joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402730
Capabilities:
Print debug messages

Disassembly:
mov dword [ecx], vtable.CCommsProcessor.0
jmp fcn.004186b7

Function at 0x40290b
Capabilities:
Resume thread

Disassembly:
push 4
mov eax, 0x41ed80
call fcn.0041de82
mov esi, ecx
mov dword [ebp - 0x10], esi
push dword [ebp + 0x30]
mov edi, dword [ebp + 0x20]
push dword [ebp + 0x2c]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push edi
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041743e
and dword [ebp - 4], 0
lea ecx, [esi + 0xf14]
mov dword [esi], vtable.CAB232CommsProcessor.0
call fcn.00417bf9
push str.Allen_Bradley_DF1
lea ecx, [esi + 0xd04]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc90.dll_Ordinal_820]
lea eax, [esi + 0x478]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x34]
push dword [ebp + 0x28]
mov dword [esi + 0x4d4], eax
mov eax, dword [ebp + 0x38]
push dword [ebp + 0x24]
mov ecx, esi
mov dword [esi + 0x474], edi
mov dword [esi + 0x4d8], eax
call fcn.00417427
mov eax, dword [esi + 0x18]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, esi
call fcn.0041df5a
ret 0x34
Function at 0x406c7a
Capabilities:
Print debug messages

Disassembly:
push 0x14
mov eax, 0x41f695
call fcn.0041de82
mov esi, ecx
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
xor ebx, ebx
push ebx
lea eax, [esi + 0x10]
push 0x2c
mov ecx, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], eax
mov dword [esi + 4], 1
call dword [sym.imp.mfc90.dll_Ordinal_2480]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
je 0x406def
push eax
lea edi, [eax + 1]
push ebx
lea eax, [ebp - 0x18]
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_4507]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call dword [sym.imp.mfc90.dll_Ordinal_601]
lea ebx, [esi + 8]
push ebx
push 0x424474
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call dword [sym.imp.MSVCR90.dll_sscanf]
fild dword [ebx]
mov eax, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x1c]
add esp, 0xc
fstp qword [eax]
add dword [ebp - 0x14], 8
mov dword [ebp - 0x18], 1
jmp 0x406ddb
cmp ebx, 0xffffffff
je 0x406de4
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_3178]
sub eax, edi
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_4507]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc90.dll_Ordinal_601]
push 0
push 0x2c
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_2480]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406d94
push ebx
push edi
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call dword [sym.imp.mfc90.dll_Ordinal_4507]
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call dword [sym.imp.mfc90.dll_Ordinal_817]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call dword [sym.imp.mfc90.dll_Ordinal_601]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x10]
push 0x424470
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call dword [sym.imp.MSVCR90.dll_sscanf]
add esp, 0xc
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x42446c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
inc dword [ebp - 0x18]
add dword [ebp - 0x14], 8
cmp dword [ebp - 0x18], 0x11
lea edi, [edi + ebx + 1]
jg 0x406de4
cmp edi, 0xffffffff
jne 0x406d1b
push 0x422c28
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
call fcn.0041df5a
ret
Function at 0x407885
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x407895
mov eax, dword [ecx + 8]
mov esi, dword [eax]
cmp dword [ebp + 8], 0
je 0x4078ea
test esi, esi
je 0x4078f5
mov eax, 0x80
mov ecx, eax
mov word [ebp + 0xe], cx
xor ecx, ecx
inc ecx
push 4
mov word [ebp + 0xc], cx
lea ecx, [ebp + 0xc]
push ecx
push eax
push 0xffff
push esi
call dword [sym.imp.WSOCK32.dll_setsockopt]
push 1
push esi
call dword [sym.imp.WSOCK32.dll_shutdown]
test eax, eax
je 0x4078dc
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
sub eax, 0x2710
add eax, 0x2710
cmp eax, 0x2736
jne 0x4078ea
xor esi, esi
test esi, esi
je 0x4078f5
push esi
call dword [sym.imp.WSOCK32.dll_closesocket]
xor eax, eax
inc eax
pop esi
pop ebp
ret 8

Function at 0x407a46
Capabilities:
Print debug messages
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 0
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_recv]
mov edi, eax
cmp edi, 0xffffffff
je 0x407a72
mov eax, dword [esi]
push 1
push edi
push dword [ebp + 0x10]
mov ecx, esi
call dword [eax + 0x18]
cmp edi, 0xffffffff
jne 0x407ad7
mov dword [esi + 0xc], 2
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
sub eax, 0x2710
js 0x407aa5
push dword [eax*4 + 0x431500]
push str.Read_Error_on_Listen_socket_:__s_n
push dword [ebp + 0x14]
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
jmp 0x407ab5
push str.Unknown_Read_error_on_Listen_socket_n
push dword [ebp + 0x14]
call dword [sym.imp.MSVCR90.dll_sprintf]
pop ecx
pop ecx
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 8]
mov ecx, esi
push 1
call fcn.00407885
or eax, 0xffffffff
jmp 0x407b0c
cmp edi, dword [ebp + 0xc]
je 0x407b03
push dword [ebp + 0xc]
mov dword [esi + 0xc], 2
push edi
push str.Read_Timeout___ld__ld_
push dword [ebp + 0x14]
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0x10
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x407b0a
mov dword [esi + 0xc], 1
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x407b12
Capabilities:
Print debug messages
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0
push dword [ebp + 0xc]
mov esi, ecx
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.WSOCK32.dll_send]
mov edi, dword [sym.imp.MSVCR90.dll_sprintf]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407b8b
xor ebx, ebx
mov dword [esi + 0xc], 2
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
sub eax, 0x2710
js 0x407b64
push dword [eax*4 + 0x431500]
push str.Write_Error_on_Listen_socket_:__s_n
push dword [ebp + 0x14]
call edi
add esp, 0xc
jmp 0x407b70
push str.Unknown_Write_error_on_Listen_socket_n
push dword [ebp + 0x14]
call edi
pop ecx
pop ecx
push 0
call dword [sym.imp.WSOCK32.dll_WSASetLastError]
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [ebp + 0x14]
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov eax, dword [esi]
push 0
push ebx
push dword [ebp + 0x10]
mov ecx, esi
call dword [eax + 0x18]
cmp ebx, dword [ebp + 0xc]
je 0x407bb9
push dword [ebp + 0xc]
mov dword [esi + 0xc], 2
push dword [ebp + 0xc]
push str.Write_Timeout___ld__ld_
push dword [ebp + 0x14]
call edi
add esp, 0x10
jmp 0x407bc0
mov dword [esi + 0xc], 1
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 0x10
Function at 0x4082c4
Capabilities:
Print debug messages

Disassembly:
push 0x10
mov eax, 0x41f8c1
call fcn.0041de82
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.CDDKSrvSocket.0
mov edi, dword [sym.imp.WSOCK32.dll_closesocket]
push 3
pop eax
mov word [esi + 0x1e0], ax
mov eax, dword [esi + 4]
mov dword [ebp - 4], 2
cmp eax, 0xffffffff
je 0x408301
push eax
call edi
or dword [esi + 4], 0xffffffff
push 0
lea ebx, [esi + 0x1f8]
push ebx
lea ecx, [ebp - 0x1c]
call sub.mfc90.dll_Ordinal_571
push 0x1388
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 3
call sub.mfc90.dll_Ordinal_4440
mov eax, dword [esi + 0x1ec]
test eax, eax
je 0x40834b
push eax
call edi
and dword [esi + 0x1e8], 0
push str.Server_socket_closing_normally._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 4
mov ecx, esi
call fcn.004013b6
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call sub.mfc90.dll_Ordinal_6707
mov ecx, ebx
mov byte [ebp - 4], 1
call sub.mfc90.dll_Ordinal_662
lea ecx, [esi + 0x1f0]
mov byte [ebp - 4], 0
call sub.mfc90.dll_Ordinal_662
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00407c51
call fcn.0041df5a
ret
Function at 0x408580
Capabilities:
Print debug messages
Set socket configuration

Disassembly:
push 0x170
mov eax, 0x41f954
call fcn.0041deeb
mov ebx, ecx
mov dword [ebp - 0x17c], ebx
call fcn.00407c92
xor esi, esi
push esi
push esi
push esi
push esi
lea ecx, [ebx + 0x1f0]
mov dword [ebp - 4], esi
mov dword [ebx], vtable.CDDKSrvSocket.0
call sub.mfc90.dll_Ordinal_398
push esi
push esi
push esi
push esi
lea ecx, [ebx + 0x1f8]
mov byte [ebp - 4], 1
call sub.mfc90.dll_Ordinal_398
movzx eax, word [ebx + 0x1d4]
push eax
mov byte [ebp - 4], 2
mov byte [ebx + 0x1cc], 1
mov dword [ebx + 8], esi
call sub.mfc90.dll_Ordinal_265
pop ecx
push esi
push 4
push esi
push 0xf
mov dword [ebx + 0x1d0], eax
push ebx
xor eax, eax
push 0x408382
mov word [ebx + 0x1e0], ax
call sub.mfc90.dll_Ordinal_1062
mov dword [ebx + 0x1dc], eax
mov eax, dword [ebp + 0x10]
cmp eax, esi
jne 0x408734
push 2
pop eax
push dword [ebp + 8]
mov word [ebx + 0x20], ax
mov dword [ebx + 0x24], esi
call dword [sym.imp.WSOCK32.dll_htons]
mov word [ebx + 0x22], ax
cmp ax, si
jne 0x408661
movzx eax, word [ebp + 8]
push eax
push str.Cannot_use_port__ld
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.MSVCR90.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0xc4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [ebx + 0xc], esi
jmp 0x408768
push 0x424fb8
call dword [sym.imp.WSOCK32.dll_getprotobyname]
mov dword [ebx + 0x30], eax
cmp eax, esi
jne 0x408691
push 1
lea eax, [ebp - 0x178]
push eax
mov ecx, ebx
call fcn.004079df
lea eax, [ebp - 0x178]
push eax
push str.Driver_cannot_connect_for_listen_:_s
jmp 0x40863c
movsx eax, word [eax + 8]
push eax
push 1
push 2
call dword [sym.imp.WSOCK32.dll_socket]
lea edi, [ebx + 4]
mov dword [edi], eax
cmp eax, 0xffffffff
jne 0x4086cb
push 1
lea eax, [ebp - 0x178]
push eax
mov ecx, ebx
call fcn.004079df
lea eax, [ebp - 0x178]
push eax
push str.Cannot_create_Listen_socket_:_s
jmp 0x40863c
push 0x10
lea ecx, [ebx + 0x20]
push ecx
push eax
call dword [sym.imp.WSOCK32.dll_bind]
test eax, eax
je 0x4086fd
push 1
lea eax, [ebp - 0x178]
push eax
mov ecx, ebx
call fcn.004079df
lea eax, [ebp - 0x178]
push eax
push str.Cannot_Bind_to_Listen_socket_:_s
jmp 0x40863c
push 4
lea eax, [ebx + 0x1c8]
push eax
push 1
push 6
push dword [edi]
call dword [sym.imp.WSOCK32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x408728
call dword [sym.imp.WSOCK32.dll_WSAGetLastError]
push eax
push str.Cannot_setsockopt_error___ld_
jmp 0x40863c
mov dword [ebx + 8], edi
mov dword [ebx + 0xc], 3
jmp 0x408737
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], 3
mov esi, str.Socket_created_OK.
lea edi, [ebp - 0xc4]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0xc4]
push eax
mov ecx, ebx
movsb byte es:[edi], byte [esi]
call fcn.004013b6
push 2
pop eax
mov word [ebx + 0x1e0], ax
mov eax, ebx
call fcn.0041df6e
ret 0xc
Function at 0x409111
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0
mov eax, 0x41fa21
call fcn.0041de82
mov edi, dword [ebp + 8]
push edi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_310]
and dword [ebp - 4], 0
xor ebx, ebx
inc ebx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40914a
test al, 0x10
jne 0x409175
push 0x5c
lea ecx, [ebp + 8]
xor ebx, ebx
call dword [sym.imp.mfc90.dll_Ordinal_5963]
mov esi, eax
test esi, esi
jle 0x4091c5
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_3178]
sub eax, esi
push eax
push esi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_2082]
jmp 0x409131
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_3178]
dec eax
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_899]
cmp al, 0x5c
je 0x40919b
push 0x4258a4
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_945]
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_910]
mov edx, edi
mov cl, byte [eax]
inc eax
mov byte [edx], cl
inc edx
test cl, cl
jne 0x4091a6
mov esi, ebx
lea ecx, [ebp + 8]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
call fcn.0041df5a
ret 4
mov byte [edi], 0
xor esi, esi
jmp 0x4091b2
Function at 0x40e470
Capabilities:
Resume thread

Disassembly:
push 8
mov eax, 0x4200cb
call fcn.0041de82
mov esi, ecx
mov dword [ebp - 0x14], esi
call fcn.00419cba
and dword [ebp - 4], 0
lea ecx, [esi + 0x484]
mov dword [esi], vtable.CMOD232CommsProcessor.0
call fcn.00417bf9
lea edi, [esi + 0x6cc]
mov ecx, edi
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
push str.MODBUS_RTU
mov ecx, edi
mov byte [ebp - 4], 3
call dword [sym.imp.mfc90.dll_Ordinal_820]
lea eax, [esi + 0x6d4]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
and dword [esi + 0x6c8], 0
push str.MODBUS_RS_232
lea eax, [ebp - 0x10]
push str.Starting_comms_emulation_:__s
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
mov ecx, esi
call fcn.0040e15c
push dword [ebp + 8]
mov ecx, esi
call fcn.00417f0a
test eax, eax
je 0x40e52c
xor eax, eax
cmp dword [ebp + 0x14], eax
mov ecx, esi
setne al
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00418720
push dword [ebp + 0x2c]
mov eax, dword [ebp + 0x20]
push dword [ebp + 0x28]
mov ecx, esi
push dword [ebp + 0x24]
mov dword [esi + 0x474], eax
call fcn.0040e0f8
mov eax, dword [esi + 0x18]
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
mov eax, esi
call fcn.0041df5a
ret 0x28
Function at 0x40f7c9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x434018]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x90
lea eax, [ebp - 0x94]
push 0
push eax
mov dword [ebp - 0x98], 0x94
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x40f81b
cmp dword [ebp - 0x94], 5
jae 0x40f81f
xor eax, eax
jmp 0x40f844
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.SetLayeredWindowAttributes
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
test eax, eax
setne cl
mov dword [0x434088], eax
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041de66
leave
ret

Function at 0x40fd7a
Capabilities:
Get hostname

Disassembly:
push ebp
sub esp, 0x88
lea ebp, [esp - 4]
mov eax, dword [0x434018]
xor eax, ebp
mov dword [ebp + 0x88], eax
push 0x14
mov eax, 0x420231
call fcn.0041deb5
mov edi, dword [ebp + 0x94]
mov esi, ecx
cmp dword [esi + 0x109c], 0
mov ecx, dword [ebp + 0x98]
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], ecx
jne 0x40fdf4
push str.no_host
call dword [sym.imp.mfc90.dll_Ordinal_820]
push eax
mov ecx, edi
call dword [sym.imp.mfc90.dll_Ordinal_817]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
call fcn.0041de66
add ebp, 0x8c
leave
ret 8
and dword [ebp - 4], 0
push 0x78
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.WSOCK32.dll_gethostname]
cmp eax, 0xffffffff
je 0x40fe72
lea eax, [ebp + 0x10]
push eax
mov ecx, edi
call dword [sym.imp.mfc90.dll_Ordinal_820]
jmp 0x40fe72
mov ecx, dword [esi + 0x109c]
mov dword [ebp - 4], 3
call fcn.0041982c
mov ecx, eax
xor eax, eax
lea edi, [ebp]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0x10
cmp ecx, 0xffffffff
je 0x40fdcf
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp]
push eax
push ecx
call dword [sym.imp.WSOCK32.dll_getpeername]
cmp eax, 0xffffffff
je 0x40fdcf
movzx eax, byte [ebp + 7]
push eax
movzx eax, byte [ebp + 6]
push eax
movzx eax, byte [ebp + 5]
push eax
movzx eax, byte [ebp + 4]
push eax
push str._d._d._d._d
push dword [ebp - 0x20]
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0x18
jmp 0x40fdcf

Function at 0x41014c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0xc0000000
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x41017a
xor eax, eax
jmp 0x4101a3
mov eax, dword [ebp + 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x410180
push ebx
lea ecx, [ebp - 4]
push ecx
sub eax, edx
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret
Function at 0x4101a7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.0041b511
add esp, 0xc
test eax, eax
je 0x410219
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0xc0000000
push dword [ebp + 0xc]
mov dword [ebp - 8], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4101f7
push dword [ebp - 4]
call sub.mfc90.dll_Ordinal_800
pop ecx
xor eax, eax
jmp 0x41021c
push esi
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 4]
call sub.mfc90.dll_Ordinal_800
pop ecx
xor eax, eax
inc eax
pop edi
pop esi
leave
ret

Function at 0x4109c6
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x410a09
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
sub eax, dword [esi + 4]
xor ebx, ebx
inc ebx
cmp eax, 0x2932e0
jbe 0x4109e8
mov dword [esi + 8], ebx
cmp dword [esi + 8], 0
je 0x410a07
call edi
sub eax, dword [esi + 4]
cmp eax, 0xea60
jbe 0x410a07
call fcn.0040fbc8
call edi
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
pop edi
pop ebx
pop esi
ret
Function at 0x414112
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x4207d1
call fcn.0041de82
mov esi, ecx
dec dword [esi + 0x3164]
mov eax, dword [esi + 0x3164]
xor ebx, ebx
cmp dword [esi + 0x314c], ebx
je 0x41413a
cmp eax, ebx
jle 0x41414e
cmp dword [esi + 0x3160], ebx
jne 0x41414e
cmp dword [esi + 0x3150], ebx
je 0x4142e6
movzx eax, byte [esi + 0x3148]
shl eax, 8
add eax, dword [esi + 0x3148]
mov dword [ebp - 0x1c], eax
cmp dword [esi + 0x3150], ebx
je 0x4141ce
cmp dword [esi + 0x3160], ebx
jne 0x4141ce
lea ecx, [esi + 0x3170]
call dword [sym.imp.mfc90.dll_Ordinal_3178]
test eax, eax
je 0x4141c2
lea edi, [esi + 0x3184]
cmp dword [edi], ebx
jne 0x4141a5
push str.VBScript
lea ecx, [esi + 0x3188]
call fcn.00403361
mov dword [edi], 1
cmp eax, ebx
je 0x4141c2
push ebx
lea ecx, [esi + 0x3170]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
mov ecx, esi
call fcn.00413ed2
cmp eax, ebx
jne 0x4142da
mov ecx, esi
call fcn.00411610
jmp 0x4142da
mov dword [ebp - 0x10], ebx
call fcn.0040fd19
test eax, eax
jle 0x4142d4
mov edi, 0x434140
push 0x434154
lea ecx, [ebp - 0x30]
call fcn.0040d89c
push dword [ebp - 0x10]
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0040caa0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x24], ebx
jne 0x4142ec
cmp dword [esi + 0x3160], ebx
je 0x414233
cmp eax, ebx
mov dword [ebp - 0x14], ebx
jle 0x414295
push ebx
push dword [ebp - 0x14]
mov ecx, edi
push dword [ebp - 0x10]
call fcn.0040da3d
inc dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x18]
jl 0x414218
jmp 0x414295
cmp dword [ebp - 0x18], 0
jle 0x414293
mov edx, dword [ebp - 0x10]
push edx
mov ecx, esi
call fcn.0040fd5e
mov ecx, edi
test eax, eax
je 0x414270
push ebx
push edx
call fcn.0040da27
mov ecx, eax
call fcn.0040d984
mov ecx, edi
test ax, ax
je 0x414263
push 0
jmp 0x414265
push 1
push ebx
push dword [ebp - 0x10]
call fcn.0040da3d
jmp 0x41428d
cmp dword [esi + 0x3154], 0
je 0x41427e
push dword [ebp - 0x1c]
jmp 0x414286
movzx eax, word [esi + 0x3148]
push eax
push ebx
push edx
call fcn.0040da60
inc ebx
cmp ebx, dword [ebp - 0x18]
jl 0x414239
xor ebx, ebx
mov eax, dword [ebp - 0x10]
cmp dword [esi + 0x1528], eax
jne 0x4142b5
push dword [ebp - 0x18]
push ebx
push 0x1015
push dword [esi + 0x10f0]
call dword [sym.imp.USER32.dll_SendMessageA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0040d8de
inc dword [ebp - 0x10]
mov ecx, esi
call fcn.0040fd19
cmp dword [ebp - 0x10], eax
jl 0x4141e3
mov dword [esi + 0x3160], ebx
mov eax, dword [esi + 0x316c]
mov dword [esi + 0x3164], eax
call fcn.0041df5a
ret
push str.Failed_to_lock_mem__n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x414295
Function at 0x4150bc
Capabilities:
Get graphical window text

Disassembly:
push 8
mov eax, 0x420e58
call fcn.0041de82
mov esi, ecx
cmp dword [esi + 0x10b8], 0
je 0x4150f1
push 0x30
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [esi + 0xa8]
lea ecx, [esi + 0x31f0]
call fcn.004106f1
jmp 0x41528e
lea ebx, [esi + 0x31f0]
mov ecx, ebx
call fcn.004106de
mov edi, eax
cmp edi, 0xffffffff
je 0x41528e
cmp edi, dword [esi + 0xa8]
je 0x4151bd
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_316]
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_316]
lea eax, [ebp - 0x10]
push eax
push edi
mov ecx, ebx
mov byte [ebp - 4], 1
call sub.mfc90.dll_Ordinal_3175
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push str.Change_protocol_to__s_
push eax
call dword [sym.imp.mfc90.dll_Ordinal_2539]
add esp, 0xc
push 4
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_910]
push eax
push str.Click_Yes_to_select_the_protocol__or_No_to_cancel.
mov ecx, esi
call sub.mfc90.dll_Ordinal_4502
cmp eax, 6
jne 0x4151a7
mov ecx, esi
mov dword [esi + 0xa8], edi
call fcn.00413539
mov ecx, esi
call fcn.00413a00
mov ecx, esi
call fcn.0040fd19
push eax
mov ecx, 0x434140
call fcn.0040db5b
mov ecx, esi
call fcn.004111fe
push dword [esi + 0xa8]
mov ecx, esi
call fcn.00413ab9
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc90.dll_Ordinal_601]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc90.dll_Ordinal_601]
xor edi, edi
cmp dword [esi + 0xf38], edi
jne 0x41520b
cmp dword [esi + 0x310c], edi
jne 0x41520b
push edi
push 0x481
mov ecx, esi
call sub.mfc90.dll_Ordinal_2899
mov ecx, eax
call sub.mfc90.dll_Ordinal_6584
push edi
push 0x482
mov ecx, esi
call sub.mfc90.dll_Ordinal_2899
mov ecx, eax
call sub.mfc90.dll_Ordinal_6584
push edi
push 0x483
mov ecx, esi
call sub.mfc90.dll_Ordinal_2899
mov ecx, eax
call sub.mfc90.dll_Ordinal_6584
mov eax, dword [esi + 0xa8]
sub eax, edi
je 0x415239
dec eax
dec eax
je 0x415231
dec eax
mov edi, 0x80
je 0x415229
lea ebx, [esi + 0x3344]
jmp 0x415244
lea ebx, [esi + 0x334c]
jmp 0x415244
lea ebx, [esi + 0x3348]
jmp 0x41523f
lea ebx, [esi + 0x3340]
mov edi, 0x80
push dword [ebx]
push 1
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebx]
push 0
push edi
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [esi + 0xa8]
lea ecx, [esi + 0x31f0]
call fcn.004106f1
push 0xd
push 0
push 0x801a
push 0xa
lea ecx, [esi + 0x16ec]
call sub.mfc90.dll_Ordinal_6177
mov ecx, esi
call fcn.00411c02
call fcn.0041df5a
ret