joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43b656
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x43b3c1
add esi, esi
push 0xe840dcce
pop esi
call fcn.0043b69f
mov esi, ebx
mov esi, 0x9193c33b
xor dword [edx], ecx
inc esi
add edx, 1
sub ebx, esi
sub ebx, ebx
cmp edx, edi
jne fcn.0043b656
sub esp, 4
mov dword [esp], 0xda61bf26
pop ebx
sub ebx, 0x378ae36e
ret
Function at 0x418d87
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x418d96
pop dword [ebp - 0xc]
mov eax, 0xe1873c00
sub eax, 0xe145ae6a
sub dword [ebp - 0xc], eax
push 0x40
push 0x1000
push 0x40dac
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0xc]
call dword [eax]
mov ecx, 0x59b3
xor esi, esi
add esi, eax
mov edi, 0x3d4f9b14
sub edi, 0x3d0c6d14
add edi, dword [ebp - 0xc]
mov edx, 0x83e85fdc
xor dword [ebp - 4], 0x840c1c33
mov ebx, dword [edi]
sub ebx, edx
mov dword [esi], ebx
add esi, 4
add edi, 0x8a268077
add edi, 0x75d97f8d
loop 0x418de6
add eax, 0x55c99459
add eax, 0xaa37c546
mov ebx, eax
add eax, 0xcdd57577
sub eax, 0xcdd57572
mov ecx, 0x39515775
add ecx, 0xc6eea88b
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x406630
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x40664f
cmp eax, 0x106
je 0x40664f
push 0x106
call fcn.00404e60
mov eax, dword [esi]
push 0x105
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x406672
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x406668
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x406780
Capabilities:
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x42b6b8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov ebx, ecx
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push ebx
call ebp
test eax, eax
je 0x4067cb
mov al, 1
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
xor eax, eax
push 4
lea esi, [esp + 0x14]
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call fcn.00404e60
mov eax, esi
push eax
push ebx
mov dword [esp + 0x2c], 0
call fcn.00407e60
test al, al
je 0x406838
cmp dword [esp + 0x14], 0
setne al
test al, al
je 0x406838
mov esi, dword [esp + 0x10]
push edi
push esi
call ebp
test eax, eax
push esi
setne bl
mov dword [esp + 0x28], 0xffffffff
call fcn.00420dfe
add esp, 4
mov al, bl
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret
mov dword [esp + 0x24], 0xffffffff
mov ecx, dword [esp + 0x10]
push ecx
call fcn.00420dfe
add esp, 4
xor al, al
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x406870
Capabilities:
Delete directory

Disassembly:
push 0xffffffffffffffff
push 0x42b4d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push ebp
call edi
test eax, eax
je 0x4068ac
mov al, 1
jmp 0x406919
xor ebx, ebx
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e60
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e60
test al, al
je 0x406902
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406902
mov esi, dword [esp + 0x14]
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00420dfe
add esp, 4
mov al, bl
jmp 0x406919
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00420dfe
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x406930
Capabilities:
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x42b4d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor ebx, ebx
push ebx
push ebp
call edi
test eax, eax
je 0x40696f
mov al, 1
jmp 0x4069e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4069e6
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e60
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e60
test al, al
je 0x4069d1
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x4069d1
mov esi, dword [esp + 0x14]
push ebx
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00420dfe
add esp, 4
mov al, bl
jmp 0x4069e8
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00420dfe
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4
Function at 0x406de0
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x42b4d8
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor edi, edi
mov ecx, ebp
call fcn.00406780
test al, al
je 0x406e94
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
call edi
test eax, eax
je 0x406e29
mov al, 1
jmp 0x406e96
xor ebx, ebx
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
call fcn.00404e60
mov eax, esi
push eax
push ebp
mov dword [esp + 0x30], ebx
call fcn.00407e60
test al, al
je 0x406e7f
cmp dword [esp + 0x18], ebx
setne al
cmp al, bl
je 0x406e7f
mov esi, dword [esp + 0x14]
push esi
call edi
cmp eax, ebx
push esi
setne bl
mov dword [esp + 0x2c], 0xffffffff
call fcn.00420dfe
add esp, 4
mov al, bl
jmp 0x406e96
mov dword [esp + 0x28], 0xffffffff
mov ecx, dword [esp + 0x14]
push ecx
call fcn.00420dfe
add esp, 4
xor al, al
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret 4

Function at 0x407580
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x40759f
cmp eax, 0x106
je 0x40759f
push 0x106
call fcn.00404e60
mov eax, dword [esi]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x4075c2
mov edx, edi
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x4075b8
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
dec eax
mov ecx, 0x103
cmp ecx, eax
sbb eax, eax
pop edi
inc eax
pop esi
ret

Function at 0x4075e0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
jg 0x4075fe
cmp eax, 0x106
je 0x4075fe
push 0x106
call fcn.00404e60
mov eax, dword [esi]
push eax
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov edx, dword [esi]
xor eax, eax
cmp word [edx], ax
je 0x40762a
mov ecx, edx
lea ebx, [ebx]
add ecx, 2
inc eax
cmp word [ecx], 0
jne 0x407620
xor ecx, ecx
mov word [edx + eax*2], cx
mov dword [esi + 4], eax
mov al, 1
pop esi
ret

Function at 0x407640
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi + 8]
cmp eax, 0x105
push edi
jg 0x40765f
cmp eax, 0x106
je 0x40765f
push 0x106
call fcn.00404e60
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push 0
push 0x430954
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x40768a
mov edx, edi
nop
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x407680
xor edx, edx
mov word [edi + ecx*2], dx
pop edi
mov dword [esi + 4], ecx
pop esi
ret 4
Function at 0x407e60
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x42c720
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push ebp
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x54]
mov eax, dword [esp + 0x58]
xor ecx, ecx
mov dword [eax + 4], ecx
mov eax, dword [eax]
xor edx, edx
mov word [eax], dx
movzx eax, word [ebp]
xor edi, edi
cmp ax, cx
je 0x407eae
inc edi
cmp word [ebp + edi*2], cx
jne 0x407ea6
cmp edi, 1
movzx ebx, ax
jl 0x408019
cmp bx, 0x5c
je 0x408019
cmp bx, 0x2e
jne 0x407ee2
cmp edi, 1
je 0x408019
cmp edi, 2
jne 0x407ee2
cmp word [ebp + 2], bx
je 0x408019
push 4
lea esi, [esp + 0x18]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x20], ecx
call fcn.00404e60
cmp edi, 3
mov dword [esp + 0x4c], 0
jle 0x407f29
cmp word [ebp + 2], 0x3a
jne 0x407f29
cmp word [ebp + 4], 0x5c
jne 0x407f29
cmp bx, 0x61
jb 0x407f20
cmp bx, 0x7a
jbe 0x407f91
add ebx, 0xffffffbf
cmp bx, 0x19
jbe 0x407f91
mov eax, dword [esp + 0x1c]
cmp eax, 0x105
jg 0x407f49
cmp eax, 0x106
je 0x407f49
push 0x106
lea esi, [esp + 0x18]
call fcn.00404e60
mov eax, dword [esp + 0x14]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea esi, [esp + 0x14]
mov edi, eax
call fcn.00405f70
test edi, edi
je 0x408031
cmp edi, 0x104
ja 0x408031
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
cmp word [edx + ecx*2 - 2], 0x5c
je 0x407f91
push 0x5c
mov eax, esi
call fcn.00404c30
mov ebx, 0x42ff68
lea eax, [esp + 0x38]
call fcn.00404b30
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x30]
push edx
mov edi, eax
mov byte [esp + 0x54], 1
call fcn.00407940
push ebp
lea ecx, [esp + 0x24]
mov bl, 2
push ecx
mov edi, eax
mov byte [esp + 0x54], bl
call fcn.004082a0
mov edi, eax
mov eax, dword [esp + 0x58]
mov byte [esp + 0x4c], 3
call fcn.00404be0
mov byte [esp + 0x4c], bl
mov edx, dword [esp + 0x20]
push edx
call fcn.00420dfe
mov byte [esp + 0x50], 1
mov eax, dword [esp + 0x30]
push eax
call fcn.00420dfe
mov byte [esp + 0x54], 0
mov ecx, dword [esp + 0x40]
push ecx
call fcn.00420dfe
mov dword [esp + 0x58], 0xffffffff
mov edx, dword [esp + 0x20]
push edx
call fcn.00420dfe
add esp, 0x10
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x3c
ret 8
mov dword [esp + 0x4c], 0xffffffff
mov eax, dword [esp + 0x14]
push eax
call fcn.00420dfe
add esp, 4
xor al, al
jmp 0x40801b

Function at 0x4081c0
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, eax
mov dword [esi], 0
mov eax, ebp
cmp ebp, 0x400000
jbe 0x4081e4
mov eax, 0x400000
mov edx, dword [esp + 0x10]
push 0
lea ecx, [esp + 0x18]
push ecx
push eax
mov eax, dword [edx]
push edi
push eax
mov dword [esp + 0x28], 0
call ebx
mov ecx, dword [esp + 0x14]
add dword [esi], ecx
test eax, eax
je 0x40821a
test ecx, ecx
je 0x408212
add edi, ecx
sub ebp, ecx
jne 0x4081d5
pop edi
pop ebp
mov al, 1
pop ebx
ret 8
pop edi
pop ebp
xor al, al
pop ebx
ret 8
Function at 0x4086a0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, eax
mov eax, dword [esi]
mov dword [esi + 4], 0
xor ecx, ecx
mov word [eax], cx
mov edx, dword [ebx]
push edi
push edx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov edi, eax
test edi, edi
jne 0x4086cf
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x4086e3
lea ecx, [edi + 1]
cmp ecx, eax
je 0x4086e3
push ecx
call fcn.00404e60
mov eax, dword [esi]
inc edi
push edi
push eax
mov eax, dword [ebx]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov edi, dword [esi]
xor ecx, ecx
cmp word [edi], cx
je 0x40870a
mov edx, edi
lea esp, [esp]
add edx, 2
inc ecx
cmp word [edx], 0
jne 0x408700
xor edx, edx
mov word [edi + ecx*2], dx
mov dword [esi + 4], ecx
test eax, eax
jne 0x408726
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
ret
pop edi
mov al, 1
pop esi
ret
Function at 0x413650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c108
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov dword [esp + 8], 0
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
push eax
mov eax, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x30]
push edx
push eax
mov dword [esp + 0x24], 0
call fcn.004134d0
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esp + 8]
test eax, eax
je 0x4136b9
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x10
Function at 0x418aa0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42c969
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x28]
mov eax, dword [esp + 0x30]
push eax
push ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x28], 0
mov dword [esp + 0x10], 0
call fcn.00418930
lea edx, [esp + 0xc]
mov dword [esp + 0x20], 0
push edx
mov dword [esp + 0xc], 1
call fcn.00405070
push ebx
mov ecx, eax
call fcn.00404fd0
mov eax, dword [esp + 0xc]
push eax
call fcn.00420dfe
add esp, 4
mov eax, ebx
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop ebx
add esp, 0x1c
ret 0xc

Function at 0x4199a0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42bf48
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebp
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x30]
xor eax, eax
xor ecx, ecx
mov word [esp + 0xc], ax
mov word [esp + 0xe], cx
mov dword [esp + 0x28], eax
mov byte [ebx], al
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x38]
mov dword [esi], eax
mov dword [esi + 4], eax
mov eax, dword [ebp]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 0xc
push ecx
push eax
call edx
mov edi, eax
test edi, edi
je 0x419a1e
lea ecx, [esp + 0xc]
call fcn.00408530
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
mov ax, word [esp + 0xc]
cmp ax, 0x40
jne 0x419a38
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [esi], eax
mov dword [esi + 4], ecx
jmp 0x419a70
test ax, ax
je 0x419a5f
lea ecx, [esp + 0xc]
call fcn.00408530
mov eax, 0x80004005
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
cmp byte [ebp + 0x2c], 0
je 0x419a73
mov edx, dword [ebp + 0x24]
mov dword [esi], edx
mov eax, dword [ebp + 0x28]
mov dword [esi + 4], eax
mov byte [ebx], 1
lea ecx, [esp + 0xc]
call fcn.00408530
xor eax, eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
add esp, 0x20
ret 8
Function at 0x41ad60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x42b2ee
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [ebx]
mov dword [esi], eax
test eax, eax
je 0x41ad96
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push eax
call edx
lea edi, [ebx + 4]
lea eax, [esi + 4]
mov dword [esp + 0x14], 0
call fcn.00404b90
lea edi, [ebx + 0x10]
lea eax, [esi + 0x10]
mov byte [esp + 0x14], 1
call fcn.00404b90
mov byte [esp + 0x14], 2
mov eax, dword [ebx + 0x1c]
mov dword [esi + 0x1c], eax
mov ecx, dword [ebx + 0x20]
mov dword [esi + 0x20], ecx
mov edx, dword [ebx + 0x24]
mov dword [esi + 0x24], edx
mov eax, dword [ebx + 0x28]
mov dword [esi + 0x28], eax
mov cl, byte [ebx + 0x2c]
lea edi, [ebx + 0x30]
lea eax, [esi + 0x30]
mov byte [esi + 0x2c], cl
call fcn.00404b90
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4

Function at 0x41d4d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x439d44]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
lea esi, [ebp + 0x118]
push esi
push 0x406160
push 0
push 0x1f6
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
test eax, eax
je 0x41d501
mov dword [esi + 4], eax
sub esp, 0xc
mov ecx, esp
mov dword [esp + 0x30], esp
push 0x430830
lea edi, [ebp + 0x14]
push ecx
call fcn.004082a0
call fcn.0041bdd0
mov bl, al
test bl, bl
je 0x41d53b
cmp byte [ebp + 0x169], 0
jne 0x41d53b
mov edx, dword [ebp + 0x11c]
push 1
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov al, byte [ebp + 0x169]
mov byte [ebp + 0x88], al
test bl, bl
je 0x41d553
mov ebx, dword [ebp + 0x11c]
jmp 0x41d555
xor ebx, ebx
mov edi, dword [esp + 0x28]
lea esi, [ebp + 0x70]
lea eax, [esi + 0x24]
call fcn.00404be0
mov ecx, dword [0x439d44]
push esi
push 0x406160
push 0
push 0x1f4
push ecx
mov dword [esi + 0x30], ebx
call dword [sym.imp.USER32.dll_DialogBoxParamW]
mov edi, dword [esp + 0x2c]
mov edx, dword [edi]
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xffffffffffffffff
push edx
call esi
mov eax, 0x45
lea ecx, [esp + 0x14]
call fcn.0041af50
mov eax, dword [eax]
mov ecx, dword [ebp + 0x74]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esp + 0x14]
push edx
call fcn.00420dfe
mov eax, dword [ebp + 0x74]
add esp, 4
push 1
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi]
push 0xffffffffffffffff
push ecx
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret 0xc
Function at 0x41e0c0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x42be4e
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x437024]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, dword [esp + 0x20]
lea esi, [edi + 4]
xor ebx, ebx
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e60
lea esi, [edi + 0x10]
mov dword [esp + 0x18], ebx
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e60
mov dword [edi + 0x20], ebx
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x38], 4
mov dword [edi + 0x28], vtable.CObjectVector_struct_CArc_.0
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x48], ebx
mov dword [edi + 0x4c], 4
mov dword [edi + 0x3c], vtable.CObjectVector_class_CStringBase_wchar_t__.0
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov byte [edi + 0x58], bl
lea esi, [edi + 0x64]
mov byte [esp + 0x18], 3
push 4
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
call fcn.00404e60
mov eax, edi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x41e9b0
Capabilities:
Set registry value

Disassembly:
mov eax, 0x200c
call fcn.00429090
mov eax, dword [0x437024]
xor eax, esp
mov dword [esp + 0x2008], eax
push 0x2000
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00426470
add esp, 0xc
push 0x2000
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov edx, dword [esp]
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
lea ecx, [esp + 0x18]
push ecx
push edx
mov dword [esp + 0x1c], 0x20
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x2008]
xor ecx, esp
call fcn.00420def
add esp, 0x200c
ret
Function at 0x41ea60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x41c
mov eax, dword [0x437024]
xor eax, esp
mov dword [esp + 0x418], eax
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.00426470
add esp, 0xc
push 0x208
lea edx, [esp + 0x214]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00426470
push str.Applications_
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.004218b6
lea eax, [esp + 0x228]
push 0x5c
push eax
call fcn.00421925
add eax, 2
push eax
lea ecx, [esp + 0x2c]
push 0x104
push ecx
call fcn.004219b2
add esp, 0x2c
push 0
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x24]
push eax
push SysReAllocStringLen
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov eax, dword [esp]
push 2
lea edx, [esp + 8]
push edx
push 1
xor ecx, ecx
push ecx
push str.IsHostApp
push eax
mov word [esp + 0x1c], cx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x418]
xor ecx, esp
call fcn.00420def
add esp, 0x41c
ret
Function at 0x420def
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x437024]
jne 0x420df9
repz ret
jmp fcn.00421be0

Function at 0x425561
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004231c1
and dword [ebp - 4], 0
cmp dword [0x439bd8], 0
mov ebx, eax
jne 0x425612
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4256c3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4256c3
push eax
call fcn.0042314f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x439bd8], eax
call esi
push eax
call fcn.0042314f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x439bdc], eax
call esi
push eax
call fcn.0042314f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x439be0], eax
call esi
push eax
call fcn.0042314f
pop ecx
mov dword [0x439be8], eax
test eax, eax
je 0x425612
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0042314f
pop ecx
mov dword [0x439be4], eax
mov eax, dword [0x439be4]
cmp eax, ebx
je 0x42566a
cmp dword [0x439be8], ebx
je 0x42566a
push eax
call fcn.004231ca
push dword [0x439be8]
mov esi, eax
call fcn.004231ca
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42566a
test edi, edi
je 0x42566a
call esi
test eax, eax
je 0x425661
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425661
test byte [ebp - 0xc], 1
jne 0x42566a
or dword [ebp + 0x10], 0x200000
jmp 0x4256a3
mov eax, dword [0x439bdc]
cmp eax, ebx
je 0x4256a3
push eax
call fcn.004231ca
pop ecx
test eax, eax
je 0x4256a3
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4256a3
mov eax, dword [0x439be0]
cmp eax, ebx
je 0x4256a3
push eax
call fcn.004231ca
pop ecx
test eax, eax
je 0x4256a3
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439bd8]
call fcn.004231ca
pop ecx
test eax, eax
je 0x4256c3
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4256c5
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret