joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bbe8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x42bc0f
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x42bc12
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.0042bbc4
pop esi
leave
ret 8

Function at 0x42da52
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42da91
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42da91
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42da91
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42da91
cmp dword [ecx + 0x74], 0xe
jbe 0x42da91
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x42dfe0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x44e100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x42e007
mov ecx, 5
int 0x29
push 2
call fcn.0042daf6
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x42e112
test esi, esi
jne 0x42e112
push 2
call fcn.0042daf6
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0042cc7e
mov esp, ebp
pop ebp
ret
Function at 0x439d10
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov ecx, dword [eax + 0xa4]
shl ecx, 0x10
or ecx, dword [eax + 0xa8]
cmp ecx, 0x60000
jae 0x439d3a
mov eax, 2
pop ebp
ret
push esi
call fcn.0042de30
mov esi, eax
mov eax, dword [ebp + 8]
mov edx, dword [esi + 0x70]
mov ecx, edx
and cl, 2
movzx ecx, cl
neg ecx
sbb ecx, ecx
inc eax
cmp eax, 3
ja case.default.0x439d5a
jmp dword [eax*4 + 0x439d90]
or edx, 2
lea eax, [ecx + 2]
mov dword [esi + 0x70], edx
pop esi
pop ebp
ret
and edx, 0xfffffffd
mov dword [esi + 0x70], edx
lea eax, [ecx + 2]
pop esi
pop ebp
ret
call sub.msvcrt.dll__errno
mov dword [eax], 0x16
call fcn.0042df70
or eax, 0xffffffff
pop esi
pop ebp
ret

Function at 0x439da0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x504
mov eax, dword [0x44e100]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x439e9b
push 0x2d
push esi
call sub.msvcrt.dll_strchr
add esp, 8
test eax, eax
je 0x439e9b
xor ecx, ecx
mov al, byte [ecx + esi]
lea edx, [ecx + ecx]
test al, al
je 0x439dfa
cbw
inc ecx
mov word [ebp + edx - 0x204], ax
cmp ecx, 0x100
jne 0x439dd8
jmp 0x439e9b
cmp edx, 0x200
jae 0x439f01
xor eax, eax
mov word [ebp + edx - 0x204], ax
lea eax, [ebp - 0x204]
push 0x2d
push eax
call sub.msvcrt.dll_wcsrchr
add esp, 8
test eax, eax
je 0x439e9b
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
lea eax, [ebp - 0x504]
push 0xff
push eax
push 0x1001
lea eax, [ebp - 0x204]
push eax
call edi
test eax, eax
je 0x439e9a
lea edx, [ebp - 0x504]
mov ecx, 0x5f
lea edx, [edx + eax*2]
mov word [edx - 2], cx
mov ecx, 0x100
sub ecx, eax
lea eax, [ebp - 0x204]
push ecx
push edx
push 0x1002
push eax
call edi
test eax, eax
je 0x439e9a
lea edi, [ebp - 0x504]
xor eax, eax
nop
movzx ecx, word [edi + eax*2]
lea edx, [ebp - 0x304]
test cx, cx
je 0x439ee3
mov byte [edx + eax], cl
inc eax
cmp eax, 0x100
jne 0x439e80
pop edi
mov eax, dword [0x451968]
test eax, eax
jne 0x439ec1
push 0x4474b8
call fcn.0043ac10
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x439ebc
or eax, 0xffffffff
mov dword [0x451968], eax
lea ecx, [eax + 1]
neg ecx
sbb ecx, ecx
and ecx, eax
je 0x439eef
push esi
push ebx
call ecx
add esp, 8
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042cc7e
mov esp, ebp
pop ebp
ret
mov byte [edx + eax], 0
lea esi, [ebp - 0x304]
jmp 0x439e9a
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop ebx
call fcn.0042cc7e
mov esp, ebp
pop ebp
ret
call fcn.0042cf15
int3

Function at 0x43a200
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.0043a230
mov esi, dword [ebp + 8]
test al, al
je 0x43a21e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.0043a240
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x43a370
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 2
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43a3cc
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43a3cc
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43a3cc
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43a3cc
cmp dword [ecx + 0x74], 0xe
jbe 0x43a3cc
cmp dword [ecx + 0xe8], 0
je 0x43a3cc
push dword [ebp + 8]
call fcn.0043a240
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x451974
call fcn.0043a010
add esp, 8
cmp dword [ebp - 8], 0
jne 0x43a401
push dword [ebp + 8]
call fcn.0043a200
mov esp, ebp
pop ebp
ret

Function at 0x43a440
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x43a49c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x43a49c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x43a49c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x43a49c
cmp dword [ecx + 0x74], 0xe
jbe 0x43a49c
cmp dword [ecx + 0xe8], 0
je 0x43a49c
push dword [ebp + 8]
call fcn.0043a240
add esp, 4
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
mov dword [ebp - 0x18], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 1]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
push 0x451974
call fcn.0043a010
add esp, 8
cmp dword [ebp - 8], 0
jne 0x43a4d1
push dword [ebp + 8]
call fcn.0043a200
mov esp, ebp
pop ebp
ret
Function at 0xd4db50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0xd4db7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0xd4db7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x401e6d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401eac
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401eac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401eac
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401eac
cmp dword [ecx + 0x74], 0xe
jbe 0x401eac
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x402e47
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor ecx, ecx
push 8
mov eax, ecx
pop edx
test al, 1
je 0x402e5b
shr eax, 1
xor eax, 0xedb88320
jmp 0x402e5d
shr eax, 1
dec edx
jne 0x402e4e
mov dword [ecx*4 + 0x4151c0], eax
mov dword [ecx*4 + 0x4171c0], eax
inc ecx
cmp ecx, 0x100
jb 0x402e49
push ebx
push esi
push edi
mov ecx, 0x4155c0
mov edi, 0x101
mov eax, dword [ecx - 0x400]
push 7
mov edx, ecx
pop esi
movzx ebx, al
shr eax, 8
xor eax, dword [ebx*4 + 0x4151c0]
mov dword [edx], eax
add edx, 0x400
dec esi
jne 0x402e8f
add ecx, 4
dec edi
jne 0x402e84
pop edi
pop esi
pop ebx
ret

Function at 0x402eb1
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4171c4], 0
jne 0x402ebf
call fcn.00402e47
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402eec
test cl, 7
je 0x402eec
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec esi
inc ecx
jmp 0x402ecd
cmp esi, 8
jb 0x402f7f
mov edi, esi
shr edi, 3
push ebx
xor eax, dword [ecx]
sub esi, 8
mov ebx, eax
shr ebx, 0x10
movzx ebx, bl
mov edx, eax
shr edx, 0x18
mov edx, dword [edx*4 + 0x4161c0]
xor edx, dword [ebx*4 + 0x4165c0]
mov ebx, eax
shr ebx, 8
movzx ebx, bl
xor edx, dword [ebx*4 + 0x4169c0]
movzx ebx, byte [ecx + 6]
xor edx, dword [ebx*4 + 0x4155c0]
movzx ebx, byte [ecx + 5]
xor edx, dword [ebx*4 + 0x4159c0]
movzx ebx, byte [ecx + 4]
xor edx, dword [ebx*4 + 0x415dc0]
movzx ebx, byte [ecx + 7]
xor edx, dword [ebx*4 + 0x4151c0]
movzx eax, al
xor edx, dword [eax*4 + 0x416dc0]
add ecx, 8
dec edi
mov eax, edx
jne 0x402efb
pop ebx
jmp 0x402f7f
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec esi
inc ecx
test esi, esi
ja 0x402f6b
pop edi
pop esi
ret 0xc

Function at 0x403447
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00401200
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x4034d9
push esi
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x800]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00407c00
lea eax, [ebp - 0x800]
push eax
call fcn.0040b257
mov esi, eax
lea eax, [ebp - 0x800]
push eax
call fcn.004084dd
test al, al
jne 0x4034b5
lea eax, [ebp - 0x1000]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040b257
lea esi, [esi + eax + 1]
mov eax, 0x104
pop edi
cmp esi, eax
pop esi
jbe 0x4034d9
push eax
push 0xaf
call fcn.0040a53c
push eax
push 0x413310
call fcn.0040c155
add esp, 0xc
leave
ret 8
Function at 0x40511b
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30c8
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x30c8]
call fcn.0040393f
xor edi, edi
push edi
lea eax, [ebp - 0x30c8]
push eax
push dword [ebp + 8]
push edi
call fcn.0040678a
test al, al
je 0x4052c0
cmp word [ebp - 0x2448], di
je 0x4052c0
lea eax, [ebp - 0x2448]
push eax
lea eax, [ebp - 0x2cc8]
push eax
call fcn.00407d04
push eax
call fcn.0040f639
test eax, eax
je 0x4052c0
lea eax, [ebp - 0x2448]
push eax
push dword [ebp + 8]
call fcn.00407d04
push eax
call fcn.0040f639
test eax, eax
jne 0x4052c0
mov word [ebp - 0x800], ax
xor ebx, ebx
mov esi, 0x400
cmp word [ebp - 0x800], di
jne 0x405211
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push eax
call fcn.0040ed1e
push ebx
push str.rtmp_d
push esi
lea eax, [ebp - 0x800]
push eax
call fcn.00407d04
push eax
call fcn.0040b4f5
add esp, 0x10
lea eax, [ebp - 0x800]
push eax
push edi
call fcn.00405eb7
test al, al
je 0x4051f9
xor eax, eax
mov word [ebp - 0x800], ax
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x4051aa
cmp word [ebp - 0x800], di
je 0x4052c0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040ed1e
lea eax, [ebp - 0x2cc8]
push eax
call fcn.00407d04
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00407d04
push eax
call fcn.0040b281
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x4052c0
lea ecx, [ebp - 0x1c28]
call fcn.00405540
push dword [ebp + 8]
xor bl, bl
push edi
call fcn.00405eb7
test al, al
jne 0x405287
push 9
push dword [ebp + 8]
lea ecx, [ebp - 0x1c28]
push edi
call fcn.004058c4
mov bl, al
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x4052b1
lea ecx, [ebp - 0x1c28]
call fcn.004055b2
lea ecx, [ebp - 0x1c28]
call fcn.00405637
lea ecx, [ebp - 0x1c28]
call fcn.0040572c
mov al, 1
jmp 0x4052c2
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40574f
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc20], ebx
cmp byte [esi + 0x1c], bl
jne 0x40576f
test byte [ebp + 0x10], 4
jne 0x40576f
xor al, al
jmp 0x405771
mov al, 1
mov ecx, dword [ebp + 0x10]
shr ecx, 1
and cl, 1
movzx edi, cl
neg edi
sbb edi, edi
and edi, 0xc0000000
add edi, 0x80000000
test byte [ebp + 0x10], 1
je 0x405798
or edi, 0x40000000
mov dword [ebp + 0x10], 1
cmp al, bl
je 0x4057aa
mov dword [ebp + 0x10], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov dword [ebp - 4], eax
call fcn.00407561
test eax, eax
je 0x4057e4
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x4057e4
cmp word [eax], bx
je 0x4057e4
push ebx
push dword [ebp - 4]
push 3
push ebx
push dword [ebp + 0x10]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x4057f8
push ebx
push dword [ebp - 4]
push 3
push ebx
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x405814
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x405814
mov dword [esi + 0xc20], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x40588c
mov dword [esi + 4], edi
mov edi, dword [ebp + 0xc]
cmp edi, ebx
je 0x40584d
push edi
call fcn.0040b257
lea eax, [eax + eax + 2]
push eax
push edi
lea eax, [esi + 0x41e]
push eax
call fcn.0040af86
jmp 0x405856
xor eax, eax
mov word [esi + 0x41e], ax
cmp dword [ebp + 8], ebx
je 0x405873
push dword [ebp + 8]
call fcn.0040afd1
inc eax
push eax
push dword [ebp + 8]
lea eax, [esi + 0x1d]
push eax
call fcn.0040af86
jmp 0x405882
push 0x1000000
lea eax, [esi + 0x1d]
push eax
push edi
call fcn.0040f401
push dword [esi + 4]
mov ecx, esi
call fcn.0040558b
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4059e6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x405a0c
cmp dword [ebp + 0xc], esi
jbe 0x405a01
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x405a5c
mov ecx, edi
call fcn.00405709
test al, al
je 0x405a42
cmp dword [ebp + 0xc], esi
jbe 0x405a42
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.004059e6
jmp 0x405a5f
cmp dword [edi + 0xc], 1
jne 0x405a57
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x405a57
xor eax, eax
jmp 0x405a5f
or eax, 0xffffffff
jmp 0x405a5f
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x405cb7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x405dc7
mov eax, dword [esi + 0xc]
test eax, eax
je 0x405ce4
dec eax
je 0x405cd9
dec eax
jne 0x405ce4
push 0xfffffffffffffff4
jmp 0x405cdb
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x405d33
cmp dword [ebp + 0xc], edi
jbe 0x405d4e
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x405d0b
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x405d4e
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x405cfb
jmp 0x405d4a
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x405dc1
cmp byte [esi + 0x14], 0
je 0x405dc1
cmp dword [esi + 0xc], 0
jne 0x405dc1
push 0
lea eax, [esi + 0x41e]
push eax
lea eax, [esi + 0x1d]
mov edi, 0x417e7c
push eax
mov ecx, edi
call fcn.004035bc
test al, al
je 0x405dab
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x405cec
test eax, eax
jbe 0x405cec
push 0
mov ecx, esi
call fcn.00405667
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.00405c18
jmp 0x405cec
lea eax, [esi + 0x41e]
push eax
lea eax, [esi + 0x1d]
push eax
push 0
push 0
mov ecx, edi
call fcn.00403846
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x405eb7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.00407561
test eax, eax
je 0x405ee1
mov eax, dword [esp + 8]
test eax, eax
je 0x405ee1
cmp word [eax], 0
je 0x405ee1
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x405efe
cmp dword [esp + 4], 0
je 0x405efc
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405efc
xor eax, eax
inc eax
jmp 0x405efe
xor eax, eax
ret 8

Function at 0x405f2c
Capabilities:
Get file attributes

Disassembly:
call fcn.00407561
test eax, eax
je 0x405f4c
mov eax, dword [esp + 8]
test eax, eax
je 0x405f4c
cmp word [eax], 0
je 0x405f4c
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x405f56
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x405f59
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.00407561
test eax, eax
je 0x405f7e
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405f7e
cmp word [eax], 0
je 0x405f7e
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x405f90
cmp dword [ebp + 8], 0
je 0x405f97
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
jmp 0x405f99
xor al, al
pop ebp
ret 0xc
Function at 0x405fcf
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.00407561
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test eax, eax
je 0x405ff5
cmp esi, ebx
je 0x405ff5
cmp word [esi], bx
je 0x405ff5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x406004
cmp dword [ebp + 8], ebx
je 0x406032
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
je 0x40601d
cmp byte [ebp + 0x10], bl
je 0x406019
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.00405f59
xor eax, eax
jmp 0x406035
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x406032
cmp eax, 3
je 0x406032
xor eax, eax
inc eax
jmp 0x406035
push 2
pop eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x406be2
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
test eax, eax
jl 0x406c14
cmp dword [ebp - 4], edi
jne 0x406c55
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x2710
ja 0x406c55
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x406c01
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x406c01
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
mov esi, eax
cmp esi, edi
jl 0x406cab
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x413bac
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x406ca2
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, edi
jl 0x406c99
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
cmp esi, edi
pop edi
pop esi
setge al
pop ebx
leave
ret 8
Function at 0x40744f
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x18]
sub esp, 0x10
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
mov esi, ecx
mov byte [esi + 0x21], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
mov ecx, esi
call fcn.004073e8
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x4074b6
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push esi
push dword [esi]
sub edi, eax
push 0
push dword [ebp + 0xc]
lea ecx, [eax + 1]
dec edi
mov dword [ebp + 0x18], ecx
dec edi
call ebx
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
push edi
push dword [ebp - 0xc]
xor edi, edi
push dword [ebp + 0x18]
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp dword [esi + 0xc], edi
jne 0x407537
cmp dword [ebp + 0xc], edi
je 0x40755a
cmp dword [esi + 0x14], edi
jne 0x40755a
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x40755a
push eax
mov ecx, esi
call fcn.004070c8
mov esi, eax
cmp esi, edi
je 0x40755a
push 5
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.0040ae4d
jmp 0x40755a
cmp eax, edi
je 0x40754d
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x1c], 0x64
jbe 0x40755a
mov ecx, esi
call fcn.00406ddd
pop edi
pop esi
pop ebx
leave
ret 0x14