joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4078c0
Capabilities:
Check os version
Get common file path

Disassembly:
sub esp, 0x68
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x64], eax
push 0x43cd40
mov dword [0x439760], 0
mov dword [0x43cd40], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [0x43cd44]
mov dword [0x439760], eax
cmp eax, 5
jbe 0x407942
push 0x64
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp]
push ecx
push str._s_syswow64
push 0x43c5c0
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x43c5c0
call fcn.004023f0
add esp, 0x10
test eax, eax
je 0x407942
mov eax, 1
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0040a10d
add esp, 0x68
ret
mov ecx, dword [esp + 0x64]
xor ecx, esp
xor eax, eax
call fcn.0040a10d
add esp, 0x68
ret

Function at 0x407ba0
Capabilities:
Copy file

Disassembly:
push esi
push 0x439640
push 0x439020
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
test eax, eax
je 0x407bf2
push 0x439020
push str._schenback.chz
push 0x43c860
call esi
push 0x439640
push str._schenback.chz
push 0x439540
call esi
add esp, 0x18
push 0
push 0x43c860
push 0x439540
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x439020
push str._schenback.chz
push 0x43c860
call esi
add esp, 0xc
push 0
push 0x43c860
call dword [sym.imp.KERNEL32.dll__lopen]
mov esi, eax
cmp esi, 0xffffffff
je 0x407d3f
push ebx
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll__llseek]
push 2
push 0
push esi
call edi
push 0
push 0
push esi
mov ebx, eax
call edi
lea eax, [ebx + 0xc8]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
je 0x407c60
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
test edi, edi
jne 0x407c6c
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push esi
call dword [sym.imp.KERNEL32.dll__lclose]
pop edi
pop ebp
pop ebx
pop esi
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll__lread]
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll__lclose]
cmp ebx, 0x64
jl 0x407d3c
mov ecx, dword [0x42cc58]
push ecx
push edi
call fcn.00407960
mov edx, dword [0x42cc58]
mov byte [edx + 0x1000], 0
mov eax, dword [0x42cc58]
lea ecx, [eax + 0x1000]
push ecx
push eax
push edi
call fcn.00404340
mov ecx, dword [0x42cc58]
add esp, 0x14
cmp byte [ecx], 0
jbe 0x407d06
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._r_n_r_n
push ecx
call esi
mov edx, dword [0x42cc58]
push 0x41db34
push edx
call esi
mov eax, dword [0x42cc58]
push 0
push 0x41cf70
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebp
pop ebx
pop esi
ret
push eax
push 0x41db14
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0
push 0x41db08
push 0x43c860
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop ebp
pop ebx
pop esi
ret
Function at 0x407d50
Capabilities:
Check if file exists
Copy file
Set file attributes

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push eax
push 0x439020
push 0x41c5ac
push 0x439540
call esi
mov ecx, dword [esp + 0x20]
push ecx
push 0x43c780
push 0x41c854
push 0x43c240
call esi
add esp, 0x20
push 0x20
push 0x43c240
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0
push 0x43c240
push 0x439540
call edi
test eax, eax
jne 0x407e05
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x43c240
cmp eax, 2
jne 0x407dc3
push 0x41db74
jmp 0x407de7
call fcn.00406390
add esp, 4
push 0
push 0x43c240
push 0x439540
call edi
test eax, eax
jne 0x407e05
push 0x43c240
push 0x41ccc4
push 0x43c860
call esi
add esp, 0xc
push 0
push 0x41c44c
push 0x43c860
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
ret

Function at 0x407e10
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
cmp eax, 1
jne 0x407e38
push 0x43c5c0
call fcn.00402500
add esp, 4
push 0x43c5c0
push 0x43c780
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x407e64
cmp eax, 2
je 0x407e54
cmp eax, 3
je 0x407e54
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x407e64
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call fcn.00402770
test eax, eax
je 0x407ea4
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0
call fcn.00402860
add esp, 4
cmp eax, 1
jne 0x407ea4
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ecx
push edx
call fcn.00407d50
mov eax, dword [esp + 0x14]
push eax
call fcn.00402890
add esp, 0xc
ret
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push ecx
push edx
call fcn.00407d50
add esp, 8
ret
Function at 0x408050
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x194
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x1a4]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
mov dword [0x439740], esi
call edi
push 1
mov ebx, eax
call edi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, eax
push 0x41dc18
lea eax, [esp + 0x14]
push eax
call ebp
call fcn.004054c0
cmp word [0x43cddc], 0x3c
mov dword [0x439620], eax
mov dword [0x43c98c], 0
jbe 0x4080c1
call fcn.004010c0
mov dword [0x43c98c], eax
call fcn.004078c0
test eax, eax
je 0x4080d6
push 0x41dbfc
lea ecx, [esp + 0x14]
push ecx
call ebp
movzx edx, word [0x43cddc]
mov eax, dword [0x43c98c]
mov ecx, dword [0x43c3ac]
push edx
mov edx, dword [0x43cb08]
push eax
mov eax, dword [0x439620]
push ecx
push edx
push eax
push 0x41dbd4
push 0x43c860
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push 0x43c860
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
cmp dword [0x43c98c], 0
mov ebp, 1
mov dword [0x43c5b8], ebp
je 0x408135
mov dword [0x43c5b8], ebp
push 0
push esi
push 0
push 0
push 0x136
lea eax, [edi - 0x12c]
cdq
sub eax, edx
push 0x190
sar eax, 1
push eax
lea eax, [ebx - 0x190]
cdq
sub eax, edx
sar eax, 1
push eax
push 0x80000
lea edx, [esp + 0x34]
push edx
push 0x41dbb8
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x439768], eax
test eax, eax
je 0x408276
push 0
mov edi, dword [sym.imp.USER32.dll_CreateWindowExA]
push esi
push 0
push eax
push 0x14
push 0xe6
push 0xc3
push 0x78
push 0x40080000
push 0x41dbb4
push str.EDIT
push 0
call edi
push 0
push esi
push 0
mov dword [0x43c32c], eax
mov eax, dword [0x439768]
push eax
push 0x14
push 0xe6
push 0xc3
push 0x82
push 0x40080000
push 0x41dbb4
push str.EDIT
push 0
call edi
mov ecx, dword [0x439768]
push 0
push esi
push 0
push ecx
push 0x14
push 0xe6
push 0xa5
push 0x82
push 0x40080000
push 0x41dbb4
push str.EDIT
push 0
mov dword [0x439160], eax
call edi
mov edx, dword [0x439768]
push 0
push esi
push 0
push edx
push 0x14
push 0xe6
push 0x87
push 0x82
push 0x40080000
push 0x41dbb4
push str.EDIT
push 0
mov dword [0x439158], eax
call edi
mov ecx, dword [0x439768]
mov dword [0x439134], eax
mov eax, dword [esp + 0x1ac]
push eax
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x439768]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, ebp
mov ecx, dword [esp + 0x1a0]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a10d
add esp, 0x194
ret
Function at 0x408290
Capabilities:
Get keyboard layout

Disassembly:
sub esp, 0x18
mov eax, dword [0x4250e0]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
call fcn.00406550
cmp dword [0x4390ec], 4
jne 0x408340
cmp dword [0x429d48], 1
jne 0x408340
cmp dword [0x43c848], 2
push 0
push 0x41de44
jge 0x4082ed
push 0x41dd80
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0040a10d
add esp, 0x18
ret
mov esi, dword [sym.imp.USER32.dll_MessageBoxW]
push 0x41dd10
push 0
call esi
call fcn.004078c0
test eax, eax
jne 0x4082db
push 4
push 0x41de44
push 0x41dce4
push eax
call esi
cmp eax, 7
je 0x40832e
call fcn.00401320
push 0
push 0x41de44
push 0x41dcc4
push 0
call esi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0040a10d
add esp, 0x18
ret
push 0x41c754
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x43c860
mov esi, eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
push 0x32
push 0x43c860
push esi
call sub.IMM32.dll_ImmGetDescriptionA
xor eax, eax
mov cl, byte [esp + eax + 4]
cmp cl, byte [eax + 0x43c860]
jne 0x4083b9
mov dl, byte [esp + eax + 5]
cmp dl, byte [eax + 0x43c861]
jne 0x4083ae
mov cl, byte [esp + eax + 6]
cmp cl, byte [eax + 0x43c862]
jne 0x4083b1
mov dl, byte [esp + eax + 7]
cmp dl, byte [eax + 0x43c863]
jne 0x4083b6
add eax, 4
cmp eax, 0x10
jl 0x408374
jmp 0x4083b9
inc eax
jmp 0x4083b9
add eax, 2
jmp 0x4083b9
add eax, 3
cmp eax, 0x10
jne 0x4083e4
push 0
push 0x41de44
push 0x41dc30
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0040a10d
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0040a10d
add esp, 0x18
ret
Function at 0x408430
Capabilities:
Get common file path
Get graphical window text
Hide graphical window

Disassembly:
mov eax, dword [0x439134]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextA]
push 0xe
push 0x4391d2
push eax
call esi
mov ecx, dword [0x439158]
push 0xe
push 0x4391a0
push ecx
call esi
mov edx, dword [0x439160]
push 0xa
push 0x439328
push edx
call esi
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x439780
push 0x43ab08
call ebp
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x43ab6c
call ebx
cmp eax, 0xe
jle 0x408493
mov byte [0x43ab7a], 0
cmp byte [0x42cc55], 0
jne 0x4084ea
push 0x4391d2
call fcn.00401fa0
add esp, 4
test eax, eax
jne 0x4084ea
cmp dword [0x43c324], eax
mov byte [0x438fe0], al
jle 0x4084cc
push eax
push 0x41de44
push 0x41de94
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [0x439768]
push 0
push 0
push eax
mov dword [0x43c324], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebp
pop ebx
ret
push 0x439328
call ebx
cmp byte [0x42cc55], 0
jne 0x40853b
cmp eax, 6
je 0x40853b
cmp dword [0x43c324], 0
jle 0x40851c
push 0
push 0x41de44
push 0x41de60
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [0x439768]
push 0
push 0
push ecx
mov dword [0x43c324], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
pop ebp
pop ebx
ret
push 0x439780
push 0x43cd12
call ebp
push 0x43ab6c
push 0x43cce0
call ebp
push 0x439848
push 0x43cd22
call ebp
mov eax, dword [0x43c324]
inc eax
cmp eax, 1
mov dword [0x43c324], eax
jle 0x40862b
mov edx, dword [0x439160]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push edi
push 0
push edx
call esi
mov eax, dword [0x439160]
mov edi, dword [sym.imp.USER32.dll_DestroyWindow]
push eax
call edi
mov ecx, dword [0x439158]
push 0
push ecx
call esi
mov edx, dword [0x439158]
push edx
call edi
mov eax, dword [0x439134]
push 0
push eax
call esi
mov ecx, dword [0x439134]
push ecx
call edi
mov edx, dword [0x43c32c]
push 0
push edx
mov dword [0x43c324], 5
call esi
mov eax, dword [0x43c32c]
push 5
push eax
call esi
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call fcn.00403d40
push 0x439020
call ebx
cmp eax, 3
pop edi
jge 0x408607
push str.c:chenhu2_
push 0x439020
call ebp
mov ecx, dword [0x439768]
push 0
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
call fcn.00406660
pop esi
pop ebp
mov dword [0x43c324], 6
pop ebx
ret
cmp eax, 5
jne 0x4084e6
pop esi
pop ebp
pop ebx
jmp fcn.00406660
Function at 0x408f70
Capabilities:
Copy file

Disassembly:
push ebx
push esi
push edi
mov edi, dword [0x42cc58]
push str.chszsj43.chh_chencyzk.bak_chenznwb.exe_chenznw6.exe_csrf732.dll_csrf764.dll_chsrf10.dll_chsrf610.dll_chensrf.dll_chensrf6.dll_chen320.ime_chen321.ime_chen640.ime_chen641.ime_chenhu4.ime_chenhu64.ime__setupw64.exe
push edi
lea esi, [edi + 0x1000]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [0x439130]
push edi
push esi
push eax
call fcn.00404340
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0xc
cmp byte [esi], 0
mov edi, eax
jbe 0x408fc8
push str._r_n_r_n
push esi
call ebx
push 0x41e194
push esi
call ebx
push 0
push 0x41cf70
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x41e180
push 0x43c860
call edi
add esp, 0xc
cmp dword [0x439744], 2
jne 0x408ff4
call fcn.00404490
test eax, eax
jne 0x40915c
cmp dword [0x43ccc8], 0x3b6
mov al, 1
push 0
mov byte [0x439764], al
mov byte [0x43ca04], al
push 0x404520
jne 0x409028
mov ecx, dword [0x42c470]
mov edx, dword [0x439740]
push ecx
push 0x41e178
push edx
jmp 0x40903a
mov eax, dword [0x42c470]
mov ecx, dword [0x439740]
push eax
push 0x41e170
push ecx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov al, byte [0x43ca04]
push 0x439020
cmp al, 2
jne 0x409055
push 0x41e160
jmp 0x409065
cmp al, 3
jne 0x409060
push 0x41e150
jmp 0x409065
push 0x41e140
push 0x43c860
call edi
add esp, 0xc
push ebp
push 0x43c860
call fcn.00408640
add esp, 4
push 0
push 0x43c860
call dword [sym.imp.KERNEL32.dll__lopen]
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x4090ae
push 0x41e110
push esi
call ebx
push 0
push 0x41cf70
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
pop ebp
pop edi
pop esi
pop ebx
ret
mov edx, dword [0x42cc58]
push 0x20000
push edx
push ebp
call dword [sym.imp.KERNEL32.dll__lread]
push ebp
mov ebx, eax
call dword [sym.imp.KERNEL32.dll__lclose]
mov eax, dword [0x42cc58]
lea esi, [eax + ebx + 0x14]
lea ebx, [eax + ebx + 6]
push ebx
mov byte [ebx], 0
mov eax, dword [0x42cc58]
push esi
push eax
call fcn.00404340
add esp, 0xc
cmp byte [esi], 0
mov ebx, eax
jbe 0x409117
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._r_n_r_n
push esi
call ebp
push 0x41e110
push esi
call ebp
push 0
push 0x41cf70
push esi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
push 0x41e0f8
push 0x43c860
call edi
push 0x439020
push str._schbmps44.bmp
push 0x439540
call edi
push 0x439020
push str._schbmpsx4.bmp
push 0x43c240
call edi
add esp, 0x24
push 0
push 0x43c240
push 0x439540
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4091b0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x10
push esi
push edi
call fcn.00403d40
push 0xc8
push 0x43c780
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
call fcn.00403f30
push 0x439020
call fcn.00405380
push 0x439020
call fcn.00405280
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push 0x439020
push str._sfiler_
push 0x43c860
call edi
push 0x43c860
call fcn.0040a5e1
add esp, 0x18
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx ecx, word [esp + 8]
movzx edx, word [esp + 0xa]
movzx eax, word [esp + 0xe]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
shl ecx, 8
add ecx, edx
shl ecx, 8
push 0x41e31c
add ecx, eax
push 0x43c9a0
mov dword [0x439180], ecx
call esi
call fcn.00406420
push 0x41e300
push 0x43c9a0
mov dword [0x43c990], 0
call esi
push 0
call fcn.00408980
add esp, 4
push 0x41e2e4
push 0x43c9a0
call esi
push 0x439020
call fcn.00405280
call fcn.00402430
mov eax, dword [0x439154]
mov ecx, dword [0x43ccc4]
inc eax
push ecx
push eax
mov dword [0x439154], eax
call fcn.004023a0
add esp, 0xc
cmp dword [0x43c5b8], 1
jne 0x4092b3
call fcn.00402e90
mov dword [0x43c1c8], eax
jmp 0x4092b8
call fcn.00409160
push 0x41e2c8
push 0x43c9a0
call esi
mov eax, dword [0x439154]
mov edx, dword [0x43ccc4]
inc eax
push edx
push eax
mov dword [0x439154], eax
call fcn.004023a0
call fcn.00404050
mov eax, dword [0x439154]
mov ecx, dword [0x43ccc4]
inc eax
push ecx
push eax
mov dword [0x439154], eax
call fcn.004023a0
add esp, 0x10
cmp byte [0x42cc55], 0
jne 0x409323
push 0x439020
push str._schenznwb.exe_ch
push 0x43c860
call edi
push 0x43c860
call fcn.00401960
add esp, 0x10
mov eax, dword [0x439154]
mov edx, dword [0x43ccc4]
inc eax
push edx
push eax
mov dword [0x439154], eax
call fcn.004023a0
add esp, 8
cmp dword [0x43c5b8], 0
jne 0x409376
call fcn.004078c0
test eax, eax
je 0x409376
push 0x439020
push 0x439020
push str._ssetupw64.exe_regch32_s
push 0x43c860
call edi
add esp, 0x10
push 5
push 0x43c860
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
add esp, 0x10
ret

Function at 0x40a10d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4250e0]
jne 0x40a117
repz ret
jmp fcn.0040b07d

Function at 0x40d9f0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40da21
call fcn.0040bc41
mov dword [eax], esi
call fcn.0040bc2e
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0040bbc6
add esp, 0x14
push 0x16
pop eax
jmp 0x40da76
test dword [ebp + 0xc], 0xfffffff9
jne 0x40d9fd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40da4e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040bc54
pop ecx
call fcn.0040bc2e
mov eax, dword [eax]
jmp 0x40da76
test al, 0x10
jne 0x40da74
test al, 1
je 0x40da74
test byte [ebp + 0xc], 2
je 0x40da74
call fcn.0040bc41
mov dword [eax], 5
call fcn.0040bc2e
mov dword [eax], 0xd
jmp 0x40da45
xor eax, eax
pop esi
pop ebp
ret
Function at 0x412b65
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040f161
and dword [ebp - 4], 0
cmp dword [0x429a78], 0
mov ebx, eax
jne 0x412c16
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x412cc7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x41ed6c
push edi
call esi
test eax, eax
je 0x412cc7
push eax
call fcn.0040f0ef
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x429a78], eax
call esi
push eax
call fcn.0040f0ef
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x429a7c], eax
call esi
push eax
call fcn.0040f0ef
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x429a80], eax
call esi
push eax
call fcn.0040f0ef
pop ecx
mov dword [0x429a88], eax
test eax, eax
je 0x412c16
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040f0ef
pop ecx
mov dword [0x429a84], eax
mov eax, dword [0x429a84]
cmp eax, ebx
je 0x412c6e
cmp dword [0x429a88], ebx
je 0x412c6e
push eax
call fcn.0040f16a
push dword [0x429a88]
mov esi, eax
call fcn.0040f16a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x412c6e
test edi, edi
je 0x412c6e
call esi
test eax, eax
je 0x412c65
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x412c65
test byte [ebp - 0xc], 1
jne 0x412c6e
or dword [ebp + 0x10], 0x200000
jmp 0x412ca7
mov eax, dword [0x429a7c]
cmp eax, ebx
je 0x412ca7
push eax
call fcn.0040f16a
pop ecx
test eax, eax
je 0x412ca7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x412ca7
mov eax, dword [0x429a80]
cmp eax, ebx
je 0x412ca7
push eax
call fcn.0040f16a
pop ecx
test eax, eax
je 0x412ca7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x429a78]
call fcn.0040f16a
pop ecx
test eax, eax
je 0x412cc7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x412cc9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c20d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a548]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409883
mov dword [ebp - 0x14], eax
cmp dword [0x4362d8], esi
jne 0x40c300
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c28d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c3e0
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c3e0
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c3e0
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4362d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4362dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4362e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4362e8], eax
test eax, eax
je 0x40c2fd
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4362e4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c325
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c318
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c33a
push 4
pop eax
jmp 0x40c3e2
cmp dword [ebp - 0x14], esi
je 0x40c33a
push dword [0x4362d8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c31f
mov eax, dword [0x4362e4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c398
cmp dword [0x4362e8], edi
je 0x40c398
push eax
call ebx
push dword [0x4362e8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c398
test eax, eax
je 0x40c398
call ecx
test eax, eax
je 0x40c38d
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c38d
test byte [ebp - 8], 1
jne 0x40c398
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c3c8
mov eax, dword [0x4362dc]
cmp eax, edi
je 0x40c3c5
push eax
call ebx
test eax, eax
je 0x40c3c5
call eax
mov esi, eax
test esi, esi
je 0x40c3c5
mov eax, dword [0x4362e0]
cmp eax, edi
je 0x40c3c5
push eax
call ebx
test eax, eax
je 0x40c3c5
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4362d8]
call ebx
test eax, eax
je 0x40c3e0
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c3e2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404320
mov esp, ebp
pop ebp
ret