joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403353
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402249
and dword [ebp - 4], 0
cmp dword [0x459288], 0
mov ebx, eax
jne 0x403404
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4034b5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4034b5
push eax
call fcn.004021d7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x459288], eax
call esi
push eax
call fcn.004021d7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x45928c], eax
call esi
push eax
call fcn.004021d7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x459290], eax
call esi
push eax
call fcn.004021d7
pop ecx
mov dword [0x459298], eax
test eax, eax
je 0x403404
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004021d7
pop ecx
mov dword [0x459294], eax
mov eax, dword [0x459294]
cmp eax, ebx
je 0x40345c
cmp dword [0x459298], ebx
je 0x40345c
push eax
call fcn.00402252
push dword [0x459298]
mov esi, eax
call fcn.00402252
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40345c
test edi, edi
je 0x40345c
call esi
test eax, eax
je 0x403453
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x403453
test byte [ebp - 0xc], 1
jne 0x40345c
or dword [ebp + 0x10], 0x200000
jmp 0x403495
mov eax, dword [0x45928c]
cmp eax, ebx
je 0x403495
push eax
call fcn.00402252
pop ecx
test eax, eax
je 0x403495
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x403495
mov eax, dword [0x459290]
cmp eax, ebx
je 0x403495
push eax
call fcn.00402252
pop ecx
test eax, eax
je 0x403495
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x459288]
call fcn.00402252
pop ecx
test eax, eax
je 0x4034b5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4034b7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4051be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4589f8]
jne 0x4051c8
repz ret
jmp fcn.004068e5
Function at 0x406792
Capabilities:
Encode data using xor

Disassembly:
jne 0x40679c
mov edi, eax
xor esi, dword [ecx + 0x14abd78b]
add byte [eax], al
bound ebp, qword [edx + 0x38]
adc cl, byte [ecx - 0x748fb0cd]
in eax, dx
mov ecx, dword [eax]
push ecx
call fcn.00404a60
mov edi, eax
xor eax, eax
mov edx, edi
mov ecx, 0x1b
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push 0x38
mov dword [eax + 0x10], edx
mov ecx, dword [esi]
mov edx, dword [ecx + 0x10]
mov dword [edx], ebx
mov eax, dword [esi]
mov ecx, dword [eax]
push ecx
lcall 0xf88b, 0xffff65a4
xor eax, eax
mov ebp, dword [esi]
loope 0x4067ec
add byte [ebp + 0x7d], dh
mov eax, 0x826a0666
push ebx
push 1
mov dword [eax + 0x14], edx
inc ebp
adc al, 0x45
push cs
mov edx, dword [ecx + 0x14]
jge 0x406869
mov eax, dword [esi]
loopne 0x406838
xor al, 1
xchg edx, eax
movsd dword es:[edi], dword [esi]
add byte [ebx + 0x48e0830e], cl
push ecx
cmp dword [eax + 0x5fffff71], 0xffffff93
pop ebx
int 0x6c
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
fist word [ebp - 0x75]
in al, dx
cmp dword [eax + 0x22b], 0x85d8b53
push esi
push edi
fadd qword [ebx + 4]
cmp eax, 0xffffffff
je 0xe44069ef
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0x4069ef
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi - 0x4a]
lea edx, [esi + 0x28]
push ecx
push edx
invalid
mov eax, 0xe9097545
sbb byte [esi + 0x5b], 0x8b
in eax, 0x5d
ret 0x12

Function at 0x4076aa
Capabilities:
Encode data using xor

Disassembly:
inc ecx
pop esi
xor byte [esi + ecx + 7], cl
loop 0x4076ad
ljmp 0x33b6:0xda8d5821
Function at 0x4080f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
test esp, esi
mov esi, edi
je 0x40816e
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x6300
jmp 0x408122
arpl word [eax], ax
add bl, ch
adc dl, dl
push ebp
adc byte [ebx], dh
cmp al, 0x85
inc esp
setl al
test eax, eax
mov dword [edx], eax
push edi
add dh, ah
fnstcw word [eax - 0x33333333]
mov eax, 0xcccccccd
mov bl, 0xa
mul ecx
loopne 0x408117
add ecx, dword [edx - 0x1409b13e]
or eax, 0x30bd8075
mov byte [esi], cl
mov ecx, edx
test edx, edx
jne 0x4080f9
mov edx, dword [eax - 0x7601d4e8]
cmp byte [ebx + 0x5b5e5fc6], cl
pop ebp
ret
jne 0x4081e5
test dword [ebx + 0x7f], esi
xor al, 0x7c
rol dword [ecx + 0x5cdffef], 0x7f
ja 0x4081a8
cmp eax, 0xffffff8a
jl 0x40810b
or byte ss:[ecx + 0xfb], al
xor byte [edx + 0x1b], 0x85
leave
jne 0x4081ac
mov eax, dword [ebp + 0x1c]
push cs
push ebp
adc al, 0x50
push edi
cmp eax, 0x6be86ccf
invalid
test ecx, ecx
je 0x4081b7
mov edx, dword [ebx + 0x14]
mov dword [ecx], 0
add byte [eax], al
add bl, ch
invalid
test eax, eax
jg 0x4081c8
jl 0x4081c1
test ebx, ebx
jae 0x4081c8
mov ecx, 0xa0000044
adc dword [edx], eax
xlatb
leave
mov edx, dword [ebp + 0x14]
test ecx, ecx
mov dword [edx], ecx
je 0x4081da
neg ebx
adc eax, 0
sbb bl, al
push esi
push 0
push 0xa
push eax
push ebx
call 0x59b890
mov eax, dword [ebx + ecx*4]
mov cl, dh
add byte [ebx - 0x750d74fc], cl
into
mov dl, 0xa
imul dl
sub bl, al
dec edi
xor byte [ecx - 0x40fa74d0], 0x1f
mov ebx, ecx
or ebx, esp
jne 0x4081db
mov ebp, ebx
sbb byte [ebx - 0x38d4e3b3], cl
pop esi
mov dword [ecx], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x6ac42a00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac42ad0
mov ecx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [ecx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 4], esi
mov esi, edi
mov dword [esp], ebx
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac42aa2
mov edx, 0x10624dd3
mov ebx, dword [ebp + 0x10]
mov eax, edx
imul dword [ebp + 0x10]
mov dword [esp], esi
sar ebx, 0x1f
sar edx, 4
sub edx, ebx
mov dword [esp + 4], edx
call fcn.6ac4c010
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac42a77
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp], ebx
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac42a77
Function at 0x6ac42b00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac42bd0
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 4], esi
mov esi, edi
mov dword [esp], ebx
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac42ba1
lea edx, [ebp - 0x90]
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.6ac4b3d0
test eax, eax
js 0x6ac42bfc
movzx eax, byte [ebp - 0x7b]
imul eax, eax, 0x64
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
jmp 0x6ac7bbc0
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp], ebx
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac42b7a
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov edi, eax
mov eax, dword [ebx]
mov dword [esp + 4], str.java_io_IOException
mov dword [esp], ebx
call dword [eax + 0x18]
sub esp, 8
test eax, eax
mov esi, eax
je 0x6ac42c71
mov dword [esp + 8], edi
lea edi, [ebp - 0x54]
mov dword [esp + 0xc], str.getReceiveTimeout
mov dword [esp + 4], str._s_in__s
mov dword [esp], edi
call sub.msvcrt.dll_sprintf
mov eax, dword [ebx]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x38]
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x5c]
mov eax, 0xffffffff
sub esp, 8
jmp 0x6ac42b97
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
push ecx
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x44]
or eax, 0xffffffff
push ebx
jmp 0x6ac42b97
Function at 0x6ac42c90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac42dd7
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], ebx
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 4], esi
mov esi, edi
mov dword [esp], ebx
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac42d31
lea edx, [ebp - 0x90]
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.6ac4b3d0
test eax, eax
js 0x6ac42d60
cmp byte [ebp - 0x7b], 0
setne al
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac42d0a
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov edi, eax
mov eax, dword [ebx]
mov dword [esp + 4], str.java_io_IOException
mov dword [esp], ebx
call dword [eax + 0x18]
sub esp, 8
test eax, eax
mov esi, eax
je 0x6ac42e03
mov dword [esp + 8], edi
lea edi, [ebp - 0x54]
mov dword [esp], edi
mov dword [esp + 0xc], str.isReceiveTimeoutEnabled
mov dword [esp + 4], str._s_in__s
call sub.msvcrt.dll_sprintf
mov eax, dword [ebx]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x38]
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x5c]
xor eax, eax
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp + 4], esi
xor esi, esi
mov dword [esp], ebx
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac42d0a
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
xor eax, eax
sub esp, 4
jmp 0x6ac42d27
Function at 0x6ac42e20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6c], 0
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac42f11
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac42ee7
lea edx, [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x5415
call fcn.6ac4c4a0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], str.RXTXPort:isDSR_returns__i_n
and eax, 0x100
mov dword [esp + 8], eax
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
shr eax, 8
and eax, 1
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac42e9e
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac42e9e
Function at 0x6ac42f40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6c], 0
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac43030
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac43005
lea edx, [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x5415
call fcn.6ac4c4a0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], str.RXTXPort:isCD_returns__i_n
and eax, 0x40
mov dword [esp + 8], eax
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
shr eax, 6
and eax, 1
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac42fbe
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac42fbe
Function at 0x6ac43060
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6c], 0
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac43150
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac43125
lea edx, [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x5415
call fcn.6ac4c4a0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], str.RXTXPort:isCTS_returns__i_n
and eax, 0x20
mov dword [esp + 8], eax
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
shr eax, 5
and eax, 1
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac430de
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac430de
Function at 0x6ac43180
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6c], 0
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac43271
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac43247
lea edx, [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x5415
call fcn.6ac4c4a0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], str.RXTXPort:isRI_returns__i_n
and eax, 0x80
mov dword [esp + 8], eax
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
shr eax, 7
and eax, 1
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac431fe
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac431fe
Function at 0x6ac432a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6c], 0
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac43390
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac43365
lea edx, [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x5415
call fcn.6ac4c4a0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], str.RXTXPort:isRTS_returns__i_n
and eax, 4
mov dword [esp + 8], eax
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
shr eax, 2
and eax, 1
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac4331e
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac4331e
Function at 0x6ac433c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov edi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x6c], 0
mov eax, dword [edi]
mov dword [esp + 4], ecx
mov dword [esp], edi
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [edi]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], edi
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac434d8
mov ecx, dword [edi]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [ecx + 0x190]
mov dword [ebp - 0x7c], eax
mov eax, dword [edi]
sub esp, 0xc
mov dword [esp], edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
mov edi, dword [ebp - 0x7c]
sub esp, 8
test edi, edi
je 0x6ac434a6
lea esi, [ebp - 0x6c]
mov dword [esp + 8], esi
mov dword [esp + 4], 0x5415
mov dword [esp], edi
call fcn.6ac4c4a0
cmp bl, 1
mov edx, dword [ebp - 0x6c]
je 0x6ac434d3
and edx, 0xfffffffb
mov dword [esp + 8], esi
movzx ebx, bl
mov dword [esp], edi
mov dword [esp + 4], 0x5418
mov dword [ebp - 0x6c], edx
call fcn.6ac4c4a0
lea eax, [ebp - 0x68]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.setRTS___i___n
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac43449
or edx, 4
jmp 0x6ac4346b
mov eax, dword [edi]
mov dword [esp], edi
lea esi, [esi]
call dword [eax + 0x40]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], edi
call dword [eax + 0x44]
mov eax, dword [edi]
sub esp, 4
mov dword [esp], edi
xor edi, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac43449
Function at 0x6ac43510
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x7c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x6c], 0
mov eax, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [eax + 0x7c]
mov esi, eax
mov eax, dword [ebx]
sub esp, 8
mov dword [esp + 0xc], 0x6ac54064
mov dword [esp + 8], 0x6ac54128
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [eax + 0x178]
sub esp, 0x10
test eax, eax
je 0x6ac43600
mov edx, dword [ebx]
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 8], eax
call dword [edx + 0x190]
mov edi, eax
mov eax, dword [ebx]
sub esp, 0xc
mov dword [esp], ebx
mov ebx, edi
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
test edi, edi
je 0x6ac435d4
lea edx, [ebp - 0x6c]
mov dword [esp + 8], edx
mov dword [esp], ebx
mov dword [esp + 4], 0x5415
call fcn.6ac4c4a0
mov eax, dword [ebp - 0x6c]
mov dword [esp + 4], str.isDTR____returns__i_n
and eax, 2
mov dword [esp + 8], eax
lea eax, [ebp - 0x68]
mov dword [esp], eax
call sub.msvcrt.dll_sprintf
mov eax, dword [ebp - 0x6c]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
shr eax, 1
and eax, 1
pop ebp
ret 8
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x26
mov dword [esp + 4], 1
mov dword [esp], str.get_java_var:_invalid_file_descriptor_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
jmp 0x6ac4358e
mov eax, dword [ebx]
mov dword [esp], ebx
call dword [eax + 0x40]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
call dword [eax + 0x44]
mov eax, dword [ebx]
sub esp, 4
mov dword [esp], ebx
xor ebx, ebx
mov dword [esp + 4], esi
call dword [eax + 0x5c]
sub esp, 8
jmp 0x6ac4358e