joyce8/EMBER2024-capa huggingface dataset:
Function at 0x465fe5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4660fd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4660fd
mov eax, dword [esi + 0x3c]
push eax
call fcn.0047affd
mov esi, eax
test esi, esi
je 0x4660fd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x4660fd
mov ecx, esi
call fcn.00465f70
cmp edi, eax
jge 0x4660fd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x466083
mov dword [esp + 0x34], 1
jmp 0x4660de
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x4660fd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.00465570
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc

Function at 0x47b9a0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x47b9d8
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00479a54
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00479a2c
jmp 0x47b9e4
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x47d08e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x47d0d0
call fcn.00482b47
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x47d0d0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x47d0c7
xor eax, eax
jmp 0x47d0d8
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0047d0de
pop edi
pop esi
pop ebx
ret 4
Function at 0x483077
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4830a5
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4830c3
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00482fdd
jmp 0x4830c3
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4830c3
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00482fdd
test edi, edi
mov eax, edi
jne 0x4830ad
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4a14f4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a15cd
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4a15e8
push ebx
push 0x4a15f8
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040a768
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004077c0
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040a494
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x4a1576
mov ax, 0x83
call fcn.004a1118
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle
call fcn.004a14c8
push 0x1cff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x4a157f
call fcn.004a14c8
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a15d4
lea eax, [ebp - 4]
call fcn.00409a3c
pop eax
jmp eax

Function at 0x4a16e8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
jmp 0x4a17a5
cmp dword [esi + 0x10], 0x1000
jne 0x4a1793
test byte [esi + 0x15], 1
jne 0x4a1793
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4a1744
cmp ebp, 2
je 0x4a1744
cmp ebp, 0x10
je 0x4a1744
cmp ebp, 0x20
jne 0x4a1760
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4a1760
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4a1771
mov eax, dword [esi]
add eax, ebx
call fcn.004a16e0
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4a1764
cmp byte [esp + 4], 0
je 0x4a1793
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov edi, dword [esi]
add edi, dword [esi + 0xc]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4a17b1
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4a1719
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1009b97b
Capabilities:
Encode data using xor

Disassembly:
stc
repne scasb al, byte es:[edi]
push 0x4aaa693a
pushal
jmp 0x1009ba49
call fcn.1009cc61
mov al, 0x2e
jmp 0x10095068
mov byte [esp + 4], 0x5d
Function at 0x4171c5
Capabilities:
Encode data using xor

Disassembly:
jecxz 0x417179
inc eax
fsub st(7), st(0)
retf
xchg ecx, eax
cmpsb byte [esi], byte es:[edi]
fisttp qword [edx + edx + 0x11bde3e3]
scasb al, byte es:[edi]
push eax
and cl, byte [esi - 0x34]
mov dword [0x1f3fb203], eax
sub bl, al
jne 0x4171d4
ljmp 0x2fd2:0xfc525b27
xor byte [esi + edi - 0x6e], 0xef
mov gs, ecx
imul esi, dword [ecx], 0x6e
inc ecx
cdq
jecxz 0x4171b8
jae 0x417231
outsd dx, dword [esi]
push edx
ror bh, cl
mov gs, word gs:[edx]
cmc
push 0xffffffffffffffe5
mov esi, 0x23c5e373
jae 0x4171aa
lds esp, [ebx]
jae 0x4171aa
lds esp, [ebx]
pushal
xor bl, byte [ecx + 0x18]
fdiv dword [ebp - 0x5851a50]
jge 0x417164
invalid
mov dword [0x26f8f55], eax
rcr dword [eax], cl
insd dword es:[edi], dx
nop
pop esp
out dx, eax
sub ah, byte [ebx]
sub dword [edx - 0x42], 0xb14e7b5c
cmc
dec ebp
lock xor esp, dword [ecx]
sub dword [edi + 0x6c6fd6d], 0x63
arpl word [ebx], bx
arpl word [ebx + 0x1b], sp
lahf
pop edx
xchg edx, eax
add edi, ebx
jbe 0x41722e
push edi
xchg dword [edi], ebx
pop ebx
imul ebx, dword [edi - 0x7e5b881e], 0xffffffac
xor al, 0x89
mov cl, 2
in eax, dx
and ch, bh
invalid
lahf
loop 0x417280
movsb byte es:[edi], byte [esi]
sub dword [esp + esi - 0x12fd4e77], 0xf58efd20
jno 0x4171f5
xor al, 1
mov bh, 0xdf
cmp byte [ebx], ah
pop esp
push cs
insd dword es:[edi], dx
wait
test eax, 0x44ede88d
mov dword [ecx], edx
mov ecx, 0x5002a10c
adc dword [ecx + 0x5002a10c], edi
or esp, edx
loope 0x417206
aam 0xf
and ebx, dword [edx + 2]
les edi, [ebp + ebp*4 - 0x7ca4773c]
movq mm4, mm2
mov al, byte [0x1f871f3]
or edi, 0xc42a1caf
lodsb al, byte [esi]
test al, 0xc6
add eax, 0x7e6ba0f8
push ebx
inc ebx
mov dr3, edx
add al, ah
mov esp, 0x5b88c4ad
or dword [edi], 0x6f
loop 0x4171e1
jno 0x41723c
add dword [ecx + 0x2a1cafcf], eax
les ebp, [eax + ebp*4 - 0x5f07fa3a]
imul edi, dword [esi + 0x53], 0x43
jno 0x417228
out dx, eax
movsd dword es:[edi], dword [esi]
adc byte [ebx - 0x2da1fa79], bl
and bl, byte [ebx - 0x792fb104]
arpl ax, sp
pop es
sar byte [esi - 0x2e62f5c2], cl
test byte [ecx + 0x4edf5651], 7
dec ebp
out dx, eax
add byte [ebp - 0x21699281], ch
in al, dx
in al, dx
invalid
mov cl, 0xe3
call 0xdb56410e
das
wait
mov esp, 0x260aa24e
mov dword [0xa6b4fb74], eax
shl ebp, cl
test eax, 0x91ebc5fa
retf
Function at 0x44d755
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x44d7a1
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x44d786
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x44d796
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x44d7b1
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x44d7f0
test ebx, ebx
je 0x44d7c5
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x44d7ba
cmp ecx, 0xfff1
jb 0x44d7d3
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x44d8db
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x44d815
Function at 0x4e2795
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e27e1
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e27c6
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e27d6
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e27f1
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e2830
test ebx, ebx
je 0x4e2805
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e27fa
cmp ecx, 0xfff1
jb 0x4e2813
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e291b
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e2855
Function at 0x501ca5
Capabilities:
Encode data using xor

Disassembly:
pop eax
std
cmpsd dword [esi], dword es:[edi]
in eax, dx
out 0xe3, al
ret 0xe717
loop 0x501c8e
xor eax, 0x93eebac7
mov dword [0xee0ebb3c], eax
popal
and dl, 0x52
mov ebp, 0x9fd15312
push edi
mov ecx, ds
dec ebp
movsd dword es:[edi], dword [esi]
inc esi
and edx, eax
push ss
add edx, dword [edx + 0x4c]
add dl, byte [esi + 0x3a520a3f]
jbe 0x501d0c
mov eax, dword [0x1fecaac6]
xor esp, edx
neg byte [esi + 0x5c4df955]
sahf
push ebp
stc
dec ebp
pop esp
dec edi
adc ch, byte [ebx + 0x67efd35f]
test eax, 0x58cd93b3
xor al, 0x30
push esi
bound esp, qword [esi - 0x5d]
loop 0x501cd8
fcomp dword [esi]
outsd dx, dword [esi]
add dh, byte [esi - 0x6f]
out 0x93, al
xchg edi, eax
std
xor al, 0xc8
ljmp 0x6e61:0x869d22a6
stosd dword es:[edi], eax
test eax, 0x94f4d7a1
call 0x823ec725
sal esp, 0x35
add dword [eax + 0x55], ebp
shr byte [eax + 0x3d5b4d4c], cl
adc byte [ebx], 0x69
or al, 0xb6
mov dl, 0xaa
add dword [ecx + 0x47], esp
jae 0x501d9b
aam 0x20
imul eax, ecx, 0xffffffa7
insd dword es:[edi], dx
inc ecx
popal
xchg ecx, eax
and ah, byte [eax + 1]
push edi
sub esp, ebx
add eax, 0xd9b49bda
add eax, 0xd9b49bda
mov ebp, 0xb303ffa2
loop 0x501cfe
test dword es:[ebp + 0x49293de2], esi
sub edx, 0xa7ba7aed
fcmovu st(0), st(5)
mov byte [0x1ffe5812], al
enter 0x4b3a, 0xffffffffffffffd8
dec ecx
stosb byte es:[edi], al
jecxz 0x501d41
or byte [edi], bh
lds esi, [bx]
dec edx
xchg ebx, eax
invalid
cmp eax, 0xc94a3307
xor ecx, dword [edx - 0x37]
cmc
insd dword es:[edi], dx
cmc
xchg ebp, esi
pop ss
invalid
invalid
mov ebx, 0xf5285d0c
in eax, 0xd3
or ebp, edi
adc eax, 0xefa00837
into
sub byte [ebx], dl
mov es, word [esi]
aaa
mov edx, 0xfd488346
pushfd
pop esi
sub edx, 0x46ae830f
pop ecx
enter 0xf81, 0x31
xor dword cs:[ecx + 0x68b3722c], esi
add byte [0x225e573], ch
jb 0x501d82
adc cl, 0xb8
mov dh, 0xa6
in eax, dx
in eax, 0xe9
movsd dword es:[edi], dword [esi]
cmp edi, ebx
or eax, 0xe2416cb2
inc ecx
push edi
jnp 0x501d95
jle 0x501e31
outsb dx, byte [esi]
xchg edx, eax
jecxz 0x501de9
inc dl
cmp esp, dword [eax + 0x2262e967]
fmul st(7), st(0)
adc dl, byte [ebx]
dec edi
and byte [edi], dl
jl 0x501d84
sbb al, 0xe8
adc dword [esi], 0x3f
pushfd
js 0x501de7
popal
mov eax, 0xb2039268
sbb al, 0x3d
or cl, dl
test eax, 0x17ae0851
jns 0x501dfa
jge 0x501e8b
or eax, 0x34425a88
push ds
into
xor eax, dword [edx]
inc ebx
adc dword [edx + 0x744768f1], esp
inc ecx
sar dword [esp + 0x24], cl
push eax
adc al, al
dec ebp
mov esp, 0xd91238d
cmp eax, 0x76d8d72
fcmovnbe st(0), st(3)
fisubr word [edi]
pop edi
pop esp
invalid
xchg esi, eax
push ebx
cmp eax, eax
cmp byte [edi + edx*8 - 0x45], dl
push esi
xchg ebx, eax
pushfd
hlt
Function at 0x54c815
Capabilities:
Encode data using xor

Disassembly:
rcr dword [edi], 0x3b
xor byte [ebx], cl
lcall 0x989, 0xa95a4e61
aas
test byte [ebx + 0x5d], al
jae 0x54c85e
stosb byte es:[edi], al
xchg edi, eax
sar bl, 0x92
fadd dword [ebp - 0x54]
cmp al, 0xaa
sub dword [ecx*4 + 0x339937b0], ebx
sbb dword [ebx], ecx
push esi
push ebx
jge 0x54c858
push cs
pop ebp
sahf
sbb esp, dword [ebp + 0x37783f49]
js 0x54c84e
js 0x54c84e
sahf
out 0x92, eax
test esi, edi
idiv dword [eax + 0x16]
clc
push ds
scasb al, byte es:[edi]
daa
dec ebx
aaa
or dword [ebx - 0x25], edi
or dh, byte [edx + 0x26]
outsb dx, byte [esi]
stosd dword es:[edi], eax
invalid
pop edx
inc edi
inc edi
fimul word [edi + eax*4]
bound ecx, qword [ecx]
cmpsd dword [esi], dword es:[edi]
test ah, dh
test ah, dh
hlt
jns 0x54c7e3
push ss
sub dword [esi + 0x73a7a4df], ecx
in al, dx
mov ds, edi
movsb byte es:[edi], byte [esi]
cmpsd dword [esi], dword es:[edi]
jae 0x54c850
jecxz 0x54c89f
cmp ebx, edx
xor al, 0xb3
sal dword [ebx + esi*4], cl
mov dword [0x84c86b4d], eax
arpl word [eax - 0x6e], dx
xchg edx, eax
jp 0x54c859
sbb ah, ch
cwde
pushal
jbe 0x54c865
invalid
push eax
int 0xa0
sbb dword [edx], esp
pop esp
cmp byte [edx - 0x2d], dh
pop ecx
movsd dword es:[edi], dword [esi]
push cs
jnp 0x54c870
push edx
add cl, byte [ebx + 0x6df75283]
nop
ret 0x4f57
Function at 0x596f65
Capabilities:
Encode data using xor

Disassembly:
ror al, cl
dec ebp
or eax, 0x31d71fc3
aam 0xa7
dec esp
invalid
Function at 0x657d0d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x661378
cmp edx, dword [eax]
je 0x657d2f
add eax, 8
inc ecx
cmp eax, 0x661408
jl 0x657d20
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x661378]
jne 0x657e5d
mov eax, dword [0xa66ce0]
cmp eax, 1
je 0x657e37
test eax, eax
jne 0x657d60
cmp dword [0x6612a4], 1
je 0x657e37
cmp edx, 0xfc
je 0x657e5d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x657d97
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.006586f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00658b80
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x657dda
lea eax, [ebp - 0x1a4]
push eax
call fcn.00658b80
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65dbec
push edi
call fcn.0065aa50
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.006586f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00658700
lea eax, [ebp - 0xa0]
push 0x65dbcc
push eax
call fcn.00658700
push dword [esi + 0x66137c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00658700
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0065a9c4
add esp, 0x2c
pop edi
jmp 0x657e5d
lea eax, [ebp + 8]
lea esi, [esi + 0x66137c]
push 0
push eax
push dword [esi]
call fcn.00658b80
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x421920
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1a000]
push edi
or ebp, 0xffffffff
jmp 0x421942
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x421949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x421938
mov eax, 1
add ebx, ebx
jne 0x42195b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x421950
jne 0x42196c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x421950
xor ecx, ecx
sub eax, 3
jb 0x421980
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4219f2
mov ebp, eax
add ebx, ebx
jne 0x42198b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x421998
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x4219bc
inc ecx
add ebx, ebx
jne 0x4219a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x42199d
jne 0x4219b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x42199d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4219dc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4219cd
jmp 0x42193e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4219dc
add edi, ecx
jmp 0x42193e
pop esi
mov edi, esi
mov ecx, 0x525
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4219fa
cmp byte [edi], 4
jne 0x4219fa
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x4219ff
lea edi, [esi + 0x1f000]
mov eax, dword [edi]
or eax, eax
je 0x421a77
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x22984]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x22a24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x421a2c
mov ecx, edi
jns 0x421a5b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x22a28]
or eax, eax
je 0x421a71
mov dword [ebx], eax
add ebx, 4
jmp 0x421a49
call dword [esi + 0x22a2c]
popal
jmp section.UPX0
Function at 0x40324c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404ab8
test esi, esi
jne 0x403282
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404ba8
jmp 0x4032a0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00403150
mov edi, eax
test esi, esi
je 0x4032a0
cmp dword [ebx], 0
je 0x4032a0
dec esi
jmp 0x403289
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x4039b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47d020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403a48
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403a28
xor eax, eax
push ebp
push 0x403a21
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403a64
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403a28
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x47d020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47d020], ax
mov esp, ebp
pop ebp
ret

Function at 0x404864
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x480048], 0
je 0x4048c5
cmp word [0x48021c], 0xd7b2
jne 0x40488d
cmp dword [0x480224], 0
jbe 0x40488d
mov eax, 0x480218
call dword [0x480234]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4048ec
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47d02c], 0
jne 0x4048e1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x404a3c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x47d030], 0
je 0x404a62
mov edx, esi
mov eax, ebx
call dword [0x47d030]
jmp 0x404a71
mov eax, 8
call fcn.00402e60
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x480049], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x404a04
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc