joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406521
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.0040600a
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test cl, 8
je 0x406556
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x470648], eax
jmp 0x4066fc
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x406571
test eax, eax
je 0x4066a7
test cl, 2
je 0x4066a7
push edi
push ebx
mov esi, 0x45b8f8
push esi
call fcn.00405a80
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406594
push str..
push esi
call edi
jmp 0x40659a
push ebx
call fcn.00405fdd
cmp word [ebx], 0
jne 0x4065aa
cmp word [0x45b8f8], 0x5c
jne 0x4065b2
push 0x4082c8
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebx + eax*2]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x25c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x406696
lea esi, [ebp - 0x230]
push 0x3f
mov eax, esi
push eax
call fcn.0040577b
xor edi, edi
cmp word [eax], di
je 0x4065f9
cmp word [ebp - 0x28], di
je 0x4065f9
lea esi, [ebp - 0x28]
cmp word [esi], 0x2e
jne 0x406614
movzx eax, word [esi + 2]
cmp ax, di
je 0x406673
cmp ax, 0x2e
jne 0x406614
cmp word [esi + 4], di
je 0x406673
push esi
push dword [ebp - 4]
call fcn.00405a80
test byte [ebp - 0x25c], 0x10
je 0x40663b
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x406673
push dword [ebp + 0xc]
push ebx
call fcn.00406521
jmp 0x406673
push ebx
call fcn.004058a6
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x40666b
test byte [ebp + 0xc], 4
je 0x406663
push ebx
push 0xfffffffffffffff1
call fcn.00404a3b
push edi
push ebx
call fcn.004064ee
jmp 0x406673
inc dword [0x470648]
jmp 0x406673
push ebx
push 0xfffffffffffffff2
call fcn.00404a3b
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4065d9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x406698
xor edi, edi
cmp dword [ebp + 8], edi
pop edi
je 0x4066a7
mov ecx, dword [ebp - 4]
xor eax, eax
mov word [ecx - 2], ax
xor esi, esi
cmp dword [ebp + 8], esi
je 0x4066fb
cmp dword [ebp - 0xc], esi
je 0x4066eb
push ebx
call fcn.00405b60
test eax, eax
je 0x4066fb
push ebx
call fcn.00405fae
push ebx
call fcn.004058a6
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4066f3
test byte [ebp + 0xc], 4
je 0x4066eb
push ebx
push 0xfffffffffffffff1
call fcn.00404a3b
push esi
push ebx
call fcn.004064ee
jmp 0x4066fb
inc dword [0x470648]
jmp 0x4066fb
push ebx
push 0xffffffffffffffe5
call fcn.00404a3b
pop esi
pop ebx
leave
ret 8
Function at 0xc842b2
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push esi
cmp byte [edi - 1], 0
lea esp, [esp + 8]
jp 0x15724bd
jne 0x153de02
ror di, cl
shl di, 0xe
lea edi, [ecx*8 - 0x516575b1]
mov edi, dword [edx + 0x24]
stc
call fcn.0157ded8

Function at 0x1565bee
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov edi, eax
or cx, ax
btr ecx, 3
pop ecx
mov ecx, 0x104
clc
stc
jmp 0x15724a7
test cl, bh
sub al, al
clc
test edi, edi
cmp sp, ax
repne scasb al, byte es:[edi]
call fcn.01581c65
Function at 0x15807a1
Capabilities:
Encode data using xor

Disassembly:
pushal
jmp 0x157421e
lea esp, [esp + 0x20]
je 0x153f3f2
push 0x25f5b735
pushfd
lea esp, [esp + 8]
jmp 0x1540b3e
cmp ebx, 1
mov byte [esp], bh
mov byte [esp], 0x43
lea esp, [esp + 0x48]
je 0x153e1e3
cmc
cmp ebx, 2
pushal
mov byte [esp], 0x2b
lea esp, [esp + 0x20]
je 0x156c68b
cmc
stc
pushfd
cmp ebx, 3
lea esp, [esp + 4]
ja 0x156314a
pushfd
lea esp, [esp + 4]
je 0x153f3f2
pushal
pushfd
pushal
mov word [esp + 4], bx
lea esp, [esp + 0x44]
jmp 0x1540b3e
Function at 0x405aa0
Capabilities:
Check os version

Disassembly:
sub esp, 0x98
mov eax, dword [0x435264]
xor eax, esp
mov dword [esp + 0x94], eax
push esi
push 0x94
xor esi, esi
lea eax, [esp + 8]
push esi
push eax
call fcn.00413590
add esp, 0xc
lea ecx, [esp + 4]
push ecx
mov dword [esp + 8], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x405aeb
cmp dword [esp + 8], 6
lea eax, [esi + 1]
je 0x405aed
mov eax, esi
mov ecx, dword [esp + 0x98]
pop esi
xor ecx, esp
call fcn.00413580
add esp, 0x98
ret

Function at 0x406880
Capabilities:
Set registry value

Disassembly:
mov edx, dword [esp + 4]
push 4
lea eax, [esp + 0xc]
push eax
mov eax, dword [ecx]
push 4
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x4068a0
Capabilities:
Set registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, ecx
test esi, esi
jne 0x4068b4
pop edi
lea eax, [esi + 0xd]
pop esi
ret 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0xc]
mov edx, dword [edi]
inc eax
push eax
mov eax, dword [esp + 0x18]
push esi
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
ret 0xc

Function at 0x4068e0
Capabilities:
Set registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 4], ecx
test ebp, ebp
jne 0x4068f6
lea eax, [ebp + 0xd]
pop ebp
pop ecx
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
push edi
xor edi, edi
mov esi, ebp
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x406903
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
pop ebp
pop ecx
ret 8
Function at 0x407410
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x435264]
xor eax, esp
mov dword [esp + 0x128], eax
mov eax, dword [ecx]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ecx + 4]
push edi
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x1c]
push ecx
xor ebx, ebx
or esi, 0x2001f
push esi
push ebx
push edx
push eax
mov dword [esp + 0x38], edx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, dword [esp + 0x10]
mov edi, eax
cmp edi, ebx
jne 0x40748f
xor eax, eax
cmp ecx, ebx
je 0x407477
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1c]
and esi, 0x300
mov edi, eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], esi
cmp eax, ebx
je 0x4074b3
cmp ecx, ebx
je 0x40749a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00413580
mov esp, ebp
pop ebp
ret 4
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea edx, [esp + 0x28]
push edx
push ebx
push ebx
push ebx
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x44]
push edx
push ebx
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
jne 0x40751a
jmp 0x4074e0
lea eax, [esp + 0x30]
push eax
lea ecx, [esp + 0x14]
call fcn.00407410
mov edi, eax
cmp edi, ebx
jne 0x407569
lea ecx, [esp + 0x28]
push ecx
mov ecx, dword [esp + 0x14]
push ebx
push ebx
push ebx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x44]
push eax
push ebx
push ecx
mov dword [esp + 0x38], 0x100
call esi
test eax, eax
je 0x4074e0
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40752d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x10], ebx
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push edx
mov dword [esp + 0x18], ebx
call fcn.00406790
mov esi, eax
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x407550
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.00413580
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x407578
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x134]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00413580
mov esp, ebp
pop ebp
ret 4

Function at 0x4077c0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x34], eax
test eax, eax
jne 0x4077de
xor al, al
pop esi
pop ecx
ret
lea eax, [esp + 4]
push eax
push 0
push esi
push 0x4077b0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
neg eax
pop esi
pop ecx
ret
Function at 0x40d280
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
mov esi, eax
call dword [sym.imp.ole32.dll_CoInitialize]
mov eax, dword [esp + 0x30]
push 0x427a18
push eax
push 0x434200
mov ecx, 0x436958
call fcn.00406ec0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov cx, word [0x4287e0]
mov dl, byte [0x4287e2]
mov dword [0x436988], eax
lea eax, [esp + 0xc]
push eax
push esi
mov word [esp + 0x14], cx
mov byte [esp + 0x16], dl
xor ebx, ebx
call fcn.00407150
mov esi, eax
add esp, 8
test esi, esi
je 0x40d324
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
lea esp, [esp]
push str.UnregServer
push esi
call edi
test eax, eax
je 0x40d3a8
push str.RegServer
push esi
call edi
test eax, eax
je 0x40d3ca
lea ecx, [esp + 0xc]
push ecx
push esi
call fcn.00407150
mov esi, eax
add esp, 8
test esi, esi
jne 0x40d2f0
mov ecx, 0x436958
call fcn.004077c0
push 1
push 4
mov ecx, 0x436958
call fcn.004076e0
mov esi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push edx
call esi
test eax, eax
je 0x40d378
mov edi, dword [sym.imp.USER32.dll_DispatchMessageA]
lea esp, [esp]
lea eax, [esp + 0x10]
push eax
call edi
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push ecx
call esi
test eax, eax
jne 0x40d360
mov ecx, 0x436958
call fcn.00407770
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x436958
call fcn.00407640
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x20
ret 0x10
push 0
push 0
push 0x64
push 0x436958
call fcn.0040ce60
push 0
push 1
mov ecx, 0x436958
call fcn.0040c140
mov ebx, eax
jmp 0x40d38d
push 0
push 1
push 0x64
push 0x436958
call fcn.0040ce60
push 0
push 1
mov ecx, 0x436958
call fcn.0040c0b0
mov ebx, eax
jmp 0x40d38d

Function at 0x413580
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435264]
jne 0x41358a
repz ret
jmp fcn.00417adc
Function at 0x4235fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00415de2
and dword [ebp - 4], 0
cmp dword [0x4373dc], 0
mov ebx, eax
jne 0x4236ad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42375e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x42375e
push eax
call fcn.00415d70
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4373dc], eax
call esi
push eax
call fcn.00415d70
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4373e0], eax
call esi
push eax
call fcn.00415d70
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4373e4], eax
call esi
push eax
call fcn.00415d70
pop ecx
mov dword [0x4373ec], eax
test eax, eax
je 0x4236ad
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00415d70
pop ecx
mov dword [0x4373e8], eax
mov eax, dword [0x4373e8]
cmp eax, ebx
je 0x423705
cmp dword [0x4373ec], ebx
je 0x423705
push eax
call fcn.00415deb
push dword [0x4373ec]
mov esi, eax
call fcn.00415deb
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x423705
test edi, edi
je 0x423705
call esi
test eax, eax
je 0x4236fc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4236fc
test byte [ebp - 0xc], 1
jne 0x423705
or dword [ebp + 0x10], 0x200000
jmp 0x42373e
mov eax, dword [0x4373e0]
cmp eax, ebx
je 0x42373e
push eax
call fcn.00415deb
pop ecx
test eax, eax
je 0x42373e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42373e
mov eax, dword [0x4373e4]
cmp eax, ebx
je 0x42373e
push eax
call fcn.00415deb
pop ecx
test eax, eax
je 0x42373e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4373dc]
call fcn.00415deb
pop ecx
test eax, eax
je 0x42375e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x423760
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403b50
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x104
mov eax, dword [0x420a50]
xor eax, esp
mov dword [esp + 0x100], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
cmp dword [esp + 0x10c], 0
je 0x403b9e
test byte [esp + esi + 4], 1
je 0x403ba5
pop esi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00407a57
add esp, 0x104
ret
test byte [esp + esi + 4], 1
je 0x403bc5
push edi
mov edi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 1
push 0xff
push esi
call edi
push 0
push 3
push 0xff
push esi
call edi
pop edi
mov ecx, dword [esp + 0x104]
pop esi
xor ecx, esp
call fcn.00407a57
add esp, 0x104
ret

Function at 0x403d10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x108
mov eax, dword [0x420a50]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
push edi
push 0
push 0
push 0x147
push 0x3ec
push esi
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push esi
mov dword [0x421eb4], eax
call fcn.00402b40
add esp, 4
push 0x3ee
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [0x422d38], eax
mov eax, dword [0x421eb4]
mov ecx, dword [eax*4 + 0x422210]
mov ecx, dword [ecx]
lea edx, [esp + 8]
mov al, byte [ecx]
mov byte [edx], al
add ecx, 1
add edx, 1
test al, al
jne 0x403d83
cmp dword [0x422d00], 0
je 0x403de4
cmp dword [0x422e40], 0
je 0x403de4
lea edx, [esp + 8]
push edx
push 0x41a9ac
push 0x422d70
call fcn.004079c0
mov eax, 0x422d70
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x403dc2
mov ecx, dword [0x422e40]
push ecx
sub eax, edx
push eax
push 1
push 0x422d70
call fcn.00407ebf
add esp, 0x10
lea eax, [esp + 8]
add eax, 0xffffffff
jmp 0x403df0
mov cl, byte [eax + 1]
add eax, 1
test cl, cl
jne 0x403df0
mov edx, dword [str..bmp]
mov cl, byte [0x41a9a8]
push 0x50
push 0
push 0
mov dword [eax], edx
push 0
lea edx, [esp + 0x18]
push edx
push 0
mov byte [eax + 4], cl
call dword [sym.imp.USER32.dll_LoadImageA]
test eax, eax
mov dword [0x4234e0], eax
je 0x403e6e
push eax
mov eax, dword [0x422d38]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
push edi
call dword [sym.imp.GDI32.dll_GetMapMode]
mov ecx, dword [0x422d38]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetMapMode]
push edi
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [0x421eb4]
mov eax, dword [edx*4 + 0x422210]
mov ecx, dword [eax + 4]
mov dword [0x42220c], ecx
call fcn.00403be0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esp + 0x10c]
pop edi
pop esi
xor ecx, esp
call fcn.00407a57
add esp, 0x108
ret
Function at 0x4042f0
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x4226f3], 0
push ebx
mov bl, byte [esp + 0xc]
push ebp
push esi
je 0x404349
cmp dword [0x422e40], 0
je 0x404349
movzx eax, bl
push eax
push str.Checking_whether_the_test_has_passed._User_verifiaction_required:__d_n
push 0x422d70
call fcn.004079c0
mov eax, 0x422d70
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x404327
mov ecx, dword [0x422e40]
push ecx
sub eax, edx
push eax
push 1
push 0x422d70
call fcn.00407ebf
add esp, 0x10
mov esi, dword [esp + 0x10]
mov ebp, dword [sym.imp.USER32.dll_DialogBoxParamA]
test bl, bl
mov ebx, dword [sym.imp.USER32.dll_SetFocus]
je 0x4043d0
mov edx, dword [0x422088]
push edi
push 0
push 0x401470
push esi
push str.Passverification
push edx
call ebp
push esi
mov edi, eax
call ebx
test edi, edi
pop edi
jne 0x404397
mov edx, dword [0x422088]
push 0
push 0x401560
push esi
push str.Failreason
push edx
call ebp
push esi
call ebx
call fcn.00403be0
push 0
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push esi
call ebx
cmp byte [0x421eef], 0
je 0x40441a
mov ecx, dword [0x42219c]
push 9
call fcn.00406860
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
call ebx
pop esi
pop ebp
xor al, al
pop ebx
ret
cmp dword [0x422e40], 0
je 0x40437e
push str.User_Selection:_FAILED_n
push 0x422d70
call fcn.004079c0
mov eax, 0x422d70
add esp, 8
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4043f3
mov ecx, dword [0x422e40]
push ecx
sub eax, edx
push eax
push 1
push 0x422d70
call fcn.00407ebf
add esp, 0x10
jmp 0x40437e
mov eax, dword [0x422088]
push 0
push 0x4012e0
push esi
push str.Serial
push eax
call ebp
test eax, eax
jne 0x40443d
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
push esi
call ebx
pop esi
pop ebp
xor al, al
pop ebx
ret
Function at 0x404450
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x1a8
mov eax, dword [0x420a50]
xor eax, esp
mov dword [esp + 0x1a4], eax
mov eax, dword [0x422210]
mov eax, dword [eax]
lea edx, [esp + 0xa0]
push edi
mov edi, dword [esp + 0x1b0]
mov dword [0x421eb4], 0
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x404486
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push esi
xor esi, esi
cmp dword [0x422e38], esi
jle 0x40451f
mov ecx, dword [esi*4 + 0x422210]
mov edx, dword [ecx]
push edx
push 0
push 0x143
push 0x3ec
push edi
call ebx
mov eax, dword [esi*4 + 0x422210]
mov ecx, dword [eax]
mov eax, 0x422090
jmp 0x4044d0
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4044f0
test dl, dl
je 0x4044ec
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4044f0
add eax, 2
add ecx, 2
test dl, dl
jne 0x4044d0
xor eax, eax
jmp 0x4044f5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x404514
mov dword [0x421eb4], esi
nop
mov cl, byte [eax + 0x422090]
mov byte [esp + eax + 0xac], cl
add eax, 1
test cl, cl
jne 0x404500
add esi, 1
cmp esi, dword [0x422e38]
jl 0x4044a4
xor eax, eax
jmp 0x404530
mov cl, byte [esp + eax + 0xac]
mov byte [eax + 0x422090], cl
add eax, 1
test cl, cl
jne 0x404530
mov ecx, dword [0x421eb4]
push 0
push ecx
push 0x14e
push 0x3ec
push edi
call ebx
push edi
call fcn.00403d10
add esp, 4
push 0x3fd
push 0x3fd
push 0x3fc
push edi
call dword [sym.imp.USER32.dll_CheckRadioButton]
lea edx, [esp + 0xa0]
push edx
mov dword [0x4234e8], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
lea eax, [esp + 0xa0]
push eax
push 0x3fa
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x422708], 0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x10]
pop esi
mov dword [0x422710], edx
mov dword [0x423510], eax
pop ebx
je 0x404609
push 1
push 0x3fb
push edi
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov ecx, dword [0x4226fc]
push ecx
call fcn.00402a60
add esp, 4
pop edi
mov ecx, dword [esp + 0x1a4]
xor ecx, esp
call fcn.00407a57
add esp, 0x1a8
ret
push 0
push 0x3fb
push edi
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov ecx, dword [esp + 0x1a8]
pop edi
xor ecx, esp
call fcn.00407a57
add esp, 0x1a8
ret
Function at 0x407400
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419940
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push esi
push edi
mov eax, dword [0x420a50]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 8]
xor edi, edi
push ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_OpenClipboard]
cmp eax, edi
mov dword [ebp - 0x24], eax
jne 0x407459
push 0x41cd70
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x14], str.Clipboard_can_not_be_opened
call fcn.00409a3c
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
cmp esi, edi
jne 0x40747c
push 0x41cd70
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], str.There_is_no_valid_text_in_the_clipboard_to_paste
call fcn.00409a3c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
cmp eax, 0x32
jle 0x4074bd
push 0x41cd70
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], str.The_text_in_the_clipboard_is_too_long_to_be_either_na_user_name_or_a_key._Make_sure_that_you_select_nonly_the_key_or_your_user_name_before_doing_a_copy_nto_the_clipboard_n
call fcn.00409a3c
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp + 8]
push 0x10
push str.Paste_error
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x4074b8
ret
push eax
call fcn.004093c9
add esp, 4
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
mov esi, edi
mov cl, byte [edx]
mov byte [esi], cl
add edx, 1
add esi, 1
test cl, cl
jne 0x4074d3
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp + 0xc]
cmp ecx, 0x40a
jne 0x407502
mov eax, edi
cmp byte [eax], 0x20
jne 0x4074ff
add eax, 1
jmp 0x4074f5
push eax
jmp 0x407503
push edi
push ecx
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
cmp dword [ebp - 0x24], 0
je 0x407517
call dword [sym.imp.USER32.dll_CloseClipboard]
test edi, edi
je 0x407524
push edi
call fcn.004094ae
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407a57
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420a50]
jne 0x407a61
repz ret
jmp fcn.0040acf8
Function at 0x4166bb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040cb76
xor ebx, ebx
cmp dword [0x423fc8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x416790
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x4166fb
xor eax, eax
jmp 0x416854
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41c3ac
push edi
call esi
cmp eax, ebx
je 0x4166f4
push eax
call fcn.0040cb13
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x423fc8], eax
call esi
push eax
call fcn.0040cb13
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x423fcc], eax
call esi
push eax
call fcn.0040cb13
mov dword [0x423fd0], eax
lea eax, [ebp - 8]
push eax
call fcn.004090b6
test eax, eax
pop ecx
pop ecx
je 0x41675e
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040aa09
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x416790
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040cb13
cmp eax, ebx
pop ecx
mov dword [0x423fd8], eax
je 0x416790
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040cb13
pop ecx
mov dword [0x423fd4], eax
mov eax, dword [0x423fd4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x416809
cmp dword [0x423fd8], esi
je 0x416809
push eax
call fcn.0040cb7f
pop ecx
call eax
cmp eax, ebx
je 0x4167d6
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x423fd8]
call fcn.0040cb7f
pop ecx
call eax
test eax, eax
je 0x4167d6
test byte [ebp - 0x18], 1
jne 0x416809
lea eax, [ebp - 0xc]
push eax
call fcn.004090ed
test eax, eax
pop ecx
je 0x4167f1
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0040aa09
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x416800
or dword [ebp + 0x10], 0x200000
jmp 0x41683a
or dword [ebp + 0x10], 0x40000
jmp 0x41683a
mov eax, dword [0x423fcc]
cmp eax, esi
je 0x41683a
push eax
call fcn.0040cb7f
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x41683a
mov eax, dword [0x423fd0]
cmp eax, esi
je 0x41683a
push dword [ebp - 4]
push eax
call fcn.0040cb7f
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x423fc8]
call fcn.0040cb7f
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret