joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401340
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push dword [0x4229f4]
mov eax, dword [ebp - 8]
push str.FM_u
push 0x422c20
mov dword [0x414df8], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [0x414df8]
add esp, 0xc
add eax, eax
push 0x422c20
push eax
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov dword [0x422c04], eax
test eax, eax
jne 0x4013a6
push str.CreateFileMapping
call fcn.00401000
add esp, 4
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x422c00], eax
test eax, eax
jne 0x4013cf
push str.MapViewOfFile_DL
call fcn.00401000
add esp, 4
mov esp, ebp
pop ebp
ret
push 0
push dword [0x414df8]
push 0
push 2
push dword [0x422c04]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x422bfc], eax
test eax, eax
jne 0x4013fd
push str.MapViewOfFile_UL
call fcn.00401000
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x401490
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [0x422b2c]
cmp edx, 2
jle 0x4014d9
push esi
mov esi, 0x422a20
mov ecx, 0xffff
test edx, edx
je 0x4014bf
lea ebx, [ebx]
movzx eax, byte [esi]
add ecx, ecx
xor cx, ax
inc esi
movzx ecx, cx
dec edx
jne 0x4014b0
mov eax, ecx
shr eax, 8
cmp al, byte [esi]
jne 0x4014d3
cmp cl, byte [esi + 1]
jne 0x4014d3
pop esi
jmp fcn.00402390
pop esi
jmp fcn.00401940
ret

Function at 0x401700
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 8], 1
call fcn.00401940
lea eax, [ebp - 4]
push eax
push str.COM_Port
push str.CommunicationSerial
call fcn.00402000
xor ecx, ecx
cmp dword [ebp - 4], ecx
cmove eax, ecx
push eax
call fcn.00401790
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0xc]
push eax
push 0
lea eax, [ebp - 8]
push eax
push 0x4020c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x414de8], eax
test eax, eax
jne 0x401774
push str.CreateThread_RxUplink_failed.
call fcn.00401000
add esp, 4
xor eax, eax
mov dword [0x422d44], eax
pop esi
mov esp, ebp
pop ebp
ret
mov eax, esi
mov dword [0x422d44], 0
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x401790
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov al, byte [ebp + 8]
push ebx
push esi
push edi
mov bl, 1
mov bh, 2
test al, al
je 0x4017a5
mov bl, al
mov bh, al
movzx esi, bh
movzx eax, bl
cmp eax, esi
jg 0x401808
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push eax
push str..COM_d
push 0x422c40
call edi
add esp, 0xc
push 0
push 0x40000000
push 3
push 0
push 0
push 0xc0000000
push 0x422c40
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ecx, eax
mov dword [0x414de4], ecx
cmp ecx, 0xffffffff
jne 0x40180e
cmp bl, bh
je 0x4017fe
inc bl
movzx eax, bl
cmp eax, esi
jle 0x4017b5
jmp 0x40180e
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
mov ecx, dword [0x414de4]
push 0x422bc0
push ecx
call dword [sym.imp.KERNEL32.dll_GetCommState]
test eax, eax
je 0x401928
mov eax, dword [0x414010]
mov dword [0x41400c], eax
mov dword [0x422bc4], eax
mov eax, dword [0x422bc8]
or eax, 1
and eax, 0xffffefff
push 0x422bc0
push dword [0x414de4]
or eax, 0x2000
mov word [0x422bd2], 8
mov byte [0x422bd4], 0
mov byte [0x422bd9], 0x1a
mov dword [0x422bc8], eax
call dword [sym.imp.KERNEL32.dll_SetCommState]
test eax, eax
jne 0x401881
push 0x40e2f8
call fcn.00401000
add esp, 4
push 0x82
push dword [0x414de4]
call dword [sym.imp.KERNEL32.dll_SetCommMask]
test eax, eax
jne 0x4018a3
push str.SetCommMask_failed
call fcn.00401000
add esp, 4
push dword [0x414de4]
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
test eax, eax
jne 0x4018c0
push str.ClearCommBreak_failed
call fcn.00401000
add esp, 4
push 0x422bf0
push 0x422bbc
push dword [0x414de4]
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
jne 0x401902
push dword [0x422bf4]
push dword [0x422bbc]
push str.ClearCommError__failed._Errors_d__cbInQue_d
push 0x422c40
call fcn.00406fdc
push 0x422c40
call fcn.00401000
add esp, 0x14
push 0xf
push dword [0x414de4]
call dword [sym.imp.KERNEL32.dll_PurgeComm]
test eax, eax
jne 0x401921
push str.PurgeComm_failed
call fcn.00401000
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
push 0x40e2e8
call fcn.00401000
add esp, 4
push 0
call fcn.00406efe
int3
Function at 0x401be0
Capabilities:
Check mutex and terminate process on windows
Check mutex on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x414050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push str.EvRxServerLoaded
push 1
push 0
mov dword [0x4229f4], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401cca
lea eax, [ebp - 0x30]
push eax
push dword [0x4229f4]
mov dword [ebp - 0x30], 0x2c
call dword [sym.imp.USER32.dll_GetWindowPlacement]
lea eax, [ebp - 0x30]
push eax
push dword [0x4229f4]
mov dword [ebp - 0x28], 7
call dword [sym.imp.USER32.dll_SetWindowPlacement]
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push 1
push 0
call esi
push 0
push 0
push 0
push 0
mov dword [0x422b90], eax
call esi
push 0
push 0
push 0
push 0
mov dword [0x422b70], eax
call esi
push str.MutexReadWrite
push 0
push 0
mov dword [0x422b50], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x414dec], eax
pop esi
test eax, eax
jne 0x401ca2
push str.CreateMutex
call fcn.00401000
add esp, 4
call fcn.00401340
push 0
push 0x3e8
push 1
push dword [0x4229f4]
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040705e
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call fcn.00406efe
int3

Function at 0x402000
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x414050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
push eax
push str.SOFTWAREEricsson_ABPCS
lea eax, [ebp - 0x104]
push str._s_s
push eax
mov dword [ebp - 0x108], 0
mov dword [ebp - 0x110], 4
mov dword [esi], 0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4020aa
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push edi
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40209e
mov dword [esi], 1
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x108]
pop edi
xor ecx, ebp
pop esi
call fcn.0040705e
mov esp, ebp
pop ebp
ret
Function at 0x402450
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x414050]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov esi, edx
mov edi, ebx
mov ecx, 0xffff
test ebx, ebx
je 0x40248f
lea esp, [esp]
movzx eax, byte [esi]
add ecx, ecx
xor cx, ax
inc esi
movzx ecx, cx
dec edi
jne 0x402480
mov eax, ecx
shr eax, 8
mov byte [esi], al
mov byte [esi + 1], cl
lea ecx, [ebx + 2]
mov word [ebp - 0x218], 0x1b
lea esi, [ebp - 0x216]
test ecx, ecx
je 0x4024d9
nop
mov al, byte [edx]
dec ecx
lea edx, [edx + 1]
cmp al, 0x1b
jne 0x4024c4
mov word [esi], 0x21b
add esi, 2
jmp 0x4024d5
cmp al, 0x1a
jne 0x4024d2
mov word [esi], 0x11b
add esi, 2
jmp 0x4024d5
mov byte [esi], al
inc esi
test ecx, ecx
jne 0x4024b0
push 0xffffffffffffffff
push dword [0x414dec]
mov byte [esi], 0x1a
inc esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4024fc
push str.WaitForSingleObject_hMutexReadWrite_WRITING
call fcn.00401000
add esp, 4
mov ebx, dword [sym.imp.KERNEL32.dll_ClearCommError]
push 0x422bf0
push 0x422bbc
push dword [0x414de4]
call ebx
test eax, eax
je 0x4025b9
mov eax, dword [0x422bbc]
mov ecx, dword [0x414df4]
test eax, eax
cmovne ecx, eax
push 0x422b40
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x218]
sub esi, eax
push esi
push eax
push dword [0x414de4]
mov dword [0x414df4], ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4025b9
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3e5
jne 0x4025ac
mov edi, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea ecx, [ecx]
push 1
lea eax, [ebp - 0x21c]
push eax
push 0x422b40
push dword [0x414de4]
call edi
test eax, eax
jne 0x4025b9
call esi
mov dword [0x422bbc], eax
cmp eax, 0x3e4
je 0x402570
push 0x422bf0
push 0x422bbc
push dword [0x414de4]
call ebx
jmp 0x4025b9
push str.GetLastError_after_WriteFile
call fcn.00401000
add esp, 4
push dword [0x414dec]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040705e
mov esp, ebp
pop ebp
ret
Function at 0x402680
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
mov eax, dword [0x414050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x9c
lea eax, [ebp - 0xa0]
push 0
push eax
mov esi, 1
call fcn.004076f0
add esp, 0xc
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x4026e8
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0xa0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, esi
test eax, eax
cmove esi, ecx
mov eax, dword [ebp - 0x90]
sub eax, 0
je case.default.0x402761
dec eax
je 0x402768
dec eax
jne case.default.0x402761
mov eax, dword [ebp - 0x9c]
dec eax
cmp eax, 5
ja case.default.0x402761
jmp dword [eax*4 + 0x4027e0]
call fcn.00403280
mov esi, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040705e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x98]
sub eax, 0
je case.0x402711.1
dec eax
jne case.default.0x402761
call fcn.00403280
mov esi, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040705e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x98]
cmp eax, 3
ja case.default.0x402761
jmp dword [eax*4 + 0x4027f8]
cmp dword [ebp - 0x9c], 4
jne case.default.0x402761
mov eax, dword [ebp - 0x98]
test eax, eax
je 0x4027ce
cmp eax, 0xa
je 0x402785
cmp eax, 0x5a
jne case.default.0x402761
lea eax, [ebp - 0xa4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesClassOtxTelecomAdapter0000
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4027ce
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 2
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040705e
mov esp, ebp
pop ebp
ret
mov esi, 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040705e
mov esp, ebp
pop ebp
ret

Function at 0x402810
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x414050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jns 0x40285d
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x40286d
lea ecx, [ebp - 0x104]
push ecx
push 0x100
push edi
push eax
call sub.OtxHwDll.dll__OtxDrvResultCode2String_16
test eax, eax
js 0x40286d
lea eax, [ebp - 0x104]
push eax
push esi
push str.__s__OTX_ERROR__s
jmp 0x402874
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040705e
mov esp, ebp
pop ebp
ret
push edi
push esi
push str.__s__OTX_ERROR__d:_NO_ADDITIONAL_INFO
push 0x422c40
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push esi
push 0x422c40
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.00406efe
int3
Function at 0x402ef0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x414050]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
call sub.OtxHwDll.dll__OtxDrvConnectLib_0
push eax
push 0xffffffffffffffff
push str.OtxDrvConnectLib
call fcn.00402810
add esp, 0xc
lea eax, [ebp - 0x104]
push 0xff
push eax
push 9
push esi
call sub.OtxHwDll.dll__OtxDrvGetAttributeValueSz_16
push 0x4229e4
call sub.OtxHwDll.dll__OtxDrvCreateEvent_4
push eax
push 0xffffffffffffffff
push str.OtxDrvCreateEvent
call fcn.00402810
add esp, 0xc
push 0x4229e0
push dword [0x4229e4]
push 0x80
call sub.OtxHwDll.dll__OtxDrvCreateEventQueue_12
push eax
push dword [0x4229e0]
push str.OtxDrvCreateEventQueue
call fcn.00402810
add esp, 0xc
mov dword [0x414e10], 6
push 0x414020
push dword [0x4229e0]
push dword [0x414e04]
push esi
push 6
push esi
call sub.OtxHwDll.dll__OtxDrvOpenPhysicalDevice_24
test eax, eax
jns 0x402fc2
push 0x414020
push dword [0x4229e0]
mov dword [0x414e10], 7
push dword [0x414e04]
push esi
push 7
push esi
call sub.OtxHwDll.dll__OtxDrvOpenPhysicalDevice_24
test eax, eax
js 0x403031
mov eax, 0x4226f4
jmp 0x402fd0
mov dword [eax], esi
add eax, 0x18
cmp eax, 0x4229f4
jl 0x402fd0
call fcn.004028a0
test eax, eax
je 0x403031
push 0x4229e8
push 0
push 0x41401c
push 0x4030c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x4229ec], eax
test eax, eax
je 0x403042
push 4
push 0
push dword [0x4229e0]
call sub.OtxHwDll.dll__OtxDrvEnable_12
push eax
push dword [0x4229e0]
push str.OtxDrvEnable___event_handler
call fcn.00402810
add esp, 0xc
mov esi, 1
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0040705e
mov esp, ebp
pop ebp
ret
push 0
call fcn.00406efe
int3

Function at 0x403280
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x414050]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x80000001
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x4032b8
lea eax, [edi + 1]
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040705e
mov esp, ebp
pop ebp
ret
push esi
push 0x80000000
push str.OtxDrv
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
call edi
test esi, esi
jne 0x4032eb
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040705e
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x40330f
cmp dword [ebp - 0x1c], 4
je 0x403327
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jne 0x403327
push esi
call edi
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040705e
mov esp, ebp
pop ebp
ret
push esi
call edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 2
pop edi
call fcn.0040705e
mov esp, ebp
pop ebp
ret
Function at 0x4033d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 1
je 0x403427
push esi
call fcn.00403d39
add esp, 4
test eax, eax
je 0x403404
push eax
push esi
mov esi, dword [ebp + 8]
push esi
push str.__s__THOR_ERROR__d:__s
push 0x422c40
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x403443
cmp esi, 0x2e
je 0x40342a
cmp esi, 0x34
je 0x40341a
push esi
mov esi, dword [ebp + 8]
push esi
push str.__s__THOR_ERROR__d:_NO_ADDITIONAL_INFO
jmp 0x403435
mov esi, dword [ebp + 8]
push 0x34
push esi
push str.__s__THOR_ERROR__d:_The_driver_has_not_been_initialized._Running_Local__Remote_
jmp 0x403435
pop esi
pop ebp
ret
mov esi, dword [ebp + 8]
push 0x2e
push esi
push str.__s__THOR_ERROR__d:_Failed_to_open_driver_device._Driver_not_started_
push 0x422c40
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
push 0x10
push esi
push 0x422c40
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0xffffffffffffffff
call fcn.00406efe
int3

Function at 0x403a50
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
cmp dword [0x421948], 0
jne 0x403a77
mov eax, 0x34
jmp 0x403b49
cmp dword [ebp + 8], 0
jne 0x403a87
mov eax, 0x5e
jmp 0x403b49
cmp dword [0x4178a8], 0
je 0x403a9a
mov eax, 0x5f
jmp 0x403b49
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x4198c8], eax
cmp dword [0x4198c8], 0
jne 0x403ac0
mov eax, 0x33
jmp 0x403b49
mov eax, dword [0x4198c8]
mov dword [0x422d48], eax
mov ecx, dword [ebp + 8]
mov dword [0x422d4c], ecx
lea edx, [ebp - 4]
push edx
push 0
push 0x422d48
push 0x404e7c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 4], 0
jne 0x403afd
mov eax, 0x60
jmp 0x403b49
push 0
lea eax, [ebp - 8]
push eax
push 4
lea ecx, [ebp - 0xc]
push ecx
push 4
push 0x4198c8
push 0x801020d4
mov edx, dword [0x421948]
push edx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x403b2d
mov eax, 0x33
jmp 0x403b49
cmp dword [ebp - 8], 0
jne 0x403b3a
mov eax, 0x33
jmp 0x403b49
mov dword [0x4178a8], 1
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40b17a
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x414050]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.00407cef
mov dword [ebp - 0x14], eax
cmp dword [0x42269c], edi
jne 0x40b26b
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40b1f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b34b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40b34b
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b34b
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x42269c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x4226a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x4226a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4226ac], eax
test eax, eax
je 0x40b268
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4226a8], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b290
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b283
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40b2a5
push 4
pop eax
jmp 0x40b34d
cmp dword [ebp - 0x14], edi
je 0x40b2a5
push dword [0x42269c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b28a
mov eax, dword [0x4226a8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40b303
cmp dword [0x4226ac], esi
je 0x40b303
push eax
call ebx
push dword [0x4226ac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b303
test eax, eax
je 0x40b303
call ecx
test eax, eax
je 0x40b2f8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b2f8
test byte [ebp - 8], 1
jne 0x40b303
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40b333
mov eax, dword [0x4226a0]
cmp eax, esi
je 0x40b330
push eax
call ebx
test eax, eax
je 0x40b330
call eax
mov edi, eax
test edi, edi
je 0x40b330
mov eax, dword [0x4226a4]
cmp eax, esi
je 0x40b330
push eax
call ebx
test eax, eax
je 0x40b330
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x42269c]
call ebx
test eax, eax
je 0x40b34b
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40b34d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040705e
leave
ret
Function at 0x401e65
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x405108
cmp edx, dword [eax]
je 0x401e87
add eax, 8
inc ecx
cmp eax, 0x405198
jl 0x401e78
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x405108]
jne 0x401fb5
mov eax, dword [0x4054b8]
cmp eax, 1
je 0x401f8f
test eax, eax
jne 0x401eb8
cmp dword [0x405058], 1
je 0x401f8f
cmp edx, 0xfc
je 0x401fb5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x401eef
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00402410
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00402580
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x401f32
lea eax, [ebp - 0x1a4]
push eax
call fcn.00402580
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4043a0
push edi
call fcn.00403210
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00402410
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00402420
lea eax, [ebp - 0xa0]
push 0x404380
push eax
call fcn.00402420
push dword [esi + 0x40510c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00402420
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040317e
add esp, 0x2c
pop edi
jmp 0x401fb5
lea eax, [ebp + 8]
lea esi, [esi + 0x40510c]
push 0
push eax
push dword [esi]
call fcn.00402580
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x14d0fa28
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
xor ebx, ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x20000013
push dword [ebp + 8]
mov dword [ebp - 8], 4
mov dword [ebp - 0xc], ebx
call dword [0x14d12300]
test eax, eax
je 0x14d0fb16
cmp dword [ebp - 0xc], 0xc8
jne 0x14d0fb16
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp + 0xc]
call dword [0x14d12158]
mov esi, eax
cmp esi, 0xffffffff
je 0x14d0fb16
mov byte [ebp - 1], bl
push ebx
push dword [ebp + 0x10]
call dword [0x14d12150]
test eax, eax
je 0x14d0fabc
lea eax, [ebp - 8]
push eax
push 0x200
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 8]
call dword [0x14d122ec]
test eax, eax
jne 0x14d0fac0
mov byte [ebp - 1], 1
cmp dword [ebp - 8], ebx
je 0x14d0faf0
push ebx
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x210]
push eax
push esi
call dword [0x14d12190]
test eax, eax
je 0x14d0fae7
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
je 0x14d0faeb
mov byte [ebp - 1], 1
cmp byte [ebp - 1], bl
je 0x14d0fa91
push esi
call dword [0x14d121a0]
push esi
call dword [0x14d12140]
cmp byte [ebp - 1], bl
je 0x14d0fb0c
push dword [ebp + 0xc]
call fcn.14d0eab6
pop ecx
xor eax, eax
cmp byte [ebp - 1], bl
sete al
jmp 0x14d0fb18
xor al, al
pop esi
pop ebx
leave
ret

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
mov ebx, 0x40915c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x46a863a5
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x4d3b2e8e
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219