joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40134a
Capabilities:
Manipulate boot configuration

Disassembly:
push ebx
push edi
xor eax, eax
push eax
mov edx, dword [0x405734]
push edx
push edx
push 1
mov eax, str..wim
push eax
mov eax, str..exe
push eax
mov edx, dword [0x405734]
push edx
push edx
call fcn.004025f0
mov edx, dword [0x4051e0]
add dword [esp], edx
call fcn.004021d0
lea eax, [esp + 4]
push eax
call fcn.00403400
mov edx, dword [0x405734]
push edx
push edx
push dword [esp + 8]
call fcn.00402f65
push 0x405710
call fcn.00403400
push dword [esp]
call fcn.00402f77
push edx
push eax
pop ebx
pop edi
cmp edi, 0
jg 0x4013c4
jl 0x4013c0
cmp ebx, 0
ja 0x4013c4
xor eax, eax
jmp 0x4013c9
mov eax, 1
or eax, eax
je 0x4013cf
jmp 0x401439
push dword [0x405734]
push 0xfffd
push 1
push dword [0x405734]
mov edx, 0x405128
push edx
call fcn.004033a0
mov edx, dword [0x405710]
push edx
call fcn.004033a0
mov edx, 0x405182
push edx
call fcn.004033a0
add dword [0x405734], 2
mov eax, str.Wim
push eax
mov eax, 0x405066
push eax
push 0
mov edx, dword [0x4051e0]
add dword [esp + 0xc], edx
call fcn.00401215
pop dword [0x405734]
jmp 0x4010be
push 3
mov eax, 0x405028
push eax
mov eax, str._bootsequence_11111111_1111_1111_1111_111111111111
push eax
mov eax, str.bcdedit.exe
push eax
call fcn.0040268f
xor eax, eax
push dword [esp]
call fcn.00403480
add esp, 4
pop edi
pop ebx
ret
Function at 0x402f77
Capabilities:
Get disk information
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x45c
push esi
or esi, 0xffffffff
push edi
mov edi, esi
test eax, eax
je 0x4030bf
xor ecx, ecx
cmp word [eax], cx
je 0x4030bf
push 0x104
push eax
lea eax, [esp + 0x10]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [esp + 0x21c], ax
lea eax, [esp + 0x14]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea ecx, [esp + eax*2 + 6]
cmp eax, 2
je 0x402fd0
cmp eax, 3
jne 0x40300a
cmp word [esp + 0xa], 0x3a
jne 0x40300a
cmp eax, 2
jne 0x402fee
lea eax, [esp + 8]
push 0x404020
push eax
call sub.MSVCRT.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4030bf
push 0xfffffffffffffffe
pop edi
jmp 0x4030bf
push ebx
push ebp
push 0x5c
pop ebp
push 0x2f
pop ebx
movzx eax, word [ecx]
cmp ax, bp
je 0x40301f
cmp ax, bx
jne 0x403029
xor eax, eax
mov word [ecx], ax
sub ecx, 2
jmp 0x403012
lea eax, [esp + 0x21c]
push eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, esi
je 0x403068
test byte [esp + 0x21c], 0x10
je 0x40304f
push 0xfffffffffffffffe
pop edi
jmp 0x40305f
mov esi, dword [esp + 0x238]
xor edi, edi
or edi, dword [esp + 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4030bd
cmp word [esp + 0x10], bp
jne 0x403076
cmp word [esp + 0x12], bp
je 0x403095
cmp word [esp + 0x10], bx
jne 0x403084
cmp word [esp + 0x12], bx
je 0x403095
push 0x2e
pop eax
cmp word [esp + 0x10], ax
jne 0x4030bd
cmp word [esp + 0x12], ax
jne 0x4030bd
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, esi
je 0x4030aa
test al, 0x10
je 0x4030bd
jmp 0x4030ba
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4030bd
push 0xfffffffffffffffe
pop edi
pop ebp
pop ebx
mov eax, edi
mov edx, esi
pop edi
pop esi
add esp, 0x45c
ret 4
Function at 0x484ce6
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x484a08
and ecx, ecx
dec eax
call fcn.00484d21
mov ecx, 0x58b45db8
xor dword [edi], ebx
add eax, 1
mov ecx, 0x1bdfecca
or ecx, ecx
add edi, 2
sub ecx, ecx
cmp edi, esi
jl fcn.00484ce6
inc ecx
and ecx, ecx
sub eax, 0xf912cd6b
ret
Function at 0x7ffe535d
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, dword fs:[0x30]
push edx
cdq
pop edx
cld
push edx
cdq
pop edx
cld
and bh, 0xff
stc
and bh, 0xff
clc
pushal
inc eax
popal
nop
lea esp, [esp]
cld
and bh, 0xff
stc
pushal
inc eax
popal
cld
pushal
inc eax
popal
clc
and bh, 0xff
clc
push edx
cdq
pop edx
cld
and bh, 0xff
cld
lea esp, [esp]
clc
add eax, 0
cld
pushal
inc eax
popal
cld
pushal
inc eax
popal
cld
push edx
cdq
pop edx
stc
pushal
inc eax
popal
cld
push edx
cdq
pop edx
cld
add eax, 0
cld
and bh, 0xff
cld
add eax, 0
nop
add eax, 0
cld
and bh, 0xff
clc
and bh, 0xff
cld
add eax, 0
cld
push edx
cdq
pop edx
clc
lea esp, [esp]
cld
push edx
cdq
pop edx
nop
pushal
inc eax
popal
cld
lea esp, [esp]
cld
add eax, 0
stc
lea esp, [esp]
clc
pushal
inc eax
popal
cld
add eax, 0
nop
push edx
cdq
pop edx
stc
add eax, 0
nop
add eax, 0
stc
and bh, 0xff
stc
call 0x7ffe5404
pop edx
cld
xor dx, dx
add edx, 0xd5e0
nop
pushal
inc eax
popal
cld
add eax, 0
push edx
cdq
pop edx
xor ecx, ecx
stc
cld
mov cl, 0x1e
lea esp, [esp]
nop
nop
xor byte [ecx + edx], 0x46
loop 0x7ffe5425
clc
lea esp, [esp]
stc
clc
cld
stc
push dword fs:[0x24]
cld
clc
clc
pop dword [edx + 0xa]
and bh, 0xff
stc
push edx
cdq
pop edx
clc
stc
stc
mov cl, 0xff
pushal
inc eax
popal
cld
and bh, 0xff
nop
nop
push edx
loop 0x7ffe5455
cld
push eax
pop eax
cld
mov dword [edx + 0x11], 0xffffacbb
lea esp, [esp]
clc
add eax, 0
nop
and al, 0xff
clc
mov ecx, dword [eax + 0x2c]
nop
stc
mov dword [edx + 0x1b], ecx
push edx
cdq
pop edx
clc
add eax, 0
clc
cld
mov dword [edx + 0x100], ecx
stc
nop
stc
cld
mov dword [eax + 0x2c], esp
stc
clc
clc
push 0
and bh, 0xff
clc
push edx
cdq
pop edx
cld
cld
stc
push 0
clc
push 0
cld
pushal
inc eax
popal
push 0
add al, 0
cld
push 0x30
cld
and bh, 0xff
clc
stc
push 0x20
cld
push edx
cdq
pop edx
nop
push 0
push 0
and bh, 0xff
cld
stc
nop
nop
add edx, 0xffff7f35
stc
and bh, 0xff
clc
add eax, 0
stc
stc
push edx
cld
push edx
push edx
cdq
pop edx
nop
push 0
cld
cld
nop
call dword [edx + 0x820e]
nop
lea esp, [esp]
stc
push edx
cdq
pop edx
cld
nop
add esp, 0x3f8
nop
push edx
cdq
pop edx
stc
xor eax, eax
lea esp, [esp]
stc
inc eax
push edx
cdq
pop edx
cld
pushal
inc eax
popal
clc
lea esp, [esp]
ret 0xc
Function at 0x7ffe8354
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp]
pushal
inc eax
popal
pop eax
cld
add eax, 0x11
mov byte [eax], 5
cld
nop
clc
call 0x7ffe8354
stc
push esi
add byte [eax], al
add cl, bh
clc
add eax, 5
pushal
inc eax
popal
clc
clc
mov ecx, eax
clc
add al, 0
stc
call 0x7ffe8313
add byte [eax], al
add eax, 0
cld
cld
stc
cld
pop eax
nop
lea esp, [esp]
cld
clc
add eax, 0x15
cld
mov byte [eax], 5
call 0x7ffe84d6
nop
cld
stc
add eax, 5
cld
nop
xchg ecx, eax
cld
pushal
inc eax
popal
nop
sub ecx, eax
push edx
cdq
pop edx
cld
xor byte [eax + ecx], 0x70
add eax, 0
nop
and al, 0xff
cld
loop 0x7ffe8341
pushal
inc eax
popal
clc
cld
stc
pop ecx
cwde
jo 0x7ffe83c8
jo 0x7ffe83ca
sub bl, dh
mov al, 0x77
mov dh, 0x70
jne 0x7ffe82fa
lds esi, [eax + 0x70]
jo 0x7ffe835a
mov al, 0x75
stc
xor eax, 0x70709884
jo 0x7ffe83e1
sub bl, dh
mov al, 0x77
mov dh, 0x70
jne 0x7ffe8311
aad 0x70
jo 0x7ffe83ed
mov al, 0x75
stc
cmc
and al, 0x86
invalid
xchg byte [edi - 0x67dfd771], cl
jo 0x7ffe8440
invalid
jo 0x7ffe8442
sub byte [esi - 0x678a8ad0], dh
xor al, 0xbf
invalid
xchg esp, eax
sub cl, cl
invalid
add byte [ecx - 0x2a7c7071], 0xfb
xor eax, 0xccf5f984
mov byte [edi + 0x24fdfb8f], cl
xchg byte [edi - 0x7bc2a471], cl
stc
cmp eax, 0x20272188
shl al, 0xfb
cmp eax, 0xcccdfb88
mov byte [edi + 0x28da838f], cl
das
sub dword [ecx - 0x4dcf4fbd], edi
jl 0x7ffe8492
and dword [eax], esp
and ecx, ecx
invalid
mov al, 5
lahf
mov cl, 0x99
insb byte es:[edi], dx
cwde
jo 0x7ffe84b9
jo 0x7ffe84bb
sub byte [ebx - 0x4f], dh
invalid
sub eax, ecx
jno 0x7ffe84c6
jo 0x7ffe84c8
mov ecx, 0x29282bb3
leave
arpl word [eax + 0x70], si
jo 0x7ffe845e
lds ebp, [esi + eax*4]
invalid
std
cwde
or dword [edi + 0x20fd4b8f], 0x28f8f86
jge 0x7ffe84c0
sti
cmc
cwde
or dword [edi + 0x6240f08f], 0x20a69b28
cwde
jo 0x7ffe8520
jo 0x7ffe8522
sub bl, dh
mov al, 0x77
mov dh, 0x70
jne 0x7ffe8452
cwde
cwde
invalid
jne 0x7ffe8510
cli
xor byte [edx - 8], dh
cmc
xchg dword [ebx - 0xa047071], eax
pushfd
or dword [edi + 0x20e58f8f], 0x7f8f8f86
pop ebp
ror byte [ebx + 0xb], 1
pop ss
add dword [edx], ecx
adc eax, 0xa8797d2
push es
pop ds
push cs
add bl, byte [0x3e1c9500]
add eax, dword [esi]
mov ds, word [esi + ebx*8 - 0x60e3ecf7]
mov ds, word [edx + 0xc]
test al, 0x4f
adc byte [edx - 0x3c7ebdb1], dl
pop ss
sbb byte [ebx], al
popfd
lea esp, [ebp + esi*8 - 0x6c]
pop ebx
pmaxub mm0, qword [ebx]
cmp eax, 0xbbd44bd5
or dword [edi - 0x630a0471], 0xffffff81
invalid
aam 0xbb
sbb dword [esi], eax
pop ds
or eax, 0x70f06a8d
nop
inc ebx
pop es
xchg ebx, eax
and edi, ebx
pop es
xchg ebx, eax
cmpsd dword [esi], dword es:[edi]
xor al, 0x55
lds ecx, [esi]
pushfd
lea edx, [ecx + 0x56]
invalid
Function at 0x4cb9d4
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4cba16
call fcn.004d174d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
cmp eax, edi
je 0x4cba16
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_LoadResource]
cmp eax, edi
jne 0x4cba0d
xor eax, eax
jmp 0x4cba1e
push eax
call dword [sym.imp.KERNEL32.DLL_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004cba24
pop edi
pop esi
pop ebx
ret 4

Function at 0x4d1c7d
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4d1cab
push dword [esi]
call dword [sym.imp.KERNEL32.DLL_TlsGetValue]
test eax, eax
je 0x4d1cc9
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004d1be3
jmp 0x4d1cc9
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4d1cc9
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004d1be3
test edi, edi
mov eax, edi
jne 0x4d1cb3
pop edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x8003b3f
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov dword [0x80043b4], 0x30
mov dword [0x80043bc], 0x8003351
mov dword [0x80043b8], 2
mov dword [0x80043c0], 0
mov dword [0x80043c4], 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
jmp 0x8003b82
mov dword [0x80043c8], eax
mov dword [0x80043dc], 0x80041e0
mov dword [0x80043d4], 0xf
mov dword [0x8004102], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x80043cc], eax
mov dword [0x80043e0], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x800410a], ebp
mov dword [0x80043d0], eax
push 0x80043b4
call dword [sym.imp.user32.dll_RegisterClassExA]
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x8004434], eax
push 0
push dword [0x8004102]
push 0
push 0
push 0x1ef
push 0x21c
push 0xffffe688
push 0xfffff524
push 0xcf0000
push str.uno_momento
push str.verba
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x800442c], eax
push 1
push dword [0x800442c]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x800442c]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x8003c40
xor edi, edi
lea ebx, [0x80043e4]
jmp 0x8003c58
push ebx
call dword [sym.imp.user32.dll_TranslateMessage]
push ebx
call dword [sym.imp.user32.dll_DispatchMessageA]
push edi
push edi
push edi
push ebx
call dword [sym.imp.user32.dll_GetMessageA]
test al, al
jne 0x8003c4a
jmp 0x8003c6c
mov eax, dword [0x80043ec]
call fcn.08002ae4
ret
Function at 0x4030a0
Capabilities:
Get graphical window text

Disassembly:
push 0xffffffffffffffff
push 0x4075e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x14]
xor ebp, ebp
call sub.MFC42.DLL_CString::CString_1
mov eax, dword [esi + 0x250]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
push ebp
push 0x147
push eax
mov dword [esp + 0x3c], ebp
call edi
lea ecx, [esp + 0x14]
push ecx
push eax
lea ecx, [esi + 0x230]
call sub.MFC42.DLL_CComboBox::GetLBText
lea edx, [esp + 0x1c]
push 0xd
push edx
mov ecx, 0x40b510
call fcn.00401710
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
lea ecx, [esp + 0x1c]
test eax, eax
setne bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x40315a
lea ecx, [esp + 0x14]
push ecx
push 0xd
mov ecx, 0x40b510
call fcn.00401780
push ecx
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x24], esp
push edx
mov ebp, 1
call sub.MFC42.DLL_CString::CString_2
lea ecx, [esi + 0x1b0]
call fcn.00403d90
mov eax, dword [esi + 0x190]
push 0
push 0
push pe_nt_image_headers32
push eax
call edi
push 0xf
mov ecx, 0x40b510
mov ebx, eax
call fcn.00401740
xor ecx, ecx
cmp ebx, 1
sete cl
cmp ecx, eax
je 0x4031b2
mov edx, dword [esi + 0x190]
push 0
push 0
push pe_nt_image_headers32
push edx
call edi
xor ecx, ecx
cmp eax, 1
sete cl
push ecx
push 0xf
mov ecx, 0x40b510
call fcn.004017c0
mov ebp, 1
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
lea edx, [esp + 0x10]
lea ecx, [esi + 0x130]
push edx
mov byte [esp + 0x30], 1
call sub.MFC42.DLL_CWnd::GetWindowTextA
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::TrimLeft
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::TrimRight
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
push 0x40b090
push ecx
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
je 0x403207
mov dword [esp + 0x18], 0
push 0x11
mov ecx, 0x40b510
call fcn.00401760
mov ecx, dword [esp + 0x18]
cmp eax, ecx
je 0x40322a
push ecx
push 0x11
mov ecx, 0x40b510
call fcn.004017f0
jmp 0x40322e
test ebp, ebp
je 0x40323f
mov ecx, 0x40b510
call fcn.004011d0
mov ecx, esi
call fcn.00402dc0
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x20
ret
Function at 0x4052a0
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x407ae0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString_1
lea eax, [edi + 0x64]
mov byte [esp + 0x24], 1
mov dword [esp + 0x14], eax
mov eax, dword [eax]
push eax
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
jne 0x40530c
mov ecx, dword [edi + 0x10]
mov eax, ecx
mov dword [edi + 0xc], ecx
lea ecx, [edi + 0x88]
mov edx, dword [eax]
add eax, 8
mov dword [edi + 0xc], edx
push eax
jmp 0x4053aa
mov esi, dword [edi + 0x70]
test esi, esi
je 0x405362
lea ebp, [edi + 0x88]
mov eax, esi
mov ebx, esi
mov esi, dword [esi]
add eax, 8
push eax
mov ecx, ebp
call fcn.00406698
lea eax, [esp + 0x10]
push eax
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push ebp
call sub.MFC42.DLL_CString::CString_2
mov ecx, edi
call fcn.004053e0
test eax, eax
je 0x40535e
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x10]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 8
test eax, eax
je 0x40539b
test esi, esi
jne 0x405319
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 0xfffffffe
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret 4
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x2c]
mov dword [edi + 0x10], ebx
mov dword [edi + 0xc], esi
push eax
call fcn.00406698
lea ecx, [esp + 0x10]
mov byte [esp + 0x24], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x2c]
mov dword [esp + 0x24], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
jmp 0x405386
Function at 0x40ba32
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x3c], 0
je 0x40ba54
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x3c], 0xffffffff
jne 0x40ba7d
mov edx, 1
test edx, edx
je 0x40ba66
mov dword [ebp - 0x20], 0
jmp 0x40ba76
push str.SnedPLCCommand_abort_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 0x20], eax
xor eax, eax
jmp 0x40bb9e
mov eax, 1
test eax, eax
je 0x40ba8f
mov dword [ebp - 0x24], 0
jmp 0x40baa3
mov ecx, dword [ebp + 8]
push ecx
push str._SnedPLCCommand__:__s__n
call fcn.0040c0c0
add esp, 8
mov dword [ebp - 0x24], eax
push 0
mov edx, dword [ebp + 8]
push edx
call fcn.004ea220
add esp, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
cmp dword [0x56cb90], 0
je 0x40baf0
cmp dword [ebp - 4], 0x2710
jle 0x40badd
xor eax, eax
jmp 0x40bb9e
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
jmp 0x40bac4
mov dword [0x56cb90], 1
push 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x40bb44
mov ecx, 1
test ecx, ecx
je 0x40bb30
mov dword [ebp - 0x28], 0
jmp 0x40bb40
push str.SnedPLCCommand_fail_n
call fcn.0040c0c0
add esp, 4
mov dword [ebp - 0x28], eax
xor eax, eax
jmp 0x40bb9e
cmp dword [ebp + 0xc], 0
je 0x40bb91
mov dword [ebp - 0x10], 0
jmp 0x40bb5c
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 3
jge 0x40bb91
push 0
lea eax, [ebp - 8]
push eax
push 0x7d
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 8], 0
je 0x40bb8f
mov ecx, dword [ebp + 0xc]
add ecx, dword [ebp - 8]
mov byte [ecx], 0
jmp 0x40bb91
jmp 0x40bb53
mov dword [0x56cb90], 0
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 8
Function at 0x40bba4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
push 0x100
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x44], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 8]
mov dword [edx + 0x48], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov dword [eax + 0x4c], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 0x50], eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp - 8]
add edx, 0x44
push edx
push 0x40bc87
push 0x800
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 8]
mov dword [ecx + 0x40], eax
push 0xf
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret 4

Function at 0x40c413
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov dword [ebp - 0x108], ecx
mov eax, dword [ebp - 0x108]
add eax, 0xd0
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0x5499d4
push 0x5499e0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x5499ec
lea edx, [ebp - 0x104]
push edx
call fcn.004e9ff0
add esp, 8
test eax, eax
je 0x40c46b
mov eax, 1
jmp 0x40c46d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x40c471
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0xd0
push eax
push 0
push str.AUTOSCANDEVICE
push 0x549a04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56d384], eax
mov ecx, dword [ebp - 4]
add ecx, 0xd0
push ecx
push 0
push 0x549a10
push 0x549a18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56e2c8], eax
mov edx, dword [ebp - 4]
add edx, 0xd0
push edx
push 0
push str.MainPageOnlyUpdateCID_Identify_ShowCID
push 0x549a48
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4f8], eax
push 0x104
push 0
push 0x67406c
call fcn.004e9480
add esp, 0xc
mov edx, dword [ebp - 4]
add edx, 0xd0
push edx
push 0x104
push 0x67406c
push 0
push str.ENABLELOGPATH
push 0x549a60
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 4]
add eax, 0x2d8
push eax
push 0
push 0x549a68
push 0x549a7c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x4fc], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4fc], 0
je 0x40c555
mov ecx, dword [ebp - 4]
call fcn.0040cec9
jmp 0x40c637
mov dword [0x56d380], 0x14
mov dword [0x56d37c], 0
mov dword [0x56ceb4], 0
mov dword [0x56ceb8], 0
push 0xff
push 0
push 0x56d27c
call fcn.004e9480
add esp, 0xc
push 0x40
push 0
push 0x56d23c
call fcn.004e9480
add esp, 0xc
push 0x549a84
push 0x56d27c
call fcn.004e96e0
add esp, 8
push 0x56d27c
push 0x56d23c
call fcn.004e96e0
add esp, 8
push 0xff
push 0
push 0x56cfbc
call fcn.004e9480
add esp, 0xc
push 0x549a9c
push 0x56cfbc
call fcn.004e96e0
add esp, 8
push 0xff
push 0
push 0x56d0bc
call fcn.004e9480
add esp, 0xc
push 0x549ab4
push 0x56d0bc
call fcn.004e96e0
add esp, 8
mov dword [0x56ceb0], 3
mov dword [0x56ceac], 0xa
push 0x10
push 0
push 0x56ce9c
call fcn.004e9480
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x40cec9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
add eax, 0x2d8
push eax
push 0
push 0x549b1c
push 0x549b2c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56d37c], eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d8
push ecx
push 0x14
push 0x549b34
push 0x549b3c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56d380], eax
mov edx, dword [ebp - 4]
add edx, 0x2d8
push edx
mov eax, dword [0x56d380]
add eax, 1
push eax
push 0x56d27c
push str.AA000000000000000000
push 0x549b5c
push 0x549b68
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x56d27c
push 0x56d23c
call fcn.004e96e0
add esp, 8
mov ecx, dword [ebp - 4]
add ecx, 0x2d8
push ecx
mov edx, dword [0x56d380]
add edx, 1
push edx
push 0x56cfbc
push str.AA999999999999999999
push 0x549b88
push 0x549b94
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 4]
add eax, 0x2d8
push eax
mov ecx, dword [0x56d380]
add ecx, 1
push ecx
push 0x56d0bc
push 0x549b9c
push 0x549bb4
push 0x549bc0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edx, dword [ebp - 4]
add edx, 0x2d8
push edx
push 0
push 0x549bc8
push 0x549bd4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56ceb8], eax
mov eax, dword [ebp - 4]
add eax, 0x2d8
push eax
push 0
push 0x549bdc
push 0x549bec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56ceb4], eax
mov ecx, dword [ebp - 4]
add ecx, 0x2d8
push ecx
push 3
push 0x549bf4
push 0x549c04
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56ceb0], eax
mov edx, dword [ebp - 4]
add edx, 0x2d8
push edx
push 0xa
push 0x549c0c
push 0x549c18
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [0x56ceac], eax
mov eax, dword [ebp - 4]
add eax, 0x2d8
push eax
push 0x10
push 0x56ce9c
push 0
push 0x549c20
push 0x549c2c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esp, ebp
pop ebp
ret