joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4346d0
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff88
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x1f8], 0
je 0x4346f1
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0
je 0x434726
mov eax, dword [ebp - 4]
test byte [eax + 0x55], 1
jne 0x434716
mov eax, dword [ebp - 4]
call fcn.00432d54
test eax, eax
jne 0x434716
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x434850
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004340a4
jmp 0x434850
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x5c]
push eax
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x70]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x434849
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
call fcn.00436f88
push eax
call sub.user32.dll_BeginPaint
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, 0x14
mov eax, dword [ebp - 4]
call fcn.00430134
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004346d0
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 4], edx
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
lea edx, [ebp - 0x68]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x5c]
push eax
lea edx, [ebp - 0x78]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x70]
push eax
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x58]
push eax
mov eax, dword [ebp - 4]
call fcn.00436f88
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x434850
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 0x14]
push eax
call sub.gdi32.dll_DeleteObject
ret
mov esp, ebp
pop ebp
ret
Function at 0x43c97c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov eax, dword [0x45a0a8]
cmp byte [eax + 0xc], 0
je 0x43caee
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43cae7
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45c4cc], 0
jne 0x43c9d5
push 0x43caf4
call sub.kernel32.dll_GetModuleHandleA_1
mov dword [ebp - 4], eax
push 0x43cafc
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4cc], eax
cmp dword [0x458c44], 0
jne 0x43cad0
push 0x43cb0c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x458c44], eax
cmp dword [0x458c44], 0
je 0x43cad0
push 0x43cb18
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4d0], eax
push 0x43cb28
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4d4], eax
push 0x43cb3c
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4d8], eax
push 0x43cb54
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4dc], eax
push 0x43cb6c
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4e0], eax
push 0x43cb80
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4e4], eax
push 0x43cb98
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4e8], eax
push 0x43cbb0
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4ec], eax
push 0x43cbcc
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4f0], eax
push 0x43cbd8
mov eax, dword [0x458c44]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45c4f4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43caee
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ecx
pop ecx
pop ebp
ret

Function at 0x4409d8
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00402e18
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x440a27
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.004030e8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4482b0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov word [ebp - 2], ax
mov al, byte [0x448308]
mov byte [ebp - 3], al
test byte [ebp - 2], 4
je 0x4482ca
or byte [ebp - 3], 1
test byte [ebp - 2], 8
je 0x4482d4
or byte [ebp - 3], 4
test byte [ebp - 2], 1
je 0x4482de
or byte [ebp - 3], 8
test byte [ebp - 2], 2
je 0x4482e8
or byte [ebp - 3], 0x10
test byte [ebp - 2], 0x10
je 0x4482f2
or byte [ebp - 3], 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x448302
or byte [ebp - 3], 2
mov al, byte [ebp - 3]
pop ecx
pop ebp
ret
Function at 0x44830c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov al, byte [0x448350]
mov byte [ebp - 5], al
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44832d
or byte [ebp - 5], 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44833d
or byte [ebp - 5], 4
test byte [ebp - 1], 0x20
je 0x448347
or byte [ebp - 5], 2
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret

Function at 0x4502dc
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
test dl, dl
je 0x4502ee
add esp, 0xfffffff0
call fcn.004022a4
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
xor edx, edx
mov eax, dword [ebp - 4]
call fcn.00419d1c
mov eax, dword [0x459da8]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x45084c
mov eax, dword [0x459db4]
mov edx, dword [ebp - 4]
mov dword [eax + 4], edx
mov dword [eax], 0x45086c
mov eax, dword [ebp - 4]
call fcn.0045088c
push 0
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411f60]
call fcn.00401f14
mov edx, dword [ebp - 4]
mov dword [edx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411f60]
call fcn.00401f14
mov edx, dword [ebp - 4]
mov dword [edx + 0x50], eax
mov dl, 1
mov eax, dword [0x411f60]
call fcn.00401f14
mov edx, dword [ebp - 4]
mov dword [edx + 0x54], eax
mov dl, 1
mov eax, dword [0x411f60]
call fcn.00401f14
mov edx, dword [ebp - 4]
mov dword [edx + 0x58], eax
mov dl, 1
mov eax, dword [0x411f60]
call fcn.00401f14
mov edx, dword [ebp - 4]
mov dword [edx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 0x10], eax
push 0x5a
mov eax, dword [ebp - 0x10]
push eax
call sub.gdi32.dll_GetDeviceCaps
mov edx, dword [ebp - 4]
mov dword [edx + 0x40], eax
mov eax, dword [ebp - 0x10]
push eax
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x58]
push eax
mov eax, 0x44bc9c
push eax
push 0
push 0
mov eax, dword [0x459ee0]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41cacc]
call fcn.0041df34
mov edx, dword [ebp - 4]
mov dword [edx + 0x84], eax
mov dl, 1
mov eax, dword [0x41cacc]
call fcn.0041df34
mov edx, dword [ebp - 4]
mov dword [edx + 0x88], eax
mov dl, 1
mov eax, dword [0x41cacc]
call fcn.0041df34
mov edx, dword [ebp - 4]
mov dword [edx + 0x80], eax
mov eax, dword [ebp - 4]
call fcn.00450e14
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x450c60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x88]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x450c60
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x80]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
mov dword [eax + 8], 0x450c60
mov eax, dword [ebp - 4]
cmp byte [ebp - 5], 0
je 0x450476
call fcn.004022fc
pop dword fs:[0]
add esp, 0xc
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4509dc
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
xor edx, edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x450be4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x450bc2
mov dl, 1
mov eax, dword [0x41237c]
call fcn.00401f14
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00402e18
lea eax, [ebp - 0x124]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
mov dword [ebp - 0xc], eax
call sub.kernel32.dll_GetSystemDefaultLangID
movzx eax, ax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
dec eax
test eax, eax
jl 0x450bab
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x124]
call fcn.0043cd1c
test al, al
jne 0x450a85
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x124]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x450b9f
xor eax, eax
push ebp
push 0x450b98
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x124]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x450aad
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
jmp 0x450aba
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x124]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x26c], eax
mov byte [ebp - 0x268], 0
lea ecx, [ebp - 0x26c]
mov edx, 0x450bf4
lea eax, [ebp - 0x264]
call fcn.00408680
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x450b81
mov dword [ebp - 0x14], 0x100
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x450c2c
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x450b81
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x224]
mov ecx, 0x100
call fcn.004030e8
mov edx, dword [ebp - 0x270]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + eax*4 - 0x124]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp + eax*4 - 0x124]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x450b81
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x224]
mov ecx, 0x100
call fcn.004030e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450b9f
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x24]
jne 0x450a5c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dl, 1
call fcn.00415eb4
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450beb
lea eax, [ebp - 0x270]
call fcn.00402e18
ret
Function at 0x45171c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x45c518]
cmp byte [eax + 0xa5], 0
jne 0x451793
cmp dword [0x45c530], 0
jne 0x451751
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4516d8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45c530], eax
cmp dword [0x45c52c], 0
jne 0x45176c
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45c52c], eax
cmp dword [0x45c534], 0
jne 0x451793
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x451678
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45c534], eax
pop ecx
pop ebp
ret

Function at 0x45185c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call fcn.004517f4
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
je 0x45187d
xor eax, eax
call fcn.0045182c
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ShowWindow
cmp byte [ebp - 9], 0
je 0x451897
mov al, 1
call fcn.0045182c
mov esp, ebp
pop ebp
ret

Function at 0x451f60
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
mov eax, dword [0x45c518]
cmp dword [eax + 0x30], 0
je 0x45202a
mov eax, dword [ebp - 4]
cmp dword [eax + 0x94], 0
jne 0x452021
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
mov dword [ebp - 0x14], eax
mov al, byte [ebp - 5]
mov byte [ebp - 0x10], al
lea eax, [ebp - 0x14]
push eax
push 0x451ee0
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
cmp dword [eax + 8], 0
je 0x452021
push 3
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindow
mov dword [ebp - 0x14], eax
push 0xffffffffffffffec
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x451fdb
mov dword [ebp - 0x14], 0xfffffffe
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
mov eax, dword [eax + 8]
dec eax
cmp eax, 0
jl 0x452021
mov dword [ebp - 0xc], eax
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x90]
call fcn.0041432c
push eax
call sub.user32.dll_SetWindowPos
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffff
jne 0x451ff0
mov eax, dword [ebp - 4]
inc dword [eax + 0x94]
mov esp, ebp
pop ebp
ret

Function at 0x452d40
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0xa4], 0
je 0x452d85
push 0x100
lea eax, [ebp - 0x108]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
lea edx, [ebp - 0x108]
mov eax, dword [ebp - 8]
call fcn.00402f80
jmp 0x452d96
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x8c]
call fcn.00402ed8
mov esp, ebp
pop ebp
ret
Function at 0x454058
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0
je 0x4540ab
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.0043734c
test al, al
je 0x4540ab
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00436f88
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4540ab
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
call fcn.00436f88
push eax
call sub.user32.dll_ShowWindow
pop ecx
pop ebp
ret
Function at 0x472771
Capabilities:
Hash data using sha1

Disassembly:
xchg dword [esp], esi
pop esi
mov dword [edi], eax
pop edi
jmp 0x4769e4
jmp 0x4a03e9
xor eax, eax
mov dword [ebp - 8], eax

Function at 0x4b6334
Capabilities:
Packed with generic packer

Disassembly:
jmp 0x4d5f3a
sbb ebp, ecx
sbb edi, ecx
jmp 0x4dbbb7
je 0x4dbbc2
jmp 0x4ede87
xchg dword [esp], edx
pop edx
xor edi, 0x95738067
cmp eax, edi
pop edi
jne 0x4e2c43
jmp 0x4f2ea8
xor ebx, ebx
call fcn.0049e406
mov eax, dword [ebx]
imul byte [edx]
pushfd
mov edi, 0x4d8834
xchg dword [esp], edi
ret
call fcn.00467736
call fcn.0048e97f
or ah, byte [esp + edx*2]
cmp eax, 0x2c5004c8
call fcn.0048a874
adc dword [ecx + 0x48a5d21], esi
adc byte [edx - 1], ch
inc ebp
cld
jmp 0x4f847b
jmp 0x4b929e
jne 0x4bdb0e
jmp loc.004652aa
or esi, 0x457f5310
push 0x87b43ea5
call fcn.00499ee9
call fcn.004f1e68
fild word [eax - 0x29]
divps xmm6, xmmword [eax]
sti
dec esi
call fcn.004f0469
xor edi, ecx
inc ebx
invalid
push ecx
push 0x9a7a586b
pop ecx
jmp 0x4d03ec
cmp eax, 0x83
jmp 0x46df2d
jmp 0x482ef0
jmp 0x495632
rol ecx, 0x10
or ecx, 0xe427179a
xor ecx, 0xfc6f9fed
cmp eax, ecx
pop ecx
jne 0x4e82e1
call fcn.0049e406
mov edx, dword [ebx]
jmp 0x4d4f82
Function at 0x429e4f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43f230]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041de4c
mov dword [ebp - 0x14], eax
cmp dword [0x442e24], esi
jne 0x429f42
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x429ecf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x42a022
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x42a022
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x42a022
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x442e24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x442e28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x442e2c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x442e34], eax
test eax, eax
je 0x429f3f
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x442e30], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x429f67
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x429f5a
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x429f7c
push 4
pop eax
jmp 0x42a024
cmp dword [ebp - 0x14], esi
je 0x429f7c
push dword [0x442e24]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x429f61
mov eax, dword [0x442e30]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x429fda
cmp dword [0x442e34], edi
je 0x429fda
push eax
call ebx
push dword [0x442e34]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x429fda
test eax, eax
je 0x429fda
call ecx
test eax, eax
je 0x429fcf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x429fcf
test byte [ebp - 8], 1
jne 0x429fda
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x42a00a
mov eax, dword [0x442e28]
cmp eax, edi
je 0x42a007
push eax
call ebx
test eax, eax
je 0x42a007
call eax
mov esi, eax
test esi, esi
je 0x42a007
mov eax, dword [0x442e2c]
cmp eax, edi
je 0x42a007
push eax
call ebx
test eax, eax
je 0x42a007
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x442e24]
call ebx
test eax, eax
je 0x42a022
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x42a024
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041a125
mov esp, ebp
pop ebp
ret
Function at 0x4025ed
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 0x10], 0
je 0x40260d
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
cmp dword [ebp + 0xc], 0
je 0x402619
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0
test ebx, ebx
je 0x402622
cmp byte [ebx], 0
jne 0x402629
xor eax, eax
jmp 0x4026da
xor ecx, ecx
mov dword [ebp - 8], ecx
xor esi, esi
jmp 0x402687
mov al, byte [ebx]
xor ecx, ecx
mov cl, al
inc ebx
cmp ecx, 0x3d
jne 0x40265b
cmp dword [ebp - 4], 0
je 0x40265b
cmp dword [ebp - 8], 0
jne 0x40265b
cmp dword [ebp + 0x10], 0
je 0x402656
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
mov dword [ebp - 8], edx
jmp 0x402686
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x402669
cmp ecx, 0xa
jne 0x402671
cmp ecx, 0xd
jne 0x40268c
inc ebx
jmp 0x40268c
mov byte [edx], al
inc edx
mov eax, dword [ebp + 8]
add eax, 0xfffffffe
cmp esi, eax
jle 0x402686
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 1
jmp 0x40268c
inc esi
cmp byte [ebx], 0
jne 0x402632
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x4026d8
mov edx, dword [ebp - 4]
mov byte [edx], 0
cmp dword [ebp - 8], 0
je 0x4026d8
push 0x1000
lea eax, [ebp - 0x1008]
push eax
push dword [ebp - 8]
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov ecx, dword [ebp + 8]
dec ecx
lea edx, [ebp - 0x1008]
mov eax, dword [ebp - 4]
call fcn.0040fd08
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov byte [edx + ecx - 1], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc