joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411500
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebx + 4], eax
cmp eax, 4
jne 0x41159e
xor eax, eax
mov edx, 0xfd48864f
push eax
push eax
push 3
pop ecx
push ecx
push eax
push ecx
push eax
push 0xa1b5df8f
mov ecx, 0x34ba2d1d
call fcn.0040160e
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x411702
push 0x27
lea eax, [ebp - 0x3b]
mov byte [ebp - 0x3c], 0
push 0
push eax
call fcn.004bea90
add esp, 0xc
lea ecx, [ebp - 0x40]
xor eax, eax
mov dword [ebp - 0x40], eax
push eax
push ecx
push 0x28
lea ecx, [ebp - 0x3c]
push ecx
push eax
push eax
push 0x11700810
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx eax, byte [ebp - 0x3c]
mov dword [ebx + 8], eax
movzx eax, byte [ebp - 0x3b]
push esi
mov dword [ebx + 0xc], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x411702
cmp eax, 5
jne 0x411702
lea eax, [ebp - 0x44]
mov edx, 0xdf2755f4
push eax
push 0x83da0c34
mov ecx, 0x16d5fe82
call fcn.0040160e
pop ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x411702
push edi
mov word [ebp - 0x14], ax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
mov edx, 0x7c8358b8
mov ecx, 0xb571f3b2
mov dword [ebp - 0x40], 1
mov dword [ebp - 0x48], 0x10
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x40]
push eax
push 0
push 0x207e0173
call fcn.0040160e
pop ecx
push eax
push dword [ebp - 0x44]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x44]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
test esi, esi
je 0x411636
cmp dword [ebp - 0x40], 1
jne 0x411702
movzx eax, word [ebp - 0xc]
push 3
pop ecx
push 2
pop edx
push 0x31
pop esi
cmp eax, esi
je 0x411666
cmp eax, 0x37
je 0x411661
cmp eax, 0x42
je 0x41165c
cmp eax, 0x54
jne 0x41166d
and dword [ebx + 8], 0
jmp 0x41166d
mov dword [ebx + 8], ecx
jmp 0x41166d
mov dword [ebx + 8], edx
jmp 0x41166d
mov dword [ebx + 8], 1
mov ax, word [ebp - 0x12]
cmp ax, 0x33
jne 0x411692
cmp word [ebp - 0x10], 0x50
jne 0x411702
cmp word [ebp - 0xe], 0x46
jne 0x411702
mov dword [ebx + 0xc], 5
jmp 0x411702
cmp ax, 0x32
jne 0x4116ce
cmp word [ebp - 0x10], 0x50
jne 0x4116af
cmp word [ebp - 0xe], 0x47
jne 0x411702
mov dword [ebx + 0xc], 4
jmp 0x411702
cmp word [ebp - 0x10], 0x51
jne 0x411702
cmp word [ebp - 0xe], 0x30
jne 0x4116c2
mov dword [ebx + 0xc], ecx
jmp 0x411702
cmp word [ebp - 0xe], 0x47
jne 0x411702
mov dword [ebx + 0xc], edx
jmp 0x411702
cmp ax, si
jne 0x4116ea
cmp word [ebp - 0x10], 0x52
jne 0x411702
cmp word [ebp - 0xe], 0x30
jne 0x411702
mov dword [ebx + 0xc], 1
jmp 0x411702
cmp ax, 0x30
jne 0x411702
cmp word [ebp - 0x10], 0x52
jne 0x411702
cmp word [ebp - 0xe], 0x47
jne 0x411702
and dword [ebx + 0xc], 0
mov ecx, dword [ebp - 4]
mov al, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.004b94b6
mov esp, ebp
pop ebp
ret 8
Function at 0x4119e8
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 0xc], 4
push esi
push edi
mov edi, dword [ebp + 8]
jne 0x411a15
push ecx
mov cl, byte [ebp + 0x10]
call fcn.0040f997
pop ecx
push 5
pop eax
jmp 0x411af8
cmp dword [ebp + 0xc], 5
jne 0x411af6
push 0x30
pop ecx
push 0x32
pop eax
push 0x50
mov word [ebp - 0x16], ax
pop eax
push 0x47
mov word [ebp - 0x14], ax
pop eax
push 0x31
mov word [ebp - 0x12], ax
pop eax
mov word [ebp - 0x10], ax
push 0x56
pop eax
mov word [ebp - 0xe], ax
xor eax, eax
cmp dword [ebp + 0x10], 1
mov word [ebp - 0x18], cx
mov word [ebp - 0xc], cx
mov word [ebp - 0xa], ax
je 0x411a70
cmp dword [ebp + 0x10], 2
jne 0x411a63
push 0x37
jmp 0x411a6b
cmp dword [ebp + 0x10], 3
jne 0x411a70
push 0x42
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1c]
mov edx, 0x12bcb65f
push eax
push 0x4e41ef9f
mov ecx, 0xdb4e1c7d
call fcn.0040160e
pop ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x411b0a
push 0x10
lea eax, [ebp - 0x18]
mov edx, 0x4f8970ac
push eax
push 1
push 0
push 0x13742967
mov ecx, 0x867bd56a
call fcn.0040160e
pop ecx
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x1c]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, 5
jne 0x411b0a
push 0x10
push 0x4ee5d0
push 0xe76e8969
mov edx, 0xbb93d089
mov ecx, 0x7261755d
call fcn.0040160e
pop ecx
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
pop esi
call fcn.004b94b6
mov esp, ebp
pop ebp
ret 0xc
push 4
jmp 0x411a0f
Function at 0x411fef
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0x84
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x80], eax
push ebx
push ebp
push esi
push 0x3c
pop esi
push 0x61
pop eax
push 0x3e
mov word [esp + 0x12], ax
mov ebx, ecx
mov ecx, dword [0x529a90]
pop eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push esi
push eax
push 0x42
mov word [esp + 0x18], si
call fcn.00420e3f
test eax, eax
jne 0x412056
movzx edx, word [0x51edc0]
lea eax, [esp + 0x12]
push esi
push eax
xor edx, 0x2525
mov ecx, 0x51edc2
call fcn.00412531
pop ecx
pop ecx
push 0xf5b74a70
mov edx, 0xcda3a734
mov ecx, 0xb449c5f7
call fcn.0040169c
mov edx, eax
xor ebp, ebp
pop ecx
mov esi, edx
mov ax, word [edx]
add edx, 2
cmp ax, bp
jne 0x412071
push edi
lea edi, [esp + 0x10]
sub edx, esi
sub edi, 2
mov ax, word [edi + 2]
add edi, 2
cmp ax, bp
jne 0x412086
mov ecx, edx
lea eax, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push eax
mov ecx, edx
and ecx, 3
push 0x33
rep movsb byte es:[edi], byte [esi]
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x4120f1
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
lea edi, [edx + 1]
mov cl, byte [edx]
inc edx
test cl, cl
jne 0x4120cf
sub edx, edi
cmp edx, 0xac
jb 0x4120ea
push eax
push 0x32
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov esi, dword [0x529bdc]
pop edi
test esi, esi
jne 0x412109
call fcn.004087d6
mov esi, eax
push 0x32
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
push ebp
push esi
push 0x30
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x8c]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x84
ret
Function at 0x412213
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x204
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x200], eax
push ebx
push ebp
push esi
push edi
mov ebp, ecx
push 0x32
push ebp
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, 0x400
mov edi, eax
push ebx
call fcn.00404d58
pop ecx
push ebx
mov esi, eax
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push esi
call fcn.00463d09
cmp byte [esi], 0
pop ecx
je 0x412312
mov ecx, esi
call fcn.00411cd7
mov ecx, dword [0x529a90]
mov ebx, 0x100
test eax, eax
lea eax, [esp + 0x10]
push ebx
push eax
jne 0x4122ca
push 0x46
call fcn.00420e3f
test eax, eax
jne 0x4122a5
movzx edx, word [0x51ee72]
lea eax, [esp + 0x10]
push ebx
push eax
xor edx, 0x2525
mov ecx, 0x51ee74
call fcn.00412531
pop ecx
pop ecx
push 0x40
push 0x4ee5d0
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push ebp
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, esi
call fcn.004121ba
jmp 0x412322
push 0x47
call fcn.00420e3f
test eax, eax
jne 0x4122f4
movzx edx, word [0x51eea4]
lea eax, [esp + 0x10]
push ebx
push eax
xor edx, 0x2525
mov ecx, 0x51eea6
call fcn.00412531
pop ecx
pop ecx
push 0x10
push 0x4ee5d0
lea eax, [esp + 0x18]
push eax
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x412322
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push edi
call dword [sym.imp.USER32.dll_SetFocus]
push esi
call fcn.00404d44
pop ecx
mov ecx, dword [esp + 0x210]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x204
ret

Function at 0x412419
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov al, byte [edi + 1]
xor al, 0x25
movzx esi, al
mov al, byte [edi]
xor al, 0x25
shl si, 8
movzx eax, al
or si, ax
movzx esi, si
mov eax, esi
call fcn.004c0200
xor ecx, ecx
mov edx, esp
test esi, esi
jle 0x412464
mov al, byte [edi + ecx + 2]
xor al, 0x25
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x412456
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push edx
push dword [0x529a94]
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b94b6
mov esp, ebp
pop ebp
ret
Function at 0x41248c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov ebx, edx
mov al, byte [edi + 1]
xor al, 0x25
movzx esi, al
mov al, byte [edi]
xor al, 0x25
shl si, 8
movzx eax, al
or si, ax
movzx esi, si
mov eax, esi
call fcn.004c0200
xor ecx, ecx
mov edx, esp
test esi, esi
jle 0x4124d7
mov al, byte [edi + ecx + 2]
xor al, 0x25
mov byte [ecx + edx], al
inc ecx
cmp ecx, esi
jl 0x4124c9
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
push edx
push dword [0x529a94]
call dword [sym.imp.USER32.dll_DialogBoxIndirectParamW]
lea esp, [ebp - 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004b94b6
mov esp, ebp
pop ebp
ret

Function at 0x412531
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
dec eax
cmp edx, eax
push ebp
cmovle eax, edx
push esi
mov esi, dword [esp + 0xc]
push edi
lea ebp, [eax + eax]
mov edi, ecx
test ebp, ebp
jle 0x41255f
push ebx
mov edx, esi
sub edi, esi
mov ebx, ebp
mov cl, byte [edi + edx]
xor cl, 0x25
mov byte [edx], cl
inc edx
dec ebx
jne 0x412552
pop ebx
xor ecx, ecx
pop edi
mov word [esi + ebp], cx
pop esi
pop ebp
ret

Function at 0x412569
Capabilities:
Get disk size

Disassembly:
sub esp, 0x220
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x21c], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x23c]
mov ebx, edx
push 0x5c
pop eax
push eax
push ebx
mov ebp, ecx
call fcn.004bacf8
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4125a3
xor eax, eax
mov word [esi], ax
push 0
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41264a
test esi, esi
je 0x4125c8
push 0x5c
pop eax
mov word [esi], ax
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x238]
jb 0x4125e9
ja 0x4125e4
mov eax, dword [esp + 0x10]
cmp eax, dword [esp + 0x234]
jbe 0x4125e9
xor eax, eax
inc eax
jmp 0x41264c
test edi, edi
je 0x41264a
mov ecx, dword [0x529a90]
lea eax, [esp + 0x20]
mov esi, 0x104
push esi
push eax
push 0x16
call fcn.00420e3f
test eax, eax
jne 0x412628
movzx edx, word [0x51e794]
lea eax, [esp + 0x20]
push esi
push eax
xor edx, 0x2525
mov ecx, 0x51e796
call fcn.00412531
pop ecx
pop ecx
movzx eax, word [ebx]
push eax
lea eax, [esp + 0x24]
push eax
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x10
push 0x4ee5d0
push edi
push ebp
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x220
ret
Function at 0x4130f5
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
call fcn.00413414
test al, al
je 0x413163
xor ebx, ebx
lea esi, [edi + 0x102]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [edi + 0x574]
push ebx
push ebx
call fcn.0044545d
mov edx, eax
lea eax, [esi + 2]
mov cx, word [esi]
add esi, 2
cmp cx, bx
jne 0x413125
sub esi, eax
lea ecx, [edi + 0x102]
sar esi, 1
lea ecx, [ecx + esi*2]
push ecx
lea eax, [ecx + 2]
mov ecx, edi
push edx
mov dword [edi + 0x564], eax
call fcn.004131dc
mov ecx, edi
call fcn.00413458
xor eax, eax
cmp byte [edi + 0x310], al
sete al
jmp 0x413165
xor al, al
pop edi
pop esi
pop ebx
ret
Function at 0x413a79
Capabilities:
Create thread

Disassembly:
sub esp, 0x624
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x61c], eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov esi, edx
push 0x33
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, eax
call fcn.00413a28
movzx ebp, ax
xor eax, eax
push 0x104
mov word [esp + 0x11c], ax
lea eax, [esp + 0x11c]
push eax
push 0x37
push edi
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
cmp word [esp + 0x118], 0
jne 0x413ada
xor al, al
jmp 0x413c08
cmp byte [esi + 0x311], 0
je 0x413b71
lea eax, [esp + 0x118]
push eax
call fcn.0041fa4a
pop ecx
test al, al
je 0x413b71
mov ecx, dword [0x529a90]
lea eax, [esp + 0x18]
mov ebx, 0x80
push ebx
push eax
push 0x3a
call fcn.00420e3f
test eax, eax
jne 0x413b34
movzx edx, word [0x51ec72]
lea eax, [esp + 0x18]
push ebx
push eax
xor edx, 0x2525
mov ecx, 0x51ec74
call fcn.00412531
pop ecx
pop ecx
lea eax, [esp + 0x118]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x328]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x320]
push 0x34
push 0x4ee5d0
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x413ad3
mov ecx, esi
call fcn.0041361d
lea eax, [esp + 0x118]
push eax
lea ebx, [esi + 0x102]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
and dword [esi + 0x344], 0
push 5
push edi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
dec eax
mov ecx, esi
neg eax
push edi
sbb al, al
inc al
push ebp
mov byte [esi + 0x312], al
call fcn.004126ec
test al, al
je 0x413ad3
mov ecx, dword [0x529a98]
movzx eax, byte [esi + 0x312]
shl eax, 0xa
push ebx
xor eax, dword [ecx + 0x14]
and eax, 0x400
xor dword [ecx + 0x14], eax
call fcn.0040e7e3
mov ecx, dword [0x529a98]
call fcn.0040d802
lea eax, [esp + 0x14]
push eax
xor eax, eax
push eax
push esi
push 0x412d14
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [esi + 0x568], eax
setne al
mov ecx, dword [esp + 0x62c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x624
ret

Function at 0x413c21
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x517490]
xor eax, ebp
mov dword [ebp - 4], eax
mov ax, word [ecx]
push ebx
push esi
push edi
push 0x3a
mov word [ebp - 0xc], ax
lea esi, [ecx + 2]
pop eax
push 0x5c
mov word [ebp - 0xa], ax
xor ebx, ebx
pop eax
push ebx
push ebx
mov word [ebp - 8], ax
xor eax, eax
push ebx
push ebx
mov word [ebp - 6], ax
mov word [esi], ax
lea eax, [ebp - 0x10]
push eax
push 0x80
push esi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
mov edi, eax
test edi, edi
je 0x413ca0
cmp word [esi], bx
jne 0x413ca0
push 0xe6eccdd8
mov edx, 0x7db99d9c
mov ecx, 0x6f2e896c
call fcn.0040174d
pop ecx
sub esi, eax
movzx ecx, word [eax]
mov word [esi + eax], cx
lea eax, [eax + 2]
test cx, cx
jne 0x413c91
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004b94b6
mov esp, ebp
pop ebp
ret
Function at 0x415213
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x434
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, ecx
push edi
push 0x32
push ebx
mov dword [esp + 0x28], ebx
call esi
push 0x33
push ebx
mov ebp, eax
call esi
mov esi, eax
call fcn.0040a8ad
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push eax
push 0
push 0x1303
push ebp
call edi
and dword [esp + 0x1c], 0
lea edx, [esp + 0x14]
mov ecx, fcn.00414f61
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebp
call fcn.00407d45
push 0
push 0
push 0x1304
push ebp
mov dword [esp + 0x34], eax
call edi
test eax, eax
jle 0x4152b1
mov edx, dword [esp + 0x1c]
mov ecx, ebp
call fcn.00415175
push 0
push dword [esp + 0x20]
push 0x130c
push ebp
call edi
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x4153a6
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [esp + 0x28]
xor ebp, ebp
push eax
push ebp
push 0xb2
push esi
call edi
push 0xfffffffffffffff9
push 0xfffffffffffffff9
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
lea eax, [esp + 0x28]
push eax
push ebp
push 0xb4
push esi
call edi
push 0xf9f9f9
push ebp
push 0x443
push esi
call edi
cmp dword [esp + 0x24], ebp
jne 0x415387
mov ecx, dword [0x529a90]
lea eax, [esp + 0x38]
mov esi, 0x100
push esi
push eax
push 0xd
pop eax
push eax
call fcn.00420e3f
test eax, eax
jne 0x41533c
movzx edx, word [0x51e28e]
lea eax, [esp + 0x38]
push esi
push eax
xor edx, 0x2525
mov ecx, 0x51e290
call fcn.00412531
pop ecx
pop ecx
lea ecx, [esp + 0x38]
lea eax, [esp + 0x238]
cmp word [esp + 0x38], bp
je 0x415379
push 0xa
pop edi
push 2
pop esi
push 0xd
pop ebx
movzx edx, word [ecx]
cmp dx, di
jne 0x415369
mov word [eax], bx
add eax, esi
mov word [eax], di
jmp 0x41536c
mov word [eax], dx
add ecx, esi
add eax, esi
cmp word [ecx], bp
jne 0x415357
mov ebx, dword [esp + 0x20]
xor ecx, ecx
mov word [eax], cx
lea eax, [esp + 0x238]
jmp 0x41539c
push 0x6b82aae9
mov edx, 0xa61f7e20
mov ecx, 0xf3dc536c
call fcn.0040180b
pop ecx
push eax
push 0x33
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov eax, dword [0x529a8c]
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
mov dword [eax + 0xc], ebx
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x434
ret
Function at 0x4154a5
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov edi, ecx
mov dword [esp + 0x14], edx
push 0x32
push edi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
xor ebp, ebp
push ebp
push ebp
mov esi, eax
push 0x1304
push esi
call ebx
mov ecx, dword [esp + 0x44]
movzx eax, cx
dec eax
je 0x4155c4
dec eax
je 0x415567
dec eax
jne 0x41555f
mov dl, byte [esp + 0x14]
lea eax, [esp + 0x44]
push eax
mov ecx, esi
call fcn.004153c7
mov ebp, eax
pop ecx
cmp ebp, 0xffffffff
je 0x41555f
push dword [esp + 0x14]
mov edx, ebp
mov ecx, esi
push dword [esp + 0x48]
call fcn.00414ace
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x1c]
shr eax, 0x10
pop ecx
pop ecx
test ax, ax
jne 0x415536
push 0
push ebp
push 0x130c
push esi
call ebx
mov edx, ebp
mov ecx, esi
call fcn.00415175
push 6
pop ecx
xor eax, eax
lea edi, [esp + 0x28]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0x38], eax
lea eax, [esp + 0x24]
push eax
push ebp
push 0x133d
push esi
mov dword [esp + 0x34], 2
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret
push ebp
push ebp
push 0x130b
push esi
call ebx
mov dl, byte [esp + 0x14]
mov edi, eax
lea eax, [esp + 0x44]
mov ecx, esi
push eax
call fcn.004153c7
mov ebp, eax
pop ecx
cmp ebp, 0xffffffff
je 0x41555f
push 0
push ebp
push 0x1308
push esi
call ebx
push dword [esp + 0x44]
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp edi, ebp
jl 0x4155a5
dec edi
test edi, edi
js 0x41555f
push 0
push edi
push 0x130c
push esi
call ebx
mov edx, edi
pop edi
mov ecx, esi
pop esi
pop ebp
pop ebx
add esp, 0x30
jmp fcn.00415175
lea eax, [esp + 0x18]
mov dword [esp + 0x18], edi
push eax
push dword [esp + 0x18]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], ebp
call fcn.00414f61
pop ecx
pop ecx
push ebp
push dword [esp + 0x24]
push 0x130c
push esi
call ebx
mov edx, dword [esp + 0x20]
jmp 0x4155b6
Function at 0x4156c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x10c
mov eax, dword [0x517490]
xor eax, esp
mov dword [esp + 0x104], eax
push ebx
push ebp
push esi
push edi
mov edi, edx
mov ebx, ecx
cmp word [edi], 0x2f
jne 0x4157f9
push 0x20c31f0a
mov edx, 0xed5ecbe3
mov ecx, 0xb89de731
add edi, 2
call fcn.0040180b
pop ecx
mov ecx, edi
mov dx, word [ecx]
xor ebp, ebp
inc ebp
xor esi, esi
cmp dx, word [eax]
jne 0x41572b
test dx, dx
je 0x415727
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41572b
add ecx, 4
add eax, 4
test dx, dx
jne 0x415700
mov eax, esi
jmp 0x41572f
sbb eax, eax
or eax, ebp
test eax, eax
jne 0x415746
mov ecx, ebx
call fcn.004155f3
mov ecx, ebp
call fcn.0040c1cd
jmp 0x4158ba
push 0xa40da457
mov edx, 0x699070be
mov ecx, 0x3c535c7c
call fcn.0040180b
pop ecx
mov ecx, edi
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x415783
test dx, dx
je 0x41577f
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x415783
add ecx, 4
add eax, 4
test dx, dx
jne 0x41575d
mov eax, esi
jmp 0x415787
sbb eax, eax
or eax, ebp
test eax, eax
jne 0x415798
push ebp
push ebx
call fcn.00404c5f
pop ecx
jmp 0x415824
push 0x3e5b5a1e
mov edx, 0xf3c68ef8
mov ecx, 0xa605a20a
call fcn.0040180b
pop ecx
mov cx, word [edi]
cmp cx, word [eax]
jne 0x4157d1
test cx, cx
je 0x4157d5
mov cx, word [edi + 2]
cmp cx, word [eax + 2]
jne 0x4157d1
add edi, 4
add eax, 4
test cx, cx
jne 0x4157ad
jmp 0x4157d5
sbb esi, esi
or esi, ebp
test esi, esi
jne 0x4158ba
push 0xe6e4bec4
mov edx, 0x2b796a23
mov ecx, 0x7eba46c3
call fcn.004017ea
pop ecx
mov ecx, eax
jmp 0x4158b5
push 4
push 0xe31dfee8
mov edx, 0x2e802a03
mov ecx, 0x7b4306ef
call fcn.0040180b
pop ecx
push eax
push edi
call fcn.004bbec3
add esp, 0xc
test eax, eax
jne 0x41582a
push edi
call fcn.004202e4
pop ecx
jmp 0x4158ba
cmp word [edi + 2], 0x3a
jne 0x415876
push edi
call fcn.0041fa5d
pop ecx
test al, al
je 0x415862
push 5
xor esi, esi
mov edx, 0x2c8a7d2f
push esi
push esi
push edi
push 0xe117a9c4
mov ecx, 0x794951b7
call fcn.0040180b
pop ecx
push eax
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x4158ba
push edi
call fcn.0041fa4a
pop ecx
test al, al
je 0x4158ba
mov ecx, edi
call fcn.0041b482
jmp 0x4158ba
push 0xc8252070
mov edx, 0x5b8f498
mov ecx, 0x507bd81c
call fcn.0040180b
pop ecx
push eax
push edi
call fcn.004bbef9
pop ecx
pop ecx
test eax, eax
je 0x4158ba
xor esi, esi
lea eax, [esp + 0x10]
push esi
push esi
push 0x100
push eax
push 0xffffffffffffffff
push edi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [esp + 0x10]
call fcn.0040a983
mov ecx, dword [esp + 0x114]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b94b6
add esp, 0x10c
ret