joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000d530
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x1000d588
cmp byte [esi + ebx - 1], 0xa
je 0x1000d55c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10022084], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x33d2368a
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x432060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6e762aad
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4320c0
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x43c983
Capabilities:
Encode data using base64

Disassembly:
push word [esp + 2]
jmp 0x47adda
jmp 0x47ad69
cmp edi, eax
call fcn.0047ad3e
call fcn.0047a70b
push ebx
les ebx, [edx + 0x3d]
int3
lea esp, [esp + 2]
lea esp, [esp + 4]
jae 0x43c9af
lea ecx, [edi + 0x47]
jmp 0x43c9c5
Function at 0x44d2a5
Capabilities:
Execute anti-debugging instructions

Disassembly:
ror edi, 0
jbe 0x44d2c2
inc al
jmp 0x44d2ac
mov ecx, ebx
mov byte [esp], al
jmp 0x44d28f
mov ecx, 0x966d1f20
xchg dl, cl
lea edx, [esi*4]
jmp 0x44d3cf
inc al
mov ecx, 0x966d1f20
xchg dl, cl
lea edx, [esi*4]
xchg cx, ax
lea esp, [esp + 4]
add edi, 0x78a40819
lea edx, [esi - 0xc7]
jmp 0x44d389
add edi, 0x77ccfe39
btc eax, ecx
je 0x44d3a6
lea edx, [ebp*4]
rdtsc
rdtsc
jmp 0x44d3a8
bsf ecx, ebx
jle 0x44d36b
jg 0x44d36b
lea edx, [ebp*4]
rdtsc
rdtsc
jmp 0x44d3a8
jmp 0x44d390
add edi, dword [esi]
dec cx
jmp 0x44d3d6
not cx
bsf ecx, ebp
jmp fcn.0044d3e4
xchg cx, ax
call fcn.0044d35b
jnp 0x44d3b2
not cx
bsf ecx, ebp
jmp fcn.0044d3e4

Function at 0x44f240
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x44efd3
not ax
mov ax, bx
rdtsc
jmp 0x44f018
xchg edx, eax
xchg dh, ah
xchg ah, dl
jmp 0x44f002
jo 0x44efaa
not ax
mov ax, bx
rdtsc
xchg edx, eax
xchg dh, ah
jmp 0x44f01b
lea eax, [eax + esi]
lea eax, reloc.mscoree.dll__CorExeMain
neg eax
jl 0x44f2e5
jge 0x44f2fd
dec eax
jmp 0x44f1e5
xchg byte [esp], ah
jmp 0x44f2e7
jmp 0x44f2cf
lea esp, [esp + 4]
neg cl
lea eax, reloc.mscoree.dll__CorExeMain
bswap eax
rcl eax, cl
jmp 0x44f381
xchg byte [esp], ah
jmp 0x44f2e7
mov dx, di
lea edx, [ecx + edx]
shr dh, cl
inc dx
ror cl, 0
bswap edx
jmp 0x44f32d
bsf eax, edx
push dword [esp]
ret 4
mov dx, word [esp]
push ebp
mov ax, bp
bt edx, edi
jo 0x44f36a
jno 0x44f36a
jg 0x44f324
je 0x44f353
out dx, al
pop eax
mov ebx, dword [ebx]
mov ebp, esi
sbb eax, 0x68c9fedd
mov esp, dword [edx]
pop ebp
shr dh, cl
inc dx
jmp 0x44f30c
mov eax, 0x424648d
lea esp, [esp + 4]
sub cl, 0x89
xchg dx, ax
push edx
mov eax, dword [esp + 2]
jmp 0x44f3a8
jmp 0x44f354
js 0x44f302
mov dx, di
lea edx, [ecx + edx]
jmp 0x44f34e
not edx
lea esp, [esp + 2]
jmp 0x44f3b7
mov byte [esp + 1], bh
push word [esp + 3]
je 0x44f38f
not edx
jmp 0x44f3d1
lea esp, [esp + 4]
not cl
mov ah, 0x44
bsr edx, ecx
jae 0x44f3ed
bsf eax, edi
bsr edx, esp
jmp 0x44f3ef
lea esp, [esp + 2]
jmp 0x44f3b7
bsf eax, edi
bsr edx, esp
jmp 0x44f3ef
jmp 0x44f3d7
rol cl, 0
lea eax, [ebp + ebp]
bsr edx, eax
jno 0x44f457
jo 0x44f42a
mov ecx, dword [edx]
cwde
dec dword [edx]
mov eax, 0x48b422b
and al, 0xe9
add al, 0xfe
invalid
not dx
sub esp, 4
mov dword [esp], esp
jmp 0x44f43d
dec al
jmp 0x44f459
not dx
sub esp, 4
mov dword [esp], esp
jmp 0x44f43d
mov edx, dword [esi]
mov al, cl
mov ax, bp
mov al, byte [esp]
bswap eax
jmp 0x44f478
dec al
and ecx, 0x3c
inc ah
jnp 0x44f40d
jp 0x44f42e
mov cl, byte [esp]
call fcn.0044f488
mov cl, 0x34
stosb byte es:[edi], al
int 0x3c
mov ch, byte [ecx + 0x23d0b121]
xchg ebx, eax
loopne 0x44f49b
mov dword [ecx + ebp], edx
lea edx, reloc.mscoree.dll__CorExeMain
bswap ecx
add esi, 4
jmp 0x44f462
add byte [eax], al
Function at 0x47aaa8
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
push ebx
pop word [esp]
jmp 0x47aad7
call fcn.0047ab1e
mov edx, esp
mov dx, word [esp]
mov edx, 0xc202f588
bswap edx
jmp 0x47ab68
mov dword [esp], esi
mov byte [esp + 2], bl
lea esp, [esp + 4]
jae 0x43c863
jb 0x47aaed
fiadd word [esi - 0x2c]
mov bl, 0x4e
std
insb byte es:[edi], dx
sti
imul ecx, dword [esi], reloc.mscoree.dll__CorExeMain
dec ebp
pop esi
test eax, 0x5d8b6bc8
or al, 0x8d
and al, 8
lea esp, [esp + 2]
jmp 0x47ab42
mov edx, dword [esp]
mov edx, dword [esp]
lea edx, [ecx + 0x41]
jmp 0x43c8ac
cmp ecx, 0x34
jae 0x43c88f
mov edx, 0x6dc5d0e5
jmp 0x47ab16
lea edx, [ecx - 4]
jmp 0x43c8ac

Function at 0x47ab1e
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
call 0x47ab52
xchg edx, eax
adc byte [edx], dh
mov ah, 0x26
pop ecx
sub bh, byte [ecx]
jge 0x43c942
mov esi, 0xb76dd884
add bl, al
xchg cx, ax
adc byte [ebx - 0x99aa9a], dl
je 0x43c906
add edi, edi
je 0x43c90a
add ch, cl
invalid
inc ebp
mov al, byte [0x87e6f325]
out 0x87, al
mov bh, 0x85
pop edi
or ah, byte [ebp - 0x17cb82c]
xor al, 0xe9
add ebx, esp
add eax, dword [eax]
xor bh, byte [0xabcf685]
outsb dx, byte [esi]
sbb al, 0x63
fucomp st(6)
stc
fdivr dword [ebx]
add eax, dword [eax]
adc eax, 0x33e4f0ac
out 0xa5, eax
mov eax, dword [reloc.mscoree.dll__CorExeMain]
sahf
adc bl, byte [edx + esi*4 - 0x516119da]
ret
cmp ecx, eax
lea esp, [esp + 4]
jae 0x43c8c2
jb 0x43c894
pop ecx
stc
imul ecx, dword [eax], reloc.mscoree.dll__CorExeMain
dec eax
das
fisubr dword [edi - 0x45]
xchg edx, eax
or eax, 0x83f6ef9c
stc
xor al, 0xf
add dword [ebp + ebx - 4], 0xffffffff

Function at 0x47ab93
Capabilities:
Encode data using base64
Encrypt data using speck

Disassembly:
mov al, 0xe6
mov byte [esp + 2], dl
mov dword [esp + 0x18], ebp
pushal
jmp 0x47abc5
lea esp, [esp + 0x24]
popal
lea edx, [edx + 8]
mov ecx, dword [edx]
pop edx
jmp 0x47abaf

Function at 0x47ac2c
Capabilities:
Encode data using base64

Disassembly:
xor ecx, ecx
cmc
call fcn.0047ac86
inc ebx
or byte [ecx + ecx*8], cl
sbb bh, al
int1
test eax, 0x1c8d12d2
outsd dx, dword [esi]
mov byte [esp + 1], dh
push dword [esp]
lea esp, [esp + 8]
jae 0x43c929
jb 0x47abfe
test dword [ebx], edx
and esi, 0x15
movsd dword es:[edi], dword [esi]
push ss
add dword [eax + 3], 0x2b95148d
add byte [eax], al
add cl, ch
push edi
sbb al, 0xfc
dec dword [ebp + reloc.mscoree.dll__CorExeMain]
add byte [eax], al
jmp 0x43c8f2

Function at 0x47ac88
Capabilities:
Encode data using base64

Disassembly:
lea esp, [esp + 4]
cmp dword [ebp + 0xc], 2
mov edx, dword [esp]
jmp 0x43c8f7

Function at 0x47acdd
Capabilities:
Encode data using base64

Disassembly:
mov ecx, dword [esp]
pop cx
lea esp, [esp + 2]
jmp 0x47ad06
lea ecx, [edi + 0x41]
jmp 0x43c9c5

Function at 0x47ad3e
Capabilities:
Encode data using base64

Disassembly:
call 0x47ad70
pop word [esp]
lea esp, [esp + 2]
jae 0x47a706
jb 0x47ad52
and al, 0x57
mov esi, 0x7c73b989
cdq
xchg edi, eax
mov ecx, 0x97997c73
lea ecx, [edx + ebp]
bswap ecx
jmp 0x47ad86
lea ecx, [edi - 4]
jmp 0x43c9c5
Function at 0x47adf0
Capabilities:
Encrypt data using speck

Disassembly:
pushfd
pushal
jmp 0x47ae15
lea esp, [esp + 2]
lea esp, [esp + 2]
jmp 0x47ae4a
push sp
lea esp, [esp + 2]
lea ecx, [ebx + 0x41]
jmp 0x47a769
cmp ebx, 0x1a
jae 0x47a73d
mov ch, byte [esp]
mov cl, 0x93
jmp 0x47ae2b
Function at 0x5013ec
Capabilities:
Decrypt data using tea
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
push edi
mov edi, dword [esi]
mov edx, 0xc6ef3720
mov ecx, dword [eax]
mov eax, dword [eax + 4]
mov dword [esp + 0x18], edi
mov edi, dword [esi + 4]
mov dword [esp + 0x14], edi
mov edi, dword [esi + 8]
mov esi, dword [esi + 0xc]
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], esi
mov edi, 0x20
mov ebx, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
mov esi, ecx
shr esi, 5
add esi, ebx
mov ebx, ecx
shl ebx, 4
add ebx, ebp
mov ebp, dword [esp + 0x18]
xor esi, ebx
lea ebx, [edx + ecx]
xor esi, ebx
mov ebx, dword [esp + 0x14]
sub eax, esi
mov esi, eax
shr esi, 5
add esi, ebx
mov ebx, eax
shl ebx, 4
add ebx, ebp
xor esi, ebx
lea ebx, [edx + eax]
xor esi, ebx
sub ecx, esi
add edx, 0x61c88647
dec edi
jne 0x501425
mov edx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
mov dword [edx], ecx
mov dword [edx + 4], eax
pop ebx
add esp, 0xc
ret
Function at 0x74eb62
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ax
lea esp, [esp + 2]
mov dword [esp], edi
mov eax, dword fs:[0x30]
jmp 0x74eb1e
Function at 0x405b70
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
movzx eax, word [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 8]
nop
mov edi, edx
shl edi, 0xf
sar di, 0xf
mov esi, edi
and esi, 0xa000
shr esi, 1
mov ebx, edx
shr ebx, 1
xor ebx, edi
and ebx, 1
test bx, bx
je 0x405ba7
or esi, 0xa001
mov edi, esi
shr edi, 1
mov ebx, edx
shr ebx, 2
xor ebx, esi
and ebx, 1
test bx, bx
je 0x405bc0
xor edi, 0xa001
mov esi, edi
shr esi, 1
and esi, 0x7fff
mov ebx, edx
shr ebx, 3
xor ebx, edi
and ebx, 1
test bx, bx
je 0x405bdf
xor esi, 0xa001
mov edi, esi
shr edi, 1
mov ebx, edx
shr ebx, 4
xor ebx, esi
and ebx, 1
test bx, bx
je 0x405bf8
xor edi, 0xa001
mov esi, edi
shr esi, 1
mov ebx, edx
shr ebx, 5
xor ebx, edi
and ebx, 1
test bx, bx
je 0x405c11
xor esi, 0xa001
mov edi, esi
shr edi, 1
and edi, 0x7fff
mov ebx, edx
shr ebx, 6
xor ebx, esi
and ebx, 1
test bx, bx
je 0x405c30
xor edi, 0xa001
mov esi, edi
shr esi, 1
mov ebx, edx
shr ebx, 7
xor ebx, edi
and ebx, 1
test bx, bx
je 0x405c49
xor esi, 0xa001
mov word [edx + edx + 0x42e700], si
inc edx
cmp dx, 0x100
jne 0x405b80
xor edx, edx
test ax, ax
je 0x405c88
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, dl
movzx esi, byte [ecx]
xor esi, edi
movzx edx, dh
xor dx, word [esi + esi + 0x42e700]
inc ecx
dec ax
jne 0x405c70
movzx eax, dx
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x40604f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov cl, 0x22
mov al, byte [esi]
cmp al, cl
jne 0x40607b
mov al, byte [esi + 1]
inc esi
cmp al, cl
je 0x406074
test al, al
jne 0x406068
cmp byte [esi], cl
jne 0x406085
inc esi
jmp 0x406085
cmp al, 0x20
jle 0x406085
inc esi
cmp byte [esi], 0x20
jg 0x40607f
mov al, byte [esi]
test al, al
je 0x40608f
cmp al, 0x20
jle 0x406078
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x4060a9
movzx ebx, word [ebp - 0x14]
jmp 0x4060ac
push 0xa
pop ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0
push 0
push edi
call fcn.0040699e
test eax, eax
je 0x406111
call fcn.00406280
test eax, eax
je 0x4060f4
push edi
push 1
call fcn.004062a7
pop ecx
test eax, eax
pop ecx
je 0x4060f4
push 0
push str.This_Demo_of_LabWindows_CVI_has_expired.
push 0x40a5d0
call fcn.00406c3b
add esp, 0xc
or esi, 0xffffffff
jmp 0x40610a
push ebx
push esi
push 0
push edi
call fcn.00406fbe
mov esi, eax
call fcn.00406848
call fcn.004068d5
call fcn.00406a82
jmp 0x406114
or esi, 0xffffffff
push esi
call fcn.00406f7e
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4062a7
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
and byte [ebp - 1], 0
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0xc], ebx
call fcn.00406298
push ebx
mov edi, eax
mov esi, edx
call sub.cvirte.dll_time
pop ecx
xor ecx, ecx
cmp esi, ecx
jl 0x4062fe
jg 0x4062d8
cmp edi, eax
jbe 0x4062fe
sub edi, eax
mov eax, 0x3e8
sbb esi, ecx
add dword [ebp - 0xc], edi
adc ebx, esi
dec eax
jne 0x4062e1
cmp ebx, ecx
mov eax, 0x927c0
jg 0x406307
jl 0x4062f9
cmp dword [ebp - 0xc], eax
jae 0x406307
mov dword [ebp - 0xc], eax
jmp 0x406305
mov dword [ebp - 0xc], 0x927c0
xor ebx, ebx
cmp ebx, ecx
mov eax, 0xfc5d36bf
jg 0x40631a
jl 0x406317
cmp dword [ebp - 0xc], eax
jae 0x40631a
mov eax, dword [ebp - 0xc]
push 0x4065ce
push eax
push ecx
push ecx
call fcn.004065a4
xor ebx, ebx
mov dword [0x42e37c], eax
cmp eax, ebx
je 0x406409
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
je 0x406373
call edi
push eax
lea eax, [ebp - 0x10c]
push 0x40a628
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x406409
push 0x104
push 0x42e068
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4063ab
mov al, byte [str.Unknown_DLL_EXE]
test al, al
mov byte [0x42e068], al
je 0x4063ab
xor eax, eax
mov cl, byte [eax + 0x40a639]
mov byte [eax + 0x42e069], cl
inc eax
test cl, cl
jne 0x40639a
call edi
push eax
lea eax, [ebp - 0x10c]
push str.CVI_Demo_Last_Time_Timer_Called___d
push eax
call esi
lea eax, [ebp - 0x10c]
push eax
push 4
push ebx
push 4
push ebx
push 0xffffffffffffffff
call fcn.00406eae
add esp, 0x24
cmp eax, ebx
mov dword [0x42e380], eax
je 0x406409
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4063ed
mov byte [ebp - 1], 1
push ebx
push ebx
push ebx
push 2
push dword [0x42e380]
call fcn.00406d7c
add esp, 0x14
cmp eax, ebx
mov dword [0x42e384], eax
jne 0x40640e
push 1
pop eax
jmp 0x406423
cmp byte [ebp - 1], 0
je 0x406421
call fcn.00406428
mov ecx, dword [0x42e384]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40643f
Capabilities:
Check mutex on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [0x42e388], 0
je 0x406455
xor eax, eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x114]
push str.National_Instruments_LabWindows_CVI_Startup_library__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [ebp - 8], eax
jne 0x40648e
push 0xfffffffffffffffd
pop eax
leave
ret
push ebx
push esi
push edi
or edi, 0xffffffff
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x42e388], 0
jne 0x406589
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.winmm.dll
call esi
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x4064c4
mov esi, edi
jmp 0x40658b
push str.advapi32.dll
call esi
mov ebx, eax
test ebx, ebx
je 0x4064bd
push 0x40a6c0
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x4064bd
push 0x40a6d0
call esi
mov edi, eax
test edi, edi
jne 0x4064f4
or esi, 0xffffffff
jmp 0x40658b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push dword [ebp - 0xc]
call esi
test eax, eax
mov dword [0x42e374], eax
je 0x406564
push str.RegOpenKeyExA
push ebx
call esi
test eax, eax
mov dword [0x42e370], eax
je 0x406564
push str.RegQueryValueExA
push ebx
call esi
test eax, eax
mov dword [0x42e064], eax
je 0x406564
push str.GetFileTime
push dword [ebp - 4]
call esi
test eax, eax
mov dword [0x42e36c], eax
je 0x406564
push str.KillTimer
push edi
call esi
test eax, eax
mov dword [0x42e378], eax
je 0x406564
push str.SetTimer
push edi
call esi
test eax, eax
mov dword [0x42e060], eax
jne 0x40657f
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push ebx
call esi
push dword [ebp - 4]
call esi
push edi
call esi
push 0xfffffffffffffffe
pop esi
jmp 0x40658b
mov dword [0x42e388], 1
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406dcb
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
xor edi, edi
cmp dword [0x42e444], edi
je 0x406de8
push 1
pop eax
jmp 0x406e6b
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x108]
push str.National_Instruments_LabWindows_CVI_Startup_SDK_stubs__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, edi
jne 0x406e1d
xor eax, eax
jmp 0x406e6b
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x42e444], edi
jne 0x406e52
push 0x40ab90
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
mov dword [0x42e444], eax
jne 0x406e52
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x42e444], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x42e444], edi
setne al
pop edi
pop esi
leave
ret
Function at 0x4044cb
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1400
call fcn.0040f630
mov eax, dword [0x28278e4]
mov ecx, dword [0x2827370]
push esi
shr eax, 3
xor esi, esi
cmp eax, esi
jbe 0x4045a1
push ebx
push edi
mov edi, ecx
mov ebx, eax
cmp dword [0x28278e4], 0x959
jne 0x40458f
push esi
lea eax, [ebp - 0x800]
push eax
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateJobObjectW]
push esi
push esi
lea eax, [ebp - 0xc00]
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumDateFormatsW]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x403f20
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
push 0x403f6c
push esi
call dword [sym.imp.KERNEL32.dll_FatalAppExitA]
push 0x403f78
push esi
call dword [sym.imp.KERNEL32.dll_SetFileShortNameW]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessShutdownParameters]
push esi
lea eax, [ebp - 0x1400]
push eax
push esi
push 0x403fb0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LCMapStringW]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push edi
call fcn.00404374
add edi, 8
dec ebx
jne 0x4044f7
pop edi
pop ebx
pop esi
leave
ret
Function at 0x4048e2
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x1004
call fcn.0040f630
push ebx
push esi
xor esi, esi
cmp dword [0x28278e4], 0x400
push edi
jne 0x4049ff
push esi
call dword [sym.imp.USER32.dll_GetDC]
push esi
lea eax, [esp + 0x414]
push eax
push esi
push 0x404148
push esi
call dword [sym.imp.KERNEL32.dll_FoldStringA]
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
push esi
push esi
lea eax, [esp + 0x818]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasW]
push esi
lea eax, [esp + 0x14]
push eax
push 0x404160
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0x404170
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DrawStateA]
push esi
call fcn.00404f4d
pop ecx
push esi
push esi
call fcn.00405083
push esi
call fcn.00405739
add esp, 0xc
push esi
call fcn.0040598b
fldz
sub esp, 0xc
fst qword [esp + 8]
fstp qword [esp]
call fcn.00404ae0
add esp, 8
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404d00
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.004051d0
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00404e30
fstp st(0)
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00405430
fstp st(0)
push esi
push esi
call fcn.00405584
push esi
call fcn.004059ff
add esp, 0x14
push esi
push esi
call fcn.00404f87
push esi
call fcn.0040579e
add esp, 0xc
mov ebx, dword [sym.imp.GDI32.dll_GetCharWidthI]
xor edi, edi
cmp edi, 0x9a1
jge 0x404a2b
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.USER32.dll_SetClipboardViewer]
push esi
push esi
push esi
push esi
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_GetSysColorBrush]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp edi, 0x4f47a90
jg 0x404a4d
inc edi
cmp edi, 0x32ffca9
jl 0x404a07
xor edi, edi
cmp edi, 0x16d2a
jge 0x404a5e
push esi
push esi
push esi
push esi
push esi
call ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp edi, 0x12e82fe
jg 0x404a7c
inc edi
cmp edi, 0x3011b
jl 0x404a4f
mov eax, dword [0x42fcbc]
mov dword [0x28278e4], eax
call fcn.004045a4
mov edi, 0x2ec37
cmp dword [0x28278e4], 0x51f
jne 0x404aab
push esi
lea eax, [esp + 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec edi
jne 0x404a90
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40a711
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42c490]
jne 0x40a71b
repz ret
jmp fcn.0040f2f7
Function at 0x40ef8c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42c490]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040a0bb
and dword [ebp - 0x14], 0
cmp dword [0x4445a0], 0
mov dword [ebp - 0x18], eax
jne 0x40f03f
push 0x4036c0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40f0e7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4036b4
push ebx
call edi
test eax, eax
je 0x40f0e7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x4036a4
push ebx
mov dword [0x4445a0], eax
call edi
push eax
call esi
push 0x403690
push ebx
mov dword [0x4445a4], eax
call edi
push eax
call esi
push 0x403674
push ebx
mov dword [0x4445a8], eax
call edi
push eax
call esi
mov dword [0x4445b0], eax
test eax, eax
je 0x40f03f
push 0x40365c
push ebx
call edi
push eax
call esi
mov dword [0x4445ac], eax
mov eax, dword [0x4445ac]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40f098
cmp dword [0x4445b0], ecx
je 0x40f098
push eax
call esi
push dword [0x4445b0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40f098
test ebx, ebx
je 0x40f098
call edi
test eax, eax
je 0x40f08f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40f08f
test byte [ebp - 8], 1
jne 0x40f098
or dword [ebp + 0x10], 0x200000
jmp 0x40f0cb
mov eax, dword [0x4445a4]
cmp eax, dword [ebp - 0x18]
je 0x40f0cb
push eax
call esi
test eax, eax
je 0x40f0cb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40f0cb
mov eax, dword [0x4445a8]
cmp eax, dword [ebp - 0x18]
je 0x40f0cb
push eax
call esi
test eax, eax
je 0x40f0cb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4445a0]
call esi
test eax, eax
je 0x40f0e7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40f0e9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040a711
leave
ret