joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41770a
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
push 0x461d10
call fcn.00401000
add esp, 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call fcn.00418900
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
mov dword [ebp - 0x1c], eax
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [ebp - 0x18], eax
push 0
push 0x461d40
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0x10], eax
push 0x461d50
push 0x461d58
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 8], eax
push 0
push 0x461d60
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.USER32.dll_FindWindowExA]
mov dword [ebp - 0xc], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x41784a
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 0x1c]
je 0x41784a
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x18]
je 0x41784a
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp - 0x10]
je 0x41784a
mov edx, dword [ebp - 0x20]
cmp edx, dword [ebp - 8]
je 0x41784a
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0xc]
je 0x41784a
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x417816
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
jne 0x417816
mov eax, dword [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x417836
push 0x461d70
push 0x461d7c
push 0x461dc4
push 0x461dd4
mov ecx, dword [ebp - 4]
call fcn.0041200b
xor eax, eax
jmp 0x417868
push 0x461dd8
call fcn.00401000
add esp, 4
mov eax, 1
jmp 0x417868
push 0x461df0
push 0x461dfc
push 0x461e44
push 0x461e54
mov ecx, dword [ebp - 4]
call fcn.0041200b
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x4185e1
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c4
mov dword [ebp - 0x3c4], ecx
push 0x4621e4
call fcn.00401000
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x3bc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x20
push 0
lea ecx, [ebp - 0x22c]
push ecx
call fcn.0042aa90
add esp, 0xc
lea edx, [ebp - 0x3c0]
push edx
lea eax, [ebp - 0x22c]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00418940
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
je 0x41866b
push 0x462214
call fcn.00401000
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x418748
mov edx, dword [ebp - 0x3c0]
mov dword [ebp - 0x108], edx
jmp 0x418688
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 0x108], ecx
cmp dword [ebp - 0x108], 0
je 0x418720
push 2
push 0
push 0
push 0x100
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp - 0x108]
mov ecx, dword [eax + 0x10]
push ecx
mov edx, dword [ebp - 0x108]
mov eax, dword [edx + 0x18]
push eax
call fcn.004196f0
mov ecx, dword [ebp - 0x108]
cmp dword [ecx + 4], 2
jne 0x4186ec
lea edx, [ebp - 0x208]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0042a2c0
add esp, 8
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
jmp 0x418748
mov ecx, dword [ebp - 0x108]
cmp dword [ecx + 4], 0x17
jne 0x41871b
cmp dword [ebp - 4], 0
jne 0x41871b
mov dword [ebp - 4], 1
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x104]
push eax
call fcn.0042a2c0
add esp, 8
jmp 0x418679
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp dword [ebp - 4], 0
je 0x418746
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0042a2c0
add esp, 8
mov eax, 1
jmp 0x418748
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x41874e
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c4
mov dword [ebp - 0x1c4], ecx
push 0x462250
call fcn.00401000
add esp, 4
mov dword [ebp - 4], 0
lea eax, [ebp - 0x1bc]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x20
push 0
lea ecx, [ebp - 0x2c]
push ecx
call fcn.0042aa90
add esp, 0xc
lea edx, [ebp - 0x1c0]
push edx
lea eax, [ebp - 0x2c]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00418940
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4187c9
push 0x46227c
call fcn.00401000
add esp, 4
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
jmp 0x41881a
mov edx, dword [ebp - 0x1c0]
mov dword [ebp - 8], edx
jmp 0x4187dd
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x1c]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x418805
mov edx, dword [ebp - 8]
cmp dword [edx + 4], 2
jne 0x4187f3
mov eax, 2
jmp 0x41881a
mov eax, dword [ebp - 8]
cmp dword [eax + 4], 0x17
jne 0x418803
mov dword [ebp - 4], 1
jmp 0x4187d4
call dword [sym.imp.WS2_32.dll_WSACleanup]
cmp dword [ebp - 4], 0
je 0x418818
mov eax, 0x17
jmp 0x41881a
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x418990
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0x4622fc
mov dword [ebp - 0x18], 0x418c10
mov dword [ebp - 0x14], 0x4622f0
mov dword [ebp - 0x10], 0x419450
mov dword [ebp - 0xc], 0x4622e0
mov dword [ebp - 8], fcn.00418ba0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
cmp dword [0x46cf18], 0
je 0x4189f5
mov eax, dword [ebp + 8]
and eax, 0xffff
mov eax, dword [eax*8 + 0x4622cc]
jmp 0x418b8f
push 0x104
lea ecx, [ebp - 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x418a10
jmp 0x418aea
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x130]
push eax
call fcn.0042a2c0
add esp, 8
push 0x4622c0
lea ecx, [ebp - 0x130]
push ecx
call fcn.0042a2d0
add esp, 8
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418a79
push 0x4622fc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x418a79
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x418a81
jmp 0x418aea
lea edx, [ebp - 0x238]
push edx
lea eax, [ebp - 0x130]
push eax
call fcn.0042a2c0
add esp, 8
push 0x4622b8
lea ecx, [ebp - 0x130]
push ecx
call fcn.0042a2d0
add esp, 8
lea edx, [ebp - 0x130]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418aea
push 0x4622fc
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x418aea
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x418b75
mov dword [ebp - 0x20], 0
jmp 0x418b06
mov edx, dword [ebp - 0x20]
add edx, 1
mov dword [ebp - 0x20], edx
cmp dword [ebp - 0x20], 3
jge 0x418b44
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*8 - 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x20]
mov dword [ebp + ecx*8 - 0x18], eax
mov edx, dword [ebp - 0x20]
cmp dword [ebp + edx*8 - 0x18], 0
jne 0x418b42
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], 0
jmp 0x418b44
jmp 0x418afd
cmp dword [ebp - 4], 0
je 0x418b75
mov dword [ebp - 0x20], 0
jmp 0x418b5c
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
cmp dword [ebp - 0x20], 3
jge 0x418b75
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + eax*8 - 0x18]
mov dword [edx*8 + 0x4622cc], ecx
jmp 0x418b53
mov dword [0x46cf18], 1
mov edx, dword [ebp + 8]
and edx, 0xffff
mov eax, dword [edx*8 + 0x4622cc]
mov esp, ebp
pop ebp
ret 4
Function at 0x4192a0
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp - 4]
mov dword [ecx], 0
mov edx, dword [ebp + 0x18]
mov byte [edx], 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41936d
mov ecx, dword [ebp - 0xc]
movsx edx, word [ecx + 8]
cmp edx, 2
jne 0x419348
mov eax, dword [ebp - 0xc]
movsx ecx, word [eax + 0xa]
cmp ecx, 4
jne 0x419348
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 8], eax
jmp 0x419305
mov ecx, dword [ebp - 8]
add ecx, 4
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp dword [edx], 0
je 0x419348
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ecx]
push edx
mov ax, word [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00419080
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov edx, dword [ebp - 4]
cmp dword [edx], 0
jne 0x41933b
mov eax, 8
jmp 0x4193b2
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 0x1c
mov dword [ebp - 4], ecx
jmp 0x4192fc
push 0x400
mov edx, dword [ebp - 0xc]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.0042a840
add esp, 0xc
mov edx, dword [ebp + 0x18]
mov byte [edx + 0x400], 0
xor eax, eax
jmp 0x4193b2
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
sub eax, 0x2af9
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 3
ja case.default.0x41938a
mov ecx, dword [ebp - 0x10]
jmp dword [ecx*4 + 0x4193b8]
mov eax, 0x2af9
jmp 0x4193b2
mov eax, 0x2afa
jmp 0x4193b2
mov eax, 0x2afb
jmp 0x4193b2
mov eax, 0x2af9
jmp 0x4193b2
mov eax, 0x2af9
mov esp, ebp
pop ebp
ret 0x18

Function at 0x419944
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x18
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x419ccc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp - 4]
mov dword [edx + 0x14], eax
push 0x4623ac
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 4]
cmp dword [eax + 0x14], 0
jne 0x419987
xor eax, eax
jmp 0x419999
push 0x4623bc
call fcn.00401000
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x41999d
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x4623fc
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
je 0x4199f0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x4199f0
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push 0x46241c
call fcn.00401000
add esp, 4
push 0x46242c
call fcn.00401000
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x419a01
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x46244c
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 8]
cmp dword [eax + 0x14], 0
je 0x419a54
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [ebp - 4], 0x103
jne 0x419a54
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x46246c
call fcn.00401000
add esp, 4
push 0x46247c
call fcn.00401000
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x419a65
Capabilities:
Get common file path
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d502
