joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405eb8
Capabilities:
Resume thread
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_ResumeThread
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4060e8
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x405f3b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x4060e8
push 0x80000002
call sub.user32.dll_UpdateWindow
test eax, eax
je 0x405f3b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x406104
push 0x80000001
call sub.user32.dll_UpdateWindow
test eax, eax
jne 0x405fc4
xor eax, eax
push ebp
push 0x405fbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405d00
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x405fa2
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406124
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_WaitMessage
test eax, eax
je 0x405fa2
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405fc4
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_UnregisterClassA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetLocalTime
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_SetFileAttributesA
push eax
call sub.KERNEL32.DLL_ResetEvent
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4060de
cmp byte [ebp - 0xd], 0
jne 0x40600b
cmp byte [ebp - 0x12], 0
je 0x4060de
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetThreadContext
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x406024
dec ebx
cmp byte [ebx], 0x2e
je 0x406033
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x406023
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4060de
inc ebx
cmp byte [ebp - 0x12], 0
je 0x406070
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_SetLocalTime
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov esi, eax
test esi, esi
jne 0x4060de
cmp byte [ebp - 0xd], 0
je 0x4060de
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetLocalTime
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov esi, eax
test esi, esi
jne 0x4060de
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_SetLocalTime
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_SetFilePointer
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40aee0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x118], ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b02e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040486c
mov eax, dword [ebp + 8]
mov ax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x12]
mov word [ebp - 0xe], ax
lea eax, [ebp - 4]
mov edx, 0x40b044
call fcn.00404904
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d2c
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.user32.dll_GetTopWindow
push eax
call sub.user32.dll_GetKeyboardLayoutList
test eax, eax
je 0x40b00d
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.00404adc
dec esi
jne 0x40b00d
mov eax, dword [0x4a0744]
sub eax, 4
je 0x40afb0
sub eax, 0xd
jne 0x40b00d
push ebx
mov eax, dword [ebx]
mov edx, 1
call fcn.0040d5dc
mov ecx, eax
mov eax, dword [ebx]
mov edx, 1
call fcn.00404d8c
jmp 0x40b00d
cmp dword [0x4a0748], 1
jne 0x40b00d
mov eax, dword [ebx]
call fcn.00404b2c
mov edx, eax
mov eax, dword [ebx]
call fcn.0040d468
cmp eax, 4
jne 0x40b00d
mov eax, dword [ebx]
mov edx, 3
call fcn.0040d578
mov esi, eax
lea eax, [ebp - 0x114]
add esi, eax
dec esi
lea eax, [ebp - 0x118]
mov edx, esi
call fcn.00404a64
mov eax, dword [ebp - 0x118]
mov edx, 2
call fcn.0040d5dc
mov ecx, eax
mov eax, ebx
mov edx, esi
call fcn.0040495c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b035
lea eax, [ebp - 0x118]
call fcn.0040486c
lea eax, [ebp - 4]
call fcn.0040486c
ret

Function at 0x40b048
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b126
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040486c
mov eax, dword [ebp + 8]
mov ax, word [eax - 0xe]
mov word [ebp - 0x14], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x10]
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 8]
mov ax, word [eax - 0x12]
mov word [ebp - 0xe], ax
cmp esi, 2
jg 0x40b0a6
lea eax, [ebp - 4]
mov edx, 0x40b13c
call fcn.00404904
jmp 0x40b0b3
lea eax, [ebp - 4]
mov edx, 0x40b148
call fcn.00404904
push 0x100
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.00404d2c
push eax
lea eax, [ebp - 0x14]
push eax
push 4
call sub.user32.dll_GetTopWindow
push eax
call sub.user32.dll_GetKeyboardLayoutList
test eax, eax
je 0x40b110
mov eax, ebx
lea edx, [ebp - 0x114]
mov ecx, 0x100
call fcn.00404adc
dec esi
jne 0x40b110
mov eax, dword [ebx]
cmp byte [eax], 0x30
jne 0x40b110
push ebx
mov eax, dword [ebx]
call fcn.00404b2c
mov ecx, eax
dec ecx
mov eax, dword [ebx]
mov edx, 2
call fcn.00404d8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b12d
lea eax, [ebp - 4]
call fcn.0040486c
ret
Function at 0x40c270
Capabilities:
Read clipboard data

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, edx
push 0
push 0x100
lea edx, [esp + 8]
push edx
push 0
push eax
push 0
push 0x3200
call sub.user32.dll_GetClipboardData
jmp 0x40c297
dec eax
test eax, eax
jle 0x40c2a9
mov dl, byte [esp + eax - 1]
sub dl, 0x21
jb 0x40c296
sub dl, 0xd
je 0x40c296
mov edx, esp
mov ecx, ebx
xchg ecx, eax
call fcn.0040495c
add esp, 0x100
pop ebx
ret

Function at 0x40d2c8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40d39e
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404904
lea eax, [ebp - 8]
call fcn.00404d7c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d2c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40d388
mov eax, ebx
call fcn.0040272c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40d381
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404d2c
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40d36b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40d3b0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40d36b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d388
mov eax, dword [ebp - 0x10]
call fcn.0040274c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40d3a5
lea eax, [ebp - 8]
call fcn.0040486c
ret

Function at 0x40e404
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov edi, eax
mov bl, 1
call sub.user32.dll_GetKeyboardLayout
mov esi, eax
cmp esi, dword [edi + 0x24]
je 0x40e495
mov eax, edi
call fcn.0040e3c0
mov ebp, dword [edi + 0x28]
mov edx, esp
mov eax, dword [edi + 0x20]
call fcn.0040e23c
mov eax, dword [esp]
cmp dword [eax + 0xc], 0
seta bl
test bl, bl
je 0x40e45d
lea eax, [edi + 0xc]
call fcn.0040e1ac
jmp 0x40e45d
lea eax, [edi + 0xc]
mov edx, 0xffff
call fcn.0040e1cc
test eax, eax
je 0x40e45d
mov eax, edi
call fcn.0040e3f4
lea eax, [edi + 0xc]
mov edx, 0xffff0001
call fcn.0040e1cc
cmp eax, 0xffff
jne 0x40e445
mov eax, edi
call fcn.0040e3c0
test bl, bl
je 0x40e484
lea eax, [edi + 0xc]
call fcn.0040e1b8
mov dword [edi + 0x24], esi
lea eax, [edi + 0x28]
call fcn.0040e1ac
dec eax
cmp eax, ebp
sete bl
inc dword [edi + 0x1c]
mov eax, ebx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40e4f0
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
push ecx
mov esi, eax
mov edx, esp
mov eax, dword [esi + 0x20]
call fcn.0040e23c
mov eax, dword [esp]
inc dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 1
seta bl
call sub.user32.dll_GetKeyboardLayout
cmp eax, dword [esi + 0x24]
je 0x40e556
test bl, bl
jne 0x40e556
mov eax, esi
call fcn.0040e3e4
jmp 0x40e54a
lea eax, [esi + 0xc]
call fcn.0040e1ac
cmp eax, 0xffff
jne 0x40e53c
mov eax, esi
call fcn.0040e3d8
push 0
call fcn.0040e060
mov eax, esi
call fcn.0040e3e4
lea eax, [esi + 0xc]
call fcn.0040e1b8
test eax, eax
jle 0x40e526
pop edx
pop esi
pop ebx
ret

Function at 0x40e55c
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push ecx
mov ebx, eax
mov edx, esp
mov eax, dword [ebx + 0x20]
call fcn.0040e23c
mov eax, dword [esp]
dec dword [eax + 0xc]
mov eax, dword [esp]
cmp dword [eax + 0xc], 0
jne 0x40e5c1
mov edx, esp
mov eax, dword [ebx + 0x20]
call fcn.0040e2b4
call sub.user32.dll_GetKeyboardLayout
cmp eax, dword [ebx + 0x24]
je 0x40e5c1
lea eax, [ebx + 0xc]
call fcn.0040e1ac
mov ecx, eax
cmp ecx, 0xffff
jne 0x40e5a8
mov eax, ebx
call fcn.0040e3d8
jmp 0x40e5c1
test ecx, ecx
jg 0x40e5c1
mov eax, ecx
mov ecx, 0xffff
cdq
idiv ecx
test edx, edx
jne 0x40e5c1
mov eax, ebx
call fcn.0040e3d8
pop edx
pop ebx
ret

Function at 0x411b58
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, edx
mov ebx, eax
cmp dword [0x4a0820], 0
je 0x411b7a
cmp bx, 0x100
jb 0x411b7a
cmp bx, 0x7ff
jbe 0x411b7e
xor eax, eax
jmp 0x411b80
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x411c07
push 0x4a0824
call sub.user32.dll_ExitWindowsEx
xor eax, eax
push ebp
push 0x411c00
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a0820]
call fcn.00405a14
movzx edi, bx
mov edx, edi
sub edx, 0x100
cmp eax, edx
setg byte [ebp - 1]
cmp byte [ebp - 1], 0
je 0x411be8
mov eax, dword [0x4a0820]
mov eax, dword [eax + edi*4 - 0x400]
mov dword [esi], eax
cmp dword [esi], 0
je 0x411bdf
mov eax, dword [esi]
cmp eax, dword [0x49b34c]
jne 0x411be3
xor eax, eax
jmp 0x411be5
mov al, 1
mov byte [ebp - 1], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411c07
push 0x4a0824
call sub.user32.dll_IsWindow
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x411c10
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x411ce6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
push 0x4a0824
call sub.user32.dll_ExitWindowsEx
xor eax, eax
push ebp
push 0x411cc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4a0820]
call fcn.00405a1c
mov esi, eax
test esi, esi
jl 0x411cb1
inc esi
xor edi, edi
mov eax, dword [0x4a0820]
mov ebx, dword [eax + edi*4]
test ebx, ebx
je 0x411cad
cmp ebx, dword [0x49b34c]
je 0x411cad
lea edx, [ebp - 0x110]
mov eax, dword [ebx]
call fcn.004039e8
lea edx, [ebp - 0x110]
lea eax, [ebp - 0x10]
call fcn.00404ad0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00408b34
test al, al
je 0x411cad
mov eax, dword [ebp - 8]
mov dword [eax], ebx
mov byte [ebp - 9], 1
jmp 0x411cb1
inc edi
dec esi
jne 0x411c64
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x411cd0
push 0x4a0824
call sub.user32.dll_IsWindow
ret

Function at 0x414910
Capabilities:
Shutdown system

Disassembly:
add eax, 8
push eax
call sub.user32.dll_ExitWindowsEx
ret
Function at 0x41ba24
Capabilities:
Get keyboard layout
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, eax
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [0x49f30c]
cmp eax, dword [edx]
je 0x41ba67
call sub.user32.dll_GetKeyboardLayout
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
push 0
mov ecx, dword [0x49f094]
mov dl, 1
mov eax, dword [0x413c9c]
call fcn.0040cb70
call fcn.00404224
test ebx, ebx
jle 0x41ba74
mov eax, ebx
call fcn.0041b9e4
jmp 0x41ba79
call fcn.0041b9d8
xor eax, eax
mov dword [ebp - 0xc], eax
push 0x4a0868
call sub.user32.dll_ExitWindowsEx
xor eax, eax
push ebp
push 0x41bbb2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push 0x49b40c
call sub.user32.dll_GetDC
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x41bb93
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0xc], 0
je 0x41bac4
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41bac8
xor eax, eax
jmp 0x41baca
mov al, 1
mov byte [ebp - 1], al
cmp byte [ebp - 1], 0
je 0x41bb7d
jmp 0x41bb70
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00415574
mov dword [ebp - 8], eax
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.00415464
push 0x4a0868
call sub.user32.dll_IsWindow
xor eax, eax
push ebp
push 0x41bb5d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x41bb2e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x41bb45
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bb64
push 0x4a0868
call sub.user32.dll_ExitWindowsEx
ret
mov eax, dword [ebp - 0xc]
cmp dword [eax + 8], 0
jg 0x41badc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bb9a
mov eax, dword [ebp - 0xc]
call fcn.00403a98
ret
Function at 0x41be98
Capabilities:
Get keyboard layout
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 4], edx
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [0x49f30c]
cmp eax, dword [edx]
jne 0x41bebf
mov ebx, dword [ebp - 4]
mov eax, dword [ebx + 0xc]
call dword [ebx + 8]
jmp 0x41bfd2
push 0
push 0
push 0xffffffffffffffff
push 0
call sub.user32.dll_EnableMenuItem
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x41bfba
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a0868
call sub.user32.dll_ExitWindowsEx
xor eax, eax
push ebp
push 0x41bf9c
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49b40c], 0
jne 0x41bf0f
mov dl, 1
mov eax, dword [0x412ebc]
call fcn.00403a68
mov dword [0x49b40c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
lea edx, [ebp - 0xc]
mov eax, dword [0x49b40c]
call fcn.00415418
call fcn.0041ba00
cmp word [0x49b3fa], 0
je 0x41bf42
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
mov eax, dword [0x49b3fc]
call dword [0x49b3f8]
push 0x4a0868
call sub.user32.dll_IsWindow
xor eax, eax
push ebp
push 0x41bf7d
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41bf84
push 0x4a0868
call sub.user32.dll_ExitWindowsEx
ret
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41c0b4
Capabilities:
Get keyboard layout

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call sub.user32.dll_GetKeyboardLayout
mov edx, dword [0x49f30c]
cmp eax, dword [edx]
jne 0x41c129
xor ebx, ebx
mov eax, dword [0x4a0850]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x41c0f3
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.00407588
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call fcn.00407568
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.0041be2c
cmp ebx, 1
jne 0x41c123
xor eax, eax
call fcn.0041ba24
test ebx, ebx
jne 0x41c0dc
jmp 0x41c135
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_SendMessageA
push esp
mov eax, dword [esp + 8]
push eax
call sub.user32.dll_GetMenuItemCount
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.0041be2c
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret

Function at 0x41e718
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41e71e
ret

Function at 0x41e78c
Capabilities:
Shutdown system

Disassembly:
add eax, 8
push eax
call sub.user32.dll_ExitWindowsEx
ret
Function at 0x4205dc
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor eax, eax
mov dword [ebp - 0x104], eax
xor eax, eax
push ebp
push 0x420678
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetMenuStringA
mov ebx, eax
test ebx, ebx
je 0x42065a
push 0
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x400
push ebx
push 0
push 0x1000
call sub.user32.dll_GetClipboardData
test eax, eax
je 0x42065a
lea eax, [ebp - 0x104]
lea edx, [ebp - 0x100]
mov ecx, 0x100
call fcn.00404adc
mov ecx, dword [ebp - 0x104]
mov dl, 1
mov eax, dword [0x412e00]
call fcn.0040ca78
call fcn.00404224
jmp 0x42065f
call fcn.00420588
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42067f
lea eax, [ebp - 0x104]
call fcn.0040486c
ret

Function at 0x424ce4
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x41e428]
call fcn.00403a68
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x424d6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov dword [eax + 8], ebx
mov eax, dword [ebp - 8]
mov dword [eax + 0x10], esi
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp - 8]
mov esi, eax
lea edi, [edx + 0x18]
mov ecx, 0x15
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 8]
mov dl, byte [ebp + 0xc]
mov byte [eax + 0x70], dl
mov eax, dword [ebp - 8]
cmp dword [eax + 0x2c], 0
je 0x424d4d
mov eax, dword [ebp - 8]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx + 0x14], eax
mov eax, dword [ebp + 8]
mov edx, dword [0x413834]
call fcn.00403c48
mov edx, dword [ebp - 8]
mov dword [edx + 0x6c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x424d82
push 0x4a08ac
call sub.user32.dll_ExitWindowsEx
xor edx, edx
push ebp
push 0x424dcb
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.0042376c
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 0x28], eax
call fcn.00423768
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x424dd2
push 0x4a08ac
call sub.user32.dll_IsWindow
ret

Function at 0x42630c
Capabilities:
Shutdown system

Disassembly:
add eax, 8
push eax
call sub.user32.dll_ExitWindowsEx
ret
Function at 0x43015c
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
push edi
mov ebx, eax
mov byte [ebp - 1], 1
mov eax, dword [ebp + 8]
add eax, 0xfffffff7
call fcn.004305ac
mov esi, eax
mov dword [ebp - 0x14], esi
push 4
push esi
call fcn.00407470
mov edx, dword [0x49f098]
mov edx, dword [edx]
cmp eax, dword [edx + 0x30]
je 0x4301b7
mov eax, dword [ebp - 0x14]
call fcn.0042f6c8
mov esi, eax
test esi, esi
je 0x4302ea
jmp 0x4301a6
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x4301a4
mov eax, esi
call fcn.00438e9c
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4302ea
mov esi, ebx
jmp 0x4301c7
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x4301c5
mov eax, esi
call fcn.00438e9c
mov edi, eax
mov dword [ebp - 0x18], edi
cmp edi, dword [ebp - 0x14]
je 0x4302ea
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov eax, dword [eax + 0x30]
test eax, eax
je 0x43020c
mov edx, dword [ebp + 8]
mov esi, eax
jmp 0x4301f9
mov esi, eax
mov eax, dword [esi + 0x30]
test eax, eax
jne 0x4301f7
mov eax, esi
call fcn.00438e9c
mov dword [ebp - 0x1c], eax
jmp 0x430236
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
mov edx, dword [0x42ed04]
call fcn.00403c24
test al, al
je 0x430231
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00438e9c
mov dword [ebp - 0x1c], eax
jmp 0x430236
xor eax, eax
mov dword [ebp - 0x1c], eax
mov byte [ebp - 8], 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 9]
mov dword [ebp - 0x10], edx
mov edx, dword [eax - 5]
mov dword [ebp - 0xc], edx
lea eax, [ebp - 0x1c]
push eax
push 0x4300f0
call sub.user32.dll_GetKeyboardLayout
push eax
call fcn.00407308
cmp byte [ebp - 8], 0
je 0x4302ea
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 0x14]
push eax
call fcn.00407490
mov eax, dword [ebp + 8]
add eax, 0xfffffff7
push eax
mov eax, dword [ebp + 8]
dec eax
push eax
lea ecx, [ebp - 0x3c]
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0x10]
mov eax, ebx
mov si, 0xffbd
call fcn.00403c94
mov eax, dword [0x4a0b34]
mov edx, dword [0x42dae4]
call fcn.00403c24
test al, al
je 0x4302d1
mov eax, dword [0x4a0b34]
mov eax, dword [eax + 0x38]
cmp dword [eax + 0xa0], 0
je 0x4302d1
mov eax, dword [0x4a0b34]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 0xa0]
call fcn.00438e9c
cmp eax, dword [ebp - 0x14]
je 0x4302ea
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.004074c8
test eax, eax
je 0x4302ea
mov byte [ebp - 1], 0
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret