joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439e1714
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x240], 0
je 0x439e1730
cmp dword [esi + 4], 0
je 0x439e175d
test byte [ebx + 0x55], 1
jne 0x439e174f
mov eax, ebx
call fcn.439dfafc
test eax, eax
jne 0x439e174f
mov edx, esi
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx - 0x10]
jmp 0x439e186d
mov edx, esi
mov eax, ebx
call fcn.439e111c
jmp 0x439e186d
push 0
call sub.user32.dll_GetDC
mov edi, eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push edi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push edi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x439e1866
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.439e376c
push eax
call sub.user32.dll_BeginPaint
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.439dcf44
mov eax, dword [ebp - 4]
mov dword [esi + 4], eax
mov edx, esi
mov eax, ebx
call fcn.439e1714
xor eax, eax
mov dword [esi + 4], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x50]
push eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x64]
push eax
push 0
push 0
push edi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.439e376c
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439e186d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439e8af0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x43a03f20]
cmp byte [eax + 0xc], 0
je 0x439e8c5d
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x439e8c56
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x43a07544], 0
jne 0x439e8b44
push 0x439e8c64
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x439e8c6c
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a07544], eax
cmp dword [0x43a03658], 0
jne 0x439e8c3f
push 0x439e8c7c
call sub.kernel32.dll_LoadLibraryA
mov dword [0x43a03658], eax
cmp dword [0x43a03658], 0
je 0x439e8c3f
push 0x439e8c88
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a07548], eax
push 0x439e8c98
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a0754c], eax
push 0x439e8cac
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a07550], eax
push 0x439e8cc4
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a07554], eax
push 0x439e8cdc
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a07558], eax
push 0x439e8cf0
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a0755c], eax
push 0x439e8d08
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a07560], eax
push 0x439e8d20
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a07564], eax
push 0x439e8d3c
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a07568], eax
push 0x439e8d48
mov eax, dword [0x43a03658]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x43a0756c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439e8c5d
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x439ee2e8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x439ee33c]
test si, 4
je 0x439ee2fd
or bl, 1
test si, 8
je 0x439ee307
or bl, 4
test si, 1
je 0x439ee311
or bl, 8
test si, 2
je 0x439ee31b
or bl, 0x10
test si, 0x10
je 0x439ee325
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x439ee334
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x439ee340
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, byte [0x439ee37c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x439ee35a
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x439ee369
or bl, 4
test esi, 0x20000000
je 0x439ee374
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x439f5a30
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x439f5a42
add esp, 0xfffffff0
call fcn.439a3d88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.439ba988
mov eax, dword [0x43a03b1c]
mov dword [eax + 4], ebx
mov dword [eax], 0x439f5dd4
mov eax, dword [0x43a03b2c]
mov dword [eax + 4], ebx
mov dword [eax], 0x439f5de0
mov eax, ebx
call fcn.439f5dec
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x439b24dc]
call fcn.439a3a4c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x439b24dc]
call fcn.439a3a4c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x439b24dc]
call fcn.439a3a4c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x439b24dc]
call fcn.439a3a4c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x439b24dc]
call fcn.439a3a4c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x439f1884
push eax
push 0
push 0
mov eax, dword [0x43a03cc4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x439be4ec]
call fcn.439bfa0c
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x439be4ec]
call fcn.439bfa0c
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x439be4ec]
call fcn.439bfa0c
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.439f621c
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x439f60ec
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x439f60ec
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x439f60ec
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x439f5b7f
call fcn.439a3de0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x439f5ed0
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x439f607b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x439f605c
mov dl, 1
mov eax, dword [0x439b2900]
call fcn.439a3a4c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.439a4890
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x439f604b
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.439e8e4c
test al, al
je 0x439f603e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x439f608c
lea eax, [ebp - 0x254]
call fcn.439a9854
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x439f603e
xor eax, eax
push ebp
push 0x439f6037
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x439f60c4
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x439f6020
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.439a4b00
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x439f6020
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.439a4b00
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439f603e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x439f5f41
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x25], 0
mov dl, 1
call fcn.439b6818
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x439f6082
lea eax, [ebp - 0x260]
call fcn.439a4890
ret

Function at 0x439f69f4
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x43a0757c]
cmp byte [eax + 0xad], 0
jne 0x439f6a65
cmp dword [0x43a07594], 0
jne 0x439f6a26
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x439f69b0
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x43a07594], eax
cmp dword [0x43a07590], 0
jne 0x439f6a41
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x43a07590], eax
cmp dword [0x43a07598], 0
jne 0x439f6a65
push esp
push 0
push 0
push 0x439f6954
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x43a07598], eax
pop edx
ret
Function at 0x439f6c38
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x439f6c4f
add esp, 0xfffffff0
call fcn.439a3d88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.439ba988
mov eax, dword [0x43a03cb0]
cmp word [eax + 2], 0
jne 0x439f6c77
mov eax, dword [0x43a03cb0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.439f8778
mov eax, dword [0x43a03d7c]
cmp word [eax + 2], 0
jne 0x439f6c91
mov eax, dword [0x43a03d7c]
mov dword [eax + 4], ebx
mov dword [eax], fcn.439f8984
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x439b24dc]
call fcn.439a3a4c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x439b24dc]
call fcn.439a3a4c
mov dword [ebx + 0x98], eax
mov dl, 1
mov eax, dword [0x439b24dc]
call fcn.439a3a4c
mov dword [ebx + 0xb0], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0xa5], 1
mov byte [ebx + 0xbc], 1
mov dl, 1
mov eax, dword [0x439becc8]
call fcn.439c5040
mov esi, eax
mov dword [ebx + 0xa0], esi
push 0x439f6e48
mov eax, dword [0x43a03bb0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.439c5414
mov eax, dword [ebx + 0xa0]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x439f9044
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x43a03bb0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.439ad090
test eax, eax
je 0x439f6d98
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.439a920c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.439ad0c4
test eax, eax
je 0x439f6dac
mov byte [eax], 0
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_CharNextA_1
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.439a4b00
mov byte [ebx + 0xd4], 0
push ebx
push 0x439f82d8
call fcn.439bbb04
mov dword [ebx + 0xc8], eax
mov eax, dword [0x43a03a30]
cmp byte [eax], 0
jne 0x439f6dfd
mov eax, ebx
call fcn.439f6f8c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0xa6], 1
xor eax, eax
mov dword [ebx + 0xa8], eax
mov eax, ebx
call fcn.439f9220
mov eax, ebx
call fcn.439f9d80
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x439f6e3d
call fcn.439a3de0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x439f720c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x43a0757c]
cmp dword [eax + 0x30], 0
je 0x439f72b6
cmp dword [ebx + 0x94], 0
jne 0x439f72b0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x439f719c
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x439f72b0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x439f7276
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x439f72b0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.439b4888
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x439f7285
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x439f7fd0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x439f8005
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.439a4980
jmp 0x439f8012
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.439a48e4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x439f9404
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x439f9472
mov eax, esi
call fcn.439e3b0c
test al, al
je 0x439f9472
mov eax, dword [ebx + 0x84]
call fcn.439e376c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x439f9472
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xf0]
test al, al
je 0x439f9466
push 0
mov eax, dword [ebx + 0x84]
call fcn.439e376c
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.439dbbac
jmp 0x439f9472
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.439f9240
pop esi
pop ebx
ret
Function at 0x43a01728
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, dword [0x43a03dc0]
mov byte [eax], 1
mov eax, 0x43a00ac0
call fcn.439a6718
mov eax, dword [0x43a03d4c]
mov eax, dword [eax]
call fcn.439f8584
mov eax, dword [0x43a03d4c]
mov eax, dword [eax]
mov edx, 0x43a017a8
call fcn.439f801c
mov eax, dword [0x43a03d4c]
mov eax, dword [eax]
mov byte [eax + 0x5b], 0
push 0
call sub.kernel32.dll_GetConsoleWindow
push eax
call sub.user32.dll_ShowWindow
mov ecx, dword [0x43a03e78]
mov eax, dword [0x43a03d4c]
mov eax, dword [eax]
mov edx, dword [0x439fef64]
call fcn.439f859c
mov eax, dword [0x43a03d4c]
mov eax, dword [eax]
call fcn.439f861c
call fcn.439a479c
add byte [eax], al
Function at 0x414910
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push esi
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax + 0x40], 0
je 0x41492e
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x41493a
mov al, 1
jmp 0x414ab3
mov dword [ebp - 0x20], 8
call fcn.00416d10
push eax
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov ecx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x14], eax
call fcn.00416d10
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x18]
push edx
call fcn.00416d40
add esp, 8
movzx eax, al
test eax, eax
je 0x41497d
xor al, al
jmp 0x414ab3
push 0
push 8
lea ecx, [ebp - 0x48]
call fcn.00412680
lea ecx, [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x24]
push edx
lea ecx, [ebp - 0x48]
call fcn.00416420
mov ecx, eax
call fcn.004138c0
mov esi, eax
lea ecx, [ebp - 0x48]
call fcn.00418db0
add esi, eax
push esi
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x48]
call fcn.00416420
mov ecx, eax
call fcn.004138c0
push eax
mov ecx, dword [ebp - 8]
add ecx, 0x48
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x40]
call fcn.00419310
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4149f1
cmp dword [ebp - 0x10], 1
je 0x4149f8
cmp dword [ebp - 0x10], 3
je 0x414a84
jmp 0x414a95
mov eax, dword [ebp - 8]
mov byte [eax + 0x45], 0
lea ecx, [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0x48]
call fcn.00416420
mov ecx, eax
call fcn.004138c0
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov dword [ebp - 0xc], edx
je 0x414a54
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x50]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 1
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x48]
call fcn.00416420
mov ecx, eax
call fcn.004138c0
push eax
call fcn.0041b419
add esp, 0x10
cmp dword [ebp - 0xc], eax
je 0x414a54
mov byte [ebp - 1], 0
lea ecx, [ebp - 0x48]
call fcn.00413190
mov al, byte [ebp - 1]
jmp 0x414ab3
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx + 0x45]
test edx, edx
jne 0x414a70
mov byte [ebp - 2], 1
lea ecx, [ebp - 0x48]
call fcn.00413190
mov al, byte [ebp - 2]
jmp 0x414ab3
cmp dword [ebp - 0xc], 0
jne 0x414a82
push 0
push 8
lea ecx, [ebp - 0x48]
call fcn.00415fb0
jmp 0x414aa6
mov byte [ebp - 3], 1
lea ecx, [ebp - 0x48]
call fcn.00413190
mov al, byte [ebp - 3]
jmp 0x414ab3
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x48]
call fcn.00413190
mov al, byte [ebp - 4]
jmp 0x414ab3
jmp 0x414989
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x428660
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x43a5dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.0041fd7f
mov dword [ebp - 0x14], eax
cmp dword [0x43cad0], esi
jne 0x428753
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x4286e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x428833
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x428833
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x428833
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43cad0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43cad4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43cad8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43cae0], eax
test eax, eax
je 0x428750
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43cadc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x428778
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x42876b
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x42878d
push 4
pop eax
jmp 0x428835
cmp dword [ebp - 0x14], esi
je 0x42878d
push dword [0x43cad0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x428772
mov eax, dword [0x43cadc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x4287eb
cmp dword [0x43cae0], edi
je 0x4287eb
push eax
call ebx
push dword [0x43cae0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x4287eb
test eax, eax
je 0x4287eb
call ecx
test eax, eax
je 0x4287e0
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x4287e0
test byte [ebp - 8], 1
jne 0x4287eb
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x42881b
mov eax, dword [0x43cad4]
cmp eax, edi
je 0x428818
push eax
call ebx
test eax, eax
je 0x428818
call eax
mov esi, eax
test esi, esi
je 0x428818
mov eax, dword [0x43cad8]
cmp eax, edi
je 0x428818
push eax
call ebx
test eax, eax
je 0x428818
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43cad0]
call ebx
test eax, eax
je 0x428833
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x428835
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041eeeb
mov esp, ebp
pop ebp
ret
Function at 0x44a380
Capabilities:
Accept command line arguments

Disassembly:
push ecx
push ebx
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push str.GetFirmwareEnvironmentVariableA
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test eax, eax
je 0x44a3c9
mov ecx, dword [0x4d09f4]
push 0x4d06fc
push ecx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
test ebx, ebx
je 0x44a3ef
push 0
push 0
push str.154CDFAF_2381_4cad_AB99_138517127D5C
push 0x4d13d4
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
dec eax
pop edi
neg eax
sbb eax, eax
pop esi
neg eax
pop ebx
pop ecx
ret
pop edi
mov al, bl
pop esi
pop ebx
pop ecx
ret

Function at 0x4b6676
Capabilities:
Encode data using xor

Disassembly:
sub ah, cl
sub eax, 0x20c747b2
test dword [edx], ebp
dec si
sub eax, 0xe42540a5
or byte [ebp - 0x61676e77], bl
and ah, ch
fdivrp st(3)
shr dword [esi - 0x69accd4d], cl
mov bl, 0x32
push ebx
xchg esi, eax
mov bl, 0x32
push ebx
xchg esi, eax
cmc
pop ebx
push ecx
mov edi, 0xd9f1ec4a
sbb byte [edx - 0x70], bh
xor bl, dh
and edi, ebp
cmp dword [ebx + 0x1c], edi
imul esi, dword es:[esi + 0x4c], 0xffffff92
push es
push ebx
cmp ch, ah
jecxz 0x4b665a
loopne 0x4b66b1
sbb esi, ecx
mov ch, 0x78
in al, 0x86
adc dl, cl
push ds
clc
push cs
xchg ecx, eax
add dl, byte [eax + 0x619858c9]
xchg ebx, eax
pop edi
fsubr dword [ebp + 0x2e]
push eax
adc ch, byte [ebx + eax - 0x28]
xor al, 0x9f
loop 0x4b6701
sub byte [esi], 0xe7
or edi, ecx
dec ebp
mov al, byte [0x94ffea98]
test al, 0x6c
sbb byte [ebx + 0x117cf07c], dh
pop edx
adc al, 0xe6
xchg ecx, eax
add esi, ecx
dec edx
jecxz 0x4b66ac
movsd dword es:[edi], dword [esi]
and eax, 0xb13aa407
push ecx
test byte [ebx], ah
jne 0x4b6724
salc
test eax, 0xb8f24acc
mov bl, 0x88
xor dword [ecx], edx
push eax
inc edx
popal
ljmp 0x31da
and ah, dl
rol dword [eax + 0x59865f15], 0xbf
imul esp, dword [ebx], 0x81af0f33
mov esi, ebp
xor dword [edx], 0xb3041285
xor eax, 0x2b792d
fisubr word [esi - 0x1d]
shl dword [edx], 0xc3
stosb byte es:[edi], al
mov ch, 0x8b
mov dh, 0xdd
rcl dl, 1
hlt