joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bfe5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
xor esi, esi
push edi
push esi
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call sub.gdiplus.dll_GdiplusStartup
push dword [ebp + 0x10]
movzx eax, word [ebp + 0xc]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
cmp edi, esi
je 0x40c0f8
push ebx
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
cmp ebx, esi
je 0x40c0f7
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
cmp edi, esi
je 0x40c0f7
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x40c0f7
push ebx
push edi
push eax
call fcn.0040d3d0
add esp, 0xc
lea eax, [ebp + 0xc]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp + 0xc], esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x40c0f7
mov ebx, dword [ebp + 0xc]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov edi, eax
cmp edi, esi
je 0x40c0c2
lea eax, [ebp - 8]
push eax
push ebx
mov dword [edi], vtable.Gdiplus::Bitmap.0
mov dword [ebp - 8], esi
call sub.gdiplus.dll_GdipCreateBitmapFromStream
mov dword [edi + 8], eax
mov eax, dword [ebp - 8]
mov dword [edi + 4], eax
jmp 0x40c0c4
xor edi, edi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp edi, esi
je 0x40c0f7
mov eax, dword [edi + 8]
mov dword [edi + 8], esi
cmp eax, esi
jne 0x40c0ef
push esi
lea eax, [ebp - 0x10]
push eax
push dword [edi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
cmp eax, esi
je 0x40c0ef
mov dword [edi + 8], eax
mov eax, dword [edi]
push 1
mov ecx, edi
call dword [eax]
pop ebx
push dword [ebp - 0xc]
call sub.gdiplus.dll_GdiplusShutdown
cmp dword [ebp - 4], esi
pop edi
pop esi
je 0x40c110
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 0x10]
leave
ret
Function at 0x40c194
Capabilities:
Check if file exists
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40c1ab
xor al, al
leave
ret
push esi
push edi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x40c226
push ebx
push esi
mov byte [ebp - 1], 0
call fcn.0040f0f3
mov ebx, eax
pop ecx
cmp ebx, edi
je 0x40c218
push ebx
push esi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40c218
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0x4269a0
push ebx
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40c218
mov esi, dword [ebp - 8]
push 0xd
pop ecx
lea edi, [ebp - 0x44]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x44], 0xfeef04bd
sete byte [ebp - 1]
push ebx
call fcn.0040d8c4
cmp byte [ebp - 1], 0
pop ecx
pop ebx
jne 0x40c22a
xor al, al
jmp 0x40c254
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp + 0xc]
shr eax, 0x10
mov dword [ecx], eax
movzx eax, word [ebp - 0x3c]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp + 0x14]
shr eax, 0x10
mov dword [ecx], eax
movzx eax, word [ebp - 0x38]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x40c258
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
mov eax, dword [0x42b268]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
push 0x24c
lea eax, [ebp - 0x668]
push edi
push eax
mov dword [ebp - 0x670], esi
mov dword [ebp - 0x66c], edi
call fcn.0040de60
add esp, 0xc
xor eax, eax
mov ebx, 0x206
push ebx
mov word [ebp - 0x41c], ax
lea eax, [ebp - 0x41a]
push edi
push eax
call fcn.0040de60
add esp, 0xc
push 0x426adc
push esi
mov edi, 0x426098
push edi
mov esi, 0x103
lea eax, [ebp - 0x41c]
push esi
push eax
call fcn.0040f1bd
add esp, 0x14
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x674], eax
cmp eax, 0xffffffff
jne 0x40c2fa
xor eax, eax
jmp 0x40c418
mov ecx, 0x426874
lea eax, [ebp - 0x640]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c32b
test dx, dx
je 0x40c327
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c32b
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c305
xor eax, eax
jmp 0x40c330
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c3d7
mov ecx, 0x426878
lea eax, [ebp - 0x640]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c369
test dx, dx
je 0x40c365
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c369
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c343
xor eax, eax
jmp 0x40c36e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c3d7
xor eax, eax
push ebx
push eax
mov word [ebp - 0x214], ax
lea eax, [ebp - 0x212]
push eax
call fcn.0040de60
add esp, 0xc
test byte [ebp - 0x66c], 0x10
lea eax, [ebp - 0x640]
push eax
push dword [ebp - 0x670]
lea eax, [ebp - 0x214]
push edi
push esi
push eax
je 0x40c3c2
call fcn.0040f1bd
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call fcn.0040c258
pop ecx
jmp 0x40c3d7
call fcn.0040f1bd
add esp, 0x14
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x66c]
push eax
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40c2fa
push dword [ebp - 0x674]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x670]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d325
leave
ret
Function at 0x40c427
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x87c
mov eax, dword [0x42b268]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x24c
lea eax, [ebp - 0x86c]
mov esi, ecx
push ebx
push eax
mov dword [ebp - 0x874], esi
mov dword [ebp - 0x870], ebx
call fcn.0040de60
add esp, 0xc
xor eax, eax
mov edi, 0x206
push edi
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push ebx
push eax
call fcn.0040de60
add esp, 0xc
push 0x426adc
push esi
mov ebx, 0x426098
push ebx
mov esi, 0x103
lea eax, [ebp - 0x620]
push esi
push eax
call fcn.0040f1bd
add esp, 0x14
lea eax, [ebp - 0x870]
push eax
lea eax, [ebp - 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x878], eax
cmp eax, 0xffffffff
jne 0x40c4c8
xor eax, eax
jmp 0x40c678
mov ecx, 0x426874
lea eax, [ebp - 0x844]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c4f9
test dx, dx
je 0x40c4f5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c4f9
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c4d3
xor eax, eax
jmp 0x40c4fe
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c637
mov ecx, 0x426878
lea eax, [ebp - 0x844]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40c537
test dx, dx
je 0x40c533
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40c537
add eax, 4
add ecx, 4
test dx, dx
jne 0x40c511
xor eax, eax
jmp 0x40c53c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c637
xor eax, eax
test byte [ebp - 0x870], 0x10
push edi
push eax
je 0x40c597
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0040de60
add esp, 0xc
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x874]
lea eax, [ebp - 0x210]
push ebx
push esi
push eax
call fcn.0040f1bd
add esp, 0x14
lea eax, [ebp - 0x210]
push eax
call fcn.0040c258
pop ecx
jmp 0x40c637
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push eax
call fcn.0040de60
add esp, 0xc
lea eax, [ebp - 0x844]
push eax
push dword [ebp - 0x874]
lea eax, [ebp - 0x418]
push ebx
push esi
push eax
call fcn.0040f1bd
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40c637
push edi
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.0040de60
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
push 0x426b5c
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0040f1bd
add esp, 0x10
push 1
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 4
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [ebp - 0x870]
push eax
push dword [ebp - 0x878]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40c4c8
push dword [ebp - 0x878]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x20
push dword [ebp - 0x874]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push dword [ebp - 0x874]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d325
leave
ret
Function at 0x40c81a
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x42d720], 0
push esi
jne 0x40c78d
call fcn.0040c6b3
test eax, eax
je 0x40c7d0
mov eax, dword [0x42d720]
cmp eax, 1
jne 0x40c7ae
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40c7d0
pop esi
ret
push eax
call dword [0x42d728]
test eax, eax
jne 0x40c818
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40c7d4
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x42d720]
call dword [0x42d728]
mov edi, eax
test edi, edi
je 0x40c7f9
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40c815
mov edi, esi
add esi, 0xff0
push edi
push dword [0x42d720]
call dword [0x42d724]
add edi, 0x10
cmp edi, esi
jb 0x40c801
mov eax, edi
pop edi
pop esi
ret
jmp 0x40c77a

Function at 0x40d325
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b268]
jne 0x40d32f
repz ret
jmp fcn.004125a5

Function at 0x41ca2f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413792
and dword [ebp - 4], 0
cmp dword [0x42e4a8], 0
mov ebx, eax
jne 0x41cae0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41cb91
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41cb91
push eax
call fcn.00413720
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x42e4a8], eax
call esi
push eax
call fcn.00413720
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x42e4ac], eax
call esi
push eax
call fcn.00413720
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42e4b0], eax
call esi
push eax
call fcn.00413720
pop ecx
mov dword [0x42e4b8], eax
test eax, eax
je 0x41cae0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413720
pop ecx
mov dword [0x42e4b4], eax
mov eax, dword [0x42e4b4]
cmp eax, ebx
je 0x41cb38
cmp dword [0x42e4b8], ebx
je 0x41cb38
push eax
call fcn.0041379b
push dword [0x42e4b8]
mov esi, eax
call fcn.0041379b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41cb38
test edi, edi
je 0x41cb38
call esi
test eax, eax
je 0x41cb2f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41cb2f
test byte [ebp - 0xc], 1
jne 0x41cb38
or dword [ebp + 0x10], 0x200000
jmp 0x41cb71
mov eax, dword [0x42e4ac]
cmp eax, ebx
je 0x41cb71
push eax
call fcn.0041379b
pop ecx
test eax, eax
je 0x41cb71
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41cb71
mov eax, dword [0x42e4b0]
cmp eax, ebx
je 0x41cb71
push eax
call fcn.0041379b
pop ecx
test eax, eax
je 0x41cb71
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x42e4a8]
call fcn.0041379b
pop ecx
test eax, eax
je 0x41cb91
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41cb93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40178f
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4100d4], 0
jne 0x40179d
call fcn.00401765
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x4017ca
test cl, 7
je 0x4017ca
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4100d0]
dec esi
inc ecx
jmp 0x4017ab
cmp esi, 8
jb 0x40184e
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4100d0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4100d0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4100d0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4100d0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4100d0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4100d0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4100d0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4100d0]
dec edi
jne 0x4017d4
xor edx, edx
test esi, esi
jbe 0x40186e
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4100d0]
inc edx
cmp edx, esi
jb 0x401855
pop ebx
pop edi
pop esi
ret 0xc

Function at 0x40191c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.004012c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4019ae
push esi
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407441
lea eax, [ebp - 0x800]
push eax
call fcn.004099da
mov esi, eax
lea eax, [ebp - 0x800]
push eax
call fcn.004078d7
test al, al
jne 0x40198a
lea eax, [ebp - 0x1000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.004099da
lea esi, [esi + eax + 1]
mov eax, 0x104
pop edi
cmp esi, eax
pop esi
jbe 0x4019ae
push eax
push 0xaf
call fcn.00409469
push eax
push 0x40e2b0
call fcn.0040a7dd
add esp, 0xc
leave
ret 8
Function at 0x403704
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x40371e
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x403731
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x403744
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.00406daf
test eax, eax
je 0x40377d
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40377d
cmp word [eax], bx
je 0x40377d
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x403791
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4037ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x4037ad
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x403825
mov dword [esi + 4], edi
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x4037e6
push edi
call fcn.004099da
lea eax, [eax + eax + 2]
push eax
push edi
lea eax, [esi + 0x418]
push eax
call fcn.0040975b
jmp 0x4037ef
xor eax, eax
mov word [esi + 0x418], ax
cmp dword [ebp + 8], ebx
je 0x40380c
push dword [ebp + 8]
call fcn.004097a6
inc eax
push eax
push dword [ebp + 8]
lea eax, [esi + 0x17]
push eax
call fcn.0040975b
jmp 0x40381b
push 0x1000000
lea eax, [esi + 0x17]
push eax
push edi
call fcn.0040d70e
push dword [esi + 4]
mov ecx, esi
call fcn.00403553
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x4038f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x403916
cmp dword [ebp + 0xc], esi
jbe 0x40390b
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x403966
mov ecx, edi
call fcn.004036be
test al, al
je 0x40394c
cmp dword [ebp + 0xc], esi
jbe 0x40394c
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004038f0
jmp 0x403969
cmp dword [edi + 0xc], 1
jne 0x403961
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x403961
xor eax, eax
jmp 0x403969
or eax, 0xffffffff
jmp 0x403969
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x403ba2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00406daf
test eax, eax
je 0x403bcc
mov eax, dword [esp + 8]
test eax, eax
je 0x403bcc
cmp word [eax], 0
je 0x403bcc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x403be9
cmp dword [esp + 4], 0
je 0x403be7
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x403be7
xor eax, eax
inc eax
jmp 0x403be9
xor eax, eax
ret 8

Function at 0x403c48
Capabilities:
Get file attributes

Disassembly:
call fcn.00406daf
test eax, eax
je 0x403c68
mov eax, dword [esp + 8]
test eax, eax
je 0x403c68
cmp word [eax], 0
je 0x403c68
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x403c72
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x403c75
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.00406daf
test eax, eax
je 0x403c9a
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x403c9a
cmp word [eax], 0
je 0x403c9a
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x403cac
cmp dword [ebp + 8], 0
je 0x403cb3
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
jmp 0x403cb5
xor al, al
pop ebp
ret 0xc

Function at 0x403e23
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.00406daf
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test eax, eax
je 0x403e49
cmp esi, ebx
je 0x403e49
cmp word [esi], bx
je 0x403e49
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x403e58
cmp dword [ebp + 8], ebx
je 0x403e86
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
je 0x403e71
cmp byte [ebp + 0x10], bl
je 0x403e6d
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.00403c75
xor eax, eax
jmp 0x403e89
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x403e86
cmp eax, 3
je 0x403e86
xor eax, eax
inc eax
jmp 0x403e89
push 2
pop eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x405302
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
test eax, eax
jl 0x405334
cmp dword [ebp - 4], edi
jne 0x405375
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x2710
ja 0x405375
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x405321
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x405321
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
mov esi, eax
cmp esi, edi
jl 0x4053cb
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x40ec00
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x4053c2
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, edi
jl 0x4053b9
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
cmp esi, edi
pop edi
pop esi
setge al
pop ebx
leave
ret 8
Function at 0x4059ee
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x18]
sub esp, 0x10
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
mov esi, ecx
mov byte [esi + 0x21], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
mov ecx, esi
call fcn.00405987
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x405a55
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push esi
push dword [esi]
sub edi, eax
push 0
push dword [ebp + 0xc]
lea ecx, [eax + 1]
dec edi
mov dword [ebp + 0x18], ecx
dec edi
call ebx
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
push edi
push dword [ebp - 0xc]
push dword [ebp + 0x18]
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
test eax, eax
je 0x405aab
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x1c], 0x64
jbe 0x405ab8
mov ecx, esi
call fcn.004054fd
pop edi
pop esi
pop ebx
leave
ret 0x14