joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411df0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x20], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x411e5a
cmp dword [ebp - 0x24], 1
je 0x411e14
jmp 0x411eaa
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x411e32
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.MSVCR90.dll_exit]
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp + 0xc], 0
jne 0x411e53
mov eax, 1
jmp 0x411ead
mov dword [ebp - 0x20], 1
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x411eaa
cmp dword [ebp - 0x18], 0x12
jne 0x411e80
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.MSVCR90.dll_exit]
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [ebp + 0xc], 0
jne 0x411ea1
mov eax, 1
jmp 0x411ead
mov dword [ebp - 0x20], 1
jmp 0x411e5a
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret
Function at 0x419e90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x14], 0
jmp 0x419ea8
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp + 0xc]
jge 0x41a00a
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
sub edx, 1
mov dword [ebp - 0x18], edx
cmp dword [ebp - 0x18], 0x13
ja case.0x419ee0.2
mov eax, dword [ebp - 0x18]
movzx ecx, byte [eax + 0x41a02c]
jmp dword [ecx*4 + 0x41a010]
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [ebp - 8]
sub edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov dword [ebp - 0x1c], edx
fild dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x10]
fstp qword [ecx + eax + 8]
mov edx, dword [ebp - 4]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov dword [ebp - 0x20], edx
fild dword [ebp - 0x20]
mov ecx, dword [ebp + 0x10]
fstp qword [ecx + eax + 0x10]
jmp 0x41a005
push 0x434118
push 8
push 0x87
push 0x434124
call fcn.0040b010
add esp, 0x10
or eax, 0xffffffff
jmp 0x41a00c
mov edx, dword [0x43b958]
push edx
mov eax, dword [0x43b954]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x43b954]
mov dword [ecx + eax + 8], edx
jmp 0x41a005
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
push 0x43413c
mov edx, dword [0x43b954]
push edx
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
mov eax, dword [ebp - 0x14]
imul eax, eax, 0x28
mov ecx, dword [ebp + 0x10]
mov edx, dword [0x43b954]
mov dword [ecx + eax + 8], edx
jmp 0x41a005
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x10]
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax + edx + 8], ecx
jmp 0x41a005
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov ecx, dword [ecx + 0x14]
mov dword [eax + edx + 8], ecx
jmp 0x41a005
mov edx, dword [ebp - 0x14]
imul edx, edx, 0x28
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax + edx]
push ecx
push 1
push 0x98
push str..wsmswin32glabel.c
call fcn.0040b010
add esp, 0x10
or eax, 0xffffffff
jmp 0x41a00c
jmp 0x419e9f
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41a2f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [0x43f024], 1
mov dword [0x43f004], 0xffffffff
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
movsx ecx, ax
test ecx, ecx
jge 0x41a32c
mov dword [ebp - 0x28], 0
jmp 0x41a333
mov dword [ebp - 0x28], 2
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x28]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push 0
push 0x3e7
push 0x111
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0x111
push 0x111
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0xc]
push eax
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
jne 0x41a3a8
push str.exit_code_in_GetMessage
push str.GMmenudisplay
push 0x6b
push str..wsmswin32gmenu.c
call fcn.00401c80
add esp, 0x10
lea edx, [ebp - 0x24]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov dword [0x43f014], 1
mov eax, dword [0x43f004]
mov esp, ebp
pop ebp
ret
Function at 0x422e80
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
jl 0x422ea9
mov eax, dword [ebp + 8]
cmp eax, dword [0x43eff4]
jge 0x422ea9
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x1c
mov edx, dword [0x43eff8]
cmp dword [edx + ecx], 0
jne 0x422eb1
or eax, 0xffffffff
jmp 0x422f54
mov eax, dword [ebp + 8]
imul eax, eax, 0x1c
add eax, dword [0x43eff8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x422ed7
cmp dword [ebp - 0xc], 2
je 0x422f17
jmp 0x422f48
mov eax, dword [ebp + 0x10]
sub eax, 1
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xc]
push eax
call dword [sym.imp.MSVCR90.dll__fileno]
add esp, 4
push eax
call sub.MSVCR90.dll__read
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x422f0b
or eax, 0xffffffff
jmp 0x422f54
cmp dword [ebp - 8], 0
jne 0x422f15
xor eax, eax
jmp 0x422f54
jmp 0x422f48
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0x10]
sub edx, 1
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x422f3e
or eax, 0xffffffff
jmp 0x422f54
cmp dword [ebp - 8], 0
jne 0x422f48
xor eax, eax
jmp 0x422f54
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
mov byte [eax], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x422f60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [ebp + 8], 0
jl 0x422f89
mov eax, dword [ebp + 8]
cmp eax, dword [0x43eff4]
jge 0x422f89
mov ecx, dword [ebp + 8]
imul ecx, ecx, 0x1c
mov edx, dword [0x43eff8]
cmp dword [edx + ecx], 0
jne 0x422f91
or eax, 0xffffffff
jmp 0x423051
mov eax, dword [ebp + 8]
imul eax, eax, 0x1c
add eax, dword [0x43eff8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0
je 0x422fba
cmp dword [ebp - 0xc], 2
je 0x423004
jmp 0x42304f
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.MSVCR90.dll_fputs]
add esp, 8
cmp eax, 0xffffffff
je 0x422fed
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x10]
push ecx
push 0x435300
call dword [sym.imp.MSVCR90.dll_fputs]
add esp, 8
cmp eax, 0xffffffff
jne 0x422ff2
or eax, 0xffffffff
jmp 0x423051
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call dword [sym.imp.MSVCR90.dll_fflush]
add esp, 4
jmp 0x42304f
push 0
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sub.MSVCR90.dll_strlen
add esp, 4
push eax
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x42304a
push 0
lea eax, [ebp - 8]
push eax
push 1
push 0x435304
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x42304f
or eax, 0xffffffff
jmp 0x423051
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4232f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [0x43efec], eax
mov ecx, dword [ebp + 0xc]
mov dword [0x43eff0], ecx
mov dword [0x43f0a4], 0
mov dword [0x43b9f8], 0
mov dword [0x43b9fc], 0
push 0
call fcn.00401360
add esp, 4
call fcn.00409200
mov dword [0x43f068], 1
mov dword [0x43f074], 2
mov dword [0x43f058], 1
mov dword [0x43f064], 1
mov edx, dword [0x43f0a8]
push edx
call fcn.00423880
add esp, 4
mov eax, dword [sym.imp.MSVCR90.dll___argv]
mov ecx, dword [eax]
add ecx, 4
mov edx, dword [sym.imp.MSVCR90.dll___argv]
mov dword [edx], ecx
mov eax, dword [sym.imp.MSVCR90.dll___argc]
mov ecx, dword [eax]
sub ecx, 1
mov edx, dword [sym.imp.MSVCR90.dll___argc]
mov dword [edx], ecx
mov eax, dword [sym.imp.MSVCR90.dll___argv]
mov ecx, dword [eax]
push ecx
mov edx, dword [sym.imp.MSVCR90.dll___argc]
mov eax, dword [edx]
push eax
call fcn.004239c0
add esp, 8
push 0
push 0x43f0c0
call sub.MSVCR90.dll__setjmp3
add esp, 8
test eax, eax
je 0x4233c2
jmp 0x423570
call fcn.00401000
call fcn.004226b0
push 0x413990
call fcn.00424490
add esp, 4
call fcn.00428130
call fcn.00425280
call fcn.00406a10
call fcn.00426c80
call fcn.00401e40
call fcn.00420a80
sub esp, 0x20
mov ecx, 8
mov esi, 0x4354a0
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0042a010
add esp, 0x20
call fcn.00413780
cmp dword [0x43b9f8], 0
je 0x423466
mov dword [ebp - 0x18], 0
mov ecx, dword [0x43b9f8]
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 1
lea edx, [ebp - 0x18]
push edx
call fcn.00425300
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x423466
mov eax, dword [ebp - 4]
push eax
call fcn.00406ba0
add esp, 4
jmp 0x423443
cmp dword [0x43b9fc], 0
je 0x4234b7
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x14], 0
mov ecx, dword [0x43b9fc]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 8], 1
lea edx, [ebp - 0x18]
push edx
call fcn.00425300
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4234b7
mov eax, dword [ebp - 4]
push eax
call fcn.00406ba0
add esp, 4
jmp 0x423494
cmp dword [0x43ba00], 0
je 0x4234c5
jmp 0x423570
call fcn.0042a910
mov dword [0x43f038], 0
cmp dword [0x43f038], 0
je 0x4234ec
call fcn.004148e0
mov dword [0x43f038], 0
cmp dword [0x43f04c], 0
jle 0x423508
call fcn.004143f0
push 0
push 0
call fcn.00411df0
add esp, 8
jmp 0x423553
cmp dword [0x43ebf8], 0
je 0x42352b
push 0
call fcn.00423590
add esp, 4
test eax, eax
jne 0x423529
push 1
call fcn.00424bd0
add esp, 4
jmp 0x423553
cmp dword [0x43f0a4], 0
je 0x423549
push 0
call fcn.00423590
add esp, 4
test eax, eax
jne 0x423547
call fcn.00415100
jmp 0x423553
push 1
call fcn.00423590
add esp, 4
cmp dword [0x43f070], 0
je 0x42356b
call fcn.0042a910
mov dword [0x43f070], 0
jmp 0x4234d4
call fcn.00423d60
push 0
call dword [sym.imp.MSVCR90.dll_exit]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x423d20
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push str.Usage:_lefty__options___file__n
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
call dword [sym.imp.MSVCR90.dll_fprintf]
add esp, 8
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
mov eax, dword [0x435690]
push eax
call dword [sym.imp.MSVCR90.dll_fputs]
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_exit]
pop ebp
ret

Function at 0x42b913
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436924]
jne 0x42b91d
repz ret
jmp fcn.0042bd75
Function at 0x100474a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x10062c4]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x10047df
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1004768
sub eax, edx
sar eax, 1
mov ecx, 0x104
cmp eax, ecx
ja 0x10047df
push esi
push ecx
lea eax, [ebp - 0x20c]
push eax
call sub.msvcrt.dll_wcscpy_s
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x1004799
sub eax, edx
sar eax, 1
lea eax, [ebp + eax*2 - 0x20c]
dec eax
dec eax
movzx ecx, word [eax]
cmp cx, 0x5c
je 0x10047bf
cmp cx, 0x2f
jne 0x10047c6
xor ecx, ecx
mov word [eax], cx
jmp 0x10047ae
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x10047e1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.010051c2
leave
ret
Function at 0x10047f2
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x768
mov eax, dword [0x10062c4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push dword [edi + 4]
mov dword [ebp - 0x768], eax
mov ebx, 0x104
lea eax, [ebp - 0x20c]
push ebx
push eax
call sub.msvcrt.dll_wcscpy_s
mov ecx, dword [edi + 4]
mov eax, ecx
add esp, 0xc
lea edx, [eax + 2]
mov si, word [eax]
inc eax
inc eax
test si, si
jne 0x1004832
sub eax, edx
sar eax, 1
sub ebx, eax
mov eax, ecx
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x1004847
sub eax, ecx
sar eax, 1
push 0x1001ed8
lea eax, [ebp + eax*2 - 0x20c]
push ebx
push eax
mov dword [ebp - 0x764], eax
call sub.msvcrt.dll_wcscpy_s
add esp, 0xc
lea eax, [ebp - 0x75c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x760], eax
cmp eax, 0xffffffff
jne 0x10048a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x12
neg eax
sbb eax, eax
jmp 0x1004a2d
mov ecx, 0x1001ed4
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10048d3
test dx, dx
je 0x10048cf
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10048d3
add eax, 4
add ecx, 4
test dx, dx
jne 0x10048ad
xor eax, eax
jmp 0x10048d8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10049f3
mov ecx, 0x1001ecc
lea eax, [ebp - 0x730]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x1004911
test dx, dx
je 0x100490d
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x1004911
add eax, 4
add ecx, 4
test dx, dx
jne 0x10048eb
xor eax, eax
jmp 0x1004916
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x10049f3
lea eax, [ebp - 0x730]
push eax
call dword [sym.imp.msvcrt.dll__wcslwr]
push eax
push ebx
push dword [ebp - 0x764]
call sub.msvcrt.dll_wcscpy_s
mov eax, dword [edi + 0xc]
add esp, 0x10
test eax, eax
je 0x1004957
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call sub.msvcrt.dll_wcscat_s
add esp, 0xc
push 0x104
lea eax, [ebp - 0x730]
push eax
push dword [edi + 8]
call fcn.01004cb1
test eax, eax
je 0x10049f3
cmp dword [edi + 0xc], 0
je 0x10049d0
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
lea eax, [ebp - 0x30c]
push eax
lea edx, [ebp - 0x20c]
call fcn.01004677
test eax, eax
je 0x10049d0
test byte [ebp - 0x75c], 0x10
je 0x10049f3
lea esi, [ebp - 0x30c]
call fcn.0100474a
test eax, eax
je 0x10049f3
lea eax, [ebp - 0x40c]
push eax
lea eax, [ebp - 0x50c]
push eax
mov eax, esi
push eax
mov eax, dword [ebp + 8]
call fcn.010044bc
jmp 0x10049f3
lea esi, [ebp - 0x20c]
call fcn.0100474a
test eax, eax
je 0x10049f3
mov eax, esi
push eax
mov eax, dword [ebp - 0x768]
call fcn.01004595
mov esi, eax
test esi, esi
jne 0x1004a10
lea eax, [ebp - 0x75c]
push eax
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov esi, eax
test esi, esi
jne 0x10048a2
push dword [ebp - 0x760]
call dword [sym.imp.KERNEL32.dll_FindClose]
test esi, esi
jne 0x1004a2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1004a2b
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.010051c2
leave
ret 8
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410004]
jne 0x40100a
repz ret
jmp fcn.004015ec

Function at 0x407e2f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00401cbf
and dword [ebp - 4], 0
cmp dword [0x411ed4], 0
mov ebx, eax
jne 0x407ee0
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407f91
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407f91
push eax
call fcn.00401c4d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x411ed4], eax
call esi
push eax
call fcn.00401c4d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x411ed8], eax
call esi
push eax
call fcn.00401c4d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x411edc], eax
call esi
push eax
call fcn.00401c4d
pop ecx
mov dword [0x411ee4], eax
test eax, eax
je 0x407ee0
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00401c4d
pop ecx
mov dword [0x411ee0], eax
mov eax, dword [0x411ee0]
cmp eax, ebx
je 0x407f38
cmp dword [0x411ee4], ebx
je 0x407f38
push eax
call fcn.00401cc8
push dword [0x411ee4]
mov esi, eax
call fcn.00401cc8
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407f38
test edi, edi
je 0x407f38
call esi
test eax, eax
je 0x407f2f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407f2f
test byte [ebp - 0xc], 1
jne 0x407f38
or dword [ebp + 0x10], 0x200000
jmp 0x407f71
mov eax, dword [0x411ed8]
cmp eax, ebx
je 0x407f71
push eax
call fcn.00401cc8
pop ecx
test eax, eax
je 0x407f71
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407f71
mov eax, dword [0x411edc]
cmp eax, ebx
je 0x407f71
push eax
call fcn.00401cc8
pop ecx
test eax, eax
je 0x407f71
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x411ed4]
call fcn.00401cc8
pop ecx
test eax, eax
je 0x407f91
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407f93
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408976
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4089b1
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x408998
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4089a9
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4089b3
inc edi
add eax, 0x28
cmp edi, esi
jb 0x40898e
xor eax, eax
pop edi
pop esi
ret
Function at 0x408c26
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea esi, [edi + edi*8 - 1]
dec dword [ecx + 0x5d880c4d]
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00408936
out 0xdc, eax
and ecx, 0xffffff8d
inc ebp
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x40b090
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x14
mov eax, dword [0x413584]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
xor esi, esi
push 0xffffffffffffffff
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x10], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [0x41358c], esi
mov dword [0x413590], esi
mov dword [0x413594], esi
call ebp
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0xc]
push edx
push esi
push 0xf003f
push esi
push 0x411fc0
push esi
push str.SoftwareB2CB09FF_2453_4f85_9F40_21C05BE4CBA8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40b194
mov eax, dword [esp + 0x10]
sub eax, 1
je 0x40b1b6
sub eax, 1
je 0x40b118
mov dword [esp + 0x18], esi
jmp 0x40b194
mov edx, dword [esp + 8]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
lea eax, [esp + 0x14]
push eax
push esi
lea ecx, [esp + 0x24]
push ecx
push esi
push 0x4114c0
push edx
call ebx
mov eax, dword [esp + 0x14]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea ecx, [esp + 0x14]
push ecx
mov edi, eax
mov eax, dword [esp + 0x14]
push edi
lea edx, [esp + 0x24]
push edx
push esi
push str.PopupMessageAp
push eax
call ebx
push str.EAC6B3CA_E278_4446_9122_E11396A0D68E
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x40b172
lea esi, [eax + 1]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebx
cmp esi, 1
jne 0x40b194
mov eax, dword [0x413588]
push 0xffffffffffffffff
push eax
call ebp
mov dword [0x41358c], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [0x413584]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [esp + 0x18]
pop esi
pop ebp
add esp, 0x14
ret
push 0x411400
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [esp + 8]
lea ecx, [eax + eax + 2]
push ecx
push 0x411450
push 1
push esi
push 0x4114a0
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x40b180
Function at 0x40b590
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x404
mov eax, dword [0x410004]
xor eax, esp
mov dword [esp + 0x400], eax
mov eax, dword [esp + 0x408]
push esi
push 0
push eax
push 0
push 0
push 0x226
push 0x12c
push 0xc8
push 0xc8
push 0xcf0000
push 0x4112e8
push ecx
push 0
mov dword [0x413528], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
test esi, esi
jne 0x40b5fb
pop esi
mov ecx, dword [esp + 0x400]
xor ecx, esp
call fcn.00401000
add esp, 0x404
ret
mov ecx, dword [0x413554]
push 0x400
lea eax, [esp + 8]
push eax
push 0x474
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
lea edx, [esp + 4]
push edx
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [esp + 0x404]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00401000
add esp, 0x404
ret