joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406300
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x154
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax]
lea eax, [ebp - 0x14c]
push 0xa1
push 0
push eax
mov dword [ebp - 0x154], ecx
call fcn.0040eec0
push 0x9b
lea eax, [ebp - 0xa2]
push 0
push eax
call fcn.0040eec0
mov eax, dword [ebx + 0x114]
add esp, 0x18
mov dword [ebp - 0xa8], 0xab00
mov word [ebp - 0xa4], 0x9901
cmp eax, 0xffffffff
je 0x406384
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xa1
call fcn.0040d8dd
push 0xa1
mov edi, eax
push 0
push edi
call fcn.0040eec0
movzx esi, word [ebx + 0x124]
add esp, 0x10
cmp dword [ebx + 0x110], 0xffffffff
je 0x4063e0
push esi
push edi
push dword [ebx + 0x10c]
call dword [sym.imp.HID.DLL_HidD_GetFeature]
movzx eax, al
test eax, eax
je 0x4063e0
movsx esi, byte [edi + 4]
lea eax, [edi + 5]
sub esi, 2
push esi
push eax
lea eax, [ebp - 0x14c]
push eax
call fcn.00410be0
add esp, 0xc
push edi
call fcn.0040d5dd
add esp, 4
test esi, esi
pop edi
pop esi
pop ebx
je 0x40640f
lea eax, [ebp - 0x14c]
push eax
mov eax, dword [ebp - 0x154]
push 0
push 0xc
mov eax, dword [eax + 4]
mov eax, dword [eax]
push dword [eax + 0x40]
call dword [sym.imp.USER32.dll_SendMessageA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4

Function at 0x406420
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x100
mov edi, dword [eax]
mov esi, ecx
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0040eec0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
mov eax, dword [esi + 4]
push 0x100
push 0xd
mov eax, dword [eax]
push dword [eax + 0x40]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406477
lea ecx, [ebp - 0x104]
sub eax, edx
push ecx
push eax
push edi
call dword [sym.imp.msdk.dll_M_VerifyUserData]
pop edi
pop esi
push 0
push 0x42cc20
test eax, eax
jne 0x4064a3
push 0x42cf44
jmp 0x4064a8
push 0x42cf58
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4
Function at 0x4067e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [edx], 1
xorps xmm0, xmm0
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [eax]
push edi
mov edi, ecx
mov eax, dword [esi]
mov dword [ebp - 0x38], eax
jne 0x40688e
push ebx
push eax
push 0x42d100
lea eax, [ebp - 0x34]
push 0x20
push eax
movups xmmword [ebp - 0x34], xmm0
movups xmmword [ebp - 0x24], xmm0
call fcn.00401b10
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x34]
add esp, 0x14
push eax
mov eax, dword [edi]
push 0
push 0xc
push dword [eax + 8]
call esi
mov eax, dword [edi]
cmp dword [eax + 0x340], 1
je 0x406950
push 0
push 0
push 0xf0
push dword [eax + 0x54]
call esi
cmp eax, 1
jne 0x406950
mov eax, dword [edi]
mov eax, dword [eax + 0xc]
push eax
push 0
push 0x111
push eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call esi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi]
push 8
push 0xd
movlpd qword [ebp - 0xc], xmm0
movlpd qword [ebp - 0x14], xmm0
push dword [eax + 0x34]
call esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi]
push 8
push 0xd
push dword [eax + 0x38]
call esi
push 0x10
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00412dd9
push 0x10
mov esi, eax
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00412dd9
add esp, 0x18
cmp esi, dword [ebp - 0x38]
jne 0x406950
cmp eax, ebx
jne 0x406950
mov eax, dword [edi]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
mov dword [eax + 0x33c], 0xffffffff
mov eax, dword [edi]
mov dword [eax + 0x340], 0
mov eax, dword [edi]
mov dword [eax + 0x348], 0
mov eax, dword [edi]
mov dword [eax + 0x34c], 0
mov eax, dword [edi]
push dword [eax + 0xc]
call esi
mov eax, dword [edi]
push 1
push dword [eax + 0x10]
call esi
mov eax, dword [edi]
push 1
push dword [eax + 0x14]
call esi
mov eax, dword [edi]
push 1
push dword [eax + 0x18]
call esi
mov eax, dword [edi]
push 0
push dword [eax + 0x1c]
call esi
mov eax, dword [edi]
push 0
push dword [eax + 0x20]
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret
Function at 0x409470
Capabilities:
Create thread
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 4]
mov eax, dword [eax]
test eax, eax
jne 0x409513
push 0x9b
push eax
lea eax, [ebp - 0xa2]
mov bl, 0x5a
push eax
call fcn.0040eec0
mov eax, dword [edi + 0x114]
add esp, 0xc
mov dword [ebp - 0xa8], 0xaa00
mov word [ebp - 0xa4], 0x5a02
mov byte [ebp - 0xa2], bl
cmp eax, 0xffffffff
je 0x4094eb
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x34]
mov edx, dword [eax + 0x348]
cmp edx, 1
je 0x40960d
xor eax, eax
cmp edx, 2
setne al
lea eax, [eax*2 + 0x70]
jmp 0x409624
cmp eax, 1
jne 0x40959c
push 0x9b
lea eax, [ebp - 0xa2]
mov bl, 0x5a
push 0
push eax
call fcn.0040eec0
mov eax, dword [edi + 0x114]
add esp, 0xc
mov dword [ebp - 0xa8], 0xaa00
mov word [ebp - 0xa4], 0x5b02
mov byte [ebp - 0xa2], bl
cmp eax, 0xffffffff
je 0x409574
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x34]
mov edx, dword [eax + 0x348]
cmp edx, 1
je 0x40960d
xor eax, eax
cmp edx, 2
setne al
lea eax, [eax*2 + 0x71]
jmp 0x409624
cmp eax, 2
jne 0x40962a
push 0x9b
lea eax, [ebp - 0xa2]
mov bl, 0x5a
push 0
push eax
call fcn.0040eec0
mov eax, dword [edi + 0x114]
add esp, 0xc
mov dword [ebp - 0xa8], 0xaa00
mov word [ebp - 0xa4], 0x5c02
mov byte [ebp - 0xa2], bl
cmp eax, 0xffffffff
je 0x4095fd
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esi]
mov eax, dword [ecx + 0x34]
mov edx, dword [eax + 0x348]
cmp edx, 1
jne 0x409614
mov eax, 0x6f
jmp 0x409624
cmp edx, 2
mov eax, 0x74
mov edi, 0x71
cmove eax, edi
mov dword [ecx + 0x164], eax
push 0
push 0
push dword [esi]
push 0x409920
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x5dc
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4
Function at 0x409a60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov esi, dword [eax]
push edi
push 0
mov eax, dword [ebx + 4]
push 0
push 0xf0
mov eax, dword [eax]
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x9c
mov dword [ebp - 0xb0], eax
lea eax, [ebp - 0xa3]
push 0
push eax
mov word [ebp - 0xac], 0x908
call fcn.0040eec0
mov ax, word [ebp - 0xac]
add esp, 0xc
mov word [ebp - 0xa3], ax
mov eax, dword [esi + 0x114]
mov dword [ebp - 0xa8], 0xff00
mov byte [ebp - 0xa4], 2
cmp eax, 0xffffffff
je 0x409aff
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esi + 0x110], 0xffffffff
movzx edi, word [esi + 0x124]
je 0x409b6b
push edi
lea eax, [ebp - 0xa8]
push eax
push dword [esi + 0x10c]
call dword [sym.imp.HID.DLL_HidD_GetFeature]
movzx eax, al
test eax, eax
je 0x409b6b
test edi, edi
je 0x409b6b
cmp dword [ebp - 0xb0], 0
mov ecx, esi
push 0x21
sete al
lea eax, [eax*2 - 1]
mov byte [ebp - 0x9e], al
mov byte [ebp - 0x8e], al
lea eax, [ebp - 0xa3]
push eax
call fcn.0040d200
push 0x22
lea eax, [ebp - 0x93]
mov ecx, esi
push eax
call fcn.0040d200
mov eax, dword [ebx + 4]
push 0
push 0
push 0xf0
mov eax, dword [eax]
push dword [eax + 0x198]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x409b9e
push eax
push 0x42cc20
push 0x42d2c8
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4

Function at 0x409bb0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa2]
push edi
push 0x9b
push 0
push eax
mov edi, ecx
mov bl, 0x5a
call fcn.0040eec0
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 0xa8], 0xaa00
mov word [ebp - 0xa4], 0x4402
mov byte [ebp - 0xa2], bl
mov eax, dword [eax + 0x114]
cmp eax, 0xffffffff
je 0x409c25
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [edi + 4]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push str.UHost
push 0
push 0xc
push dword [eax + 0x48]
call esi
mov eax, dword [edi + 4]
push str.UKBoard
push 0
push 0xc
push dword [eax + 0x184]
call esi
mov eax, dword [edi + 4]
push str.UMouse
push 0
push 0xc
push dword [eax + 0x188]
call esi
mov eax, dword [edi + 4]
push 0
push 0
push 0xf0
push dword [eax + 0x1a0]
call esi
pop edi
pop esi
pop ebx
test eax, eax
jne 0x409c91
push eax
push 0x42cc20
push 0x42d2c8
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4
Function at 0x40bfd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [eax]
lea eax, [ebp - 0xc]
push edi
mov edi, ecx
movlpd qword [ebp - 0xc], xmm0
push eax
push 8
push 0xd
mov eax, dword [edi + 4]
movlpd qword [ebp - 0x14], xmm0
push dword [eax + 0x90]
call esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi + 4]
push 8
push 0xd
push dword [eax + 0x94]
call esi
push 0xa
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00412dd9
push 0xa
mov esi, eax
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00412dd9
add esp, 0x18
push eax
push esi
push ebx
call dword [sym.imp.msdk.dll_M_ResolutionUsed]
pop edi
pop esi
pop ebx
push 0
push 0x42cc20
test eax, eax
jne 0x40c060
push 0x42d6fc
jmp 0x40c065
push 0x42d70c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4

Function at 0x40c080
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
xorps xmm0, xmm0
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, dword [eax]
lea eax, [ebp - 0xc]
push edi
mov edi, ecx
movlpd qword [ebp - 0xc], xmm0
push eax
push 8
push 0xd
mov eax, dword [edi + 4]
movlpd qword [ebp - 0x14], xmm0
push dword [eax + 0x98]
call esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi + 4]
push 8
push 0xd
push dword [eax + 0x9c]
call esi
push 0xa
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00412dd9
push 0xa
mov esi, eax
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00412dd9
add esp, 0x18
push eax
push esi
push ebx
call dword [sym.imp.msdk.dll_M_MoveTo3]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4

Function at 0x40c2f0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x3e8
mov edi, dword [eax]
mov esi, ecx
push 0x320
call dword [sym.imp.msdk.dll_M_DelayRandom]
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.0040eec0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
mov eax, dword [esi + 4]
push 0x100
push 0xd
mov eax, dword [eax]
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x104]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c357
sub eax, edx
push eax
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.msdk.dll_M_KeyInputStringGBK]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4
Function at 0x40c440
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov ebx, dword [eax]
mov edi, ecx
push 0x3e8
push 0x320
call dword [sym.imp.msdk.dll_M_DelayRandom]
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [edi + 4]
xorps xmm0, xmm0
movlpd qword [ebp - 0xc], xmm0
movlpd qword [ebp - 0x14], xmm0
push 8
mov eax, dword [eax]
push 0xd
push dword [eax + 0x90]
call esi
lea eax, [ebp - 0x14]
push eax
mov eax, dword [edi + 4]
push 8
push 0xd
mov eax, dword [eax]
push dword [eax + 0x94]
call esi
push 0xa
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00412dd9
push 0xa
mov esi, eax
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00412dd9
add esp, 0x18
push eax
push esi
push ebx
call dword [sym.imp.msdk.dll_M_ResolutionUsed]
test eax, eax
jne 0x40c549
mov esi, dword [sym.imp.msdk.dll_M_MoveTo3]
push 0x64
push 0x64
push ebx
call esi
push ebx
call dword [sym.imp.msdk.dll_M_LeftDown]
mov edi, dword [sym.imp.msdk.dll_M_DelayRandom]
push 0xc8
push 0x64
call edi
push 0x64
push 0xc8
push ebx
call esi
push 0xc8
push 0x64
call edi
push 0xc8
push 0x64
push ebx
call esi
push 0xc8
push 0x64
call edi
push 0xc8
push 0xc8
push ebx
call esi
push 0xc8
push 0x64
call edi
push 0x64
push 0x64
push ebx
call esi
push 0xc8
push 0x64
call edi
push ebx
call dword [sym.imp.msdk.dll_M_ReleaseAllMouse]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 4

Function at 0x40c690
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x42dc28
mov edx, 0x6b
mov ecx, str..msdk.dll
call fcn.0040c720
push 0x42dc28
mov edx, 0x6e
mov ecx, str..LibMsdkKey.dll
call fcn.0040c720
push 0x42dc28
mov edx, 0x6c
mov ecx, str..WCH55xISPDLL.dll
call fcn.0040c720
push 0x42dc28
mov edx, 0x76
mov ecx, str..CH375DLL.dll
call fcn.0040c720
add esp, 0x10
push dword [ebp + 8]
call fcn.00404f30
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..msdk.dll
call esi
push str..LibMsdkKey.dll
call esi
push str..WCH55xISPDLL.dll
call esi
push str..CH375DLL.dll
call esi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x40c720
Capabilities:
Delete file
Extract resource via kernel32 functions
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, ecx
push edi
push eax
mov edi, edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
movzx eax, di
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40c7e5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0x40c7e5
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40c7e5
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
je 0x40c7e5
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push 0
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], eax
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40c7e5
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret
Function at 0x40d200
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0xa3]
push edi
push 0x9c
push 0
push eax
mov edi, ecx
call fcn.0040eec0
mov eax, dword [ebp + 0xc]
push eax
mov byte [ebp - 0xa4], al
lea eax, [ebp - 0xa3]
push esi
push eax
mov dword [ebp - 0xa8], 0xff00
call fcn.00410be0
mov eax, dword [edi + 0x114]
add esp, 0x18
pop edi
pop esi
cmp eax, 0xffffffff
je 0x40d27a
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 8

Function at 0x40d290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x9b
lea eax, [ebp - 0xa2]
mov esi, ecx
push 0
push eax
mov bl, 0x5a
call fcn.0040eec0
mov eax, dword [esi + 0x114]
add esp, 0xc
mov byte [ebp - 0xa2], bl
mov dword [ebp - 0xa8], 0xaa00
mov word [ebp - 0xa4], 0x4402
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x40d301
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret

Function at 0x40d310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x9b
lea eax, [ebp - 0xa2]
mov esi, ecx
push 0
push eax
mov bl, 0x5a
call fcn.0040eec0
mov eax, dword [esi + 0x114]
add esp, 0xc
mov byte [ebp - 0xa2], bl
mov dword [ebp - 0xa8], 0xaa00
mov word [ebp - 0xa4], 0x5002
pop esi
pop ebx
cmp eax, 0xffffffff
je 0x40d381
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret
Function at 0x40d390
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
mov eax, dword [0x431008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0xb8], eax
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov bl, 0x5a
push edi
mov dword [ebp - 0xc8], eax
mov eax, dword [ebp + 0x10]
push 0x9b
mov dword [ebp - 0xcc], eax
lea eax, [ebp - 0xa2]
push 0
push eax
call fcn.0040eec0
mov eax, dword [esi + 0x114]
add esp, 0xc
mov dword [ebp - 0xa8], 0xab00
mov word [ebp - 0xa4], 0x6102
mov byte [ebp - 0xa2], bl
cmp eax, 0xffffffff
je 0x40d41b
push 0
lea ecx, [ebp - 0xac]
push ecx
push 0xa1
lea ecx, [ebp - 0xa8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xa1
call fcn.0040d8dd
push 0xa1
mov edi, eax
push 0
push edi
mov dword [ebp - 0xac], edi
call fcn.0040eec0
movzx ebx, word [esi + 0x124]
add esp, 0x10
cmp dword [esi + 0x110], 0xffffffff
je 0x40d5b0
push ebx
push edi
push dword [esi + 0x10c]
call dword [sym.imp.HID.DLL_HidD_GetFeature]
movzx eax, al
test eax, eax
je 0x40d5b0
test ebx, ebx
je 0x40d5b0
movsx eax, byte [edi + 4]
sub eax, 2
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov dword [ebp - 0xc0], ebx
lea esi, [ebx + ebx]
push esi
mov dword [ebp - 0xc4], esi
call fcn.0040d8dd
push esi
push 0
push eax
mov dword [ebp - 0xb4], eax
call fcn.0040eec0
lea eax, [edi + 5]
push ebx
push eax
push dword [ebp - 0xb4]
call fcn.00410be0
mov ecx, dword [ebp - 0xb4]
add esp, 0x1c
xor edx, edx
mov word [ebp - 0xb0], 0x5b3a
lea eax, [ecx + ebx]
mov dword [ebp - 0xbc], eax
test ebx, ebx
jle 0x40d50c
mov edi, dword [ebp - 0xc0]
mov ebx, ecx
mov esi, eax
sub ebx, esi
mov eax, edx
lea ecx, [edx + esi]
and eax, 1
inc edx
mov al, byte [ebp + eax - 0xb0]
xor al, byte [ebx + ecx]
mov byte [ecx], al
cmp edx, edi
jl 0x40d4e1
mov esi, dword [ebp - 0xc4]
mov edi, dword [ebp - 0xac]
mov ecx, dword [ebp - 0xb4]
lea edx, [edi + 5]
sub esi, 4
jb 0x40d525
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x40d52a
add ecx, 4
add edx, 4
sub esi, 4
jae 0x40d514
cmp esi, 0xfffffffc
je 0x40d569
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x40d557
cmp esi, 0xfffffffd
je 0x40d569
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x40d557
cmp esi, 0xfffffffe
je 0x40d569
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x40d557
cmp esi, 0xffffffff
je 0x40d569
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x40d569
mov eax, dword [ebp - 0xb8]
test eax, eax
je 0x40d5a2
mov dword [eax], 0
jmp 0x40d5a2
mov ecx, dword [ebp - 0xb8]
test ecx, ecx
je 0x40d579
movsx eax, byte [edi + 5]
mov dword [ecx], eax
mov edx, dword [ebp - 0xc8]
test edx, edx
je 0x40d592
movsx ecx, byte [edi + 7]
movsx eax, byte [edi + 6]
shl ecx, 8
add ecx, eax
mov dword [edx], ecx
mov ecx, dword [ebp - 0xcc]
test ecx, ecx
je 0x40d5a2
movsx eax, byte [edi + 8]
mov dword [ecx], eax
push dword [ebp - 0xb4]
call fcn.0040d5dd
add esp, 4
push edi
call fcn.0040d5dd
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.0040d5cc
mov esp, ebp
pop ebp
ret 0xc