joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002688
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
push ebx
push esi
push edi
je 0x100026dd
push dword [esp + 0x10]
push 0x10002607
call dword [sym.imp.USER32.dll_EnumWindows]
mov esi, dword [0x10006a38]
test esi, esi
je 0x10002736
xor edi, edi
mov ebx, dword [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x100026d5
cmp byte [esi + 0x10], 0
je 0x100026d5
push 3
push edi
push edi
push edi
push edi
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov esi, ebx
test ebx, ebx
jne 0x100026b1
jmp 0x10002736
mov esi, dword [0x10006a38]
test esi, esi
je 0x10002736
xor edi, edi
push ebp
mov ebx, dword [esi]
lea ebp, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [ebp], eax
jne 0x1000272f
cmp byte [esi + 0x11], 0
je 0x1000270b
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
cmp byte [esi + 0x10], 0
je 0x10002722
push 3
push edi
push edi
push edi
push edi
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SetWindowPos]
push ebp
push 0x10006a38
call fcn.10003d1c
pop ecx
pop ecx
mov esi, ebx
test ebx, ebx
jne 0x100026ea
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x10002867
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x100029af
xor ecx, ecx
cmp word [eax], cx
je 0x100029af
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x100028c0
cmp eax, 3
jne 0x100028fa
cmp word [esp + 0xa], 0x3a
jne 0x100028fa
cmp eax, 2
jne 0x100028de
lea eax, [esp + 8]
push 0x10005024
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x100029af
push 0xfffffffffffffffe
pop edi
jmp 0x100029af
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x1000290f
cmp ax, bx
jne 0x10002919
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x10002902
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x10002958
test byte [esp + 0x21c], 0x10
je 0x1000293f
push 0xfffffffffffffffe
pop edi
jmp 0x1000294f
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x100029ad
cmp word [esp + 0x10], bp
jne 0x10002966
cmp word [esp + 0x12], bp
je 0x10002985
cmp word [esp + 0x10], bx
jne 0x10002974
cmp word [esp + 0x12], bx
je 0x10002985
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x100029ad
cmp word [esp + 0x12], ax
jne 0x100029ad
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x1000299a
test al, 0x10
je 0x100029ad
jmp 0x100029aa
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x100029ad
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4

Function at 0x100029be
Capabilities:
Set file attributes

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
je 0x100029cc
jmp dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 8

Function at 0x100029cf
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x10002a47
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
lea ecx, [ebp - 0x20c]
add esp, 0x10
lea eax, [ecx + eax*2]
jmp 0x10002a28
movzx ecx, word [eax - 2]
cmp ecx, 0x20
je 0x10002a25
cmp ecx, 0x5c
je 0x10002a25
cmp ecx, 0x2f
jne 0x10002a32
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x10002a12
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x10002a49
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x10002ac0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
mov dword [esp + 4], 0
cmp dword [esi + 0x14], 0
jne 0x10002afc
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [esi + 8]
sub eax, dword [esi + 0xc]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esi + 8]
mov dword [esi + 0xc], eax
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 4
xor eax, eax
pop esi
pop ecx
ret 4

Function at 0x10002e50
Capabilities:
Write file on windows

Disassembly:
push ecx
mov edx, dword [esp + 0xc]
mov dword [esp], 0
test edx, edx
je 0x10002e48
cmp word [edx], 0
je 0x10002e48
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0xc]
test ecx, ecx
jne 0x10002d6e
mov ecx, dword [esi + 0x18]
push edi
cmp ecx, 0x19
jne 0x10002dcd
cmp dword [esi + 4], 0
mov ecx, edx
lea edi, [ecx + 2]
je 0x10002da0
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002d80
sub ecx, edi
sar ecx, 1
lea eax, [ecx + ecx]
push eax
push edx
push esi
call fcn.10002e80
pop edi
pop esi
pop ecx
ret 0xc
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10002da0
sub ecx, edi
lea eax, [esp + 8]
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
push edx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
cmp ecx, 2
lea ecx, [esp + 0x14]
setne al
push ecx
dec eax
and eax, 0xfde9
push edx
push eax
call fcn.10002f90
mov edi, eax
test edi, edi
je 0x10002dc3
cmp dword [esi + 4], 0
je 0x10002e1b
push dword [esp + 0x14]
push edi
push esi
call fcn.10002e80
push edi
push 0
push dword [0x100069d0]
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
push 0
lea eax, [esp + 0xc]
push eax
push dword [esp + 0x1c]
push edi
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
push 0
push dword [0x100069d0]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
xor eax, eax
pop ecx
ret 0xc
push dword [esp + 4]
push dword [0x10006f80]
call fcn.10003b79
test eax, eax
je 0x10002e6c
mov dword [esp + 4], eax
jmp 0x10002d40
xor eax, eax
ret 0xc
Function at 0x10002e80
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push esi
mov esi, dword [esp + 0x14]
mov dword [esp + 4], 0
cmp dword [esi + 0x1c], 0
jne 0x10002f87
cmp dword [esi + 0x14], 1
jne 0x10002ecb
mov eax, dword [esi + 0xc]
lea ecx, [esp + 0xc]
push 1
neg eax
cdq
push ecx
push eax
push dword [esi]
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0xc]
push edi
mov edi, dword [esp + 0x20]
cmp eax, edi
jle 0x10002f48
mov ecx, dword [esi + 8]
add ecx, dword [esi + 4]
sub ecx, eax
mov eax, edi
dec eax
je 0x10002f33
dec eax
je 0x10002f1c
sub eax, 2
je 0x10002f07
push edi
push dword [esp + 0x20]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov ax, word [eax]
mov word [ecx], ax
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
mov eax, dword [esp + 0x1c]
mov al, byte [eax]
mov byte [ecx], al
mov eax, edi
sub dword [esi + 0xc], edi
pop edi
pop esi
add esp, 0xc
ret 0xc
push esi
call fcn.10002ac0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x10002f75
push 0
lea eax, [esp + 0xc]
push eax
push edi
push dword [esp + 0x28]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0xc
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
push edi
push dword [esp + 0x20]
add ecx, eax
jmp 0x10002ef1
xor eax, eax
pop esi
add esp, 0xc
ret 0xc

Function at 0x10003178
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x44b521aa
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x45725fe
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x404cf3
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
push edi
push ebx
lea edi, [ebp - 0x2b4]
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
lea edx, [ebp - 0x14]
push edx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.DLL_OpenProcessToken]
test eax, eax
jne 0x404d2c
lea esi, [0x404ef8]
call fcn.00404eb2
jmp 0x404eab
lea edx, [ebp - 0xc]
push edx
push 0x405032
push 0
call dword [sym.imp.ADVAPI32.DLL_LookupPrivilegeValueA]
test eax, eax
jne 0x404d51
lea esi, [0x404f09]
call fcn.00404eb2
jmp 0x404ea2
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
lea edx, [ebp - 0x10]
push 0
push 0
push 0
push edx
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.DLL_AdjustTokenPrivileges]
test eax, eax
jne 0x404d88
lea esi, [0x404f2f]
call fcn.00404eb2
jmp 0x404ea2
mov eax, dword [ebp + 8]
cmp al, 0x80
je 0x404da8
cmp al, 1
je 0x404dd4
cmp al, 2
je 0x404e5d
cmp al, 3
je 0x404e34
jmp 0x404e86
push 0
push 0x404fb3
call fcn.00414acf
push 0
call dword [sym.imp.ADVAPI32.DLL_AbortSystemShutdownA]
test eax, eax
jne 0x404e86
lea esi, [0x404f56]
call fcn.00404eb2
jmp 0x404e86
lea edi, [ebp - 0x2b4]
push dword [ebp + 0xc]
push 0x40500a
push 0x2a0
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
push 0
push edi
call fcn.00414acf
push dword [ebp + 0x10]
push 0x405046
push 0x2a0
push edi
call dword [sym.imp.SHLWAPI.DLL_wnsprintfA]
add esp, 0x10
push dword [ebp + 0x14]
push 0
push 1
push dword [ebp + 0xc]
push edi
push 0
call dword [sym.imp.ADVAPI32.DLL_InitiateSystemShutdownExW]
test eax, eax
jne 0x404e86
lea esi, [0x404f6a]
call fcn.00404eb2
jmp 0x404e86
push 0
push 0x404ff3
call fcn.00414acf
push 1
push 1
push 0
call dword [sym.imp.POWRPROF.DLL_SetSuspendState]
test eax, eax
jne 0x404e86
lea esi, [0x404f83]
call fcn.00404eb2
jmp 0x404e86
push 0
push 0x404fd8
call fcn.00414acf
push 1
push 1
push 1
call dword [sym.imp.POWRPROF.DLL_SetSuspendState]
test eax, eax
jne 0x404e86
lea esi, [0x404f99]
call fcn.00404eb2
jmp 0x404e86
mov dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push 0
push 0
push 0
push edx
push 0
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.DLL_AdjustTokenPrivileges]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x4051fa
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov eax, dword [str.Powered_by_batteries]
call fcn.004080cb
cmp byte [0x427d55], 0
je 0x405230
push 0
push 0
push dword [0x431600]
push 0x404a64
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x427d60], 0
je 0x405243
mov eax, dword [0x427d61]
call fcn.00412142
cmp byte [0x427d5b], 0
jne 0x405275
cmp byte [0x427d5c], 0
jne 0x405275
cmp byte [0x427d5d], 0
jne 0x405275
cmp byte [0x427d5e], 0
jne 0x405275
cmp byte [0x428175], 0
jne 0x405275
jmp 0x4052f8
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
test eax, eax
je 0x4052f8
mov ebx, eax
mov al, byte [0x427d5b]
mov byte [ebx], al
mov al, byte [0x427d5c]
mov byte [ebx + 1], al
mov al, byte [0x427d5d]
mov byte [ebx + 2], al
mov al, byte [0x427d5e]
mov byte [ebx + 3], al
mov al, byte [0x427d5f]
mov byte [ebx + 0x10], al
mov eax, dword [str.Powered_by_batteries]
mov dword [ebx + 4], eax
lea eax, [0x427d65]
mov dword [ebx + 8], eax
lea eax, [0x427f6d]
mov dword [ebx + 0xc], eax
mov al, byte [0x428175]
mov byte [ebx + 0x13], al
mov eax, dword [0x428178]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0x6000b
push 0
push 0
push ebx
push 0x404b90
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
ret

Function at 0x4052fc
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov eax, dword [str.Battery_level_is_below_the_limit]
call fcn.004080cb
cmp byte [0x428191], 0
je 0x405332
push 0
push 0
push dword [0x431618]
push 0x404a64
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x42819d], 0
je 0x405345
mov eax, dword [0x42819e]
call fcn.00412142
mov eax, dword [str.Battery_level_is_below_the_limit]
call fcn.004080cb
cmp byte [0x428198], 0
jne 0x405381
cmp byte [0x428199], 0
jne 0x405381
cmp byte [0x42819a], 0
jne 0x405381
cmp byte [0x42819b], 0
jne 0x405381
cmp byte [0x4285b2], 0
jne 0x405381
jmp 0x405404
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
test eax, eax
je 0x405404
mov ebx, eax
mov al, byte [0x428198]
mov byte [ebx], al
mov al, byte [0x428199]
mov byte [ebx + 1], al
mov al, byte [0x42819a]
mov byte [ebx + 2], al
mov al, byte [0x42819b]
mov byte [ebx + 3], al
mov al, byte [0x42819c]
mov byte [ebx + 0x10], al
mov eax, dword [str.Battery_level_is_below_the_limit]
mov dword [ebx + 4], eax
lea eax, [0x4281a2]
mov dword [ebx + 8], eax
lea eax, [0x4283aa]
mov dword [ebx + 0xc], eax
mov al, byte [0x4285b2]
mov byte [ebx + 0x13], al
mov eax, dword [0x4285b4]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0x6000b
push 0
push 0
push ebx
push 0x404b90
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
ret
Function at 0x405408
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov eax, dword [str.The_battery_is_low]
call fcn.004080cb
cmp byte [0x4285b9], 0
je 0x40543e
push 0
push 0
push dword [0x431608]
push 0x404a64
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x4285c5], 0
je 0x405451
mov eax, dword [0x4285c6]
call fcn.00412142
cmp byte [0x4285c0], 0
jne 0x405483
cmp byte [0x4285c1], 0
jne 0x405483
cmp byte [0x4285c2], 0
jne 0x405483
cmp byte [0x4285c3], 0
jne 0x405483
cmp byte [0x4289da], 0
jne 0x405483
jmp 0x405506
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
test eax, eax
je 0x405506
mov ebx, eax
mov al, byte [0x4285c0]
mov byte [ebx], al
mov al, byte [0x4285c1]
mov byte [ebx + 1], al
mov al, byte [0x4285c2]
mov byte [ebx + 2], al
mov al, byte [0x4285c3]
mov byte [ebx + 3], al
mov al, byte [0x4285c4]
mov byte [ebx + 0x10], al
mov eax, dword [str.The_battery_is_low]
mov dword [ebx + 4], eax
lea eax, [0x4285ca]
mov dword [ebx + 8], eax
lea eax, [0x4287d2]
mov dword [ebx + 0xc], eax
mov al, byte [0x4289da]
mov byte [ebx + 0x13], al
mov eax, dword [0x4289dc]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0x6000b
push 0
push 0
push ebx
push 0x404b90
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
ret

Function at 0x40550a
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov eax, dword [str.Mains_power_is_restored]
call fcn.004080cb
cmp byte [0x4289e1], 0
je 0x405540
push 0
push 0
push dword [0x431620]
push 0x404a64
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x4289ed], 0
je 0x40554e
call fcn.0041213a
cmp byte [0x4289e8], 0
jne 0x405580
cmp byte [0x4289e9], 0
jne 0x405580
cmp byte [0x4289ea], 0
jne 0x405580
cmp byte [0x4289eb], 0
jne 0x405580
cmp byte [0x428e02], 0
jne 0x405580
jmp 0x405607
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
test eax, eax
je 0x405607
mov ebx, eax
mov al, byte [0x4289e8]
mov byte [ebx], al
mov al, byte [0x4289e9]
mov byte [ebx + 1], al
mov al, byte [0x4289ea]
mov byte [ebx + 2], al
mov al, byte [0x4289eb]
mov byte [ebx + 3], al
mov al, byte [0x4289ec]
mov byte [ebx + 0x10], al
mov eax, dword [str.Mains_power_is_restored]
mov dword [ebx + 4], eax
lea eax, [0x4289f2]
mov dword [ebx + 8], eax
lea eax, [0x428bfa]
mov dword [ebx + 0xc], eax
movzx eax, byte [0x428e02]
shl al, 7
mov byte [ebx + 0x13], al
mov dword [ebx + 0x14], 0
mov dword [ebx + 0x18], 0
push 0
push 0
push ebx
push 0x404b90
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
ret
Function at 0x40560b
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov eax, dword [str.Error_UPS]
call fcn.004080cb
cmp byte [0x428e05], 0
je 0x405641
push 0
push 0
push dword [0x431610]
push 0x404a64
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x428e11], 0
je 0x405654
mov eax, dword [0x428e12]
call fcn.00412142
cmp byte [0x428e0c], 0
jne 0x405686
cmp byte [0x428e0d], 0
jne 0x405686
cmp byte [0x428e0e], 0
jne 0x405686
cmp byte [0x428e0f], 0
jne 0x405686
cmp byte [0x429226], 0
jne 0x405686
jmp 0x405709
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
test eax, eax
je 0x405709
mov ebx, eax
mov al, byte [0x428e0c]
mov byte [ebx], al
mov al, byte [0x428e0d]
mov byte [ebx + 1], al
mov al, byte [0x428e0e]
mov byte [ebx + 2], al
mov al, byte [0x428e0f]
mov byte [ebx + 3], al
mov al, byte [0x428e10]
mov byte [ebx + 0x10], al
mov eax, dword [str.Error_UPS]
mov dword [ebx + 4], eax
lea eax, [0x428e16]
mov dword [ebx + 8], eax
lea eax, [0x42901e]
mov dword [ebx + 0xc], eax
mov al, byte [0x429226]
mov byte [ebx + 0x13], al
mov eax, dword [0x429228]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0x6000c
push 0
push 0
push ebx
push 0x404b90
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
ret

Function at 0x40570d
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov eax, dword [str.Communication_with_UPS_lost]
call fcn.004080cb
cmp byte [0x42922d], 0
je 0x405743
push 0
push 0
push dword [0x431628]
push 0x404a64
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp byte [0x429234], 0
jne 0x405775
cmp byte [0x429235], 0
jne 0x405775
cmp byte [0x429236], 0
jne 0x405775
cmp byte [0x429237], 0
jne 0x405775
cmp byte [0x42964e], 0
jne 0x405775
jmp 0x4057f8
push 0x1c
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
test eax, eax
je 0x4057f8
mov ebx, eax
mov al, byte [0x429234]
mov byte [ebx], al
mov al, byte [0x429235]
mov byte [ebx + 1], al
mov al, byte [0x429236]
mov byte [ebx + 2], al
mov al, byte [0x429237]
mov byte [ebx + 3], al
mov al, byte [0x429238]
mov byte [ebx + 0x10], al
mov eax, dword [str.Communication_with_UPS_lost]
mov dword [ebx + 4], eax
lea eax, [0x42923e]
mov dword [ebx + 8], eax
lea eax, [0x429446]
mov dword [ebx + 0xc], eax
mov al, byte [0x42964e]
mov byte [ebx + 0x13], al
mov eax, dword [0x429650]
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], 0x6000c
push 0
push 0
push ebx
push 0x404b90
push 0
push 0
call dword [sym.imp.KERNEL32.DLL_CreateThread]
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
pop ebx
ret
Function at 0x407c51
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push esi
push ebx
push 0
push pe_nt_image_headers32
push 3
push 0
push 7
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
jne 0x407c8e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 2
je 0x407d22
jmp 0x407d29
mov ebx, eax
lea esi, [ebp - 0xc]
mov dword [esi], 0
mov dword [esi + 4], 0
push esi
push ebx
call dword [sym.imp.KERNEL32.DLL_GetFileSizeEx]
test eax, eax
jne 0x407cb5
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x407d29
cmp dword [esi + 4], 0
jne 0x407cc3
mov esi, dword [esi]
test esi, esi
js 0x407cc3
jne 0x407ccc
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x407d29
test esi, esi
jne 0x407cd5
xor edi, edi
dec esi
jmp 0x407d10
push esi
push 0x40
call dword [sym.imp.KERNEL32.DLL_LocalAlloc]
mov edi, eax
test eax, eax
jne 0x407ced
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x407d29
lea edx, [ebp - 4]
push 0
push edx
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x407d10
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_LocalFree]
jmp 0x407d29
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov edx, esi
mov eax, edi
pop ebx
pop esi
pop edi
leave
ret 4
xor eax, eax
dec eax
mov edx, eax
jmp 0x407d1b
xor eax, eax
xor edx, edx
jmp 0x407d1b

Function at 0x4081c5
Capabilities:
Write file on windows

Disassembly:
pushal
mov byte [0x4298c4], 1
push 0
push 0x20
push 2
push 0
push 3
push 0x40000000
push 0x429654
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
cmp eax, 0xffffffff
jne 0x40820f
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x41f058
push 0x1010
push 0x429654
push dword [0x4315d0]
push eax
call fcn.0040ab8f
jmp 0x408255
mov ebx, eax
push 0
push 0x421264
push 0x364
push 0x4298c4
push ebx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
jne 0x40824e
call dword [sym.imp.KERNEL32.DLL_GetLastError]
push 0x41f058
push 0x1010
push 0x429654
push dword [0x4315d0]
push eax
call fcn.0040ab8f
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
popal
ret