joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001961f
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100196a7
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10019696
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10019677
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10019694
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10004f7e
mov dword [eax], 0x32f4bb0f
jmp 0x1001966c
jmp 0x100196a5
push 0
push 0x2680
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x100196bb
push 0x4735
push 0
push 0x7c10
call fcn.10015a1f
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002a3ed
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063bb5
call fcn.10062638
sub esp, 0x14
cmp byte [ebp + 0x38], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ecx
je 0x1002a472
mov ebx, dword [ebp + 0x20]
xor edx, edx
mov edi, dword [ebp + 0x2c]
mov esi, dword [ebp + 0x18]
mov eax, dword [ebx]
mov dword [esi], 0x7ccc8959
mov ecx, dword [edi]
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [edi]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
sub ecx, 0x7ccc8959
mov eax, dword [eax]
neg ecx
sbb ecx, ecx
xor edx, edx
add ecx, 0xffff6002
cmp eax, ecx
mov ecx, dword [ebp - 0x14]
setge dl
mov eax, dword [ecx]
sub edx, eax
mov eax, dword [ecx]
imul eax, edx
mov dword [edi], eax
mov eax, dword [edi]
mov eax, dword [ecx]
mov eax, dword [ebx]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [esi]
mov eax, dword [edi]
mov dword [ecx], eax
jmp 0x1002a556
mov dword [ebp - 0x18], 0x554d
cmp dword [ebp - 0x18], 0x5802
jle 0x1002a4c8
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x14], 0x6d73
xor edi, edi
mov eax, ebx
mov ecx, 0x1007e2d8
xor eax, edi
cdq
push edx
push eax
call fcn.10004c4e
inc edi
cmp edi, 0xc2c
jl 0x1002a48f
dec ebx
dec dword [ebp - 0x14]
jne 0x1002a48d
inc esi
cmp esi, 0x4a16
jl 0x1002a484
push 0x1f90
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x533c
jge 0x1002a503
mov edx, str.krvou_izftrzq_rmpxs_vly_stesibjz_pmhaym
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x1002a503
mov eax, dword [ebp + 0x1c]
mov esi, 0x69aed23b
mov edx, dword [ebp + 0x34]
xor ecx, ecx
mov edi, dword [ebp + 0x24]
mov dword [eax], esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [edx]
cmp eax, esi
mov esi, dword [ebp + 0x28]
setge cl
mov dword [edx], ecx
mov eax, dword [edx]
xor edx, edx
mov dword [edi], eax
mov eax, dword [ebx]
mov ecx, dword [esi]
sub ecx, eax
mov eax, dword [ebx]
cmp eax, ecx
mov eax, dword [esi]
sete dl
imul eax, edx
xor edx, edx
cmp eax, 0xb722
mov eax, dword [edi]
setne dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp + 0x10]
setne cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c742
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x1002c78f
cmp byte [ebp + 0x10], 0
je 0x1002c76d
xor eax, eax
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x1002c7d2
push eax
push 0x2680
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1002c7d2
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1002c7d2
mov edx, dword [ebp + 0x1c]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x5c50
inc dword [esi]
cmp dword [esi], 2
jl 0x1002c77b
jmp 0x1002c7d2
cmp byte [ebp + 0x14], 0
je 0x1002c7b2
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002c7d2
xor eax, eax
push eax
push eax
push 0x1c5a
push eax
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
jmp 0x1002c7d2
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1002c7d2
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc3938dd4
inc dword [edx]
cmp dword [edx], 3
jl 0x1002c7c0
pop esi
pop ebp
ret

Function at 0x1002c9fc
Capabilities:
Log keystrokes via polling

Disassembly:
test dl, dl
je 0x1002ca21
cmp byte [ecx], 0
je 0x1002ca29
push 1
push 0x7f6e
push 1
mov edx, 0x8c5
mov ecx, 0xdc
call fcn.1002a3c0
add esp, 0xc
ret
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
ret
Function at 0x1002caa3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063c38
call fcn.10062638
sub esp, 0x2c
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
je 0x1002caf7
test dl, dl
je 0x1002cace
mov dword [ecx], 0xfffffff7
jmp 0x1002cc45
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002cc45
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x1002cae3
jmp 0x1002cc45
mov dword [ebp + 0x14], 0x1fd2
xor esi, esi
cmp dword [ebp + 0x14], 0x20f2
jle 0x1002cb62
mov edi, esi
mov ebx, esi
lea eax, [ebx + edi]
cdq
lea ecx, [ebp - 0x38]
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002cb25
mov eax, dword [eax]
push eax
call fcn.1004a373
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.10005270
inc ebx
cmp ebx, 0x6586
jl 0x1002cb0d
inc edi
cmp edi, 0x4d4e
jl 0x1002cb0b
push 0x15a8
push esi
push 0x1bec
push esi
push 0x8f8
push 0x7c
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp dword [ebp + 0x14], 0x1d84
jge 0x1002cb76
push str.tuk_tlcrtwavo_aawnzksei_dumvs_weuprsu_bwmhtdu_obfrr_nzjhe_quduz_yuw_hrhgxq_owui
call fcn.1004a373
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x1002cb8e
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
jmp 0x1002cc45
mov dword [ebp - 0x20], 0x20be
cmp dword [ebp - 0x20], 0x2281
jle 0x1002cbf3
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov eax, esi
mov dword [ebp - 0x18], 0x3b84
mov dword [ebp + 0x14], eax
mov esi, eax
mov edi, 0x72e3
mov eax, esi
mov ecx, 0x1007e2d8
xor eax, ebx
cdq
push edx
push eax
call fcn.10004c4e
inc esi
dec edi
jne 0x1002cbb6
mov eax, dword [ebp + 0x14]
mov edi, dword [ebp - 0x1c]
add eax, edi
dec dword [ebp - 0x18]
mov dword [ebp + 0x14], eax
jne 0x1002cbaf
inc edi
mov dword [ebp - 0x1c], edi
push 0
pop esi
cmp edi, 0x581a
jl 0x1002cba3
inc ebx
cmp ebx, 0x2e98
jl 0x1002cba0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x1fc5
jge 0x1002cc30
mov edx, str.hjps_oirbwkgh_hrpz_yqfnlv_qpjlwegn_csrc_sqqczsrg
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x1002cc30
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002cc45
push esi
push esi
push 0x1888
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d939
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063c87
call fcn.10062638
sub esp, 0x18
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
je 0x1002da0e
mov dword [ebp - 0x18], 0x1319
cmp dword [ebp - 0x18], 0x151d
jle 0x1002d9b4
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x1007e2d8
xor eax, esi
cdq
push edx
push eax
call fcn.10004c4e
inc esi
cmp esi, 0x77c4
jl 0x1002d97f
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x2ebd
jl 0x1002d972
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x7c24
jl 0x1002d970
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1186
jge 0x1002d9ef
mov edx, str.fpcfqrl_rkqw_uodibd_olzdmvjy_zbic_ukmcw_aqwf_ncsg_wsctkeg_potkmu
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x1002d9ef
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x1002da07
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0x342eb90d
inc dword [edx]
cmp dword [edx], 2
jl 0x1002d9fa
jmp 0x1002da1b
push 0x19d9
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e5c2
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x1002e5d3
mov eax, dword [ebp + 8]
add dword [eax], 0xfffffffe
pop ebp
ret
push 0
push 0x2680
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
pop ebp
ret
Function at 0x1003914a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006411c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003918d
push 0x7f28
push 0xf22
push 1
call fcn.1003931f
add esp, 0xc
jmp 0x1003930e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100391ca
push 0x2157
push 0
push 0x1bce
push 0x1db0
push 0x2366
call dword [sym.imp.GDI32.dll_TextOutA]
jmp 0x1003930e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0x5533
mov dword [ebp - 0x38], str.eahra_kylod_frxqt_drnlvq_snwhuz_nyjcco_dttsdzm_qesoqmrj
cmp dword [ebp - 0x24], 0x5782
jle 0x1003929e
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
and dword [ebp - 0x20], 0
jmp 0x10039202
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6114
jge 0x1003929e
and dword [ebp - 0x1c], 0
jmp 0x1003921c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x71c8
jge 0x10039299
and dword [ebp - 0x14], 0
jmp 0x10039232
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4e33
jge 0x10039294
and dword [ebp - 0x18], 0
jmp 0x10039248
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x424a
jge 0x10039292
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, cl
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x78]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.10004c2e
push eax
call fcn.1004a373
pop ecx
lea ecx, [ebp - 0x78]
call fcn.10004c24
jmp 0x10039241
jmp 0x1003922b
jmp 0x10039215
jmp 0x100391fb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x54b2
jge 0x100392ba
push dword [ebp - 0x38]
call fcn.1004a373
pop ecx
jmp 0x100392d6
or dword [ebp - 4], 0xffffffff
jmp 0x100392e0
lea eax, [ebp - 0x60]
push eax
call fcn.10035bb9
pop ecx
mov esi, eax
lea edi, [ebp - 0x54]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [eax]
call fcn.10038569
shl eax, 1
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ecx + eax*4]
sub eax, 0x12c
mov ecx, dword [ebp - 0x40]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039fc0
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006415c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003a012
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x1cad
push 0
call fcn.1003f7aa
add esp, 0x14
jmp 0x1003a0e9
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1003a0c4
mov dword [ebp - 0x28], 0xbf8f0aa6
mov dword [ebp - 0x24], 0x65720b96
push 1
lea ecx, [ebp - 0x40]
call fcn.10004f00
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
jmp 0x1003a058
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jge 0x1003a071
push dword [ebp - 0x10]
lea ecx, [ebp - 0x40]
call fcn.10004f7e
mov dword [eax], 0xd5befa1e
jmp 0x1003a051
push 0x7d45
push 0
push 0x12d4
call fcn.10039109
add esp, 0xc
lea eax, [ebp - 0x24]
push eax
push 0x698d
push 0
push 0x4b7c
push 0
push 0x7870
push 0x12a5
push 0x28d8
lea eax, [ebp - 0x40]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.100409f1
add esp, 0x28
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.10004f62
jmp 0x1003a0e9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1003a0e9
push 0
push 0x2680
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100427b1
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100643cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10042808
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push 0x7e21
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
push 0xcf
push 1
call fcn.1004293d
add esp, 0x14
jmp 0x1004292c
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1004290c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x1c], 0x36dd
mov dword [ebp - 0x40], str.zkeishdhh_afkfevb_ogqntxk_ykumtca_zqge
cmp dword [ebp - 0x1c], 0x3849
jle 0x100428be
and dword [ebp - 0x14], 0
jmp 0x10042864
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xc13
jge 0x100428be
and dword [ebp - 0x18], 0
jmp 0x1004287a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5427
jge 0x100428bc
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.10004c2e
push eax
call fcn.1004a373
pop ecx
lea ecx, [ebp - 0x74]
call fcn.10004c24
jmp 0x10042873
jmp 0x1004285d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x34d2
jge 0x100428da
push dword [ebp - 0x40]
call fcn.1004a373
pop ecx
jmp 0x100428f6
or dword [ebp - 4], 0xffffffff
jmp 0x10042900
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1004292c
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x1004292c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003b3b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10003b4a
pop dword [ebp - 8]
mov eax, 0x10003b4a
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x940b535a
sub dword [ebp - 0x18], 0x45b90e0f
mov dword [ebp - 0x14], 0xc427d9c6
add dword [ebp - 0x14], 0x6e0b727f
mov dword [ebp - 0x10], 0x426eb322
add dword [ebp - 0x10], 0x9dd910c
mov dword [ebp - 0xc], 0xd04026d9
sub dword [ebp - 0xc], 0xd04026d9
lea eax, [ebp - 0x18]
push eax
mov eax, 0x588cfbf1
sub eax, 0x488cabad
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x91b45d2b
add dword [ebp - 0x18], 0xe2be0c2b
mov dword [ebp - 0x14], 0x5107c607
add dword [ebp - 0x14], 0xf0649b6e
mov dword [ebp - 0x10], 0xd0ac2f27
sub dword [ebp - 0x10], 0x6d3cc2bb
mov dword [ebp - 0xc], 0xe11f82e
add dword [ebp - 0xc], 0xf1ee07d2
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xe0323996
add eax, 0x2fce16ba
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x376de
push 0
call eax
mov ecx, 0x77c5eaf6
sub ecx, 0x77c5a062
mov esi, eax
mov edx, 0x383437af
add edx, 0xd7cc6051
add edx, dword [ebp - 8]
mov ebx, 0x90c0c79e
add ebx, 0x523fe646
add dword [ebp - 4], edx
mov edi, dword [edx]
sub dword [ebp - 4], ecx
add edi, ebx
add dword [ebp - 4], 0x18744c29
mov dword [esi], edi
xor dword [ebp - 4], 0x7223f077
add esi, 0x80895a2a
add esi, 0x7f76a5da
add edx, 0x5a15586d
sub edx, 0x5a155869
loop 0x10003c67
add eax, 0x11d23
mov ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x403dc8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov cl, 0x22
mov al, byte [esi]
cmp al, cl
jne 0x403df4
mov al, byte [esi + 1]
inc esi
cmp al, cl
je 0x403ded
test al, al
jne 0x403de1
cmp byte [esi], cl
jne 0x403dfe
inc esi
jmp 0x403dfe
cmp al, 0x20
jle 0x403dfe
inc esi
cmp byte [esi], 0x20
jg 0x403df8
mov al, byte [esi]
test al, al
je 0x403e08
cmp al, 0x20
jle 0x403df1
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x403e22
movzx ebx, word [ebp - 0x14]
jmp 0x403e25
push 0xa
pop ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov edi, eax
push 0
push 0
push edi
call fcn.00404538
test eax, eax
je 0x403e8a
call fcn.00403ea0
test eax, eax
je 0x403e6d
push edi
push 1
call fcn.00403f05
pop ecx
test eax, eax
pop ecx
je 0x403e6d
push 0
push str.This_Demo_of_LabWindows_CVI_has_expired.
push 0x76f9f0
call fcn.00403eb8
add esp, 0xc
or esi, 0xffffffff
jmp 0x403e83
push ebx
push esi
push 0
push edi
call fcn.00404b20
mov esi, eax
call fcn.00404410
call fcn.0040449d
call fcn.0040461c
jmp 0x403e8d
or esi, 0xffffffff
push esi
call fcn.00404ada
pop ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403f05
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
push esi
push edi
xor ebx, ebx
push 0x40418f
push 0x927c0
push ebx
push ebx
mov byte [ebp - 1], bl
call fcn.00404165
cmp eax, ebx
mov dword [0x458070], eax
je 0x403fcb
cmp dword [ebp + 8], ebx
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
je 0x403f6d
call edi
push eax
lea eax, [ebp - 0x104]
push 0x76fa5c
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x403fcb
call edi
push eax
lea eax, [ebp - 0x104]
push str.CVI_Demo_Last_Time_Timer_Called___d
push eax
call esi
lea eax, [ebp - 0x104]
push eax
push 4
push ebx
push 4
push ebx
push 0xffffffffffffffff
call fcn.00404a0a
add esp, 0x24
cmp eax, ebx
mov dword [0x458074], eax
je 0x403fcb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x403faf
mov byte [ebp - 1], 1
push ebx
push ebx
push ebx
push 2
push dword [0x458074]
call fcn.004048d8
add esp, 0x14
cmp eax, ebx
mov dword [0x458078], eax
jne 0x403fd0
push 1
pop eax
jmp 0x403fe4
cmp byte [ebp - 1], bl
je 0x403fe2
call fcn.00403fe9
mov ecx, dword [0x458078]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404000
Capabilities:
Check mutex on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [0x45807c], 0
je 0x404016
xor eax, eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x114]
push str.National_Instruments_LabWindows_CVI_Startup_library__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
mov dword [ebp - 8], eax
jne 0x40404f
push 0xfffffffffffffffd
pop eax
leave
ret
push ebx
push esi
push edi
or edi, 0xffffffff
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x45807c], 0
jne 0x40414a
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.winmm.dll
call esi
test eax, eax
mov dword [ebp - 0xc], eax
jne 0x404085
mov esi, edi
jmp 0x40414c
push str.advapi32.dll
call esi
mov ebx, eax
test ebx, ebx
je 0x40407e
push 0x76fae4
call esi
test eax, eax
mov dword [ebp - 4], eax
je 0x40407e
push str.user32.dll
call esi
mov edi, eax
test edi, edi
jne 0x4040b5
or esi, 0xffffffff
jmp 0x40414c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push dword [ebp - 0xc]
call esi
test eax, eax
mov dword [0x458068], eax
je 0x404125
push str.RegOpenKeyExA
push ebx
call esi
test eax, eax
mov dword [0x458064], eax
je 0x404125
push str.RegQueryValueExA
push ebx
call esi
test eax, eax
mov dword [0x45805c], eax
je 0x404125
push str.GetFileTime
push dword [ebp - 4]
call esi
test eax, eax
mov dword [0x458060], eax
je 0x404125
push str.KillTimer
push edi
call esi
test eax, eax
mov dword [0x45806c], eax
je 0x404125
push str.SetTimer
push edi
call esi
test eax, eax
mov dword [0x458058], eax
jne 0x404140
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push ebx
call esi
push dword [ebp - 4]
call esi
push edi
call esi
push 0xfffffffffffffffe
pop esi
jmp 0x40414c
mov dword [0x45807c], 1
xor esi, esi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404927
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
push edi
xor edi, edi
cmp dword [0x458140], edi
je 0x404944
push 1
pop eax
jmp 0x4049c7
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x108]
push str.National_Instruments_LabWindows_CVI_Startup_SDK_stubs__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
cmp esi, edi
jne 0x404979
xor eax, eax
jmp 0x4049c7
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x458140], edi
jne 0x4049ae
push 0x770074
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, edi
mov dword [0x458140], eax
jne 0x4049ae
push 0x770084
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x458140], eax
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [0x458140], edi
setne al
pop edi
pop esi
leave
ret