joyce8/EMBER2024-capa huggingface dataset:
Function at 0x783a1294
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x783a9a61
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x783c8018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5186
xor edi, edi
cmp dword [esi], edi
mov ebx, eax
je 0x783a1315
push 2
lea eax, [esp + 0x18]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp word [esp + 0x14], di
mov ecx, dword [ebp + 0x14]
jne 0x783a1308
push dword [ebp + 0x10]
call sym.MFC80U.DLL_Ordinal_3933
test eax, eax
je 0x783a1311
mov ecx, dword [ebp + 0x14]
push 1
push dword [ebp + 0x10]
call sym.MFC80U.DLL_Ordinal_5823
jmp 0x783a1373
push edi
push dword [ebp + 0x10]
call sym.MFC80U.DLL_Ordinal_5823
xor eax, eax
jmp 0x783a1376
mov esi, dword [ebp + 0x14]
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_3960
test eax, eax
je 0x783a1363
push dword [ebp + 0x10]
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_3932
test eax, eax
jne 0x783a1363
cmp dword [esi + 0xe4], edi
je 0x783a1311
push 0xf29d
lea ecx, [esp + 0x1c]
call sym.MFC80U.DLL_Ordinal_283
mov dword [esp + 0x28], edi
push dword [esp + 0x18]
push ebx
call sym.MFC80U.DLL_Ordinal_1164
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
call fcn.78303c47
jmp 0x783a1373
lea eax, [esp + 0x14]
push eax
push ebx
mov word [esp + 0x1c], di
call sym.MFC80U.DLL_Ordinal_1164
xor eax, eax
inc eax
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x783a145d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x783ad77c
mov eax, dword fs:[0]
push eax
push ecx
push ecx
push ebx
push esi
push edi
mov eax, dword [0x783c8018]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5186
cmp dword [esi], 0
mov ebx, eax
je 0x783a14fa
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
mov edi, eax
mov eax, dword [esi]
mov eax, dword [eax - 8]
cmp edi, eax
jle 0x783a14ba
push eax
push dword [ebp + 8]
call sym.MFC80U.DLL_Ordinal_1054
lea eax, [edi + 1]
push eax
push 0
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5190
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5398
test edi, edi
mov ecx, dword [ebp + 0x14]
jne 0x783a14f0
push esi
call sym.MFC80U.DLL_Ordinal_3933
test eax, eax
je 0x783a153f
mov ecx, dword [ebp + 0x14]
push 1
jmp 0x783a14f2
push 0
push esi
call sym.MFC80U.DLL_Ordinal_5823
jmp 0x783a153f
mov eax, dword [ebp + 0x14]
cmp dword [eax + 0xe4], 0
je 0x783a1534
push 0xf29d
lea ecx, [esp + 0x14]
call sym.MFC80U.DLL_Ordinal_283
mov dword [esp + 0x20], 1
push dword [esp + 0x10]
push ebx
call sym.MFC80U.DLL_Ordinal_1164
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.78303c47
jmp 0x783a153f
mov eax, dword [ebp + 0x10]
push dword [eax]
push ebx
call sym.MFC80U.DLL_Ordinal_1164
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x783a1554
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x783a9a3e
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x783c8018]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5186
cmp dword [esi], 0
mov edi, eax
je 0x783a15c3
push dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
push esi
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
mov ecx, dword [ebp + 0x18]
jne 0x783a15b9
push esi
call sym.MFC80U.DLL_Ordinal_3933
test eax, eax
je 0x783a1603
mov ecx, dword [ebp + 0x18]
push 1
jmp 0x783a15bb
push 0
push esi
call sym.MFC80U.DLL_Ordinal_5823
jmp 0x783a1603
mov eax, dword [ebp + 0x18]
cmp dword [eax + 0xe4], 0
je 0x783a15fa
push 0xf29d
lea ecx, [esp + 0x14]
call sym.MFC80U.DLL_Ordinal_283
and dword [esp + 0x20], 0
push dword [esp + 0x10]
push edi
call sym.MFC80U.DLL_Ordinal_1164
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
call fcn.78303c47
jmp 0x783a1603
push dword [ebp + 0x10]
push edi
call sym.MFC80U.DLL_Ordinal_1164
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x783a17e8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x783ad759
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x783c8018]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push dword [ebp + 0xc]
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5185
xor ebx, ebx
cmp dword [esi], ebx
mov edi, eax
mov dword [esp + 0x18], edi
je 0x783a18fa
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, eax
cmp esi, 0xffffffff
je 0x783a18b3
push 0x783c8d10
lea ecx, [esp + 0x18]
call sym.MFC80U.DLL_Ordinal_269
lea eax, [esi + 1]
push eax
push esi
lea ecx, [esp + 0x1c]
mov dword [esp + 0x30], ebx
call sym.MFC80U.DLL_Ordinal_5190
push eax
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindowTextW]
call edi
push 0xffffffffffffffff
lea ecx, [esp + 0x18]
call sym.MFC80U.DLL_Ordinal_5398
mov esi, dword [ebp + 0x10]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esi]
mov eax, dword [ebx - 0xc]
mov ecx, dword [ecx - 8]
cmp eax, ecx
jle 0x783a1890
push ecx
push dword [ebp + 8]
call sym.MFC80U.DLL_Ordinal_1054
inc eax
push eax
push 0
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5190
push eax
push dword [esp + 0x20]
call edi
or dword [esp + 0x28], 0xffffffff
lea eax, [ebx - 0x10]
call fcn.78303c47
xor ebx, ebx
jmp 0x783a18cd
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
mov eax, dword [eax - 8]
inc eax
push eax
push ebx
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5190
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call sym.MFC80U.DLL_Ordinal_5398
mov eax, dword [esi]
cmp dword [eax - 0xc], ebx
mov ecx, dword [ebp + 0x14]
jne 0x783a18f1
push esi
call sym.MFC80U.DLL_Ordinal_3933
test eax, eax
je 0x783a1944
mov ecx, dword [ebp + 0x14]
push 1
jmp 0x783a18f2
push ebx
push esi
call sym.MFC80U.DLL_Ordinal_5823
jmp 0x783a1944
mov ecx, dword [ebp + 0x14]
call sym.MFC80U.DLL_Ordinal_3960
test eax, eax
je 0x783a1935
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
push esi
call sym.MFC80U.DLL_Ordinal_3932
test eax, eax
jne 0x783a1935
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x783a1944
push dword [esi]
push edi
call sym.MFC80U.DLL_Ordinal_1164
jmp 0x783a1944
push ebx
push 0xffffffffffffffff
push 0x14e
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x783a2863
Capabilities:
Get graphical window text

Disassembly:
push 0xc
mov eax, 0x783ae529
call fcn.783a76f8
mov ebx, dword [ebp + 8]
xor eax, eax
xor edi, edi
cmp ebx, edi
setne al
cmp eax, edi
jne 0x783a2884
call sym.MFC80U.DLL_Ordinal_1176
fldz
push dword [ebp + 0xc]
mov ecx, ebx
fstp qword [ebp - 0x18]
mov dword [ebp - 0x10], edi
call sym.MFC80U.DLL_Ordinal_5186
mov ecx, dword [ebx + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call sym.MFC80U.DLL_Ordinal_2652
cmp dword [ebx], edi
je 0x783a293b
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push 0x783c8d10
lea ecx, [ebp + 0xc]
mov esi, eax
call sym.MFC80U.DLL_Ordinal_269
lea eax, [esi + 1]
push eax
push esi
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], edi
call sym.MFC80U.DLL_Ordinal_2468
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
call sym.MFC80U.DLL_Ordinal_5398
push edi
push dword [ebp + 0xc]
lea esi, [ebp - 0x18]
call fcn.78365560
test al, al
jne 0x783a290d
push 0xffffffffffffffff
push edi
push 0xf11c
call sym.MFC80U.DLL_Ordinal_1117
mov ecx, ebx
call sym.MFC80U.DLL_Ordinal_2247
lea eax, [ebp - 0x18]
push eax
call fcn.783a1010
mov esi, dword [ebp + 0x10]
mov word [esi], ax
lea eax, [ebp - 0x18]
push eax
call fcn.783a0fed
mov word [esi + 2], ax
lea eax, [ebp - 0x18]
push eax
call fcn.783a0fca
mov word [esi + 4], ax
mov eax, dword [ebp + 0xc]
jmp 0x783a2978
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax + 4]
movzx edx, word [eax + 2]
movsx eax, word [eax]
push edi
push edi
push edi
push ecx
push edx
push eax
lea eax, [ebp - 0x18]
call fcn.78365339
lea eax, [ebp - 0x18]
push eax
lea esi, [ebp + 0x10]
call fcn.7836544b
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
push dword [ebp + 8]
call sym.MFC80U.DLL_Ordinal_1164
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.78303c47
call fcn.783a77d0
ret 0xc
Function at 0x783a2988
Capabilities:
Get graphical window text

Disassembly:
push 0xc
mov eax, 0x783ae529
call fcn.783a76f8
mov edi, dword [ebp + 8]
xor eax, eax
test edi, edi
setne al
test eax, eax
jne 0x783a29a7
call sym.MFC80U.DLL_Ordinal_1176
fldz
push dword [ebp + 0xc]
and dword [ebp - 0x10], 0
fstp qword [ebp - 0x18]
mov ecx, edi
call sym.MFC80U.DLL_Ordinal_5186
mov ecx, dword [edi + 4]
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
call sym.MFC80U.DLL_Ordinal_2652
cmp dword [edi], 0
je 0x783a2a63
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push 0x783c8d10
lea ecx, [ebp + 0xc]
mov esi, eax
call sym.MFC80U.DLL_Ordinal_269
and dword [ebp - 4], 0
lea eax, [esi + 1]
push eax
push esi
lea ecx, [ebp + 0xc]
call sym.MFC80U.DLL_Ordinal_2468
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
call sym.MFC80U.DLL_Ordinal_5398
push 1
push dword [ebp + 0xc]
lea esi, [ebp - 0x18]
call fcn.78365560
test al, al
jne 0x783a2a35
push 0xffffffffffffffff
push 0
push 0xf11b
call sym.MFC80U.DLL_Ordinal_1117
mov ecx, edi
call sym.MFC80U.DLL_Ordinal_2247
lea eax, [ebp - 0x18]
push eax
call fcn.783a0fa7
mov esi, dword [ebp + 0x10]
mov word [esi], ax
lea eax, [ebp - 0x18]
push eax
call fcn.783a0f84
mov word [esi + 2], ax
lea eax, [ebp - 0x18]
push eax
call fcn.783a0f61
mov word [esi + 4], ax
mov eax, dword [ebp + 0xc]
jmp 0x783a2aa6
mov eax, dword [ebp + 0x10]
movzx ecx, word [eax + 4]
movzx edx, word [eax + 2]
movzx eax, word [eax]
push ecx
push edx
push eax
push 0x1e
push 0xc
push 0x76b
lea eax, [ebp - 0x18]
call fcn.78365339
lea eax, [ebp - 0x18]
push eax
lea esi, [ebp + 0x10]
call fcn.7836544b
mov dword [ebp - 4], 1
push dword [ebp + 0x10]
push dword [ebp + 8]
call sym.MFC80U.DLL_Ordinal_1164
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.78303c47
call fcn.783a77d0
ret 0xc

Function at 0x783a505e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x783c8018]
jne 0x783a5068
repz ret
jmp fcn.783a5613

Function at 0x783a5a34
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push 0x782e3560
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x783a5a8c
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x782f9bb0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x783a5a7f
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x783a5a8e
xor eax, eax
pop esi
leave
ret 4
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x44c41801
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
mov eax, section..reloc
mov ebx, 0x42f3f8
nop
mov ecx, 0x560500d5
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x10003c08
Capabilities:
Accept command line arguments
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002b554
push 0x10022660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], 0
mov eax, 1
test eax, eax
je 0x10003c9d
mov ecx, dword [ebp - 0x1c]
mov dl, byte [ecx]
mov byte [ebp - 0x24], dl
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
test ecx, ecx
jne 0x10003c6e
jmp 0x10003c9d
mov edx, dword [ebp - 0x20]
shr edx, 0x15
mov eax, dword [ebp - 0x20]
shl eax, 0xb
or edx, eax
mov dword [ebp - 0x20], edx
mov ecx, dword [ebp - 0x24]
and ecx, 0xff
mov edx, dword [ebp - 0x20]
xor edx, ecx
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
xor eax, 0x2f1ea
mov dword [ebp - 0x20], eax
jmp 0x10003c45
cmp dword [ebp - 0x20], 0xff83723c
je 0x10003cec
cmp dword [ebp - 0x20], 0x75cdeec7
je 0x10003cec
cmp dword [ebp - 0x20], 0x389c9cc1
je 0x10003cec
cmp dword [ebp - 0x20], 0x8b092beb
je 0x10003cec
cmp dword [ebp - 0x20], 0x8b649be8
je 0x10003cec
cmp dword [ebp - 0x20], 0xab837249
je 0x10003cec
cmp dword [ebp - 0x20], 0xc62330ea
je 0x10003cec
cmp dword [ebp - 0x20], 0
je 0x10003cec
mov dword [0x100360f0], 0xd88f4676
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.100036fc
add esp, 4
push 0x1003e4f0
push 0x40
mov edx, dword [0x1002b3dc]
sub edx, dword [0x1002b4b0]
push edx
mov eax, dword [0x1002b4b0]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.10003a70
add esp, 8
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
invalid
retf
invalid
Function at 0x10004682
Capabilities:
Accept command line arguments

Disassembly:
and word [ebp - 0x100], ax
push 0xee
push eax
lea eax, [ebp - 0xfe]
push eax
call fcn.10004ddc
mov eax, dword [ebx + 0x30]
add esp, 0xc
test eax, eax
push 0x78
lea edi, [ebp - 0x100]
pop esi
jbe 0x100046f3
mov ecx, dword [ebx + 0x28]
test ecx, ecx
je 0x100046f3
push dword [ebx + 0x34]
push eax
push ecx
push 0x1001ee5c
mov eax, edi
push esi
push eax
call fcn.1000410c
add esp, 0x18
test eax, eax
jl 0x100046ee
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x100046d4
sub eax, edx
push 0x78
sar eax, 1
pop esi
sub esi, eax
lea edi, [ebp + eax*2 - 0x100]
and word [ebp - 0x12], 0
push esi
push edi
push dword [ebx + 0x14]
call fcn.10004398
cmp dword [ebx + 0x14], 0xc1311003
jne 0x10004791
push 0x1001beaa
push 0x78
pop esi
push esi
lea eax, [ebp - 0x100]
push eax
call fcn.1000458c
mov eax, dword [ebx + 0x18]
cmp eax, 0x80000003
je 0x1000477f
cmp eax, 0xc0000005
je 0x10004777
cmp eax, 0xc0000094
je 0x1000476f
cmp eax, 0xc00000fd
je 0x10004767
push eax
push 0x10006b3c
lea eax, [ebp - 0x150]
push 0x28
push eax
call fcn.1000410c
add esp, 0x10
and word [ebp - 0x102], 0
push esi
lea eax, [ebp - 0x150]
push eax
jmp 0x10004785
push esi
push 0x1001e157
jmp 0x10004785
push esi
push 0x10008075
jmp 0x10004785
push esi
push 0x10004a17
jmp 0x10004785
push esi
push 0x10009a89
lea eax, [ebp - 0x100]
push eax
call fcn.100045cc
xor edi, edi
cmp dword [ebx + 0x14], edi
jge 0x1000481d
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
jl 0x1000481d
mov eax, dword [ebp - 0x154]
mov esi, dword [eax]
lea eax, [ebp - 0x100]
push eax
call dword [fcn.10022600]
push eax
push dword [ebp - 0x154]
call dword [esi + 0x14]
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0xc]
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
lea edx, [ebp - 0x158]
push edx
push 0x1000dd3d
push eax
call dword [ecx]
mov eax, dword [ebp - 0x154]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [ebp - 0x158], edi
je 0x1000481d
push dword [ebp - 0x158]
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [ebp - 0x158]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebx + 0x28]
call fcn.10003e30
call fcn.10004d8c
ret
Function at 0x100065dc
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 0xc], 0x40
push edi
jne 0x100066cf
mov edi, dword [0x10022660]
push esi
call edi
cmp eax, 0xffffffff
pop ecx
je 0x10006629
push esi
call edi
cmp eax, 0xfffffffe
pop ecx
je 0x10006629
push ebx
push esi
call edi
mov ecx, dword [fcn.100222c0]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
pop ebx
jmp 0x1000662e
mov eax, dword [sym.imp.KERNEL32.dll_VirtualProtect]
test byte [eax + 4], 0x80
je 0x100066cf
xor edi, edi
inc edi
dec dword [esi + 4]
js 0x1000664a
mov ecx, dword [esi]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x10006651
push esi
call fcn.10005ad0
pop ecx
cmp eax, 0xffffffff
jne 0x1000665f
or ax, 0xffff
jmp 0x100066e8
mov byte [ebp - 4], al
movzx eax, al
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
pop ecx
je 0x100066a4
dec dword [esi + 4]
js 0x10006680
mov ecx, dword [esi]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x10006687
push esi
call fcn.10005ad0
pop ecx
cmp eax, 0xffffffff
jne 0x1000669e
movsx eax, byte [ebp - 4]
push esi
push eax
call fcn.1000e5a1
pop ecx
or ax, 0xffff
jmp 0x100066e7
push 2
mov byte [ebp - 3], al
pop edi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
call dword [pe_dos_header]
add esp, 0xc
cmp eax, 0xffffffff
jne 0x100066c9
call dword [pe_dos_header]
mov dword [eax], 0x2a
jmp 0x10006656
mov ax, word [ebp + 8]
jmp 0x100066e8
add dword [esi + 4], 0xfffffffe
js 0x100066e1
mov ecx, dword [esi]
movzx eax, word [ecx]
add ecx, 2
mov dword [esi], ecx
jmp 0x100066e8
push esi
call fcn.100068f4
pop ecx
pop edi
pop esi
leave
ret
Function at 0x10007a98
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
mov esi, ecx
jbe 0x10007b25
lea eax, [edi - 1]
test edi, eax
jne 0x10007b25
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x10007ac3
mov dword [ebp + 8], 1
mov ecx, dword [ebp + 8]
mov edx, dword [esi + 0x14]
mov eax, edx
sub eax, edi
sub eax, 4
cmp ecx, eax
ja 0x10007b49
cmp eax, edx
ja 0x10007b49
mov eax, dword [esi + 0xc]
push ebx
lea ebx, [edi - 1]
not ebx
lea eax, [edi + eax - 1]
and eax, ebx
add ecx, eax
lea edx, [ecx - 1]
cmp edx, dword [esi + 0x10]
jbe 0x10007b43
push dword [esi + 0x14]
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
mov ecx, dword [esi + 4]
mov dword [eax], ecx
mov edx, dword [esi + 0x14]
lea ecx, [eax + 4]
lea edx, [edx + eax - 1]
mov dword [esi + 4], eax
lea eax, [ecx + edi - 1]
and eax, ebx
cmp eax, ecx
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
jb 0x10007b25
mov ecx, dword [ebp + 8]
add ecx, eax
lea edi, [ecx - 1]
cmp edi, edx
jbe 0x10007b43
push dword [ebp + 4]
lea ecx, [ebp - 0x28]
push 0x80004005
call fcn.10004830
push 0x1000ecff
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.dll_GetCommandLineA
mov dword [esi + 0xc], ecx
pop ebx
jmp 0x10007b78
lea eax, [edi + 4]
cmp eax, 4
jb 0x10007b25
cmp eax, edi
jb 0x10007b25
lea edx, [eax + ecx]
cmp edx, eax
jb 0x10007b25
cmp edx, ecx
jb 0x10007b25
mov eax, dword [esi]
push edx
mov ecx, esi
call dword [eax]
mov ecx, dword [esi + 8]
mov dword [eax], ecx
mov dword [esi + 8], eax
lea eax, [eax + edi + 3]
dec edi
not edi
and eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x10009f0c
Capabilities:
Accept command line arguments

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x28
cmp eax, dword [ecx + 4]
jb 0x10009f3a
push dword [ebp + 4]
lea ecx, [ebp - 0x28]
push 0x80070057
call fcn.10004830
push 0x1000ecff
lea eax, [ebp - 0x28]
push eax
call sub.KERNEL32.dll_GetCommandLineA
mov ecx, dword [ecx]
lea eax, [ecx + eax*8]
leave
ret 4
Function at 0x6d2630
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x124000]
push edi
or ebp, 0xffffffff
jmp 0x6d2652
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6d2659
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d2648
mov eax, 1
add ebx, ebx
jne 0x6d266b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6d267c
jne 0x6d269b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d269b
dec eax
add ebx, ebx
jne 0x6d2688
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6d2660
add ebx, ebx
jne 0x6d2697
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6d26ed
xor ecx, ecx
sub eax, 3
jb 0x6d26b3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6d2722
sar eax, 1
mov ebp, eax
jmp 0x6d26be
add ebx, ebx
jne 0x6d26be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d268c
inc ecx
add ebx, ebx
jne 0x6d26cc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d268c
add ebx, ebx
jne 0x6d26d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6d26ce
jne 0x6d26ea
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6d26ce
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6d270c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6d26fe
jmp 0x6d264e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6d270c
add edi, ecx
jmp 0x6d264e
pop esi
mov edi, esi
mov ecx, 0x9798
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6d272a
cmp byte [edi], 0x28
jne 0x6d272a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6d272f
lea edi, [esi + 0x2cf000]
mov eax, dword [edi]
or eax, eax
je 0x6d279e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2d7f84]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2d808c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6d275c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2d8094]
or eax, eax
je 0x6d2798
mov dword [ebx], eax
add ebx, 4
jmp 0x6d2779
call dword [esi + 0x2d8090]
mov ebp, dword [esi + 0x2d8098]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6d27d2
sub esp, 0xffffff80
jmp 0x518d94