joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d334
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x466bb0]
cmp dword [eax + 0x30], 0
je 0x44d3de
cmp dword [ebx + 0x94], 0
jne 0x44d3d8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44d2c4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44d3d8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44d39e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44d3d8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004138dc
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44d3ad
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44df40
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44df75
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404088
jmp 0x44df82
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403fec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44efd4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44f015
mov eax, esi
call fcn.00435858
test al, al
je 0x44f015
mov eax, dword [ebx + 0x84]
call fcn.004355f8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44f015
push 0
mov eax, dword [ebx + 0x84]
call fcn.004355f8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x4526dc
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x45270a
mov eax, ebx
call fcn.00453190
cmp dword [ebx + 0x40], 0
je 0x452703
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x45277b
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x45276d
cmp dword [ebx + 8], 0
je 0x45272c
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x45273e
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x45276d
cmp dword [ebx + 8], 0
je 0x45271f
cmp eax, 3
je 0x452751
dec eax
jne 0x45271f
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x45271f
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x45271f
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x452799
cmp dword [ebx + 0x14], 0xcc
je 0x452799
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004527a4
pop ebx
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x453063]
shl eax, 2
mov dword [0x453067], eax
push edi
push ecx
xor eax, eax
mov edi, 0x45b438
mov ecx, 0x45e998
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.00401ca7
pop ecx
push 0x45302c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x45306b], eax
push 0
jmp fcn.0040c988
Function at 0x4075b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
call fcn.00406f3c
test byte [ebp + 0xd], 0xc0
jne 0x4075d4
mov eax, dword [0x459ad4]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4075e1
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x40760e
je 0x407620
sub ecx, 0x100
je 0x40762e
sub ecx, 0x100
je 0x407635
sub ecx, 0x100
je 0x407627
jmp 0x40763c
sub ecx, 0x600
je 0x407635
sub ecx, 0x100
je 0x407620
jmp 0x40763c
mov edi, 1
jmp 0x407641
mov edi, 2
jmp 0x407641
mov edi, 4
jmp 0x407641
mov edi, 5
jmp 0x407641
mov edi, 3
test byte [ebp + 0xd], 1
je 0x407668
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x45a0b8]
test al, 0x80
je 0x407661
mov ebx, 0x80
jmp 0x40767a
mov ebx, 1
jmp 0x40767a
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x40767a
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40768c
je 0x407695
dec eax
je 0x40769e
jmp 0x4076a7
mov dword [ebp - 4], 0x80000000
jmp 0x4076b6
mov dword [ebp - 4], 0x40000000
jmp 0x4076b6
mov dword [ebp - 4], 0xc0000000
jmp 0x4076b6
push 1
call fcn.004072fc
pop ecx
mov ebx, eax
jmp 0x4077a2
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4076d2
sub eax, 0x10
je 0x4076d9
sub eax, 0x10
je 0x4076e2
sub eax, 0x10
je 0x4076eb
jmp 0x4076eb
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4076f2
mov dword [ebp - 8], 1
jmp 0x4076f2
mov dword [ebp - 8], 2
jmp 0x4076f2
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40775b
call sub.KERNEL32.dll_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x407750
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x407750
add ebx, 0xffffffb2
push ebx
call fcn.004072fc
pop ecx
mov ebx, eax
jmp 0x4077a2
mov edi, esi
push edi
call fcn.00407514
pop ecx
test eax, eax
je 0x40776f
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40777b
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.0040703c
add esp, 8
mov ebx, eax
inc eax
jne 0x4077a2
push 4
call fcn.004072fc
pop ecx
push esi
call sub.KERNEL32.dll_CloseHandle
call fcn.00406f70
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40b6fc
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.dll_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret
Function at 0x40bb9c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
cmp dword [0x45ab8c], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40bc54
cmp byte [0x453062], 0
je 0x40bc0e
push 0x50
lea eax, [ebp - 0x54]
push eax
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x54]
push edx
call fcn.0040a904
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40bbf7
push 0x3a
lea edx, [ebp - 0x54]
push edx
call fcn.0040a904
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40bbf7
lea ebx, [ebp - 0x54]
jmp 0x40bbf8
inc ebx
call fcn.0040bb54
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.dll_MessageBoxA
jmp 0x40bc75
push 0xfffffffffffffff4
call sub.KERNEL32.dll_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x45ab90
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.00401348
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.dll_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x45ab93
push ebx
call sub.KERNEL32.dll_WriteFile
jmp 0x40bc75
cmp dword [0x45ab8c], 0xffffffff
je 0x40bc75
mov eax, dword [0x45ab8c]
test eax, eax
je 0x40bc75
cmp byte [eax], 0
je 0x40bc75
push esi
push eax
call fcn.0040bd04
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c37c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x45b924], 0
jne 0x40c3fd
cmp dword [0x45b940], 0
jne 0x40c3ac
call sub.KERNEL32.dll_GetEnvironmentStrings
mov dword [0x45b940], eax
test eax, eax
jne 0x40c3ac
push 0x45acb4
call fcn.0040bc8c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x45b940]
jmp 0x40c3c0
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00401348
pop ecx
mov edi, eax
test eax, eax
jne 0x40c3b8
lea edi, [ebp + 1]
push edi
call fcn.0040b3fc
pop ecx
mov ebx, eax
mov dword [0x45b928], ebx
test ebx, ebx
jne 0x40c3ea
xor eax, eax
jmp 0x40c4c0
push edi
mov edx, dword [0x45b940]
push edx
push ebx
call fcn.00401128
add esp, 0xc
jmp 0x40c41d
xor esi, esi
mov ebx, dword [0x45b924]
jmp 0x40c417
push eax
call fcn.00401348
pop ecx
test eax, eax
jne 0x40c413
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c407
lea ebx, [esi + 4]
push 4
mov dword [0x45b92c], ebx
inc ebx
push ebx
call fcn.0040a95c
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x40c440
xor eax, eax
jmp 0x40c4c0
cmp dword [0x45b924], 0
jne 0x40c471
xor esi, esi
mov ebx, dword [0x45b928]
mov eax, dword [esp]
mov ebp, eax
jmp 0x40c462
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00401348
pop ecx
mov edi, eax
test eax, eax
jne 0x40c458
jmp 0x40c4a2
xor esi, esi
mov ebx, dword [0x45b924]
mov eax, dword [esp]
mov edi, eax
jmp 0x40c49c
push eax
call fcn.00401348
pop ecx
test eax, eax
je 0x40c491
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x40c495
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x40c480
mov eax, dword [0x45b924]
test eax, eax
je 0x40c4b2
push eax
call fcn.0040b2e8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x45b924], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40d8b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0xc]
cmp esi, 0x10
jge 0x40d8de
test esi, esi
je 0x40d8de
call fcn.0040bb28
mov dword [eax], 0x13
or eax, 0xffffffff
jmp 0x40d94a
call fcn.0040d694
mov ebx, eax
test eax, eax
jne 0x40d8f9
call fcn.0040bb28
mov dword [eax], 8
or eax, 0xffffffff
jmp 0x40d94a
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 4]
mov dword [ebx + 4], edx
mov ecx, dword [ebp + 8]
mov dword [ebx + 0x14], ecx
push eax
mov edx, dword [ebp + 0x18]
push edx
push ebx
push 0x40d828
push esi
mov ecx, dword [ebp + 0x14]
push ecx
call sub.KERNEL32.dll_CreateThread
test eax, eax
jne 0x40d93e
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x718
jne 0x40d937
push 0x59
call fcn.004072fc
pop ecx
jmp 0x40d94a
call fcn.00407368
jmp 0x40d94a
mov dword [ebx + 8], eax
test edi, edi
je 0x40d94a
mov edx, dword [ebp - 4]
mov dword [edi], edx
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x40e30c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
lea eax, [ebp - 4]
push eax
call fcn.00414c88
pop ecx
push 0
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 4]
add edx, 0x48c
push edx
push 0x80000002
push ecx
call fcn.00414cbc
add esp, 0x10
test eax, eax
je 0x40e36a
push 0
push 0x4531c4
lea eax, [ebp - 4]
push eax
call fcn.00414dfc
add esp, 0xc
mov dword [ebp - 8], eax
lea edx, [ebp - 4]
push edx
call fcn.00414de4
cmp dword [ebp - 8], 0
pop ecx
jne 0x40e555
push 0
lea eax, [ebp - 4]
mov ecx, dword [ebp + 0xc]
add ecx, 0x48c
push ecx
push 0x80000002
push eax
call fcn.00414d50
add esp, 0x10
test eax, eax
je 0x40e3a8
push 1
push 0x4531c4
lea edx, [ebp - 4]
push edx
call fcn.00414ee8
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
call fcn.00414de4
pop ecx
xor eax, eax
lea edx, [ebp - 4]
mov dword [ebp - 0xc], eax
push 0
push 0x4531ce
push 0x80000002
push edx
call fcn.00414cbc
add esp, 0x10
test eax, eax
je 0x40e3e9
push 0
push 0x4531f2
lea ecx, [ebp - 4]
push ecx
call fcn.00414dfc
add esp, 0xc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.00414de4
pop ecx
cmp dword [ebp - 0xc], 0
jle 0x40e434
push 0
push 0x4531ce
push 0x80000002
lea edx, [ebp - 4]
push edx
call fcn.00414d50
add esp, 0x10
test eax, eax
je 0x40e555
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 4]
inc ecx
push ecx
push 0x4531f2
push eax
call fcn.00414ee8
add esp, 0xc
lea edx, [ebp - 4]
push edx
call fcn.00414de4
pop ecx
jmp 0x40e555
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x118]
push ecx
push 0x104
call sub.KERNEL32.dll_GetTempPathA
push 0x4531fc
lea eax, [ebp - 0x118]
push eax
lea edx, [ebp - 0x21c]
push edx
call fcn.00431208
add esp, 0xc
mov dword [ebp - 0x14], 1
jmp 0x40e537
mov ecx, dword [ebp - 0x14]
push ecx
mov eax, dword [ebp + 0xc]
add eax, 0x28
push eax
call fcn.0042d140
add esp, 8
cmp eax, 0xf
jne 0x40e534
lea edx, [ebp - 0x21c]
push edx
mov ecx, dword [ebp - 0x14]
push ecx
mov eax, dword [ebp + 0xc]
add eax, 0x28
push eax
call fcn.0042dfa4
add esp, 0xc
test eax, eax
je 0x40e4c9
mov edx, dword [ebp - 0x10]
push edx
call sub.USER32.dll_SetCursor
jmp 0x40e555
push 1
push 0
lea ecx, [ebp - 0x21c]
push ecx
call fcn.0041b424
add esp, 0xc
test eax, eax
je 0x40e529
push 0
push 0x4531ce
push 0x80000002
lea eax, [ebp - 4]
push eax
call fcn.00414d50
add esp, 0x10
test eax, eax
je 0x40e51c
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 4]
inc edx
push edx
push 0x4531f2
push ecx
call fcn.00414ee8
add esp, 0xc
lea eax, [ebp - 4]
push eax
call fcn.00414de4
pop ecx
lea edx, [ebp - 0x21c]
push edx
call fcn.00438e08
pop ecx
mov ecx, dword [ebp - 0x10]
push ecx
call sub.USER32.dll_SetCursor
jmp 0x40e555
inc dword [ebp - 0x14]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x160]
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp - 0x14]
jg 0x40e481
mov eax, dword [ebp - 0x10]
push eax
call sub.USER32.dll_SetCursor
mov esp, ebp
pop ebp
ret
Function at 0x40e55c
Capabilities:
Delete registry key
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
lea eax, [ebp - 4]
push eax
call fcn.00414c88
pop ecx
push 0
push 0x4531ce
push 0x80000002
lea edx, [ebp - 4]
push edx
call fcn.00414d50
add esp, 0x10
test eax, eax
je 0x40e5cb
push 0
push 0x4531f2
lea ecx, [ebp - 4]
push ecx
call fcn.00414dfc
add esp, 0xc
dec eax
mov dword [ebp - 8], eax
lea edx, [ebp - 4]
mov eax, dword [ebp - 8]
push eax
push 0x4531f2
push edx
call fcn.00414ee8
add esp, 0xc
lea ecx, [ebp - 4]
push ecx
call fcn.00414de4
cmp dword [ebp - 8], 0
pop ecx
jg 0x40e6b8
push 0x4531ce
push 0x80000002
call sub.ADVAPI32.dll_RegDeleteKeyA
push 0x7f02
push 0
call sub.USER32.dll_LoadCursorA
push eax
call sub.USER32.dll_SetCursor
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x114]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
push 0x453206
lea edx, [ebp - 0x114]
push edx
lea ecx, [ebp - 0x218]
push ecx
call fcn.00431208
add esp, 0xc
mov dword [ebp - 0x10], 1
jmp 0x40e69a
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp + 0xc]
add edx, 0x28
push edx
call fcn.0042d140
add esp, 8
cmp eax, 0x10
jne 0x40e697
lea ecx, [ebp - 0x218]
push ecx
mov eax, dword [ebp - 0x10]
push eax
mov edx, dword [ebp + 0xc]
add edx, 0x28
push edx
call fcn.0042dfa4
add esp, 0xc
test eax, eax
je 0x40e665
mov ecx, dword [ebp - 0xc]
push ecx
call sub.USER32.dll_SetCursor
jmp 0x40e6b8
push 1
push 0x453210
lea eax, [ebp - 0x218]
push eax
call fcn.0041b424
add esp, 0xc
test eax, eax
je 0x40e68c
lea edx, [ebp - 0x218]
push edx
call fcn.00438e08
pop ecx
mov ecx, dword [ebp - 0xc]
push ecx
call sub.USER32.dll_SetCursor
jmp 0x40e6b8
inc dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 0x160]
mov ecx, dword [edx + 8]
cmp ecx, dword [ebp - 0x10]
jg 0x40e624
mov eax, dword [ebp - 0xc]
push eax
call sub.USER32.dll_SetCursor
mov esp, ebp
pop ebp
ret

Function at 0x410978
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0x453c4e
push 0
call sub.SHELL32.dll_ShellExecuteA
xor eax, eax
pop ebp
ret
Function at 0x414ab0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push 1
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push 0x453dd4
push 0
call sub.SHELL32.dll_ShellExecuteA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
ja 0x414aee
push 1
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call sub.SHELL32.dll_ShellExecuteA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x20
jbe 0x414afb
xor eax, eax
jmp 0x414bf8
lea edx, [ebp - 0x408]
push edx
push 0x453dd9
push 0x80000000
call fcn.00414bfc
add esp, 0xc
test eax, eax
jne 0x414bf5
push 0x453dde
lea ecx, [ebp - 0x408]
push ecx
call fcn.0040123c
add esp, 8
lea eax, [ebp - 0x408]
push eax
lea edx, [ebp - 0x408]
push edx
push 0x80000000
call fcn.00414bfc
add esp, 0xc
test eax, eax
jne 0x414bf5
push 0x453df2
lea ecx, [ebp - 0x408]
push ecx
call fcn.004015c0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x414baf
push 0x453df7
lea eax, [ebp - 0x408]
push eax
call fcn.004015c0
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x414ba7
lea edx, [ebp - 0x408]
push edx
call fcn.00401348
pop ecx
lea ecx, [ebp - 0x409]
add eax, ecx
mov dword [ebp - 8], eax
jmp 0x414bb5
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x414bb5
mov edx, dword [ebp - 8]
mov byte [edx], 0
push 0x453dfa
mov ecx, dword [ebp - 8]
push ecx
call fcn.0040123c
add esp, 8
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 8]
push edx
call fcn.0040123c
add esp, 8
lea ecx, [ebp - 0x408]
push 0
push 0
push ecx
call fcn.0041b424
add esp, 0xc
test eax, eax
jne 0x414bf5
call sub.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x414bfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push esi
push edi
lea eax, [ebp - 8]
push eax
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.ADVAPI32.dll_RegOpenKeyExA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x414c7c
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x10c]
push edx
push 0
mov ecx, dword [ebp - 8]
push ecx
call sub.ADVAPI32.dll_RegQueryValueA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x414c73
mov eax, dword [ebp + 0x10]
lea edi, [ebp - 0x10c]
mov esi, eax
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegCloseKey
mov eax, dword [ebp - 4]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x415c08
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push 0x200
lea eax, [ebp - 0x214]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
push ecx
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x214]
push eax
call fcn.00401348
pop ecx
test eax, eax
je 0x415cd2