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x220
push edi
mov byte [ebp - 0x200], 0
mov ecx, 0x7c
xor eax, eax
lea edi, [ebp - 0x1ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x1f4
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x46249c
lea ecx, [ebp - 0x200]
push ecx
call fcn.0042a2d0
add esp, 8
lea ecx, [ebp - 0x21c]
call fcn.00422eca
mov dword [ebp - 4], 0
push 0
lea edx, [ebp - 0x200]
push edx
lea ecx, [ebp - 0x21c]
call fcn.00422f8d
test eax, eax
jne 0x419b14
mov dword [ebp - 0x220], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00422f07
mov eax, dword [ebp - 0x220]
jmp 0x419cbd
lea eax, [ebp - 0x200]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x46cf38], eax
cmp dword [0x46cf38], 0
jne 0x419b63
push 0x4624ac
call fcn.00401000
add esp, 4
mov dword [ebp - 0x224], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00422f07
mov eax, dword [ebp - 0x224]
jmp 0x419cbd
mov dword [0x46cf20], 0
mov dword [0x46cf24], 0
mov dword [0x46cf28], 0
mov dword [0x46cf2c], 0
mov dword [0x46cf30], 0
mov dword [0x46cf34], 0
push 0x4624d0
mov ecx, dword [0x46cf38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46cf20], eax
push 0x4624e8
mov edx, dword [0x46cf38]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46cf24], eax
push 0x462504
mov eax, dword [0x46cf38]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46cf28], eax
push 0x462520
mov ecx, dword [0x46cf38]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46cf2c], eax
push 0x462544
mov edx, dword [0x46cf38]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46cf30], eax
push 0x462568
mov eax, dword [0x46cf38]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46cf34], eax
cmp dword [0x46cf20], 0
je 0x419c5d
cmp dword [0x46cf24], 0
je 0x419c5d
cmp dword [0x46cf28], 0
je 0x419c5d
cmp dword [0x46cf2c], 0
je 0x419c5d
cmp dword [0x46cf34], 0
je 0x419c5d
cmp dword [0x46cf30], 0
jne 0x419c9b
mov ecx, dword [0x46cf38]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x462588
call fcn.00401000
add esp, 4
mov dword [ebp - 0x228], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00422f07
mov eax, dword [ebp - 0x228]
jmp 0x419cbd
mov dword [ebp - 0x22c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x21c]
call fcn.00422f07
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41c103
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d5c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x14], 0xff
push 0x462e88
call fcn.00401000
add esp, 4
push 0x462ea4
lea ecx, [ebp - 0x10]
call fcn.0043df01
mov dword [ebp - 4], 0
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x10]
call fcn.00404600
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41c1d5
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 0x46cf40
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x41c1be
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
push 0x462ecc
call fcn.00401000
add esp, 8
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0043de93
mov eax, dword [ebp - 0x1c]
jmp 0x41c1fb
push 0x462edc
call fcn.00401000
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x462ef0
call fcn.00401000
add esp, 4
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0043de93
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41c299
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x41c2c1
xor eax, eax
jmp 0x41c323
mov ecx, dword [ebp - 0x84]
mov dword [ebp - 0x98], ecx
cmp dword [ebp - 0x98], 1
je 0x41c2e1
cmp dword [ebp - 0x98], 2
je 0x41c2f8
jmp 0x41c31a
cmp dword [ebp - 0x8c], 0xa
jb 0x41c2f1
mov eax, 1
jmp 0x41c323
mov eax, 3
jmp 0x41c323
cmp dword [ebp - 0x90], 4
jne 0x41c308
mov eax, 2
jmp 0x41c323
cmp dword [ebp - 0x90], 5
jb 0x41c318
mov eax, 2
jmp 0x41c323
jmp 0x41c321
mov eax, 3
jmp 0x41c323
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x41c327
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d5e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 4
lea eax, [ebp - 0x14]
push eax
push 0x20006
push 0
lea ecx, [ebp + 8]
call fcn.00404600
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41c3d2
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
lea ecx, [ebp + 0xc]
call fcn.00404600
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x41c3c8
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x18], 1
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043de93
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043de93
mov eax, dword [ebp - 0x18]
jmp 0x41c3f7
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x1c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043de93
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043de93
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41c407
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44d600
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x1c], 4
lea ecx, [ebp + 8]
call fcn.00404600
push eax
push 0x462f20
call fcn.00401000
add esp, 8
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
lea ecx, [ebp + 8]
call fcn.00404600
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41c522
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 0x10]
push edx
lea eax, [ebp - 0x18]
push eax
push 0
lea ecx, [ebp + 0xc]
call fcn.00404600
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x41c4d5
mov edx, dword [ebp + 0x10]
cmp dword [edx], 0
je 0x41c4b7
mov dword [ebp - 0x30], 0x462f44
jmp 0x41c4be
mov dword [ebp - 0x30], 0x462f4c
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0x462f54
call fcn.00401000
add esp, 0xc
jmp 0x41c516
mov edx, dword [ebp + 0xc]
push edx
push 0x462f74
call fcn.00401000
add esp, 8
mov eax, dword [ebp + 0x10]
mov dword [eax], 0
mov dword [ebp - 0x20], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043de93
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043de93
mov eax, dword [ebp - 0x20]
jmp 0x41c56e
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41c549
mov dword [ebp - 0x24], 0xffffffff
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043de93
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043de93
mov eax, dword [ebp - 0x24]
jmp 0x41c56e
mov dword [ebp - 0x28], 0
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043de93
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043de93
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x420da1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44dc18
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x440
push edi
mov dword [ebp - 0x440], ecx
mov byte [ebp - 0x318], 0
mov ecx, 0x7f
xor eax, eax
lea edi, [ebp - 0x317]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x200
lea eax, [ebp - 0x318]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x420dfc
xor eax, eax
jmp 0x420f6a
call fcn.00404650
mov dword [ebp - 0x118], eax
push 0x104
push 0
lea ecx, [ebp - 0x114]
push ecx
call fcn.0042aa90
add esp, 0xc
mov edx, dword [ebp - 0x118]
mov eax, dword [edx + 0xf0]
push eax
push 0x463acc
lea ecx, [ebp - 0x114]
push ecx
call fcn.0042ada4
add esp, 0xc
lea edx, [ebp - 0x114]
push edx
push 0x463af0
call fcn.00414290
add esp, 8
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0x114]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x420e84
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x420f6a
mov eax, dword [ebp - 0x118]
mov ecx, dword [eax + 0xf0]
push ecx
lea edx, [ebp - 0x318]
push edx
push 0x463b0c
lea eax, [ebp - 0x318]
push eax
call fcn.0042ada4
add esp, 0x10
push ecx
mov ecx, esp
mov dword [ebp - 0x438], esp
lea edx, [ebp - 0x318]
push edx
call fcn.0043df01
mov dword [ebp - 0x444], eax
lea eax, [ebp - 0x43c]
push eax
mov ecx, dword [ebp - 0x118]
call fcn.00409bdf
mov dword [ebp - 0x448], eax
mov ecx, dword [ebp - 0x448]
mov dword [ebp - 0x44c], ecx
mov dword [ebp - 4], 0
mov edx, dword [ebp - 0x44c]
push edx
mov ecx, dword [ebp - 0x440]
add ecx, 0x44
call fcn.0043dfcc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x43c]
call fcn.0043de93
lea eax, [ebp - 0x318]
push eax
push 0x463b28
call fcn.00414290
add esp, 8
lea ecx, [ebp - 0x430]
push ecx
lea edx, [ebp - 0x318]
push edx
call fcn.0042a93e
add esp, 8
mov dword [ebp - 0x434], eax
cmp dword [ebp - 0x434], 0xffffffff
jne 0x420f56
xor eax, eax
jmp 0x420f6a
mov eax, dword [ebp - 0x434]
push eax
call fcn.0042aa0b
add esp, 4
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x421b19
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x20], ecx
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x14]
call fcn.00421fc0
push 0
push 0x463b8c
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x421b70
lea ecx, [ebp - 0x14]
call fcn.00407830
push eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x14]
push ecx
push 0x421ab9
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x421ba4
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x18], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x1c]
sub edx, 0x14
push edx
mov eax, dword [ebp - 0x18]
sub eax, 0x28
push eax
lea ecx, [ebp - 0x14]
call fcn.00422070
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp - 0x10]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0xc]
mov dword [ecx + 8], edx
mov eax, dword [ebp - 8]
mov dword [ecx + 0xc], eax
mov eax, dword [ebp + 8]
mov esp, ebp
pop ebp
ret 4

Function at 0x422130
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x422188
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x467e4c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42217b
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x42218a
xor eax, eax
pop esi
leave
ret 4