joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d4768
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4d49c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.004d2ffc
xor eax, eax
push ebp
push 0x4d4994
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d3604
test al, al
je 0x4d4976
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040aef4
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x4d4976
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b81c
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d2f5c
test al, al
je 0x4d496a
mov eax, dword [ebp - 4]
call fcn.0040b81c
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.0040b87c
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d4064
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x4d496a
xor eax, eax
push ebp
push 0x4d4963
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.004d2ffc
xor eax, eax
push ebp
push 0x4d4943
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0040b81c
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.0040b87c
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d3000
mov eax, dword [ebp - 4]
call fcn.0040b81c
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.0040b87c
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.004d4064
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x4d491e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004d462c
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.004d4768
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d4925
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey
pop eax
jmp eax
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x4d47f3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d499b
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.004d2ffc
pop eax
jmp eax
Function at 0x4d4cb0
Capabilities:
Get system information on windows

Disassembly:
add esp, 0xffffffdc
push esp
call sub.kernel32.dll_GetNativeSystemInfo
movzx eax, word [esp]
sub ax, 1
jb 0x4d4cd1
sub ax, 5
je 0x4d4cdc
sub ax, 3
je 0x4d4ce0
jmp 0x4d4ceb
mov byte [0x4ed8a8], 0x20
mov al, 1
jmp 0x4d4ced
xor eax, eax
jmp 0x4d4ced
mov byte [0x4ed8a8], 0x40
mov al, 1
jmp 0x4d4ced
xor eax, eax
add esp, 0x24
ret

Function at 0x4d5920
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
xor eax, eax
push ebp
push 0x4d5a93
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4e6c5c]
mov edx, 0x4d5aac
call fcn.004088c0
mov edx, dword [ebp - 4]
call fcn.004088c0
mov edx, 0x4d5adc
call fcn.004088c0
call main
call fcn.0040711c
push 1
push 0x4d5ae4
push 0
call sub.advapi32.dll_OpenSCManagerW
mov ebx, eax
test ebx, ebx
jne 0x4d59bb
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x4e6c5c]
mov edx, 0x4d5b10
call fcn.004088c0
call fcn.0040d454
mov edx, 0x4d5b5c
call fcn.004088c0
call main
call fcn.0040711c
jmp 0x4d5a7b
push 2
mov eax, dword [ebp - 4]
call fcn.0040b81c
push eax
push ebx
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jne 0x4d5a0f
push ebx
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x4e6c5c]
mov edx, 0x4d5b70
call fcn.004088c0
call fcn.0040d454
mov edx, 0x4d5b5c
call fcn.004088c0
call main
call fcn.0040711c
jmp 0x4d5a7b
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
jne 0x4d5a6f
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
call sub.kernel32.dll_GetLastError
mov ebx, eax
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x4e6c5c]
mov edx, 0x4d5bb8
call fcn.004088c0
call fcn.0040d454
mov edx, 0x4d5b5c
call fcn.004088c0
call main
call fcn.0040711c
jmp 0x4d5a7b
push esi
call sub.advapi32.dll_CloseServiceHandle
push ebx
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5a9a
lea eax, [ebp - 4]
call fcn.0040ad5c
pop eax
jmp eax
Function at 0x4d5d08
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.0040ae50
xor eax, eax
push ebp
push 0x4d5e4c
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [0x4e6c5c]
mov edx, 0x4d5e64
call fcn.004088c0
mov edx, dword [ebp - 0xc]
call fcn.004088c0
mov edx, 0x4d5e8c
call fcn.004088c0
call main
call fcn.0040711c
push 1
push 0x4d5e94
push 0
call sub.advapi32.dll_OpenSCManagerW
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4d5d8c
push ebp
call sub.kernel32.dll_GetLastError
mov edx, eax
mov eax, 0x4d5ec0
call fcn.004d5c04
pop ecx
jmp 0x4d5e34
push 0x10
mov eax, dword [ebp - 0xc]
call fcn.0040b81c
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_OpenServiceW
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x4d5dbe
push ebp
call sub.kernel32.dll_GetLastError
mov edx, eax
mov eax, 0x4d5ee8
call fcn.004d5c04
pop ecx
jmp 0x4d5e34
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x4d5e22
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0x420
jne 0x4d5e12
push 0x7d0
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_StartServiceW
test eax, eax
jne 0x4d5e22
push ebp
mov edx, ebx
mov eax, 0x4d5f0c
call fcn.004d5c04
pop ecx
jmp 0x4d5e34
push ebp
mov edx, ebx
mov eax, 0x4d5f0c
call fcn.004d5c04
pop ecx
jmp 0x4d5e34
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_CloseServiceHandle
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_CloseServiceHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5e53
lea eax, [ebp - 0xc]
call fcn.0040ad5c
pop eax
jmp eax
Function at 0x4d69a4
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
jne 0x4d69f2
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [0x4e6c5c]
mov edx, 0x4d6a58
call fcn.004088c0
call fcn.0040d454
mov edx, 0x4d6aa0
call fcn.004088c0
call main
call fcn.0040711c
mov eax, esi
call fcn.0040abbc
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
test eax, eax
jne 0x4d6a40
push ebx
call sub.kernel32.dll_CloseHandle
call sub.kernel32.dll_GetLastError
mov esi, eax
mov eax, esi
xor edx, edx
push edx
push eax
mov eax, dword [0x4e6c5c]
mov edx, 0x4d6ab4
call fcn.004088c0
call fcn.0040d454
mov edx, 0x4d6aa0
call fcn.004088c0
call main
call fcn.0040711c
mov eax, esi
call fcn.0040abbc
push ebx
call sub.kernel32.dll_CloseHandle
pop esi
pop ebx
ret

Function at 0x4d6af8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
xor eax, eax
push ebp
push 0x4d6bca
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00408134
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 4]
call fcn.0040b30c
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040b81c
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4d6b93
call sub.kernel32.dll_GetLastError
xor edx, edx
push edx
push eax
mov eax, dword [0x4e6c5c]
mov edx, 0x4d6be4
call fcn.004088c0
call fcn.0040d454
mov edx, 0x4d6c30
call fcn.004088c0
call main
call fcn.0040711c
jmp 0x4d6bb2
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6bd1
lea eax, [ebp - 4]
call fcn.0040ad5c
pop eax
jmp eax
Function at 0x4d6c38
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
push ebx
xor ecx, ecx
mov dword [ebp - 0x408], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040ae50
xor eax, eax
push ebp
push 0x4d6d09
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.0040ad5c
lea eax, [ebp - 0x404]
xor ecx, ecx
mov edx, 0x200
call fcn.00408134
cmp byte [0x4ed8a8], 0x40
jne 0x4d6cb6
movzx eax, byte [0x4d6d18]
push eax
lea eax, [ebp - 0x408]
push eax
mov ecx, 0x4d6d28
mov edx, 0x4d6d54
mov eax, dword [ebp - 4]
call fcn.0042a318
mov edx, dword [ebp - 0x408]
lea eax, [ebp - 4]
call fcn.0040b194
push 0x200
lea eax, [ebp - 0x404]
push eax
mov eax, dword [ebp - 4]
call fcn.0040b81c
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsW
test eax, eax
jbe 0x4d6ce6
mov eax, ebx
lea edx, [ebp - 0x404]
mov ecx, 0x200
call fcn.0040b8b8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d6d10
lea eax, [ebp - 0x408]
call fcn.0040ad5c
lea eax, [ebp - 4]
call fcn.0040ad5c
pop eax
jmp eax

Function at 0x4d7748
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d7832
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x4e6c5c]
mov edx, 0x4d7850
call fcn.004088c0
mov edx, 0x4d787c
call fcn.004088c0
call main
call fcn.0040711c
mov byte [ebp - 5], 0
mov eax, ebx
call fcn.0040ad5c
push 0
push 0
push 0
push 0
push 0x4d7918
call sub.wininet.dll_InternetOpenW
mov edi, eax
test edi, edi
je 0x4d781a
push 0
push 0x80000000
push 0
push 0
push 0x4d7940
push edi
call sub.wininet.dll_InternetOpenUrlW
mov esi, eax
test esi, esi
jne 0x4d77d3
push edi
call sub.wininet.dll_InternetCloseHandle
jmp 0x4d781a
lea eax, [ebp - 0xc]
push eax
push 0x400
lea eax, [ebp - 0x40c]
push eax
push esi
call sub.wininet.dll_InternetReadFile
lea edx, [ebp - 0x40c]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0xc]
call fcn.0040b014
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040ba10
cmp dword [ebp - 0xc], 0
jne 0x4d77d3
push esi
call sub.wininet.dll_InternetCloseHandle
push edi
call sub.wininet.dll_InternetCloseHandle
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d7839
lea eax, [ebp - 4]
call fcn.0040ad5c
pop eax
jmp eax
Function at 0x4d8848
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, edx
mov esi, eax
xor ebx, ebx
push 2
push 0
mov eax, esi
call fcn.0040b81c
push eax
call sub.kernel32.dll_LoadLibraryExW
mov esi, eax
test esi, esi
je 0x4d88e0
push 0x10
push 1
push esi
call sub.kernel32.dll_FindResourceW
mov edi, eax
test edi, edi
je 0x4d88e0
push edi
push esi
call sub.kernel32.dll_LoadResource
test eax, eax
je 0x4d88e0
mov edx, dword [eax + 0x30]
mov dword [ebp], edx
mov edx, dword [eax + 0x34]
shr edx, 0x10
mov word [ebp + 4], dx
movzx edx, word [eax + 0x34]
mov word [ebp + 6], dx
mov edx, dword [eax + 0x44]
and edx, 1
cmp edx, 1
sete dl
mov byte [ebp + 8], dl
mov edx, dword [eax + 0x44]
and edx, 2
cmp edx, 2
sete dl
mov byte [ebp + 9], dl
mov edx, dword [eax + 0x44]
and edx, 8
cmp edx, 8
sete dl
mov byte [ebp + 0xa], dl
mov eax, dword [eax + 0x44]
and eax, 0x20
cmp eax, 0x20
sete al
mov byte [ebp + 0xb], al
push esi
call sub.kernel32.dll_FreeLibrary
mov bl, 1
mov eax, ebx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x402270
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
rcl edi, 0xda
neg edx
and ebx, 0x9c
imul ebx
or eax, 0xeb
add edx, 0
neg edi
mov ebx, 0x8b
rol esi, 0x97
sbb esi, 0x42
and eax, 0x13
neg esi
sbb edi, 0x40
not eax
or esi, 0xf6
dec eax
imul esi
not eax
ror eax, 0xc5
inc eax
rol edx, 0x9e
imul edi
inc edx
ror esi, 0xf8
neg eax
rcr ebx, 0xba
add ebx, 0x6d
inc edx
or edi, 0xbb
imul eax
ror eax, 0xb0
or eax, 0x6c
add esi, 0x7a
imul edi
or edi, 0x31
rol esi, 0xe
ror ebx, 0xd2
sub edi, 0xf3
inc edi
rcl eax, 0xae
bswap edi
dec ebx
sub ebx, 0x47
inc esi
rcr ebx, 0x27
or edx, 0x16
sbb eax, 0x40
or ebx, 0xd1
dec edi
not esi
xor ecx, ecx
xor edi, edi
dec edi
neg eax
not esi
imul ebx
rol edi, 0xd5
dec edi
sbb eax, 0x2b
and edx, 0xde
inc esi
imul ebx
neg esi
and esi, 0xd8
inc edx
neg edi
imul edi
bswap eax
or ebx, 0xd9
sub ebx, 0x10
rcl ebx, 0xa3
or edx, 0x9c
and esi, 0x8e
bswap edi
bswap ebx
dec edi
neg ebx
rcr edi, 0x6b
dec edx
inc esi
inc ebx
sub edx, 0x5c
sub edx, 0x77
neg eax
imul edx
imul esi
rcr edi, 0x88
rol esi, 0x4b
neg ebx
imul ebx
not ebx
or eax, 0x29
or edx, 0x26
ror eax, 0x40
or eax, 0x46
rcl esi, 0x1b
or ebx, 0xb
not edi
ror edx, 0x69
neg edi
rol edi, 0x58
and edi, 0x23
mov ecx, dword [ebp + 0xc]
sbb esi, 0x4a
rcl edi, 0xf7
sub ebx, 0x6c
not ebx
imul eax
and edi, 2
not esi
rcl edx, 9
or esi, 0x8a
inc esi
rcr edx, 0x44
sub esi, 0xc4
ror eax, 0xdb
imul ebx
rcl ebx, 0xa8
add ebx, 0x95
not ebx
neg esi
or esi, 0xb8
and ebx, 0x20
rcr esi, 0xf3
mov ebx, 0x4b
bswap edi
sbb edi, 0x2b
sbb edx, 0x7b
rcl edi, 0x86
bswap ebx
rcr ebx, 0x9d
rcl eax, 0x88
mov edx, 0xa3
or ebx, 0xed
not esi
bswap ebx
neg esi
mov ebx, 0x62
rcl edi, 0x32
sbb eax, 0xa7
bswap ebx
imul edi
rol eax, 0x91
imul edi
mov ebx, 0xe2
ror ebx, 0xd7
add edx, 0xc2
bswap esi
imul edx
rol ebx, 0x96
bswap edi
sbb edi, 0x12
bswap esi
mov edi, dword [ebp + 8]
xor esi, eax
mov esi, ebx
mov eax, eax
not byte [edi]
xor esi, eax
xor esi, eax
xor esi, esi
xor eax, esi
xor eax, eax
xor eax, eax
xor ebx, esi
mov esi, eax
xor esi, eax
add byte [edi], 0x54
xor eax, esi
xor ebx, ebx
mov esi, esi
mov ebx, eax
mov eax, esi
mov ebx, esi
mov ebx, eax
xor ebx, eax
xor ebx, ebx
sub byte [edi], 0x29
mov eax, esi
xor esi, esi
xor ebx, eax
xor ebx, ebx
mov esi, eax
xor esi, eax
mov ebx, esi
xor eax, eax
mov eax, ebx
imul byte [edi]
inc edi
loop 0x402432
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40a7ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x45c690]
jne 0x40a7f4
repz ret
jmp fcn.00411d7d
Function at 0x4166fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00410686
and dword [ebp - 4], 0
cmp dword [0x45e1d0], 0
mov ebx, eax
jne 0x4167ad
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41685e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41685e
push eax
call fcn.00410614
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x45e1d0], eax
call esi
push eax
call fcn.00410614
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45e1d4], eax
call esi
push eax
call fcn.00410614
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x45e1d8], eax
call esi
push eax
call fcn.00410614
pop ecx
mov dword [0x45e1e0], eax
test eax, eax
je 0x4167ad
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00410614
pop ecx
mov dword [0x45e1dc], eax
mov eax, dword [0x45e1dc]
cmp eax, ebx
je 0x416805
cmp dword [0x45e1e0], ebx
je 0x416805
push eax
call fcn.0041068f
push dword [0x45e1e0]
mov esi, eax
call fcn.0041068f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x416805
test edi, edi
je 0x416805
call esi
test eax, eax
je 0x4167fc
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4167fc
test byte [ebp - 0xc], 1
jne 0x416805
or dword [ebp + 0x10], 0x200000
jmp 0x41683e
mov eax, dword [0x45e1d4]
cmp eax, ebx
je 0x41683e
push eax
call fcn.0041068f
pop ecx
test eax, eax
je 0x41683e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41683e
mov eax, dword [0x45e1d8]
cmp eax, ebx
je 0x41683e
push eax
call fcn.0041068f
pop ecx
test eax, eax
je 0x41683e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45e1d0]
call fcn.0041068f
pop ecx
test eax, eax
je 0x41685e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416860
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x48f9e0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7c000]
push edi
jmp 0x48f9fa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x48fa01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48f9f0
mov eax, 1
add ebx, ebx
jne 0x48fa13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x48fa24
jne 0x48fa43
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa43
dec eax
add ebx, ebx
jne 0x48fa30
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x48fa08
add ebx, ebx
jne 0x48fa3f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x48fa95
xor ecx, ecx
sub eax, 3
jb 0x48fa5b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x48faca
sar eax, 1
mov ebp, eax
jmp 0x48fa66
add ebx, ebx
jne 0x48fa66
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
inc ecx
add ebx, ebx
jne 0x48fa74
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x48fa34
add ebx, ebx
jne 0x48fa81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x48fa76
jne 0x48fa92
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x48fa76
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x48fab4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x48faa6
jmp 0x48f9f6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x48fab4
add edi, ecx
jmp 0x48f9f6
pop esi
mov edi, esi
mov ecx, 0x1a9e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x48fad2
cmp byte [edi], 6
jne 0x48fad2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x48fad7
lea edi, [esi + 0x8d000]
mov eax, dword [edi]
or eax, eax
je 0x48fb4f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x8f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x8f104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x48fb04
mov ecx, edi
jns 0x48fb33
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x8f108]
or eax, eax
je 0x48fb49
mov dword [ebx], eax
add ebx, 4
jmp 0x48fb21
call dword [esi + 0x8f118]
mov ebp, dword [esi + 0x8f10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x207]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x48fb83
sub esp, 0xffffff80
jmp section.UPX0

Function at 0x40895d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
call fcn.0040898c
add edx, 0xfd5f6a6c
add edi, edx
xor dword [esi], ecx
add edi, 0xa71c408d
add esi, 1
and edx, edx
cmp esi, eax
jne fcn.0040895d
sub edi, 0x19a82dfc
ret
Function at 0x4d2025
Capabilities:
Allocate or change rwx memory

Disassembly:
pushal
pushfd
push 0x4d2005
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x4d2012
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x4d2046], eax
jmp 0x4d204a
push 0x4d205c
push 0x40
push 0x10
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x4d2060
mov eax, dword [0x4d2046]
mov byte [eax], 0x68
mov dword [eax + 1], 0x4d207a
mov byte [eax + 5], 0xc3
popfd
popal
jmp 0x4d20cf
pushal
pushfd
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [0x4d20cb], eax
mov dword [sym.imp.KERNEL32.dll_VirtualProtect], reloc.KERNEL32.dll_VirtualProtect
popfd
popal
push section..adata
ret
Function at 0xfea740
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7f6000]
push edi
or ebp, 0xffffffff
jmp 0xfea762
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0xfea769
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfea758
mov eax, 1
add ebx, ebx
jne 0xfea77b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0xfea78c
jne 0xfea7ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfea7ab
dec eax
add ebx, ebx
jne 0xfea798
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0xfea770
add ebx, ebx
jne 0xfea7a7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0xfea7fd
xor ecx, ecx
sub eax, 3
jb 0xfea7c3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0xfea832
sar eax, 1
mov ebp, eax
jmp 0xfea7ce
add ebx, ebx
jne 0xfea7ce
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfea79c
inc ecx
add ebx, ebx
jne 0xfea7dc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0xfea79c
add ebx, ebx
jne 0xfea7e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0xfea7de
jne 0xfea7fa
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0xfea7de
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0xfea81c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0xfea80e
jmp 0xfea75e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0xfea81c
add edi, ecx
jmp 0xfea75e
pop esi
mov edi, esi
mov ecx, 0x220d8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0xfea83a
mov eax, dword [edi]
mov bl, byte [edi + 4]
xchg ah, al
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0xfea83f
lea edi, [esi + 0xbe6000]
mov eax, dword [edi]
or eax, eax
je 0xfea8a7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xbf8af8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xbf8c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0xfea865
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xbf8c28]
or eax, eax
je 0xfea8a1
mov dword [ebx], eax
add ebx, 4
jmp 0xfea882
call dword [esi + 0xbf8c38]
mov ebp, dword [esi + 0xbf8c2c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0xfea8db
sub esp, 0xffffff80
jmp 0x9738a4