joyce8/EMBER2024-capa huggingface dataset:
Function at 0xce32b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x5000e008], 0x8088405
inc edx
mov dword [ebx + 0x5000e008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0xce5cf4
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov eax, dword [0x5000f73c]
xor ebx, ebx
mov bl, al
xor bl, dl
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
mov dword [0x5000f73c], eax
and eax, 0xff
add dword [0x5000f740], eax
imul eax, dword [0x5000f740], 0x8088405
inc eax
mov dword [0x5000f740], eax
mov eax, dword [0x5000f744]
movzx ebx, al
xor bl, byte [0x5000f743]
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
mov dword [0x5000f744], eax
ret

Function at 0xce5d64
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
pushal
mov byte [ebp - 1], 0
mov dword [0x5000f73c], 0x12345678
mov dword [0x5000f740], 0x23456789
mov dword [0x5000f744], 0x34567890
movzx ecx, byte [0x5000f748]
test ecx, ecx
je 0xce5df1
xor esi, esi
mov dl, byte [esi + 0x5000f749]
call fcn.00ce5cf4
inc esi
cmp esi, ecx
jb 0xce5d98
xor esi, esi
call fcn.00ce5d4c
xor byte [esi + 0x5000f724], al
mov dl, byte [esi + 0x5000f724]
call fcn.00ce5cf4
inc esi
cmp esi, 0xc
jb 0xce5daa
mov al, byte [0x5000f72f]
test word [0x5000f90e], 8
jne 0xce5de5
cmp al, byte [0x5000f919]
jne 0xce5df1
mov byte [ebp - 1], 1
jmp 0xce5df1
cmp al, byte [0x5000f913]
jne 0xce5df1
mov byte [ebp - 1], 1
popal
mov al, byte [ebp - 1]
pop ecx
pop ebp
ret

Function at 0xce5e84
Capabilities:
Encode data using xor

Disassembly:
pushal
mov edi, dword [0x5000f82c]
cmp dword [0x5000f828], edi
jae 0xce5e99
mov edi, dword [0x5000f828]
test edi, edi
je 0xce5ec4
sub dword [0x5000f82c], edi
lea esi, [0x5003aa00]
add esi, dword [0x5000f824]
add edi, esi
call fcn.00ce5d4c
xor byte [esi], al
mov dl, byte [esi]
call fcn.00ce5cf4
inc esi
cmp esi, edi
jb 0xce5eb1
popal
ret

Function at 0xce5ec8
Capabilities:
Encode data using xor

Disassembly:
pushal
lea esi, [0x5003aa00]
mov edi, esi
add edi, dword [0x5000f828]
call fcn.00ce5d4c
mov dl, byte [esi]
xor byte [esi], al
call fcn.00ce5cf4
inc esi
cmp esi, edi
jb 0xce5ed7
popal
ret
Function at 0xce66d4
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [0x5000fdb0]
add dword [0x5000fd80], eax
cmp byte [0x5000f840], 0
jne 0xce673a
cmp dword [0x5000fdb0], 0
jle 0xce673a
mov eax, dword [0x5000fdbc]
lea edx, [eax + 0x5002a800]
mov ecx, dword [0x5000fdb0]
mov eax, dword [0x5000f864]
call fcn.00ce4ecc
test eax, eax
jge 0xce673a
mov dword [0x5000f834], 5
push 0x50005b6c
push dword [0x5000f854]
push 0x50005b8c
mov eax, 0x5000f838
mov edx, 3
call fcn.00ce3e44
ret
mov eax, dword [0x5000fdb0]
test eax, eax
je 0xce6776
add dword [0x5000fda0], eax
mov eax, dword [0x5000fdc4]
mov esi, dword [0x5000fdbc]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
inc esi
cmp esi, dword [0x5000fda8]
jb 0xce6756
mov dword [0x5000fdc4], eax
cmp dword [0x5000fda8], 0x10000
jb 0xce67a7
mov esi, 0x5002a800
mov edi, esi
add esi, dword [0x5000fda8]
sub esi, 0x8000
mov ecx, 0x8000
cld
rep movsb byte es:[edi], byte [esi]
mov dword [0x5000fda8], 0x8000
mov eax, dword [0x5000fda8]
mov dword [0x5000fdbc], eax
mov dword [0x5000fdb0], 0
ret

Function at 0xce9550
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x5000fda8], 0x8000
jle 0xce95b5
pushal
mov edx, dword [0x5000fda8]
sub edx, 0x8000
mov esi, 0x5002a800
mov edi, esi
add esi, edx
mov ecx, 0x2000
cld
rep movsd dword es:[edi], dword [esi]
mov ebx, 0xffff
sub dword [ebx*4 + 0x50042b04], edx
dec ebx
jns 0xce957f
mov esi, edx
shl esi, 2
add esi, 0x50082b44
mov ebx, esi
add ebx, 0x20000
mov edi, 0x50082b44
cld
lodsd eax, dword [esi]
sub eax, edx
stosd dword es:[edi], eax
cmp esi, ebx
jb 0xce95a2
popal
mov dword [0x5000fda8], 0x8000
mov eax, dword [0x5000fda8]
mov dword [0x5000fdbc], eax
mov eax, dword [0x5000f91e]
sub eax, dword [0x5000fda0]
mov dword [0x5000fdb0], eax
cmp dword [0x5000fdb0], 0x8000
jle 0xce95e5
mov dword [0x5000fdb0], 0x8000
mov eax, dword [0x5000fdbc]
lea edx, [eax + 0x5002a800]
mov ecx, dword [0x5000fdb0]
mov eax, dword [0x5000f864]
call fcn.00ce4ef8
cmp eax, dword [0x5000fdb0]
je 0xce9632
mov dword [0x5000f834], 3
push 0x50008a38
push dword [0x5000f854]
push 0x50008a5c
mov eax, 0x5000f838
mov edx, 3
call fcn.00ce3e44
ret
mov eax, dword [0x5000fdbc]
add eax, dword [0x5000fdb0]
mov dword [0x5000fda8], eax
mov eax, dword [0x5000fdb0]
add dword [0x5000fda0], eax
mov eax, dword [0x5000fdb0]
add dword [0x5000fd80], eax
pushal
mov eax, dword [0x5000fdc4]
mov esi, dword [0x5000fdbc]
xor ebx, ebx
mov bl, al
xor bl, byte [esi + 0x5002a800]
shr eax, 8
xor eax, dword [ebx*4 + 0x5000fde4]
inc esi
cmp esi, dword [0x5000fda8]
jb 0xce9666
mov dword [0x5000fdc4], eax
popal
ret
Function at 0x41f04c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x62a53a
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
mov esi, ebx
xor ecx, ecx
cmp byte [eax + 0x6a], 0
je 0x41f09b
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x88]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
jmp 0x41f0ba
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [esi + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edx, dword [eax + 0x78]
test edx, edx
je 0x41f0ba
mov ecx, edx
add ecx, ebx
test ecx, ecx
je 0x41f12c
mov esi, dword [ecx + 0x18]
mov eax, dword [ecx + 0x1c]
add eax, ebx
mov dword [ebp - 0x10], eax
mov edi, dword [ecx + 0x20]
add edi, ebx
mov eax, dword [ecx + 0x24]
add eax, ebx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffff
jbe 0x41f115
test esi, esi
jbe 0x41f12c
mov eax, dword [edi]
add eax, ebx
mov edx, dword [ebp - 4]
call fcn.004088ec
test eax, eax
jne 0x41f107
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
jmp 0x41f12c
add dword [ebp - 0xc], 2
add edi, 4
dec esi
test esi, esi
ja 0x41f0e4
jmp 0x41f12c
mov edx, eax
sub edx, dword [ecx + 0x10]
cmp edx, dword [ecx + 0x14]
jae 0x41f12c
mov eax, edx
shl eax, 2
add eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62a541
ret
Function at 0x420284
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov word [ebp - 4], cx
mov byte [ebp - 1], dl
xor eax, eax
push ebp
push 0x62b89f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x4202bf
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x4202d8
lea eax, [ebp - 0x10]
mov edx, dword [0x648348]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x4202eb
lea eax, [ebp - 0x10]
mov edx, dword [0x648348]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x4202f7
adc edx, 0
mov edx, dword [edx*4 + 0x647178]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x420471
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x40
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x420464
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406ddc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0x18
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
cmp dword [eax], 0x4550
jne 0x420464
add eax, 4
mov dword [ebp - 0xc], eax
cmp byte [ebp - 1], 0
je 0x420402
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x8664
jne 0x420402
mov eax, edi
call fcn.00403288
mov eax, 0xf0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xf0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420402
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420402
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
cmp byte [ebp - 1], 0
jne 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x14c
jb 0x420464
mov eax, dword [ebp - 0xc]
cmp word [eax], 0x150
ja 0x420464
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 8]
push eax
push 0xe0
push edi
push esi
call fcn.00406d7c
test eax, eax
je 0x420464
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 4]
jne 0x420464
mov eax, dword [eax + 0x10]
mov edx, dword [ebp + 0xc]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x420489
inc ebx
cmp ebx, 0x19
jne 0x4202b1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x62b8a6
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x402880
Capabilities:
Parse credit card information
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
or eax, 0xffffffff
mov word [ebp - 0xc], ax
push ebx
xor ecx, ecx
mov eax, 0x65
xor ebx, ebx
mov dword [ebp - 0x1c], eax
mov edx, 2
mul edx
seto cl
push esi
push edi
mov dword [ebp - 0x20], ebx
neg ecx
or ecx, eax
push ecx
call fcn.004115d7
add esp, 4
xor ecx, ecx
push 4
mov dword [ebp - 0x24], eax
mov word [eax], cx
call fcn.004115d7
add esp, 4
test eax, eax
je 0x427d2c
mov dword [eax], 1
mov dword [ebp - 0x18], eax
mov edx, dword [ebp + 0x10]
cmp dword [edx + 8], ebx
jbe 0x40290f
xor edi, edi
mov eax, edx
mov ecx, dword [eax + 4]
mov esi, dword [ecx + edi*4]
test esi, esi
je 0x402909
movzx eax, word [esi + 8]
cmp ax, 0x3f
jle 0x4029d2
push esi
call fcn.004111dc
mov eax, dword [ebp + 0x10]
add esp, 4
inc edi
cmp edi, dword [eax + 8]
jb 0x4028e5
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], ebx
cmp word [eax], bx
je 0x402aff
cmp ax, 0x30
jl 0x4028fd
mov ecx, dword [esi]
test ecx, ecx
je 0x4028fd
mov eax, dword [ecx + 0xc]
dec dword [eax]
mov edx, dword [ecx + 0xc]
mov dword [ebp - 8], ecx
cmp dword [edx], ebx
je 0x427d34
mov ecx, dword [ebp - 8]
push ecx
call fcn.004111dc
add esp, 4
jmp 0x4028fd
mov dword [ebp - 0x18], ebx
jmp 0x4028d9
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push ecx
call fcn.004111dc
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0xc]
add esp, 4
push eax
call fcn.004111dc
add esp, 4
jmp 0x4029f9
Function at 0x47f943
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call 0x483063
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x40101f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1296110]
jne 0x401029
repz ret
jmp fcn.004012ab

Function at 0x404e11
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1296110]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004013b1
and dword [ebp - 0x14], 0
cmp dword [0x1299224], 0
mov dword [ebp - 0x18], eax
jne 0x404ec4
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404f6c
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404f6c
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1299224], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1299228], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x129922c], eax
call edi
push eax
call esi
mov dword [0x1299234], eax
test eax, eax
je 0x404ec4
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1299230], eax
mov eax, dword [0x1299230]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x404f1d
cmp dword [0x1299234], ecx
je 0x404f1d
push eax
call esi
push dword [0x1299234]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404f1d
test ebx, ebx
je 0x404f1d
call edi
test eax, eax
je 0x404f14
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x404f14
test byte [ebp - 8], 1
jne 0x404f1d
or dword [ebp + 0x10], 0x200000
jmp 0x404f50
mov eax, dword [0x1299228]
cmp eax, dword [ebp - 0x18]
je 0x404f50
push eax
call esi
test eax, eax
je 0x404f50
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x404f50
mov eax, dword [0x129922c]
cmp eax, dword [ebp - 0x18]
je 0x404f50
push eax
call esi
test eax, eax
je 0x404f50
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1299224]
call esi
test eax, eax
je 0x404f6c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404f6e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040101f
leave
ret
Function at 0x411e90
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
cmp dword [0x4871ec], 0
je 0x411ee1
mov eax, 0x6418
mov ecx, 1
mov edx, dword [ebp - 8]
mov esi, dword [0x4871ec]
mov dword [esp], edx
mov dword [esp + 4], 0x6418
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
call sub.cvirte.dll_fwrite
mov dword [ebp - 0x14], eax
add esp, 0x24
pop esi
pop ebp
ret
Function at 0x41ce20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x6c
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov esi, 1
mov edi, 4
lea ebx, [ebp - 0x20]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], ebx
mov dword [esp + 4], 1
mov dword [esp + 8], 4
mov dword [esp + 0xc], eax
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
call sub.cvirte.dll_fread
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 4
jae 0x41ce85
mov dword [ebp - 0x10], 0xffffffff
jmp 0x41d038
lea eax, [0x4222d2]
mov ecx, 4
lea edx, [ebp - 0x20]
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 4
mov dword [ebp - 0x34], ecx
call sub.cvirte.dll_memcmp
cmp eax, 0
je 0x41cf28
mov eax, 3
lea ecx, [ebp - 0x20]
mov edx, ecx
add edx, 1
mov dword [esp], ecx
mov dword [esp + 4], edx
mov dword [esp + 8], 3
mov dword [ebp - 0x38], eax
call sub.cvirte.dll_memcpy
mov ecx, 1
lea edx, [ebp - 0x20]
add edx, 3
mov esi, dword [ebp - 0x14]
mov dword [esp], edx
mov dword [esp + 4], 1
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
call sub.cvirte.dll_fread
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 1
je 0x41cf23
mov dword [ebp - 0x10], 0xffffffff
jmp 0x41d038
jmp 0x41ce85
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call sub.cvirte.dll_ftell
mov ecx, 1
mov edx, 2
lea esi, [ebp - 0x20]
sub eax, 4
mov edi, dword [ebp - 0x1c]
mov dword [edi], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], 1
mov dword [esp + 8], 2
mov dword [esp + 0xc], eax
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
call sub.cvirte.dll_fread
mov ecx, 3
mov edx, 1
mov dword [ebp - 0x28], eax
movzx eax, byte [ebp - 0x20]
shl eax, 8
movzx esi, byte [ebp - 0x1f]
add eax, esi
mov bx, ax
mov eax, dword [ebp - 0x18]
mov word [eax], bx
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
mov dword [esp + 4], 3
mov dword [esp + 8], 1
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
call sub.cvirte.dll_fseek
mov ecx, 1
mov edx, 3
lea esi, [ebp - 0x20]
mov edi, dword [ebp - 0x14]
mov dword [esp], esi
mov dword [esp + 4], 1
mov dword [esp + 8], 3
mov dword [esp + 0xc], edi
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
call sub.cvirte.dll_fread
mov ecx, 1
mov dword [ebp - 0x28], eax
movzx eax, byte [ebp - 0x20]
shl eax, 0x10
movzx edx, byte [ebp - 0x1f]
shl edx, 8
add eax, edx
movzx edx, byte [ebp - 0x1e]
add eax, edx
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
movzx edx, word [edx]
sub edx, 0xc
mov dword [esp], eax
mov dword [esp + 4], edx
mov dword [esp + 8], 1
mov dword [ebp - 0x60], ecx
call sub.cvirte.dll_fseek
mov ecx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x10]
add esp, 0x6c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x41e840
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x41e86e
mov al, byte [esi + 1]
mov ecx, esi
inc esi
cmp al, 0x22
je 0x41e865
test al, al
jne 0x41e857
cmp byte [esi], 0x22
cmovne esi, ecx
inc esi
jmp 0x41e878
cmp al, 0x20
jle 0x41e878
inc esi
cmp byte [esi], 0x20
jg 0x41e872
mov al, byte [esi]
test al, al
je 0x41e88c
nop
cmp al, 0x20
jg 0x41e88c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x41e880
lea eax, [ebp - 0x44]
mov dword [ebp - 0x18], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
movzx ebx, word [ebp - 0x14]
jne 0x41e8ac
mov ebx, 0xa
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
mov edi, eax
push 0
push edi
call fcn.0041f4b0
test eax, eax
je 0x41e933
call fcn.0041f0c0
test eax, eax
je 0x41e908
push edi
push 1
call fcn.0041eee0
add esp, 8
test eax, eax
je 0x41e908
push 0
push 0x4892fc
push str.LabWindows_CVI
call fcn.0041f6b0
add esp, 0xc
or esi, 0xffffffff
call fcn.0041f440
push esi
call fcn.0041f960
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0
push edi
call fcn.0041fb80
mov esi, eax
call fcn.0041f1c0
call fcn.0041f170
call fcn.0041f440
push esi
call fcn.0041f960
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
or esi, 0xffffffff
push esi
call fcn.0041f960
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41eb40
Capabilities:
Check mutex on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
cmp dword [0x42406c], 0
je 0x41eb58
xor eax, eax
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x114]
push str.National_Instruments_LabWindows_CVI_Startup_library__d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x114]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edi, eax
test edi, edi
jne 0x41eb94
lea eax, [edi - 3]
pop edi
mov esp, ebp
pop ebp
ret
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [0x42406c], 0
je 0x41ebbb
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.winmm.dll
call esi
mov dword [ebp - 8], eax
test eax, eax
jne 0x41ebe7
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push str.advapi32.dll
call esi
mov ebx, eax
test ebx, ebx
je 0x41ec11
push str.kernel32.dll
call esi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x41ec11
push str.user32.dll
call esi
mov dword [ebp - 4], eax
test eax, eax
jne 0x41ec29
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
or eax, 0xffffffff
pop edi
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.timeGetTime
push dword [ebp - 8]
call esi
mov dword [0x424070], eax
test eax, eax
je 0x41ecbe
push str.RegOpenKeyExA
push ebx
call esi
mov dword [0x424074], eax
test eax, eax
je 0x41ecbe
push str.RegQueryValueExA
push ebx
call esi
mov dword [0x424078], eax
test eax, eax
je 0x41ecbe
push str.GetFileTime
push dword [ebp - 0xc]
call esi
mov dword [0x42407c], eax
test eax, eax
je 0x41ecbe
push str.KillTimer
push dword [ebp - 4]
call esi
mov dword [0x424080], eax
test eax, eax
je 0x41ecbe
push str.SetTimer
push dword [ebp - 4]
call esi
mov dword [0x424084], eax
test eax, eax
je 0x41ecbe
push edi
mov dword [0x42406c], 1
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
push dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push ebx
call esi
push dword [ebp - 0xc]
call esi
push dword [ebp - 4]
call esi
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop esi
mov eax, 0xfffffffe
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x41eee0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x423d7a]
xorps xmm0, xmm0
push ebx
push esi
cdq
push edi
mov edi, eax
mov byte [ebp - 1], 0
mov ebx, edx
movlpd qword [ebp - 0xc], xmm0
add edi, 0x83aa6260
push 0
adc ebx, 0
call sub.cvirte.dll_time
add esp, 4
test ebx, ebx
jl 0x41ef5c
jg 0x41ef1f
cmp edi, eax
jbe 0x41ef5c
mov esi, dword [ebp - 0xc]
sub edi, eax
mov eax, dword [ebp - 8]
mov ecx, 0x3e8
sbb ebx, 0
nop
add esi, edi
adc eax, ebx
sub ecx, 1
jne 0x41ef30
test eax, eax
jg 0x41ef55
jl 0x41ef5c
cmp esi, 0x927c0
jb 0x41ef5c
test eax, eax
jl 0x41ef68
jg 0x41ef55
cmp esi, 0xfc5d36bf
jb 0x41ef68
mov esi, 0xfc5d36bf
jmp 0x41ef68
mov dword [ebp - 8], 0
mov esi, 0x927c0
call fcn.0041eb40
test eax, eax
je 0x41ef7b
push 0
call fcn.0041f960
add esp, 4
push 0x41ed10
push esi
push 0
push 0
call dword [0x424084]
mov dword [0x424060], eax
test eax, eax
jne 0x41efa0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 8], 0
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
je 0x41efdb
call edi
push eax
lea eax, [ebp - 0x10c]
push str.CVI_Demo_Exe__x
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
test eax, eax
je 0x41ef94
push 0x104
push 0x424088
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x41f013
xor ecx, ecx
nop dword [eax]
nop dword [eax + eax]
mov al, byte [ecx + str.Unknown_DLL_EXE]
lea ecx, [ecx + 1]
mov byte [ecx + 0x424087], al
test al, al
jne 0x41f000
call edi
push eax
lea eax, [ebp - 0x10c]
push str.CVI_Demo_Last_Time_Timer_Called___d
push eax
call esi
lea eax, [ebp - 0x10c]
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call fcn.0041f910
add esp, 0x24
mov dword [0x424064], eax
test eax, eax
je 0x41ef94
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, byte [ebp - 1]
cmp eax, 0xb7
push 0
push 0
push 0
push 2
push dword [0x424064]
mov esi, 1
cmovne ebx, esi
call fcn.0041fa40
add esp, 0x14
mov dword [0x424068], eax
test eax, eax
jne 0x41f089
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test bl, bl
je 0x41f0ae
call fcn.0041eb40
test eax, eax
je 0x41f0a0
push 0
call fcn.0041f960
add esp, 4
call dword [0x424070]
mov ecx, dword [0x424068]
mov dword [ecx], eax
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret