joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f5c20
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10119045
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101a8540]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov edi, dword [ebp + 8]
mov edx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x100f5c57
mov edx, dword [edi]
xor ecx, ecx
mov esi, 0x811c9dc5
cmp dword [edi + 0x10], ecx
jbe 0x100f5c75
movzx eax, byte [edx + ecx]
inc ecx
xor eax, esi
imul esi, eax, 0x1000193
cmp ecx, dword [edi + 0x10]
jb 0x100f5c63
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10033e30
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x100f5d45
cmp dword [ebx + 8], 0x6666666
je 0x100f5d5c
lea eax, [ebx + 4]
mov dword [ebp - 0x1c], eax
push 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
call fcn.101118c3
mov ecx, eax
add esp, 4
mov dword [ebp - 0x18], ecx
push edi
lea edi, [ecx + 8]
mov ecx, edi
call fcn.100344f0
xorps xmm0, xmm0
movq qword [edi + 0x18], xmm0
mov dword [edi + 0x1c], 0
mov eax, dword [ebx + 8]
inc eax
mov dword [ebp - 4], 1
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1011dc60]
mov eax, dword [ebx + 0x1c]
cvtpd2ps xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
shr eax, 0x1f
addsd xmm0, qword [eax*8 + 0x1011dc60]
cvtpd2ps xmm0, xmm0
divss xmm1, xmm0
comiss xmm1, dword [ebx]
jbe 0x100f5d36
mov ecx, ebx
call fcn.100f6150
push esi
push edi
lea eax, [ebp - 0x14]
mov ecx, ebx
push eax
call fcn.10033e30
mov ecx, dword [eax]
jmp 0x100f5d39
mov ecx, dword [ebp - 0x14]
push dword [ebp - 0x18]
push ecx
push esi
mov ecx, ebx
call fcn.100f60f0
add eax, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.unordered_map_set_too_long
call fcn.10112f42
int3

Function at 0x10109830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 8]
push ebx
movzx eax, ax
push esi
mov esi, eax
mov dword [ebp - 4], eax
push edi
shr esi, 8
xor eax, eax
xor edi, edi
mov dword [ebp - 8], esi
cmp dword [ebp + 0x10], eax
jbe 0x10109890
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
movzx ecx, word [ecx + edi*2]
mov edx, ecx
movzx ecx, cl
shr edx, 8
add edx, eax
cmp esi, ecx
jb 0x10109890
jne 0x10109888
cmp eax, edx
jge 0x10109888
mov ecx, dword [ebp + 8]
movzx esi, cl
movzx ecx, byte [eax + ebx]
cmp cx, si
je 0x101098b8
inc eax
cmp eax, edx
jl 0x10109877
mov esi, dword [ebp - 8]
inc edi
mov eax, edx
cmp edi, dword [ebp + 0x10]
jb 0x10109856
mov edi, dword [ebp + 0x1c]
xor eax, eax
mov bl, 1
test edi, edi
je 0x101098d0
mov esi, dword [ebp + 0x18]
nop
movzx ecx, byte [eax + esi]
test cl, cl
jns 0x101098c1
movzx edx, byte [eax + esi + 1]
inc eax
and ecx, 0x7f
shl ecx, 8
or edx, ecx
jmp 0x101098c3
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, ecx
sub dword [ebp - 4], edx
js 0x101098d0
inc eax
xor bl, 1
cmp eax, edi
jb 0x101098a0
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10111901
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x10111936
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x10111933
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x1011193f
add edx, 0x28
cmp edx, esi
jne 0x10111921
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x1011193c

Function at 0x101e4c5d
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10693e73
jmp 0x105cc71e
push esp
push dword [esp]
pop ebp
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
jmp 0x105cc7fa
jmp 0x107085f8
jmp 0x10693ecb
push edi
push esp
pop edi
add edi, 4
push esi
mov esi, 4
sub edi, esi
pop esi
push edi
push dword [esp + 4]
pop edi
pop dword [esp]
jmp 0x10693eeb
pop esp
mov dword [esp], ebp
jmp 0x10693fa1
jmp 0x105cc6b8
jmp fcn.10696b21
jmp 0x107086ac
mov esp, dword [esp]
jmp 0x10708720
push ebx
push esp
pop ebx
push eax
push 4
pop eax
add ebx, eax
pop eax
sub ebx, 0x14
xchg dword [esp], ebx
jmp 0x10708656
jmp 0x10696ac8

Function at 0x105cc723
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x10693e73
jmp 0x105cc71e
push esp
push dword [esp]
pop ebp
push ebp
mov ebp, esp
add ebp, 4
add ebp, 4
xor ebp, dword [esp]
xor dword [esp], ebp
xor ebp, dword [esp]
pop esp
jmp 0x105cc7fa
jmp 0x107085f8
jmp 0x10693ecb
push edi
push esp
pop edi
add edi, 4
push esi
mov esi, 4
sub edi, esi
pop esi
push edi
push dword [esp + 4]
pop edi
pop dword [esp]
jmp 0x10693eeb
pop esp
mov dword [esp], ebp
jmp 0x10693fa1
jmp 0x105cc6b8
jmp fcn.10696b21
jmp 0x107086ac
mov esp, dword [esp]
jmp 0x10708720
push ebx
push esp
pop ebx
push eax
push 4
pop eax
add ebx, eax
pop eax
sub ebx, 0x14
xchg dword [esp], ebx
jmp 0x10708656
jmp 0x10696ac8
Function at 0x402e4a
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4151c4], 0
jne 0x402e58
call fcn.00402e20
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402e85
test cl, 7
je 0x402e85
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec esi
inc ecx
jmp 0x402e66
cmp esi, 8
jb 0x402f09
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4151c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec edi
jne 0x402e8f
xor edx, edx
test esi, esi
jbe 0x402f29
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4151c0]
inc edx
cmp edx, esi
jb 0x402f10
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x404ff2
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30c0
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x30c0]
call fcn.00403848
xor edi, edi
push edi
lea eax, [ebp - 0x30c0]
push eax
push dword [ebp + 8]
push edi
call fcn.004065a5
test al, al
je 0x405197
cmp word [ebp - 0x2440], di
je 0x405197
lea eax, [ebp - 0x2440]
push eax
lea eax, [ebp - 0x2cc0]
push eax
call fcn.00407baf
push eax
call fcn.0040f111
test eax, eax
je 0x405197
lea eax, [ebp - 0x2440]
push eax
push dword [ebp + 8]
call fcn.00407baf
push eax
call fcn.0040f111
test eax, eax
jne 0x405197
mov word [ebp - 0x800], ax
xor ebx, ebx
mov esi, 0x400
cmp word [ebp - 0x800], di
jne 0x4050e8
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push eax
call fcn.0040e905
push ebx
push str.rtmp_d
push esi
lea eax, [ebp - 0x800]
push eax
call fcn.00407baf
push eax
call fcn.0040b120
add esp, 0x10
lea eax, [ebp - 0x800]
push eax
push edi
call fcn.00405ce1
test al, al
je 0x4050d0
xor eax, eax
mov word [ebp - 0x800], ax
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x405081
cmp word [ebp - 0x800], di
je 0x405197
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040e905
lea eax, [ebp - 0x2cc0]
push eax
call fcn.00407baf
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00407baf
push eax
call fcn.0040af0c
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x405197
lea ecx, [ebp - 0x1c20]
call fcn.00405403
push dword [ebp + 8]
xor bl, bl
push edi
call fcn.00405ce1
test al, al
jne 0x40515e
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x1c20]
push edi
call fcn.0040572a
mov bl, al
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x405188
lea ecx, [ebp - 0x1c20]
call fcn.0040546e
lea ecx, [ebp - 0x1c20]
call fcn.004054f3
lea ecx, [ebp - 0x1c20]
call fcn.004055c2
mov al, 1
jmp 0x405199
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4055e5
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x4055ff
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x405612
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x405625
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.0040740e
test eax, eax
je 0x40565e
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40565e
cmp word [eax], bx
je 0x40565e
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x405672
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40568e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40568e
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x4056f0
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x4056bc
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.0040af0c
jmp 0x4056c5
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x4056d8
push dword [ebp + 8]
push eax
call fcn.0040ada1
jmp 0x4056e6
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.0040eefe
push dword [esi + 4]
mov ecx, esi
call fcn.00405447
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x405827
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x40584d
cmp dword [ebp + 0xc], esi
jbe 0x405842
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40589d
mov ecx, edi
call fcn.0040559f
test al, al
je 0x405883
cmp dword [ebp + 0xc], esi
jbe 0x405883
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.00405827
jmp 0x4058a0
cmp dword [edi + 0xc], 1
jne 0x405898
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x405898
xor eax, eax
jmp 0x4058a0
or eax, 0xffffffff
jmp 0x4058a0
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x405ae1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x405bf1
mov eax, dword [esi + 0xc]
test eax, eax
je 0x405b0e
dec eax
je 0x405b03
dec eax
jne 0x405b0e
push 0xfffffffffffffff4
jmp 0x405b05
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x405b5d
cmp dword [ebp + 0xc], edi
jbe 0x405b78
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x405b35
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x405b78
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x405b25
jmp 0x405b74
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x405beb
cmp byte [esi + 0x14], 0
je 0x405beb
cmp dword [esi + 0xc], 0
jne 0x405beb
push 0
lea eax, [esi + 0x418]
push eax
lea eax, [esi + 0x17]
mov edi, 0x415e7c
push eax
mov ecx, edi
call fcn.004034d6
test al, al
je 0x405bd5
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x405b16
test eax, eax
jbe 0x405b16
push 0
mov ecx, esi
call fcn.00405523
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.00405a42
jmp 0x405b16
lea eax, [esi + 0x418]
push eax
lea eax, [esi + 0x17]
push eax
push 0
push 0
mov ecx, edi
call fcn.0040374f
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x405ce1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0040740e
test eax, eax
je 0x405d0b
mov eax, dword [esp + 8]
test eax, eax
je 0x405d0b
cmp word [eax], 0
je 0x405d0b
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x405d28
cmp dword [esp + 4], 0
je 0x405d26
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405d26
xor eax, eax
inc eax
jmp 0x405d28
xor eax, eax
ret 8

Function at 0x405d56
Capabilities:
Get file attributes

Disassembly:
call fcn.0040740e
test eax, eax
je 0x405d76
mov eax, dword [esp + 8]
test eax, eax
je 0x405d76
cmp word [eax], 0
je 0x405d76
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x405d80
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x405d83
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.0040740e
test eax, eax
je 0x405da8
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405da8
cmp word [eax], 0
je 0x405da8
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x405dba
cmp dword [ebp + 8], 0
je 0x405dc1
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
jmp 0x405dc3
xor al, al
pop ebp
ret 0xc
Function at 0x405df9
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.0040740e
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test eax, eax
je 0x405e1f
cmp esi, ebx
je 0x405e1f
cmp word [esi], bx
je 0x405e1f
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x405e2e
cmp dword [ebp + 8], ebx
je 0x405e5c
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
je 0x405e47
cmp byte [ebp + 0x10], bl
je 0x405e43
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.00405d83
xor eax, eax
jmp 0x405e5f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405e5c
cmp eax, 3
je 0x405e5c
xor eax, eax
inc eax
jmp 0x405e5f
push 2
pop eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x406a5d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi]
lea ecx, [ebp - 8]
push ecx
push edi
call dword [eax + 0x48]
test eax, eax
jl 0x406a8f
cmp dword [ebp - 8], ebx
jne 0x406ad0
call esi
sub eax, dword [ebp - 0xc]
cmp eax, 0x2710
ja 0x406ad0
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x406a7c
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x406a7c
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x406b10
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x413b9c
push eax
call dword [ecx]
test eax, eax
jl 0x406b10
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x406b07
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
setge bl
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8
Function at 0x4072bd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
push edi
jne 0x4072e0
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov byte [esi + 0x14], 1
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0xc]
mov byte [esi + 0x15], 0
call ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.00407256
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call edi
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x407336
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
push dword [esi]
push 0
push dword [ebp + 0xc]
call edi
mov ecx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
xor edi, edi
push eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
dec ecx
dec ecx
push ecx
push dword [ebp - 0xc]
inc eax
push eax
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp eax, edi
je 0x407381
push 5
push eax
call ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [esi + 0x15], 0
je 0x407396
cmp dword [esi + 0x18], 0x64
jbe 0x407407
mov ecx, esi
call fcn.00406c4d
jmp 0x407407
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4073a7
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 4], edi
push 5
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0x10]
call fcn.0040aee2
imul eax, eax, 0xc
add eax, 0x200
push eax
call fcn.0040ab16
push dword [ebp + 0x10]
mov ebx, eax
push ebx
call fcn.0040af0c
push ebx
mov ecx, esi
call fcn.00406b19
test al, al
jne 0x4073e3
push ebx
mov ecx, esi
call fcn.00406b4f
push ebx
mov ecx, esi
call fcn.00406f4e
push ebx
mov esi, eax
call fcn.0040ab2f
cmp esi, edi
je 0x407407
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.0040ab2f
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a02a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
call fcn.00409f47
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov byte [ebp - 1], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
sub edi, dword [ebp - 0x24]
sub esi, eax
sub esi, dword [ebp - 0x20]
inc edi
inc esi
cmp byte [ebp - 1], 0
je 0x40a0b7
cmp byte [ebp + 0x10], 0
jne 0x40a0fc
imul eax, dword [ebp - 8]
push 0x206
cdq
push 0x64
pop ecx
idiv ecx
add eax, esi
push eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
add eax, edi
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [ebp + 0x10], 0
jne 0x40a0fc
push 0x400
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
push 0x400
lea eax, [ebp - 0x844]
push eax
push eax
call fcn.00409e02
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 8
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 5
push dword [ebp + 8]
sub esi, eax
call dword [sym.imp.USER32.dll_GetWindow]
and dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x40a1f8
cmp dword [ebp + 8], 0x200
jge 0x40a200
push 0x400
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x844], 0
je 0x40a176
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
push 0x400
lea eax, [ebp - 0x844]
push eax
push eax
call fcn.00409e02
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [ebp - 1], 0
je 0x40a1e2
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call ebx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 0x204
inc eax
imul eax, dword [ebp - 8]
cdq
push 0x64
pop ecx
idiv ecx
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
inc eax
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
push eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x20]
sub eax, esi
imul eax, dword [ebp - 8]
cdq
idiv ecx
push eax
mov eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x34]
sar ecx, 1
sub eax, ecx
sub eax, dword [ebp - 0x24]
push 0x64
imul eax, dword [ebp - 0xc]
pop ecx
cdq
idiv ecx
push eax
push 0
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp + 0x10], eax
cmp eax, dword [ebp - 0x14]
je 0x40a200
inc dword [ebp + 8]
test eax, eax
jne 0x40a120
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a2cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
push 0x20
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 8], ecx
call fcn.0040abe0
xor eax, eax
push 4
xor ecx, ecx
mov dword [ebp + 8], eax
xor ebx, ebx
pop edx
cmp eax, 0xa
jg 0x40a3da
cmp ebx, edx
jge 0x40a321
lea esi, [ebp + ebx*4 - 0x28]
mov dword [ebp - 4], esi
cmp ecx, edx
jge 0x40a323
mov edi, dword [ebp - 8]
lea esi, [ecx + eax*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, dword [ebp - 4]
add dword [ebp - 4], edx
inc ebx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a306
cmp ecx, edx
jne 0x40a32b
inc eax
mov dword [ebp + 8], eax
xor ecx, ecx
cmp ebx, edx
jl 0x40a2f2
cmp eax, 0xa
jg 0x40a3da
mov dword [ebp - 4], 0x41aeb0
movzx esi, byte [ebp - 0x1b]
mov al, byte [ebp - 0x28]
xor al, byte [esi + 0x41afd0]
movzx esi, byte [ebp - 0x1a]
mov bl, byte [esi + 0x41afd0]
movzx esi, byte [ebp - 0x19]
xor byte [ebp - 0x27], bl
mov bl, byte [esi + 0x41afd0]
movzx esi, byte [ebp - 0x1c]
xor byte [ebp - 0x26], bl
mov bl, byte [esi + 0x41afd0]
mov esi, dword [ebp - 4]
xor al, byte [esi]
xor byte [ebp - 0x25], bl
inc dword [ebp - 4]
push 3
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x24]
pop edi
xor esi, esi
mov bl, byte [eax + esi - 4]
xor byte [eax + esi], bl
inc esi
cmp esi, edx
jl 0x40a386
add eax, edx
dec edi
jne 0x40a384
xor ebx, ebx
cmp dword [ebp + 8], 0xa
jg 0x40a3da
cmp ebx, edx
jge 0x40a3c3
lea eax, [ebp + ebx*4 - 0x28]
cmp ecx, edx
jge 0x40a3c5
mov esi, dword [ebp + 8]
mov edi, dword [ebp - 8]
lea esi, [ecx + esi*4]
lea edi, [edi + esi*4 + 0x14]
mov esi, eax
inc ebx
add eax, edx
inc ecx
cmp ebx, edx
movsd dword es:[edi], dword [esi]
jl 0x40a3a7
cmp ecx, edx
jne 0x40a3cc
inc dword [ebp + 8]
xor ecx, ecx
cmp ebx, edx
jl 0x40a399
cmp dword [ebp + 8], 0xa
jle 0x40a33f
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a3e1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
add ecx, 0x24
push 4
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], 9
pop edi
xor eax, eax
mov ecx, dword [ebp - 4]
lea esi, [ebp + eax - 0x1c]
add ecx, 2
mov dword [ebp - 8], edi
movzx edx, byte [ecx + 1]
movzx ebx, byte [ecx - 1]
mov dl, byte [eax + edx*4 + 0x417eb0]
xor dl, byte [eax + ebx*4 + 0x4186b0]
movzx ebx, byte [ecx - 2]
xor dl, byte [eax + ebx*4 + 0x418ab0]
movzx ebx, byte [ecx]
xor dl, byte [eax + ebx*4 + 0x4182b0]
add ecx, edi
mov byte [esi], dl
add esi, edi
dec dword [ebp - 8]
jne 0x40a409
inc eax
cmp eax, edi
jl 0x40a3fc
push 0x10
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 4]
call fcn.0040abe0
add dword [ebp - 4], 0x10
dec dword [ebp - 0xc]
jne 0x40a3fa
pop edi
pop esi
pop ebx
leave
ret