joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4047d0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2024
call fcn.00435100
mov eax, dword [0x457a00]
xor eax, esp
mov dword [esp + 0x2020], eax
push ebx
push ebp
mov ebp, dword [esp + 0x2030]
push esi
xor esi, esi
push 0x1fff
lea eax, [esp + 0x2d]
push esi
push eax
mov ebx, ecx
mov dword [esp + 0x1c], esi
mov byte [esp + 0x34], 0
call fcn.00433570
xor eax, eax
add esp, 0xc
push str.backup_nv_enter_n
mov byte [esp + 0x1c], 0
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov word [esp + 0x29], ax
mov byte [esp + 0x2b], al
call fcn.00401000
mov ecx, dword [ebp]
add esp, 4
sub ecx, 1
js 0x4048b5
mov dword [esp + 0x14], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ecx]
add esi, 1
push esi
push str.NV_d
lea edx, [esp + 0x20]
push 0x10
push edx
call fcn.00430bb0
add esp, 0x10
push edi
push 0x2000
lea eax, [esp + 0x30]
push eax
push 0x45029b
lea ecx, [esp + 0x28]
push ecx
push 0x44c94c
call ebx
test eax, eax
je 0x4048a3
mov edx, dword [esp + 0x14]
add dword [esp + 0x10], 1
push edx
lea ecx, [esp + 0x2c]
mov byte [esp + eax + 0x2c], 0
call fcn.004040c0
add esp, 4
mov eax, dword [ebp]
add dword [esp + 0x14], 0x94
sub eax, 1
cmp esi, eax
jle 0x404850
mov ecx, dword [esp + 0x10]
push str.backup_nv_exit_n
mov dword [ebp], ecx
call fcn.00401000
mov ecx, dword [esp + 0x2030]
add esp, 4
pop esi
pop ebp
pop ebx
xor ecx, esp
mov al, 1
call fcn.0042fb8f
add esp, 0x2024
ret
Function at 0x4049b0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x338
mov eax, dword [0x457a00]
xor eax, esp
mov dword [esp + 0x334], eax
push ebx
push ebp
push esi
push edi
xor ebp, ebp
push 0x1ff
lea eax, [esp + 0x145]
mov esi, ecx
push ebp
push eax
mov dword [esp + 0x28], esi
mov edi, edx
mov dword [esp + 0x20], ebp
mov byte [esp + 0x14c], 0
call fcn.00433570
xor eax, eax
add esp, 0xc
push str.restore_nv_enter_n
mov byte [esp + 0x2c], 0
mov dword [esp + 0x2d], eax
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov word [esp + 0x39], ax
mov byte [esp + 0x3b], al
mov dword [esp + 0x14], ebp
mov dword [esp + 0x1c], 1
call fcn.00401000
mov cl, 0x34
mov byte [esp + 0x26], cl
mov byte [esp + 0x2a], cl
add esp, 4
lea ecx, [esp + 0x20]
mov dl, 0x56
mov al, 0x12
push ecx
mov bl, 0x78
push esi
mov byte [esp + 0x28], bl
mov byte [esp + 0x29], dl
mov byte [esp + 0x2b], al
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], dl
mov byte [esp + 0x2f], al
call fcn.0041cef0
push 0x103
lea edx, [esp + 0x45]
push ebp
push edx
mov byte [esp + 0x4c], 0
call fcn.00433570
mov eax, dword [esp + 0x360]
add eax, 0xffffffff
add esp, 0x14
cmp eax, ebp
mov dword [esp + 0x20], eax
jl 0x404be2
mov ebp, 1
lea ebx, [edi + 2]
push ebp
push str.NV_d
lea eax, [esp + 0x30]
push 0x10
push eax
call fcn.00430bb0
movzx esi, word [edi]
add esp, 0x10
push 0x45bc58
push 0x200
lea ecx, [esp + 0x148]
push ecx
push 0x45029b
lea edx, [esp + 0x38]
push edx
push 0x44c94c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x404ba1
add dword [esp + 0x14], 1
cmp byte [edi + 0x88], 0
mov ecx, dword [esp + 0x1c]
jne 0x404b44
push ebx
push esi
call fcn.0041cac0
movzx eax, ax
add esp, 8
test ax, ax
je 0x404b0d
cmp ax, 5
je 0x404b0d
cmp ax, 7
jne 0x404bc0
mov ecx, dword [esp + 0x10]
movzx edx, si
push edx
movzx eax, ax
add ecx, 1
push eax
push ecx
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x34]
push ecx
push str.PASDLib_WriteNvItem__s_Write_ok_ret__d___d_id__d_n
add ebp, 1
add edi, 0x94
add ebx, 0x94
call fcn.00401000
add esp, 0x14
jmp 0x404bb0
push edi
push esi
call fcn.0041fbc0
movzx eax, ax
movzx edx, si
add esp, 8
test ax, ax
push edx
je 0x404b81
