joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45b0d8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x4a9070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push esi
cmp dword [edi + 0x10], ebx
je 0x45b15a
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
inc esi
lea eax, [esi + esi]
call fcn.0047b910
mov dword [ebp - 8], esp
cmp esp, ebx
je 0x45b15a
push esi
push dword [ebp - 8]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, dword [edi + 0x10]
push dword [ebp - 8]
add eax, 0x1e4
call fcn.004361f0
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
push 1
push ebx
push ebx
push ebx
push ecx
call dword [eax + 0x24]
mov ecx, str.textchanged
mov esi, eax
call fcn.0043a547
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
cmp byte [eax + 0x14d], bl
je 0x45b15a
push dword [edi + 0x10]
call fcn.00448952
xor eax, eax
lea esp, [ebp - 0x10]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046fab6
leave
ret

Function at 0x45b66a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
movsd dword es:[edi], dword [esi]
call fcn.00447edd
mov eax, dword [ebx + 0x6d8]
test eax, eax
je 0x45b6f0
lea ecx, [esp + 0x10]
push ecx
push eax
call fcn.0045abe1
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x45b6c3
mov eax, dword [ebx + 0x6d8]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45b6f0
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
push 0x54
push eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
push eax
push dword [esp + 0x20]
mov eax, dword [ebx + 0x6d8]
push dword [esp + 0x20]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x45b6f9
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004482c2
mov eax, dword [esi + 0x6d8]
test eax, eax
je 0x45b777
lea ecx, [esp + 8]
push ecx
push eax
call fcn.0045abe1
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x45b74a
mov eax, dword [esi + 0x6d8]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x45b777
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
push 0x54
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
push eax
push dword [esp + 0x18]
mov eax, dword [esi + 0x6d8]
push dword [esp + 0x18]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x45bf2d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi], 0x14
mov ebx, ecx
jne 0x45bf66
mov eax, dword [ebx]
call dword [eax + 0xe8]
test al, al
je 0x45bf66
mov eax, dword [ebx + 0xc98]
test eax, eax
je 0x45bf5f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ebx
call fcn.0045c119
cmp dword [edi], 0xe
jne 0x45c018
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xe8]
test al, al
je 0x45c018
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x40]
mov esi, eax
lea edi, [ebp - 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
xor esi, esi
cmp dword [ebx + 0xc98], esi
jne 0x45bfd9
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x24]
mov eax, dword [ebx]
mov edi, dword [0x4ae324]
mov ecx, ebx
call dword [eax + 0x24]
mov eax, dword [eax + 0x84]
push esi
push edi
push 0x1911
push eax
push esi
push esi
push esi
push esi
push 0x50000000
push esi
push str.SysDateTimePick32
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebx + 0xc98], eax
lea eax, [ebx + 0xc88]
push eax
push esi
push 0x1002
push dword [ebx + 0xc98]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
push 0x40
push eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push esi
push dword [ebx + 0xc98]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edi, dword [ebp + 8]
push edi
mov ecx, ebx
call fcn.0043c393
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x45c189
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0xc98], 0
push esi
push edi
je 0x45c208
lea eax, [ebp - 0x14]
push eax
mov eax, ebx
call fcn.0045c027
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x40]
mov esi, eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x24]
cmp eax, ecx
jl 0x45c1f3
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
sub ecx, dword [ebp - 0x10]
sub edx, dword [ebp - 0x20]
cmp ecx, edx
jl 0x45c1f3
push 0
push ecx
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 0
push dword [ebx + 0xc98]
call dword [sym.imp.USER32.dll_SetWindowPos]
jmp 0x45c208
push 0
push dword [ebx + 0xc98]
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ebx
call fcn.0045c119
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x464b93
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebx + 0x10], eax
and dword [eax + 0x6e8], 0
cmp dword [ebx + 4], 0
push esi
push edi
jne 0x464c08
lea eax, [ebp - 0x14]
push eax
mov eax, ebx
call fcn.00464c78
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
call dword [eax + 0x24]
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0
push 0x40000000
push dword [eax + 0x84]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.00434cb2
mov ecx, dword [ebx + 0x10]
push dword [ecx + 0x664]
mov eax, dword [ecx]
call dword [eax + 0x24]
mov ecx, eax
call fcn.0043ae05
push 1
push dword [eax]
push 0x30
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebx + 0x10]
mov eax, dword [ecx]
lea edx, [ebp - 0x98]
push edx
call dword [eax + 0x38]
mov eax, dword [eax]
cmp word [eax], 0
lea ecx, [ebp - 0x98]
sete byte [ebp + 0xb]
call fcn.00436015
cmp byte [ebp + 0xb], 0
mov esi, 0x6d8
je 0x464c43
mov eax, dword [ebx + 0x10]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov eax, dword [ebx + 0x10]
add eax, esi
push eax
push 0
push 0x1002
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
push 4
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
mov byte [ebx + 0x18], 1
pop ebx
leave
ret 4

Function at 0x465014
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea esi, [ebp + 8]
sub esp, 0x10
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov ebx, ecx
movsd dword es:[edi], dword [esi]
call fcn.00447edd
mov eax, dword [ebx + 0x6f0]
test eax, eax
je 0x465099
lea ecx, [esp + 0x10]
push ecx
call fcn.00464c78
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x46506c
mov eax, dword [ebx + 0x6f0]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x465099
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x14]
push 0x54
push eax
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
push eax
push dword [esp + 0x20]
mov eax, dword [ebx + 0x6f0]
push dword [esp + 0x20]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4650a2
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004482c2
mov eax, dword [esi + 0x6f0]
test eax, eax
je 0x46511f
lea ecx, [esp + 8]
push ecx
call fcn.00464c78
lea eax, [esp + 8]
push eax
call dword [sym.imp.USER32.dll_IsRectEmpty]
test eax, eax
je 0x4650f2
mov eax, dword [esi + 0x6f0]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x46511f
mov eax, dword [esp + 0x14]
sub eax, dword [esp + 0xc]
push 0x54
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x10]
push eax
push dword [esp + 0x18]
mov eax, dword [esi + 0x6f0]
push dword [esp + 0x18]
push 0
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x46b627
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 8]
mov esi, eax
and esi, 7
je 0x46b64c
cmp eax, esi
jge 0x46b644
mov eax, edi
call fcn.0046b0a3
mov ecx, esi
shr dword [edi + 0xc], cl
sub dword [edi + 8], esi
xor eax, eax
cmp dword [edi + 8], eax
jle 0x46b66e
mov cl, byte [edi + 0xc]
shr dword [edi + 0xc], 8
add dword [edi + 8], 0xfffffff8
mov byte [ebp + eax - 4], cl
inc eax
cmp dword [edi + 8], 0
jg 0x46b653
cmp eax, 4
jge 0x46b68a
mov esi, dword [edi + 4]
mov ecx, dword [edi]
cmp ecx, esi
jb 0x46b67b
xor dl, dl
jmp 0x46b67e
mov dl, byte [ecx]
inc ecx
mov byte [ebp + eax - 4], dl
inc eax
cmp eax, 4
jl 0x46b673
mov dword [edi], ecx
movzx esi, byte [ebp - 3]
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 2]
shl esi, 8
add esi, eax
movzx eax, byte [ebp - 1]
shl eax, 8
add eax, ecx
mov ecx, esi
xor ecx, 0xffff
cmp eax, ecx
je 0x46b6be
mov dword [0x4ad72c], str.zlib_corrupt
xor eax, eax
jmp 0x46b70a
mov eax, dword [edi]
add eax, esi
cmp eax, dword [edi + 4]
jbe 0x46b6d3
mov dword [0x4ad72c], str.read_past_buffer
jmp 0x46b6ba
mov eax, dword [edi + 0x10]
lea ecx, [eax + esi]
cmp ecx, dword [edi + 0x18]
jbe 0x46b6e9
push esi
call fcn.0046b17b
pop ecx
test eax, eax
je 0x46b6ba
mov eax, dword [edi + 0x10]
push ebx
mov ebx, dword [edi]
push esi
push ebx
push eax
call fcn.00472800
mov eax, dword [edi + 0x10]
add eax, esi
add ebx, esi
mov dword [edi + 0x10], eax
add esp, 0xc
xor eax, eax
mov dword [edi], ebx
inc eax
pop ebx
pop edi
pop esi
leave
ret

Function at 0x46fab6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4a9070]
jne 0x46fac0
repz ret
jmp fcn.00470dcb
Function at 0x477bd8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0047188e
and dword [ebp - 4], 0
cmp dword [0x4ad3a8], 0
mov ebx, eax
jne 0x477c89
push 0x48f06c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x477d3a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x477d3a
push eax
call fcn.0047181c
mov dword [esp], 0x48f050
push edi
mov dword [0x4ad3a8], eax
call esi
push eax
call fcn.0047181c
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4ad3ac], eax
call esi
push eax
call fcn.0047181c
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4ad3b0], eax
call esi
push eax
call fcn.0047181c
pop ecx
mov dword [0x4ad3b8], eax
test eax, eax
je 0x477c89
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0047181c
pop ecx
mov dword [0x4ad3b4], eax
mov eax, dword [0x4ad3b4]
cmp eax, ebx
je 0x477ce1
cmp dword [0x4ad3b8], ebx
je 0x477ce1
push eax
call fcn.00471897
push dword [0x4ad3b8]
mov esi, eax
call fcn.00471897
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x477ce1
test edi, edi
je 0x477ce1
call esi
test eax, eax
je 0x477cd8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x477cd8
test byte [ebp - 0xc], 1
jne 0x477ce1
or dword [ebp + 0x10], 0x200000
jmp 0x477d1a
mov eax, dword [0x4ad3ac]
cmp eax, ebx
je 0x477d1a
push eax
call fcn.00471897
pop ecx
test eax, eax
je 0x477d1a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x477d1a
mov eax, dword [0x4ad3b0]
cmp eax, ebx
je 0x477d1a
push eax
call fcn.00471897
pop ecx
test eax, eax
je 0x477d1a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4ad3a8]
call fcn.00471897
pop ecx
test eax, eax
je 0x477d3a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x477d3c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0xa1c058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xa1c1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xa1c07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1c06a
add dl, dl
jne 0xa1c089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1c0dc
xor eax, eax
add dl, dl
jne 0xa1c096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xa1c17d
add dl, dl
jne 0xa1c0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1c0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1c0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1c0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xa1c0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xa1c075
mov eax, 1
add dl, dl
jne 0xa1c0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xa1c0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1c0e1
sub eax, ebx
mov ebx, 1
jne 0xa1c128
mov ecx, 1
add dl, dl
jne 0xa1c10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1c119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1c105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1c075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xa1c13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xa1c14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xa1c136
cmp eax, 0x7d00
jae 0xa1c16d
cmp eax, 0x500
jb 0xa1c168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1c075
cmp eax, 0x7f
ja 0xa1c170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xa1c075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xa1c19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xa1c075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10

Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x928cd4
push eax
push dword fs:[0]
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec edx
bound ebx, qword ds:[0xa8498464]
or al, 0x99
mov dl, 0xf5
imul esi, dword [0xe7af52d4], 0xdfebb982
sub eax, 0x555fdd1b
in eax, dx
mov esi, 0x79bacb51
push es
into
mov ecx, 0x357c306
fcom dword [edx + 0x633e8366]
iretd
or dword [eax - 0x19729186], esp
sub dword [ebx], 0xffffffb8
invalid

Function at 0x424bfc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004248ad

Function at 0x424c07
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00424a37
Function at 0x47ba90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x45000]
push edi
jmp 0x47baaa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47bab1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47baa0
mov eax, 1
add ebx, ebx
jne 0x47bac3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47bad4
jne 0x47baf3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47baf3
dec eax
add ebx, ebx
jne 0x47bae0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x47bab8
add ebx, ebx
jne 0x47baef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x47bb45
xor ecx, ecx
sub eax, 3
jb 0x47bb0b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47bb7a
sar eax, 1
mov ebp, eax
jmp 0x47bb16
add ebx, ebx
jne 0x47bb16
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bae4
inc ecx
add ebx, ebx
jne 0x47bb24
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47bae4
add ebx, ebx
jne 0x47bb31
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47bb26
jne 0x47bb42
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47bb26
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47bb64
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47bb56
jmp 0x47baa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47bb64
add edi, ecx
jmp 0x47baa6
pop esi
mov edi, esi
mov ecx, 0x18fe
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x47bb82
cmp byte [edi], 9
jne 0x47bb82
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x47bb87
lea edi, [esi + 0x77000]
mov eax, dword [edi]
or eax, eax
je 0x47bbff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7b348]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7b3d4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47bbb4
mov ecx, edi
jns 0x47bbe3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7b3d8]
or eax, eax
je 0x47bbf9
mov dword [ebx], eax
add ebx, 4
jmp 0x47bbd1
call dword [esi + 0x7b3e8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x47bc30
cmp al, 0xef
ja 0x47bc23
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x47bc05
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x47bc12
mov ebp, dword [esi + 0x7b3dc]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47bc64
sub esp, 0xffffff80
jmp 0x407034
Function at 0x535350
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xc7000]
push edi
jmp 0x53536a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x535371
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x535360
mov eax, 1
add ebx, ebx
jne 0x535383
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x535394
jne 0x5353b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5353b3
dec eax
add ebx, ebx
jne 0x5353a0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x535378
add ebx, ebx
jne 0x5353af
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x535405
xor ecx, ecx
sub eax, 3
jb 0x5353cb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x53543a
sar eax, 1
mov ebp, eax
jmp 0x5353d6
add ebx, ebx
jne 0x5353d6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5353a4
inc ecx
add ebx, ebx
jne 0x5353e4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5353a4
add ebx, ebx
jne 0x5353f1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5353e6
jne 0x535402
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5353e6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x535424
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x535416
jmp 0x535366
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x535424
add edi, ecx
jmp 0x535366
pop esi
mov edi, esi
mov ecx, 0x9980
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x535442
cmp byte [edi], 0x22
jne 0x535442
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x535447
lea edi, [esi + 0x131000]
mov eax, dword [edi]
or eax, eax
je 0x5354bf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x13c500]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x13c668]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x535474
mov ecx, edi
jns 0x5354a3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x13c66c]
or eax, eax
je 0x5354b9
mov dword [ebx], eax
add ebx, 4
jmp 0x535491
call dword [esi + 0x13c67c]
mov ebp, dword [esi + 0x13c670]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5354f3
sub esp, 0xffffff80
jmp 0x4b2116
Function at 0x6d04d7ee
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.J2D_TRACE_LEVEL
call esi
and dword [0x6d0f6ec8], 0
pop ecx
test eax, eax
je 0x6d04d834
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 4]
push ecx
push 0x6d0b71a4
push eax
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0xc
test eax, eax
jle 0x6d04d834
mov eax, dword [ebp - 4]
cmp eax, 5
ja 0x6d04d834
mov dword [0x6d0f6ec8], eax
push str.J2D_TRACE_FILE
call esi
mov esi, eax
pop ecx
test esi, esi
je 0x6d04d867
push 0x6d0b7190
push esi
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [0x6d0f9534], eax
test eax, eax
jne 0x6d04d87e
push esi
push str._E_:_Error_opening_trace_file__s_n
call dword [sym.imp.MSVCR100.dll_printf]
pop ecx
pop ecx
cmp dword [0x6d0f9534], 0
jne 0x6d04d87e
call dword [sym.imp.MSVCR100.dll___iob_func]
add eax, 0x20
mov dword [0x6d0f9534], eax
pop esi
leave
ret

Function at 0x6d0506c0
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.MSVCR100.dll_getenv]
push str.IMLIB_DEBUG
call esi
add esp, 4
mov ebx, 1
test eax, eax
je 0x6d050702
call sym.awt.dll_awt_setMlibStartTimer
mov dword [0x6d0f9578], eax
call sym.awt.dll_awt_setMlibStartTimer
cmp dword [0x6d0f9578], 0
mov dword [0x6d0f957c], eax
je 0x6d050702
test eax, eax
je 0x6d050702
mov dword [0x6d0f9568], ebx
push str.IMLIB_PRINT
call esi
add esp, 4
test eax, eax
je 0x6d050716
mov dword [0x6d0f956c], ebx
push str.IMLIB_START
call esi
add esp, 4
test eax, eax
je 0x6d050738
push 0x6d0f9570
push 0x6d0b71a4
push eax
call dword [sym.imp.MSVCR100.dll_sscanf]
add esp, 0xc
push str.IMLIB_NOMLIB
call esi
add esp, 4
test eax, eax
je 0x6d050753
pop esi
mov dword [0x6d0f9574], ebx
xor al, al
pop ebx
ret 8
mov eax, dword [esp + 0xc]
push 0x6d0f955c
push 0x6d0f6ecc
push eax
call fcn.6d05f1d0
add esp, 0xc
test eax, eax
jne 0x6d050746
pop esi
mov al, bl
pop ebx
ret 8