joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414c90
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push edi
push esi
push str._s.
push 0x105
push eax
call fcn.004038d0
add esp, 0x10
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, dword [ebp + 0xc]
mov edi, eax
cmp edi, 0xffffffff
je 0x414dd9
nop word [eax + eax]
cmp dword [ebp - 0x24c], 0x10
lea eax, [ebp - 0x220]
je 0x414d2c
push eax
push esi
push str._s_s
lea eax, [ebp - 0x10c]
push 0x105
push eax
call fcn.004038d0
add esp, 0x14
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x414dbc
mov ecx, 0x45b9e4
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x414d51
test dl, dl
je 0x414d4d
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x414d51
add eax, 2
add ecx, 2
test dl, dl
jne 0x414d31
xor eax, eax
jmp 0x414d56
sbb eax, eax
or eax, 1
test eax, eax
je 0x414dbc
mov eax, 0x45b9e8
lea ecx, [ebp - 0x220]
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x414d85
test dl, dl
je 0x414d81
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x414d85
add ecx, 2
add eax, 2
test dl, dl
jne 0x414d65
xor eax, eax
jmp 0x414d8a
sbb eax, eax
or eax, 1
test eax, eax
je 0x414dbc
lea eax, [ebp - 0x220]
push eax
push esi
push str._s_s
lea eax, [ebp - 0x10c]
push 0x105
push eax
call fcn.004038d0
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00414c90
add esp, 0x1c
lea eax, [ebp - 0x24c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x414cf0
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp bl, 1
jne 0x414de5
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b572
mov esp, ebp
pop ebp
ret

Function at 0x414e60
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
imul esi, ebx, 0x58
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov byte [esi + 0x4c1901], 1
nop dword [eax]
push 0xa
call edi
cmp byte [esi + 0x4c1901], 1
je 0x414e90
push dword [esi + 0x4c1904]
push ebx
call fcn.00415640
push ebx
push 0x4b07dc
push str._sBlocCodeBLOC_04u.TXT
lea eax, [ebp - 0x10c]
push 0x105
push eax
call fcn.004038d0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x10c]
add esp, 0x1c
push eax
call esi
push ebx
push 0x4b07dc
push str._sBlocDllBLOC_04u.DLL
lea eax, [ebp - 0x10c]
push 0x105
push eax
call fcn.004038d0
add esp, 0x14
lea eax, [ebp - 0x10c]
push eax
call esi
imul eax, ebx, 0x8c
push 0x4b07c8
mov byte [eax + 0x4b84b8], 0
mov byte [eax + 0x4b84ba], 0
call fcn.004129f0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov al, 1
pop edi
pop esi
pop ebx
call fcn.0043b572
mov esp, ebp
pop ebp
ret
Function at 0x415640
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
imul esi, edi, 0x16
mov dword [ebp - 0x110], ebx
add esi, ebx
mov eax, dword [esi*4 + 0x4c1908]
test eax, eax
je 0x41572c
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push edi
push 0x4b07dc
push str._sWorkBLOC_04u.DL_u
lea eax, [ebp - 0x10c]
mov dword [esi*4 + 0x4c1908], 0
push 0x105
push eax
call fcn.004038d0
add esp, 0x18
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [sym.imp.KERNEL32.dll_HeapFree]
xor ebx, ebx
imul edi, edi, 0xb
add edi, dword [ebp - 0x110]
cmp dword [edi*8 + 0x4c1930], ebx
jle 0x415716
xor esi, esi
mov eax, dword [edi*8 + 0x4c1934]
mov eax, dword [esi + eax]
test eax, eax
je 0x415709
push eax
push 0
push dword [0x47ceb8]
call ecx
mov eax, dword [edi*8 + 0x4c1934]
push dword [eax + esi + 0xc]
push 0
push dword [0x47ceb8]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [sym.imp.KERNEL32.dll_HeapFree]
inc ebx
add esi, 0x10
cmp ebx, dword [edi*8 + 0x4c1930]
jl 0x4156d1
mov eax, dword [edi*8 + 0x4c1934]
test eax, eax
je 0x41572c
push eax
push 0
push dword [0x47ceb8]
call ecx
mov ecx, dword [ebp - 4]
mov al, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043b572
mov esp, ebp
pop ebp
ret
Function at 0x415740
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._MEMORY:
push eax
call fcn.0043cc10
add esp, 8
test eax, eax
je 0x415878
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push str._MEMORY:
push eax
call fcn.0043cc10
add eax, 8
push eax
lea eax, [ebp - 0x10c]
push 0x105
push eax
call fcn.0043f2f3
xor eax, eax
add esp, 0x14
cmp byte [ebp - 0x10c], al
je 0x4157d0
nop word [eax + eax]
cmp byte [ebp + eax - 0x10c], 0x2f
je 0x4157c5
inc eax
cmp byte [ebp + eax - 0x10c], 0
jne 0x4157b0
cmp eax, 0x105
jae 0x4158c4
mov byte [ebp + eax - 0x10c], 0
lea eax, [ebp - 0x10c]
push eax
push 0x105
push esi
call fcn.0043f2f3
mov ecx, esi
add esp, 0xc
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4157f2
sub ecx, edx
je 0x41583d
nop dword [eax]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x415805
sub eax, edx
cmp byte [eax + esi - 1], 0x20
jne 0x41583d
mov ecx, esi
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415820
sub ecx, edx
mov byte [ecx + esi - 1], al
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415832
sub ecx, edx
jne 0x415800
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415842
sub ecx, edx
cmp byte [ecx + esi - 1], 0x5c
je 0x415886
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415857
sub ecx, edx
mov eax, 0x105
push 0x45b66c
sub eax, ecx
push eax
push esi
call fcn.0043f34d
add esp, 0xc
jmp 0x415886
push 0x104
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push esi
call fcn.0043cad0
add esp, 8
mov ecx, esi
sub ecx, eax
add ecx, 0x104
push ebx
push ecx
push 0x5c
push esi
call fcn.0043cad0
add esp, 8
inc eax
push eax
call fcn.0043f2f3
mov ecx, dword [ebp - 4]
add esp, 0xc
mov eax, esi
xor ecx, ebp
pop esi
pop ebx
call fcn.0043b572
mov esp, ebp
pop ebp
ret
call fcn.0043b497
int3
Function at 0x4158f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x280
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 1
lea eax, [ebp - 0x10c]
push esi
jne 0x415a34
push 0x45b9d8
push str.IsiSave.ctx
push eax
call fcn.00415740
add esp, 8
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.0043f4a5
add esp, 0xc
test eax, eax
jne 0x415b28
push dword [ebp - 0x280]
lea eax, [ebp - 0x11c]
push 1
push 0x10
push eax
call fcn.0043f901
add esp, 0x10
lea ecx, [ebp - 0x11c]
mov edx, 0x4b8448
mov esi, 0xc
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x415a0a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x415970
push dword [ebp - 0x280]
call fcn.00448048
add esp, 4
test eax, eax
jne 0x415a17
nop dword [eax + eax]
push dword [ebp - 0x280]
lea eax, [ebp - 0x27c]
push 1
push 0x160
push eax
call fcn.0043f901
add esp, 0x10
cmp eax, 1
jne 0x415a17
lea eax, [ebp - 0x274]
push eax
push dword [ebp - 0x278]
mov eax, dword [ebp - 0x27c]
push eax
push eax
call fcn.00420bd0
push dword [ebp - 0x280]
call fcn.00448048
add esp, 0x14
test eax, eax
je 0x4159a0
push dword [ebp - 0x280]
call fcn.0043f6f8
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b572
mov esp, ebp
pop ebp
ret
push str.Restoring_objects_values_failed_due_to_project_ID_mismatch
call fcn.0040e800
add esp, 4
push dword [ebp - 0x280]
call fcn.0043f6f8
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b572
mov esp, ebp
pop ebp
ret
push 0x45b9d4
push str.IsiSave.ctx
push eax
call fcn.00415740
add esp, 8
push eax
lea eax, [ebp - 0x280]
push eax
call fcn.0043f4a5
add esp, 0xc
test eax, eax
jne 0x415b16
push ebx
push dword [ebp - 0x280]
push 1
push 0x10
push 0x4b8448
call fcn.0044ad23
mov eax, dword [0x4c165c]
add esp, 0x10
xor ebx, ebx
test eax, eax
jle 0x415af8
push edi
mov edi, 0x4c1668
nop dword [eax + eax]
mov ecx, dword [edi - 8]
xor esi, esi
mov dword [ebp - 0x27c], ecx
cmp dword [edi], esi
jle 0x415aef
nop
mov eax, dword [edi - 4]
lea edx, [ebp - 0x274]
push edx
add eax, esi
push eax
push ecx
push ecx
mov dword [ebp - 0x278], eax
call fcn.00420a30
add esp, 0x10
cmp al, 1
jne 0x415add
push dword [ebp - 0x280]
lea eax, [ebp - 0x27c]
push 1
push 0x160
push eax
call fcn.0044ad23
add esp, 0x10
inc esi
cmp esi, dword [edi]
jge 0x415aea
mov ecx, dword [ebp - 0x27c]
jmp 0x415aa0
mov eax, dword [0x4c165c]
inc ebx
add edi, 0xc
cmp ebx, eax
jl 0x415a90
pop edi
push dword [ebp - 0x280]
call fcn.0043f6f8
add esp, 4
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b572
mov esp, ebp
pop ebp
ret
push 0x4b08e1
push str.Unable_to_save_objects_values_while_closing_project__s
call fcn.0040e800
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043b572
mov esp, ebp
pop ebp
ret
Function at 0x416200
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 1
push esi
jne 0x416312
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
mov word [0x509194], ax
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0x4365a0
push 0
push 0
call esi
mov dx, word [0x509194]
movsx ecx, dx
inc dx
cmp byte [0x4b0779], 1
mov word [0x509194], dx
mov dword [ecx*4 + 0x508d98], eax
jne 0x4162de
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0x436bd0
push 0
push 0
call esi
mov dx, word [0x509194]
movsx ecx, dx
inc dx
mov word [0x509194], dx
mov dword [ecx*4 + 0x508d98], eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0x437e40
push 0
push 0
call esi
mov dx, word [0x509194]
movsx ecx, dx
inc dx
mov word [0x509194], dx
mov dword [ecx*4 + 0x508d98], eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0x4382f0
push 0
push 0
call esi
mov dx, word [0x509194]
movsx ecx, dx
inc dx
mov word [0x509194], dx
mov dword [ecx*4 + 0x508d98], eax
lea eax, [ebp + 8]
push eax
push 0
push 0
push 0x439550
push 0
push 0
call esi
mov dx, word [0x509194]
movsx ecx, dx
inc dx
mov word [0x509194], dx
pop esi
mov dword [ecx*4 + 0x508d98], eax
mov al, 1
mov esp, ebp
pop ebp
ret
push edi
push dword [0x47cea8]
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov esi, 0x48dfc8
mov edi, 0xe5
nop dword [eax]
push dword [esi]
call fcn.0040c240
add esp, 4
lea esi, [esi + 0x254]
sub edi, 1
jne 0x416330
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call ebx
mov ax, word [0x509194]
xor ecx, ecx
xor esi, esi
cmp cx, ax
jge 0x41639b
lea eax, [ebp - 4]
push eax
movsx eax, si
push dword [eax*4 + 0x508d98]
call edi
test eax, eax
je 0x416382
cmp dword [ebp - 4], 0x103
je 0x416390
mov ax, word [0x509194]
inc esi
cmp si, ax
jl 0x416365
jmp 0x41639b
mov ax, word [0x509194]
cmp si, ax
jl 0x416352
xor ecx, ecx
xor esi, esi
pop ebx
cmp cx, ax
jge 0x4163c6
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax + eax]
movsx eax, si
push dword [eax*4 + 0x508d98]
call edi
inc esi
cmp si, word [0x509194]
jl 0x4163b0
pop edi
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4170f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x5091b4], 1
push edi
mov edi, dword [ebp + 8]
jne 0x41729c
push ebx
push esi
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x28], esi
shl edi, 4
nop dword [eax]
test ebx, ebx
jne 0x417289
cmp byte [esi + 0x4c0238], 1
jne 0x417276
lea eax, [ebp - 0x2c]
push eax
push 0x40
push ebx
lea eax, [ebp - 0x24]
push eax
push dword [esi*4 + 0x5091a4]
call sub.Asidrv32.dll_AASiReadIDI
mov ebx, eax
mov dword [ebp - 0x30], ebx
test ebx, ebx
jne 0x41726a
xor esi, esi
mov ebx, edi
add edi, 0x400
nop dword [eax]
nop word [eax + eax]
mov edx, dword [0x4c18bd]
lea ebx, [ebx + 0x20]
movzx ecx, byte [ebp + esi - 0x24]
xor cl, byte [edx + ebx - 0x20]
and cl, 1
xor byte [edx + ebx - 0x20], cl
mov edx, dword [0x4c18bd]
movzx ecx, byte [ebp + esi - 0x24]
shr cl, 4
and cl, 1
movzx eax, byte [edx + ebx - 0x10]
and al, 0xfe
or cl, al
mov byte [edx + ebx - 0x10], cl
mov edx, dword [0x4c18bd]
movzx ecx, byte [ebp + esi - 0x24]
shr cl, 1
and cl, 1
movzx eax, byte [edx + ebx - 0x1f]
and al, 0xfe
or cl, al
mov byte [edx + ebx - 0x1f], cl
mov edx, dword [0x4c18bd]
movzx ecx, byte [ebp + esi - 0x24]
shr cl, 5
and cl, 1
movzx eax, byte [edx + ebx - 0xf]
and al, 0xfe
or cl, al
mov byte [edx + ebx - 0xf], cl
mov edx, dword [0x4c18bd]
movzx ecx, byte [ebp + esi - 0x24]
shr cl, 2
and cl, 1
movzx eax, byte [edx + ebx - 0x1e]
and al, 0xfe
or cl, al
mov byte [edx + ebx - 0x1e], cl
mov edx, dword [0x4c18bd]
movzx ecx, byte [ebp + esi - 0x24]
shr cl, 6
and cl, 1
movzx eax, byte [edx + ebx - 0xe]
and al, 0xfe
or cl, al
mov byte [edx + ebx - 0xe], cl
mov edx, dword [0x4c18bd]
movzx ecx, byte [ebp + esi - 0x24]
shr cl, 3
and cl, 1
movzx eax, byte [edx + ebx - 0x1d]
and al, 0xfe
or cl, al
mov byte [edx + ebx - 0x1d], cl
mov edx, dword [0x4c18bd]
movzx eax, byte [ebp + esi - 0x24]
inc esi
shr al, 7
movzx ecx, byte [edx + ebx - 0xd]
and cl, 0xfe
or cl, al
mov byte [edx + ebx - 0xd], cl
cmp esi, 0x20
jl 0x417170
mov esi, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x30]
jmp 0x41727c
push ebx
push esi
call fcn.004184b0
add esp, 8
jmp 0x41727c
add edi, 0x400
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 2
jl 0x417120
pop esi
pop ebx
mov al, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b572
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop edi
call fcn.0043b572
mov esp, ebp
pop ebp
ret
Function at 0x418e80
Capabilities:
Create thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 8], 1
push esi
jne 0x418f1f
cmp byte [0x4c023c], 1
jne 0x418ffb
push str.Starting_K8055_Driver
call fcn.0040e750
movaps xmm0, xmmword [0x45c4f0]
push 0x50
push 0
push 0x5093f0
movups xmmword [0x5093d0], xmm0
mov byte [0x5093e8], 1
call fcn.0043d400
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
lea eax, [ebp - 0x18]
add esp, 0x10
push eax
push 0
push 0
push 0x419010
push 0
push 0
call esi
mov dword [0x5093e0], eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x419180
push 0
push 0
call esi
mov dword [0x5093e4], eax
mov al, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b572
mov esp, ebp
pop ebp
ret
cmp byte [0x4c023c], 1
jne 0x418ffb
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [ebp - 0x14]
push ebx
push edi
push eax
push dword [0x5093e0]
mov byte [0x5093e8], 0
call esi
mov edi, dword [sym.imp.KERNEL32.dll_SwitchToThread]
cmp eax, 1
jne 0x418f6e
cmp dword [ebp - 0x14], 0x103
jne 0x418f6e
call edi
lea eax, [ebp - 0x14]
push eax
push dword [0x5093e0]
call esi
cmp eax, 1
je 0x418f52
lea eax, [ebp - 0x14]
push eax
push dword [0x5093e4]
call esi
cmp eax, 1
jne 0x418f9c
nop
cmp dword [ebp - 0x14], 0x103
jne 0x418f9c
call edi
lea eax, [ebp - 0x14]
push eax
push dword [0x5093e4]
call esi
cmp eax, 1
je 0x418f80
push dword [0x5093e0]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [0x5093e4]
call edi
push str.Stopping_K8055_Driver
call fcn.0040e750
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 4
mov word [ebp - 0xf], 5
mov esi, 0x5093d0
mov byte [ebp - 0xd], 0
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x418fee
push 0
lea ecx, [ebp - 0x18]
push ecx
push 9
lea ecx, [ebp - 0x10]
push ecx
push eax
call ebx
push dword [esi]
call edi
add esi, 4
cmp esi, 0x5093e0
jl 0x418fd4
pop edi
pop ebx
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.0043b572
mov esp, ebp
pop ebp
ret
Function at 0x41ab40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x458c40
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x47c554]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov bl, 1
mov byte [ebp - 0x11], bl
cmp byte [ebp + 8], bl
jne 0x41acbe
cmp byte [0x4c0248], bl
jne 0x41adb9
call fcn.0041b0b0
cmp al, bl
jne 0x41acaa
push str.Starting_IBS_EcoLink_Driver
call fcn.0040e750
xor eax, eax
mov dword [0x5095a8], 0
add esp, 4
xor edi, edi
cmp ax, word [0x4c024a]
jae 0x41ac2d
mov esi, 0x4c0266
nop dword [eax + eax]
movzx eax, word [esi - 2]
push eax
call fcn.00431aa0
add esp, 4
test al, al
jne 0x41abe2
movzx eax, word [esi - 2]
push eax
call fcn.00431af0
add esp, 4
test al, al
je 0x41ac1e
movzx eax, word [esi]
push eax
call fcn.00431b40
cdq
add esp, 4
and edx, 7
add eax, edx
sar eax, 3
cmp eax, 1
jge 0x41ac03
mov eax, 1
jmp 0x41ac18
movzx eax, word [esi]
push eax
call fcn.00431b40
cdq
add esp, 4
and edx, 7
add eax, edx
sar eax, 3
add dword [0x5095a8], eax
movzx eax, word [0x4c024a]
inc edi
add esi, 0xa
cmp edi, eax
jl 0x41abc0
mov eax, dword [0x5095a8]
mov esi, dword [sym.imp.KERNEL32.dll_HeapAlloc]
add eax, 0x10
push eax
push 8
push dword [0x47ceb8]
call esi
mov dword [0x509498], eax
mov eax, dword [0x5095a8]
add eax, 0x10
push eax
push 8
push dword [0x47ceb8]
call esi
push dword [0x5095a8]
mov dword [0x50949c], eax
push 0
push eax
call fcn.0043d400
add esp, 0xc
mov byte [0x50948e], bl
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0x41b240
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x509490], eax
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [0x4c0248], bl
jne 0x41adb9
mov eax, dword [0x4c18d9]
mov byte [0x50948e], 0
and byte [eax + 0x182], 0xfe
mov eax, dword [0x509490]
test eax, eax
je 0x41ad2c
mov esi, dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea ecx, [ebp + 8]
push ecx
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
cmp eax, 1
jne 0x41ad1e
nop
cmp dword [ebp + 8], 0x103
jne 0x41ad1e
push 1
call edi
lea eax, [ebp + 8]
push eax
push dword [0x509490]
call esi
cmp eax, 1
je 0x41ad00
push dword [0x509490]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41ad32
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push str.Stopping_IBS_EcoLink_Driver
call fcn.0040e750
add esp, 4
nop
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
movzx eax, word [0x4c0250]
push eax
call dword [0x509444]
movzx eax, ax
push 1
mov esi, eax
mov dword [ebp - 4], 0xffffffff
call edi
cmp esi, 2
je 0x41ad40
jmp 0x41ad88
push dword [ebp - 0x18]
call fcn.0041b980
mov esi, dword [sym.imp.KERNEL32.dll_HeapFree]
add esp, 4
push dword [0x509498]
push 0
push dword [0x47ceb8]
call esi
push dword [0x50949c]
push 0
push dword [0x47ceb8]
call esi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41b0b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x47c554]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x509494], 0
push ebx
mov bl, 1
jne 0x41b205
push 0x105
lea eax, [ebp - 0x10c]
push eax
push dword [0x47cea0]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call fcn.0043cad0
push str.EcoLink.DLL
lea ecx, [eax + 1]
lea eax, [ebp - 7]
sub eax, ecx
push eax
push ecx
call fcn.0043f2f3
add esp, 0x14
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x509494], eax
test eax, eax
je 0x41b216
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.W_IBU_Open
push eax
call esi
push str.W_IBU_Close
push dword [0x509494]
mov dword [0x509440], eax
call esi
push str.W_IBU_IBS_Reset
push dword [0x509494]
mov dword [0x509444], eax
call esi
push str.W_IBU_IBS_Init
push dword [0x509494]
mov dword [0x509448], eax
call esi
push str.W_IBU_IBS_Run
push dword [0x509494]
mov dword [0x50944c], eax
call esi
push str.W_IBU_IBS_Diagnostics
push dword [0x509494]
mov dword [0x509450], eax
call esi
push str.W_IBU_StatusText
push dword [0x509494]
mov dword [0x509454], eax
call esi
push str.W_IBU_IAPI_Set_Max_Rep
push dword [0x509494]
mov dword [0x509458], eax
call esi
push str.W_IBU_IAPI_Set_Max_Devices
push dword [0x509494]
mov dword [0x50945c], eax
call esi
push str.W_IBU_IAPI_Set_Busy_Mode
push dword [0x509494]
mov dword [0x509460], eax
call esi
push str.W_IBU_ML_Set_IBS_Baudrate
push dword [0x509494]
mov dword [0x509464], eax
call esi
push str.W_IBU_ML_Get_Error_History
push dword [0x509494]
mov dword [0x509468], eax
call esi
mov dword [0x50946c], eax
pop esi
mov al, bl
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043b572
mov esp, ebp
pop ebp
ret
push str.EcoLink:_file_EcoLink.DLL_not_found_or_load_failure
call fcn.0040e800
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
xor al, al
pop ebx
call fcn.0043b572
mov esp, ebp
pop ebp
ret
Function at 0x4209b0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x420a25
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [ebp + 8]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4209d0
sub eax, edx
inc eax
push eax
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edx, eax
mov eax, esi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4209f6
sub eax, ebx
push esi
inc eax
push eax
push edx
call fcn.0043f2f3
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
pop edi
pop esi
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop ebp
ret