, esi
je 0x4038ce
xor eax, eax
mov al, byte [esi]
cmp eax, 0x22
jne 0x4038ce
lea eax, [esi + 1]
mov edx, 0x22
call fcn.0040f728
mov esi, eax
test esi, esi
je 0x40397e
mov edx, 0x414108
mov eax, esi
call fcn.0040f76c
mov esi, eax
test eax, eax
je 0x4038f1
mov eax, ebx
mov edx, esi
call fcn.0040f798
mov byte [ebp - 1], 0
xor eax, eax
xor esi, esi
jmp 0x40396e
xor ecx, ecx
mov cl, dl
cmp ecx, 0x20
je 0x403908
mov byte [ebp - 1], 1
cmp ecx, 0x22
jne 0x40390e
inc esi
test esi, 1
jne 0x40396d
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x2d
jne 0x40392f
test eax, eax
je 0x403939
xor edx, edx
mov dl, byte [ebx + eax - 1]
cmp edx, 0x20
je 0x403939
xor ecx, ecx
mov cl, byte [ebx + eax]
cmp ecx, 0x2f
jne 0x40396d
xor edx, edx
mov dl, byte [ebx + eax + 1]
cmp edx, 0x73
je 0x403949
cmp edx, 0x53
jne 0x40396d
mov dl, byte [ebx + eax + 2]
test dl, dl
je 0x40395a
xor ecx, ecx
mov cl, dl
cmp ecx, 0x20
jne 0x40396d
mov dword [0x414058], 1
mov byte [0x41405c], 1
jmp 0x403975
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x4038fb
cmp byte [ebp - 1], 0
jne 0x40397e
mov byte [ebx], 0
push 0x400
push 0x415170
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x415170
push str.sfxname
call sub.KERNEL32.DLL_SetEnvironmentVariableA
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
mov dword [0x41a4f4], eax
push 0x64
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x415970], eax
push 0x65
push dword [0x41a4f4]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x415974], eax
lea eax, [ebp - 0xc]
call fcn.00405624
mov edx, 0x415170
mov eax, 0x41a4e0
call fcn.00404c64
lea eax, [ebp - 0x24]
call fcn.004041cc
lea eax, [ebp - 0x3c]
call fcn.004041cc
push 0
push 0x401183
lea edx, [ebp - 0x24]
push 0
mov dword [0x415d78], edx
lea ecx, [ebp - 0x3c]
push str.STARTDLG
push ebx
mov dword [0x415d7c], ecx
call sub.USER32.DLL_DialogBoxParamA
xor eax, eax
mov dword [0x4148bc], eax
xor edx, edx
mov dword [0x415d7c], edx
mov dword [0x415d78], edx
cmp dword [0x4148c4], 0
jne 0x403a51
cmp dword [0x4148d0], 0
jne 0x403a51
mov ecx, 4
mov edx, dword [0x414048]
xor eax, eax
call fcn.004018a8
lea eax, [ebp - 0x3c]
mov edx, 2
call fcn.004041f0
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004041f0
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00405698
cmp byte [0x414044], 0
je 0x403a86
call fcn.00402778
mov eax, 0x4150e0
mov ecx, 0x80
xor edx, edx
call fcn.0040f698
cmp dword [0x414054], 0
jle 0x403aaa
mov eax, dword [0x414048]
call fcn.0040f61c
push dword [0x415970]
call sub.GDI32.DLL_DeleteObject
mov eax, dword [0x415974]
test eax, eax
je 0x403ac4
push eax
call sub.GDI32.DLL_DeleteObject
cmp dword [0x41a4d4], 0
jne 0x403ae5
cmp dword [0x4148c4], 0
je 0x403ae5
mov eax, 0x41a4d4
mov edx, 0xff
call fcn.0040c8dc
mov dword [0x4148c4], 2
push dword [0x41a4d4]
call sub.KERNEL32.DLL_ExitProcess
xor eax, eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403b04
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov dword [0x4148d4], 1
mov ebx, dword [0x4148bc]
test ebx, ebx
je 0x403b2c
mov eax, 0x7d
call fcn.004029f0
push eax
push 1
push ebx
call sub.USER32.DLL_SetDlgItemTextA
xor edx, edx
mov dword [0x4148d8], edx
mov dword [0x4148dc], 1
mov eax, dword [0x4148bc]
test eax, eax
je 0x403b85
push 1
push eax
call sub.USER32.DLL_ShowWindow
cmp dword [0x414054], 0
jne 0x403b7c
cmp byte [0x414019], 0
jne 0x403b7c
push 0
push 1
push 0x111
push dword [0x4148bc]
call sub.USER32.DLL_SendMessageA
jmp 0x403b7c
call fcn.00402a6c
cmp dword [0x4148c4], 2
jne 0x403b77
cmp byte [0x414044], 0
je 0x403b93
call fcn.00402778
pop ebx
ret

Function at 0x404218
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x40423d
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x14], 1
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00404374
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
mov eax, dword [ebx + 4]
test eax, eax
je 0x404283
push eax
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
add ecx, 0xfffffffe
push ecx
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
je 0x4042d4
push 5
push edi
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x404351
mov eax, dword [ebx + 4]
test eax, eax
je 0x4042ec
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp + 8]
call fcn.0040f718
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x100
call fcn.0040f608
mov edi, eax
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.0040f798
mov edx, edi
mov eax, ebx
call fcn.004049b0
test al, al
jne 0x40432d
mov edx, edi
mov eax, ebx
call fcn.004049e8
mov edx, edi
mov eax, ebx
call fcn.00404828
mov ebx, eax
mov eax, edi
call fcn.0040f61c
test ebx, ebx
je 0x404351
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.0040f61c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404568
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x4045ce
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x4045df
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x4045ce
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [esp + 8]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [esp + 8]
push eax
call sub.USER32.DLL_DispatchMessageA
push esp
push esi
mov edx, dword [esi]
call dword [edx + 0x48]
test eax, eax
jl 0x404586
cmp dword [esp], 0
je 0x404586
xor ebx, ebx
cmp dword [esp], 0
je 0x404629
lea eax, [esp + 4]
push eax
push 0x41478c
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x404629
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x40461f
push edi
mov ecx, dword [esp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret