joyce8/EMBER2024-capa huggingface dataset:
Function at 0xf38986
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ch, 0x2d
xchg bp, ax
neg ebp
mov byte [esp], bl
add esp, 0
jmp 0xf389fa
mov edx, 0xfc8f3200
pop eax
rol edi, cl
lea esp, [esp]
jmp 0xf38970
pop edx
xchg dword [esp + 4], edi
mov byte [esp + 4], bl
mov dx, word [esp + 0xd]
jmp 0xf38aea
cmp ah, ch
mov ebp, dword [esp + 6]
neg ax
mov dl, byte [esp + 0xa]
dec ax
pushfd
jmp 0xf389be
push word [esp + 1]
pop edx
lea edi, reloc.gdiplus.dll_GdipAlloc
mov ebp, 0xc92a5732
sub esp, 0x13
bts edi, ecx
jmp 0xf389d4
not ebx
mov bp, 0x9f54
mov edi, 0xe6d23b04
xchg dh, dl
lea edi, reloc.gdiplus.dll_GdipAlloc
xchg cl, ah
jmp 0xf38a69
xchg word [esp + 1], cx
mov dword [esp], edi
inc si
mov di, sp
bsr ebp, ebx
xchg edi, esi
jmp 0xf38a13
inc dl
sub esp, 0x13
pop dword [esp + 0x11]
mov esi, 0x911bcefb
jmp 0xf38abc
mov byte [esp + 5], dl
mov dh, 0xaf
neg edi
shr ecx, 0x1a
not ah
xchg esi, ecx
jmp 0xf38a53
bts dx, bp
lea esp, [esp + 0xe]
pop word [esp + 1]
lea esi, [ebp - 0xdc]
clc
not bp
jmp 0xf38a3f
not si
pop word [esp + 8]
mov edx, 0x4c8d3d1d
not cx
jmp 0xf38ad1
cmp edi, 0xfb6012b1
xchg dh, ch
mov si, sp
mov dword [esp + 0xa], edx
bswap ecx
pop si
jmp 0xf38aa6
push word [esp + 0xc]
mov byte [esp + 0xd], bl
rcl bp, 0xa
mov ax, si
jmp 0xf38b1b
mov edi, 0x213d2af
mov ecx, dword [esp + 0xf]
mov bl, byte [esp + 8]
push dword [esp + 6]
mov edi, dword [esp + 0x14]
xchg dword [esp + 0xf], ecx
jmp 0xf38a8d
lea edx, [ebx - 9]
mov bp, word [esp + 0xe]
mov ah, bl
and cx, 0x4c91
jmp 0xf38b5a
mov word [esp + 0xf], di
mov word [esp + 1], bp
lea ebx, [edi*4]
not edx
mov byte [esp + 0xc], bl
lea edi, [ecx*4]
jmp 0xf38b05
pop bp
xchg cl, dl
btc di, sp
lea ecx, [ecx*4]
mov cl, byte [esp + 0xb]
rdtsc
jmp 0xf38d29
push word [esp]
mov byte [esp + 1], dl
cld
mov word [esp + 2], bp
xchg byte [esp + 0xd], al
pop ebx
jmp 0xf38c37
push word [esp + 6]
bswap esi
mov word [esp + 2], ax
shl edi, 3
push word [esp + 2]
lea edx, [eax + ecx]
jmp 0xf38b96
shl edx, cl
mov dword [esp + 3], edx
mov dword [esp + 1], ecx
not esi
mov ecx, edi
xchg dl, al
jmp 0xf38c19
push dword [esp + 1]
lea ecx, reloc.gdiplus.dll_GdipAlloc
xchg byte [esp + 3], cl
cld
pop word [esp + 2]
mov bl, ah
jmp 0xf38bd5
mov word [esp + 3], bp
xchg di, ax
call fcn.00f38c03
stosd dword es:[edi], eax
cmp ebp, dword [ebx - reloc.gdiplus.dll_GdipAlloc]
sbb al, 0xb2
aad 0x24
invalid
btr si, sp
rdtsc
lea ecx, [esp - 0xe3]
mov word [esp + 9], di
mov dword [esp + 6], esp
pop word [esp + 6]
jmp 0xf38beb
sbb ah, 0x31
std
lea esp, [esp + 0x1a]
bsr edi, edi
xchg byte [esp + 3], ah
mov byte [esp + 6], bh
jmp 0xf38bbc
xchg byte [esp + 0xb], bh
mov cl, 0x3f
mov dl, al
pop word [esp + 2]
sub esp, 0x14
lea esi, [esi + 0x5c]
jmp 0xf38ca7

Function at 0xf38d66
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00f3801c
mov word [esp], sp
mov dword [esp + 0x1c], edi
lea esp, [esp + 0x1c]
jmp 0xf38ddf
push eax
jmp 0xf38017
mov eax, dword [eax]
mov eax, dword [eax + 8]
jmp 0xf38daf
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xf38dc5
Function at 0x402260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x484203
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov dword [esi], vtable.CMenu.0
mov dword [esi + 4], edi
lea ebx, [esi + 8]
mov dword [esp + 0x18], edi
mov ecx, ebx
call fcn.004638d4
mov dword [ebx], method.CPtrArray.virtual_0
lea ebx, [esi + 0x1c]
mov byte [esp + 0x18], 1
mov ecx, ebx
call fcn.004638d4
or eax, 0xffffffff
push 0x4d20b8
mov dword [ebx], method.CPtrArray.virtual_0
push edi
mov dword [esi], 0x48bd9c
mov dword [esi + 0x54], edi
mov dword [esi + 0x40], edi
mov dword [esi + 0x30], 0x10
mov dword [esi + 0x34], 0xf
mov dword [esi + 0x4c], eax
mov dword [esi + 0x50], eax
mov dword [esi + 0x44], edi
mov dword [esi + 0x48], edi
mov dword [esi + 0x38], 0xc0c0c0
mov dword [esi + 0x3c], edi
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x58], edi
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x406050
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x484730
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push ebp
xor eax, eax
push esi
push edi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], vtable.CPen.0
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x28], eax
push ecx
push eax
push eax
call dword [sym.imp.GDI32.dll_CreatePen]
push eax
lea ecx, [esp + 0x14]
call fcn.0046cce7
mov esi, dword [esp + 0x30]
lea edx, [esp + 0x10]
push edx
mov ecx, esi
call fcn.0046c3c3
mov edi, dword [esp + 0x38]
mov ebx, dword [esp + 0x34]
mov dword [esp + 0x3c], eax
mov ecx, esi
lea eax, [edi + 2]
push eax
lea eax, [esp + 0x1c]
push ebx
push eax
call fcn.0046c7c3
lea eax, [edi + 5]
mov ecx, esi
push eax
push ebx
call fcn.0046c80f
lea ebp, [edi + 3]
lea eax, [ebx + 1]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.0046c7c3
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 1]
push eax
call fcn.0046c80f
lea eax, [edi + 4]
lea ecx, [ebx + 2]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.0046c7c3
lea eax, [edi + 7]
mov ecx, esi
push eax
lea eax, [ebx + 2]
push eax
call fcn.0046c80f
lea eax, [ebx + 3]
push ebp
lea ecx, [esp + 0x1c]
push eax
push ecx
mov ecx, esi
call fcn.0046c7c3
lea eax, [edi + 6]
mov ecx, esi
push eax
lea eax, [ebx + 3]
push eax
call fcn.0046c80f
lea eax, [edi + 2]
lea ecx, [ebx + 4]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
mov ecx, esi
call fcn.0046c7c3
lea eax, [edi + 5]
mov ecx, esi
push eax
lea eax, [ebx + 4]
push eax
call fcn.0046c80f
lea ecx, [edi + 1]
lea eax, [ebx + 5]
push ecx
lea edx, [esp + 0x1c]
push eax
push edx
mov ecx, esi
call fcn.0046c7c3
lea eax, [edi + 4]
mov ecx, esi
push eax
lea eax, [ebx + 5]
push eax
call fcn.0046c80f
add ebx, 6
push edi
lea eax, [esp + 0x1c]
push ebx
push eax
mov ecx, esi
call fcn.0046c7c3
push ebp
push ebx
mov ecx, esi
call fcn.0046c80f
mov ecx, dword [esp + 0x3c]
push ecx
mov ecx, esi
invalid
Function at 0x406900
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x4847b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x24]
call fcn.0046c178
mov edi, dword [esp + 0x7c]
lea eax, [esp + 0x54]
push eax
xor ebx, ebx
mov ecx, dword [edi + 4]
push 0x18
push ecx
mov dword [esp + 0x80], ebx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov esi, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push ebx
call esi
push eax
lea ecx, [esp + 0x28]
call fcn.0046c22f
cmp edi, ebx
jne 0x40695e
xor eax, eax
jmp 0x406961
mov eax, dword [edi + 4]
mov edx, dword [esp + 0x28]
push eax
push edx
call fcn.0046c370
mov ebp, eax
lea ecx, [esp + 0x34]
mov dword [esp + 0x10], ebp
call fcn.0046c178
lea ecx, [esp + 0x14]
call fcn.00405170
mov dword [esp + 0x14], vtable.CBrush.0
lea ecx, [esp + 0x1c]
call fcn.00405170
mov dword [esp + 0x1c], 0x48bdc8
push ebx
mov byte [esp + 0x78], 3
call esi
push eax
lea ecx, [esp + 0x38]
call fcn.0046c22f
mov eax, dword [esp + 0x5c]
mov ecx, dword [esp + 0x58]
mov edx, dword [esp + 0x28]
push eax
push ecx
push edx
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
push eax
lea ecx, [esp + 0x20]
call fcn.0046cce7
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x18]
call fcn.0046cce7
mov esi, dword [esp + 0x20]
lea eax, [esp + 0x1c]
neg eax
sbb eax, eax
and eax, esi
push eax
mov eax, dword [esp + 0x3c]
push eax
call fcn.0046c370
mov edi, dword [esp + 0x18]
mov esi, eax
mov ecx, dword [esp + 0x58]
lea eax, [esp + 0x14]
neg eax
mov edx, dword [esp + 0x5c]
mov dword [esp + 0x4c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x44], ebx
sbb eax, eax
mov dword [esp + 0x48], ebx
and eax, edi
mov dword [esp + 0x50], edx
push eax
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
mov edx, dword [esp + 0x38]
mov ebx, dword [sym.imp.GDI32.dll_GetPixel]
push 1
push 1
push edx
call ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x7c], eax
call fcn.0046cd3e
test esi, esi
je 0x406a5e
mov esi, dword [esi + 4]
mov eax, dword [esp + 0x38]
push esi
push eax
call fcn.0046c370
mov eax, dword [esp + 0x58]
xor edi, edi
test eax, eax
jle 0x406ac5
mov ebp, dword [sym.imp.GDI32.dll_SetPixel]
mov eax, dword [esp + 0x5c]
xor esi, esi
test eax, eax
jle 0x406ab8
mov ecx, dword [esp + 0x28]
push esi
push edi
push ecx
call ebx
cmp eax, dword [esp + 0x7c]
je 0x406aaf
push 0x3fd33333
push 0x33333333
push eax
call fcn.004032d0
mov edx, dword [esp + 0x34]
add esp, 0xc
push eax
push esi
push edi
push edx
call ebp
mov eax, dword [esp + 0x5c]
inc esi
cmp esi, eax
jl 0x406a83
mov ecx, dword [esp + 0x58]
inc edi
cmp edi, ecx
jl 0x406a7d
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x406acd
xor eax, eax
jmp 0x406ad0
mov eax, dword [ebp + 4]
push eax
mov eax, dword [esp + 0x2c]
push eax
call fcn.0046c370
mov esi, vtable.CGdiObject.0
mov dword [esp + 0x1c], esi
lea ecx, [esp + 0x1c]
mov byte [esp + 0x74], 4
call fcn.0046cd3e
mov dword [esp + 0x14], esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x74], 5
Function at 0x4070d0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x484860
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
mov eax, esi
mov ebp, ecx
push edi
xor edi, edi
mov ecx, dword [eax]
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], vtable.CBrush.0
mov edx, dword [eax + 4]
mov dword [esp + 0x1c], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x20], ecx
mov edx, dword [eax + 0xc]
mov dword [esp + 0x24], edx
mov dword [esp + 0x30], edi
call fcn.004023b0
test eax, eax
je 0x40712e
push 0xf
jmp 0x407130
push 4
mov ebx, dword [sym.imp.USER32.dll_GetSysColor]
call ebx
cmp dword [esp + 0x40], edi
jne 0x407151
push 0x3fe33333
push 0x33333333
push eax
call fcn.004032d0
add esp, 0xc
push eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push eax
lea ecx, [esp + 0x14]
call fcn.0046cce7
mov edi, dword [esp + 0x14]
lea eax, [esp + 0x10]
neg eax
sbb eax, eax
and eax, edi
mov edi, dword [esp + 0x38]
push eax
lea eax, [esp + 0x1c]
mov ecx, dword [edi + 4]
push eax
push ecx
call dword [sym.imp.USER32.dll_FillRect]
lea ecx, [esp + 0x10]
call fcn.0046cd3e
call fcn.004023a0
test eax, eax
je 0x4071a9
mov eax, dword [edi + 4]
push 0xf
lea edx, [esp + 0x1c]
push 2
push edx
push eax
call dword [sym.imp.USER32.dll_DrawEdge]
mov eax, dword [esp + 0x44]
push 7
test eax, eax
jne 0x4071cd
call ebx
mov ecx, dword [esi + 4]
mov edx, dword [esi]
add ecx, 4
push eax
add edx, 4
push ecx
push edx
push edi
mov ecx, ebp
call fcn.00406050
jmp 0x4071e5
call ebx
mov ecx, dword [esi]
push eax
mov eax, dword [esi + 4]
add ecx, 5
add eax, 4
push eax
push ecx
push edi
mov ecx, ebp
call fcn.00405f30
mov dword [esp + 0x10], vtable.CGdiObject.0
lea ecx, [esp + 0x10]
mov dword [esp + 0x30], 1
call fcn.0046cd3e
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 0x10

Function at 0x4077e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0047ed5b
mov edi, dword [esp + 0x14]
mov ebx, dword [eax + 0xc]
mov ebp, dword [sym.imp.KERNEL32.dll_FindResourceA]
and edi, 0xffff
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x40781b
xor ebx, ebx
push 2
push edi
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x40781b
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40782c
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x40783c
pop edi
pop esi
pop ebp
pop ebx
ret
push eax
call fcn.004077a0
add esp, 4
cmp ax, 0x10
je 0x407852
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push 0
push esi
push ebx
invalid
invalid
xchg edi, eax
Function at 0x407950
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [0x4d20d8]
sub esp, 0x134
test eax, eax
jne 0x407a25
lea eax, [esp]
mov dword [0x4d20d8], 1
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftPlus_ThemesCurrent
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407a25
push esi
lea ecx, [esp + 0xc]
push edi
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push ecx
mov dword [esp + 0x28], 0x104
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407a18
mov ecx, 5
mov esi, str.Windows_Classic.theme
lea edi, [esp + 0x14]
lea edx, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edx
call edi
mov esi, eax
lea eax, [esp + 0x14]
push eax
call edi
cmp esi, eax
jl 0x407a18
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
call edi
sub esi, eax
lea eax, [esp + esi + 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x407a18
mov dword [0x4d20d4], 1
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, dword [0x4d20d4]
add esp, 0x134
ret

Function at 0x407eb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, ecx
call fcn.0047ed5b
mov ebp, dword [esp + 0x14]
mov esi, dword [eax + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_FindResourceA]
push 0xf1
push ebp
push esi
call ebx
test eax, eax
jne 0x407eeb
xor esi, esi
push 0xf1
push ebp
push esi
call ebx
test eax, eax
jne 0x407eeb
pop edi
pop esi
pop ebp
pop ebx
ret 4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x407efe
pop edi
pop esi
pop ebp
pop ebx
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x407f12
pop edi
pop esi
xor eax, eax
mov ax, word [esi + 6]
shl eax, 2
push eax
call fcn.0046987b
xor edx, edx
add esp, 4
cmp word [esi + 6], dx
mov ebp, eax
jbe 0x407f4b
mov ecx, ebp
lea eax, [esi + 8]
xor ebx, ebx
inc edx
mov bx, word [eax]
add eax, 2
mov dword [ecx], ebx
xor ebx, ebx
mov bx, word [esi + 6]
add ecx, 4
cmp edx, ebx
jl 0x407f33
xor ecx, ecx
mov cx, word [esi + 6]
push ecx
push ebp
mov ecx, edi
call fcn.0047f7b2
push ebp
mov ebx, eax
call fcn.004698a4
add esp, 4
test ebx, ebx
je 0x407fac
xor ecx, ecx
xor eax, eax
mov cx, word [esi + 4]
mov ax, word [esi + 2]
push ecx
push eax
lea ebx, [ecx + 7]
lea edx, [eax + 7]
push ebx
push edx
mov ecx, edi
call fcn.0047f57b
mov ecx, dword [esp + 0x14]
xor edx, edx
mov dx, word [esi + 2]
xor eax, eax
mov dword [edi + 0x9c], edx
mov ax, word [esi + 4]
push ecx
mov ecx, edi
mov dword [edi + 0xa0], eax
call fcn.00407fc0
mov ebx, eax
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
ret 4
Function at 0x40c170
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x484d38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
push ebx
mov eax, dword [esi + 0x204]
push ebx
push 0x1004
push eax
mov dword [esp + 0x34], esi
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
jle 0x40c351
add esi, 0x1e8
mov dword [esp + 0x18], esi
mov ecx, dword [0x4cdd70]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x18]
xor edi, edi
push edi
lea edx, [esp + 0x20]
push ebx
push edx
mov dword [esp + 0x3c], edi
call fcn.004628f0
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x34], 1
call fcn.0046937d
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 0
call fcn.00469244
mov esi, 0x4d20dc
mov eax, dword [esi]
push eax
mov eax, dword [esp + 0x10]
push eax
call fcn.00451105
add esp, 8
test eax, eax
je 0x40c227
add esi, 4
inc edi
cmp esi, 0x4d20f8
jl 0x40c205
jmp 0x40c22c
cmp edi, 7
jl 0x40c242
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00469244
jmp 0x40c32a
xor esi, esi
mov ecx, dword [esp + 0x10]
lea ebx, [esi + 1]
push ebx
lea edx, [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x20]
push edx
call fcn.004628f0
mov eax, dword [eax]
push 0
push eax
call fcn.00451435
mov eax, dword [edi*4 + 0x48ca80]
mov edx, dword [ebp + 8]
add esp, 8
lea eax, [eax + eax*2]
lea ecx, [esi + eax*2]
fstp qword [edx + ecx*8 + 0x138]
lea ecx, [esp + 0x20]
call fcn.00469244
mov eax, dword [edi*4 + 0x48ca80]
lea ecx, [eax + eax*2]
lea edx, [esi + ecx*2]
lea ecx, [eax + eax*2]
mov eax, dword [ebp + 8]
shl ecx, 4
fld qword [eax + edx*8 + 0x138]
fsub qword [ecx + eax + 0x138]
fabs
fcomp qword [0x48d1f0]
fnstsw ax
test ah, 0x41
jne 0x40c30a
mov edx, dword [0x4cdd70]
mov dword [esp + 0x14], edx
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x14]
push eax
push str.WCDMA__s_points_LOSS_D_Value_is_big_than_0.3db__do_you_want_go_on_
push ecx
mov byte [esp + 0x3c], 2
call fcn.00461dbf
add byte [ebx - 0x7cdfdbac], cl
les ecx, [edx + ebp*2]
add byte [eax + 0x34], ch
add byte [eax + eax], al
push edx
call fcn.00473235
cmp eax, 7
je 0x40c36a
cmp eax, 2
je 0x40c36a
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.00469244
mov esi, ebx
cmp esi, 6
jl 0x40c244
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00469244
mov ebx, dword [esp + 0x10]
mov eax, dword [esp + 0x24]
push 0
push 0
inc ebx
mov ecx, dword [eax + 0x204]
push 0x1004
add al, 0x10
add byte [eax], al
push ecx
mov dword [esp + 0x20], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
cmp ebx, eax
jl 0x40c1c3
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov edx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
push 3
push 3
push edx
mov ecx, esi
call fcn.0046289a
mov ecx, esi
call fcn.004689b3
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 0
call fcn.00469244
Function at 0x40d950
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x41c
mov eax, dword [esp + 0x420]
push ebx
push ebp
xor ebp, ebp
mov ebx, ecx
cmp eax, ebp
mov dword [esp + 0x38], ebx
jne 0x40d978
pop ebp
xor eax, eax
pop ebx
add esp, 0x41c
ret 4
push esi
push edi
mov ecx, 0xf9
xor eax, eax
lea edi, [esp + 0x45]
mov byte [esp + 0x44], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x50
stosb byte es:[edi], al
call fcn.0046987b
add esp, 4
mov esi, eax
mov eax, dword [ebx + 0x174]
lea ecx, [esp + 0x44]
push eax
push 0x3e8
push ecx
push str.DeepSleep
push str.Test_Items
push str.Current_Test
mov dword [esp + 0x54], esi
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
lea eax, [esp + 0x44]
push edx
push 0x4c8444
push esi
push eax
call fcn.00414260
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], ebp
cmp eax, ebp
jle 0x40dcca
mov dword [esp + 0x10], esi

Function at 0x40dcf0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x484f78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
push 0x499
call fcn.004686a6
mov edx, dword [eax + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x18]
mov eax, dword [ebx + 0x78]
push 0
push 0
sub edi, esi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0x1037
push eax
sub edi, 4
call esi
mov ecx, dword [ebx + 0x78]
or al, 0x21
push eax
push 0
push 0x1036
push ecx
call esi
mov edx, dword [0x4cdd70]
mov dword [esp + 0xc], edx
mov eax, dword [ebx + 0x154]
mov dword [esp + 0x30], 0
test eax, eax
jg 0x40dda5
push 0
push 0
push str.Parse_current_test_xml_file_error
call fcn.00473235
lea ecx, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.00469244
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
invalid
Function at 0x410870
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x208
test edx, edx
push esi
push edi
je 0x410983
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 2
jl 0x410983
mov ecx, 0x40
lea edi, [esp + 9]
mov byte [esp + 8], al
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0xc]
push edx
push eax
call fcn.004512a7
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 7], 0x5c
jne 0x4108e5
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 7], al
lea ecx, [esp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x410909
test al, 0x10
je 0x410909
pop edi
mov eax, 1
pop esi
add esp, 0x208
ret 8
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea edx, [esp + 8]
push 0x5c
push edx
stosb byte es:[edi], al
call fcn.00451206
add esp, 8
test eax, eax
je 0x410983
lea ecx, [esp + 8]
lea edx, [esp + 8]
sub eax, ecx
push eax
lea eax, [esp + 0x110]
push edx
push eax
call fcn.004512a7
mov esi, dword [esp + 0x224]
add esp, 0xc
lea ecx, [esp + 0x10c]
push esi
push ecx
call fcn.00410870
test eax, eax
je 0x410983
lea edx, [esp + 8]
push esi
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
pop edi
pop esi
add esp, 0x208
ret 8
pop edi
xor eax, eax
pop esi
add esp, 0x208
ret 8

Function at 0x4119e0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov edi, 0x4d2204
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea ebx, [ebp + 0x334]
mov eax, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push 0xa
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4c8fc8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x4c8fc4
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push str.Burst_Count
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
call esi
push ebx
push 0xa
push 0x4c8fb4
push str.Burst_Count
mov dword [ebp + 0x94], eax
call esi
push ebx
push 0xa
push str.PFER
push str.Burst_Count
mov dword [ebp + 0x8c], eax
call esi
push ebx
push 3
push str.ORFS_MOD
push str.Burst_Count
mov dword [ebp + 0x88], eax
call esi
push ebx
push 3
push str.ORFS_SWIT
push str.Burst_Count
mov dword [ebp + 0xb8], eax
call esi
push ebx
push 0x9c4
push str.BERR
push str.Burst_Count
mov dword [ebp + 0xbc], eax
call esi
pop edi
mov dword [ebp + 0x74], eax
pop esi
pop ebp
pop ebx
ret