joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410670
Capabilities:
Delete registry value
Set registry value

Disassembly:
sub esp, 0x1c
call fcn.0040a640
test eax, eax
je 0x4106fb
call fcn.0040f990
test eax, eax
je 0x4106f3
push ebx
mov ebx, dword [sym.imp.USER32.dll_TranslateMessage]
push ebp
mov ebp, dword [sym.imp.USER32.dll_DispatchMessageA]
push esi
mov esi, dword [sym.imp.USER32.dll_PeekMessageA]
push edi
mov edi, dword [sym.imp.USER32.dll_GetMessageA]
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call esi
test eax, eax
je 0x4106e6
push 0
push 0
lea ecx, [esp + 0x18]
push 0
push ecx
call edi
test eax, eax
je 0x4106d3
lea edx, [esp + 0x10]
push edx
call ebx
lea eax, [esp + 0x10]
push eax
call ebp
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
call esi
test eax, eax
jne 0x4106b4
call fcn.0040f990
test eax, eax
jne 0x4106a1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
jmp fcn.0040d7a0
add esp, 0x1c
ret
Function at 0x411810
Capabilities:
Check for software breakpoints
Encode data using xor

Disassembly:
mov eax, dword [0x42acdc]
sub esp, 0x14
cmp eax, 0xffffffff
push ebx
push ebp
push esi
push edi
je 0x411960
mov ecx, dword [0x42ace0]
mov edx, dword [eax*4 + 0x42ab10]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x411832
mov eax, dword [0x42abd0]
test eax, eax
je 0x411960
cmp dword [eax + 8], 1
jne 0x411960
mov ecx, dword [eax + 0x14]
test ecx, ecx
jne 0x411960
mov edi, 0x425430
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
mov dword [0x425324], 0x4086a0
test ecx, ecx
mov dl, 0x2c
lea ebp, [esp + 0x10]
jle 0x41189f
mov al, dl
shl al, 7
shr dl, 1
add dl, al
mov al, byte [esi + 0x425430]
xor al, dl
mov byte [ebp], al
inc ebp
inc esi
cmp esi, ecx
jl 0x411885
lea ecx, [esp + 0x10]
mov byte [ebp], 0
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
test ebx, ebx
je 0x41192c
mov edi, 0x42543c
or ecx, 0xffffffff
xor eax, eax
xor esi, esi
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
mov dl, 0x2c
test ecx, ecx
lea ebp, [esp + 0x10]
jle 0x4118eb
mov al, dl
shl al, 7
shr dl, 1
add dl, al
mov al, byte [esi + 0x42543c]
xor al, dl
mov byte [ebp], al
inc ebp
inc esi
cmp esi, ecx
jl 0x4118d1
lea ecx, [esp + 0x10]
mov byte [ebp], 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
test eax, eax
mov dword [esp + 0x20], edx
je 0x41192c
cmp byte [eax], 0xcc
je 0x411920
call eax
test eax, eax
je 0x41192c
mov dword [0x42ac20], 1
jmp 0x411960
mov eax, dword [0x42abd0]
mov dword [0x425328], 0x409410
test eax, eax
je 0x411956
cmp dword [eax + 8], 1
jne 0x411956
mov ecx, dword [eax + 0x14]
mov dword [0x425324], 0x408c40
test ecx, ecx
je 0x411960
mov dword [0x425324], 0x408ee0
mov eax, dword [esp + 0x28]
xor esi, esi
mov dword [0x42acdc], eax
mov dword [0x42a904], esi
mov ecx, dword [eax*4 + 0x42ab90]
mov dword [0x42a900], esi
cmp ecx, esi
je 0x411993
mov edx, dword [ecx]
add ecx, 4
mov dword [0x42a904], edx
mov dword [0x42a900], ecx
mov ecx, dword [eax*4 + 0x42ab50]
mov edx, dword [0x42ace0]
mov dword [0x42abd0], ecx
mov ecx, dword [eax*4 + 0x42ab10]
mov al, byte [ecx]
inc ecx
mov byte [edx], al
inc edx
test al, al
jne 0x4119ad
mov eax, dword [0x42abd0]
cmp eax, esi
je 0x4119d5
cmp dword [eax + 8], 1
jne 0x4119d5
cmp dword [eax + 0x14], esi
jne 0x4119d5
mov dword [0x425324], 0x408c40
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x411e50
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x318
push esi
mov esi, dword [esp + 0x320]
test esi, esi
je 0x411e70
push 0x180
push esi
call fcn.0041995c
add esp, 8
mov eax, dword [0x42ac7c]
test eax, eax
je 0x411ebb
test esi, esi
jne 0x411e9c
mov eax, dword [esp + 0x324]
push 4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x318
ret
mov ecx, dword [esp + 0x324]
push 5
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x318
ret
mov eax, dword [esp + 0x324]
push ebp
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 0x11c]
push 0x104
push edx
push eax
call edi
test esi, esi
je 0x411eee
lea ecx, [esp + 0x220]
push 0x104
push ecx
push esi
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x18]
push str.WININIT.INI
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
test esi, esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
je 0x411f50
lea ecx, [esp + 0x18]
lea edx, [esp + 0x11c]
push ecx
lea eax, [esp + 0x224]
push edx
push eax
push str.Rename
call esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call esi
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x318
ret
lea edx, [esp + 0x18]
lea eax, [esp + 0x11c]
push edx
push eax
push 0x425cf8
push str.Rename
call esi
lea ecx, [esp + 0x18]
push ecx
push 0
push 0
push 0
call esi
lea edx, [esp + 0x18]
push 2
push edx
call fcn.00401140
mov ebp, eax
add esp, 8
cmp ebp, 0xffffffff
je 0x412068
push ebx
push ebp
call fcn.004012c0
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x1c], ebx
lea ecx, [ebx + 0x200]
push ecx
call fcn.00402180
add esp, 0xc
test eax, eax
je 0x41205e
mov esi, dword [esp + 0x10]
push ebx
push esi
push ebp
call fcn.004011c0
add esp, 0xc
test eax, eax
jne 0x412051
add ebx, 0xfffffffc
mov edx, esi
test ebx, ebx
jbe 0x412051
mov eax, 0xfffffffe
sub eax, esi
mov dword [esp + 0x18], eax
cmp byte [edx], 0x78
jne 0x412020
cmp byte [edx + 1], 0x79
jne 0x412020
cmp byte [edx + 2], 0x7a
jne 0x412020
cmp byte [edx + 3], 0x3d
jne 0x412020
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
lea esi, [edx + 4]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x120]
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x41202b
mov eax, dword [esp + 0x18]
inc edx
lea ecx, [eax + edx + 2]
cmp ecx, ebx
jb 0x411fe4
jmp 0x412051
push 0
push ebp
mov byte [edx], 0x4e
mov byte [edx + 1], 0x55
mov byte [edx + 2], 0x4c
call fcn.00401260
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
push ebp
call fcn.00401200
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call fcn.00402200
add esp, 4
push ebp
call fcn.004013c0
add esp, 4
pop ebx
pop edi
pop ebp
mov eax, 1
pop esi
add esp, 0x318
ret
Function at 0x41995c
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x419987
test byte [esp + 8], 0x80
je 0x419976
and al, 0xfe
jmp 0x419978
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x419998
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041af0a
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x419a9d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x419abd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041af0a
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x419ade
test byte [esp + 8], 2
je 0x419ade
mov dword [0x42ad2c], 0xd
mov dword [0x42ad30], 5
jmp 0x419ab9
xor eax, eax
ret

Function at 0x41e549
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x42a380
cmp edx, dword [eax]
je 0x41e56b
add eax, 8
inc ecx
cmp eax, 0x42a410
jl 0x41e55c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x42a380]
jne 0x41e699
mov eax, dword [0x42ad88]
cmp eax, 1
je 0x41e673
test eax, eax
jne 0x41e59c
cmp dword [0x427df8], 1
je 0x41e673
cmp edx, 0xfc
je 0x41e699
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41e5d3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0041d1a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041d120
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x41e616
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041d120
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x425850
push edi
call fcn.0041a0c0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0041d1a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0041d1b0
lea eax, [ebp - 0xa0]
push 0x422bdc
push eax
call fcn.0041d1b0
push dword [esi + 0x42a384]
lea eax, [ebp - 0xa0]
push eax
call fcn.0041d1b0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0041fea5
add esp, 0x2c
pop edi
jmp 0x41e699
lea eax, [ebp + 8]
lea esi, [esi + 0x42a384]
push 0
push eax
push dword [esi]
call fcn.0041d120
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x414dd0
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], eax
dec ebx
dec edi
add ecx, 4
sub edx, edx
or ebx, edx
sub esp, 4
mov dword [esp], 0x70279eab
pop ebx
cmp ecx, esi
jne fcn.00414dd0
and edi, edi
sub edi, 1
ret

Function at 0x1ac17f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1ac17fa
pushal
call 0x1ac1800
pop ebp
sub ebp, 0x10
sub ebp, 0x16c17f0
jmp 0x1ac1816
mov eax, 0x16c17f0
add eax, ebp
add eax, 0x4c
mov ecx, 0x59c
mov edx, 0x694f38d
xor byte [eax], dl
inc eax
dec ecx
jne 0x1ac182d
jmp 0x1ac1840
push es
inc eax
push es
add al, 0xb1
lea ecx, [ebp + 0x754c0c8d]
lea ecx, [ebp + 0x35408e8d]
or dword [ebp - 0x5ac87273], 0xffffff8d
lea ecx, [ebp + 0x458e6f7a]
push es
or al, 0x81
lea ecx, [ebp + 0x488e8d]
jmp 0x8ab08a15
Function at 0x1000f188
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x1000f197
pop dword [ebp - 0x30]
mov eax, 0x1000f197
sub dword [ebp - 0x30], eax
push 0x40
push 0x1000
push 0x337a9
push 0
mov eax, 0x62ef4247
sub eax, 0x52ee01e3
add eax, dword [ebp - 0x30]
call dword [eax]
mov ecx, 0x3198
mov edx, eax
mov ebx, 0x10018600
add ebx, dword [ebp - 0x30]
mov esi, 0xb058ab65
sub esi, 0x398beef4
xor dword [ebp - 0x28], edx
mov edi, dword [ebx]
xor edi, esi
mov dword [edx], edi
mov dword [ebp - 0x20], 0x26a4d5d1
add edx, 4
add ebx, 4
loop 0x1000f1e5
add eax, 0xb933
mov ebx, eax
add eax, 5
mov ecx, 0xd5dc16ec
sub ecx, 0xc5dc16ec
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10007faf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10007fbe
pop dword [ebp - 0x34]
mov eax, 0x766aee35
sub eax, 0x666a6e77
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x87374ef3
add dword [ebp - 0x44], 0xc71af658
mov dword [ebp - 0x40], 0x721ce9ef
sub dword [ebp - 0x40], 0x3fe99daa
mov dword [ebp - 0x3c], 0xac477e62
sub dword [ebp - 0x3c], 0x5ffb3a34
mov dword [ebp - 0x38], 0x169fa052
add dword [ebp - 0x38], 0xe9605fae
lea eax, [ebp - 0x44]
push eax
mov eax, 0xe7fa185f
sub eax, 0xd7f857df
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x93e71a19
add dword [ebp - 0x44], 0xe08b4f3d
mov dword [ebp - 0x40], 0x9b3f5878
add dword [ebp - 0x40], 0xa62d08fd
mov dword [ebp - 0x3c], 0x31cb7a87
sub dword [ebp - 0x3c], 0xce5c0e1b
mov dword [ebp - 0x38], 0x869ce4c
add dword [ebp - 0x38], 0xf79631b4
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0x69f1c5f3
sub eax, 0x59f005f3
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x35727
push 0
call eax
mov ecx, 0x16f2f57b
add ecx, 0xe90d4a52
mov edi, eax
mov ebx, 0x8b693b3c
add ebx, 0x84992cc4
add ebx, dword [ebp - 0x34]
mov esi, 0x3ab20e38
xor dword [ebp - 0x1c], 0xb596f09
mov edx, dword [ebx]
sub dword [ebp - 0x1c], eax
xor edx, esi
sub dword [ebp - 0x20], edi
mov dword [edi], edx
add dword [ebp - 0x24], edi
add edi, 0xc7c9d409
add edi, 0x38362bfb
add ebx, 0xd4b4114a
sub ebx, 0xd4b41146
loop 0x100080da
add eax, 0xf207
mov ebx, eax
add eax, 0x5bef4bee
add eax, 0xa410b417
mov ecx, 0xb63932e5
sub ecx, 0xa63932e5
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x10008fc4
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1000
mov dword [esp + 0x14], ebp
call sub.glib_lite.dll_Ordinal_394
mov esi, dword [esp + 0x1c]
mov edi, eax
mov ebx, dword [esp + 0x20]
pop ecx
mov dword [ebx], ebp
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
mov ecx, dword [esi + 0x11c]
sbb ecx, dword [esi + 0x114]
add eax, 0xffffffff
adc ecx, 0xffffffff
cmp ecx, ebp
ja 0x1000901f
jb 0x10009011
cmp eax, 0xffe
ja 0x1000901f
mov eax, dword [esi + 0x118]
sub eax, dword [esi + 0x110]
jmp 0x10009024
mov eax, 0x1000
test edi, edi
je 0x1000909a
push ebp
lea ecx, [esp + 0x14]
push ecx
push eax
push edi
push dword [esi + 0x104]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
je 0x10009093
push sub.glib_lite.dll_Ordinal_105
push edi
push dword [esp + 0x18]
push ebp
push 0x1000
push edi
push ebp
call sub.gstreamer_lite.dll_Ordinal_25
add esp, 0x1c
mov dword [ebx], eax
test eax, eax
je 0x10009072
mov ecx, dword [esi + 0x110]
mov dword [eax + 0x40], ecx
mov ecx, dword [esi + 0x114]
mov dword [eax + 0x44], ecx
mov eax, dword [esp + 0x10]
add eax, dword [esi + 0x110]
push 0
pop edx
adc edx, dword [esi + 0x114]
mov dword [esi + 0x110], eax
mov dword [esi + 0x114], edx
jmp 0x1000909e
push edi
call sub.glib_lite.dll_Ordinal_105
pop ecx
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x409944
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099f8
jmp 0x4099ed
cmp dword [esi + 0x10], 0x1000
jne 0x4099d9
test byte [esi + 0x15], 1
jne 0x4099d9
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409998
cmp eax, 2
je 0x409998
cmp eax, 0x10
je 0x409998
cmp eax, 0x20
jne 0x4099ad
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4099ad
mov bl, 1
xor ebp, ebp
jmp 0x4099be
mov eax, dword [esi]
add eax, ebp
call fcn.0040993c
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x4099b1
test bl, bl
je 0x4099d9
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4099f8
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409970
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40894d
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x4085d8
sub edx, eax
sub esp, 4
mov dword [esp], eax
pop eax
call fcn.00408986
xor dword [ebx], ecx
sub esp, 4
mov dword [esp], 0xd0858e70
pop edx
add ebx, 1
sub edx, 0x90cf212e
dec edx
cmp ebx, esi
jne fcn.0040894d
mov eax, edx
inc edx
ret
Function at 0xc49b00
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00c49c50
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xc49b26
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc49b12
add dl, dl
jne 0xc49b31
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc49b84
xor eax, eax
add dl, dl
jne 0xc49b3e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xc49c25
add dl, dl
jne 0xc49b4d
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc49b58
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc49b63
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc49b6e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xc49b7a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xc49b1d
mov eax, 1
add dl, dl
jne 0xc49b92
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xc49b9d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc49b89
sub eax, ebx
mov ebx, 1
jne 0xc49bd0
mov ecx, 1
add dl, dl
jne 0xc49bb6
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc49bc1
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc49bad
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc49b1d
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xc49be7
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xc49bf2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xc49bde
cmp eax, 0x7d00
jae 0xc49c15
cmp eax, 0x500
jb 0xc49c10
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc49b1d
cmp eax, 0x7f
ja 0xc49c18
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xc49b1d
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xc49c46
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xc49b1d
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401c60
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [str.GlobalDevInitFlag]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x425f84], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401c92
mov ecx, dword [0x425f84]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
ret
mov al, 1
ret
Function at 0x402b30
Capabilities:
Create thread

Disassembly:
sub esp, 0x64
mov ecx, 0x19
xor eax, eax
mov byte [0x41e138], 1
push esi
mov esi, dword [esp + 0x6c]
push edi
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
push esi
lea eax, [esp + 0xc]
push str.._s
push eax
call fcn.00406f66
add esp, 0xc
xor edi, edi
lea ecx, [esp + 8]
push edi
push edi
push 3
push edi
push 1
push 0xc0000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push eax
push str.handle___d__n
mov dword [0x42b2a0], eax
call fcn.00406d51
mov eax, dword [0x42b2a0]
add esp, 8
cmp eax, 0xffffffff
jne 0x402bad
push esi
push str.Open_CAN_fail__name___s__n
call fcn.00406d51
add esp, 8
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x64
ret
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, 0xffffffff
mov dword [0x42b2a8], eax
jne 0x402bea
mov edx, dword [0x42b2a0]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._reateEvent_CAN_fail____n
mov dword [0x42b2a0], edi
call fcn.00406d51
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x64
ret
mov ecx, dword [0x42b2a0]
lea eax, [esp + 0x70]
push edi
push eax
push edi
push edi
push 4
push 0x42b2a8
push 0x222040
push ecx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x402c48
mov edx, dword [0x42b2a0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x42b2a8]
push eax
call esi
push str._DeviceIoControl_error_n
mov dword [0x42b2a0], edi
mov dword [0x42b2a8], edi
call fcn.00406d51
add esp, 4
or eax, 0xffffffff
pop edi
pop esi
add esp, 0x64
ret
mov ecx, dword [0x42b2a0]
push 0x42147c
push edi
push ecx
push 0x402620
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [0x42b2a4], eax
jne 0x402c99
mov edx, dword [0x42b2a0]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [0x42b2a8]
push eax
call esi
mov dword [0x42b2a0], edi
mov dword [0x42b2a8], edi
pop edi
mov eax, 0xfffffffe
pop esi
add esp, 0x64
ret
pop edi
mov byte [0x42b29c], 1
mov eax, 1
pop esi
add esp, 0x64
ret

Function at 0x403100
Capabilities:
Create thread

Disassembly:
mov ecx, dword [str.USBClass_03SubClass_21Prot_01]
sub esp, 8
lea eax, [esp]
push eax
push ecx
call sub.HidFunEx.dll_HidOpen
add esp, 8
cmp eax, 0xffffffff
mov dword [0x421030], eax
jne 0x403135
push str.FuncKey_open_failed_n
call fcn.00406d51
add esp, 4
or eax, 0xffffffff
add esp, 8
ret
lea edx, [esp + 4]
push edx
push 0
push eax
push 0x402cb0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x421040], eax
jne 0x403169
push str.hFuncKeyThread_is_NULL_n
call fcn.00406d51
add esp, 4
or eax, 0xffffffff
add esp, 8
ret
push str.hFuncKeyThread_is_OK_n
call fcn.00406d51
add esp, 4
mov eax, 1
add esp, 8
ret
Function at 0x403180
Capabilities:
Create thread

Disassembly:
mov ecx, dword [str.USBClass_03SubClass_22Prot_02]
sub esp, 8
lea eax, [esp]
push eax
push ecx
call sub.HidFunEx.dll_HidOpen
add esp, 8
cmp eax, 0xffffffff
mov dword [0x42102c], eax
jne 0x4031b5
push str.hidMainTel_open_failed_n
call fcn.00406d51
add esp, 4
or eax, 0xffffffff
add esp, 8
ret
lea edx, [esp + 4]
push edx
push 0
push eax
push 0x402e80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x42103c], eax
jne 0x4031e9
push str.hMainTelThread_is_NULL_n
call fcn.00406d51
add esp, 4
or eax, 0xffffffff
add esp, 8
ret
push str.hMainTelThread_is_OK_n
call fcn.00406d51
add esp, 4
mov eax, 1
add esp, 8
ret

Function at 0x403200
Capabilities:
Create thread

Disassembly:
mov ecx, dword [str.USBClass_03SubClass_23Prot_03]
sub esp, 8
lea eax, [esp]
push eax
push ecx
call sub.HidFunEx.dll_HidOpen
add esp, 8
cmp eax, 0xffffffff
mov dword [0x421028], eax
jne 0x403235
push str.hidEmergTel_open_failed_n
call fcn.00406d51
add esp, 4
or eax, 0xffffffff
add esp, 8
ret
lea edx, [esp + 4]
push edx
push 0
push eax
push 0x402fd0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x421038], eax
jne 0x403269
push str.hEmergTelThread_is_NULL_n
call fcn.00406d51
add esp, 4
or eax, 0xffffffff
add esp, 8
ret
push str.hEmergTelThread_is_OK_n
call fcn.00406d51
add esp, 4
mov eax, 1
add esp, 8
ret
Function at 0x40c689
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x420560
cmp edx, dword [eax]
je 0x40c6ab
add eax, 8
inc ecx
cmp eax, 0x4205f0
jl 0x40c69c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x420560]
jne 0x40c7d9
mov eax, dword [0x42d270]
cmp eax, 1
je 0x40c7b3
test eax, eax
jne 0x40c6dc
cmp dword [0x41fbd4], 1
je 0x40c7b3
cmp edx, 0xfc
je 0x40c7d9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40c713
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040cdd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040a880
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40c756
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040a880
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41a64c
push edi
call fcn.00406e20
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040cdd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040cde0
lea eax, [ebp - 0xa0]
push 0x41a62c
push eax
call fcn.0040cde0
push dword [esi + 0x420564]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040cde0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040d8d3
add esp, 0x2c
pop edi
jmp 0x40c7d9
lea eax, [ebp + 8]
lea esi, [esi + 0x420564]
push 0
push eax
push dword [esi]
call fcn.0040a880
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret