joyce8/EMBER2024-capa huggingface dataset:
Function at 0x533058
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff84
push ebx
push esi
push edi
mov edi, edx
mov ebx, eax
cmp dword [edi + 4], 0
je 0x533079
mov edx, edi
mov eax, ebx
call fcn.0046d54c
jmp 0x5331c6
push 0
call sub.user32.dll_GetDC
mov esi, eax
lea edx, [ebp - 0x6c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x60]
push eax
lea edx, [ebp - 0x7c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x74]
push eax
push esi
call sub.gdi32.dll_CreateCompatibleBitmap
mov dword [ebp - 8], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
push 0
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov dword [ebp - 0xc], eax
xor ecx, ecx
push ebp
push 0x5331bf
push dword fs:[ecx]
mov dword fs:[ecx], esp
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0046f898
push eax
call sub.user32.dll_BeginPaint
mov esi, eax
lea eax, [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_GetClipBox
lea eax, [ebp - 0x5c]
call fcn.00407708
test al, al
je 0x53310a
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
push 0
lea eax, [ebp - 0x5c]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_InvalidateRect
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 4]
mov edx, 0x14
mov eax, ebx
call fcn.0046a150
mov eax, dword [ebp - 4]
mov dword [edi + 4], eax
mov edx, edi
mov eax, ebx
call fcn.00533058
xor eax, eax
mov dword [edi + 4], eax
lea eax, [ebp - 0x5c]
push eax
push esi
call sub.gdi32.dll_GetClipBox
lea eax, [ebp - 0x5c]
call fcn.00407708
test al, al
je 0x533160
lea edx, [ebp - 0x5c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x44]
push 0xcc0020
mov edx, dword [ebp - 0x58]
push edx
mov eax, dword [ebp - 0x5c]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x50]
push ecx
mov ecx, dword [ebp - 0x54]
push ecx
push edx
push eax
push esi
call sub.gdi32.dll_BitBlt
lea eax, [ebp - 0x4c]
push eax
mov eax, ebx
call fcn.0046f898
push eax
call sub.user32.dll_EndPaint
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5331c6
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [ebp - 4]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_DeleteObject
ret
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56f054
Capabilities:
Hash data with md5

Disassembly:
push ebx
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
mov edx, 0x40
lea ecx, [eax + 0x18]
mov byte [ecx], 0
inc ecx
dec edx
jne 0x56f067
mov edx, 0x10
lea ecx, [eax + 0x58]
xor ebx, ebx
mov dword [ecx], ebx
add ecx, 4
dec edx
jne 0x56f076
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
pop ebx
ret

Function at 0x56fb84
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff50
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xb0], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053f4
mov eax, dword [ebp - 8]
call fcn.004053f4
xor eax, eax
push ebp
push 0x56fcf9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405204
cmp eax, 0x40
jle 0x56fbf0
lea edx, [ebp - 0xb0]
mov eax, dword [ebp - 8]
call fcn.0056fb48
mov edx, dword [ebp - 0xb0]
lea eax, [ebp - 8]
call fcn.00404fcc
lea ecx, [ebp - 0xc]
mov edx, 0x40
mov al, 0x36
call fcn.004055f4
lea ecx, [ebp - 0x10]
mov edx, 0x40
mov al, 0x5c
call fcn.004055f4
mov eax, dword [ebp - 8]
call fcn.00405204
mov esi, eax
test esi, esi
jle 0x56fc59
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.0040545c
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
lea eax, [ebp - 0x10]
call fcn.0040545c
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x56fc21
lea eax, [ebp - 0xac]
call fcn.0056f054
mov ebx, 0x56f188
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0xc]
call fcn.0056f8a4
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 4]
call fcn.0056f8a4
lea ecx, [ebp - 0x14]
mov edx, ebx
lea eax, [ebp - 0xac]
call fcn.0056f9cc
lea eax, [ebp - 0xac]
call fcn.0056f054
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x10]
call fcn.0056f8a4
mov ecx, ebx
lea eax, [ebp - 0xac]
mov edx, dword [ebp - 0x14]
call fcn.0056f8a4
mov ecx, edi
mov edx, ebx
lea eax, [ebp - 0xac]
call fcn.0056f9cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x56fd00
lea eax, [ebp - 0xb0]
call fcn.00404f34
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404f58
ret
Function at 0x5702d8
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff74
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov edi, ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004053f4
mov eax, dword [ebp - 8]
call fcn.004053f4
xor eax, eax
push ebp
push 0x57043c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.00405204
cmp eax, 0x40
jle 0x570344
lea edx, [ebp - 0x8c]
mov eax, dword [ebp - 8]
call fcn.005702b0
mov edx, dword [ebp - 0x8c]
lea eax, [ebp - 8]
call fcn.00404fcc
lea ecx, [ebp - 0xc]
mov edx, 0x40
mov al, 0x36
call fcn.004055f4
lea ecx, [ebp - 0x10]
mov edx, 0x40
mov al, 0x5c
call fcn.004055f4
mov eax, dword [ebp - 8]
call fcn.00405204
mov esi, eax
test esi, esi
jle 0x5703ad
mov ebx, 1
lea eax, [ebp - 0xc]
call fcn.0040545c
mov edx, dword [ebp - 0xc]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
lea eax, [ebp - 0x10]
call fcn.0040545c
mov edx, dword [ebp - 0x10]
mov dl, byte [edx + ebx - 1]
mov ecx, dword [ebp - 8]
xor dl, byte [ecx + ebx - 1]
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x570375
lea eax, [ebp - 0x88]
call fcn.0056fdd8
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 0xc]
call fcn.0057010c
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 4]
call fcn.0057010c
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x88]
call fcn.005701a4
lea eax, [ebp - 0x88]
call fcn.0056fdd8
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 0x10]
call fcn.0057010c
lea eax, [ebp - 0x88]
mov edx, dword [ebp - 0x14]
call fcn.0057010c
mov edx, edi
lea eax, [ebp - 0x88]
call fcn.005701a4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x570443
lea eax, [ebp - 0x8c]
call fcn.00404f34
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404f58
ret

Function at 0x577728
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ecx, eax
xor eax, eax
push ebp
push 0x5777bd
push dword fs:[eax]
mov dword fs:[eax], esp
test ecx, ecx
setl byte [ebp - 1]
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov ebx, eax
cmp byte [ebp - 1], 0
je 0x577760
dec ebx
not ebx
mov eax, esi
call fcn.00404f34
mov edi, ebx
and edi, 0xff
shr ebx, 8
lea eax, [ebp - 8]
mov edx, edi
call fcn.0040511c
mov edx, dword [ebp - 8]
mov ecx, dword [esi]
mov eax, esi
call fcn.00405250
test ebx, ebx
jne 0x577767
cmp byte [ebp - 1], 0
jne 0x5777a7
mov eax, dword [esi]
cmp byte [eax], 0x7f
jbe 0x5777a7
mov ecx, dword [esi]
mov eax, esi
mov edx, 0x5777d4
call fcn.00405250
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5777c4
lea eax, [ebp - 8]
call fcn.00404f34
ret
Function at 0x57b860
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
lea eax, [ebp - 0x18]
mov edx, 0x10
call fcn.00408684
mov eax, dword [ebp - 4]
cmp dword [eax + 0x84], 0xffffffff
je 0x57b8f6
xor eax, eax
push ebp
push 0x57b8ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov word [ebp - 0x18], 2
push ebx
call sub.wsock32.dll_htons
mov word [ebp - 0x16], ax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x50]
mov dword [ebp - 0x14], eax
push 0x10
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x84]
push eax
call sub.wsock32.dll_connect
test eax, eax
sete byte [ebp - 5]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57b8f6
cmp byte [ebp - 5], 0
je 0x57b8ee
mov eax, dword [ebp - 4]
call fcn.0057d734
mov eax, dword [ebp - 4]
call fcn.0057d758
ret
mov al, byte [ebp - 5]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x57bb34
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, edx
push 0
call sub.kernel32.dll_SetLastError
mov eax, ebx
call fcn.00405404
push eax
call sub.kernel32.dll_GetFileAttributesA
call sub.kernel32.dll_GetLastError_1
cmp eax, 0x56
je 0x57bb6a
cmp eax, 5
je 0x57bb6a
cmp eax, 0x41
je 0x57bb6a
cmp eax, 0x52e
je 0x57bb6a
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x57d5f4
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x57d697
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x20]
mov edx, 0x20
call fcn.00408684
xor eax, eax
mov dword [ebp - 0x1c], eax
push dword [ebx + 0x50]
call sub.wsock32.dll_inet_ntoa
mov edx, eax
lea eax, [ebp - 0x28]
call fcn.0040513c
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
mov edx, 0x57d6b0
call fcn.00405250
mov eax, dword [ebp - 0x24]
call fcn.00405404
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [0x59c290]
mov eax, dword [eax]
call fcn.00405404
push eax
mov eax, dword [0x59c42c]
mov eax, dword [eax]
call fcn.00405404
push eax
lea eax, [ebp - 0x20]
push eax
call sub.mpr.dll_WNetAddConnection2A
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x57d69e
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.00404f58
ret

Function at 0x57d758
Capabilities:
Create tcp socket

Disassembly:
push ebx
mov ebx, eax
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov dword [ebx + 0x84], eax
pop ebx
ret

Function at 0x57ff94
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov esi, ecx
mov ebx, edx
xor eax, eax
push ebp
push 0x580098
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.00403288
mov eax, dword [ebp - 0x1c]
call fcn.00405404
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
call fcn.00402df4
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x580076
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
lea edx, [ebp - 0x20]
xor eax, eax
call fcn.00403288
mov eax, dword [ebp - 0x20]
call fcn.00405404
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5800ac
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
test dword [eax + 0x1c], 2
mov edx, dword [ebp + 8]
seta byte [edx]
mov edx, dword [eax + 8]
shr edx, 0x10
mov word [ebx], dx
mov dx, word [eax + 8]
and dx, 0xffff
mov word [esi], dx
mov ax, word [eax + 0xc]
and ax, 0xffff
mov edx, dword [ebp + 0xc]
mov word [edx], ax
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58007d
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00402e24
ret
Function at 0x5816b8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
test dl, dl
je 0x5816cb
add esp, 0xfffffff0
call fcn.0040443c
mov edi, ecx
mov byte [ebp - 1], dl
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.00404080
mov ecx, edi
mov dl, 1
mov eax, dword [0x581428]
call fcn.00482df4
mov ebx, eax
mov dword [esi + 4], ebx
push 0x104
push 0x41
mov eax, dword [ebx + 4]
mov edx, dword [0x47ffd8]
call fcn.0040426c
mov edi, eax
mov eax, dword [edi + 0x44]
push eax
mov eax, dword [ebx + 4]
mov edx, dword [0x47ffd8]
call fcn.0040426c
mov eax, dword [edi + 0x4c]
sar eax, 1
jns 0x581721
adc eax, 0
pop edx
add edx, eax
sub edx, 0x20
push edx
mov eax, dword [ebx + 4]
mov edx, dword [0x47ffd8]
call fcn.0040426c
mov eax, dword [edi + 0x40]
push eax
mov eax, dword [ebx + 4]
mov edx, dword [0x47ffd8]
call fcn.0040426c
mov eax, dword [edi + 0x48]
sar eax, 1
jns 0x581752
adc eax, 0
pop edx
add edx, eax
sub edx, 0x82
mov eax, ebx
pop ecx
mov edi, dword [eax]
call dword [edi + 0x84]
push 4
mov eax, ebx
call fcn.0046f898
push eax
call sub.user32.dll_ShowWindow
mov dl, 1
mov eax, ebx
call fcn.00483c48
push 0
push 0xf060
push 0
mov eax, ebx
call fcn.0046f898
push eax
call sub.user32.dll_GetSystemMenu
push eax
call sub.user32.dll_DeleteMenu
mov eax, ebx
mov edx, dword [eax]
call dword [edx + 0x88]
mov eax, esi
cmp byte [ebp - 1], 0
je 0x5817bb
call fcn.00404494
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x58b610
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.004053f4
xor eax, eax
push ebp
push 0x58b68a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x40]
mov edx, 0x3c
call fcn.00408684
mov dword [ebp - 0x40], 0x3c
mov eax, 0x58b698
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 4]
call fcn.00405404
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 5
mov dword [ebp - 0x3c], 0xc
lea eax, [ebp - 0x40]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b691
lea eax, [ebp - 4]
call fcn.00404f34
ret

Function at 0x58f324
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
xor ebx, ebx
mov eax, esi
call fcn.00405404
push eax
call sub.wsock32.dll_gethostbyname
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x58f34e
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov ebx, dword [eax]
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x5938e0
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
xor eax, eax
push ebp
push 0x59393a
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
xor eax, eax
call fcn.00403288
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040ca40
mov eax, dword [ebp - 4]
call fcn.00405404
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 2
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x593941
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404f58
ret
Function at 0x401500
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x14
push esi
mov esi, ecx
lea eax, [esp + 0xc]
lea ecx, [esp + 8]
mov edx, dword [esi + 4]
push eax
push ecx
push edx
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_ClearCommError]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
cmp eax, ecx
jb 0x401530
mov eax, ecx
test eax, eax
mov dword [esp + 4], eax
jbe 0x401558
lea ecx, [esi + 0x242]
lea edx, [esp + 4]
push ecx
mov ecx, dword [esi + 4]
push edx
push eax
mov eax, dword [esp + 0x28]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 4]
pop esi
add esp, 0x14
ret 8

Function at 0x401710
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x40d83c]
sub esp, 0x14
test eax, eax
push ebx
push ebp
push esi
push edi
mov esi, ecx
jne 0x40172e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 4
mov edx, dword [esi + 4]
lea edi, [esi + 0x22e]
lea eax, [esp + 0x10]
push edi
push eax
lea ecx, [esp + 0x30]
push 1
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x401791
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebp
cmp eax, 0x3e5
jne 0x4017c3
mov ecx, dword [esi + 4]
mov ebx, dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
lea eax, [esp + 0x10]
push 1
push eax
push edi
push ecx
call ebx
test eax, eax
jne 0x401791
call ebp
cmp eax, 0x3e4
jne 0x4017a0
mov eax, dword [esi + 4]
lea edx, [esp + 0x10]
push 1
push edx
push edi
push eax
call ebx
test eax, eax
je 0x401776
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 4
mov eax, dword [esi + 4]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret 4
mov eax, dword [esi + 4]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ClearCommError]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret 4
Function at 0x401820
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, ecx
and eax, 0xffff
push esi
mov esi, dword [esp + 0x10]
mov ecx, eax
mov edx, ecx
push edi
lea edi, [ebp + 0x25f]
mov dword [ebp + 0x25b], eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov dword [esp + 0x18], eax
and ecx, 3
mov ebx, 0xffff
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 0x256]
test ecx, ecx
je 0x401868
push 0
push 0x7e
jmp 0x401875
cmp byte [ebp + 0x20c], 1
jne 0x401880
push 0
push 0x7f
mov ecx, ebp
call fcn.004016c0
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
xor esi, esi
test eax, eax
mov dl, byte [ecx]
mov byte [ebp + 0x25a], dl
jle 0x4018d7
mov eax, dword [esp + 0x14]
mov cl, byte [esi + eax]
push ecx
mov ecx, ebp
call fcn.00401930
mov edi, dword [esp + 0x14]
push eax
mov ecx, ebp
mov dl, byte [esi + edi]
push edx
call fcn.004016c0
mov eax, ebx
xor ecx, ecx
mov cl, byte [esi + edi]
and eax, 0xff
xor eax, ecx
xor edx, edx
mov dl, bh
mov bx, word [eax*2 + 0x40c020]
mov eax, dword [esp + 0x18]
xor bx, dx
inc esi
cmp esi, eax
jl 0x401892
not ebx
xor eax, eax
push ebx
mov al, bh
mov ecx, ebp
mov byte [esp + 0x18], al
call fcn.00401930
push eax
push ebx
mov ecx, ebp
call fcn.004016c0
mov esi, dword [esp + 0x14]
mov ecx, ebp
push esi
call fcn.00401930
push eax
push esi
mov ecx, ebp
call fcn.004016c0
push 0
push 0x7e
mov ecx, ebp
call fcn.004016c0
mov eax, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
jle 0x401925
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
ret 0xc

Function at 0x401b10
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
push esi
cmp cx, 8
mov eax, 0x3fffffff
jb 0x401b5c
mov esi, dword [esp + 8]
push ebx
push edi
mov edi, ecx
and edi, 0xffff
shr edi, 3
mov edx, eax
xor ebx, ebx
mov bl, byte [esi]
add ecx, 0xfff8
shr edx, 0x16
and edx, 0xff
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x40c220]
xor eax, edx
inc esi
dec edi
jne 0x401b31
pop edi
pop ebx
jmp 0x401b60
mov esi, dword [esp + 8]
test cx, cx
je 0x401b95
xor edx, edx
add ecx, 0xffff
mov dl, byte [esi]
and ecx, 0xffff
shl edx, 0x16
inc ecx
mov esi, edx
xor esi, eax
test esi, 0x20000000
je 0x401b8e
add eax, eax
xor eax, 0x6030b9c7
jmp 0x401b90
shl eax, 1
shl edx, 1
dec ecx
jne 0x401b79
not eax
and eax, 0x3fffffff
pop esi
ret 8
Function at 0x4029e0
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4077c8
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
push edi
mov edi, ecx
push 2
push 0xfffffffffffffff0
mov eax, dword [edi + 0x14]
lea esi, [edi + 0x14]
mov ecx, esi
call dword [eax + 0x30]
mov edx, dword [esi]
lea eax, [esp + 0xc]
push 4
push eax
mov ecx, esi
call dword [edx + 0x3c]
mov esi, dword [esp + 0xf]
mov ecx, dword [esp + 0xe]
mov edx, dword [esp + 0xd]
and esi, 0xff
mov eax, dword [esp + 0xc]
and ecx, 0xff
shl esi, 8
or esi, ecx
and edx, 0xff
shl esi, 8
or esi, edx
and eax, 0xff
shl esi, 8
or esi, eax
mov ecx, edi
push esi
call fcn.00402b00
test eax, eax
jne 0x402ada
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_1
push esi
lea ecx, [esp + 0xc]
push str.Application
push ecx
mov dword [esp + 0x28], 0
call sub.MFC42.DLL_CString::Format
add esp, 0xc
lea ecx, [esp + 8]
push 0x40c9e0
call fcn.00406f62
push 0x40c9c0
lea ecx, [esp + 0xc]
call fcn.00406f62
mov edx, dword [esp + 8]
push 0
push 0x1034
push edx
call sub.MFC42.DLL_AfxMessageBox
cmp eax, 7
mov dword [esp + 0x1c], 0xffffffff
lea ecx, [esp + 8]
jne 0x402ad5
call fcn.00406ecc
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
call fcn.00406ecc
mov ecx, dword [esp + 0x14]
mov dword [edi + 0xc], esi
pop edi
mov eax, 1
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0x404160
Capabilities:
Resume thread

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push 1
mov eax, dword [eax + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
lea ebx, [esi + 0x64]
lea edi, [esi + 0x791]
push ebx
push esi
mov ecx, edi
call fcn.00401230
mov ecx, edi
call fcn.004012c0
test eax, eax
jne 0x4041b1
push eax
push eax
push str.Cant_open_COM_Port_n
mov ecx, esi
call sub.MFC42.DLL_CWnd::MessageBoxA
mov ecx, edi
call fcn.004014a0
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esi + 0x60]
push 0
test eax, eax
jne 0x4041f2
push 4
push 0
push 1
push 0x40a1d0
call sub.MFC42.DLL_AfxBeginThread
mov dword [esi + 0x60], eax
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esi + 0x60]
push ebx
push edi
push esi
call fcn.00406bb0
pop edi
pop esi
mov dword [0x40d90c], 1
mov al, 1
pop ebx
ret
push 0
push str.Cant_start_Downloadert_n
mov ecx, esi
call sub.MFC42.DLL_CWnd::MessageBoxA
mov ecx, edi
call fcn.004014a0
pop edi
pop esi
xor al, al
pop ebx
ret

Function at 0x4046c0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [esp + 0xc]
cmp dword [esi + 0x9b4], edi
je 0x4046f6
mov eax, dword [esi + 0x60]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push edi
lea ecx, [esi + 0x791]
call fcn.00401ce0
mov edx, dword [esi + 0x60]
mov eax, dword [edx + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
ret 4