lea edx, [ebp - 0x14]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.00415d1c
add esp, 0xc
mov edx, dword [ebp + 8]
cmp dword [edx + 0xc], 0
je 0x415c6e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0xc]
push eax
mov edx, dword [ebp + 0xc]
push edx
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x20]
push eax
mov edx, dword [ebp + 0xc]
push edx
call sub.GDI32.dll_SetTextColor
push 1
mov ecx, dword [ebp + 0xc]
push ecx
call sub.GDI32.dll_SetBkMode
push 0
lea eax, [ebp - 0x14]
push 0x8020
push eax
lea edx, [ebp - 0x214]
push 0xffffffffffffffff
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.USER32.dll_DrawTextExA
cmp dword [ebp + 0x10], 0
je 0x415cbc
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.00415cd8
add esp, 8
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc], 0
je 0x415cd2
mov eax, dword [ebp - 4]
push eax
mov edx, dword [ebp + 0xc]
push edx
call sub.GDI32.dll_SelectObject
mov esp, ebp
pop ebp
ret
Function at 0x415d1c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde0
push 0x200
lea eax, [ebp - 0x220]
push eax
mov edx, dword [ebp + 8]
mov ecx, dword [edx + 4]
push ecx
call sub.USER32.dll_GetWindowTextA
lea eax, [ebp - 0x220]
push eax
call fcn.00401348
pop ecx
test eax, eax
jne 0x415d64
push 0
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
call sub.USER32.dll_SetRect
jmp 0x415e34
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xc], 0
je 0x415d80
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0xc]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.GDI32.dll_SelectObject
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x20]
mov edx, dword [eax + 4]
mov dword [ebp - 8], edx
push ecx
mov eax, dword [ebp - 8]
push eax
call sub.USER32.dll_GetClientRect
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0x10]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x10]
mov dword [ecx + 0xc], edx
push 0xffffffffffffffff
push 0xffffffffffffffff
mov eax, dword [ebp + 0x10]
push eax
call sub.USER32.dll_InflateRect
push 0
push 0x8420
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x220]
push edx
push 0xffffffffffffffff
push ecx
mov eax, dword [ebp + 0xc]
push eax
call sub.USER32.dll_DrawTextExA
mov dword [ebp - 0xc], eax
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx + 4]
add ecx, dword [ebp - 0xc]
mov dword [eax + 0xc], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0xc]
mov ecx, dword [edx + 4]
neg ecx
sar eax, 1
jns 0x415e0a
adc eax, 0
add ecx, eax
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 1
mov ecx, dword [ebp + 0x10]
push ecx
call sub.USER32.dll_OffsetRect
mov eax, dword [ebp + 8]
cmp dword [eax + 0xc], 0
je 0x415e34
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
call sub.GDI32.dll_SelectObject
mov esp, ebp
pop ebp
ret
Function at 0x41b424
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffcac
push esi
push edi
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.00401198
lea edi, [ebp - 0x354]
add esp, 0xc
mov dword [ebp - 0x44], 0x44
mov eax, edi
mov esi, 0x454c00
movsb byte es:[edi], byte [esi]
cmp dword [ebp + 8], 0
je 0x41b485
push pe_nt_image_headers32
lea edx, [ebp - 0x154]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.dll_GetShortPathNameA
lea eax, [ebp - 0x154]
push eax
lea edx, [ebp - 0x354]
push edx
call fcn.0040123c
add esp, 8
cmp dword [ebp + 0xc], 0
je 0x41b4b8
cmp dword [ebp + 8], 0
je 0x41b4a5
push 0x454c01
lea ecx, [ebp - 0x354]
push ecx
call fcn.0040123c
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x354]
push edx
call fcn.0040123c
add esp, 8
lea ecx, [ebp - 0x54]
lea eax, [ebp - 0x44]
push ecx
push eax
push 0
push 0
push 0
push 1
push 0
lea edx, [ebp - 0x354]
push 0
push edx
push 0
call sub.KERNEL32.dll_CreateProcessA
test eax, eax
je 0x41b4f6
cmp dword [ebp + 0x10], 0
je 0x41b4ef
push 0xffffffffffffffff
mov ecx, dword [ebp - 0x54]
push ecx
call sub.KERNEL32.dll_WaitForSingleObject
mov eax, 1
jmp 0x41b4f8
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret