joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41a9ff
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0xdb8624]
xor eax, esp
push eax
lea eax, [esp + 0x3c]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x38]
call dword [0x41f4e4]
mov ecx, eax
call dword [0x41f4e8]
push str.Downloader::FileError
mov ecx, eax
mov dword [esp + 0x48], ebx
call dword [0x41f4ec]
or edi, 0xffffffff
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], edi
call dword [0x41f4f0]
mov eax, dword [esp + 0x4c]
cmp eax, 0xcc
ja case.0x4019fc.5
movzx ecx, byte [eax + 0x401bac]
jmp dword [ecx*4 + 0x401b98]
mov ebx, 1
push ebx
push 0xa
push eax
lea edx, [esp + 0x20]
push edx
call dword [0x41f4f8]
push eax
lea eax, [esp + 0x60]
push str.Networking_error__
push eax
mov dword [esp + 0x60], ebx
call fcn.00401750
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x41ff40
push eax
push ecx
mov byte [esp + 0x58], 2
call fcn.00401070
add esp, 0xc
mov ecx, esi
call fcn.004186d0
lea ecx, [esp + 0x4c]
mov byte [esp + 0x44], bl
call dword [0x41f508]
lea ecx, [esp + 0x14]
jmp 0x401b77
push 1
push ecx
mov dword [esp + 0x54], esp
mov edi, esp
push 0x11
push str.Password_required
call dword [0x41f438]
add esp, 8
mov ecx, esi
mov dword [edi], eax
call fcn.004186d0
mov ecx, esi
call fcn.004185c0
mov ecx, dword [esi + 0x2c]
mov edi, dword [0x41f3d4]
mov byte [esi + 0xc], bl
call edi
mov ecx, dword [esi + 0x30]
call edi
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret 4
push 1
push 0xa
push eax
lea edx, [esp + 0x28]
push edx
call dword [0x41f4f8]
push eax
lea eax, [esp + 0x2c]
push str.Proxy_error__
mov ebx, 3
push eax
mov dword [esp + 0x60], ebx
call fcn.00401750
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x41ff40
push eax
push ecx
mov byte [esp + 0x58], 4
call fcn.00401070
add esp, 0xc
mov ecx, esi
call fcn.004186d0
lea ecx, [esp + 0x18]
mov byte [esp + 0x44], bl
call dword [0x41f508]
lea ecx, [esp + 0x1c]
jmp 0x401b77
push 1
push 0xa
push eax
lea edx, [esp + 0x30]
push edx
call dword [0x41f4f8]
push eax
lea eax, [esp + 0x34]
push str.Server_error__
mov ebx, 5
push eax
mov dword [esp + 0x60], ebx
call fcn.00401750
add esp, 0x14
mov ecx, esp
mov dword [esp + 0x18], esp
push 0x41ff40
push eax
push ecx
mov byte [esp + 0x58], 6
call fcn.00401070
add esp, 0xc
mov ecx, esi
call fcn.004186d0
lea ecx, [esp + 0x20]
mov byte [esp + 0x44], bl
call dword [0x41f508]
lea ecx, [esp + 0x24]
mov dword [esp + 0x44], edi
call dword [0x41f508]
mov ecx, dword [esp + 0x3c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x38
ret 4
Function at 0x401d50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41aa29
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0xdb8624]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
mov esi, ecx
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x30]
call dword [0x41f4e4]
mov ecx, eax
call dword [0x41f4e8]
push 0x41ff80
mov ecx, eax
mov dword [esp + 0x40], ebx
call dword [0x41f4ec]
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0xffffffff
call dword [0x41f4f0]
mov edx, dword [0x41f4d0]
mov ecx, dword [0x41f4c8]
mov edi, dword [0x41f4d8]
push edx
mov edx, dword [esi + 0x40]
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ecx
push esi
lea ecx, [esp + 0x20]
push ecx
push edx
mov dword [esp + 0x24], 0x4018f0
call edi
mov ecx, dword [0x41f5dc]
mov eax, dword [0x41f5d4]
push ecx
mov ecx, dword [esi + 0x40]
lea edx, [esp + 0x30]
push edx
mov dword [esp + 0x38], eax
push esi
lea eax, [esp + 0x3c]
push eax
push ecx
mov dword [esp + 0x40], fcn.00401980
call edi
mov ecx, dword [esp + 0x6c]
add esp, 0x28
call dword [0x41f4cc]
mov dword [esi + 0x14], ebx
mov dword [esi + 0x10], ebx
cmp byte [esi + 0xc], bl
je 0x401e66
mov ecx, dword [esi + 0x2c]
mov byte [esi + 0xc], bl
call dword [0x41f3d4]
mov ecx, dword [esi + 0x24]
mov edx, dword [ecx]
mov eax, dword [edx + 0x34]
call eax
mov ecx, dword [esi + 0x24]
cmp ecx, ebx
je 0x401e4e
mov edx, dword [ecx]
mov eax, dword [edx + 0xc]
push 1
call eax
push ecx
lea edx, [esi + 0x3c]
mov ecx, esp
mov dword [esp + 0x48], esp
push edx
call dword [0x41f4fc]
mov ecx, esi
call fcn.00418620
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x30
ret 4
Function at 0x4155f0
Capabilities:
Encode data using xor

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor ecx, ecx
mov word [esp + 4], 0xcdfb
mov byte [esp + 6], 0xac
test edi, edi
jle 0x41562d
push esi
mov esi, dword [esp + 0x10]
lea ecx, [ecx]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
lea eax, [edx + edx*2]
mov edx, ecx
sub edx, eax
mov al, byte [esp + edx + 8]
xor byte [ecx + esi], al
inc ecx
cmp ecx, edi
jl 0x415610
pop esi
pop edi
pop ecx
ret

Function at 0x415650
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41da95
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0xdb8624]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
call dword [0x41f4b8]
mov esi, dword [esp + 0x30]
mov ecx, esi
mov dword [esp + 0x24], 1
call dword [0x41f3d8]
test al, al
je 0x415731
push ecx
mov eax, esp
mov dword [eax], 1
mov eax, dword [esi]
mov edx, dword [eax + 0x30]
mov ecx, esi
mov dword [esp + 0x18], esp
call edx
test al, al
je 0x415731
mov eax, dword [esi]
mov edx, dword [eax + 0x3c]
mov ecx, esi
call edx
xor edi, edi
mov ecx, 0xa00000
test edx, edx
jg 0x4156db
jl 0x4156d7
cmp eax, ecx
jae 0x4156db
mov ecx, eax
mov edi, edx
push edi
push ecx
lea eax, [esp + 0x18]
push eax
mov ecx, esi
call dword [0x41f3a4]
push 1
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
mov byte [esp + 0x30], 2
call dword [0x41f3a0]
add esp, 0xc
push eax
lea ecx, [esp + 0x10]
call dword [0x41f39c]
lea ecx, [esp + 0x14]
call dword [0x41f418]
mov eax, dword [esi]
mov edx, dword [eax + 0x34]
mov ecx, esi
call edx
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 1
call dword [0x41f418]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
call dword [0x41f398]
mov ecx, eax
mov byte [esp + 0x24], 3
call dword [0x41f394]
test eax, eax
je 0x415761
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x415756
sub ecx, esi
jmp 0x415764
or ecx, 0xffffffff
push ecx
push eax
call dword [0x41f438]
mov esi, dword [esp + 0x34]
add esp, 8
mov dword [esi], eax
lea ecx, [esp + 0x14]
mov dword [esp + 0x18], 1
mov byte [esp + 0x24], 1
call dword [0x41f418]
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 0
call dword [0x41f418]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret
Function at 0x418390
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41e06c
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
push edi
mov eax, dword [0xdb8624]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
push ecx
mov eax, esp
mov dword [esp + 0x18], esp
mov dword [eax], 0
mov eax, dword [esp + 0x30]
push eax
call dword [0x41f854]
push 0x24
mov dword [esp + 0x28], 0
mov dword [esi], 0x424b1c
mov dword [esi + 8], 0x424afc
call fcn.00419d10
add esp, 4
lea ecx, [esi + 0x1c]
mov dword [esi + 0x18], eax
call dword [0x41f408]
lea ecx, [esi + 0x20]
call dword [0x41f408]
mov ecx, dword [esi + 0x18]
push esi
mov byte [esp + 0x28], 2
call fcn.00417a40
push ecx
mov eax, esp
mov ecx, esi
mov dword [esp + 0x30], esp
mov dword [eax], 0x800
call dword [0x41f810]
mov edi, dword [0x41f438]
push 0x2c
push 0x423bec
call edi
mov dword [esp + 0x34], eax
lea ecx, [esp + 0x34]
push ecx
mov byte [esp + 0x30], 3
call dword [0x41f570]
add esp, 0xc
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 2
call dword [0x41f508]
push 6
push 0x423b78
call edi
add esp, 8
mov dword [esp + 0x2c], eax
push 0
push 1
push 9
lea edx, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
mov byte [esp + 0x34], 4
call dword [0x41f56c]
lea ecx, [esp + 0x2c]
mov byte [esp + 0x24], 6
call dword [0x41f508]
push 0x4b
lea ecx, [esp + 0x18]
call dword [0x41f538]
mov ecx, dword [esi + 0x18]
mov ecx, dword [ecx + 0x1c]
mov edi, dword [0x41fbec]
lea eax, [esp + 0x14]
push eax
call edi
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 8]
lea edx, [esp + 0x14]
push edx
call edi
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx]
call edi
mov ecx, dword [esi + 0x18]
mov ecx, dword [ecx + 0x20]
lea eax, [esp + 0x14]
push eax
call edi
mov eax, dword [esi + 0x18]
mov ecx, dword [eax + 0x18]
lea edx, [esp + 0x14]
push edx
call edi
mov edx, dword [esi + 0x18]
lea ecx, [esp + 0x14]
push ecx
mov ecx, dword [edx + 4]
call edi
mov ecx, dword [esi + 0x18]
mov ecx, dword [ecx + 0x14]
lea eax, [esp + 0x14]
push eax
call edi
mov edx, dword [esi + 0x18]
mov eax, dword [edx + 4]
push 0
push 0x424258
push esi
push 0x424264
push eax
lea ecx, [esp + 0x20]
push ecx
call dword [0x41f34c]
add esp, 0x18
lea ecx, [esp + 0xc]
call dword [0x41f47c]
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 2
call dword [0x41f524]
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x1c
ret 4
Function at 0x401410
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x402408
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x426028]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x426028]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
cmp dword [ebp + 8], 2
mov edi, dword [ebp + 0xc]
jge 0x401487
push str.Parameter_fehlen
call dword [sym.imp.MSVCR110.dll_printf]
mov eax, dword [sym.imp.BugDogDLL.dll_bool_CDebLogManager::m_bIsOn]
add esp, 4
cmp byte [eax], 0
je 0x40159b
push str.Params_wrong
push 0x1194
push str.main
push 0x29
call dword [sym.imp.BugDogDLL.dll_void___cdecl_DebLog2Channel2_long_int__char_const___long_int__char_const__]
jmp 0x401598
mov edx, dword [edi + 4]
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
cmp byte [edx], 0
jne 0x4014a8
xor ecx, ecx
jmp 0x4014b9
mov ecx, edx
lea esi, [ecx + 1]
lea ecx, [ecx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4014b0
sub ecx, esi
push ecx
push edx
lea ecx, [esp + 0x18]
call fcn.00401750
lea ecx, [esp + 0x10]
mov dword [esp + 0x38], 0
call fcn.00401270
mov dword [esp + 0x38], 0xffffffff
cmp dword [esp + 0x24], 0x10
jb 0x4014f1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR110.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, dword [sym.imp.BugDogDLL.dll_bool_CDebLogManager::m_bIsOn]
mov esi, dword [sym.imp.BugDogDLL.dll_void___cdecl_DebLog2Channel2_long_int__char_const___long_int__char_const__]
cmp byte [eax], 0
mov dword [esp + 0x24], 0xf
mov dword [esp + 0x20], 0
mov byte [esp + 0x10], 0
je 0x40152f
push dword [edi + 4]
push str.try_to_kill_itself_with_TerminateProcess___s_
push 0x1194
push str.main
push 0x34
call esi
add esp, 0x14
push dword [edi + 4]
mov edi, dword [sym.imp.MSVCR110.dll_printf]
push str.try_to_kill_itself_with_TerminateProcess___s__n
call edi
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [sym.imp.BugDogDLL.dll_bool_CDebLogManager::m_bIsOn]
cmp byte [eax], 0
je 0x401571
push str.after_ExitProcess_0_
push 0x1194
push str.main
push 0x37
call esi
add esp, 0x10
push str.Pre_Exit_n
call edi
mov eax, dword [sym.imp.BugDogDLL.dll_bool_CDebLogManager::m_bIsOn]
add esp, 4
cmp byte [eax], 0
je 0x40159b
push str.Pre_Exit
push 0x1194
push str.main
push 0x3e
call esi
add esp, 0x10
xor eax, eax
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.00401cb6
mov esp, ebp
pop ebp
ret
Function at 0x34a3700
Capabilities:
Decompress data using aplib

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov edi, dword [esp + 0x28]
cld
mov dl, 0x80
xor ebx, ebx
movsb byte es:[edi], byte [esi]
mov bl, 2
call fcn.034a378f
jae 0x34a370e
xor ecx, ecx
call fcn.034a378f
jae 0x34a373d
xor eax, eax
call fcn.034a378f
jae 0x34a374d
mov bl, 2
inc ecx
mov al, 0x10
call fcn.034a378f
adc al, al
jae 0x34a372f
jne 0x34a3779
stosb byte es:[edi], al
jmp 0x34a3711
call fcn.034a379b
sub ecx, ebx
jne 0x34a3756
call fcn.034a3799
jmp 0x34a3775
lodsb al, byte [esi]
shr eax, 1
je 0x34a3783
adc ecx, ecx
jmp 0x34a3772
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
call fcn.034a3799
cmp eax, 0x7d00
jae 0x34a3772
cmp ah, 5
jae 0x34a3773
cmp eax, 0x7f
ja 0x34a3774
inc ecx
inc ecx
xchg ebp, eax
mov eax, ebp
mov bl, 1
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x34a3711
sub edi, dword [esp + 0x28]
mov dword [esp + 0x1c], edi
popal
ret 8
Function at 0x1012475
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10015e0
call fcn.010127c8
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x10124b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10124b2
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x10124ca
cmp eax, 0x20b
je 0x10124b7
mov dword [ebp - 0x1c], ebx
jmp 0x10124de
cmp dword [ecx + 0x84], 0xe
jbe 0x10124b2
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x10124d8
cmp dword [ecx + 0x74], 0xe
jbe 0x10124b2
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1015010], 0xffffffff
or dword [0x1015014], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x101500c]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1015008]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1015018], eax
call fcn.010127c2
cmp dword [0x10149d0], ebx
jne 0x1012539
push fcn.010127c2
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.010127b0
push 0x1001234
push 0x1001230
call sub.msvcrt.dll__initterm
mov eax, dword [0x1015004]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x1015000]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x100122c
push 0x1001228
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x10125cf
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10125a3
cmp al, 0x22
jne 0x1012595
cmp byte [esi], 0x22
jne 0x10125ac
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x10125b6
cmp al, 0x20
jbe 0x10125a8
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x10125da
movzx eax, word [ebp - 0x48]
jmp 0x10125dd
cmp byte [esi], 0x20
jbe 0x10125ac
inc esi
mov dword [ebp - 0x34], esi
jmp 0x10125cf
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x10125fa
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x101262f
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01012801
ret

Function at 0x401288
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x401288
lcall 0x5de5, 0x8b10c483
jmp loc.00760634
Function at 0x421726
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
call fcn.005423e0
lea ebp, [0x72ab68]
push dword [ebp + 0x34]
mov ebx, 1
cmp ebx, dword [esp]
jne 0x421756
mov edx, str.http:__sdr.eladit.com_FDM_sw2_20Software_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
xor ebx, ebx
cmp ebx, dword [esp]
jne 0x421770
mov edx, str.http:__www.hdsdr.de
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0xc
cmp ebx, dword [esp]
jne 0x42178d
mov edx, str.http:__napan.ca_ghpsdr3_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0xa
cmp ebx, dword [esp]
jne 0x4217aa
mov edx, 0x6263a0
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0xb
cmp ebx, dword [esp]
jne 0x4217c7
mov edx, str.https:__github.com_TAPR_OpenHPSDR_PowerSDR_releases
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0xd
cmp ebx, dword [esp]
jne 0x4217e4
mov edx, str.http:__sdr_radio.com_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0xe
cmp ebx, dword [esp]
jne 0x421801
mov edx, str.http:__fyngyrz.com__p915
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0xf
cmp ebx, dword [esp]
jne 0x42181e
mov edx, str.http:__airspy.com_download_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0x10
cmp ebx, dword [esp]
je 0x421832
mov ebx, 0x11
cmp ebx, dword [esp]
jne 0x421842
mov edx, str.http:__www.sdrplay.com_downloads_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0x12
cmp ebx, dword [esp]
jne 0x42185c
mov edx, str.http:__www.icomamerica.com_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
mov ebx, 0x13
cmp ebx, dword [esp]
jne 0x421876
mov edx, str.http:__www.kenwood.com_
lea ecx, [esp + 4]
call fcn.004fa008
jmp 0x4218bd
push edx
call fcn.00542240
pop edx
push eax
mov edx, str.http:__www.winradio.com_home_download_
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
lea ebp, [0x72ab68]
push dword [ebp + 8]
call fcn.00540410
pop eax
mov edx, str..htm
push edx
call fcn.00542310
lea eax, [esp + 8]
push eax
call fcn.00542280
pop eax
push 5
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, str.open
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
push dword [esp]
call fcn.00542440
add esp, 4
pop ebx
pop ebp
ret
Function at 0x4340d5
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
push edi
xor eax, eax
push eax
push eax
call fcn.005423e0
push 0x50024
mov eax, str.Edit_antenna_file
push eax
mov eax, str.After_editing_and_saving_you_must_re_open_nthis_dialogue_to_make_changes_valid._n_nEdit_file_
push eax
lea ebp, [0x72a850]
push dword [ebp + 0x38]
call fcn.004780fe
mov ebx, eax
cmp ebx, 6
jne 0x43425e
lea ebp, [0x72a978]
push dword [ebp + 0x84]
call fcn.00522fa2
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x434130
jl 0x43412c
cmp ebx, 0
ja 0x434130
xor eax, eax
jmp 0x434135
mov eax, 1
or eax, eax
jne 0x434232
lea ebp, [0x72a978]
push dword [ebp + 0x84]
call fcn.00482439
mov dword [esp], eax
cmp dword [esp], 0
je 0x434218
push 2
push dword [esp + 4]
call fcn.00524270
push 2
mov eax, str._My_antennae__up_to_10__one_on_every_line_below__r_n
push eax
push dword [esp + 8]
call fcn.005244d0
push 2
mov eax, str._After_editing__re_open_the_recent_window_to_see_changes_r_n
push eax
push dword [esp + 8]
call fcn.005244d0
mov byte [esp + 4], 1
jmp 0x434198
mov eax, 0xa
cmp al, byte [esp + 4]
jl 0x43420e
push edx
call fcn.00542240
pop edx
push eax
push 2
push edx
call fcn.00542240
pop edx
push eax
mov edx, 0x6211c2
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
movsx eax, byte [esp + 0x18]
cdq
push edx
push eax
call fcn.0053f630
pop eax
mov edx, 0x63b57e
push edx
call fcn.00542310
call fcn.00542370
push dword [esp + 0xc]
call fcn.004fa482
add dword [esp + 4], edx
call fcn.005244d0
call fcn.004fa4e0
inc byte [esp + 4]
jno 0x434198
push dword [esp]
call fcn.00523a00
jmp 0x434232
lea ebp, [0x72a978]
push dword [ebp + 0x84]
lea ebp, [0x72a850]
push dword [ebp]
call fcn.004cf534
push 5
push 0
push 0
lea ebp, [0x72a978]
mov eax, dword [ebp + 0x84]
push eax
mov eax, str.open
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
add esp, 8
pop edi
pop ebx
pop ebp
ret
Function at 0x448b82
Capabilities:
Get graphical window text

Disassembly:
push ebp
push ebx
push edi
call fcn.005423e0
lea ebp, [0x72a908]
mov ebx, dword [ebp + 0x34]
cmp ebx, 1
jne 0x448bc6
lea ebp, [0x72a908]
mov dword [ebp + 0x34], 2
push 1
call fcn.005335a4
push 1
call sub.KERNEL32.dll_Sleep
lea ebp, [0x72a908]
mov ebx, dword [ebp + 0x34]
and ebx, ebx
jne 0x448ba5
push 0x1e6
call fcn.0052708f
mov ebx, eax
push 0x1e8
call fcn.0052708f
mov edi, eax
shl edi, 5
or ebx, edi
push 0x1e7
call fcn.0052708f
mov edi, eax
shl edi, 6
or ebx, edi
push 0x1e9
call fcn.0052708f
mov edi, eax
shl edi, 7
or ebx, edi
push ebx
lea ebp, [0x72b27c]
pop eax
mov dword [ebp + 0x3c], eax
mov ebx, dword [ebp + 0x3c]
push 0x1ea
call fcn.0052708f
mov edi, eax
shl edi, 8
or ebx, edi
push 0x1eb
call fcn.0052708f
mov edi, eax
shl edi, 9
or ebx, edi
push 0x1ec
call fcn.0052708f
mov edi, eax
shl edi, 0xa
or ebx, edi
push ebx
pop eax
mov dword [ebp + 0x3c], eax
mov ebx, dword [ebp + 0x3c]
push 0x1ed
call fcn.0052708f
mov edi, eax
shl edi, 0xb
or ebx, edi
push 0x1ee
call fcn.0052708f
mov edi, eax
shl edi, 0xc
or ebx, edi
push 0x1ef
call fcn.0052708f
mov edi, eax
shl edi, 0xd
or ebx, edi
push ebx
pop eax
mov dword [ebp + 0x3c], eax
push 6
call fcn.005338e3
push eax
pop eax
mov dword [ebp + 0x34], eax
push 6
call fcn.00533952
push eax
pop eax
mov dword [ebp + 0x38], eax
push 6
call fcn.0053300e
lea ebp, [0x72a850]
mov dword [ebp + 0x30], 0
push 0x1e2
call fcn.0053978f
push 0x1e3
call fcn.0053978f
lea ebp, [0x72b24c]
push dword [ebp + 0x1c]
call fcn.0041c195
lea ebp, [0x72b24c]
push dword [ebp + 0x20]
call fcn.0041c195
lea ebp, [0x72a850]
push dword [ebp]
push 1
push 6
push dword [ebp]
call sub.USER32.dll_SendMessageW
mov eax, 1
push eax
call fcn.0042dbd7
push 0
push 0x116
push 0
call fcn.0051f352
xor eax, eax
pop edi
pop ebx
pop ebp
ret
Function at 0x45c659
Capabilities:
Create process on windows

Disassembly:
push ebp
push ebx
xor eax, eax
push eax
push eax
push eax
call fcn.005423e0
lea ebp, [0x72abe8]
mov edx, dword [ebp + 0x164]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
lea eax, [esp + 0xc]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push 2
mov eax, 0x6201f4
push eax
mov eax, 0x641c1a
push eax
push dword [esp + 0x1c]
call fcn.0053f110
call fcn.004fa4e0
lea ebp, [0x72b240]
push dword [ebp]
push dword [esp + 0xc]
call fcn.0053f8e0
and eax, eax
je 0x45c754
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
mov eax, 0x6206d8
push eax
mov eax, 0x6206d8
push eax
push dword [esp + 0x18]
call fcn.0053f790
mov ebx, eax
inc ebx
push ebx
push dword [esp + 0x18]
call fcn.0053f490
lea eax, [esp + 8]
push eax
call fcn.00542280
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
lea ebp, [0x72b240]
push dword [ebp]
push 1
push dword [esp + 0x18]
call fcn.0053f490
mov edx, 0x61f59a
push edx
call fcn.00542310
mov edx, dword [esp + 8]
push edx
call fcn.00542310
lea eax, [esp + 0xc]
push eax
call fcn.00542280
call fcn.004c0eb0
and eax, eax
je 0x45c76c
mov edx, str.http:__www.bing.com_search_q
lea ecx, [esp]
call fcn.004fa008
jmp 0x45c779
mov edx, str.https:__www.google.com_search_q
lea ecx, [esp]
call fcn.004fa008
mov edx, dword [esp]
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542310
push edx
call fcn.00542240
pop edx
push eax
push edx
call fcn.00542240
pop edx
push eax
push 2
push dword [esp + 0x18]
call fcn.00521ff8
pop eax
lea eax, [esp + 4]
push eax
call fcn.00542280
push 0xa
push 0
push 0
mov eax, dword [esp + 0xc]
push eax
mov eax, str.open
push eax
push 0
call sub.SHELL32.dll_ShellExecuteW
xor eax, eax
push dword [esp]
call fcn.00542440
push dword [esp + 8]
call fcn.00542440
push dword [esp + 4]
call fcn.00542440
add esp, 0xc
pop ebx
pop ebp
ret
Function at 0x479d44
Capabilities:
Query or enumerate registry value

Disassembly:
xor eax, eax
push eax
push eax
push eax
call fcn.005423e0
mov edx, dword [esp + 0x14]
lea ecx, [esp]
call fcn.004fa000
mov dword [esp + 4], 4
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
push 0
push dword [esp + 0x10]
push dword [esp + 0x24]
call sub.ADVAPI32.dll_RegQueryValueExW
mov eax, dword [esp + 8]
jmp 0x479d8b
push dword [esp]
call fcn.00542440
add esp, 0xc
ret 8