joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
test esi, esi
jne 0x401a49
lea eax, [esi + 0xd]
pop esi
mov esp, ebp
pop ebp
ret 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x401a53
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push edi
push eax
mov eax, dword [edx]
push 7
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x4020e0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x41b3dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
mov edx, dword [edi]
or ecx, 0x2001f
push ecx
xor esi, esi
push eax
push edx
lea ecx, [ebp - 0x110]
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], esi
call fcn.00401920
mov ebx, eax
cmp ebx, esi
je 0x40215a
mov eax, dword [ebp - 0x110]
cmp eax, esi
je 0x402145
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409af3
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x120]
push eax
mov eax, dword [ebp - 0x110]
push esi
push esi
push esi
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x104]
push edx
push esi
push eax
mov dword [ebp - 0x114], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4021dc
mov edi, edi
lea ecx, [ebp - 0x104]
push ecx
lea ecx, [ebp - 0x110]
call fcn.004020e0
mov ebx, eax
cmp ebx, esi
jne 0x402134
lea edx, [ebp - 0x120]
push edx
mov edx, dword [ebp - 0x110]
push esi
push esi
push esi
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x104]
push ecx
push esi
push edx
mov dword [ebp - 0x114], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x402190
mov eax, dword [ebp - 0x110]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, esi
je 0x4021f5
push eax
call ebx
mov dword [ebp - 0x110], esi
mov eax, dword [ebp - 0x118]
push eax
mov ecx, edi
mov dword [ebp - 0x10c], esi
call fcn.00401800
mov edi, eax
mov eax, dword [ebp - 0x110]
cmp eax, esi
je 0x402218
push eax
call ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409af3
mov esp, ebp
pop ebp
ret 4
Function at 0x403f10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
lea edx, [ebp + 0x10]
push edx
mov edx, dword [ebp + 8]
push esi
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0xc]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403f73
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x403f4f
cmp eax, 2
jne 0x403f61
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x403f6f
test eax, eax
je 0x403f6c
cmp byte [eax + esi - 1], 0
je 0x403f6f
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x403f80
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x41b3dc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x90
lea eax, [ebp - 0x94]
push 0
push eax
mov esi, 0x30
mov dword [ebp - 0x98], 0x94
call fcn.0040a160
add esp, 0xc
lea ecx, [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x403fd3
cmp dword [ebp - 0x94], 6
jae 0x403fe7
mov eax, 0x2c
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00409af3
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00409af3
mov esp, ebp
pop ebp
ret

Function at 0x4046c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x54]
mov ecx, eax
and ecx, 0xc
push edi
mov bl, 1
cmp cl, 0xc
jne 0x40471c
mov eax, dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push eax
mov dword [ebp - 0xc], eax
call edi
mov edx, dword [esi + 4]
push edx
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0xfffffffe
call edi
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
lea ecx, [ebp - 0xc]
push ecx
push edi
push 0x4e
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
shr eax, 2
test al, 1
je 0x404756
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
mov edi, eax
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_GetParent]
mov ecx, dword [esi + 4]
push ecx
movzx edx, di
push edx
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi + 0x28]
push 1
push 0
push 0
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
seta bl
test bl, bl
je 0x404789
mov ecx, dword [esi + 4]
or byte [esi + 0x58], 2
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406730
Capabilities:
Check if file exists
Delete file
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x406745
pop ebp
ret 8
movzx ecx, word [ebp + 8]
push esi
push str.CaxaFile
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x406763
pop esi
pop ebp
ret 8
push edi
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x406780
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x406788
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x40679d
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov esi, dword [ebp + 0xc]
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp + 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x4157f8
push esi
call fcn.0040a866
mov esi, eax
add esp, 8
test esi, esi
je 0x4067f1
push esi
push edi
push 1
push ebx
call fcn.0040a730
add esp, 0x10
cmp edi, eax
jne 0x4067e8
mov dword [ebp + 0xc], 1
push esi
call fcn.0040a565
add esp, 4
mov eax, dword [ebp + 0xc]
pop ebx
pop edi
pop esi
pop ebp
ret 8

Function at 0x406800
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0
push 0
push str.http:__marswu.ys168.com
push str.open
push 0
call esi
push 1
push 0
push 0
push str.https:__pan.baidu.com_s_1mkrEixU
push str.open
push 0
call esi
xor eax, eax
pop esi
ret 0xc
Function at 0x407498
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
cmp dword [eax - 0xc], 1
lea ecx, [eax - 0xc]
push edi
mov edi, dword [ebp + 8]
jg 0x40740a
cmp edi, dword [eax - 4]
jle 0x407442
add eax, 0xfffffff4
cmp eax, dword [0x41b020]
je 0x407436
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jg 0x40742e
mov eax, dword [esi]
sub eax, 0xc
push eax
call fcn.00409b02
add esp, 4
mov ecx, dword [0x41b024]
mov dword [esi], ecx
push edi
mov ecx, esi
call fcn.00406e30
test eax, eax
je 0x407488
mov edx, dword [ebp + 0xc]
mov eax, dword [esi]
push edi
push edx
lea ecx, [edi + 1]
push ecx
push eax
call fcn.00409d86
add esp, 0x10
cmp eax, 0x50
ja case.0x407462.1
movzx edx, byte [eax + 0x4074a8]
jmp dword [edx*4 + 0x407498]
push 0x8007000e
call fcn.00401000
push 0x80070057
call fcn.00401000
mov eax, dword [esi]
mov dword [eax - 8], edi
mov ecx, dword [esi]
mov byte [edi + ecx], 0
pop edi
pop esi
pop ebp
ret 8
push 0x80004005
call fcn.00401000
jge 0x40750e
inc eax
add byte [ecx + 0x74], ch
inc eax
add byte [ebx + 0x74], dh
inc eax
add byte [esi + 0x4074], cl
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ecx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [edx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [ebx]
add eax, dword [eax]
int3
adc eax, sym.imp.USER32.dll_GetDlgItem
push 0xff
push 0xff
lea ecx, [esi + 0x20]
mov edi, eax
call fcn.004071c0
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esi + 0x20]
call fcn.004072e0
mov ecx, dword [esi + 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esi + 0x20]
mov dword [edx - 8], eax
mov ecx, dword [esi + 0x20]
pop edi
mov byte [eax + ecx], 0
xor eax, eax
pop esi
ret 0x10
Function at 0x407af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414be8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x41b3dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [0x41b024]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
push 0xf023f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB240C796_6C46_40D9_B242_BBE12A692886
push 0x80000002
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00401920
push 0x104
lea ecx, [ebp - 0x10]
call fcn.004071c0
lea ecx, [ebp - 0x14]
push ecx
mov esi, eax
mov eax, dword [ebp - 0x24]
push esi
lea edx, [ebp - 0x18]
push edx
push edi
push str.InstallLocation
push eax
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x407b97
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x407b8b
cmp eax, 2
jne 0x407b97
cmp esi, edi
je 0x407b97
cmp dword [ebp - 0x14], edi
jne 0x407b97
mov byte [esi], 0
lea ecx, [ebp - 0x10]
call fcn.004072e0
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov dword [esi - 8], eax
mov byte [eax + esi], 0
mov ecx, dword [0x41b024]
mov dword [ebp - 0x14], ecx
push 0xff
push 0x100
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004071c0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea ecx, [ebp - 0x14]
call fcn.004072e0
mov esi, dword [ebp - 0x14]
push esi
call edi
lea edx, [ebp - 0x14]
mov dword [esi - 8], eax
push edx
lea ecx, [ebp - 0x10]
mov byte [eax + esi], 0
call fcn.00407560
mov eax, dword [ebx + 4]
push 0x3e8
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [ebp - 0x24]
test edi, edi
je 0x407c2c
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov edi, dword [ebp - 0x24]
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebx + 0x20]
mov dword [ebp - 0x20], 0
call fcn.00407560
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esi - 0xc]
mov byte [ebp - 4], 1
cmp eax, dword [0x41b020]
je 0x407c67
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x407c67
push esi
call fcn.00409b02
add esp, 4
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 0
cmp ecx, dword [0x41b020]
je 0x407c8c
lea esi, [eax - 0xc]
push esi
call ebx
test eax, eax
jg 0x407c8c
push esi
call fcn.00409b02
add esp, 4
test edi, edi
je 0x407c97
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407cb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x414be8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x41b3dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov eax, dword [0x41b024]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], eax
push 0xf013f
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallB260CB56_5C4D_4D82_9341_295127A2DC64
push 0x80000002
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.00401920
push 0x105
lea ecx, [ebp - 0x10]
call fcn.004071c0
lea ecx, [ebp - 0x14]
push ecx
mov esi, eax
mov eax, dword [ebp - 0x24]
push esi
lea edx, [ebp - 0x18]
push edx
push edi
push str.InstallLocation
push eax
mov dword [ebp - 0x14], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
jne 0x407d57
mov eax, dword [ebp - 0x18]
cmp eax, 1
je 0x407d4b
cmp eax, 2
jne 0x407d57
cmp esi, edi
je 0x407d57
cmp dword [ebp - 0x14], edi
jne 0x407d57
mov byte [esi], 0
lea ecx, [ebp - 0x10]
call fcn.004072e0
mov esi, dword [ebp - 0x10]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
mov dword [esi - 8], eax
mov byte [eax + esi], 0
mov ecx, dword [0x41b024]
mov dword [ebp - 0x14], ecx
push 0xff
push 0x100
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004071c0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
lea ecx, [ebp - 0x14]
call fcn.004072e0
mov esi, dword [ebp - 0x14]
push esi
call edi
lea edx, [ebp - 0x14]
mov dword [esi - 8], eax
push edx
lea ecx, [ebp - 0x10]
mov byte [eax + esi], 0
call fcn.00407560
mov eax, dword [ebx + 4]
push 0x3e8
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edi, dword [ebp - 0x24]
test edi, edi
je 0x407dec
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x24], 0
mov edi, dword [ebp - 0x24]
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebx + 0x20]
mov dword [ebp - 0x20], 0
call fcn.00407560
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
lea eax, [esi - 0xc]
mov byte [ebp - 4], 1
cmp eax, dword [0x41b020]
je 0x407e27
add esi, 0xfffffff4
push esi
call ebx
test eax, eax
jg 0x407e27
push esi
call fcn.00409b02
add esp, 4
mov eax, dword [ebp - 0x10]
lea ecx, [eax - 0xc]
mov byte [ebp - 4], 0
cmp ecx, dword [0x41b020]
je 0x407e4c
lea esi, [eax - 0xc]
push esi
call ebx
test eax, eax
jg 0x407e4c
push esi
call fcn.00409b02
add esp, 4
test edi, edi
je 0x407e57
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x407e70
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
mov ebx, ecx
push 0
lea ecx, [ebx + 4]
call fcn.00406980
mov eax, dword [0x41c3c4]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
push 0xc
mov dword [ebp - 4], eax
call edi
push eax
push 0xb
call edi
mov ecx, dword [ebp - 4]
push eax
push 1
push 0x80
push ecx
call dword [sym.imp.USER32.dll_LoadImageA]
mov edx, dword [ebx + 4]
push eax
push 1
push 0x80
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x41c3c4]
push 0
push 0x32
mov dword [ebp - 4], eax
call edi
push eax
push 0x31
call edi
mov ecx, dword [ebp - 4]
push eax
push 1
push 0x80
push ecx
call dword [sym.imp.USER32.dll_LoadImageA]
mov edx, dword [ebx + 4]
push eax
push 0
push 0x80
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov ax, word [ebp - 0x28]
cmp ax, 9
je 0x407f13
cmp ax, 6
jne 0x407f51
mov ecx, dword [ebx + 4]
push 1
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov edx, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ef
push edx
call edi
push 1
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, ebx
call fcn.00407cb0
jmp 0x407f8d
mov ecx, dword [ebx + 4]
push 1
push 0x3ee
push ecx
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov edx, dword [ebx + 4]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ef
push edx
call edi
push 0
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0
mov ecx, ebx
call fcn.00407af0
mov ecx, dword [ebx + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebx + 4]
push 0x3ec
push edx
call edi
cmp dword [ebx + 0x58], 0
mov edi, eax
jne 0x407fba
push 0
push 0
push 0x31
push edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [ebx + 0x58], eax
push edi
lea ecx, [ebx + 0x24]
call fcn.00406c40
test eax, eax
je 0x407fcf
lea ecx, [ebx + 0x24]
call fcn.00405160
or dword [ebx + 0x78], 0xc
push 0x415954
lea ecx, [ebx + 0x24]
call fcn.00404e70
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4093d2
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x41c38c], 0
push esi
push edi
jne 0x409348
call fcn.004092b4
test eax, eax
je 0x40938d
mov eax, dword [0x41c38c]
cmp eax, 1
jne 0x409369
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x40938d
jmp 0x4093cf
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4093cf
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x409391
xor eax, eax
jmp 0x4093cf
mov eax, dword [esi]
push dword [0x41c38c]
call edi
mov edi, eax
test edi, edi
je 0x4093b3
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4093cf
lea edi, [esi + 0xff0]
push esi
push dword [0x41c38c]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4093b9
mov eax, esi
pop edi
pop esi
ret
jmp 0x409334

Function at 0x409af3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b3dc]
jne 0x409afd
repz ret
jmp fcn.0040c2dc
Function at 0x411f09
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b3dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040bd7b
and dword [ebp - 0x14], 0
cmp dword [0x41d0a0], 0
mov dword [ebp - 0x18], eax
jne 0x411fbc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412064
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x417c18
push ebx
call edi
test eax, eax
je 0x412064
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x417c08
push ebx
mov dword [0x41d0a0], eax
call edi
push eax
call esi
push 0x417bf4
push ebx
mov dword [0x41d0a4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41d0a8], eax
call edi
push eax
call esi
mov dword [0x41d0b0], eax
test eax, eax
je 0x411fbc
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41d0ac], eax
mov eax, dword [0x41d0ac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412015
cmp dword [0x41d0b0], ecx
je 0x412015
push eax
call esi
push dword [0x41d0b0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412015
test ebx, ebx
je 0x412015
call edi
test eax, eax
je 0x41200c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41200c
test byte [ebp - 8], 1
jne 0x412015
or dword [ebp + 0x10], 0x200000
jmp 0x412048
mov eax, dword [0x41d0a4]
cmp eax, dword [ebp - 0x18]
je 0x412048
push eax
call esi
test eax, eax
je 0x412048
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412048
mov eax, dword [0x41d0a8]
cmp eax, dword [ebp - 0x18]
je 0x412048
push eax
call esi
test eax, eax
je 0x412048
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41d0a0]
call esi
test eax, eax
je 0x412064
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412066
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409af3
leave
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219