joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40caba
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
push esi
cmp dword [0x4339c0], ebx
jne 0x40cad3
mov ecx, 0x4339b8
call fcn.0040ca7b
mov esi, dword [ebp + 0xc]
mov ecx, esi
and ecx, 0xf
mov eax, esi
sub eax, ecx
cmp byte [ebp + 0x10], bl
je 0x40cb1d
mov ecx, dword [0x4339c0]
cmp ecx, ebx
je 0x40cb39
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40cb5a
push str.CryptProtectMemory_failed
mov esi, 0x42e76c
push esi
call fcn.004063a1
pop ecx
pop ecx
mov ecx, esi
call fcn.00401000
push 2
mov ecx, esi
call fcn.0040645d
jmp 0x40cb5a
mov ecx, dword [0x4339c4]
cmp ecx, ebx
je 0x40cb39
push ebx
push eax
push dword [ebp + 8]
call ecx
test eax, eax
jne 0x40cb5a
push str.CryptUnprotectMemory_failed
jmp 0x40cafe
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor ecx, ecx
cmp esi, ebx
jbe 0x40cb5a
mov dl, al
add dl, 0x4b
mov eax, dword [ebp + 8]
add eax, ecx
mov bl, dl
add bl, cl
xor byte [eax], bl
inc ecx
cmp ecx, esi
jb 0x40cb4a
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x40ccff
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x42b0dc], 0
push ebx
push esi
push edi
mov edi, 0x400
jne 0x40cd4a
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x4480cc], ax
xor eax, eax
mov word [0x4480ce], ax
mov dword [0x42b0dc], 0x4480cc
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041087f
mov ebx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push ebx
push esi
xor eax, eax
push 0x42b0cc
mov word [esi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
pop edi
mov word [esi + ebx*2 - 2], ax
pop esi
pop ebx
leave
ret 0x10
Function at 0x40cfaa
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
push ebx
push esi
push edi
push 0x68
push dword [0x43c9f8]
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp byte [0x43c9fc], 0
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov edi, eax
mov dword [ebp - 4], edi
mov ebx, 0xb1
jne 0x40d00c
mov ecx, dword [0x4339cc]
call fcn.004187fc
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push ebx
push edi
call esi
push 0x426554
push 0
push 0xc2
push edi
call esi
mov byte [0x43c9fc], 1
mov edi, 0x5f5e100
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x60]
push eax
push 0
push 0x43a
push dword [ebp - 4]
mov dword [ebp - 0x60], 0x5c
call esi
xor eax, eax
inc eax
cmp byte [ebp + 8], 0
mov byte [ebp - 0x47], 0
mov dword [ebp - 0x5c], eax
je 0x40d05c
mov ecx, dword [ebp - 0x58]
and ecx, 0xbfffffff
or ecx, eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x4c], 0xa0
mov dword [ebp - 0x5c], 0x40000001
lea ecx, [ebp - 0x60]
push ecx
push eax
push 0x444
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push 0
push 0xc2
push dword [ebp - 4]
call esi
push edi
push edi
push ebx
push dword [ebp - 4]
call esi
cmp byte [ebp + 8], 0
je 0x40d0a6
mov eax, dword [ebp - 0x58]
and eax, 0xfffffffe
or eax, 0x40000000
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x60]
push eax
push 1
push 0x444
push dword [ebp - 4]
call esi
push 0x42681c
push 0
push 0xc2
push dword [ebp - 4]
call esi
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40d454
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.00419e00
push ebx
mov ebx, ecx
push edi
mov edi, dword [ebp + 8]
test ebx, ebx
je 0x40d46f
mov byte [ebx], 0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x40d479
mov byte [eax], 0
test edi, edi
je 0x40d522
movzx eax, word [edi]
test ax, ax
je 0x40d522
push esi
xor esi, esi
xor ecx, ecx
movzx eax, ax
inc edi
inc edi
cmp ax, 0x3d
jne 0x40d4b2
cmp dword [ebp + 0xc], 0
je 0x40d4be
test esi, esi
jne 0x40d4be
test ebx, ebx
je 0x40d4ae
mov byte [ebx], 1
mov esi, edx
jmp 0x40d4cd
cmp ax, 0xd
je 0x40d4e0
cmp ax, 0xa
je 0x40d4e2
mov word [edx], ax
mov eax, dword [ebp + 0x14]
inc edx
add eax, 0xfffffffe
inc edx
cmp ecx, eax
jg 0x40d4d8
movzx eax, word [edi]
inc ecx
test ax, ax
jne 0x40d492
jmp 0x40d4e2
mov eax, dword [ebp + 0x10]
mov byte [eax], 1
jmp 0x40d4e2
inc edi
inc edi
mov ebx, dword [ebp + 0xc]
xor eax, eax
mov word [edx], ax
test ebx, ebx
je 0x40d51d
mov word [ebx], ax
test esi, esi
je 0x40d51d
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push dword [ebp + 0x14]
lea eax, [ebp - 0x2000]
push eax
push ebx
call fcn.00410823
xor eax, eax
mov word [esi], ax
mov eax, edi
pop esi
jmp 0x40d524
xor eax, eax
pop edi
pop ebx
leave
ret 0x10
Function at 0x40d569
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.00419e00
push 0x800
lea eax, [ebp - 0x1020]
push eax
call fcn.00419298
cmp byte [0x43c9fd], 0
jne 0x40d5fe
push 6
push dword [0x42b0c8]
lea eax, [ebp - 0x1020]
push eax
call fcn.0040a11f
push eax
call fcn.0041156d
test eax, eax
jne 0x40d5fe
push 0x42666c
call fcn.00419285
lea eax, [ebp - 0x1020]
push eax
call fcn.00419a83
xor ecx, ecx
push 0x1e
mov word [ebp + eax*2 - 0x101e], cx
push ecx
lea eax, [ebp - 0x20]
push eax
call fcn.00419b00
add esp, 0x10
push 0x14
pop eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x1020]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
leave
ret

Function at 0x40d75f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00419e00
push ebx
xor ebx, ebx
cmp byte [0x43ca30], bl
je 0x40d7e4
cmp word [0x4339d0], bx
je 0x40d7e4
push esi
push 0x4339d0
lea esi, [ebp - 0x1008]
call fcn.0040d722
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0x20006
push ebx
push ebx
push ebx
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
pop esi
test eax, eax
jne 0x40d7e4
push dword [ebp + 8]
call fcn.00419a83
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push ebx
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
leave
ret 4

Function at 0x40d7e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.00419e00
cmp byte [0x43ca30], 0
je 0x40d890
push esi
push dword [ebp + 8]
lea esi, [ebp - 0x200c]
call fcn.0040d722
lea eax, [ebp - 8]
push eax
push 1
push 0
push str.SoftwareWinRAR_SFX
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
test eax, eax
jne 0x40d890
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x100c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 0x200c]
push eax
push dword [ebp - 8]
mov dword [ebp - 4], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40d887
shr dword [ebp - 4], 1
mov eax, 0x7ff
cmp dword [ebp - 4], eax
jae 0x40d86b
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
xor ecx, ecx
mov word [ebp + eax*2 - 0x100c], cx
lea eax, [ebp - 0x100c]
push eax
push dword [ebp + 8]
call fcn.00410823
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret 8
Function at 0x40e3e1
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.USER32.dll_DialogBoxParamW]
cmp byte [0x43c9de], 0
mov eax, dword [ebp + 0xc]
mov dword [0x43c9e0], eax
mov eax, dword [ebp + 0x10]
mov dword [0x43c9e4], eax
mov eax, dword [ebp + 0x14]
mov dword [0x43c9d8], eax
je 0x40e411
xor eax, eax
inc eax
jmp 0x40e43a
cmp byte [0x43c9df], 0
je 0x40e41f
push 2
pop eax
jmp 0x40e43a
push dword [ebp + 8]
push 0x40db4c
push dword [0x43c9f8]
push str.REPLACEFILEDLG
push dword [0x42e764]
call esi
dec eax
je 0x40e48c
dec eax
je 0x40e49e
dec eax
je 0x40e485
dec eax
jne 0x40e469
push dword [ebp + 8]
push 0x40d100
push dword [0x43c9f8]
push str.RENAMEDLG
push dword [0x42e764]
call esi
test eax, eax
je 0x40e3eb
mov al, 0x52
jmp 0x40e499
dec eax
je 0x40e47a
dec eax
mov al, 0x4e
jne 0x40e499
mov byte [0x43c9df], 1
jmp 0x40e499
mov byte [0x43c9ea], 1
mov al, 0x43
jmp 0x40e499
mov byte [0x43c9de], 1
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov al, 0x59
pop esi
pop ebp
ret 0x10
mov al, 0x4e
jmp 0x40e499
Function at 0x410dd8
Capabilities:
Create thread

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov esi, ecx
push 0x20
pop ecx
mov dword [esi], eax
cmp eax, ecx
jbe 0x410ded
mov dword [esi], ecx
xor edi, edi
xor ebx, ebx
inc edi
cmp dword [esi], ebx
jne 0x410df8
mov dword [esi], edi
cmp dword [esi], ecx
jbe 0x410dfe
mov dword [esi], ecx
push ebx
push ecx
push ebx
push ebx
mov byte [esi + 0x190], bl
call dword [sym.imp.KERNEL32.dll_CreateSemaphoreW]
push ebx
push edi
push edi
push ebx
mov dword [esi + 0x194], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x198], eax
lea eax, [esi + 0x19c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp dword [esi + 0x194], ebx
je 0x410e41
cmp dword [esi + 0x198], ebx
jne 0x410e5c
push str._nThread_pool_initialization_failed.
mov edi, 0x42e76c
push edi
call fcn.004063a1
pop ecx
pop ecx
push 2
mov ecx, edi
call fcn.0040645d
mov dword [esp + 0x14], ebx
cmp dword [esi], ebx
jbe 0x410ed1
push ebp
lea ebp, [esi + 4]
lea eax, [esp + 0x10]
push eax
push ebx
push esi
push 0x410d91
push 0x10000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, ebx
jne 0x410ead
push str.CreateThread_failed
push 0x42e76c
call fcn.004063a1
pop ecx
pop ecx
mov ecx, 0x42e76c
call fcn.00401000
push 2
mov ecx, 0x42e76c
call fcn.0040645d
mov dword [ebp], edi
mov eax, dword [0x44a73c]
cmp eax, ebx
je 0x410ec1
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc dword [esp + 0x18]
mov eax, dword [esp + 0x18]
add ebp, 4
cmp eax, dword [esi]
jb 0x410e68
pop ebp
pop edi
mov dword [esi + 0x188], ebx
mov dword [esi + 0x18c], ebx
mov dword [esi + 0x84], ebx
mov eax, esi
pop esi
pop ebx
pop ecx
ret 4
Function at 0x414c9d
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x425a26
call fcn.00419784
push ecx
push ebx
push esi
mov esi, ecx
push 1
lea ecx, [esi + 4]
mov dword [ebp - 0x10], esi
call fcn.00409663
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x50], ebx
lea ecx, [esi + 0x97c8]
call fcn.00412221
lea ecx, [esi + 0xe570]
mov byte [ebp - 4], 4
call fcn.0040a811
push 1
lea ecx, [esi + 0xe5a8]
mov byte [ebp - 4], 5
call fcn.00409663
lea eax, [esi + 0xe5b8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe5c8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
lea eax, [esi + 0xe5d8]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov dword [eax + 0xc], ebx
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 9
mov dword [esi], eax
mov dword [esi + 0x4b34], ebx
mov byte [esi + 0x4b40], bl
mov byte [esi + 0x4b41], bl
mov byte [esi + 0x4b42], bl
mov dword [esi + 0x1c], 1
call fcn.00410eec
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x14], eax
mov dword [esi + 0x20], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xe5ec], ebx
mov dword [esi + 0xe5f0], ebx
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x418813
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call ebx
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
test eax, eax
jl 0x418845
cmp dword [ebp - 4], edi
jne 0x418886
call ebx
sub eax, dword [ebp - 0xc]
cmp eax, 0x2710
ja 0x418886
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x418832
push edi
push edi
push edi
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x418832
mov eax, dword [esi]
lea ecx, [ebp - 4]
push ecx
push esi
call dword [eax + 0x48]
mov esi, eax
cmp esi, edi
jl 0x4188dc
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x4270e8
push eax
call dword [ecx]
mov esi, eax
cmp esi, edi
jl 0x4188d3
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
mov esi, eax
cmp esi, edi
jl 0x4188ca
mov eax, dword [ebp - 8]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov esi, eax
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
cmp esi, edi
pop edi
pop esi
setge al
pop ebx
leave
ret 8
Function at 0x41909a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 0x18]
sub esp, 0x10
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
mov esi, ecx
mov byte [esi + 0x21], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp + 8]
mov ecx, esi
call fcn.00419033
mov eax, dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 0x14], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
call ebx
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [esi + 4]
test eax, eax
je 0x419101
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
push esi
push dword [esi]
sub edi, eax
push 0
push dword [ebp + 0xc]
lea ecx, [eax + 1]
dec edi
mov dword [ebp + 0x18], ecx
dec edi
call ebx
push eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push eax
push edi
push dword [ebp - 0xc]
xor edi, edi
push dword [ebp + 0x18]
push 0x40000000
push edi
push str.RarHtmlClassName
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
cmp dword [esi + 0xc], edi
jne 0x419183
cmp dword [ebp + 0xc], edi
je 0x4191a6
cmp dword [esi + 0x14], edi
jne 0x4191a6
mov eax, dword [esi + 0x10]
cmp eax, edi
je 0x4191a6
push eax
mov ecx, esi
call fcn.00418d0e
mov esi, eax
cmp esi, edi
je 0x4191a6
push 5
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.004197a3
pop ecx
jmp 0x4191a6
cmp eax, edi
je 0x419199
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x1c], 0x64
jbe 0x4191a6
mov ecx, esi
call fcn.00418a18
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x4191ad
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x4270d8
push 1
xor ebx, ebx
push ebx
push 0x427188
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x41927e
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x427178
push eax
call dword [ecx]
test eax, eax
jl 0x419275
cmp byte [ebp + 8], bl
je 0x419200
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x41921d
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x41922f
push 0x426554
jmp 0x419232
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x419247
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x419258
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x41926c
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x419298
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x41d99b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42b280]
jne 0x41d9a5
repz ret
jmp fcn.00422653
Function at 0x423f75
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041da1c
and dword [ebp - 4], 0
cmp dword [0x44b370], 0
mov ebx, eax
jne 0x424026
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4240d7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4240d7
push eax
call fcn.0041d9aa
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44b370], eax
call esi
push eax
call fcn.0041d9aa
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44b374], eax
call esi
push eax
call fcn.0041d9aa
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44b378], eax
call esi
push eax
call fcn.0041d9aa
pop ecx
mov dword [0x44b380], eax
test eax, eax
je 0x424026
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041d9aa
pop ecx
mov dword [0x44b37c], eax
mov eax, dword [0x44b37c]
cmp eax, ebx
je 0x42407e
cmp dword [0x44b380], ebx
je 0x42407e
push eax
call fcn.0041da25
push dword [0x44b380]
mov esi, eax
call fcn.0041da25
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42407e
test edi, edi
je 0x42407e
call esi
test eax, eax
je 0x424075
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424075
test byte [ebp - 0xc], 1
jne 0x42407e
or dword [ebp + 0x10], 0x200000
jmp 0x4240b7
mov eax, dword [0x44b374]
cmp eax, ebx
je 0x4240b7
push eax
call fcn.0041da25
pop ecx
test eax, eax
je 0x4240b7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4240b7
mov eax, dword [0x44b378]
cmp eax, ebx
je 0x4240b7
push eax
call fcn.0041da25
pop ecx
test eax, eax
je 0x4240b7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44b370]
call fcn.0041da25
pop ecx
test eax, eax
je 0x4240d7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4240d9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406080
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x42a3cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, dword [esp + 0x18]
push edi
lea ecx, [esi + 4]
mov dword [esi], 0x40433c
call fcn.00406ce1
push 4
mov dword [esp + 0x18], 0
call fcn.00407ba2
mov edi, eax
add esp, 4
test edi, edi
je 0x4060f4
push ebx
call fcn.00406bb9
mov dword [edi], eax
call fcn.00406978
push 0
lea ecx, [esp + 0x10]
mov ebx, eax
call fcn.00406ca2
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4060e8
inc eax
mov dword [ebx + 4], eax
lea ecx, [esp + 0xc]
call fcn.00406cca
pop ebx
jmp 0x4060f6
xor edi, edi
mov dword [esi + 0x38], edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov ecx, dword [esp + 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 4

Function at 0x408611
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42ddc0]
jne 0x40861b
repz ret
jmp fcn.0040dd7c
Function at 0x412984
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42ddc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a98a
and dword [ebp - 0x14], 0
cmp dword [0x4303b4], 0
mov dword [ebp - 0x18], eax
jne 0x412a37
push 0x403fa0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x412adf
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x403f94
push ebx
call edi
test eax, eax
je 0x412adf
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x403f84
push ebx
mov dword [0x4303b4], eax
call edi
push eax
call esi
push 0x403f70
push ebx
mov dword [0x4303b8], eax
call edi
push eax
call esi
push 0x403f54
push ebx
mov dword [0x4303bc], eax
call edi
push eax
call esi
mov dword [0x4303c4], eax
test eax, eax
je 0x412a37
push 0x403f3c
push ebx
call edi
push eax
call esi
mov dword [0x4303c0], eax
mov eax, dword [0x4303c0]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x412a90
cmp dword [0x4303c4], ecx
je 0x412a90
push eax
call esi
push dword [0x4303c4]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x412a90
test ebx, ebx
je 0x412a90
call edi
test eax, eax
je 0x412a87
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x412a87
test byte [ebp - 8], 1
jne 0x412a90
or dword [ebp + 0x10], 0x200000
jmp 0x412ac3
mov eax, dword [0x4303b8]
cmp eax, dword [ebp - 0x18]
je 0x412ac3
push eax
call esi
test eax, eax
je 0x412ac3
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412ac3
mov eax, dword [0x4303bc]
cmp eax, dword [ebp - 0x18]
je 0x412ac3
push eax
call esi
test eax, eax
je 0x412ac3
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4303b4]
call esi
test eax, eax
je 0x412adf
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x412ae1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408611
leave
ret