joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48db7f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x84], 0
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov dword [ebp - 0x88], eax
call fcn.0048daab
call fcn.0048d84f
call fcn.00434af7
mov ecx, eax
call fcn.0042d1cb
push ebx
push str.wpsupdate_cmdline___s
mov edi, str.wWinMain
push edi
push 0x6a
mov esi, str.S:_func_improvement_20150701_branchCoding_supportwpsupdateUpdateClientupdatewpsupdate.cpp
push esi
push 4
call fcn.0042f683
push dword [ebp - 0x88]
call fcn.00435092
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 1
push eax
mov dword [ebp - 0x88], eax
call fcn.0042fbe1
mov ecx, eax
call fcn.0043f11f
test eax, eax
js 0x48dce3
push ebx
call fcn.00493091
pop ecx
test eax, eax
jne 0x48dc29
call fcn.0042eae0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x10]
test eax, eax
je 0x48dd4b
call fcn.0042eae0
mov ecx, eax
call fcn.00485331
test al, al
je 0x48dc4a
call fcn.00442183
test al, al
je 0x48dc4a
xor eax, eax
inc eax
jmp 0x48dd4b
lea eax, [ebp - 0x20]
push eax
call fcn.0048db36
cmp dword [eax + 0x14], 8
pop ecx
jb 0x48dc5c
mov eax, dword [eax]
push eax
call fcn.0048d5b2
pop ecx
push 0
mov ebx, eax
push 1
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x84], ebx
call fcn.0042e109
lea ecx, [ebp - 0x84]
call fcn.0047b7a6
test al, al
je 0x48dcb1
push str.Another_instance_of_wpsupdate_is_running__exit.
push edi
push 0x7e
push esi
push 4
call fcn.0042f683
add esp, 0x14
test ebx, ebx
je 0x48dca9
cmp ebx, 0xffffffff
je 0x48dca9
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x48dd4b
lea ecx, [ebp - 0x80]
call fcn.00440186
lea eax, [ebp - 0x80]
push eax
call fcn.00436f13
pop ecx
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x84], eax
call fcn.004402bf
test ebx, ebx
je 0x48dd1e
cmp ebx, 0xffffffff
je 0x48dd1e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48dd1e
push dword [ebp - 0x88]
push str.Faild_parse_command_line:__s.
push edi
push 0x87
push esi
push 0
call fcn.0042f683
push ecx
mov ecx, esp
mov dword [ebp - 0x8c], esp
push dword [ebp - 0x88]
call fcn.0042e48d
push 1
call fcn.00430d77
mov ecx, eax
call fcn.0042f1f3
call fcn.00436fc6
call fcn.00434af7
mov ecx, eax
call fcn.0042d1f4
push str.Update_Exit.
push edi
push 0x8e
push esi
push 4
call fcn.0042f683
mov eax, dword [ebp - 0x84]
add esp, 0x14
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004927bf
leave
ret 0x10
Function at 0x48f346
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xa004
call fcn.00494df0
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x10], 0
push edi
mov edi, ecx
jne 0x48f36e
xor eax, eax
jmp 0x48f3ce
push 0xffffffffffffffff
push 0
push esi
lea ecx, [edi + 0x24]
call fcn.0042e374
xor eax, eax
push 0x9ffe
push eax
mov word [ebp - 0xa004], ax
lea eax, [ebp - 0xa002]
push eax
call fcn.00492b40
add esp, 0xc
cmp dword [esi + 0x14], 8
jb 0x48f3a1
mov esi, dword [esi]
push esi
push 0x5000
lea eax, [ebp - 0xa004]
push eax
push str.feature
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
push eax
lea eax, [ebp - 0xa004]
push eax
mov ecx, edi
call fcn.0048f22d
xor eax, eax
inc eax
mov dword [edi + 0x20], eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004927bf
leave
ret 4

Function at 0x48f448
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xc
mov eax, 0x4ba868
call fcn.0049355c
mov esi, ecx
call fcn.0048f3fd
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x48f484
xor eax, eax
jmp 0x48f545
mov dword [ebp - 0x18], ebx
push edi
push ebx
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
jne 0x48f4a4
cmp ebx, edi
je 0x48f47d
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x48f47d
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x14]
push eax
push 0x14
lea eax, [esi + 4]
push eax
push ebx
call edi
test eax, eax
jne 0x48f4c0
test ebx, ebx
jmp 0x48f499
cmp dword [ebp - 0x14], 0x14
jne 0x48f4bc
mov eax, dword [esi + 0x14]
xor ecx, ecx
push 8
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004912f9
pop ecx
push 0
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [esi + 0x14]
shl ecx, 3
push ecx
push eax
push ebx
mov dword [ebp - 0x10], eax
call edi
test eax, eax
jne 0x48f501
push dword [ebp - 0x10]
call fcn.004926f3
pop ecx
jmp 0x48f4bc
and dword [ebp + 8], 0
cmp dword [esi + 0x14], 0
jbe 0x48f52a
mov edi, dword [ebp - 0x10]
push edi
lea ecx, [esi + 0x18]
call fcn.0048f094
mov ecx, dword [edi + 4]
inc dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 8]
add edi, 8
cmp eax, dword [esi + 0x14]
jb 0x48f50e
push dword [ebp - 0x10]
call fcn.004926f3
xor edi, edi
inc edi
pop ecx
mov dword [esi], edi
test ebx, ebx
je 0x48f543
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
call fcn.00493634
ret 4
Function at 0x48f584
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push edi
push 1
lea eax, [ebp - 4]
push eax
mov edi, str.WPS_OFFICE_ROOT_DIR
push edi
call esi
push dword [ebp + 0xc]
push dword [ebp + 8]
test eax, eax
je 0x48f5ad
push edi
call esi
jmp 0x48f5d3
push 0x400000
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 2
pop esi
push 0x5c
push dword [ebp + 8]
call fcn.00494b3e
pop ecx
pop ecx
test eax, eax
je 0x48f5d0
xor ecx, ecx
mov word [eax], cx
dec esi
jne 0x48f5bb
pop edi
xor eax, eax
pop esi
leave
ret 8

Function at 0x49025a
Capabilities:
Encode data using xor

Disassembly:
push 0x24
mov eax, 0x4ba8b1
call fcn.0049355c
mov edi, ecx
mov dword [ebp - 0x10], edi
xor esi, esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], esi
push dword [ebp + 0x14]
call fcn.00490234
mov edx, dword [ebp + 0xc]
push esi
push edx
mov ecx, edi
call fcn.0048ff46
push 2
push edx
mov ecx, edi
mov dword [ebp + 8], eax
call fcn.0048ff46
push 4
push edx
mov ecx, edi
mov ebx, eax
call fcn.0048ff46
push 6
push edx
mov ecx, edi
mov dword [ebp + 0xc], eax
call fcn.0048ff46
mov edi, dword [ebp - 0x30]
mov dword [ebp + 0x14], eax
mov dword [ebp - 0x18], 8
push dword [edi + esi*4]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0048ff79
push dword [edi + esi*4 + 0xc]
mov dword [ebp + 8], eax
mov eax, dword [edi + esi*4 + 4]
push dword [ebp + 0x14]
add eax, ebx
mov ebx, dword [edi + esi*4 + 8]
add ebx, dword [ebp + 0xc]
mov ecx, 0xffff
and eax, ecx
and ebx, ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.0048ff79
push dword [edi + esi*4 + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
xor ebx, dword [ebp + 8]
mov dword [ebp + 0x14], eax
mov eax, dword [ebp - 0x14]
push ebx
mov dword [ebp - 0x20], eax
call fcn.0048ff79
mov ecx, dword [ebp + 0x14]
xor ecx, dword [ebp - 0x14]
push dword [edi + esi*4 + 0x14]
add ecx, eax
and ecx, 0xffff
push ecx
mov ecx, dword [ebp - 0x10]
mov dword [ebp + 0xc], eax
call fcn.0048ff79
mov ebx, eax
mov eax, dword [ebp + 0xc]
xor dword [ebp + 8], ebx
add eax, ebx
xor ebx, dword [ebp - 0x1c]
and eax, 0xffff
xor dword [ebp + 0x14], eax
xor eax, dword [ebp - 0x20]
add esi, 6
dec dword [ebp - 0x18]
mov dword [ebp + 0xc], eax
jne 0x4902c7
push dword [edi + esi*4]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.0048ff79
mov ecx, dword [ebp - 0x10]
push 0
push dword [ebp + 0x10]
push eax
call fcn.0048ff5f
mov eax, dword [edi + esi*4 + 4]
add eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10]
push 2
push dword [ebp + 0x10]
push eax
call fcn.0048ff5f
mov ecx, dword [ebp - 0x10]
push 4
push dword [ebp + 0x10]
lea esi, [edi + esi*4 + 8]
mov eax, dword [esi]
add eax, ebx
push eax
call fcn.0048ff5f
mov ecx, dword [ebp - 0x10]
push 6
push dword [ebp + 0x10]
push dword [esi + 4]
push dword [ebp + 0x14]
call fcn.0048ff79
mov ecx, dword [ebp - 0x10]
push eax
call fcn.0048ff5f
lea ecx, [ebp - 0x30]
call fcn.004820f8
mov al, 1
call fcn.00493634
ret 0x10
Function at 0x4906b3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ecx
push eax
lea ecx, [ebp - 0x20]
call fcn.0042e48d
mov eax, dword [ebp - 0x20]
xor esi, esi
cmp dword [ebp - 0xc], 8
mov dword [ebp - 0x28], esi
jae 0x4906ef
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x28]
push ecx
push 0x20019
push esi
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x490750
mov eax, dword [ebp + 0x18]
add eax, eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x24]
push eax
push esi
push ebx
push dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x28]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, esi
jne 0x490750
cmp dword [ebp - 0x24], 1
je 0x490741
cmp dword [ebp - 0x24], 2
jne 0x490750
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.0042e109
xor eax, eax
jmp 0x490760
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.0042e109
mov eax, 0x80004005
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004927bf
leave
ret

Function at 0x490b0a
Capabilities:
Read .ini file

Disassembly:
push 0x58
mov eax, 0x4ba991
call fcn.004935c5
cmp dword [0x4f9948], 0xffffffff
jne 0x490b95
lea eax, [ebp - 0x64]
push eax
call fcn.004907e6
mov dword [esp], str.cfgs_setup.cfg
push eax
lea eax, [ebp - 0x48]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0042efad
add esp, 0xc
push esi
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 2
call fcn.0042e109
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004907aa
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x490b68
lea eax, [ebp - 0x2c]
push eax
push esi
push str.SupportNewLangs
push 0x4c2c74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 1
lea ecx, [ebp - 0x2c]
mov dword [0x4f9948], eax
call fcn.0042e109
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.0042e109
xor eax, eax
cmp dword [0x4f9948], 1
sete al
call fcn.00493648
ret
Function at 0x490ba7
Capabilities:
Read .ini file

Disassembly:
push 0x64
mov eax, 0x4ba9ce
call fcn.004935c5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x48]
xor ebx, ebx
push eax
mov dword [ebp - 0x6c], ecx
mov dword [ebp - 0x70], ebx
call fcn.00490896
push 0x4be56c
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x64]
push eax
mov dword [ebp - 4], ebx
call fcn.0042fffe
push str.lang.conf
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 1
call fcn.0042efad
add esp, 0x20
push ebx
push 1
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 3
call fcn.0042e109
push 0x7e
xor edi, edi
mov esi, 0x80
pop eax
cmp edi, ebx
je 0x490c2b
cmp word [edi + esi*2 - 4], bx
jne 0x490c7e
cmp word [edi + esi*2 - 2], bx
jne 0x490c7e
lea ecx, [esi - 2]
cmp eax, ecx
jne 0x490c7e
add esi, esi
cmp edi, ebx
je 0x490c38
push edi
call fcn.00497565
pop ecx
lea eax, [esi + esi]
push eax
call fcn.004975ff
mov edi, eax
lea eax, [esi + esi]
push eax
push ebx
push edi
call fcn.00492b40
mov ecx, dword [ebp - 0x2c]
add esp, 0x10
cmp dword [ebp - 0x18], 8
jae 0x490c5d
lea ecx, [ebp - 0x2c]
mov eax, dword [ebp - 0x6c]
cmp dword [eax + 0x14], 8
jb 0x490c68
mov eax, dword [eax]
push ecx
push esi
push edi
push 0x4bf8f0
push eax
push str.Language
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x490c12
mov ecx, dword [ebp - 0x68]
push eax
push edi
call fcn.0043105f
push edi
call fcn.00497565
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.0042e109
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.0042e109
mov eax, dword [ebp - 0x68]
call fcn.00493648
ret
Function at 0x491025
Capabilities:
Check if file exists

Disassembly:
push 0xac
mov eax, 0x4baade
call fcn.004935c5
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0xa0], ebx
mov dword [ebp - 0xa4], esi
mov dword [ebp - 0xb8], eax
cmp dword [eax + 0x10], ebx
jne 0x491067
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
jmp 0x4911b8
mov dword [ebp - 0xb4], ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xac], ebx
lea eax, [ebp - 0xb4]
push eax
mov dword [ebp - 4], ebx
call fcn.00490f1d
lea ecx, [ebp - 0x2c]
mov dword [esp], 0x4d9c98
call fcn.0042e48d
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.0043d617
xor edi, edi
push ebx
inc edi
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0042e109
mov eax, dword [ebp - 0xb4]
mov dword [ebp - 0xa0], eax
cmp eax, dword [ebp - 0xb0]
je 0x49119e
mov esi, 0x4be56c
lea eax, [ebp - 0x80]
push eax
call fcn.00490699
push esi
push eax
lea eax, [ebp - 0x9c]
push eax
mov byte [ebp - 4], 2
call fcn.0042efad
push dword [ebp - 0xa0]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.00439c24
push esi
push eax
lea eax, [ebp - 0x48]
push eax
mov byte [ebp - 4], 4
call fcn.0042efad
push dword [ebp - 0xb8]
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00439c24
add esp, 0x34
push ebx
push edi
lea ecx, [ebp - 0x48]
call fcn.0042e109
push ebx
push edi
lea ecx, [ebp - 0x64]
call fcn.0042e109
push ebx
push edi
lea ecx, [ebp - 0x9c]
call fcn.0042e109
push ebx
push edi
lea ecx, [ebp - 0x80]
mov byte [ebp - 4], 0xa
call fcn.0042e109
cmp dword [ebp - 0x18], 8
mov eax, dword [ebp - 0x2c]
jae 0x491167
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4911c0
push ebx
push edi
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0042e109
add dword [ebp - 0xa0], 0x1c
mov eax, dword [ebp - 0xa0]
cmp eax, dword [ebp - 0xb0]
jne 0x4910d7
mov esi, dword [ebp - 0xa4]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
lea ecx, [ebp - 0xb4]
mov word [esi], ax
call fcn.0043bbe1
mov eax, esi
call fcn.00493648
ret
mov ecx, dword [ebp - 0xa4]
lea eax, [ebp - 0x2c]
push eax
call fcn.0042e51a
push ebx
push edi
lea ecx, [ebp - 0x2c]
call fcn.0042e109
lea ecx, [ebp - 0xb4]
call fcn.0043bbe1
mov eax, dword [ebp - 0xa4]
jmp 0x4911ba
Function at 0x4921f4
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x4fd2a0], 0
push esi
push edi
jne 0x49216a
call fcn.004920d6
test eax, eax
je 0x4921af
mov eax, dword [0x4fd2a0]
cmp eax, 1
jne 0x49218b
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4921af
jmp 0x4921f1
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x4921f1
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4921b3
xor eax, eax
jmp 0x4921f1
mov eax, dword [esi]
push dword [0x4fd2a0]
call edi
mov edi, eax
test edi, edi
je 0x4921d5
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x4921f1
lea edi, [esi + 0xff0]
push esi
push dword [0x4fd2a0]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x4921db
mov eax, esi
pop edi
pop esi
ret
jmp 0x492156

Function at 0x4927bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4f9b3c]
jne 0x4927c9
repz ret
jmp fcn.0049f259
Function at 0x4ae0aa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f9b3c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0049eb17
and dword [ebp - 0x14], 0
cmp dword [0x4fe120], 0
mov dword [ebp - 0x18], eax
jne 0x4ae15d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4ae205
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4dc370
push ebx
call edi
test eax, eax
je 0x4ae205
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4dc360
push ebx
mov dword [0x4fe120], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4fe124], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4fe128], eax
call edi
push eax
call esi
mov dword [0x4fe130], eax
test eax, eax
je 0x4ae15d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4fe12c], eax
mov eax, dword [0x4fe12c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4ae1b6
cmp dword [0x4fe130], ecx
je 0x4ae1b6
push eax
call esi
push dword [0x4fe130]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4ae1b6
test ebx, ebx
je 0x4ae1b6
call edi
test eax, eax
je 0x4ae1ad
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4ae1ad
test byte [ebp - 8], 1
jne 0x4ae1b6
or dword [ebp + 0x10], 0x200000
jmp 0x4ae1e9
mov eax, dword [0x4fe124]
cmp eax, dword [ebp - 0x18]
je 0x4ae1e9
push eax
call esi
test eax, eax
je 0x4ae1e9
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x4ae1e9
mov eax, dword [0x4fe128]
cmp eax, dword [ebp - 0x18]
je 0x4ae1e9
push eax
call esi
test eax, eax
je 0x4ae1e9
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4fe120]
call esi
test eax, eax
je 0x4ae205
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4ae207
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004927bf
leave
ret
Function at 0x401dd0
Capabilities:
Accept command line arguments
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
nop

Function at 0x401e40
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x54
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x401e97
xor ecx, ecx
xor edx, edx
jmp 0x401e79
cmp ax, 0x5c
jne 0x401f00
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x401e97
cmp ax, 9
je 0x401e85
cmp ax, 0x20
jne 0x401e60
test ecx, ecx
je 0x401ee8
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x401e79
lea eax, [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x20], 1
je 0x401f20
movzx esi, word [ebp - 0x1c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call sym._wWinMain_16
sub esp, 0x10
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
movzx eax, word [ebx + 2]
add ebx, 2
cmp ax, 9
je 0x401ee8
cmp ax, 0x20
je 0x401ee8
jmp 0x401e97
cmp ax, 0x22
jne 0x401e89
and edx, 1
jne 0x401e89
xor ecx, 1
jmp 0x401e6d
mov eax, 1
mov esi, 1
mov word [ebp - 0x1c], ax
jmp 0x401eb0
Function at 0x73b1b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1cb000]
mov dword [edi + 0x23fe90], 0x17ed6222
push edi
or ebp, 0xffffffff
jmp 0x73b1da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x73b1e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x73b1d0
mov eax, 1
add ebx, ebx
jne 0x73b1f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x73b204
jne 0x73b223
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x73b223
dec eax
add ebx, ebx
jne 0x73b210
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x73b1e8
add ebx, ebx
jne 0x73b21f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x73b275
xor ecx, ecx
sub eax, 3
jb 0x73b23b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x73b2aa
sar eax, 1
mov ebp, eax
jmp 0x73b246
add ebx, ebx
jne 0x73b246
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x73b214
inc ecx
add ebx, ebx
jne 0x73b254
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x73b214
add ebx, ebx
jne 0x73b261
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x73b256
jne 0x73b272
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x73b256
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x73b294
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x73b286
jmp 0x73b1d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x73b294
add edi, ecx
jmp 0x73b1d6
pop esi
mov edi, esi
mov ecx, 0xe015
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x73b2b2
cmp byte [edi], 0x2a
jne 0x73b2b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x73b2b7
lea edi, [esi + 0x32a000]
mov eax, dword [edi]
or eax, eax
je 0x73b32f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x36731c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x367528]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x73b2e4
mov ecx, edi
jns 0x73b313
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x367530]
or eax, eax
je 0x73b329
mov dword [ebx], eax
add ebx, 4
jmp 0x73b301
call dword [esi + 0x36752c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x73b360
cmp al, 0xef
ja 0x73b353
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x73b335
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x73b342
mov ebp, dword [esi + 0x367534]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x24f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x73b394
sub esp, 0xffffff80
jmp 0x4a423c