joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41bef0
Capabilities:
Create directory
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x471f36
mov eax, dword fs:[0]
push eax
sub esp, 0x214
mov eax, dword [0x4878d4]
xor eax, esp
mov dword [esp + 0x210], eax
push ebp
push esi
push edi
mov eax, dword [0x4878d4]
xor eax, esp
push eax
lea eax, [esp + 0x224]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x234]
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22]
push ecx
mov word [esp + 0x24], ax
call fcn.0045cac0
mov eax, dword [ebp + 0x59c]
add esp, 0xc
push eax
push 0x104
lea edx, [esp + 0x20]
push edx
push 0x47d008
push str.picpath
push str.memory
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.004040c0
mov dword [esp + 0x22c], 0
mov esi, dword [esp + 0x10]
mov ecx, 0x47d008
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41bfbb
test dx, dx
je 0x41bfb7
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41bfbb
add eax, 4
add ecx, 4
test dx, dx
jne 0x41bf95
xor eax, eax
jmp 0x41bfc0
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
sete al
test al, al
je 0x41bff7
lea eax, [esi - 0x10]
mov dword [esp + 0x22c], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41bff0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
jmp 0x41c0d5
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edx, dword [0x489490]
mov esi, eax
mov eax, dword [edx + 0xc]
mov ecx, 0x489490
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
push esi
push str._d.bmp
lea edi, [esp + 0x1c]
mov byte [esp + 0x234], 1
call fcn.00405490
mov edi, dword [esp + 0x1c]
mov eax, dword [edi - 0xc]
add esp, 8
push eax
push edi
lea ecx, [esp + 0x18]
push ecx
call fcn.00404fe0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax - 0xc]
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov esi, eax
test esi, esi
jne 0x41c066
call fcn.004057f0
mov eax, dword [ebp + 0x518]
mov edx, dword [eax]
push 0
push esi
push eax
mov eax, dword [edx + 0xfc]
call eax
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
lea eax, [edi - 0x10]
mov byte [esp + 0x22c], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c0a5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x22c], 0xffffffff
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c0d0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x224]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.004599ea
add esp, 0x220
ret 4
Function at 0x41c100
Capabilities:
Create process on windows
Read .ini file

Disassembly:
sub esp, 0x210
mov eax, dword [0x4878d4]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0045cac0
mov edx, dword [esi + 0x59c]
add esp, 0xc
push edx
push 0x104
lea eax, [esp + 0x10]
push eax
push 0x47d008
push str.picpath
push str.memory
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea ecx, [esp + 4]
push ecx
lea ecx, [esp + 0xc]
call fcn.004040c0
mov esi, dword [esp + 4]
mov ecx, 0x47d008
mov eax, esi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41c196
test dx, dx
je 0x41c192
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41c196
add eax, 4
add ecx, 4
test dx, dx
jne 0x41c170
xor eax, eax
jmp 0x41c19b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41c1d3
lea eax, [esi - 0x10]
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x41c1bb
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.004599ea
add esp, 0x210
ret
push 0xa
push 0
push 0
push esi
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x41c207
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x210]
pop esi
xor ecx, esp
mov eax, 1
call fcn.004599ea
add esp, 0x210
ret
Function at 0x4211e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4878d4]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.0045cac0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x42124a
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x421233
cmp eax, 4
jne 0x42124a
cmp dword [esp + 8], 0x5a
jb 0x42124a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.004599ea
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.004599ea
add esp, 0x118
ret

Function at 0x421270
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4212de
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x4212af
cmp eax, 2
jne 0x4212ca
mov eax, dword [esp]
test esi, esi
je 0x4212d8
test eax, eax
je 0x4212d3
test al, 1
jne 0x4212ca
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4212d8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x424ba0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x471c99
mov eax, dword fs:[0]
push eax
sub esp, 0x2a4
mov eax, dword [0x4878d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [esi + 0x24]
xor ebx, ebx
push eax
mov dword [ebp - 0x2ac], esi
mov dword [esi + 0x20], ebx
call fcn.0041ea10
push 0x104
lea ecx, [ebp - 0x218]
push ecx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
lea edx, [ebp - 0x218]
push edx
lea ecx, [ebp - 0x2a0]
call fcn.00432930
push str.QvodNet.dll
push 0x47b320
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 1
call fcn.00432b40
lea ecx, [ebp - 0x2a0]
call fcn.00432050
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x48a5c8], eax
cmp eax, ebx
je 0x424c51
push 0xa70000
call fcn.00459cc6
add esp, 4
mov dword [esi], eax
cmp eax, ebx
jne 0x424c6c
push ebx
push str.error
push 0x47dd44
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x424cb9
call fcn.004248a0
mov dword [ebp - 0x2a8], eax
mov eax, dword [0x48a5cc]
mov dword [esi + 0x20], eax
cmp eax, ebx
je 0x424c93
mov ecx, dword [0x48a5cc]
mov eax, dword [ecx]
call dword [eax]
mov dword [ebp - 0x2a8], eax
lea ecx, [esi + 4]
push ecx
mov dword [esi + 0x3c], ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea edx, [ebp - 0x2a4]
push edx
push ebx
push esi
push 0x424900
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x1c], eax
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], bl
call fcn.00432010
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004599ea
mov esp, ebp
pop ebp
ret
Function at 0x433490
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
xor esi, esi
call edi
test ax, ax
jge 0x4334a8
mov esi, 8
push 2
call edi
test ax, ax
jge 0x4334b4
or esi, 1
push 1
call edi
test ax, ax
jge 0x4334c0
or esi, 2
push 0x10
call edi
test ax, ax
jge 0x4334cc
or esi, 4
push 0x12
call edi
test ax, ax
jge 0x4334d8
or esi, 0x20
pop edi
mov eax, esi
pop esi
ret
Function at 0x436ac0
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x3c
push esi
mov esi, ecx
push edi
mov edi, dword [esi]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
je 0x436ada
push edi
call dword [sym.imp.USER32.dll_SetFocus]
mov eax, dword [esi + 0xd0]
mov edi, dword [esp + 0x48]
cmp edi, eax
je 0x436c09
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x436b74
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x28], 0x15
mov dword [esp + 0x2c], edi
call ebx
mov ecx, dword [esi + 0xd0]
mov dword [esp + 0x30], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
lea edx, [esp + 0x28]
push edx
call eax
mov ecx, dword [esi + 0xd0]
lea edx, [esp + 0xc]
mov dword [esp + 0x10], ecx
push edx
mov ecx, esi
mov dword [esp + 0x10], 0xa
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call fcn.00433cf0
mov dword [esi + 0xd0], 0
test edi, edi
je 0x436c08
mov eax, dword [edi]
mov edx, dword [eax + 0x1c]
mov ecx, edi
call edx
cmp eax, esi
jne 0x436c08
mov eax, dword [edi]
mov edx, dword [eax + 0xb8]
mov ecx, edi
call edx
test al, al
je 0x436c08
mov eax, dword [edi]
mov edx, dword [eax + 0xc8]
mov ecx, edi
call edx
test al, al
je 0x436c08
xor eax, eax
mov dword [esp + 0x2c], eax
mov dword [esi + 0xd0], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
mov dword [esp + 0x44], eax
mov dword [esp + 0x28], 0x16
mov dword [esp + 0x2c], edi
call ebx
mov ecx, dword [esi + 0xd0]
mov dword [esp + 0x30], eax
mov eax, dword [ecx]
mov eax, dword [eax + 0xec]
lea edx, [esp + 0x28]
push edx
call eax
mov ecx, dword [esi + 0xd0]
push 0
push 0
push 0xb
push ecx
mov ecx, esi
call fcn.004356b0
pop ebx
pop edi
pop esi
add esp, 0x3c
ret 4
Function at 0x436d00
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x20
sub eax, 0x100
push esi
push edi
mov esi, ecx
je 0x436e0a
sub eax, 4
je 0x436d8a
sub eax, 2
jne 0x436e00
mov edx, dword [esp + 0x30]
xor ecx, ecx
push edx
mov word [esp + 0x30], ax
mov word [esp + 0x32], cx
call fcn.0045d68b
mov ecx, dword [esi + 0xcc]
add esp, 4
push reloc.OLEAUT32.dll_VariantCopyInd
mov word [esp + 0x30], ax
mov eax, dword [ecx]
mov eax, dword [eax + 0xe8]
lea edx, [esp + 0x30]
push edx
push 0x4346e0
call eax
mov esi, eax
test esi, esi
je 0x436e00
mov edx, dword [esi]
mov eax, dword [edx + 0xdc]
mov ecx, esi
call eax
mov edx, dword [esi]
mov eax, dword [edx + 0x18]
mov ecx, esi
call eax
pop edi
mov al, 1
pop esi
add esp, 0x20
ret 0x10
cmp dword [esi + 0xd0], 0
je 0x436e00
mov cx, word [esp + 0x30]
mov edx, dword [esi + 0xe0]
xor eax, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov eax, dword [esi + 0xe4]
mov dword [esp + 8], 5
mov word [esp + 0x1c], cx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], eax
call fcn.00433490
mov word [esp + 0x1e], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xd0]
mov dword [esp + 0x10], eax
mov edx, dword [ecx]
mov edx, dword [edx + 0xec]
lea eax, [esp + 8]
push eax
call edx
pop edi
xor al, al
pop esi
add esp, 0x20
ret 0x10
mov eax, dword [esp + 0x30]
cmp eax, 9
jne 0x436e36
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setge al
movzx ecx, al
push ecx
mov ecx, esi
call fcn.00436c20
pop edi
mov al, 1
pop esi
add esp, 0x20
ret 0x10
cmp eax, 0xd
jne 0x436e7f
push 0x4758d0
lea ecx, [esi + 0x168]
call fcn.00432f40
mov edi, eax
test edi, edi
je 0x436e00
mov eax, dword [esi + 0xd0]
cmp eax, edi
je 0x436e00
test eax, eax
je 0x436e6c
mov ecx, eax
mov edx, dword [ecx]
mov eax, dword [edx + 0x14]
call eax
test al, 4
jne 0x436e00
mov edx, dword [edi]
mov eax, dword [edx + 0x18]
mov ecx, edi
call eax
pop edi
mov al, 1
pop esi
add esp, 0x20
ret 0x10
cmp eax, 0x1b
jne 0x436e00
push str.cancel
lea ecx, [esi + 0x168]
call fcn.00432f40
test eax, eax
je 0x436e00
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x18]
call eax
pop edi
mov al, 1
pop esi
add esp, 0x20
ret 0x10
Function at 0x440380
Capabilities:
Get file size
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi]
xor ebp, ebp
cmp eax, ebp
je 0x440397
push eax
call fcn.0045a1ed
add esp, 4
mov eax, dword [esi + 4]
cmp eax, ebp
je 0x4403a7
push eax
call fcn.0045a1ed
add esp, 4
mov eax, dword [esp + 0x14]
push ebp
push 0x80
push 3
push ebp
push 1
push SysReAllocString
push eax
mov dword [esi], ebp
mov dword [esi + 4], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4403fd
push 0x63
lea ecx, [esi + 0x10]
push str.Error_opening_file
push ecx
call fcn.0045b36d
push 0x31
push 0x47b668
add esi, 0xd8
push esi
call fcn.0045b36d
add esp, 0x18
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, ebp
jne 0x440415
push 0x63
push str.File_is_empty
jmp 0x44046d
cmp edi, 0x400000
jbe 0x44042a
push 0x63
push str.File_too_large
lea eax, [esi + 0x10]
push eax
jmp 0x440471
push edi
mov dword [esp + 0x14], ebp
call fcn.00459cc6
add esp, 4
push 0
lea ecx, [esp + 0x14]
push ecx
push edi
mov ebp, eax
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], edi
je 0x440496
push ebp
call fcn.00459cd1
add esp, 4
mov ecx, esi
call fcn.0043f560
push 0x63
push str.Could_not_read_file
lea edx, [esi + 0x10]
push edx
call fcn.0045b36d
push 0x31
push 0x47b668
add esi, 0xd8
push esi
call fcn.0045b36d
add esp, 0x18
pop edi
pop esi
pop ebp
xor al, al
pop ebx
pop ecx
ret 8
mov eax, dword [esp + 0x1c]
push eax
push edi
push ebp
mov ecx, esi
call fcn.00440220
push ebp
mov bl, al
call fcn.00459cd1
add esp, 4
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 8
Function at 0x44c960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x44c982
cmp eax, esi
jge 0x44c97a
mov eax, edi
call fcn.0044c140
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
xor eax, eax
cmp dword [edi + 8], eax
jle 0x44c9aa
lea ecx, [eax - 8]
lea esp, [esp]
mov dl, byte [edi + 0xc]
shr dword [edi + 0xc], 8
add dword [edi + 8], ecx
mov byte [esp + eax + 8], dl
inc eax
cmp dword [edi + 8], 0
jg 0x44c990
cmp eax, 4
jge 0x44c9ca
mov esi, dword [edi + 4]
lea ecx, [ecx]
mov ecx, dword [edi]
cmp ecx, esi
jb 0x44c9ba
xor edx, edx
jmp 0x44c9c0
movzx edx, byte [ecx]
inc ecx
mov dword [edi], ecx
mov byte [esp + eax + 8], dl
inc eax
cmp eax, 4
jl 0x44c9b0
mov eax, dword [esp + 8]
movzx ecx, byte [esp + 0xb]
movzx edx, byte [esp + 0xa]
movzx esi, ah
movzx eax, al
shl esi, 8
add esi, eax
shl ecx, 8
mov eax, esi
add ecx, edx
xor eax, 0xffff
cmp ecx, eax
je 0x44ca03
mov dword [0x4892b4], str.zlib_corrupt
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov ecx, dword [edi]
add ecx, esi
cmp ecx, dword [edi + 4]
jbe 0x44ca1c
pop edi
mov dword [0x4892b4], 0x478228
xor eax, eax
pop esi
pop ecx
ret
mov edx, dword [edi + 0x10]
add edx, esi
cmp edx, dword [edi + 0x18]
jbe 0x44ca31
mov ecx, esi
call fcn.0044c170
test eax, eax
je 0x44c9fd
mov eax, dword [edi]
mov ecx, dword [edi + 0x10]
push esi
push eax
push ecx
call fcn.0045d210
add dword [edi], esi
add esp, 0xc
add dword [edi + 0x10], esi
pop edi
mov eax, 1
pop esi
pop ecx
ret
Function at 0x4599ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4878d4]
jne 0x4599f4
repz ret
jmp fcn.0045d835

Function at 0x469f55
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045dc72
and dword [ebp - 4], 0
cmp dword [0x48a094], 0
mov ebx, eax
jne 0x46a006
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x46a0b7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x46a0b7
push eax
call fcn.0045dc00
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48a094], eax
call esi
push eax
call fcn.0045dc00
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48a098], eax
call esi
push eax
call fcn.0045dc00
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48a09c], eax
call esi
push eax
call fcn.0045dc00
pop ecx
mov dword [0x48a0a4], eax
test eax, eax
je 0x46a006
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0045dc00
pop ecx
mov dword [0x48a0a0], eax
mov eax, dword [0x48a0a0]
cmp eax, ebx
je 0x46a05e
cmp dword [0x48a0a4], ebx
je 0x46a05e
push eax
call fcn.0045dc7b
push dword [0x48a0a4]
mov esi, eax
call fcn.0045dc7b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x46a05e
test edi, edi
je 0x46a05e
call esi
test eax, eax
je 0x46a055
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46a055
test byte [ebp - 0xc], 1
jne 0x46a05e
or dword [ebp + 0x10], 0x200000
jmp 0x46a097
mov eax, dword [0x48a098]
cmp eax, ebx
je 0x46a097
push eax
call fcn.0045dc7b
pop ecx
test eax, eax
je 0x46a097
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x46a097
mov eax, dword [0x48a09c]
cmp eax, ebx
je 0x46a097
push eax
call fcn.0045dc7b
pop ecx
test eax, eax
je 0x46a097
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48a094]
call fcn.0045dc7b
pop ecx
test eax, eax
je 0x46a0b7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46a0b9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4e4740
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x90000]
push edi
jmp 0x4e475a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4e4761
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e4750
mov eax, 1
add ebx, ebx
jne 0x4e4773
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4e4784
jne 0x4e47a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e47a3
dec eax
add ebx, ebx
jne 0x4e4790
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4e4768
add ebx, ebx
jne 0x4e479f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4e47f5
xor ecx, ecx
sub eax, 3
jb 0x4e47bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4e482a
sar eax, 1
mov ebp, eax
jmp 0x4e47c6
add ebx, ebx
jne 0x4e47c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e4794
inc ecx
add ebx, ebx
jne 0x4e47d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4e4794
add ebx, ebx
jne 0x4e47e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4e47d6
jne 0x4e47f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4e47d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4e4814
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4e4806
jmp 0x4e4756
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4e4814
add edi, ecx
jmp 0x4e4756
pop esi
mov edi, esi
mov ecx, 0x3ed9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4e4832
cmp byte [edi], 0x11
jne 0x4e4832
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4e4837
lea edi, [esi + 0xdd000]
mov eax, dword [edi]
or eax, eax
je 0x4e48af
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xf2ffc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xf3178]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4e4864
mov ecx, edi
jns 0x4e4893
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xf317c]
or eax, eax
je 0x4e48a9
mov dword [ebx], eax
add ebx, 4
jmp 0x4e4881
call dword [esi + 0xf318c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x4e48e0
cmp al, 0xef
ja 0x4e48d3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x4e48b5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x4e48c2
mov ebp, dword [esi + 0xf3180]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4e4914
sub esp, 0xffffff80
jmp 0x425f74
Function at 0x442770
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.004a67b3
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.004a67b3
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
push 0x10
call fcn.004a67b3
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x4a8d60
call fcn.004a67c5
add esp, 4
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 3
je 0x442830
mov eax, 0
jmp 0x44299c
cmp dword [ebp + 0xc], 0
jne 0x44285c
mov dword [ebp - 0x1c], esp
mov eax, 0x65
call fcn.004a67bf
cmp dword [ebp - 0x1c], esp
je 0x442859
push 6
call fcn.004a67b9
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x442884
mov eax, 0x88959a
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x44287e
push ebx
call fcn.004a67ad
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
mov eax, 0x66
call fcn.004a67bf
cmp dword [ebp - 0x1c], esp
je 0x4428af
push 6
call fcn.004a67b9
add esp, 4
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x59e347
mov eax, 0x67
call fcn.004a67bf
cmp dword [ebp - 0x1c], esp
je 0x4428db
push 6
call fcn.004a67b9
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x20], ebx
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebx], 2
mov dword [ebp - 0x1c], esp
mov eax, 0
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x18]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 0x68
call fcn.004a67bf
cmp dword [ebp - 0x1c], esp
je 0x44296f
push 6
call fcn.004a67b9
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esp
push dword [ebp - 8]
mov eax, 0x55
call fcn.004a67bf
cmp dword [ebp - 0x1c], esp
je 0x442994
push 6
call fcn.004a67b9
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x44299c
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.004a67ad
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.004a67ad
add esp, 4
mov ebx, dword [ebp - 0x18]
push ebx
call fcn.004a67ad
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10