joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10038890
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x100e7c94]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
cmp edi, eax
jbe 0x1003894c
cmp dword [esi + 0x10], 0
jne 0x100388d2
mov eax, 0x100
cmp edi, eax
cmova eax, edi
push eax
mov dword [esi + 0xc], eax
call fcn.1003acd8
mov edi, eax
jmp 0x10038943
push edi
lfence
push dword [esi + 0xc]
lea eax, [ebp - 0x84]
push str.CMediaData_expand_buffer__d______d_n
push 0x80
push eax
call fcn.10027900
add esp, 0x14
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 8]
mov ecx, 0x100
cmp edi, ecx
cmova ecx, edi
add eax, eax
mov dword [esi + 0xc], ecx
cmp ecx, eax
jae 0x1003891a
mov dword [esi + 0xc], eax
jmp 0x1003891c
mov eax, ecx
push eax
call fcn.1003acd8
mov edi, eax
add esp, 4
mov eax, dword [esi + 8]
test eax, eax
je 0x1003893b
push eax
push dword [esi + 0x10]
push edi
call fcn.1003cc70
add esp, 0xc
push dword [esi + 0x10]
call fcn.1003acfd
mov dword [esi + 0x10], edi
add esp, 4
mov eax, dword [esi + 0xc]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1003acef
mov esp, ebp
pop ebp
ret 4

Function at 0x10078013
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10077c0b

Function at 0x1007801e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10077d95

Function at 0x1007c563
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1007bf2b

Function at 0x1008af1d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1008adf1
Function at 0x1008e250
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret

Function at 0x1008e270
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x100e7c94]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x98]
mov dword [ebp - 0x98], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x1008e2c3
cmp dword [ebp - 0x88], 2
jne 0x1008e2c3
cmp dword [ebp - 0x94], 6
jb 0x1008e2c3
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003acef
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.1003acef
mov esp, ebp
pop ebp
ret
Function at 0x1008ec70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100e7c94]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [str.runas]
xorps xmm0, xmm0
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov ax, word [0x100da130]
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x48]
push eax
movlpd qword [ebp - 0x24], xmm0
movlpd qword [ebp - 0x1c], xmm0
movlpd qword [ebp - 0x14], xmm0
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x38], ecx
movups xmmword [ebp - 0x34], xmm0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003acef
mov esp, ebp
pop ebp
ret
Function at 0x100937a0
Capabilities:
Check mutex on windows

Disassembly:
push 0x14809830
call fcn.100975f0
add esp, 4
mov dword [0x148098f4], eax
test eax, eax
jle 0x10093847
push str.Empia_VideoClass_HidClass_Library
push 0
push 0
mov byte [0x14809828], 2
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
push 0x3e8
push eax
mov dword [0x1480982c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x100937fa
push str.hidreq_Init
push str.__S__mutex_time_out
call fcn.1008d430
add esp, 8
xor eax, eax
ret
push esi
xor esi, esi
cmp dword [0x148098f4], esi
jle 0x10093834
push edi
mov edi, 0x14809b18
nop dword [eax + eax]
mov eax, dword [esi*4 + 0x14809834]
push edi
push eax
mov dword [edi - 8], eax
call fcn.100902c0
inc esi
add esp, 8
add edi, 0x20c
cmp esi, dword [0x148098f4]
jl 0x10093810
pop edi
push dword [0x1480982c]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, 1
pop esi
ret
push str.No_found_HID_Device.
call fcn.1008d430
add esp, 4
xor eax, eax
ret
Function at 0x10097c70
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 1]
push esi
push edi
push eax
push 1
lea eax, [ebp - 2]
mov byte [ebp - 2], 5
push eax
push 1
push 1
push 0
push ebx
call fcn.10092840
mov cl, byte [ebp - 1]
add esp, 0x1c
mov al, cl
and al, 0xc
cmp al, 0xc
je 0x10097d0c
lea eax, [ebp - 8]
mov byte [ebp - 8], 1
push eax
push 2
xor esi, esi
or cl, 0xc
push esi
push esi
push 1
push esi
push ebx
mov byte [ebp - 7], cl
call fcn.10092a90
add esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
nop dword [eax]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jae 0x10097cde
mov edi, eax
jmp 0x10097ce2
mov esi, eax
sub esi, edi
cmp esi, 0xbb8
jae 0x10097d15
lea eax, [ebp - 1]
push eax
push 1
lea eax, [ebp - 2]
push eax
push 1
push 1
push 0
push ebx
call fcn.10092840
mov al, byte [ebp - 1]
add esp, 0x1c
and al, 0xc
cmp al, 0xc
jne 0x10097cd0
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10097f20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
xor eax, eax
push edi
mov byte [ebp - 1], 0x9f
mov word [ebp - 8], ax
mov byte [ebp - 6], al
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x3e8
jae 0x10097fb6
nop dword [eax + eax]
lea eax, [ebp - 8]
push eax
push 3
lea eax, [ebp - 1]
push eax
push 1
push 1
push 0
call fcn.100927a0
add esp, 0x18
cmp eax, 0x80004005
je 0x10097fc8
mov dl, byte [ebp - 6]
xor ecx, ecx
mov bl, byte [ebp - 7]
mov eax, 0x100daf01
mov dh, byte [ebp - 8]
nop
cmp dh, byte [eax - 1]
jne 0x10097f8e
cmp bl, byte [eax]
jne 0x10097f8e
cmp dl, byte [eax + 1]
je 0x10097fd1
add eax, 0x14
inc ecx
cmp eax, 0x100daff1
jl 0x10097f80
push str.emVidHidCls_SPI_Flash_GetInfo
push str.__s__retry...
call fcn.100979c0
add esp, 8
call esi
sub eax, edi
cmp eax, 0x3e8
jb 0x10097f50
push str.emVidHidCls_SPI_Flash_GetInfo
push str.__s__Read_SFlash_Info_fail.
call fcn.100979c0
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [ecx + ecx*4]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx*4 + 0x100daf08]
mov dword [ecx], eax
mov eax, dword [edx*4 + 0x100daf04]
mov dword [ecx + 4], eax
push dword [edx*4 + 0x100daefc]
push str.emVidHidCls_SPI_Flash_GetInfo
push str.__s__SPI_FlashType_:__s
call fcn.100979c0
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402414
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x402988
call fcn.004026d8
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x402474
cmp eax, 0xffffffff
je 0x402474
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40246d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40246d
cmp edx, 0x10000000
jae 0x40246d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40246a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4024e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40251e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x402516
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x402520
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x402506
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4025f0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x402621
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x402621
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x402621
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x408769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40c190
cmp edx, dword [eax]
je 0x40878b
add eax, 8
inc ecx
cmp eax, 0x40c220
jl 0x40877c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40c190]
jne 0x4088b9
mov eax, dword [0x40cbb0]
cmp eax, 1
je 0x408893
test eax, eax
jne 0x4087bc
cmp dword [0x40c0e4], 1
je 0x408893
cmp edx, 0xfc
je 0x4088b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4087f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00409670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00409490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x408836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00409490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40b45c
push edi
call fcn.00409f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00409670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00409680
lea eax, [ebp - 0xa0]
push 0x40b43c
push eax
call fcn.00409680
push dword [esi + 0x40c194]
lea eax, [ebp - 0xa0]
push eax
call fcn.00409680
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00409e75
add esp, 0x2c
pop edi
jmp 0x4088b9
lea eax, [ebp + 8]
lea esi, [esi + 0x40c194]
push 0
push eax
push dword [esi]
call fcn.00409490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x7b1f7161
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x400b1b31
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x6a87549b
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x29c14237
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x41f660
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x41f696
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x41f67e
cmp byte [ebx + 0x1e], 0
jne 0x41f696
push 0x48
call fcn.004031b0
mov esi, eax
add esp, 4
test esi, esi
jne 0x41f69f
test ebx, ebx
je 0x41f696
mov byte [ebx + 0x1e], 1
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, byte [edi + 5]
mov byte [esi + 5], al
mov ecx, dword [edi]
push ecx
push ebx
call fcn.0041f1b0
mov dword [esi], eax
mov edx, dword [edi + 0xc]
push edx
push ebx
call fcn.0041f330
mov dword [esi + 0xc], eax
mov eax, dword [edi + 0x10]
push eax
push ebx
call fcn.0041f060
mov dword [esi + 0x10], eax
mov ecx, dword [edi + 0x14]
push ecx
push ebx
call fcn.0041f1b0
mov dword [esi + 0x14], eax
mov edx, dword [edi + 0x18]
push edx
push ebx
call fcn.0041f060
mov dword [esi + 0x18], eax
mov eax, dword [edi + 0x1c]
push eax
push ebx
call fcn.0041f1b0
mov dword [esi + 0x1c], eax
movzx ecx, byte [edi + 4]
mov byte [esi + 4], cl
mov edx, dword [edi + 0x20]
push edx
push ebx
call fcn.0041f660
mov dword [esi + 0x20], eax
mov eax, dword [edi + 0x2c]
push eax
push ebx
call fcn.0041f060
mov dword [esi + 0x2c], eax
mov ecx, dword [edi + 0x30]
add esp, 0x40
push ecx
push ebx
call fcn.0041f060
mov dword [esi + 0x30], eax
add esp, 8
or eax, 0xffffffff
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dl, byte [edi + 6]
mov byte [esi + 6], dl
movzx ecx, byte [edi + 7]
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
pop edi
mov byte [esi + 7], cl
mov byte [esi + 8], 0
mov byte [esi + 9], 0
mov dword [esi + 0x28], 0
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42eea0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x6fc], 3
jne 0x42edf1
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.0042d077
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.0042cfd8
add esp, 0xc
jmp 0x42efdf
cmp dword [ebp - 0x6fc], 4
jne 0x42ee9b
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
mov byte [ebp - 0x7b7], 0xb2
mov byte [ebp - 0x7b6], 0xb1
mov byte [ebp - 0x7b5], 0xb8
mov byte [ebp - 0x7b4], 0xcf
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
mov byte [ebp - 0x7af], 0x91
mov byte [ebp - 0x7ae], 0xfd
call fcn.0042d067
ljmp 0x8d0b
cmp dword [ebp - 0x6fc], 5
jne 0x42ef3c
and byte [ebp - 0x7cc], 0
and byte [ebp - 0x7cb], 0
mov byte [ebp - 0x7ca], 0x3f
and byte [ebp - 0x7c9], 0
mov byte [ebp - 0x7c8], 0x9c
mov byte [ebp - 0x7c7], 0x90
mov byte [ebp - 0x7c6], 0x93
mov byte [ebp - 0x7c5], 0x81
mov byte [ebp - 0x7c4], 0x90
mov byte [ebp - 0x7c3], 0xac
mov byte [ebp - 0x7c2], 0xee
mov byte [ebp - 0x7c1], 0xa4
mov byte [ebp - 0x7c0], 0xac
mov byte [ebp - 0x7bf], 0xac
mov byte [ebp - 0x7be], 0xc0
push 0xb
lea eax, [ebp - 0x7cc]
push eax
call fcn.0042d077
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.0042cfd8
add esp, 0xc
jmp 0x42efdf
cmp dword [ebp - 0x6fc], 6
jne 0x42efda
and byte [ebp - 0x7dc], 0
and byte [ebp - 0x7db], 0
mov byte [ebp - 0x7da], 0x11
and byte [ebp - 0x7d9], 0
mov byte [ebp - 0x7d8], 0xb2
mov byte [ebp - 0x7d7], 0x8b
mov byte [ebp - 0x7d6], 0x9c
mov byte [ebp - 0x7d5], 0x9c
mov byte [ebp - 0x7d4], 0x81
mov byte [ebp - 0x7d3], 0x9c
mov byte [ebp - 0x7d2], 0xc0
mov byte [ebp - 0x7d1], 0x82
mov byte [ebp - 0x7d0], 0x81
mov byte [ebp - 0x7cf], 0x89
mov byte [ebp - 0x7ce], 0xee
push 0xb
lea eax, [ebp - 0x7dc]
push eax
call fcn.0042d077
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.0042cfd8
add esp, 0xc
jmp 0x42efdf
jmp 0x42f10d
Function at 0x448d80
Capabilities:
Check mutex on windows
Write file on windows

Disassembly:
sub esp, 0x438
mov eax, dword [0x4a0fe0]
xor eax, esp
mov dword [esp + 0x430], eax
cmp byte [0x4a5ba3], 0
push ebp
push esi
push edi
je 0x448f19
cmp word [0x4a5f90], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], 0
je 0x448f19
cmp word [0x4a5d88], 0
je 0x448f19
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x44c]
lea eax, [esp + 0x450]
lea esi, [esp + 0x230]
call fcn.004493e0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [esp + 0x22]
movzx edx, word [esp + 0x20]
push eax
movzx eax, word [esp + 0x22]
push ecx
movzx ecx, word [esp + 0x24]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x26]
push ecx
movzx ecx, word [esp + 0x28]
push edx
push eax
push ecx
push str.__04wd__02wd__02wd__02wd:_02wd:_02wd._03wd__t__d__t
mov ecx, 0x104
lea edi, [esp + 0x4c]
call fcn.00449380
mov eax, dword [esp + 0x46c]
add esp, 0x24
sub eax, 0
je 0x448e60
sub eax, 1
je 0x448e59
sub eax, 1
jne 0x448e6e
push 0x495534
jmp 0x448e65
push 0x495528
jmp 0x448e65
push str.___
lea esi, [esp + 0x2c]
call fcn.004492d0
lea edx, [esp + 0x230]
push edx
lea esi, [esp + 0x2c]
call fcn.004492d0
push 0x4a5d88
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x448f19
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x80
push 4
push 0
push 0
push 0x40000000
push 0x4a5f90
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebp, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
cmp esi, 0xffffffff
je 0x448f0f
lea eax, [esp + 0x10]
push eax
push 0xfffffffffffffffe
lea ecx, [esp + 0x30]
push ecx
call fcn.00449280
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x28]
push edx
push eax
lea ecx, [esp + 0x34]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test esi, esi
je 0x448f0f
push esi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call ebp
mov ecx, dword [esp + 0x43c]
pop edi
pop esi
pop ebp
xor ecx, esp
call fcn.0046d626
add esp, 0x438
ret
Function at 0x44bfc0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 8
test edi, edi
push ebx
mov bl, 1
mov dword [esp + 8], 0
jne 0x44bfd9
xor al, al
pop ebx
add esp, 8
ret
push ebp
push esi
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push str.ProxyPassword
push str.SOFTWAREEPSONMyEpson_Portal
call fcn.00448950
mov ebp, dword [esp + 0x20]
add esp, 0x10
test eax, eax
je 0x44c02e
xor bl, bl
mov dword [edi], 0
test ebp, ebp
je 0x44c025
mov esi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0xc]
add edx, 2
push edx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, dword [esp + 0xc]
lea edx, [esi + 2]
shr edx, 1
mov ecx, eax
mov dword [edi], ecx
je 0x44c067
cmp edx, 0x7fffffff
ja 0x44c067
mov eax, ebp
call fcn.00449490
mov esi, dword [esp + 0xc]
mov ecx, dword [edi]
test ecx, ecx
mov edx, esi
je 0x44c080
xor eax, eax
test esi, esi
jbe 0x44c080
xor byte [eax + ecx], 0x64
add eax, 1
cmp eax, edx
jb 0x44c075
mov eax, dword [edi]
push eax
push str.ReadProxySetting___ProxyPassword_s_n
push 0
call fcn.00448d80
add esp, 0xc
jmp 0x44c007

Function at 0x44ca60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x44ca79
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x44cab4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x44cab0
lea ebx, [ebx]
cmp esi, eax
jae 0x44cab4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x44caa0
cmp esi, eax
jb 0x44caba
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x44d180
Capabilities:
Send data
Send http request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, edx
mov edx, dword [ebp + 8]
xor ebx, ebx
push ebx
lea edi, [esi + eax]
mov eax, dword [edx + 8]
push edi
push esi
push ecx
push ebx
push ebx
push eax
mov dword [esp + 0x2c], ebx
call dword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x44d1e0
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str._WinHttpSendRequest_Error___d__n
call fcn.00401010
add esp, 8
call esi
push eax
push str.WinHttpSendRequest_Error___d__n
push 2
call fcn.00448d80
add esp, 0xc
lea eax, [ebx + 2]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push edi
push esi
push str.____WinHttpSendRequest_RequestDataLen__d__AllRequestDataLen__d__n
call fcn.00401010
add esp, 0xc
push edi
push esi
push str.WinHttpSendRequest_RequestDataLen__d__AllRequestDataLen__d__n
push 0
call fcn.00448d80
add esp, 0x10
cmp dword [ebp + 0xc], ebx
mov dword [esp + 0x18], ebx
jle 0x44d2e4
mov dword [esp + 0x14], 1
lea eax, [ebp + 0xc]
jmp 0x44d220
mov ebx, dword [eax + 4]
add eax, 4
mov edi, dword [eax + 4]
add eax, 4
xor esi, esi
cmp ebx, esi
mov dword [esp + 0x1c], eax
je 0x44d28e
test edi, edi
mov dword [esp + 0x10], esi
jbe 0x44d267
mov edi, edi
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebp + 8]
mov edx, edi
sub edx, esi
push edx
mov edx, dword [ecx + 8]
lea eax, [ebx + esi]
push eax
push edx
call dword [sym.imp.WINHTTP.dll_WinHttpWriteData]
test eax, eax
je 0x44d2b0
add esi, dword [esp + 0x10]
cmp esi, edi
jb 0x44d240
mov eax, dword [esp + 0x14]
push esi
push edi
push eax
push str.____WinHttpWriteData__d__SendDataLen__d__dwAllBytesWritten__d__n
call fcn.00401010
push esi
push edi
push eax
push str.WinHttpWriteData__d__SendDataLen__d__dwAllBytesWritten__d__n
push 0
call fcn.00448d80
mov eax, dword [esp + 0x40]
add esp, 0x24
mov ecx, dword [esp + 0x18]
add dword [esp + 0x14], 1
add ecx, 1
cmp ecx, dword [ebp + 0xc]
mov dword [esp + 0x18], ecx
jl 0x44d220
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
push eax
push str._WinHttpWriteData_Error___d__n
call fcn.00401010
add esp, 8
call esi
push eax
push str.WinHttpWriteData_Error___d__n
push 2
call fcn.00448d80
add esp, 0xc
mov eax, 2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret