joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403079
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4030b4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4030b0
lea ebx, [ebx]
cmp esi, eax
jae 0x4030b4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4030a0
cmp esi, eax
jb 0x4030ba
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x40fbe1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x431c5c]
jne 0x40fbeb
repz ret
jmp fcn.00414c8c

Function at 0x41c257
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00414676
and dword [ebp - 4], 0
cmp dword [0x435d08], 0
mov ebx, eax
jne 0x41c308
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41c3b9
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42b228
push edi
call esi
test eax, eax
je 0x41c3b9
push eax
call fcn.00414604
mov dword [esp], 0x42b218
push edi
mov dword [0x435d08], eax
call esi
push eax
call fcn.00414604
mov dword [esp], 0x42b204
push edi
mov dword [0x435d0c], eax
call esi
push eax
call fcn.00414604
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435d10], eax
call esi
push eax
call fcn.00414604
pop ecx
mov dword [0x435d18], eax
test eax, eax
je 0x41c308
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00414604
pop ecx
mov dword [0x435d14], eax
mov eax, dword [0x435d14]
cmp eax, ebx
je 0x41c360
cmp dword [0x435d18], ebx
je 0x41c360
push eax
call fcn.0041467f
push dword [0x435d18]
mov esi, eax
call fcn.0041467f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41c360
test edi, edi
je 0x41c360
call esi
test eax, eax
je 0x41c357
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41c357
test byte [ebp - 0xc], 1
jne 0x41c360
or dword [ebp + 0x10], 0x200000
jmp 0x41c399
mov eax, dword [0x435d0c]
cmp eax, ebx
je 0x41c399
push eax
call fcn.0041467f
pop ecx
test eax, eax
je 0x41c399
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41c399
mov eax, dword [0x435d10]
cmp eax, ebx
je 0x41c399
push eax
call fcn.0041467f
pop ecx
test eax, eax
je 0x41c399
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435d08]
call fcn.0041467f
pop ecx
test eax, eax
je 0x41c3b9
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41c3bb
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402282
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x4022a2
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x4022ab
cmp byte [ebx], 0
jne 0x4022b2
xor eax, eax
jmp 0x402332
xor esi, esi
jmp 0x4022f5
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x4022dc
cmp dword [ebp - 4], 0
je 0x4022dc
test esi, esi
jne 0x4022dc
cmp dword [ebp + 8], 0
je 0x4022d8
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x4022f5
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x4022ea
cmp ecx, 0xa
jne 0x4022f2
cmp ecx, 0xd
jne 0x4022fa
inc ebx
jmp 0x4022fa
mov byte [edx], al
inc edx
cmp byte [ebx], 0
jne 0x4022b6
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x402330
mov eax, dword [ebp - 4]
test esi, esi
mov byte [eax], 0
je 0x402330
push 0x1000
lea edx, [ebp - 0x1004]
push edx
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.004066e0
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40233a
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffff7c0
mov ebx, eax
mov al, byte [0x40c934]
test al, al
mov byte [esp], dl
lea esi, [esp + 4]
je 0x402376
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x40236a
mov edx, 0x40b107
mov eax, ebx
call fcn.004067b4
mov edx, 0x40c934
mov eax, ebx
call fcn.004067b4
mov eax, esi
mov ecx, 0x3c
xor edx, edx
call fcn.00406604
mov dword [esi], 0x3c
xor eax, eax
mov dword [esi + 4], 0x5c0
mov al, byte [ebx]
cmp eax, 0x22
jne 0x40239f
lea edx, [ebx + 1]
jmp 0x4023a1
mov edx, ebx
mov dword [esi + 0x10], edx
xor eax, eax
jmp 0x4023f2
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x4023ca
jmp 0x4023c3
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x22
jne 0x4023c3
mov byte [ebx + eax], 0x20
jmp 0x4023ca
inc eax
cmp byte [ebx + eax], 0
jne 0x4023b3
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x20
je 0x4023df
xor ecx, ecx
mov cl, byte [ebx + eax + 1]
cmp ecx, 0x2f
jne 0x4023f1
cmp edx, 0x20
jne 0x4023e8
mov byte [ebx + eax], 0
lea eax, [eax + ebx + 1]
mov dword [esi + 0x14], eax
jmp 0x4023f9
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x4023a8
mov dword [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
call fcn.00405698
mov edi, eax
test edi, edi
je 0x402425
mov edx, str..inf
mov eax, edi
call fcn.00406768
test eax, eax
jne 0x402425
mov dword [esi + 0xc], 0x40b1dc
xor edx, edx
mov eax, dword [esi + 0x10]
call fcn.00405a34
mov byte [esp + 1], al
cmp byte [esp + 1], 0
je 0x40244d
lea edx, [esp + 0x40]
mov eax, dword [esi + 0x10]
call fcn.00405ac8
lea ecx, [esp + 0x40]
mov dword [esi + 0x10], ecx
cmp byte [esp], 0
je 0x402490
cmp byte [esp + 1], 0
jne 0x402490
lea eax, [esp + 0x440]
mov edx, dword [esi + 0x10]
call fcn.004066e0
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.004067b4
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00405a34
test al, al
je 0x402566
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x4024ba
and dword [esi + 4], 0xfffffbff
mov dword [esi + 0x10], ebx
push esi
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x402566
cmp byte [0x40b03d], 0
jne 0x4024d1
cmp byte [esp], 0
je 0x402517
push dword [0x40bc5c]
call sub.USER32.DLL_IsWindowVisible
mov ebx, eax
test ebx, ebx
je 0x4024ef
push 0
push dword [0x40bc5c]
call sub.USER32.DLL_ShowWindow
push 0x7d0
push dword [esi + 0x38]
call sub.USER32.DLL_WaitForInputIdle
push 0xffffffffffffffff
push dword [esi + 0x38]
call sub.KERNEL32.DLL_WaitForSingleObject
test ebx, ebx
je 0x402517
push 1
push dword [0x40bc5c]
call sub.USER32.DLL_ShowWindow
push dword [esi + 0x38]
call sub.KERNEL32.DLL_CloseHandle
test edi, edi
je 0x402533
mov edx, str..exe
mov eax, edi
call fcn.00406768
test eax, eax
je 0x402566
cmp byte [0x40b03d], 0
je 0x40254e
cmp byte [esp], 0
jne 0x40254e
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x402566
cmp byte [esp], 0
je 0x40255b
mov ecx, 0xc8
jmp 0x402560
mov ecx, 0x3e8
push ecx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop edi
pop esi
pop ebx
ret
Function at 0x402570
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffff7e0
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.00406660
mov ecx, eax
mov edx, esp
lea eax, [esp + 0x400]
call fcn.00406734
test eax, eax
jne 0x402607
push 0x40b1e9
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.00406660
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x800]
mov ecx, 0x1e
xor edx, edx
call fcn.00406604
mov dword [esp + 0x804], 3
mov word [esp + 0x810], 0x14
mov eax, esp
mov dword [esp + 0x808], eax
lea edx, [esp + 0x800]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x820
ret

Function at 0x4026c2
Capabilities:
Set registry value

Disassembly:
push ebx
add esp, 0xfffffbf8
mov ebx, eax
cmp byte [0x40b054], 0
je 0x402739
cmp byte [0x40cd3c], 0
je 0x402739
lea edx, [esp + 8]
mov eax, 0x40cd3c
call fcn.00402691
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 4]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x402739
mov eax, ebx
call fcn.00406660
inc eax
push eax
push ebx
push 1
push 0
lea edx, [esp + 0x18]
push edx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegSetValueExA
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x408
pop ebx
ret

Function at 0x402741
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
add esp, 0xfffff7f4
mov ebx, eax
cmp byte [0x40b054], 0
je 0x4027ba
lea edx, [esp + 0xc]
mov eax, ebx
call fcn.00402691
push esp
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4027ba
mov dword [esp + 4], 0x400
lea ecx, [esp + 4]
push ecx
lea eax, [esp + 0x410]
push eax
lea edx, [esp + 0x10]
push edx
push 0
lea ecx, [esp + 0x1c]
push ecx
push dword [esp + 0x14]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x4027b2
lea edx, [esp + 0x40c]
mov eax, ebx
call fcn.004066e0
push dword [esp]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0x80c
pop ebx
ret

Function at 0x4028d0
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret
Function at 0x402a38
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x40bbac
push 1
push 0
push 0x40bbbc
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x402b37
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402a9b
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x402aad
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.004066e0
lea eax, [ebp - 0x40c]
call fcn.00405738
cmp byte [ebp - 0x40c], 0
je 0x402ade
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x40bbdc
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402b2e
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x402b25
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402b48
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x402cac
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffc4
mov edi, edx
mov ebx, eax
push 0x67
push dword [0x40bc5c]
call sub.USER32.DLL_GetDlgItem
mov esi, eax
cmp byte [0x40b019], 0
jne 0x402d08
mov eax, dword [0x40d13c]
call fcn.00403e68
push 5
push esi
call sub.USER32.DLL_ShowWindow
push 0xffffffffffffffff
push 0
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x40b091
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
mov byte [0x40b019], 1
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
mov dword [esp], 0x3c
mov edx, esp
push edx
push 0
push 0x43a
push esi
call sub.USER32.DLL_SendMessageA
and dword [esp + 8], 0xbfffffff
mov byte [esp + 0x19], 0
test bl, bl
je 0x402d54
or dword [esp + 8], 1
mov dword [esp + 0x14], 0xa0
jmp 0x402d5f
and dword [esp + 8], 0xfffffffe
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 4], 0x40000001
mov eax, esp
push eax
push 1
push 0x444
push esi
call sub.USER32.DLL_SendMessageA
push edi
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
push 0x5f5e100
push 0x5f5e100
push 0xb1
push esi
call sub.USER32.DLL_SendMessageA
push 0x40b0b8
push 0
push 0xc2
push esi
call sub.USER32.DLL_SendMessageA
add esp, 0x3c
pop edi
pop esi
pop ebx
ret
Function at 0x40340c
Capabilities:
Accept command line arguments
Set environment variable

Disassembly:
push ebx
push esi
add esp, 0xffffffc8
mov ebx, 0x40c934
mov eax, 0x40d590
call fcn.00406350
call sub.KERNEL32.DLL_GetCommandLineA
mov esi, eax
test esi, esi
je 0x403443
xor eax, eax
mov al, byte [esi]
cmp eax, 0x22
jne 0x403443
lea eax, [esi + 1]
mov edx, 0x22
call fcn.00406670
mov esi, eax
test esi, esi
je 0x4034af
mov edx, 0x40b0ea
mov eax, esi
call fcn.004066b4
mov esi, eax
test eax, eax
je 0x403462
mov eax, ebx
mov edx, esi
call fcn.004066e0
xor ecx, ecx
xor eax, eax
jmp 0x4034a1
and edx, 0xff
cmp edx, 0x20
je 0x403475
mov cl, 1
xor edx, edx
mov dl, byte [ebx + eax]
cmp edx, 0x2d
je 0x403484
cmp edx, 0x2f
jne 0x4034a0
xor edx, edx
mov dl, byte [ebx + eax + 1]
cmp edx, 0x73
je 0x403494
cmp edx, 0x53
jne 0x4034a0
mov dword [0x40b050], 1
jmp 0x4034a8
inc eax
mov dl, byte [ebx + eax]
test dl, dl
jne 0x403468
test cl, cl
jne 0x4034af
mov byte [ebx], 0
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x64
mov dword [0x40bc90], ebx
mov dword [0x40bc8c], ebx
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x40cd34], eax
push 0x65
push dword [0x40bc8c]
call sub.USER32.DLL_LoadBitmapA
mov dword [0x40cd38], eax
mov eax, esp
call fcn.0040500c
push 0x400
push 0x40c534
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x40c534
push str.sfxname
call sub.KERNEL32.DLL_SetEnvironmentVariableA
mov edx, 0x40c534
mov eax, 0x40bc94
call fcn.00404770
lea eax, [esp + 8]
call fcn.00403cd8
lea eax, [esp + 0x20]
call fcn.00403cd8
lea edx, [esp + 8]
lea ecx, [esp + 0x20]
push 0
push 0x40109f
mov dword [0x40d13c], edx
push 0
mov dword [0x40d140], ecx
push str.STARTDLG
push dword [0x40bc90]
call sub.USER32.DLL_DialogBoxParamA
lea eax, [esp + 0x20]
mov edx, 2
call fcn.00403cfc
lea eax, [esp + 8]
mov edx, 2
call fcn.00403cfc
mov eax, esp
mov edx, 2
call fcn.00405080
xor ecx, ecx
mov dword [0x40d140], ecx
mov dword [0x40d13c], ecx
cmp dword [0x40bc64], 0
jne 0x4035b2
cmp dword [0x40bc70], 0
jne 0x4035b2
mov ecx, 4
mov edx, dword [0x40b040]
xor eax, eax
call fcn.004017c2
cmp byte [0x40b03d], 0
je 0x4035c0
call fcn.00402570
mov eax, 0x40c4a8
mov ecx, 0x80
xor edx, edx
call fcn.00406604
cmp dword [0x40b04c], 0
jle 0x4035e4
mov eax, dword [0x40b040]
call fcn.00406418
push dword [0x40cd34]
call sub.GDI32.DLL_DeleteObject
mov eax, dword [0x40cd38]
test eax, eax
je 0x4035fe
push eax
call sub.GDI32.DLL_DeleteObject
cmp dword [0x40bc80], 0
jne 0x40361f
cmp dword [0x40bc64], 0
je 0x40361f
mov eax, 0x40bc80
mov edx, 0xff
call fcn.00406214
mov dword [0x40bc64], 2
push dword [0x40bc80]
call sub.KERNEL32.DLL_ExitProcess
add esp, 0x38
pop esi
pop ebx
ret
Function at 0x403d24
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, eax
push esi
push edi
cmp byte [ebx + 0x14], 0
mov edi, edx
mov esi, ecx
jne 0x403d49
push 0
call sub.OLE32.DLL_OleInitialize
call sub.COMCTL32.DLL_InitCommonControls
mov byte [ebx + 0x14], 1
mov byte [ebx + 0x15], 0
push 0
push esi
call sub.USER32.DLL_ShowWindow
mov edx, edi
mov eax, ebx
call fcn.00403e80
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov dword [ebx + 0x10], ecx
push eax
push esi
call sub.USER32.DLL_GetWindowRect
push 2
lea edx, [ebp - 0x10]
push edx
push esi
call sub.USER32.DLL_GetParent
push eax
push 0
call sub.USER32.DLL_MapWindowPoints
mov eax, dword [ebx + 4]
test eax, eax
je 0x403d8f
push eax
call sub.USER32.DLL_DestroyWindow
push ebx
push dword [ebx]
push 0
push esi
call sub.USER32.DLL_GetParent
push eax
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 0x10]
add ecx, 0xfffffffe
push ecx
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0x40000000
push 0
push str.RarHtmlClassName
push 0
call sub.USER32.DLL_CreateWindowExA
mov edi, eax
mov dword [ebx + 4], edi
test edi, edi
je 0x403de0
push 5
push edi
call sub.USER32.DLL_ShowWindow
push dword [ebx + 4]
call sub.USER32.DLL_UpdateWindow
cmp byte [ebx + 0x15], 0
jne 0x403e5d
mov eax, dword [ebx + 4]
test eax, eax
je 0x403df8
push eax
call sub.USER32.DLL_DestroyWindow
xor edx, edx
mov dword [ebx + 4], edx
push 5
push esi
call sub.USER32.DLL_ShowWindow
mov eax, dword [ebp + 8]
call fcn.00406660
add eax, eax
lea eax, [eax + eax*2]
add eax, 0x100
call fcn.00406404
mov edi, eax
mov edx, dword [ebp + 8]
mov eax, edi
call fcn.004066e0
mov edx, edi
mov eax, ebx
call fcn.004044bc
test al, al
jne 0x403e39
mov edx, edi
mov eax, ebx
call fcn.004044f4
mov edx, edi
mov eax, ebx
call fcn.00404334
mov ebx, eax
mov eax, edi
call fcn.00406418
test ebx, ebx
je 0x403e5d
push ebx
push esi
call sub.USER32.DLL_SetWindowTextA
mov eax, ebx
call fcn.00406418
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x404074
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffdc
mov edi, edx
mov esi, eax
xor eax, eax
mov dword [esp], eax
xor edx, edx
mov dword [esp + 4], edx
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
jmp 0x4040da
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x2710
ja 0x4040eb
push 0
push 0
push 0
push 0
lea eax, [esp + 0x18]
push eax
call sub.USER32.DLL_PeekMessageA
test eax, eax
je 0x4040da
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
call sub.USER32.DLL_GetMessageA
lea ecx, [esp + 8]
push ecx
call sub.USER32.DLL_TranslateMessage
lea eax, [esp + 8]
push eax
call sub.USER32.DLL_DispatchMessageA
push esp
push esi
mov edx, dword [esi]
call dword [edx + 0x48]
test eax, eax
jl 0x404092
cmp dword [esp], 0
je 0x404092
xor ebx, ebx
cmp dword [esp], 0
je 0x404135
lea eax, [esp + 4]
push eax
push 0x40bbec
mov edx, dword [esp + 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x404135
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 0x20]
test eax, eax
jl 0x40412b
push edi
mov ecx, dword [esp + 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
test eax, eax
setge bl
and ebx, 1
mov eax, dword [esp + 4]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, ebx
add esp, 0x24
pop edi
pop esi
pop ebx
ret
Function at 0x404c40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7ac
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov esi, edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00404e3c
mov ebx, eax
lea eax, [ebp - 0x34]
push eax
push esi
call sub.USER32.DLL_GetWindowRect
lea edx, [ebp - 0x44]
push edx
push esi
call sub.USER32.DLL_GetClientRect
mov ecx, dword [ebp - 0x2c]
sub ecx, dword [ebp - 0x34]
inc ecx
sub ecx, dword [ebp - 0x3c]
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
inc eax
sub eax, dword [ebp - 0x38]
test bl, bl
mov dword [ebp - 0x18], eax
je 0x404cd7
cmp byte [ebp + 8], 0
jne 0x404cd7
mov eax, dword [ebp - 0x3c]
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x38]
imul dword [ebp - 0x10]
cdq
mov edi, 0x64
idiv edi
add ecx, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
push 0x206
push eax
push ecx
push 0
push 0
push 0
push esi
call sub.USER32.DLL_SetWindowPos
cmp byte [ebp + 8], 0
jne 0x404d15
push 0x400
lea eax, [ebp - 0x444]
push eax
push esi
call sub.USER32.DLL_GetWindowTextA
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x444]
lea edx, [ebp - 0x444]
mov eax, dword [ebp - 4]
call fcn.00404ac4
lea edx, [ebp - 0x444]
push edx
push esi
call sub.USER32.DLL_SetWindowTextA
push 8
call sub.USER32.DLL_GetSystemMetrics
sub dword [ebp - 0x18], eax
push 5
push esi
call sub.USER32.DLL_GetWindow
mov edi, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
jmp 0x404e23
push 0x400
lea eax, [ebp - 0x844]
push eax
push edi
call sub.USER32.DLL_GetWindowTextA
cmp byte [ebp - 0x844], 0
je 0x404d74
push 1
push dword [ebp - 8]
lea ecx, [ebp - 0x844]
lea edx, [ebp - 0x844]
mov eax, dword [ebp - 4]
call fcn.00404ac4
lea edx, [ebp - 0x844]
push edx
push edi
call sub.USER32.DLL_SetWindowTextA
test bl, bl
je 0x404e13
lea ecx, [ebp - 0x854]
push ecx
push edi
call sub.USER32.DLL_GetWindowRect
mov eax, dword [ebp - 0x854]
sub eax, dword [ebp - 0x34]
mov edx, dword [ebp - 0x14]
sar edx, 1
jns 0x404d9c
adc edx, 0
sub eax, edx
mov ecx, 0x64
imul dword [ebp - 0xc]
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x850]
sub eax, dword [ebp - 0x30]
sub eax, dword [ebp - 0x18]
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x84c]
sub eax, dword [ebp - 0x854]
inc eax
imul dword [ebp - 0xc]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x848]
sub eax, dword [ebp - 0x850]
inc eax
imul dword [ebp - 0x10]
cdq
push ecx
mov ecx, 0x64
idiv ecx
pop ecx
push 0x204
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x20]
push ecx
push 0
push edi
call sub.USER32.DLL_SetWindowPos
push 2
push edi
call sub.USER32.DLL_GetWindow
mov edi, eax
cmp edi, dword [ebp - 0x1c]
je 0x404e33
inc esi
test edi, edi
je 0x404e33
cmp esi, 0x200
jl 0x404d33
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4