joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10c7f6c
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
xor esi, esi
push ebx
mov dword [ebp - 4], esi
call fcn.010c6fc0
mov edi, dword [ebp - 4]
test eax, eax
jl 0x10c7fc8
cmp dword [ebp - 8], esi
jbe 0x10c7fc8
lea eax, [ebp + 8]
push eax
push 0xf003f
push dword [edi + esi*4]
push ebx
call fcn.010c78fa
test eax, eax
jl 0x10c7fc2
push dword [ebp + 8]
call fcn.010c7f6c
test eax, eax
jge 0x10c7fc2
push dword [ebp + 8]
call fcn.010c773c
inc esi
cmp esi, dword [ebp - 8]
jb 0x10c7f98
test edi, edi
je 0x10c7fe1
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
push ebx
call dword [sym.imp.ntdll.dll_NtDeleteKey]
mov esi, eax
test esi, esi
jl 0x10c7ff5
push ebx
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4

Function at 0x10c81a2
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push edi
push edi
push 0x62
call esi
mov ebx, eax
cmp ebx, 0xc0000023
je 0x10c81d2
cmp ebx, edi
jl 0x10c8246
mov ebx, 0xc0000001
jmp 0x10c8246
mov eax, dword fs:[0x18]
push dword [ebp - 4]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov edi, eax
test edi, edi
jne 0x10c81f5
mov ebx, 0xc000009a
jmp 0x10c822d
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push edi
push 0x62
call esi
mov ebx, eax
test ebx, ebx
jl 0x10c822d
movzx eax, word [edi]
mov ecx, dword [ebp + 0x10]
add eax, 2
mov dword [ecx], eax
cmp eax, dword [ebp + 0xc]
jbe 0x10c821e
mov ebx, 0xc0000023
jmp 0x10c822d
push eax
push dword [edi + 4]
push dword [ebp + 8]
call sub.msvcrt.dll_memcpy
add esp, 0xc
test edi, edi
je 0x10c8246
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc
Function at 0x10c8568
Capabilities:
Get process heap force flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
lea eax, [ebp - 8]
push eax
push 0x104222c
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.010c3898
mov esi, eax
cmp esi, edi
jl 0x10c8673
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
push 0x24000001
push dword [ebp - 8]
call fcn.010c5bbe
mov esi, eax
cmp esi, 0xc0000225
jne 0x10c85b9
mov dword [ebp + 8], edi
jmp 0x10c85c1
cmp esi, edi
jl 0x10c8673
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
shr eax, 4
push ebx
mov dword [ebp - 0xc], edi
cmp eax, edi
jbe 0x10c85f6
mov ecx, dword [ebp + 0xc]
add ecx, 8
mov dword [ebp - 0x10], ecx
mov esi, dword [ebp - 0x10]
push 4
pop ecx
mov edi, edx
xor ebx, ebx
repe cmpsd dword [esi], dword es:[edi]
je 0x10c861d
add edx, 0x10
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], eax
jb 0x10c85db
xor edi, edi
mov eax, dword fs:[0x18]
mov ecx, dword [ebp + 8]
mov eax, dword [eax + 0x30]
add ecx, 0x10
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
cmp ebx, edi
jne 0x10c8623
mov esi, 0xc0000017
jmp 0x10c865a
xor esi, esi
xor edi, edi
jmp 0x10c8672
mov esi, dword [ebp + 0xc]
add esi, 8
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push dword [ebp + 8]
lea eax, [ebx + 0x10]
push dword [ebp - 4]
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 8]
add esp, 0xc
add eax, 0x10
push eax
push ebx
push 0x24000001
push dword [ebp - 8]
call fcn.010c5b7a
mov esi, eax
xor edi, edi
cmp ebx, edi
je 0x10c8672
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop ebx
cmp dword [ebp - 4], edi
je 0x10c868e
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 8], edi
je 0x10c869b
push dword [ebp - 8]
call fcn.010c343c
pop edi
mov eax, esi
pop esi
leave
ret 8
Function at 0x10c979e
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
and al, 0x7f
cmp al, 0x7f
jne 0x10c97c1
mov dword [ebp + 8], 0xc000003a
jmp 0x10c9910
movzx eax, byte [esi + 3]
movzx ecx, byte [esi + 2]
shl eax, 8
or eax, ecx
add eax, esi
jmp 0x10c97eb
cmp cl, 4
jne 0x10c97dc
cmp byte [eax + 1], cl
je 0x10c97f7
movzx ecx, byte [eax + 3]
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
add eax, ecx
mov cl, byte [eax]
mov dl, cl
and dl, 0x7f
cmp dl, 0x7f
jne 0x10c97d2
push ebx
sub eax, esi
push edi
add eax, 4
mov edi, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
lea ebx, [edi + 0xc]
push ebx
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov esi, eax
test esi, esi
jne 0x10c982a
mov dword [ebp + 8], 0xc000009a
jmp 0x10c98f5
add edi, 0xfffffffc
push edi
push dword [ebp + 8]
lea eax, [esi + 0xc]
push eax
mov dword [esi], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], 4
call sub.msvcrt.dll_memcpy
lea eax, [edi + esi + 0xc]
add esp, 0xc
mov byte [eax], 0x7f
mov byte [eax + 1], 0xff
mov byte [eax + 2], 4
mov byte [eax + 3], 0
lea eax, [ebp - 4]
push eax
push 3
push esi
call fcn.010c8caa
mov dword [ebp + 8], eax
test eax, eax
jl 0x10c98d8
mov eax, dword [ebp - 4]
mov edi, dword [eax + 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
sub edi, 0xc
lea ecx, [edi + 0x14]
push ecx
push 0
push dword [eax + 0x18]
mov dword [ebp - 8], ecx
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov ebx, eax
test ebx, ebx
jne 0x10c98a6
mov dword [ebp + 8], 0xc000009a
jmp 0x10c98d8
push dword [ebp - 8]
push 0
push ebx
call sub.msvcrt.dll_memset
mov eax, dword [ebp - 4]
add eax, 0xc
push edi
push eax
lea eax, [ebx + 0x14]
push eax
mov dword [ebx], 2
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
mov dword [eax], ebx
mov eax, dword [ebp + 0x10]
add esp, 0x18
mov dword [eax], ecx
cmp dword [ebp - 4], 0
je 0x10c98f5
push dword [ebp - 4]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop ebx
test esi, esi
je 0x10c9910
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, dword [ebp + 8]
pop esi
leave
ret 0xc
Function at 0x10caab8
Capabilities:
Get process heap flags
Get storage device properties

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x10e3200]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x44], esi
call fcn.010cb86e
test al, al
jne 0x10caae3
xor eax, eax
jmp 0x10cac2e
push ebx
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x3c]
push eax
push 1
push 0x10cccd2
push 0x10ccfbe
push esi
call fcn.010cb1ee
mov ebx, dword [sym.imp.ntdll.dll_RtlFreeHeap]
test eax, eax
jl 0x10cac13
cmp dword [ebp - 0x40], 4
jb 0x10cac13
push dword [ebp - 0x3c]
shr dword [ebp - 0x40], 1
call sub.msvcrt.dll__wcslwr
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x10ccf88
push dword [ebp - 0x40]
push dword [ebp - 0x3c]
call sub.msvcrt.dll__snwscanf_s
add esp, 0x1c
cmp eax, 3
jne 0x10cac13
cmp dword [ebp - 0x54], esi
jne 0x10cac13
cmp dword [ebp - 0x4c], esi
jne 0x10cac13
cmp dword [ebp - 0x48], esi
jne 0x10cac13
lea eax, [ebp - 0x50]
push eax
push 0x10ccf46
call fcn.010c6924
test eax, eax
jl 0x10cac13
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [ebp - 0x3c]
push esi
push dword [eax + 0x18]
call ebx
mov edx, dword [ebp - 0x50]
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xa
stosd dword es:[edi], eax
pop ecx
xor eax, eax
push 0x28
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x38]
push eax
push 0xc
lea eax, [ebp - 0x10]
push eax
push 0x2d1400
push edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
call fcn.010cb77a
cmp eax, esi
pop edi
jge 0x10cabce
cmp eax, 0xc000003a
jmp 0x10cabd2
cmp dword [ebp - 0x1c], 7
jne 0x10cac13
push 0x10ccf04
lea eax, [ebp - 0x74]
push eax
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
lea eax, [ebp - 0x74]
mov dword [ebp - 0x64], eax
lea eax, [ebp - 0x6c]
push eax
push 0x20001
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x6c], 0x18
mov dword [ebp - 0x68], esi
mov dword [ebp - 0x60], 0x40
mov dword [ebp - 0x5c], esi
mov dword [ebp - 0x58], esi
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
cmp dword [ebp - 0x3c], esi
je 0x10cac2a
push dword [ebp - 0x3c]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push esi
push dword [eax + 0x18]
call ebx
mov eax, dword [ebp - 0x44]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.010987b7
leave
ret
Function at 0x10cac6c
Capabilities:
Check for peb beingdebugged flag

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov esi, dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
push edi
push 0x10ccf46
lea eax, [ebp - 0x14]
xor edi, edi
push eax
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x2c]
push eax
push 0x20001
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
call dword [sym.imp.ntdll.dll_NtOpenSymbolicLinkObject]
mov ebx, eax
cmp ebx, edi
jge 0x10cace8
cmp ebx, 0xc0000017
je 0x10cad7c
cmp ebx, 0xc000009a
je 0x10cad7c
mov ebx, 0xc0000452
jmp 0x10cad7c
push dword [ebp - 4]
call fcn.010cac40
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], edi
call esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySymbolicLinkObject]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov ebx, eax
cmp ebx, 0xc0000023
je 0x10cad25
cmp ebx, edi
jl 0x10cad7c
mov ebx, 0xc0000001
jmp 0x10cad7c
mov eax, dword fs:[0x18]
mov ecx, dword [ebp - 0xc]
mov eax, dword [eax + 0x30]
add ecx, 2
push ecx
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 8], eax
cmp eax, edi
jne 0x10cad4d
mov ebx, 0xc000009a
jmp 0x10cad7c
mov dword [ebp - 0x10], eax
mov ax, word [ebp - 0xc]
mov word [ebp - 0x12], ax
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov ebx, eax
cmp ebx, edi
jl 0x10cad7c
movzx ecx, word [ebp - 0x14]
mov eax, dword [ebp - 8]
shr ecx, 1
xor edx, edx
mov word [eax + ecx*2], dx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
cmp dword [ebp - 4], edi
je 0x10cad8a
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
cmp ebx, edi
jge 0x10cada9
cmp dword [ebp - 8], edi
je 0x10cada9
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push edi
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4
Function at 0x10caf7e
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword fs:[0x18]
push ebx
push esi
xor ebx, ebx
push 0x6a
mov dword [ebp - 0x18], ebx
mov dword [ebp - 8], ebx
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
mov byte [ebp - 1], bl
call dword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
cmp eax, ebx
jne 0x10cafbf
mov esi, 0xc0000017
jmp 0x10cb0e8
test byte [ebp + 0xc], 1
push edi
je 0x10cafdd
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.010caef0
mov esi, eax
cmp esi, ebx
jge 0x10cb12f
push ebx
push 0x18
lea eax, [ebp - 0x34]
push eax
push 7
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov esi, eax
cmp esi, ebx
jl 0x10cb0d1
mov dword [ebp + 0xc], ebx
cmp dword [ebp - 0x34], ebx
jbe 0x10cb0cc
push ebx
push dword [ebp + 0xc]
push 0x10ccc02
push 0x35
push dword [ebp - 0x14]
call sub.msvcrt.dll_swprintf_s
add esp, 0x14
cmp dword [ebp - 8], ebx
je 0x10cb036
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov dword [ebp - 8], ebx
lea eax, [ebp - 8]
push eax
push dword [ebp - 0x14]
call fcn.010cb452
test eax, eax
jl 0x10cb0b8
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jne 0x10cb0b8
mov dword [ebp - 0x1c], ebx
cmp dword [eax + 4], ebx
jbe 0x10cb0b8
add eax, 0x48
push 4
pop ecx
mov edi, 0x1030234
lea esi, [eax + 8]
xor edx, edx
repe cmpsd dword [esi], dword es:[edi]
jne 0x10cb07e
cmp byte [ebp - 1], bl
jne 0x10cb093
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax]
mov byte [ebp - 1], 1
mov dword [ebp - 0xc], ecx
inc dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0x1c]
add eax, 0x90
cmp edx, dword [ecx + 4]
jb 0x10cb059
jmp 0x10cb0b8
lea eax, [ebp - 0x18]
push eax
call fcn.010cb8ce
test eax, eax
jl 0x10cb126
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x18]
call fcn.010cb33a
test eax, eax
jl 0x10cb126
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp eax, dword [ebp - 0x34]
jb 0x10cb002
cmp byte [ebp - 1], bl
jne 0x10cb12d
mov esi, 0xc0000452
push dword [ebp - 0x14]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
pop edi
cmp dword [ebp - 8], ebx
je 0x10cb103
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [ebp - 0x18], ebx
je 0x10cb11e
push dword [ebp - 0x18]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc
mov esi, 0xc0000451
jmp 0x10cb0d1
xor esi, esi
cmp dword [ebp + 8], ebx
jne 0x10cb137
mov dword [ebp - 0xc], ebx
push dword [ebp - 0xc]
mov edi, dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0x10ccc02
push 0x35
push edi
call sub.msvcrt.dll_swprintf_s
mov eax, dword [ebp + 0x10]
add esp, 0x14
mov dword [eax], edi
jmp 0x10cb0e7
Function at 0x10cb1ee
Capabilities:
Get process heap flags
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x18]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0x1c]
push edi
push dword [ebp + 0xc]
mov dword [eax], ebx
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ntdll.dll_RtlInitUnicodeString]
cmp dword [ebp + 0x10], ebx
je 0x10cb23c
lea eax, [ebp - 4]
push eax
push 0x20019
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.010cb176
mov edi, eax
cmp edi, ebx
jl 0x10cb301
jmp 0x10cb242
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQueryValueKey]
lea eax, [ebp + 0xc]
push eax
push ebx
push ebx
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov edi, eax
cmp edi, 0xc0000023
je 0x10cb276
cmp edi, ebx
jl 0x10cb300
mov edi, 0xc0000001
jmp 0x10cb300
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
push ebx
push dword [eax + 0x18]
mov ebx, dword [sym.imp.ntdll.dll_RtlAllocateHeap]
call ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x10cb2e1
lea ecx, [ebp - 0xc]
push ecx
push dword [ebp + 0xc]
push eax
push 2
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call esi
mov edi, eax
test edi, edi
jl 0x10cb300
mov esi, dword [ebp - 8]
mov eax, dword [esi + 4]
cmp eax, dword [ebp + 0x14]
je 0x10cb2c0
mov edi, 0xc0000024
jmp 0x10cb300
sub dword [ebp + 0xc], 0xc
mov eax, dword fs:[0x18]
push dword [ebp + 0xc]
mov eax, dword [eax + 0x30]
xor edi, edi
push edi
push dword [eax + 0x18]
call ebx
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
cmp eax, edi
jne 0x10cb2e8
mov edi, 0xc000009a
jmp 0x10cb300
push dword [ebp + 0xc]
add esi, 0xc
push esi
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
add esp, 0xc
mov dword [ecx], eax
pop esi
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
je 0x10cb310
push eax
call dword [sym.imp.ntdll.dll_NtClose]
cmp dword [ebp - 8], 0
je 0x10cb32d
push dword [ebp - 8]
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
push 0
push dword [eax + 0x18]
call dword [sym.imp.ntdll.dll_RtlFreeHeap]
mov eax, edi
pop edi
pop ebx
leave
ret 0x18
Function at 0x6fb1a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x23f000]
push edi
or ebp, 0xffffffff
jmp 0x6fb1c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6fb1c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fb1b8
mov eax, 1
add ebx, ebx
jne 0x6fb1db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6fb1ec
jne 0x6fb20b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fb20b
dec eax
add ebx, ebx
jne 0x6fb1f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6fb1d0
add ebx, ebx
jne 0x6fb207
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6fb25d
xor ecx, ecx
sub eax, 3
jb 0x6fb223
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6fb292
sar eax, 1
mov ebp, eax
jmp 0x6fb22e
add ebx, ebx
jne 0x6fb22e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fb1fc
inc ecx
add ebx, ebx
jne 0x6fb23c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6fb1fc
add ebx, ebx
jne 0x6fb249
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6fb23e
jne 0x6fb25a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6fb23e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6fb27c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6fb26e
jmp 0x6fb1be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6fb27c
add edi, ecx
jmp 0x6fb1be
pop esi
mov edi, esi
mov ecx, 0x6ce9
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6fb29a
cmp byte [edi], 0x1e
jne 0x6fb29a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6fb29f
lea edi, [esi + 0x2f8000]
mov eax, dword [edi]
or eax, eax
je 0x6fb317
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x302a9c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x302bd4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6fb2cc
mov ecx, edi
jns 0x6fb2fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x302bdc]
or eax, eax
je 0x6fb311
mov dword [ebx], eax
add ebx, 4
jmp 0x6fb2e9
call dword [esi + 0x302bd8]
mov ebp, dword [esi + 0x302be0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6fb34b
sub esp, 0xffffff80
jmp 0x4f5862
Function at 0x40273a
Capabilities:
Terminate process

Disassembly:
call section..text
push 0
push 0x406018
push 0x406014
call fcn.00402d4d
push 0
push 0x406020
push 0x40601c
call fcn.00402d4d
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x402770
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push edi
push esi
test ecx, ecx
jne 0x402bf1
mov eax, dword [0x405a59]
Function at 0x4033f2
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x406a44]
test eax, eax
je 0x40340b
call eax
test eax, eax
jne 0x40340b
push 0xfffffffffffffffe
jmp 0x403425
push 1
push 0x406010
push 0x406008
call fcn.00402d4d
add esp, 0xc
test eax, eax
je 0x40342b
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x406004
push section..data
call fcn.00402d4d
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x403451
mov esi, 0x405c05
mov cl, 0x20
jmp 0x40345a
cmp al, 0x20
ja 0x403464
inc esi
mov al, byte [esi]
test al, al
jne 0x403455
cmp al, 0x20
jbe 0x40347b
mov al, byte [esi]
cmp al, 0x22
jne 0x40346d
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x403466
jmp 0x40347b
cmp al, cl
ja 0x403481
inc esi
mov al, byte [esi]
test al, al
jne 0x403476
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x4034aa
movzx eax, word [ebp - 0x14]
jmp 0x4034ad
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.0040273a
pop ecx
pop esi
leave
ret

Function at 0x4034e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40639d], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0xfffffc18
push 0xfffffc18
push 0xcf0000
push 0x4068a0
push 0x406908
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403532
xor eax, eax
jmp 0x403549
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]