joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d451
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor esi, esi
push esi
push 0x80
push 3
push esi
push esi
push closesocket
push dword [0x42de58]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
mov dword [ebp - 0xc], edi
jne 0x40d4a6
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
fld qword [0x421370]
jmp 0x40d612
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
jne 0x40d4c7
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40d49b
push 0x22c
call fcn.004179b4
mov esi, 0x230
mov edi, eax
push esi
call fcn.004179b4
fld qword [0x421370]
pop ecx
mov dword [ebp - 4], eax
fstp qword [ebp - 0x14]
pop ecx
mov ebx, 0x42ec68
lea eax, [ebp - 8]
push 0
push eax
push esi
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d5e0
cmp dword [ebp - 8], 0
jbe 0x40d5e0
push 2
push dword [ebp - 4]
push edi
call fcn.0040ced0
add esp, 0xc
test eax, eax
jbe 0x40d49b
xor esi, esi
mov eax, dword [0x42f154]
push 0x42f190
add eax, esi
push eax
call fcn.004181a0
pop ecx
test eax, eax
pop ecx
je 0x40d5db
cmp byte [edi + 0x15c], 0
je 0x40d5cc
lea eax, [edi + 0x18]
push eax
mov eax, dword [0x42f154]
add eax, esi
push eax
call fcn.004181a0
pop ecx
test eax, eax
pop ecx
jne 0x40d5cc
mov eax, dword [0x42f154]
fld qword [esi + eax + 0x18]
fcomp qword [ebp - 0x14]
fnstsw ax
sahf
jb 0x40d589
fld qword [ebp - 0x14]
fcomp qword [0x421370]
fnstsw ax
sahf
jne 0x40d5cc
push 0x32a
push 0
push ebx
call fcn.004174b0
mov eax, dword [0x42f154]
fld qword [esi + eax + 0x18]
lea eax, [edi + 0x167]
fstp qword [ebp - 0x14]
push eax
push 0x427fd4
push ebx
call fcn.00417634
push dword [edi + 0x1cc]
push 0x427fd0
push 0x42ecd6
call fcn.00417634
add esp, 0x24
add esi, 0x20
cmp esi, 0x640
jl 0x40d52e
mov esi, 0x230
cmp dword [ebp - 8], esi
jne 0x40d5ea
jmp 0x40d4f1
push edi
call fcn.00417985
push dword [ebp - 4]
call fcn.00417985
pop ecx
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
fld qword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e5b1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push esi
push edi
push 0
push 0x80
push 3
push 0
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40e5fc
push 0xffffffffffffffff
call esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__ld_getting_handle_to_file__s._nIf_another_process_is_using_it__please_free_this_file_and_re_run._nIf_the_problem_persists__please_contact_Softwrap_support__contact_ndetails_available_on_http:__www.softwrap.com_
call fcn.004099b6
add esp, 0xc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.0040e4a0
mov eax, dword [ebp - 8]
add esp, 0xc
neg eax
push 2
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0xc]
push 0
push eax
push dword [ebp - 8]
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40e64f
push dword [ebp - 4]
call fcn.00417985
pop ecx
push edi
call esi
push str.Error__ld_writing_to_the_file__s._nIf_the_problem_persists__please_contact_Softwrap_support__http:__www.softwrap.com_
call fcn.004099b6
pop ecx
push dword [ebp - 4]
call fcn.00417985
pop ecx
push edi
call esi
pop edi
pop esi
leave
ret

Function at 0x40e771
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push closesocket
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40e7b2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Error__ld_accessing_file__s._nIf_another_process_is_using_it__please_free_this_file_and_re_run._nIf_the_problem_persists__please_contact_Softwrap_support__http:__www.softwrap.com_
call fcn.00410576
add esp, 0xc
jmp 0x40e7f4
push 2
push edi
push 0xffffffffffffffc0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x40
call fcn.004179b4
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push edi
push eax
push 0x40
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e7f8
push ebx
call fcn.00417985
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.Error__ld_reading_from_the_file__s._nIf_the_problem_persists__please_contact_Softwrap_support__http:__www.softwrap.com_
call fcn.00410576
pop ecx
mov al, 2
jmp 0x40e81e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
push 0x40
push ebx
call fcn.0040e65f
add esp, 0xc
test al, al
jne 0x40e815
add al, 3
jmp 0x40e81e
push ebx
call fcn.00417985
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ec89
Capabilities:
Terminate process

Disassembly:
sub esp, 0x34
lea eax, [esp]
push eax
push dword [0x42f12c]
call fcn.0040e771
movsx eax, al
pop ecx
dec eax
pop ecx
je 0x40e863
dec eax
je 0x40e857
dec eax
jne 0x40e86f
push dword [0x42f12c]
push str.The_watermark_of_the__s_file_is_corrupt._nPlease_contact_Softwrap_support__contact_details_on__nhttp:__www.softwrap.com__for_a_new_one
call fcn.004099b6
pop ecx
jmp 0x40e86e
call fcn.00411ce2
push 1
call fcn.00417f53
push dword [0x42f12c]
call fcn.0040e5b1
pop ecx
add esp, 0x34
ret
push 0
push 0x40e873
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x6d
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp eax, 0xffffffff
jne 0x40ecc0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Couldnt_create_FirstRun_dialog_box__error__d_n
call fcn.004099b6
pop ecx
pop ecx
cmp dword [0x42f0b4], 0
je 0x40ecce
jmp 0x40e823
ret

Function at 0x40ee37
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
push ebx
push esi
push edi
push 0x12c
call fcn.004179b4
mov esi, eax
mov eax, 0x230
push eax
mov dword [ebp - 0xc], eax
call fcn.004179b4
cmp byte [ebp + 0x10], 2
pop ecx
pop ecx
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
jne 0x40ee82
call fcn.0040cfb3
push eax
push str.SoftwareSoftwrap_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x40ee91
push str.SoftwareSoftwrap_s
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 8]
xor ebx, ebx
push eax
push 0xf003f
push ebx
push esi
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push esi
mov edi, eax
call fcn.00417985
cmp edi, ebx
pop ecx
jne 0x40ef43
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push ebx
push ebx
push str.License
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
je 0x40eee0
cmp eax, 2
setne bl
add ebx, 3
jmp 0x40ef38
push 2
lea eax, [ebp - 0x238]
pop ebx
push ebx
push dword [ebp - 4]
push eax
call fcn.0040ced0
add esp, 0xc
test eax, eax
jbe 0x40ef38
sub esp, 0x22c
mov ecx, 0x8b
lea esi, [ebp - 0x238]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0040eddb
add esp, 0x22c
test al, al
je 0x40ef38
lea eax, [ebp - 0x238]
push 0x22c
push eax
push dword [ebp + 8]
call fcn.00417bc0
add esp, 0xc
push 1
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ef52
push 3
cmp edi, 2
pop ebx
je 0x40ef52
cmp edi, ebx
je 0x40ef52
push 4
pop ebx
push dword [ebp - 4]
call fcn.00417985
pop ecx
pop edi
mov al, bl
pop esi
pop ebx
leave
ret
Function at 0x40f3d4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x304
push ebx
xor ebx, ebx
cmp byte [0x42f177], bl
push esi
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x64
jne 0x40f530
mov byte [0x42f177], 1
call fcn.0041088c
lea eax, [ebp - 0x10]
push eax
push 0xf003f
push ebx
push str.SOFTWARESoftwrap
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40f4d2
push dword [ebp - 4]
call fcn.004179b4
pop ecx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push ebx
push ebx
push ebx
lea ecx, [ebp - 4]
push ebx
push ecx
inc dword [ebp - 8]
push dword [ebp - 0xc]
mov dword [ebp - 4], 0x64
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x40f4bc
push 1
lea eax, [ebp - 0x304]
push dword [ebp - 0xc]
push eax
call fcn.0040ee37
add esp, 0xc
cmp al, 1
jne 0x40f432
lea eax, [ebp - 0x2ec]
push eax
lea eax, [ebp - 0xd8]
push eax
call fcn.00418030
lea eax, [ebp - 0x2d7]
push eax
lea eax, [ebp - 0xc4]
push eax
call fcn.00418030
sub esp, 0xb4
lea esi, [ebp - 0xd8]
push 0x31
pop ecx
mov edi, esp
push 0x42f170
rep movsd dword es:[edi], dword [esi]
call fcn.0040efb1
add esp, 0xc8
cmp dword [ebp - 0x14], 0x103
jne 0x40f432
push dword [ebp - 0xc]
call fcn.00417985
pop ecx
lea eax, [ebp - 0xd8]
push 0x42e4e8
push eax
call fcn.00418030
lea eax, [ebp - 0xc4]
push 0x42e4fd
push eax
call fcn.00418030
sub esp, 0xb4
lea esi, [ebp - 0xd8]
push 0x31
pop ecx
mov edi, esp
push 0x42f170
rep movsd dword es:[edi], dword [esi]
call fcn.0040efb1
mov esi, dword [0x42f170]
add esp, 0xc8
cmp esi, ebx
je 0x40f530
push esi
call fcn.0040f059
mov esi, dword [esi + 0xc0]
pop ecx
jmp 0x40f51d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40f73a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe8
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [0x42f164]
mov dword [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x20019
call fcn.0040ef62
mov edi, eax
xor esi, esi
cmp edi, esi
pop ecx
mov dword [ebp - 0x20], edi
je 0x40f91d
push esi
lea eax, [ebp - 0xc]
push esi
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x40f795
mov al, 4
jmp 0x40f93c
mov eax, dword [ebp - 0xc]
add eax, 0x230
push eax
mov dword [ebp - 0x1c], eax
call fcn.004179b4
mov ebx, 0x22c
mov dword [ebp - 0x18], eax
push ebx
call fcn.004179b4
pop ecx
mov dword [ebp - 8], eax
pop ecx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push esi
push esi
push str.size10
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40f7e3
cmp dword [ebp - 0xc], esi
je 0x40f7e3
mov dword [ebp - 4], 3
jmp 0x40f87d
xor edi, edi
push 0x14
mov dword [ebp - 0x10], edi
call fcn.004179b4
cmp dword [ebp - 0xc], esi
pop ecx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x14], esi
jbe 0x40f85e
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
add ecx, eax
push 2
push ecx
push dword [ebp - 8]
call fcn.0040ced0
add esp, 0xc
cmp eax, esi
mov dword [ebp - 0x1c], eax
jbe 0x40f911
mov esi, dword [ebp - 8]
sub esp, 0x22c
mov ecx, 0x8b
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.0040eddb
add esp, 0x22c
test al, al
jne 0x40f894
mov dword [ebp - 4], 2
mov edi, dword [ebp - 0x10]
xor esi, esi
add dword [ebp - 0x14], 0x230
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0xc]
jb 0x40f7fb
cmp dword [ebp - 4], 2
je 0x40f86b
neg edi
sbb edi, edi
and edi, 0xfffffffe
add edi, 3
mov dword [ebp - 4], edi
push dword [ebp - 0x24]
call fcn.00417985
push dword [ebp - 0x18]
call fcn.00417985
pop ecx
pop ecx
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40f924
mov esi, dword [ebp - 8]
lea eax, [esi + 0x18]
push eax
lea eax, [ebp - 0xe8]
push eax
call fcn.00418030
push esi
call fcn.0040d3bc
push eax
lea eax, [ebp - 0xd4]
push eax
call fcn.00418030
sub esp, 0xb0
lea esi, [ebp - 0xe8]
push 0x31
pop ecx
mov edi, esp
push 0x42f170
rep movsd dword es:[edi], dword [esi]
call fcn.0040efb1
mov eax, dword [ebp - 8]
push 0x14
push dword [ebp + 0xc]
add eax, 0x18
push eax
call fcn.004185f0
add esp, 0xd4
test eax, eax
jne 0x40f844
push ebx
mov dword [ebp - 0x10], 1
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00417bc0
add esp, 0xc
jmp 0x40f844
mov dword [ebp - 4], 2
jmp 0x40f849
mov dword [ebp - 4], 4
push dword [ebp - 8]
call fcn.00417985
pop ecx
push dword [0x42f164]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov al, byte [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40fd79
Capabilities:
Create directory
Get common file path
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3dc
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor edi, edi
cmp dword [ebp + 0x10], 6
jne 0x40fdf0
lea eax, [ebp - 0xe8]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x40fdcf
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call esi
push eax
push str.Error__ld___Cant_get_the_default_Windows_Directory._n
call fcn.004099b6
pop ecx
pop ecx
push dword [ebp + 0xc]
lea eax, [ebp - 0xe8]
push eax
lea eax, [ebp - 0x1b0]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x40fe38
push dword [0x42de30]
lea eax, [ebp - 0x84]
push eax
call fcn.00418030
lea eax, [ebp - 0x84]
push str.SoftwrapLicense
push eax
call fcn.00418040
add esp, 0x10
lea eax, [ebp - 0x84]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [0x42de58]
lea eax, [ebp - 0x1b0]
push eax
call fcn.00418030
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp + 0x10], 6
push edi
setne al
dec eax
and al, 0x82
add eax, 0x80
push eax
push 4
push edi
push edi
lea eax, [ebp - 0x1b0]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40fe88
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call esi
push eax
push dword [ebp + 0xc]
push str.Cannot_get_a_handle_to_file:__s___error__d_n
call fcn.004099b6
add esp, 0xc
mov esi, 0x230
push esi
call fcn.004179b4
pop ecx
mov ebx, eax
mov dword [ebp + 0x10], edi
mov dword [ebp + 0xc], edi
lea eax, [ebp - 8]
push edi
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40fee2
add dword [ebp + 0x10], esi
push 2
lea eax, [ebp - 0x3dc]
push ebx
push eax
call fcn.0040ced0
add esp, 0xc
test eax, eax
jbe 0x40fee2
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
lea eax, [ebp - 0x3c4]
push eax
call fcn.004181a0
pop ecx
test eax, eax
pop ecx
je 0x40fee9
cmp dword [ebp - 8], esi
jne 0x40fef3
jmp 0x40fe9c
sub dword [ebp + 0x10], esi
mov dword [ebp + 0xc], 1
push 1
push ebx
push dword [ebp + 8]
call fcn.0040ced0
add esp, 0xc
test eax, eax
jne 0x40ff1c
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push str.Encryption_error_while_writing_a_system_file
call fcn.004099b6
pop ecx
cmp dword [ebp + 0xc], edi
push edi
je 0x40ff30
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 0xc]
push eax
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call fcn.00417985
pop ecx
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [0x42f168]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4111e7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
push 1
xor ebx, ebx
pop esi
cmp byte [0x42e629], bl
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x28], 0x1e
mov dword [ebp - 0x24], 0x5a
mov dword [ebp - 0x20], 0xd2
mov dword [ebp - 0x1c], ebx
jne 0x4112f7
cmp byte [0x42e62b], bl
jne 0x4112f7
cmp dword [0x42e624], ebx
mov dword [0x42f0b4], ebx
jne 0x411261
cmp word [0x42e620], bx
jne 0x411261
cmp byte [0x42e622], bl
jne 0x411261
cmp byte [0x42e623], bl
jne 0x411261
cmp byte [0x42e62e], bl
jne 0x41126a
cmp byte [0x42e61c], 6
jne 0x411272
mov dword [0x42f0b4], esi
jmp 0x4112ed
lea eax, [ebp - 8]
push eax
call fcn.0040d36a
lea eax, [ebp - 0x18]
push eax
call fcn.0040d399
push ecx
push ecx
mov esi, 0x42e5f4
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x18]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0040a8cf
add esp, 0x20
test al, al
je 0x4112b4
push str.The_system_time_is_incorrect._It_is_set_to_before_the_last_time_this_program_was_run._Please_adjust_it_to_the_correct_time_and_re_run_the_program.
call fcn.004099b6
pop ecx
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
push dword [0x42e624]
push dword [0x42e620]
call fcn.0040a99c
movzx ecx, byte [0x42e61c]
add esp, 0x14
cmp eax, dword [ebp + ecx*4 - 0x34]
jl 0x4112e3
call fcn.00414fae
jmp 0x4112ed
mov dword [0x42f0b4], 1
call fcn.0040c773
pop edi
pop esi
pop ebx
leave
ret
call fcn.0040a2bd
call fcn.00411ce2
push esi
call fcn.00417f53

Function at 0x411657
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
lea eax, [ebp - 0x34]
push eax
push dword [0x42f12c]
call fcn.0040e771
movsx eax, al
pop ecx
dec eax
pop ecx
je 0x41169a
dec eax
je 0x41168e
dec eax
jne 0x4116ab
push dword [0x42f12c]
push str.The_watermark_of_the__s_file_is_corrupt._nPlease_contact_Softwrap_support__contact_details_on__nhttp:__www.softwrap.com__for_a_new_one
call fcn.004099b6
pop ecx
pop ecx
leave
ret
call fcn.00411ce2
push 1
call fcn.00417f53
lea eax, [ebp - 0x2f]
push 0x14
push eax
push dword [ebp + 8]
call fcn.00417bc0
add esp, 0xc
leave
ret

Function at 0x41171a
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x411742
cmp byte [esp + 8], 0
je 0x411742
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
neg eax
sbb eax, eax
inc eax
ret
xor al, al
ret
Function at 0x411b28
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
lea eax, [ebp - 8]
push 3
push eax
call fcn.0040cbce
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.SW_Licen
push 0x42f110
call fcn.00409a00
add esp, 0x20
call fcn.00410e93
movsx eax, al
dec eax
mov byte [0x42e628], bl
mov byte [0x42e629], bl
je 0x411b8f
dec eax
je 0x411cd9
dec eax
je 0x411b85
dec eax
jne 0x411cde
call fcn.004111e7
jmp 0x411cde
call fcn.004115f7
jmp 0x411cde
lea eax, [ebp - 8]
push 8
mov esi, 0x42e62f
push eax
push esi
call fcn.004185f0
add esp, 0xc
test eax, eax
jne 0x411c24
cmp byte [0x42e62c], bl
jne 0x411c1a
cmp byte [0x42e629], bl
jne 0x411c09
cmp byte [0x42e62b], bl
jne 0x411c09
cmp byte [0x42e628], bl
je 0x411be8
mov byte [0x42e629], 1
call fcn.00410541
call fcn.0040f3d4
push str.Softwrap_has_detected_that_this_software_has_been_run_on_this_computer_nbefore._Attempts_have_been_made_to_conceal_this_and_are_thus_construed_nas_being_a_hacking_attempt._Seeing_that_a_hacking_attempt_has_already_been_nrecorded_in_this_license__this_software_is_now_rendered_unusable.
call fcn.00410576
pop ecx
jmp 0x411cde
mov byte [0x42e628], 1
call fcn.00410541
call fcn.0040f3d4
push str.Softwrap_has_detected_that_this_software_has_been_run_on_this_computer_nbefore._Attempts_have_been_made_to_conceal_this_and_are_thus_construed_nas_being_a_hacking_attempt._Any_further_hacking_attempts_will_render_nthis_software_unusable_on_this_computer.
call fcn.00410576
pop ecx
jmp 0x411cd9
call fcn.0040a2bd
call fcn.00411ce2
push 1
call fcn.00417f53
call fcn.00410541
jmp 0x411b7b
lea eax, [ebp - 0x1c]
push eax
call fcn.00411634
lea eax, [ebp - 0x30]
push eax
call fcn.00411657
lea eax, [ebp - 0x1c]
push 0x14
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.004185f0
add esp, 0x14
test eax, eax
jne 0x411c66
mov dword [0x42f0b4], ebx
call fcn.004116ad
cmp dword [0x42f0b4], ebx
je 0x411cde
call fcn.0040c773
jmp 0x411cde
push 0x10
push ebx
push 0x42e5f4
mov byte [0x42e62a], bl
mov byte [0x42e628], bl
mov byte [0x42e629], bl
mov byte [0x42e62c], bl
mov dword [0x42e614], ebx
mov byte [0x42e62d], bl
mov byte [0x42e62e], bl
mov byte [0x42e637], bl
mov dword [0x42e69c], ebx
call fcn.004174b0
push 0x42e604
call fcn.00411307
push 0x42e620
call fcn.00411307
lea eax, [ebp - 8]
push 8
push eax
push esi
call fcn.00417bc0
add esp, 0x20
call fcn.0040ec89
cmp dword [0x42f0b4], ebx
je 0x411cde
call fcn.0040a2bd
pop esi
pop ebx
leave
ret

Function at 0x412227
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push 0
push 1
push 2
call sub.WSOCK32.dll_socket
mov ecx, dword [esp + 4]
cmp eax, 0xffffffff
mov dword [ecx], eax
jne 0x41224c
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.00411fbd
pop ecx
xor al, al
ret
mov al, 1
ret
Function at 0x41224f
Capabilities:
Connect socket

Disassembly:
push esi
push edi
push 0x10
call fcn.004179b4
mov edi, dword [esp + 0x14]
mov esi, eax
pop ecx
mov word [esi], 2
mov ax, word [edi]
push eax
call sub.WSOCK32.dll_htons
push 0x10
push esi
push dword [esp + 0x14]
mov word [esi + 2], ax
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
call sub.WSOCK32.dll_connect
push esi
mov edi, eax
call fcn.00417985
pop ecx
cmp edi, 0xffffffff
pop edi
pop esi
jne 0x4122ae
call sub.WSOCK32.dll_WSAGetLastError
cmp eax, 0x2748
je 0x4122ae
call sub.WSOCK32.dll_WSAGetLastError
push eax
call fcn.00411fbd
pop ecx
xor eax, eax
ret
push 1
pop eax
ret