movzx eax, ax
push eax
lea ecx, [esp + 0x40]
push ecx
push str.PASDLib_PASDLib_WriteEfsFile_Ex__s_failed_ok_ret__d_id__d_n
add ebp, 1
add edi, 0x94
add ebx, 0x94
call fcn.00401000
add esp, 0x10
jmp 0x404bb0
mov eax, dword [esp + 0x14]
add eax, 1
push 0
push eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x34]
push eax
push str.PASDLib_WriteNvItem__s_Write_ok_ret__d___d_id__d_n
call fcn.00401000
add esp, 0x14
add ebp, 1
add edi, 0x94
add ebx, 0x94
mov ecx, dword [esp + 0x20]
cmp dword [esp + 0x14], ecx
jle 0x404a92
jmp 0x404be2
movzx edx, si
push edx
movzx eax, ax
push eax
lea ecx, [esp + 0x30]
push ecx
push str.PASDLib_WriteNvItem__s_Write_error_ret__d_id__d_n
mov dword [esp + 0x28], 0
call fcn.00401000
add esp, 0x10
mov edx, dword [esp + 0x10]
push edx
push str.restore_nv_exit_total_valid_number:_d_n
call fcn.00401000
mov ecx, dword [esp + 0x34c]
add esp, 8
cmp dword [esp + 0x18], 0
pop edi
pop esi
pop ebp
setne al
pop ebx
xor ecx, esp
call fcn.0042fb8f
add esp, 0x338
ret
Function at 0x40db40
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov eax, 0x1010
call fcn.00435100
mov eax, dword [0x457a00]
xor eax, esp
mov dword [esp + 0x100c], eax
mov eax, dword [esp + 0x1014]
push ebx
push ebp
push esi
push 0xfff
lea ecx, [esp + 0x1d]
push 0
push ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
call fcn.00433570
mov ebx, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
xor esi, esi
lea ecx, [ecx]
mov ecx, dword [edi + 0x5c]
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0x1000
lea eax, [esp + 0x28]
push eax
push ecx
call ebx
push 0x1000
lea edx, [esp + 0x1c]
push 0
push edx
mov dword [esp + 0x1c], eax
call fcn.00433570
add esp, 0xc
cmp dword [esp + 0xc], 0
jne 0x40dbdd
push 0x320
call ebp
add esi, 1
cmp esi, 0x2d
jl 0x40db90
mov esi, dword [esp + 0x10]
jmp 0x40dc24
mov edx, dword [edi + 0x5c]
push 0
lea eax, [esp + 0x10]
push eax
push 0x1000
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
lea eax, [esp + 0x18]
push str.device_not_found
push eax
call fcn.00430890
add esp, 8
test eax, eax
je 0x40dc24
push 0x1000
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00433570
add esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
mov ecx, eax
sub edx, ecx
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x40dc30
mov ecx, dword [esp + 0x1018]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fb8f
add esp, 0x1010
ret 4

Function at 0x40dc60
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov eax, 0x1014
call fcn.00435100
mov eax, dword [0x457a00]
xor eax, esp
mov dword [esp + 0x1010], eax
mov eax, dword [esp + 0x1018]
push ebx
push ebp
push esi
push 0xfff
lea ecx, [esp + 0x1d]
push 0
push ecx
mov dword [esp + 0x20], eax
mov byte [esp + 0x24], 0
call fcn.00433570
mov ebx, dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
xor esi, esi
lea ecx, [ecx]
mov ecx, dword [edi + 0x5c]
push 0
push 0
lea edx, [esp + 0x14]
push edx
push 0x1000
lea eax, [esp + 0x28]
push eax
push ecx
call ebx
push 0x1000
lea edx, [esp + 0x1c]
push 0
push edx
mov dword [esp + 0x1c], eax
call fcn.00433570
add esp, 0xc
cmp dword [esp + 0xc], 0
mov eax, str.dwRead_true_n
jne 0x40dcf2
mov eax, str.dwRead_false_n
push eax
call fcn.00401000
add esp, 4
cmp dword [esp + 0xc], 0
jne 0x40dd17
push 0x320
call ebp
add esi, 1
cmp esi, 0xa
jl 0x40dcb0
mov esi, dword [esp + 0x10]
jmp 0x40dd5e
mov edx, dword [edi + 0x5c]
push 0
lea eax, [esp + 0x10]
push eax
push 0x1000
lea ecx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov esi, eax
lea eax, [esp + 0x18]
push str.device_not_found
push eax
call fcn.00430890
add esp, 8
test eax, eax
je 0x40dd5e
push 0x1000
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00433570
add esp, 0xc
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x18]
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
add eax, 1
test cl, cl
jne 0x40dd70
mov ecx, dword [esp + 0x101c]
mov eax, esi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042fb8f
add esp, 0x1014
ret 4
Function at 0x40dda0
Capabilities:
Create a process with modified i/o handles and window
Create process on windows

Disassembly:
sub esp, 0x404
mov eax, dword [0x457a00]
xor eax, esp
mov dword [esp + 0x400], eax
push edi
push 0x3ff
lea eax, [esp + 9]
push 0
push eax
mov edi, ecx
mov byte [esp + 0x10], 0
call fcn.00433570
push edi
lea ecx, [esp + 0x14]
push 0x44f358
push ecx
call fcn.00430b35
xor eax, eax
mov dword [esi], eax
push 0x44
mov dword [esi + 4], eax
push eax
lea edi, [esi + 0x10]
mov dword [esi + 8], eax
push edi
mov dword [esi + 0xc], eax
call fcn.00433570
add esp, 0x24
push edi
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esi + 0x60]
mov edx, dword [esi + 0x54]
push esi
push edi
push 0
push 0
push 0x30
push 1
push 0
mov dword [esi + 0x50], eax
mov dword [esi + 0x4c], eax
push 0
lea eax, [esp + 0x24]
push eax
push 0
mov dword [edi], 0x44
mov dword [esi + 0x48], edx
mov dword [esi + 0x3c], 0x101
mov word [esi + 0x40], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [esp + 0x404]
pop edi
xor ecx, esp
call fcn.0042fb8f
add esp, 0x404
ret

Function at 0x40de60
Capabilities:
Create pipe
Create two anonymous pipes

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreatePipe]
push esi
push edi
mov esi, eax
push 0
lea eax, [esp + 0x10]
push eax
lea ecx, [esi + 0x60]
push ecx
lea edi, [esi + 0x5c]
push edi
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0
call ebx
test eax, eax
jne 0x40dea5
pop edi
pop esi
or eax, 0xffffffff
pop ebx
add esp, 0xc
ret
mov edx, dword [edi]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push 0
push 1
push edx
call ebp
test eax, eax
jne 0x40dec6
pop ebp
pop edi
pop esi
mov eax, 0xfffffffe
pop ebx
add esp, 0xc
ret
push 0
lea eax, [esp + 0x14]
push eax
lea edi, [esi + 0x58]
push edi
add esi, 0x54
push esi
call ebx
test eax, eax
jne 0x40dee8
pop ebp
pop edi
pop esi
mov eax, 0xfffffffd
pop ebx
add esp, 0xc
ret
mov ecx, dword [edi]
push 0
push 1
push ecx
call ebp
neg eax
pop ebp
sbb eax, eax
pop edi
and eax, 5
pop esi
add eax, 0xfffffffc
pop ebx
add esp, 0xc
ret
Function at 0x415250
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x415269
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4152a4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4152a0
lea ebx, [ebx]
cmp esi, eax
jae 0x4152a4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x415290
cmp esi, eax
jb 0x4152aa
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x421280
Capabilities:
Get disk information

Disassembly:
sub esp, 0xa0
mov eax, dword [0x457a00]
xor eax, esp
mov dword [esp + 0x9c], eax
mov eax, dword [esp + 0xa8]
push ebx
push esi
push 0x7f
mov ebx, ecx
xor esi, esi
lea ecx, [esp + 0x29]
push esi
push ecx
mov dword [esp + 0x1c], eax
mov byte [esp + 0x30], 0
call fcn.00433570
add esp, 0xc
xor eax, eax
lea edx, [esp + 0x24]
push edx
push 0x80
mov byte [esp + 0x1c], 0
mov dword [esp + 0x1d], eax
mov dword [esp + 0x21], eax
mov dword [esp + 0x25], eax
mov word [esp + 0x29], ax
mov byte [esp + 0x2b], al
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
jne 0x421307
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0042fb8f
add esp, 0xa0
ret
push ebp
push edi
mov dword [esp + 0x10], esi
lea ebp, [esp + 0x2c]
add ebx, 0x28
mov eax, dword [esp + 0xb4]
cmp eax, 0x20
jb 0x421325
mov eax, 0x20
cmp dword [esp + 0x10], eax
jae 0x42143f
cmp byte [ebp], 0
je 0x42143f
mov edi, 0x450b60
mov esi, ebp
mov ecx, 4
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x421350
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jl 0x421432
mov eax, ebp
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x421360
sub eax, edx
add eax, 1
push eax
lea esi, [ebx - 0x28]
push ebp
push esi
call fcn.0043dca0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push esi
mov dword [ebx + 0x20], eax
lea eax, [esp + 0x20]
push str.._s
push eax
call fcn.00430b35
lea eax, [esp + 0x28]
add esp, 0xc
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4213a0
push 0
push 0
push 3
push 0
sub eax, esi
push 3
mov byte [esp + eax + 0x2f], cl
push 0x80000000
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x421415
xor eax, eax
mov dword [ebx - 0x20], eax
mov dword [ebx - 0x1c], eax
mov dword [ebx - 0x18], eax
mov dword [ebx - 0x14], eax
mov dword [ebx - 0x10], eax
mov dword [ebx - 0xc], eax
mov dword [ebx - 8], eax
mov dword [ebx - 4], eax
mov dword [ebx], eax
mov dword [ebx + 4], eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov dword [ebx + 0x10], eax
mov dword [ebx + 0x14], eax
mov dword [ebx + 0x18], eax
push esi
mov dword [ebx + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add dword [esp + 0x10], 1
add ebp, 4
jmp 0x421314
lea edx, [ebx - 0x20]
push edx
mov ecx, esi
call fcn.00421000
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add dword [esp + 0x14], 1
add ebx, 0x4c
add dword [esp + 0x10], 1
add ebp, 4
jmp 0x421314
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
pop edi
pop ebp
mov dword [ecx], eax
mov ecx, dword [esp + 0xa4]
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0042fb8f
add esp, 0xa0
ret
Function at 0x422220
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov bl, 1
call edi
mov dword [esi + 0x150], eax
mov ecx, esi
call fcn.00421cf0
test al, al
jne 0x422254
call edi
sub eax, dword [esi + 0x150]
cmp eax, dword [esi + 8]
jbe 0x422232
xor eax, eax
test bl, bl
pop edi
sete al
pop ebx
ret
xor bl, bl
xor eax, eax
test bl, bl
pop edi
sete al
pop ebx
ret
Function at 0x422260
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, eax
xor eax, eax
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov eax, dword [esi + 0x2c]
push 0xf
xor ebx, ebx
push eax
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
test eax, eax
jne 0x4222e6
push 0x100
lea edi, [esi + 0x50]
push ebx
push edi
call fcn.00433570
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_flush_comm_port.
push str._s_System_Code:_d
push edi
call fcn.00430b35
mov eax, dword [esi + 0x2c]
add esp, 0x10
cmp eax, ebx
mov dword [esi + 0x298], 1
je 0x4222db
cmp eax, 0xffffffff
je 0x4222db
call fcn.00422ef0
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 8
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
cmp eax, ebx
mov dword [esp + 0x20], eax
jne 0x422330
push 0x100
add esi, 0x50
push ebx
push esi
call fcn.00433570
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_create_write_event.
push str._s_System_Code:_d
push esi
call fcn.00430b35
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 8
mov eax, dword [esp + 0x2c]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x2c]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 0x2c]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x422447
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x3e5
je 0x4223d6
push ebp
push 0x100
lea ebp, [esi + 0x50]
push ebx
push ebp
call fcn.00433570
add esp, 0xc
call edi
push eax
push str.its_not_ERROR_IO_PENDING_error.
push str._s_System_Code:_d
push ebp
call fcn.00430b35
add esp, 0x10
pop ebp
mov ecx, dword [esi + 0x2c]
push ebx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x42243a
push 0x100
add esi, 0x50
push ebx
push esi
call fcn.00433570
add esp, 0xc
call edi
push eax
push str.write_operation_is_not_completed
push str._s_System_Code:_d
push esi
call fcn.00430b35
add esp, 0x10
jmp 0x422449
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x20]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, ebx
je 0x42238f
push 0x100
add esi, 0x50
cmp eax, 0x102
push ebx
push esi
je 0x42241a
call fcn.00433570
add esp, 0xc
call edi
push eax
push str.An_error_has_occurred_in_WaitForSingleObject.__t_t_t_t_tThis_usually_indicates_a_problem_with_the_OVERLAPPED_structures_event_handle.
push str._s_System_Code:_d
push esi
call fcn.00430b35
add esp, 0x10
jmp 0x422449
call fcn.00433570
add esp, 0xc
call edi
push eax
push str.write_operation_is_timeout.
push str._s_System_Code:_d
push esi
call fcn.00430b35
add esp, 0x10
jmp 0x422449
mov edx, dword [esp + 0x2c]
cmp dword [esp + 0xc], edx
sete bl
jmp 0x422449
mov bl, 1
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
add esp, 0x18
ret 8
Function at 0x422460
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
push edi
mov esi, ecx
mov edi, eax
mov eax, dword [esi + 0x2c]
push 0xf
push eax
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_PurgeComm]
test eax, eax
jne 0x4224ce
push 0x100
push eax
lea edi, [esi + 0x50]
push edi
call fcn.00433570
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_flush_comm_port.
push str._s_System_Code:_d
push edi
call fcn.00430b35
mov eax, dword [esi + 0x2c]
add esp, 0x10
test eax, eax
mov dword [esi + 0x298], 1
je 0x4224c6
cmp eax, 0xffffffff
je 0x4224c6
call fcn.00422ef0
pop edi
xor al, al
pop esi
pop ecx
ret 4
mov edx, dword [esp + 0x10]
mov eax, dword [esi + 0x2c]
push 0
lea ecx, [esp + 0xc]
push ecx
push edi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
setne cl
cmp dword [esp + 8], edi
pop edi
sete al
and al, cl
pop esi
pop ecx
ret 4

Function at 0x422500
Capabilities:
Read file on windows

Disassembly:
mov ecx, dword [edi + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push 0
lea eax, [esp + 0x10]
push eax
push esi
push ebp
push ecx
mov dword [esp + 0x20], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, eax
mov eax, dword [esp + 0xc]
xor edx, edx
cmp esi, eax
sete dl
and ebx, edx
je 0x422549
mov ecx, dword [esp + 0x10]
mov dword [ecx], eax
mov ecx, dword [edi + 0x180]
test ecx, ecx
je 0x422549
push eax
push ebp
call ecx
add esp, 8
xor eax, eax
test ebx, ebx
pop ebp
setne al
pop ebx
ret 8
Function at 0x422560
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
push ebp
mov ebp, dword [esp + 0x1c]
push esi
push edi
push 0
mov edi, eax
mov ecx, dword [edi + 0x2c]
lea eax, [esp + 0x28]
push eax
push 1
push ebx
push ecx
mov dword [esp + 0x38], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x24]
xor edx, edx
cmp ecx, 1
sete dl
and eax, edx
je 0x422613
mov eax, dword [edi + 0x180]
test eax, eax
mov dword [ebp], ecx
je 0x4225ac
push ecx
push ebx
call eax
add esp, 8
cmp dword [ebp], 1
jne 0x422613
mov esi, dword [esp + 0x20]
cmp esi, 1
mov byte [esp + 0x24], 1
jle 0x42268f
mov edx, dword [edi + 0x2c]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x10]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ClearCommError]
test eax, eax
jne 0x422635
push 0x100
push eax
lea esi, [edi + 0x50]
push esi
call fcn.00433570
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_get_comm_stat.
push str._s_System_Code:_d
push esi
call fcn.00430b35
add esp, 0x10
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x10
ret 8
mov ecx, dword [esp + 0x20]
push ecx
push 0
push ebx
mov byte [esp + 0x30], 0
call fcn.00433570
mov al, byte [esp + 0x30]
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x10
ret 8
lea eax, [esi - 1]
mov esi, dword [esp + 0x14]
cmp esi, eax
jl 0x422642
mov esi, eax
test esi, esi
jle 0x42268b
push ebp
lea eax, [ebx + 1]
push eax
call fcn.00422500
test al, al
je 0x42265e
cmp dword [ebp], esi
mov byte [esp + 0x24], 1
je 0x422663
mov byte [esp + 0x24], 0
add dword [ebp], 1
cmp byte [esp + 0x24], 0
jne 0x42268b
mov ecx, dword [esp + 0x20]
push ecx
push 0
push ebx
call fcn.00433570
mov al, byte [esp + 0x30]
add esp, 0xc
pop edi
pop esi
pop ebp
add esp, 0x10
ret 8
mov esi, dword [esp + 0x20]
mov ebp, dword [ebp]
cmp esi, ebp
jle 0x42269a
mov byte [ebx + ebp], 0
mov al, byte [esp + 0x24]
pop edi
pop esi
pop ebp
add esp, 0x10
ret 8
Function at 0x422840
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, eax
xor eax, eax
cmp byte [esi + 0x14], al
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov bl, 1
je 0x4228af
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x4228b9
push 0x100
push eax
add esi, 0x50
push esi
call fcn.00433570
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.fail_to_create_write_event.
push str._s_System_Code:_d
push esi
call fcn.00430b35
add esp, 0x10
pop esi
xor al, al
pop ebx
add esp, 0x18
ret 0xc
mov edx, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x28]
lea eax, [esp + 0x10]
push eax
mov eax, dword [esi + 0x2c]
lea ecx, [esp + 0x10]
push ecx
push edx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x42290b
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
cmp eax, 0x3e5
je 0x422924
push 0x100
add esi, 0x50
push 0
push esi
call fcn.00433570
add esp, 0xc
call edi
push eax
push str.its_not_ERROR_IO_PENDING_error.
jmp 0x4229a1
mov esi, dword [esi + 0x180]
test esi, esi
je 0x4229cc
mov ecx, dword [esp + 0xc]
push ecx
push edi
jmp 0x4229c7
mov edx, dword [esi + 0x10]
mov eax, dword [esp + 0x20]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x42296d
push 0x100
add esi, 0x50
cmp eax, 0x102
push 0
push esi
je 0x42295b
call fcn.00433570
add esp, 0xc
call edi
push eax
push str.An_error_has_occurred_in_WaitForSingleObject.__t_t_t_t_tThis_usually_indicates_a_problem_with_the_OVERLAPPED_structures_event_handle.
jmp 0x4229a1
call fcn.00433570
add esp, 0xc
call edi
push eax
push str.read_operation_is_timeout.
jmp 0x4229a1
mov eax, dword [esi + 0x2c]
push 0
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x4229b3
push 0x100
push eax
add esi, 0x50
push esi
call fcn.00433570
add esp, 0xc
call edi
push eax
push str.error_in_read_form_rs232.
push str._s_System_Code:_d
push esi
call fcn.00430b35
add esp, 0x10
xor bl, bl
jmp 0x4229cc
mov esi, dword [esi + 0x180]
test esi, esi
je 0x4229cc
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x28]
push ecx
push edx
call esi
add esp, 8
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 0x30]
pop edi
pop esi
mov al, bl
mov dword [edx], ecx
pop ebx
add esp, 0x18
ret 0xc
Function at 0x422af0
Capabilities:
Print debug messages

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
xor esi, esi
push 0x1000
push esi
push 0x45c238
mov edi, eax
mov dword [esp + 0x1c], esi
lea ebp, [esi + 3]
call fcn.00433570
add esp, 0xc
cmp byte [edi + 0x16], 0
lea eax, [esp + 0x10]
je 0x422b2f
push eax
push 0x45c238
mov eax, 0x1000
call fcn.00422770
jmp 0x422b5b
mov ecx, 0x1000
sub ecx, esi
cmp byte [edi + 0x15], 0
je 0x422b4c
push ecx
lea edx, [esi + 0x45c238]
push edx
push edi
call fcn.004229f0
jmp 0x422b5b
push eax
push ecx
lea ebx, [esi + 0x45c238]
mov eax, edi
call fcn.00422560
mov esi, dword [esp + 0x10]
mov bl, al
and bl, 1
test esi, esi
jle 0x422b6f
push str.iRead___0_r_n
jmp 0x422b74
push str.iRead__0_r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
test esi, esi
je 0x422b82
test bl, bl
jne 0x422b8b
mov edx, ebp
sub ebp, 1
test edx, edx
jge 0x422b13
test bl, bl
mov dword [0x45c234], esi
je 0x422ba1
test esi, esi
je 0x422ba1
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push edi
xor bl, bl
call fcn.004226b0
test al, al
mov al, bl
jne 0x422bb9
mov dword [edi + 0x298], 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret