joyce8/EMBER2024-capa huggingface dataset:
Function at 0x732f89
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, 0x6132be0a
add esp, 0
btc ebp, ebx
xchg byte [esp + 8], cl
xchg word [esp], dx
jmp 0x732f4e
popal
mov di, sp
lea ebp, [ecx + ebx]
sub esp, 2
mov cx, word [esp + 9]
mov word [esp + 6], bx
jmp 0x732e9e
lea ecx, [eax + 0x6e141ba1]
cpuid
lea esp, [esp + 3]
neg si
mov bl, 0x70
xchg dx, bp
jmp 0x732f36
mov dword [esp + 3], esi
mov dh, byte [esp + 7]
push word [esp + 8]
xchg bp, bx
mov bl, 0x18
mov edi, dword [esp]
jmp 0x732ece
lea ebx, [ebx*4]
lea ebp, [edx + edi]
push word [esp]
btc edi, ebx
pop edi
add al, dh
jmp 0x732fb2
setle bh
btc ebp, edi
mov dword [esp + 7], esi
lea esp, [esp + 9]
jmp 0x732f01
mov bx, word [esp + 6]
mov cx, bx
lea edi, [ebp*4]
push dword [esp]
jmp 0x732f1d
not edx
lea ebx, [eax - 0x31]
pop edx
mov cx, 0x752d
mov dword [esp + 1], ebp
mov cx, 0x5a83
jmp 0x732eea
push word [esp + 0xf]
push word [esp + 5]
add di, 0xdd46
pop si
btr ebx, esp
jmp 0x732eb8
jmp 0x732f6f
sub bl, ah
not di
btc edi, edi
not ah
btc edx, edi
mov dx, 0x3a59
jmp 0x73388c
mov byte [esp], bh
rdtsc
mov di, 0x5edf
mov bl, 0xd0
mov ch, byte [esp]
rdtsc
jmp 0x732f8b
xchg bh, cl
lea edx, [ebp*4]
sub esp, 0
mov byte [esp], bh
inc ebx
call fcn.007335bc
xchg word [esp + 0xd], cx
mov edx, dword [esp + 0x1f]
btr edx, edx
call fcn.00734bf3
int3
xchg byte [esp], cl
lea edx, [ecx + edi]
xchg byte [esp], dl
setno ah
neg dx
xchg dh, al
jmp 0x73383c

Function at 0x7333db
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, 0x9907
push dword [esp + 0x1c]
mov byte [esp + 9], ah
push word [esp + 0x29]
jmp 0x733402

Function at 0x7335bc
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg word [esp], cx
sub bp, 0xa30
mov bh, byte [esp + 1]
mov edi, 0x7cd2bd96
sub esp, 4
xchg dh, al
cpuid
jmp 0x733297
inc ecx
bswap ecx
mov bx, 0xf661
mov byte [esp + 1], bh
add edx, ebp
rcr ch, 5
jmp 0x7333c1
xchg edx, eax
jmp 0x73341a
Function at 0x73397d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
not bp
shr ch, 5
sub ecx, eax
mov ax, word [esp + 0x19]
jmp 0x7339cb
mov esi, dword [esp]
rdtsc
mov word [esp], dx
lea eax, [ecx*4]
jmp 0x733a98
push word [esp + 0x1b]
mov dx, word [esp + 0x13]
add esp, 0x1c
mov dx, 0xeac3
lea eax, [esi*4]
mov bl, 0xc8
jmp 0x7339b5
cld
mov cx, di
btr ecx, esp
call fcn.00733a37
lea ecx, [edx*4]
call fcn.00733aac
adc eax, 0x9b680999
ja 0x733b02
cli
push 0x5b18fa0f
mov dl, 0xad
mov esp, 0xbb0f168f
fsub dword [esi + 0xf]
mov ebp, 0x240c8bf5
btc eax, ebx
bsr si, bp
mov ecx, dword [esp]
add esp, 1
xchg byte [esp], bl
inc dl
jmp 0x733a6e
rdtsc
mov cx, word [esp]
rdtsc
sub esp, 4
xchg dh, al
lea ebp, [ebx*4]
jmp 0x733b0d
mov ebp, 0x24248dc1
mov cx, 0x813
jmp 0x733ade
rdtsc
add esp, 0
mov ebp, dword [esp + 3]
mov dx, sp
add esp, 2
bsf si, si
jmp 0x733b42
lea esp, [esp + 2]
add esp, 0
bsf bx, si
bsf bp, ax
lea edx, [eax*4]
xchg edi, eax
jmp 0x7348e9
lea esp, [esp + 0x20]
popfd
jmp 0x733c16
push word [esp + 0x17]
cmc
add esp, 0x1f
pop word [esp]
sub esp, 0x1e
lea esp, [esp + 3]
jmp 0x733b78
pushal
pop word [esp + 7]
push dword [esp + 0xc]
push word [esp + 0x15]
mov word [esp + 0x1c], dx
mov dword [esp + 0x17], esi
jmp 0x733b9c
setnp ch
mov bx, word [esp + 2]
pop bp
lea esp, [esp + 4]
popal
clc
jmp 0x733bcb
push 0xa8899e4e
add dword [esp], 0x57c74713
push esp
jmp 0x733d27
bswap esi
bswap edx
sub esp, 0x1a
xchg edx, eax
add esp, 0x15
xchg byte [esp], bl
jmp 0x733c04
mov ebp, 0xb0959830
pushal
pop word [esp + 0x13]
mov byte [esp + 0xb], ch
push edx
call fcn.00733c55
lea esp, [esp + 2]
push ebp
bswap ebp
lea ebp, [eax - 0xf9]
lea ebp, [edx + ebx]
mov bp, 0x605d
jmp 0x733c78
push word [esp + 1]
push dword [esp + 4]
pop dword [esp]
mov byte [esp + 4], dh
pop word [esp + 1]
pop word [esp]
jmp 0x733ca4
cpuid
mov bl, bh
mov edx, ebp
xchg ah, bl
cpuid
bswap edx
jmp 0x733c45
neg bp
mov ax, word [esp]
rdtsc
not si
xchg ah, bl
add esp, 0
jmp 0x733dd5
and cl, bh
xchg byte [esp], bl
add esp, 0
xchg byte [esp], dl
mov ah, byte [esp]
mov cl, 0xf2
jmp 0x7340c4

Function at 0x733aac
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov al, ah
mov cl, 0x42
add esi, ebp
lea ecx, [ebx*4]
jmp 0x733b31
xchg cx, ax
rdtsc
lea esp, [esp]
bsr ax, cx
lea esp, [esp]
pop dx
mov dh, byte [esp]
inc al
mov si, di
add esp, 0
xchg bh, cl
jmp 0x733af8
Function at 0x734996
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov edx, 0xa21ff950
bsf bx, ax
clc
xchg bl, bh
mov ebx, 0x25344aa8
pushal
jmp 0x734a21
xchg byte [esp], bl
mov bl, 0xf8
rol bx, cl
lea esp, [esp + 1]
mov dword [esp + 6], edx
sub bl, ah
jmp 0x734939
lea esp, [esp + 1]
mov dword [esp + 0xf], ebx
push esp
xchg word [esp], bx
mov bx, word [esp]
lea esp, [esp + 3]
jmp 0x734951
pop dword [esp]
push dword [esp + 1]
pushal
mov byte [esp + 9], dh
jmp 0x73496d
xchg ah, bl
mov eax, dword [esp]
mov bl, byte [esp]
bsf bx, si
setp bh
mov dl, dh
jmp 0x7349fd
setno dh
mov dword [esp + 0x19], eax
inc ax
stc
xchg ebx, eax
rol bx, cl
jmp 0x7349c6
mov ax, word [esp]
bsr bx, cx
mov eax, dword [esp]
pushal
mov bx, word [esp]
pop word [esp + 0x11]
jmp 0x734a61
mov bx, bp
inc edx
setbe dh
mov dx, 0x876b
bsf dx, ax
pop edx
jmp 0x7349ec
lea edx, [eax - 0x6c891e67]
mov ax, 0xaf83
mov dh, byte [esp + 0x15]
sub esp, 6
jmp 0x734af4
mov dh, ch
lea eax, [eax*4]
xchg byte [esp + 0xc], dh
jmp 0x734a33
mov dl, dh
not dx
pop edx
mov dh, ch
pop dword [esp + 8]
mov ax, word [esp + 0x10]
jmp 0x734a4a
mov dword [esp + 0xd], ecx
mov word [esp + 0x10], di
bt ebx, edx
pushal
clc
bswap edx
jmp 0x734aae
mov ax, dx
pop eax
push edx
pop edx
inc eax
push dword [esp + 8]
jmp 0x734ad8

Function at 0x735077
Capabilities:
Execute anti-debugging instructions

Disassembly:
not bx
jmp 0x7350bc
pop dx
xchg ebx, eax
mov edx, esp
mov edx, dword [esp + 0x19]
setl bh
xchg dx, ax
jmp 0x7350a4
setle ah
stc
neg bh
xchg dh, dl
bswap eax
pop bx
jmp 0x73507c

Function at 0x735323
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, [edi*4]
rdtsc
jmp 0x735363
shl ax, cl
xchg ah, bl
lea edx, [ebx*4]
rdtsc
mov byte [esp + 1], dh
jmp 0x7353c9
mov ah, byte [esp + 6]
pop eax
mov ax, sp
cld
lea edx, [esi*4]
push dword [esp + 5]
jmp 0x73534a
xchg bh, dh
not bh
xchg byte [esp], dh
xchg dx, ax
neg eax
xchg byte [esp], dl
jmp 0x735425
pop dword [esp]
bsf ax, ax
mov ebx, eax
push dword [esp + 2]
mov dl, 0xac
add esp, 9
jmp 0x735391
add esp, 7
mov bx, word [esp + 4]
xchg dx, bx
inc dl
shl ebx, 0x13
push dword [esp + 2]
jmp 0x7353a7
mov dh, byte [esp]
bsr bx, bp
pushal
mov ebx, 0xcb2f7c8
mov ax, 0xb99f
add esp, 0x1d
jmp 0x735464
mov ah, byte [esp]
inc bx
neg bh
btr ebx, esp
mov eax, ebx
add esp, 0
jmp 0x735405
pop ebx
bswap ebx
not dx
rdtsc
cld
call fcn.0073544d
not bx
xchg dh, dl
add al, dh
lea ebx, [ebx + edi]
mov edx, 0xc5d84ef0
mov bx, 0x4805
jmp 0x7356b2
mov word [esp + 0xb], di
bsf ax, si
xchg dx, ax
xchg word [esp + 8], ax
call fcn.00735498
jb 0x73553f
rcl eax, 0xd
mov dx, word [esp + 0xc]
lea esp, [esp + 1]
lea esp, [esp]
jmp 0x7354bb
inc eax
mov ah, byte [esp + 9]
sete ah
not ax
push dword [esp + 0xc]
bswap eax
jmp 0x7354d2
pop ebx
cld
lea ebx, [edi*4]
push esp
neg dx
sub esp, 0xa
jmp 0x7354eb
cmc
mov dword [esp], esi
xchg dword [esp], ebx
xchg dx, bx
inc al
setae bh
jmp 0x735536
mov word [esp], di
mov ebx, dword [esp + 3]
lea edx, [edx + ebp]
xchg dh, al
mov word [esp], dx
xchg edx, ebx
jmp 0x735671
Function at 0x73548c
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [eax + edx]
lea esp, [esp + 0x33]
sub bl, ah
sub esp, 0x10
mov dh, 0x4a
xchg dx, bx
jmp 0x7352b7
mov eax, dword [esp + 0x13]
not bh
bsr bx, cx
mov eax, dword [esp + 0x11]
mov ax, 0xe145
pushal
jmp 0x73527f
mov dx, si
shl ebx, 0x15
xchg dword [esp + 2], eax
mov edx, ecx
push dword [esp + 0xc]
btc ebx, ebx
jmp 0x735382
mov bx, 0xae05
add esp, 0x1d
not ebx
mov bl, bh
mov byte [esp + 0x13], ch
lea esp, [esp + 3]
jmp 0x7352a2
mov bl, bh
mov eax, 0x44883236
xchg dh, dl
lea edx, [edx*4]
mov edx, dword [esp + 0x1d]
push edx
jmp 0x7352e3
pop ebx
neg ebx
pop eax
mov edx, dword [esp + 3]
call fcn.00735323
mov edx, esi
neg dx
rdtsc
pop ebx
neg ebx
setge dh
jmp 0x73533d
push word [esp + 0x11]
not eax
xchg dh, al
mov bh, byte [esp + 3]
sub esp, 0x14
mov dx, bx
jmp 0x73530c
cmc
xchg edx, eax
inc dl
rdtsc
jmp 0x7353ed

Function at 0x735e05
Capabilities:
Parse pe header

Disassembly:
mov word [esp], dx
mov word [esp], di
jmp 0x735e32
mov word [esp + 0x30], di
push edx
lea esp, [esp + 0x44]
push edx
push word [esp + 1]
jmp 0x735e56
pushal
mov dword [esp + 0x88], ebp
pushal
pushal
mov word [esp + 0x14], sp
jmp 0x735e0f

Function at 0x735e28
Capabilities:
Parse pe header

Disassembly:
pop word [esp + 1]
call fcn.00735e05

Function at 0x735e49
Capabilities:
Parse pe header

Disassembly:
mov word [esp], di
pop word [esp]
call fcn.00735e28
pop word [esp + 1]
mov dword [esp], esi
mov dword [esp + 0x88], esi
call fcn.00735e9b
loope 0x735e8c
mov word [esp], di
pop word [esp]
pushal
pop word [esp + 0x15]
pop dword [esp]
call fcn.00735dff
Function at 0x10024d1
Capabilities:
Create service
Persist via windows service

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x100a068]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0x200
lea eax, [ebp - 0x204]
push eax
xor edi, edi
push edi
xor ebx, ebx
call dword [0x10010a0]
test eax, eax
mov esi, dword [0x1001098]
jne 0x1002510
call esi
mov ebx, eax
cmp ebx, edi
jne 0x1002588
push 0xf003f
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [ebp - 0x208], eax
jne 0x100252f
call esi
mov ebx, eax
cmp ebx, edi
jne 0x1002574
push edi
push edi
push dword [0x100a048]
lea eax, [ebp - 0x204]
push edi
push edi
push eax
push 1
push 2
push 0x10
push 0xf01ff
push dword [0x100a044]
push dword [0x100a040]
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
cmp eax, edi
jne 0x100256d
call esi
mov ebx, eax
jmp 0x1002574
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp dword [ebp - 0x208], edi
je 0x1002588
push dword [ebp - 0x208]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.01006e5a
leave
ret
Function at 0x10078f3
Capabilities:
Access the windows event log

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
xor esi, esi
xor ebx, ebx
cmp dword [ebp + 0x10], 5
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
jbe 0x1007929
xor eax, eax
jmp 0x1007a32
mov eax, dword [ebp + 0x1c]
cmp eax, esi
je 0x1007936
xor ebx, ebx
mov dword [ebp - 0x24], eax
inc ebx
mov eax, dword [ebp + 0x20]
cmp eax, esi
je 0x1007945
movzx ecx, bx
mov dword [ebp + ecx*4 - 0x24], eax
inc ebx
mov eax, dword [ebp + 0x24]
cmp eax, esi
je 0x1007954
movzx ecx, bx
mov dword [ebp + ecx*4 - 0x24], eax
inc ebx
mov eax, dword [ebp + 0x28]
cmp eax, esi
je 0x1007963
movzx ecx, bx
mov dword [ebp + ecx*4 - 0x24], eax
inc ebx
mov eax, dword [ebp + 0x2c]
cmp eax, esi
je 0x1007972
movzx ecx, bx
mov dword [ebp + ecx*4 - 0x24], eax
inc ebx
mov eax, dword [ebp + 0x30]
cmp eax, esi
je 0x1007981
movzx ecx, bx
mov dword [ebp + ecx*4 - 0x24], eax
inc ebx
mov eax, dword [ebp + 0x34]
cmp eax, esi
je 0x1007990
movzx ecx, bx
mov dword [ebp + ecx*4 - 0x24], eax
inc ebx
mov eax, dword [ebp + 0x38]
cmp eax, esi
je 0x100799f
movzx ecx, bx
mov dword [ebp + ecx*4 - 0x24], eax
inc ebx
mov eax, dword [ebp + 0x14]
shr eax, 0x1e
sub eax, esi
je 0x10079ca
dec eax
je 0x10079c1
dec eax
je 0x10079b8
mov dword [ebp + 0x10], 1
jmp 0x10079d1
mov dword [ebp + 0x10], 2
jmp 0x10079d1
mov dword [ebp + 0x10], 4
jmp 0x10079d1
mov dword [ebp + 0x10], 0x10
push edi
push dword [ebp + 8]
call fcn.010073ca
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edi, eax
cmp edi, esi
je 0x1007a2e
cmp dword [ebp + 0x18], esi
je 0x10079f4
call fcn.01007554
mov esi, eax
push dword [ebp + 0x40]
lea eax, [ebp - 0x24]
push eax
push dword [ebp + 0x3c]
push ebx
push esi
push dword [ebp + 0x14]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
test eax, eax
je 0x1007a1b
mov dword [ebp - 4], 1
push edi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
test esi, esi
je 0x1007a2e
push esi
call dword [sym.imp.msvcrt.dll_free]
pop ecx
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x3c
Function at 0x1008626
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push 0x14
push 0x1002038
call fcn.010070e4
xor ebx, ebx
cmp dword [0x100a1b0], ebx
jne 0x100866f
mov dword [ebp - 4], ebx
push 0x100a1b4
call dword [0x1001094]
mov dword [0x100a1b0], 1
or dword [ebp - 4], 0xffffffff
jmp 0x1008667
cmp dword [0x100a1b0], ebx
je 0x10086a7
cmp dword [0x100a690], ebx
jne 0x100868b
push 0x1002028
call dword [0x1001090]
mov dword [0x100a690], eax
cmp eax, ebx
je 0x10086a7
cmp dword [0x100a694], ebx
jne 0x10086b3
push 0x100201c
call dword [0x1001090]
mov dword [0x100a694], eax
cmp eax, ebx
jne 0x10086b3
call fcn.01007ca6
xor eax, eax
jmp 0x100876c
cmp dword [0x100a6a4], ebx
jne 0x10086dc
push 0x100a6a4
push 0x1001fe8
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
cmp dword [0x100a6a4], ebx
je 0x1008767
xor esi, esi
push 4
pop edi
mov eax, dword [esi + 0x100a098]
cmp eax, ebx
je 0x100872b
mov dword [ebp - 0x1c], edi
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [esi + 0x100a094]
push ecx
lea ecx, [ebp - 0x24]
push ecx
push ebx
push eax
push dword [0x100a6a4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x100872b
mov dword [ebp - 0x20], ebx
push edi
lea eax, [ebp - 0x20]
push eax
push edi
push ebx
push dword [esi + 0x100a098]
push dword [0x100a6a4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esi, 0xc
cmp esi, 0x120
jb 0x10086e1
call fcn.010084c3
mov eax, dword [0x100a6a8]
cmp eax, ebx
jne 0x1008754
push ebx
push ebx
push 1
push ebx
call dword [0x100109c]
mov dword [0x100a6a8], eax
push 1
push eax
push 7
push 1
push dword [0x100a6a4]
call dword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
mov eax, dword [0x100a6a8]
call fcn.0100711f
ret
Function at 0x401010
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 8]
mov ebx, edx
push eax
push str.Software_
push closesocket
mov edi, ecx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x401065
push dword [ebp + 8]
push ebx
push 3
push eax
push edi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
test eax, eax
mov ecx, 1
cmove esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret
Function at 0x4055b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426878
mov eax, dword fs:[0]
push eax
sub esp, 0x114
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
cmp dword [edi + 0x340], 1
je 0x405608
push 0
push 0x42cc20
push 0x42d150
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x4056ec
mov eax, dword [edi + 0x348]
cmp eax, 1
je 0x405621
cmp eax, 2
je 0x405621
cmp eax, 3
jne 0x4056ec
mov eax, dword [edi + 0x33c]
cmp eax, 0xffffffff
jne 0x4056d9
push 0x100
xorps xmm0, xmm0
lea eax, [ebp - 0x120]
push 0
push eax
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.0040eec0
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x18]
add esp, 0xc
push eax
push 8
push 0xd
push dword [edi + 0x34]
call esi
lea eax, [ebp - 0x20]
push eax
push 8
push 0xd
push dword [edi + 0x38]
call esi
lea eax, [ebp - 0x120]
push eax
push 0x100
push 0xd
push dword [edi + 0x28]
call esi
push 0x10
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00412dd9
push 0x10
mov esi, eax
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00412dd9
add esp, 0x18
push eax
push esi
call dword [sym.imp.msdk.dll_M_Open_VidPid]
cmp eax, 0xffffffff
je 0x4056ba
mov dword [edi + 0x33c], eax
jmp 0x4056d4
push 0
push 0x42cc20
push 0x42d160
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [edi + 0x33c]
cmp eax, 0xffffffff
je 0x4056ec
mov ecx, dword [ebp + 0x2c]
mov dword [ebp - 0x14], eax
test ecx, ecx
je 0x405728
mov eax, dword [ecx]
lea edx, [ebp - 0x14]
push edx
call dword [eax + 8]
mov dword [ebp - 4], 2
mov ecx, dword [ebp + 0x2c]
test ecx, ecx
je 0x40570b
mov edx, dword [ecx]
lea eax, [ebp + 8]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 0x28
call fcn.0040e2e3
int3
Function at 0x405af0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42693b
mov eax, dword fs:[0]
push eax
sub esp, 0x278
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x18]
push eax
push 8
push 0xd
push dword [edi + 0x34]
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
movlpd qword [ebp - 0x20], xmm0
call ebx
lea eax, [ebp - 0x20]
push eax
push 8
push 0xd
push dword [edi + 0x38]
call ebx
push 0x10
lea eax, [ebp - 0x18]
push 0
push eax
call fcn.00412dd9
push 0x10
mov esi, eax
lea eax, [ebp - 0x20]
push 0
push eax
call fcn.00412dd9
push 0
mov dword [ebp - 0x284], eax
call fcn.00412eb6
add esp, 0x1c
cmp edx, dword [edi + 0x334]
jl 0x405bb0
jg 0x405b8b
cmp eax, dword [edi + 0x330]
jmp 0x405bb0
push 0
push 0x42cc20
push 0x42d174
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [edi + 0x340], 0
xor eax, eax
jmp 0x405d20
xor ebx, ebx
lea eax, [ebp - 0x280]
push 0x15c
push ebx
push eax
mov dword [edi + 0x340], ebx
call fcn.0040eec0
movaps xmm0, xmmword [0x42de80]
add esp, 0xc
mov dword [ebp - method.CUsbHidCtrl.virtual_0], vtable.CUsbHidCtrl.0
mov dword [ebp - method.CUsbHid.virtual_0], vtable.CUsbHid.0
movups xmmword [ebp - 0x174], xmm0
push dword [ebp - 0x284]
lea ecx, [ebp - 0x27c]
mov dword [ebp - 4], ebx
push esi
call fcn.0040cf10
cmp eax, 1
jne 0x405d04
cmp word [ebp - 0x160], bx
jne 0x405cf7
mov ax, word [ebp - 0x15c]
cmp ax, 0x41
je 0x405c35
mov ecx, 0xa1
cmp ax, cx
jne 0x405cf7
lea eax, [edi + 0x350]
push eax
lea eax, [edi + 0x34c]
push eax
lea esi, [edi + 0x348]
push esi
lea ecx, [ebp - 0x280]
call fcn.0040d390
mov eax, dword [esi]
cmp eax, 1
je 0x405cbe
cmp eax, 2
je 0x405cbe
cmp eax, 3
je 0x405cbe
push 0x104
lea eax, [ebp - 0x124]
or ebx, 0xffffffff
push 0
push eax
call fcn.0040eec0
push 0x42cbf5
push 0x42d180
lea eax, [ebp - 0x124]
push 0x104
push eax
call fcn.00401b10
add esp, 0x1c
lea eax, [ebp - 0x124]
push eax
push 0
push 0xc
push dword [edi + 0x98]
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [ebp - 0x27c]
call fcn.0040d150
jmp 0x405d1e
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
mov ebx, 1
push 0
push dword [edi + 0xc]
mov dword [edi + 0x340], ebx
call esi
push 0
push dword [edi + 0x10]
call esi
push 0
push dword [edi + 0x14]
call esi
push 0
push dword [edi + 0x18]
call esi
push ebx
push dword [edi + 0x1c]
call esi
push ebx
push dword [edi + 0x20]
call esi
lea ecx, [ebp - 0x27c]
call fcn.0040d150
jmp 0x405d1e
cmp dword [ebp + 8], 0
je 0x405d1e
push 0
push 0x42cc20
push 0x42d184
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4
Function at 0x4060c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa2]
push 0x9b
push 0
push eax
mov bl, 0x5a
call fcn.0040eec0
mov eax, dword [esi]
add esp, 0xc
mov byte [ebp - 0xa2], bl
mov dword [ebp - 0xa8], 0xaa00
mov word [ebp - 0xa4], 0x5002
mov eax, dword [eax + 0x114]
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x406134
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4

Function at 0x406150
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ecx + 8]
mov ebx, esi
push edi
mov edi, dword [ebp + 8]
lea ecx, [ebx + 1]
mov al, byte [ebx]
inc ebx
test al, al
jne 0x406171
push 0x9b
lea eax, [ebp - 0xa2]
sub ebx, ecx
push 0
push eax
call fcn.0040eec0
lea eax, [ebx + 1]
mov dword [ebp - 0xa8], 0xaa00
push ebx
mov byte [ebp - 0xa4], al
lea eax, [ebp - 0xa2]
push esi
push eax
mov byte [ebp - 0xa3], 0x99
call fcn.00410be0
mov eax, dword [edi]
add esp, 0x18
mov eax, dword [eax + 0x114]
pop edi
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x4061e4
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4

Function at 0x406200
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x431008]
xor eax, esp
mov dword [esp + 0x10c], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x100
mov edi, dword [eax]
mov esi, ecx
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0040eec0
add esp, 0xc
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 4]
push 0x100
push 0xd
mov eax, dword [eax]
push dword [eax + 0x40]
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406258
sub ecx, edx
je 0x4062cf
lea eax, [esp + 0x10]
push eax
push ecx
push edi
call dword [sym.imp.msdk.dll_M_SetUserData]
test eax, eax
jne 0x4062c1
mov ecx, dword [esi + 4]
lea edx, [esp + 0x10]
sub esp, 0x28
mov eax, esp
mov dword [eax], vtable.std::_Func_impl_no_alloc_class__lambda_c6015375b1acbeedf7c9e598f8ec8a6e___void__class_CUsbHidCtrl__.0
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
mov dword [eax + 0x24], eax
mov ecx, dword [esi + 4]
mov ecx, dword [ecx]
call fcn.00405770
mov eax, dword [esi + 4]
push 0
push 0
push 0xf0
mov eax, dword [eax]
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jne 0x4062e3
push eax
push 0x42cc20
push 0x42cf0c
jmp 0x4062db
push 0
push 0x42cc20
push 0x42cf20
jmp 0x4062db
push 0
push 0x42cc20
push 0x42cf34
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x114]
pop edi
pop esi
xor ecx, esp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4