joyce8/EMBER2024-capa huggingface dataset:
Function at 0x59bf80
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x59bfa7
test edi, 0x40000
je 0x59bfc1
test bl, bl
jne 0x59c050
mov eax, 0x40000
and eax, edi
cmp eax, 0x40000
jne 0x59c050
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x59bff4
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x59c010
mov eax, esi
mov edx, 0xffffffec
mov ecx, 0x40000
or ecx, edi
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
jmp 0x59c026
mov eax, esi
mov edx, 0xffffffec
mov ecx, 0xfffbffff
and ecx, edi
push ecx
push edx
push eax
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x59c037
cmp byte [esp + 2], 0
je 0x59c050
cmp byte [esp + 2], 0
je 0x59c048
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x59c050
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x59c300
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x59c326
mov eax, esp
push eax
push 0x59c2c8
call sub.user32.dll_EnumWindows
jmp 0x59c339
mov eax, esp
push eax
push 0x59c2a8
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x59c3fc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x59c44c]
test bl, 4
je 0x59c410
or si, 1
test bl, 8
je 0x59c419
or si, 4
test bl, 1
je 0x59c422
or si, 8
test bl, 2
je 0x59c42b
or si, 0x10
test bl, 0x10
je 0x59c434
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x59c444
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x59c450
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x59c48c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x59c46b
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x59c47b
or bx, 4
test esi, 0x20000000
je 0x59c487
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x5a51b0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x5a51c2
add esp, 0xfffffff0
call fcn.00407b88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c2798
mov eax, dword [0x5d8af0]
mov dword [eax + 4], ebx
mov dword [eax], 0x5a566c
mov eax, dword [0x5d8b00]
mov dword [eax + 4], ebx
mov dword [eax], 0x5a5678
mov eax, ebx
call fcn.005a5684
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x44], eax
mov dl, 1
mov eax, dword [0x48a0c8]
call fcn.00407554
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x48a0c8]
call fcn.00407554
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x48a0c8]
call fcn.00407554
mov dword [ebx + 0x5c], eax
mov dl, 1
mov eax, dword [0x48a0c8]
call fcn.00407554
mov dword [ebx + 0x60], eax
mov dl, 1
mov eax, dword [0x48a0c8]
call fcn.00407554
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x48], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x60]
push eax
mov eax, 0x59ff3c
push eax
push 0
push 0
call sub.user32.dll_EnumDisplayMonitors
mov dl, 1
mov eax, dword [0x4f6aa0]
call fcn.004fcbf0
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x4f6aa0]
call fcn.004fcbf0
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x4f6aa0]
call fcn.004fcbf0
mov dword [ebx + 0x80], eax
mov dl, 1
mov eax, dword [0x4f6aa0]
call fcn.004fcbf0
mov dword [ebx + 0x8c], eax
mov dl, 1
mov eax, dword [0x4f6aa0]
call fcn.004fcbf0
mov dword [ebx + 0x90], eax
mov eax, ebx
call fcn.005a5c74
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a5a90
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a5a90
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a5a90
mov eax, dword [ebx + 0x8c]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a5a90
mov eax, dword [ebx + 0x90]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x5a5a90
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5a533f
call fcn.00407be0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x5a5830
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x5a59db
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3c], 0
jne 0x5a59bc
mov dl, 1
mov eax, dword [0x48d884]
call fcn.004b0b64
mov edx, dword [ebp - 4]
mov dword [edx + 0x3c], eax
mov eax, dword [ebp - 4]
add eax, 0x40
call fcn.004091c4
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x5a59ab
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0052968c
test al, al
je 0x5a599e
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x5a59ec
lea eax, [ebp - 0x394]
call fcn.00422300
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x5a599e
xor eax, eax
push ebp
push 0x5a5997
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x5a5a5c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x5a5980
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409dac
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x44]
jne 0x5a5980
mov eax, dword [ebp - 4]
add eax, 0x40
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00409dac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a599e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x5a58a1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
mov byte [eax + 0x39], 0
mov dl, 1
call fcn.004b0aa0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x3c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a59e2
lea eax, [ebp - 0x3a0]
call fcn.004091c4
ret

Function at 0x5a659c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x5df330]
cmp byte [eax + 0xb9], 0
jne 0x5a660e
cmp dword [0x5df350], 0
jne 0x5a65ce
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x5d8944]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x5df350], eax
cmp dword [0x5df34c], 0
jne 0x5a65e9
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x5df34c], eax
cmp dword [0x5df354], 0
jne 0x5a660e
push esp
push 0
push 0
mov eax, dword [0x5d8940]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x5df354], eax
pop edx
ret
Function at 0x5a6bfc
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
test dl, dl
je 0x5a6c13
add esp, 0xfffffff0
call fcn.00407b88
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004c2798
mov eax, dword [0x5d89bc]
cmp byte [eax], 0
jne 0x5a6c40
push 0
call sub.ole32.dll_OleInitialize
test eax, 0x80000000
sete al
mov byte [ebx + 0x18c], al
mov eax, dword [0x5d8ccc]
cmp word [eax + 2], 0
jne 0x5a6c5a
mov eax, dword [0x5d8ccc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005a8f0c
mov eax, dword [0x5d8df8]
cmp word [eax + 2], 0
jne 0x5a6c74
mov eax, dword [0x5d8df8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.005a9110
mov byte [ebx + 0x39], 0
mov dl, 1
mov eax, dword [0x4f6aa0]
call fcn.004fcbf0
mov esi, eax
mov dword [ebx + 0x4c], esi
mov dword [esi + 0xc], ebx
mov dword [esi + 8], 0x5a9688
mov dl, 1
mov eax, dword [0x48a0c8]
call fcn.00407554
mov dword [ebx + 0x9c], eax
mov dl, 1
mov eax, dword [0x48a0c8]
call fcn.00407554
mov dword [ebx + 0xbc], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
xor eax, eax
mov dword [ebx + 0x90], eax
mov dword [ebx + 0x68], 0xff000018
mov dword [ebx + 0x84], 0x1f4
mov byte [ebx + 0x88], 1
xor eax, eax
mov dword [ebx + 0x8c], eax
mov dword [ebx + 0x80], 0x9c4
mov byte [ebx + 0x94], 0
mov byte [ebx + 0xb1], 1
mov byte [ebx + 0xc8], 1
mov dl, 1
mov eax, dword [0x4fb4c8]
call fcn.00506360
mov esi, eax
mov dword [ebx + 0xac], esi
push 0x5a6e5c
mov eax, dword [0x5d8b94]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconW
mov edx, eax
mov eax, esi
call fcn.005067f0
mov eax, dword [ebx + 0xac]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x5a9970
mov dl, 1
mov eax, dword [0x48a0c8]
call fcn.00407554
mov dword [ebx + 0xa4], eax
push pe_nt_image_headers32
lea eax, [ebp - 0x202]
push eax
mov eax, dword [0x5d8b94]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameW_1
lea eax, [ebp - 0x202]
mov dx, 0x5c
call fcn.00422114
test eax, eax
je 0x5a6d8e
lea edx, [eax + 2]
lea eax, [ebp - 0x202]
call fcn.00421f50
lea eax, [ebp - 0x202]
mov dx, 0x2e
call fcn.004220f8
test eax, eax
je 0x5a6da6
mov word [eax], 0
lea eax, [ebp - 0x202]
push eax
call sub.user32.dll_CharNextW_1
push eax
call sub.user32.dll_CharLowerW
lea eax, [ebx + 0x98]
lea edx, [ebp - 0x202]
mov ecx, pe_nt_image_headers32
call fcn.00409dac
push ebx
push 0x5a88e8
call fcn.0059c3e0
mov dword [ebx + 0x188], eax
mov byte [ebx + 0xdc], 0
mov eax, dword [0x5d89bc]
cmp byte [eax], 0
jne 0x5a6df7
mov eax, ebx
call fcn.005a7024
mov byte [ebx + 0x65], 1
mov byte [ebx + 0x66], 1
mov byte [ebx + 0x67], 1
mov byte [ebx + 0xb2], 1
mov byte [ebx + 0xdd], 0
mov byte [ebx + 0xe8], 0
xor eax, eax
mov dword [ebx + 0xe0], eax
mov byte [ebx + 0xdf], 0
xor eax, eax
mov dword [ebx + 0xb4], eax
mov eax, ebx
call fcn.005a9bb8
mov eax, ebx
call fcn.005aa808
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x5a6e54
call fcn.00407be0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5a735c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x180]
test eax, eax
je 0x5a7408
cmp dword [ebx + 0xa0], 0
jne 0x5a7402
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x5a7294
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x9c]
cmp dword [eax + 8], 0
je 0x5a7402
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
mov eax, esi
mov edx, 0xffffffec
push edx
push eax
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x5a73c8
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x9c]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x5a7402
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x9c]
call fcn.004ac484
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x5a73d7
inc dword [ebx + 0xa0]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x5a7628
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x5df330]
cmp dword [eax + 0x180], 0
je 0x5a778d
test bl, bl
jne 0x5a76db
cmp dword [esi + 0xa8], 0
jne 0x5a76d0
mov eax, esi
call fcn.005aa658
push eax
push 0x5a7534
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x50], 0
je 0x5a76a1
mov eax, dword [0x5df330]
cmp byte [eax + 0xdf], 0
je 0x5a76a1
mov eax, dword [esi + 0xe4]
call fcn.0040af70
mov edi, eax
cmp edi, 0
jl 0x5a76a1
push 0
mov eax, dword [esi + 0xe4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5a768a
mov eax, dword [esi + 0xa4]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5a76d0
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xa4]
call fcn.004ac484
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5a76b0
inc dword [esi + 0xa8]
jmp 0x5a778d
cmp dword [esi + 0xa8], 0
jle 0x5a778d
dec dword [esi + 0xa8]
cmp dword [esi + 0xa8], 0
jne 0x5a778d
cmp dword [esi + 0x50], 0
je 0x5a7738
mov eax, dword [0x5df330]
cmp byte [eax + 0xdf], 0
je 0x5a7738
mov eax, dword [esi + 0xe4]
call fcn.0040af70
mov edi, eax
cmp edi, 0
jl 0x5a7738
push 5
mov eax, dword [esi + 0xe4]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x5a7721
mov eax, dword [esi + 0xa4]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x5a7767
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0xa4]
call fcn.004ac484
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x5a7747
mov eax, dword [esi + 0xa4]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xe4]
mov ecx, 1
mov edx, dword [0x599258]
call fcn.0040b184
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x5a83e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffe00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xb8], 0
je 0x5a8445
cmp byte [ebx + 0xdf], 0
jne 0x5a8445
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x180]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040934c
mov eax, dword [esi]
test eax, eax
je 0x5a8432
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x5a8452
mov eax, esi
mov edx, dword [ebx + 0x98]
call fcn.004095a4
jmp 0x5a8452
mov eax, esi
mov edx, dword [ebx + 0x98]
call fcn.004095a4
add esp, 0x200
pop esi
pop ebx
ret

Function at 0x5a9da4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x90]
test esi, esi
je 0x5a9e15
mov eax, esi
call fcn.005234c4
test al, al
je 0x5a9e15
mov eax, dword [ebx + 0x90]
call fcn.00523110
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x5a9e15
mov eax, dword [ebx + 0x90]
mov edx, dword [eax]
call dword [edx + 0x110]
test al, al
je 0x5a9e06
push 0
mov eax, dword [ebx + 0x90]
call fcn.00523110
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x90]
call fcn.00519e54
jmp 0x5a9e15
mov cl, 1
mov edx, dword [ebx + 0x80]
mov eax, ebx
call fcn.005a9bd8
pop esi
pop ebx
ret
Function at 0x404c5e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x505ef8]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push esi
mov esi, dword [0x50af4c]
push edi
push 0xf0
push eax
xor edi, edi
push esi
mov dword [ebp - 0x10c], ecx
inc edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x404dcd
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x404dcd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404dcd
push ebx
movzx eax, word [esi]
xor ecx, ecx
cmp cx, ax
je 0x404dcc
mov ecx, dword [esi + 4]
mov ebx, eax
movzx eax, word [esi + 2]
mov dword [ebp - 0x110], ecx
mov ecx, 0x403
add esi, 8
cmp cx, ax
jne 0x404d46
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x108], eax
call fcn.00405b19
push dword [ebp - 0x108]
mov eax, dword [ebp - 0x10c]
push 0
push 0x143
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
lea eax, [ebp - 0x104]
cmove edi, ecx
cmp dword [ebp - 0x108], eax
je 0x404dbe
push dword [ebp - 0x108]
call fcn.0048fa51
pop ecx
jmp 0x404dbe
mov ecx, 0x1234
cmp cx, ax
jne 0x404dbe
or dword [ebp - 0x130], 0xffffffff
push 3
lea eax, [ebp - 0x104]
push esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x134], 1
mov dword [ebp - 0x108], eax
call fcn.00405b19
mov eax, dword [ebp - 0x108]
lea ecx, [ebp - 0x104]
mov dword [ebp - 0x12c], eax
cmp eax, ecx
je 0x404d98
push eax
call fcn.0048fa51
pop ecx
lea eax, [ebp - 0x134]
push eax
mov eax, dword [ebp - 0x10c]
push 0
push 0x40b
push ebx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor ecx, ecx
cmp eax, 0xffffffff
cmove edi, ecx
add esi, dword [ebp - 0x110]
test edi, edi
jne 0x404cbd
pop ebx
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.0048f354
leave
ret 4
Function at 0x40fbcb
Capabilities:
Encode data using xor

Disassembly:
push 0x68
mov eax, 0x4adc99
call fcn.0048f423
mov eax, dword [0x507340]
imul eax, eax
push 9
cdq
pop ecx
idiv ecx
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x4c], ebx
cmp edx, 6
jne 0x40fbb9
inc dword [0x507650]
push 0
lea ecx, [ebp - 0x60]
call fcn.0042f326
and dword [ebp - 4], 0
lea eax, [ebp - 0x60]
push eax
push 1
push 0x4094ed
call fcn.0041437b
push eax
call fcn.0041b105
push 8
pop esi
test eax, eax
jne 0x40fc6c
push 0x505ab0
lea ecx, [ebp - 0x4c]
call fcn.00408fd9
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x4c]
push str.getIntallLanguageGroups_error_EnumSystemLanguageGroups__d
push eax
call fcn.00405092
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00438012
add esp, 0x14
push eax
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.0042f275
lea eax, [ebp - 0x74]
push eax
push 0x4c0c00
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 3
call fcn.0042f5f2
mov ecx, eax
call fcn.0042f4ab
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], 2
call fcn.0042f451
lea ecx, [ebp - 0x28]
call fcn.00401056
mov ecx, dword [ebp - 0x4c]
mov byte [ebp - 4], 0
lea ecx, [ecx - 0x10]
call fcn.00407864
jmp 0x40fcac
call fcn.00411272
test al, al
jne 0x40fcac
mov esi, dword [0x507340]
push 8
xor edx, edx
pop ebx
mov ecx, edx
mov edi, ebx
mov eax, ecx
and eax, 1
dec eax
not eax
and eax, esi
sar ecx, 1
xor ecx, eax
dec edi
jne 0x40fc84
add esi, ecx
inc edx
cmp edx, 0x100
jl 0x40fc80
mov ebx, dword [ebp - 0x4c]
push 8
mov dword [0x507340], esi
pop esi
lea ecx, [ebp - 0x48]
call fcn.00430a82
push 0x505ab0
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 4
call fcn.00408fd9
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.00432bf9
cmp dword [eax + 0x14], 0x10
mov byte [ebp - 4], 6
jb 0x40fce5
mov eax, dword [eax]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00401027
lea eax, [ebp - 0x50]
push eax
call fcn.00437fc7
add esp, 0x1c
push eax
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 7
call fcn.00402394
mov ecx, dword [ebp - 0x50]
lea ecx, [ecx - 0x10]
call fcn.00407864
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00401056
mov word [ebx], si
call fcn.00411254
test al, al
jne 0x40fd34
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov esi, dword [ebp - 0x4c]
push dword [esi - 0xc]
push esi
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
test eax, eax
jne 0x40fd4a
call fcn.00409bd9
lea ecx, [esi - 0x10]
mov dword [ebx + 8], eax
call fcn.00407864
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 0
call fcn.004090f2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x60]
call fcn.0042f451
call fcn.0048f3d2
ret
Function at 0x41c89d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x15f8
call fcn.00492330
mov eax, dword [0x505ef8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
call fcn.0041cc37
xor ecx, ecx
test al, al
jne 0x41c8d7
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor ecx, ecx
cmp dword [esi + 0x10], ecx
jne 0x41c963
call fcn.0041cc0f
test al, al
jne 0x41c950
xor eax, eax
push 0x15f0
push eax
mov word [ebp - 0x15f8], ax
lea eax, [ebp - 0x15f6]
push eax
call fcn.004913e0
add esp, 0xc
xor edi, edi
xor esi, esi
xor edx, edx
test edi, edi
je 0x41c935
test edx, edx
je 0x41c935
lea eax, [esi + edx]
lea ecx, [esi + edx]
mov ax, word [ebp + eax*2 - 0x1662]
inc ax
add ax, word [ebp + ecx*2 - 0x15fa]
mov word [ebp + ecx*2 - 0x15f8], ax
inc edx
cmp edx, 0x35
jl 0x41c90d
add esi, 0x35
inc edi
cmp esi, 0xaf9
jl 0x41c90b
movsx eax, word [ebp - 8]
mov dword [0x507340], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048f354
leave
ret 8
cmp dword [esi + 0x14], ecx
je 0x41c950
cmp dword [esi + 0x18], ecx
je 0x41c950
cmp dword [esi + 0x1c], ecx
je 0x41c950
push ebx
push dword [edi]
mov ecx, esi
call fcn.0041ca31
jmp 0x41c952

Function at 0x41c97e
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, ecx
push esi
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 8]
mov ecx, eax
mov dword [ebp - 8], eax
call fcn.0041c89d
mov esi, eax
test esi, esi
jne 0x41c9c3
mov eax, dword [0x507340]
imul eax, eax
push 0xf
cdq
pop ecx
idiv ecx
cmp edx, 0xb
jne 0x41c9bf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x507340], eax
xor al, al
jmp 0x41ca2c
push ebx
push edi
xor ebx, ebx
push dword [ebp - 4]
inc ebx
push 0x41cb3e
call dword [sym.imp.USER32.dll_EnumWindows]
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x41c9f3
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov edi, eax
jmp 0x41c9f6
xor edi, edi
inc edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 5
jge 0x41ca22
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0041c89d
mov esi, eax
test esi, esi
jne 0x41c9c7
xor eax, eax
cmp edi, 1
pop edi
sete al
pop ebx
pop esi
leave
ret 4