joyce8/EMBER2024-capa huggingface dataset:
Function at 0x438554
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x45d948]
cmp byte [eax + 0xc], 0
je 0x4386c1
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4386ba
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45eb68], 0
jne 0x4385a8
push 0x4386c8
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x4386d0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb68], eax
cmp dword [0x45cb00], 0
jne 0x4386a3
push 0x4386e0
call sub.kernel32.dll_LoadLibraryA
mov dword [0x45cb00], eax
cmp dword [0x45cb00], 0
je 0x4386a3
push 0x4386ec
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb6c], eax
push 0x4386fc
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb70], eax
push 0x438710
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb74], eax
push 0x438728
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb78], eax
push 0x438740
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb7c], eax
push 0x438754
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb80], eax
push 0x43876c
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb84], eax
push 0x438784
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb88], eax
push 0x4387a0
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb8c], eax
push 0x4387ac
mov eax, dword [0x45cb00]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45eb90], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4386c1
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43c54c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00403ffc
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43c59b
push pe_nt_image_headers32
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, pe_nt_image_headers32
call fcn.0040426c
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x443cb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x443d00]
test si, 4
je 0x443cc4
or bl, 1
test si, 8
je 0x443cce
or bl, 4
test si, 1
je 0x443cd8
or bl, 8
test si, 2
je 0x443ce2
or bl, 0x10
test si, 0x10
je 0x443cec
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x443cfb
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x443d04
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x443d3c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x443d1d
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x443d2c
or bl, 4
test esi, 0x20000000
je 0x443d37
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44a3e4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44a3f6
add esp, 0xfffffff0
call fcn.0040354c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a77c
mov eax, dword [0x45d4a0]
mov dword [eax + 4], ebx
mov dword [eax], 0x44a788
mov eax, dword [0x45d4b0]
mov dword [eax + 4], ebx
mov dword [eax], 0x44a794
mov eax, ebx
call fcn.0044a7a0
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411bb8]
call fcn.00403210
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411bb8]
call fcn.00403210
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411bb8]
call fcn.00403210
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411bb8]
call fcn.00403210
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411bb8]
call fcn.00403210
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x446bbc
push eax
push 0
push 0
mov eax, dword [0x45d6a4]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41c1a0]
call fcn.0041d5e4
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41c1a0]
call fcn.0041d5e4
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41c1a0]
call fcn.0041d5e4
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044abc0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44aa9c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44aa9c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44aa9c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44a533
call fcn.004035a4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44a880
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44aa2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44aa0c
mov dl, 1
mov eax, dword [0x412160]
call fcn.00403210
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403ffc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44a9fb
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004388b4
test al, al
je 0x44a9ee
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44aa3c
lea eax, [ebp - 0x254]
call fcn.00408e64
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44a9ee
xor eax, eax
push ebp
push 0x44a9e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44aa74
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44a9d0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040426c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44a9d0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040426c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a9ee
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44a8f1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416464
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44aa32
lea eax, [ebp - 0x260]
call fcn.00403ffc
ret

Function at 0x44b360
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45ebb4]
cmp byte [eax + 0xa5], 0
jne 0x44b3d1
cmp dword [0x45ebcc], 0
jne 0x44b392
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44b31c
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45ebcc], eax
cmp dword [0x45ebc8], 0
jne 0x44b3ad
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45ebc8], eax
cmp dword [0x45ebd0], 0
jne 0x44b3d1
push esp
push 0
push 0
push 0x44b2c0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x45ebd0], eax
pop edx
ret
Function at 0x44b4c8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44b4df
add esp, 0xfffffff0
call fcn.0040354c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a77c
mov eax, dword [0x45d684]
cmp word [eax + 2], 0
jne 0x44b507
mov eax, dword [0x45d684]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044cba0
mov eax, dword [0x45d784]
cmp word [eax + 2], 0
jne 0x44b521
mov eax, dword [0x45d784]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044cd98
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411bb8]
call fcn.00403210
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411bb8]
call fcn.00403210
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41c950]
call fcn.00422598
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44b6a8
mov eax, dword [0x45d53c]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00422968
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44d338
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45d53c]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c608
test eax, eax
je 0x44b616
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408858
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c630
test eax, eax
je 0x44b62a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040426c
mov eax, dword [0x45d37c]
cmp byte [eax], 0
jne 0x44b65e
mov eax, ebx
call fcn.0044b7d0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044d514
mov eax, ebx
call fcn.0044ded8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44b69e
call fcn.004035a4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44ba50
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45ebb4]
cmp dword [eax + 0x30], 0
je 0x44bafa
cmp dword [ebx + 0x94], 0
jne 0x44baf4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44b9e0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44baf4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44baba
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44baf4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041412c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44bac9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44c65c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44c691
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004040ec
jmp 0x44c69e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404050
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44d6f0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44d731
mov eax, esi
call fcn.004340bc
test al, al
je 0x44d731
mov eax, dword [ebx + 0x84]
call fcn.00433e5c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44d731
push 0
mov eax, dword [ebx + 0x84]
call fcn.00433e5c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x457f40
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45807a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00414dc8
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x457fbc
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x457fbc
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00407e38
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x45d404]
mov ebx, dword [ebx]
mov eax, 0x458090
call ebx
dec eax
jne 0x457fbc
mov ebx, 1
jmp 0x457fbe
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x45805f
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.00457a50
test al, al
jne 0x458053
mov eax, dword [ebp - 4]
call fcn.00457f34
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00404050
xor edx, edx
push ebp
push 0x458041
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x458037
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.00458354
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x458053
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x457fd6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x458081
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404020
ret
Function at 0x401250
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ee5d
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x416008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [ebp + 8], 2
mov byte [0x417388], 1
jne 0x401432
mov eax, dword [ebp + 0xc]
mov edx, str.disable
mov ecx, dword [eax + 4]
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x4012b8
test bl, bl
je 0x4012b4
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x4012b8
add eax, 2
add edx, 2
test bl, bl
jne 0x401298
xor eax, eax
jmp 0x4012bd
sbb eax, eax
or eax, 1
test eax, eax
je 0x401332
mov edx, str.enable
mov eax, ecx
mov bl, byte [eax]
cmp bl, byte [edx]
jne 0x4012e8
test bl, bl
je 0x4012e4
mov bl, byte [eax + 1]
cmp bl, byte [edx + 1]
jne 0x4012e8
add eax, 2
add edx, 2
test bl, bl
jne 0x4012c8
xor eax, eax
jmp 0x4012ed
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4012f8
mov byte [0x417389], al
jmp 0x401339
mov eax, str.disablesilent
nop dword [eax]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x401320
test dl, dl
je 0x40131c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x401320
add ecx, 2
add eax, 2
test dl, dl
jne 0x401300
xor eax, eax
jmp 0x401325
sbb eax, eax
or eax, 1
test eax, eax
jne 0x401432
mov byte [0x417388], al
mov byte [0x417389], 1
push 0x413d88
push str.KILLERGUI_V2_MYTHWARE
call dword [sym.imp.USER32.dll_FindWindowW]
lea ecx, [ebp - 0x58]
mov esi, eax
call fcn.00401450
push eax
call fcn.004016b0
lea ecx, [ebp - 0x58]
call fcn.004016a0
call fcn.00401990
test al, al
je 0x401382
push 0x10
push 0x413dbc
push 0x413dd8
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x401432
push str.Shutdown.exe
lea ecx, [ebp - 0x40]
call fcn.004019a0
push str.__Shutdown.exe
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.004019a0
add esp, 8
lea ecx, [ebp - 0x40]
call fcn.00401680
lea ecx, [ebp - 0x28]
mov edx, eax
call fcn.00401680
cmp byte [0x417389], 0
je 0x4013f3
push eax
push edx
call fcn.00404fb8
add esp, 8
test eax, eax
jne 0x4013e5
cmp byte [0x417388], al
je 0x401422
push 0x40
push 0x413dbc
push 0x413e24
jmp 0x40141b
push 0x10
push 0x413dbc
push 0x413e40
jmp 0x40141b
push edx
push eax
call fcn.00404fb8
add esp, 8
test eax, eax
jne 0x40140f
push 0x40
push 0x413dbc
push 0x413e5c
jmp 0x40141b
push 0x10
push 0x413dbc
push str.b__rYYe_b
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x28]
call fcn.004016a0
lea ecx, [ebp - 0x40]
call fcn.004016a0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401f66
mov esp, ebp
pop ebp
ret
Function at 0x401450
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40eeab
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x416008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x114], edi
push 0x413db8
lea ecx, [ebp - 0x148]
mov dword [ebp - 0x114], edi
xor bl, bl
call fcn.00401700
lea eax, [ebp - 0x14c]
mov dword [ebp - 4], 0
push eax
push 0x20019
push 0
push str.SOFTWARETopDomaine_Learning_Class_V6.0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4014d7
push dword [ebp - 0x14c]
call esi
mov bl, 1
push 0x100
lea eax, [ebp - 0x110]
push 0
push eax
call fcn.00403360
add esp, 0xc
mov dword [ebp - 0x114], 1
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x100
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.TargetDirectory
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x401537
push dword [ebp - 0x14c]
call esi
mov bl, 1
push dword [ebp - 0x14c]
call esi
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x130]
call fcn.00401700
mov byte [ebp - 4], 1
test bl, bl
je 0x401637
push 0x100
lea eax, [ebp - 0x110]
xor bl, bl
push 0
push eax
call fcn.00403360
add esp, 0xc
lea eax, [ebp - 0x14c]
push eax
push 0x20019
push 0
push str.SOFTWARETopDomaine_Learning_Class_Standard1.00_
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4015a1
push dword [ebp - 0x14c]
call esi
mov bl, 1
lea eax, [ebp - 0x118]
mov dword [ebp - 0x114], 1
push eax
lea eax, [ebp - 0x110]
mov dword [ebp - 0x118], 0x100
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.TargetDirectory
push dword [ebp - 0x14c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x14c]
test eax, eax
je 0x401611
call esi
push dword [ebp - 0x14c]
call esi
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x130]
call fcn.00401690
push 0x413db8
mov ecx, edi
call fcn.00401700
jmp 0x401645
call esi
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x130]
call fcn.00401690
test bl, bl
je 0x401637
push 0x413db8
mov ecx, edi
call fcn.00401700
jmp 0x401645
lea eax, [ebp - 0x130]
mov ecx, edi
push eax
call fcn.004016e0
lea ecx, [ebp - 0x130]
call fcn.004016a0
lea ecx, [ebp - 0x148]
call fcn.004016a0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00401f66
mov esp, ebp
pop ebp
ret

Function at 0x4057ed
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40582c
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40582c
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40582c
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40582c
cmp dword [ecx + 0x74], 0xe
jbe 0x40582c
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x407329
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410510
push 0x410508
push str.FlsAlloc
push 0x1f
call fcn.004071e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40735d
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f12c]
call esi
jmp 0x407363
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4073a7
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410520
push 0x410518
push str.FlsGetValue
push 0x21
call fcn.004071e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4073de
push dword [ebp + 8]
mov ecx, esi
call dword [0x40f12c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4073e6
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x410528
push 0x410520
push str.FlsSetValue
push 0x22
call fcn.004071e8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x407420
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x40f12c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x4089bb
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x408a58
push ebx
push esi
call fcn.00408984
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00408918
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x408a05
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408a57
push edi
push eax
call fcn.0040697c
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x408a25
call fcn.00406942
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x408a56
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00408918
add esp, 0x20
test eax, eax
jne 0x408a44
push edi
call fcn.00406942
jmp 0x408a4c
push ebx
call fcn.00406942
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4010d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx edx, word [esp + 4]
mov dword [esp + 4], edx
jmp fcn.00409951

Function at 0x401fe0
Capabilities:
Check mutex on windows

Disassembly:
push esi
mov esi, ecx
call fcn.004093c2
push 0
push SysReAllocString
push 0xc40080
mov ecx, esi
call fcn.004104a5
push 0
push 0x80000
push 0x40001
mov ecx, esi
call fcn.004104d1
mov eax, dword [esi + 0x74]
mov ecx, dword [esi + 0x20]
push 1
push 0
push eax
push ecx
call dword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
push str.UpdateLogin
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402048
mov edx, dword [esi]
mov eax, dword [edx + 0x158]
mov ecx, esi
call eax
mov ecx, dword [esi + 0x84]
mov edx, dword [esi + 0x20]
push ecx
push 1
push 0x80
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
push str.GXDCompress.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40208e
push str.uncompress
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5863ac], eax
test eax, eax
je 0x40208e
mov dword [0x5863a0], 0xffffffff
call fcn.004020d0
call fcn.004020d0
push 0
lea ecx, [esi + 0x8c]
call fcn.004105c8
push 0
push 0
push 0
push 0
push esi
push 0x4027d0
call fcn.00417be1
mov ecx, esi
mov dword [esi + 0x78], eax
call fcn.00402320
mov eax, 1
pop esi
ret