joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431f80
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x431fab
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x431fcf
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x431fea
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x439a5a
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x439a92
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0043ceb0
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0043ce88
jmp 0x439a9e
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x43b85c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x43b89e
call fcn.00448451
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x43b89e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x43b895
xor eax, eax
jmp 0x43b8a6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0043b8ac
pop edi
pop esi
pop ebx
ret 4
Function at 0x70012b7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x70012c6
pop dword [ebp - 0x28]
mov eax, 0x3767ebd
sub eax, 0xfc766bf7
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x6b71b69b
sub dword [ebp - 0x38], 0x1d1f7150
mov dword [ebp - 0x34], 0x94359545
sub dword [ebp - 0x34], 0x62024900
mov dword [ebp - 0x30], 0x310be1b1
sub dword [ebp - 0x30], 0xe4bf9d83
mov dword [ebp - 0x2c], 0x8abcc952
add dword [ebp - 0x2c], 0x754336ae
lea eax, [ebp - 0x38]
push eax
mov eax, 0x6d72cb73
add eax, 0x998e64bd
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x2a13fe8f
add dword [ebp - 0x38], 0x4a5e6ac7
mov dword [ebp - 0x34], 0x8c1ea0a4
sub dword [ebp - 0x34], 0x4ab23f2f
mov dword [ebp - 0x30], 0x76c27e16
sub dword [ebp - 0x30], 0x135311aa
mov dword [ebp - 0x2c], 0x9c8dde1d
sub dword [ebp - 0x2c], 0x9c8dde1d
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, 0x2bfa4309
sub eax, 0x24f912d5
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3bd17
push 0
call eax
mov ecx, 0xd5ee4a04
add ecx, 0x2a1202f4
xor esi, esi
add esi, eax
mov edx, 0x5b62c50f
add edx, 0xab9f3cf1
add edx, dword [ebp - 0x28]
mov ebx, 0x88df1c6d
mov edi, dword [edx]
mov dword [ebp - 8], 0xebd21d31
add edi, ebx
xor dword [ebp - 0x1c], eax
mov dword [esi], edi
xor dword [ebp - 4], 0x9158354b
add esi, 4
add edx, 4
loop 0x70013e4
add eax, 0x126b3
mov ebx, eax
add eax, 0x7011f050
add eax, 0x8fee0fb5
mov ecx, 0xa5927fc
add ecx, 0xfca6d804
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.070012b7
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.070012b7
int3
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x41c200
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x15000]
push edi
or ebp, 0xffffffff
jmp 0x41c222
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41c229
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41c218
mov eax, 1
add ebx, ebx
jne 0x41c23b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41c230
jne 0x41c24c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c230
xor ecx, ecx
sub eax, 3
jb 0x41c260
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x41c2d2
mov ebp, eax
add ebx, ebx
jne 0x41c26b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41c278
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x41c29c
inc ecx
add ebx, ebx
jne 0x41c288
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41c27d
jne 0x41c299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41c27d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41c2bc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41c2ad
jmp 0x41c21e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41c2bc
add edi, ecx
jmp 0x41c21e
pop esi
mov edi, esi
mov ecx, 0x49a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41c2da
cmp byte [edi], 6
jne 0x41c2da
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x41c2df
lea edi, [esi + 0x1a000]
mov eax, dword [edi]
or eax, eax
je 0x41c34e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1d57c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1d610]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41c30c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1d618]
or eax, eax
je 0x41c348
mov dword [ebx], eax
add ebx, 4
jmp 0x41c329
call dword [esi + 0x1d614]
mov ebp, dword [esi + 0x1d61c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x41c382
sub esp, 0xffffff80
jmp 0x40e0e4
Function at 0x403a74
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x390
mov eax, dword [0x44608c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
mov eax, 0x101
push 0
push eax
mov ecx, esi
mov dword [ebp - 0x390], eax
call fcn.004046c1
cmp dword [esi + 0x14], 8
jb 0x403aaa
mov eax, dword [esi]
jmp 0x403aac
mov eax, esi
lea ecx, [ebp - 0x390]
push ecx
push eax
push 2
call sub.Secur32.dll_GetUserNameExW
test al, al
je 0x403adf
push 0
push dword [ebp - 0x390]
mov ecx, esi
call fcn.004046c1
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004065bb
mov esp, ebp
pop ebp
ret 4
push 0x4243c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0xf
lea ecx, [ebp - 0x38c]
call fcn.004018f5
push 0x442bc0
lea eax, [ebp - 0x38c]
push eax
call fcn.004073d4
int3

Function at 0xe48678
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe48682
pushal
call 0xe48688
pop ebp
sub ebp, 0x10
sub ebp, 0xa48678
jmp 0xe4869e
mov eax, 0xa48678
add eax, ebp
add eax, 0x4c
mov ecx, 0x5cb
mov edx, 0x73f6ace5
xor byte [eax], dl
inc eax
dec ecx
jne 0xe486b5
jmp 0xe486c8
outsb dx, byte [esi]
sub byte [esi + 0x6c], ch
fxam
in eax, 0xe5
and al, 0x1d
in eax, 0xe5
in eax, 0xe6
sub byte [ebp - 9], bl
in eax, 0xe5
in eax, 0x5f
int 0xe5
in eax, 0xe5
adc al, byte [edi]
out 0x2d, al
outsb dx, byte [esi]
jmp 0xe7ca6cd2
Function at 0x4045e9
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x40e2e0
push str.FlsAlloc
push 0
call fcn.00404562
mov esi, eax
add esp, 0x10
test esi, esi
je 0x40461b
push dword [ebp + 8]
mov ecx, esi
call fcn.00403613
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x40465d
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x40e310
push str.FlsSetValue
push 3
call fcn.00404562
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x404691
mov ecx, esi
call fcn.00403613
call esi
jmp 0x404697
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x401530
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, dword [0x427020]
test eax, eax
je 0x4015b0
push esi
push ebx
sub esp, 0x34
call sub.KERNEL32.dll_GetTickCount
lea esi, [esp + 0x12]
lea ebx, [eax + 0x7d0]
jmp 0x40158f
mov eax, dword [0x427020]
mov dword [esp + 0xc], 0x1e
mov dword [esp + 8], esi
mov dword [esp + 4], str.beefe004_4910_473c_be46_960948c2f59c
mov dword [esp], eax
call fcn.00402840
sub eax, 1
cmp eax, 0xfffffffd
ja 0x401580
test byte [esp + 0x12], 1
je 0x4015a3
mov dword [esp], 0xa
call sub.KERNEL32.dll_Sleep
sub esp, 4
call sub.KERNEL32.dll_GetTickCount
cmp ebx, eax
jae 0x401550
add esp, 0x34
mov eax, 1
pop ebx
pop esi
ret
add esp, 0x34
xor eax, eax
pop ebx
pop esi
ret
mov eax, 1
ret

Function at 0x4040a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0x88
mov eax, dword [esp + 0x90]
test ax, ax
jne 0x404110
mov eax, 0x54
lea ebx, [esp + 0x1c]
mov dword [esp + 0x1c], 0x45455053
mov dword [esp + 0x20], 0x52505f44
mov dword [esp + 0x24], 0x41454845
mov word [esp + 0x28], ax
lea eax, [esp + 0x18]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [0x42b3b0]
mov dword [esp], eax
call fcn.004055b0
test al, al
jne 0x404130
mov eax, dword [esp + 0x18]
mov dword [esp], eax
call fcn.00403ef0
add esp, 0x88
pop ebx
ret
lea ebx, [esp + 0x1c]
movzx eax, ax
mov dword [esp + 4], str.CALSPEED_u
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_sprintf
jmp 0x4040d9
mov dword [esp + 4], ebx
mov dword [esp], 0x41ee78
call fcn.004036b0
add esp, 0x88
mov eax, 1
pop ebx
ret
Function at 0x404b70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [0x428368]
mov ebx, dword [esp + 0x20]
test eax, eax
je 0x404c07
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x52
mov dword [esp + 4], 1
mov dword [esp], str._n__n
call sub.msvcrt.dll_fwrite
mov eax, dword [0x428368]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__Result:__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x428368]
mov dword [esp + 8], 0x51
mov dword [esp + 4], 1
mov dword [esp], 0x41f1d0
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x428368]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [0x428368]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [0x428368], 0
mov eax, dword [0x428364]
test eax, eax
je 0x404c96
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x52
mov dword [esp + 4], 1
mov dword [esp], str._n__n
call sub.msvcrt.dll_fwrite
mov eax, dword [0x428364]
mov dword [esp + 8], ebx
mov dword [esp + 4], str.__Result:__s_n
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
mov eax, dword [0x428364]
mov dword [esp + 8], 0x51
mov dword [esp + 4], 1
mov dword [esp], 0x41f1d0
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [0x428364]
mov dword [esp], eax
call sub.msvcrt.dll_fflush
mov eax, dword [0x428364]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [0x428364], 0
add esp, 0x18
pop ebx
ret
Function at 0x408510
Capabilities:
Write file on windows

Disassembly:
test eax, eax
je 0x4086d0
push esi
push ebx
mov esi, eax
mov ebx, 0x42a144
sub esp, 0x24
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x41feec
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x39
mov dword [esp + 4], 1
mov dword [esp], 0x41fef0
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], 0x41ff2c
call sub.msvcrt.dll_fwrite
movzx eax, word [0x42a10c]
mov dword [esp + 4], 0x41ff4c
mov dword [esp], esi
mov dword [esp + 0x10], eax
movzx eax, word [0x42a10a]
mov dword [esp + 0xc], eax
movzx eax, word [0x42a108]
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], 0x41ff70
call sub.msvcrt.dll_fwrite
movzx eax, word [ebx]
mov dword [esp + 4], 0x41ff98
add ebx, 2
mov dword [esp], esi
mov dword [esp + 0x14], eax
movzx eax, word [ebx - 0x14]
mov dword [esp + 0x10], eax
movzx eax, word [ebx - 0x26]
mov dword [esp + 0xc], eax
movzx eax, word [ebx - 0x38]
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
cmp ebx, 0x42a156
jne 0x4085d5
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], 0x41ffb8
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x41ffe0
call sub.msvcrt.dll_fwrite
movzx eax, word [0x42a156]
mov dword [esp], esi
mov dword [esp + 4], str.__Reference_temperature:__u_n
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
movzx eax, word [0x42a158]
mov dword [esp], esi
mov dword [esp + 4], str.__Temperature_compensation_factor:__u_n
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
movzx eax, word [0x42a15a]
mov dword [esp], esi
mov dword [esp + 4], str.__Temperature_compensation_extra:__u_n
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x3a
mov dword [esp + 4], 1
mov dword [esp], 0x420054
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fflush
add esp, 0x24
xor eax, eax
pop ebx
pop esi
ret
mov eax, 1
ret
Function at 0x409fb0
Capabilities:
Write file on windows

Disassembly:
test eax, eax
je 0x40a120
push esi
push ebx
mov esi, eax
mov ebx, 0x428e04
sub esp, 0x24
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x420ce4
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x39
mov dword [esp + 4], 1
mov dword [esp], 0x420ce8
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], 0x420d24
call sub.msvcrt.dll_fwrite
movzx eax, word [0x428dcc]
mov dword [esp + 4], 0x420d44
mov dword [esp], esi
mov dword [esp + 0x10], eax
movzx eax, word [0x428dca]
mov dword [esp + 0xc], eax
movzx eax, word [0x428dc8]
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], 0x420d68
call sub.msvcrt.dll_fwrite
movzx eax, word [ebx]
mov dword [esp + 4], 0x420d90
add ebx, 2
mov dword [esp], esi
mov dword [esp + 0x14], eax
movzx eax, word [ebx - 0x14]
mov dword [esp + 0x10], eax
movzx eax, word [ebx - 0x26]
mov dword [esp + 0xc], eax
movzx eax, word [ebx - 0x38]
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
cmp ebx, 0x428e16
jne 0x40a075
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], 0x420db0
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x420dd8
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x3a
mov dword [esp + 4], 1
mov dword [esp], 0x420ddc
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fflush
add esp, 0x24
xor eax, eax
pop ebx
pop esi
ret
mov eax, 1
ret
Function at 0x40bd30
Capabilities:
Write file on windows

Disassembly:
test eax, eax
je 0x40bea0
push esi
push ebx
mov esi, eax
mov ebx, 0x428e84
sub esp, 0x24
mov dword [esp + 0xc], eax
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x421a04
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x39
mov dword [esp + 4], 1
mov dword [esp], 0x421a08
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x1e
mov dword [esp + 4], 1
mov dword [esp], str._________________Speeds__RPM__n
call sub.msvcrt.dll_fwrite
movzx eax, word [0x428e4c]
mov dword [esp + 4], str.___Position___5u___5u___5u__n
mov dword [esp], esi
mov dword [esp + 0x10], eax
movzx eax, word [0x428e4a]
mov dword [esp + 0xc], eax
movzx eax, word [0x428e48]
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], 0x421a88
call sub.msvcrt.dll_fwrite
movzx eax, word [ebx]
mov dword [esp + 4], str._______5u___5u___5u___5u__n
add ebx, 2
mov dword [esp], esi
mov dword [esp + 0x14], eax
movzx eax, word [ebx - 0x14]
mov dword [esp + 0x10], eax
movzx eax, word [ebx - 0x26]
mov dword [esp + 0xc], eax
movzx eax, word [ebx - 0x38]
mov dword [esp + 8], eax
call sub.msvcrt.dll_fprintf
cmp ebx, 0x428e96
jne 0x40bdf5
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x27
mov dword [esp + 4], 1
mov dword [esp], 0x421ad0
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 3
mov dword [esp + 4], 1
mov dword [esp], 0x421af8
call sub.msvcrt.dll_fwrite
mov dword [esp + 0xc], esi
mov dword [esp + 8], 0x3a
mov dword [esp + 4], 1
mov dword [esp], str.__n_n
call sub.msvcrt.dll_fwrite
mov dword [esp], esi
call sub.msvcrt.dll_fflush
add esp, 0x24
xor eax, eax
pop ebx
pop esi
ret
mov eax, 1
ret
Function at 0x40ecd0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
movzx eax, al
push esi
push ebx
mov edi, ecx
sub esp, 0x22c
lea ebx, [esp + 0x2c]
mov dword [esp + 8], 0x1f4
mov dword [esp], eax
mov dword [esp + 0x1c], edx
mov dword [esp + 4], ebx
call fcn.0040f9f0
cmp ax, 2
jbe 0x40edc0
mov ebp, eax
lea eax, [eax - 3]
mov edx, ebp
cmp dl, 2
je 0x40edd0
movzx eax, al
mov ecx, 0xffffffff
lea esi, [ebx + eax + 1]
mov eax, 0xffffffff
lea esi, [esi]
lea edi, [edi]
add ebx, 1
xor cl, byte [ebx - 1]
movzx edx, cl
xor al, byte [edx + 0x422ea0]
cmp ebx, esi
mov ecx, eax
movzx eax, byte [edx + 0x422da0]
jne 0x40ed30
shl ecx, 8
or ecx, eax
movzx edx, ch
movzx ebp, bp
mov eax, 1
movzx ebx, byte [esp + ebp + 0x2a]
cmp ebx, edx
je 0x40ed70
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp byte [esp + ebp + 0x2b], cl
jne 0x40ed65
cmp word [esp + 0x1c], 0
je 0x40edb8
movzx eax, word [esp + 0x1c]
mov edx, 3
sub eax, 1
movzx eax, ax
lea ebx, [edi + eax*2 + 2]
lea ecx, [edx + 1]
movzx eax, dx
add edi, 2
movzx eax, byte [esp + eax + 0x2c]
add edx, 2
movzx ecx, cx
movzx ecx, byte [esp + ecx + 0x2c]
shl eax, 8
or eax, ecx
mov word [edi - 2], ax
cmp edi, ebx
jne 0x40ed92
xor eax, eax
jmp 0x40ed65
add esp, 0x22c
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, 0xffffffff
mov edx, 0xff
jmp 0x40ed54

Function at 0x40f950
Capabilities:
Write file on windows

Disassembly:
cmp byte [0x428f4c], 0
jne 0x40f960
xor eax, eax
ret
sub esp, 0x3c
mov ecx, 0x42b1a0
mov byte [0x42b1a0], 0
mov edx, dword [esp + 0x44]
mov eax, dword [esp + 0x40]
call fcn.0040f560
mov eax, dword [0x41d0a0]
mov dword [esp + 4], 0xf
mov dword [esp], eax
call sub.KERNEL32.dll_PurgeComm
mov eax, dword [0x41d0a0]
sub esp, 8
mov dword [esp], eax
call sub.KERNEL32.dll_FlushFileBuffers
sub esp, 4
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 4], eax
mov eax, dword [0x41d0a0]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov dword [esp], 5
call sub.KERNEL32.dll_Sleep
sub esp, 4
mov eax, dword [esp + 0x2c]
add esp, 0x3c
ret