joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456878
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x456a23
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x456a04
mov dl, 1
mov eax, dword [0x415e14]
call fcn.0040324c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403fcc
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4569f3
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00444884
test al, al
je 0x4569e6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x456a34
lea eax, [ebp - 0x254]
call fcn.00409054
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4569e6
xor eax, eax
push ebp
push 0x4569df
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x456a6c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4569c8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040423c
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4569c8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.0040423c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4569e6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4568e9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004198f0
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x456a2a
lea eax, [ebp - 0x260]
call fcn.00403fcc
ret

Function at 0x457358
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45fbe0]
cmp byte [eax + 0xa5], 0
jne 0x4573c9
cmp dword [0x45fbf8], 0
jne 0x45738a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x457314
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45fbf8], eax
cmp dword [0x45fbf4], 0
jne 0x4573a5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45fbf4], eax
cmp dword [0x45fbfc], 0
jne 0x4573c9
push esp
push 0
push 0
push 0x4572b8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45fbfc], eax
pop edx
ret
Function at 0x4574c0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x4574d7
add esp, 0xfffffff0
call fcn.004035a0
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041d700
mov eax, dword [0x45e160]
cmp word [eax + 2], 0
jne 0x4574ff
mov eax, dword [0x45e160]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458b98
mov eax, dword [0x45e214]
cmp word [eax + 2], 0
jne 0x457519
mov eax, dword [0x45e214]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00458d90
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4159f8]
call fcn.0040324c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4159f8]
call fcn.0040324c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41fc3c]
call fcn.00426fb4
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x4576a0
mov eax, dword [0x45e080]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00427384
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x459330
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45e080]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c818
test eax, eax
je 0x45760e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408a34
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c840
test eax, eax
je 0x457622
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.0040423c
mov eax, dword [0x45df60]
cmp byte [eax], 0
jne 0x457656
mov eax, ebx
call fcn.004577c8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045950c
mov eax, ebx
call fcn.00459ed0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x457696
call fcn.004035f8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x457a48
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45fbe0]
cmp dword [eax + 0x30], 0
je 0x457af2
cmp dword [ebx + 0x94], 0
jne 0x457aec
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4579d8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x457aec
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x457ab2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x457aec
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417d60
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x457ac1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x458654
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x458689
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004040bc
jmp 0x458696
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404020
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4596e8
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x459729
mov eax, esi
call fcn.0043feb0
test al, al
je 0x459729
mov eax, dword [ebx + 0x84]
call fcn.0043fbac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x459729
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043fbac
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x402290
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x402376
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x402365
jg 0x4022d0
test edx, edx
je 0x402365
nop dword [eax]
call fcn.00405c60
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x402324
jg 0x4022e7
test esi, esi
je 0x402324
cmp ebx, eax
jg 0x4022f7
jl 0x4022f1
cmp edi, esi
jae 0x4022f7
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.00504830
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x402349
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x40235f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x4022d0
jl 0x40235f
test edi, edi
jne 0x4022d0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x402398
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x40239a
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x402418
jg 0x4023ad
test esi, esi
je 0x402418
test eax, eax
jl 0x4023fc
jg 0x4023b7
test ebx, ebx
je 0x4023fc
cmp edi, eax
jg 0x4023c7
jl 0x4023c1
cmp esi, ebx
jae 0x4023c7
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.00504830
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
sub esi, ebx
sbb edi, dword [esp + 0x14]
add edx, ebx
mov eax, dword [ecx + 0x30]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
test edi, edi
jl 0x402418
jg 0x4023ff
test esi, esi
je 0x402418
jmp 0x4023ff
mov edx, dword [ebp + 8]
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x402418
push eax
push esi
push 1
push edx
call fcn.00508133
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402430
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [esp + 0xc], edi
test eax, eax
jg 0x402462
jl 0x402455
test ecx, ecx
jne 0x402462
xor eax, eax
xor edx, edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x402522
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov ecx, ebx
call fcn.00405b20
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x4024ce
jg 0x40248d
test esi, esi
je 0x4024ce
mov ecx, dword [esp + 0xc]
cmp ecx, eax
jg 0x4024a5
mov eax, dword [esp + 0x10]
jl 0x40249f
cmp eax, esi
jae 0x4024a5
mov esi, eax
mov dword [esp + 0x14], ecx
mov eax, dword [ebx + 0x1c]
push esi
push dword [eax]
push edi
call fcn.00504830
mov eax, dword [ebx + 0x2c]
add esp, 0xc
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
sub ecx, esi
sbb edx, dword [esp + 0x14]
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
jmp 0x4024ef
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x1c]
mov edx, dword [esp + 0xc]
cmp eax, 0xffffffff
je 0x40250b
mov ecx, dword [esp + 0x10]
mov esi, 1
add ecx, 0xffffffff
mov byte [edi], al
adc edx, 0xffffffff
add edi, esi
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], ecx
test edx, edx
jg 0x402474
jl 0x40250b
test ecx, ecx
jne 0x402474
mov eax, dword [ebp + 0xc]
sub eax, dword [esp + 0x10]
mov ecx, dword [ebp + 0x10]
sbb ecx, edx
mov edx, ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
mov edi, ecx
mov edx, dword [eax]
test edx, edx
je 0x402561
mov eax, dword [ebx + 0x2c]
mov eax, dword [eax]
test eax, eax
je 0x402561
mov edi, dword [esp + 0xc]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push edx
push edi
call fcn.00504830
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [esp + 0x18], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
cmp dword [ebx + 0x4c], 0
mov ecx, edi
je 0x4025d0
mov esi, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [esi], eax
jne 0x402587
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [esi], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebx + 0x2c]
mov dword [eax], edx
mov esi, dword [esp + 0xc]
mov ecx, edi
cmp edi, 0xfff
jbe 0x4025b9
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call fcn.0050837c
sub edi, eax
add esp, 0x10
add esi, eax
mov ecx, edi
cmp eax, 0xfff
jne 0x4025e4
cmp edi, eax
ja 0x402595
test ecx, ecx
je 0x4025d0
push dword [ebx + 0x4c]
push edi
push 1
push esi
call fcn.0050837c
mov ecx, edi
add esp, 0x10
sub ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, ecx
sbb edx, 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x402950
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x58a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x402980
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000f2
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
push edi
mov ecx, dword [eax]
test ecx, ecx
je 0x4029bc
mov edx, dword [esi + 0x30]
mov edi, dword [edx]
lea eax, [edi + ecx]
cmp ecx, eax
jae 0x4029bc
lea ecx, [edi - 1]
mov dword [edx], ecx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000f2
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
je 0x402aa4
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x4029e4
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x402a17
push dword [esi + 0x4c]
movsx eax, bl
push eax
call fcn.00507420
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000f2
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
sub eax, 0
je 0x402a77
sub eax, 1
je 0x402a77
sub eax, 2
jne 0x402aa4
push dword [esi + 0x4c]
movsx eax, byte [ebp - 0x25]
push eax
call fcn.00507420
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000f2
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402a94
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00508133
add esp, 0x10
cmp edi, eax
jne 0x402aa4
lea eax, [ebp - 0x25]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
jne 0x4029a7
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005000f2
mov esp, ebp
pop ebp
ret 4
Function at 0x402ec0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x58a06c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x402f7a
cmp byte [esi + 0x3d], 0
je 0x402f7a
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x402f68
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x402f30
sub eax, 1
je 0x402f34
sub eax, 2
jne 0x402f68
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000f2
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x402f51
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00508133
add esp, 0x10
cmp edi, eax
jne 0x402f68
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000f2
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005000f2
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.005000f2
mov esp, ebp
pop ebp
ret

Function at 0x4033e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e2c0
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x58a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, ecx
mov dword [ebp - 0x10], eax
push 8
mov dword [eax], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.0050058b
mov esi, eax
xorps xmm0, xmm0
movq qword [esi], xmm0
push 1
mov dword [ebp - 4], 0
call fcn.004fed75
mov dword [esi + 4], eax
add esp, 8
mov eax, dword [ebp - 0x10]
lea edi, [eax + 0x14]
lea ecx, [eax + 0x18]
lea edx, [eax + 0x24]
mov dword [eax + 0x34], esi
lea ebx, [eax + 4]
mov dword [eax + 0xc], ebx
lea esi, [eax + 8]
mov dword [eax + 0x10], esi
mov dword [eax + 0x1c], edi
mov dword [eax + 0x20], ecx
mov dword [eax + 0x2c], edx
add eax, 0x28
mov dword [ebp - 0x14], ebx
mov ebx, dword [ebp - 0x10]
mov dword [ebx + 0x30], eax
mov ebx, dword [ebp - 0x14]
mov dword [esi], 0
mov dword [ecx], 0
mov dword [eax], 0
mov eax, dword [ebp - 0x10]
mov dword [ebx], 0
mov dword [edi], 0
mov dword [edx], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4065b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
push eax
call 0x617a4f
test eax, eax
je 0x406609
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x406609
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 8]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x4065f8
cmp esi, edx
jae 0x406609
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x4065e6
cmp esi, edx
jae 0x406609
cmp word [esi], 0
je 0x406609
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x406750
Capabilities:
Access peb ldr_data
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e715
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push esi
push edi
mov eax, dword [0x58a06c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov edi, dword [ebp + 8]
lea ecx, [esi + 0x90]
mov dword [ebp - 0x10], esi
mov dword [esi], vtable.itas109::CSerialPort.0
mov dword [ebp - 0x24], ecx
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
mov eax, dword [edi + 8]
mov dword [esi + 8], eax
movups xmm0, xmmword [edi + 0xc]
mov dword [ebp - 0x20], 0
movups xmmword [esi + 0xc], xmm0
movq xmm0, qword [edi + 0x1c]
movq qword [esi + 0x1c], xmm0
mov eax, dword [edi + 0x24]
mov dword [esi + 0x24], eax
mov eax, dword [edi + 0x28]
mov dword [esi + 0x28], eax
mov eax, dword [edi + 0x2c]
mov dword [esi + 0x2c], eax
mov eax, dword [edi + 0x30]
mov dword [esi + 0x30], eax
movq xmm0, qword [edi + 0x34]
movq qword [esi + 0x34], xmm0
mov eax, dword [edi + 0x3c]
mov dword [esi + 0x3c], eax
movups xmm0, xmmword [edi + 0x40]
movups xmmword [esi + 0x40], xmm0
mov eax, dword [edi + 0x50]
mov dword [esi + 0x50], eax
movups xmm0, xmmword [edi + 0x54]
movups xmmword [esi + 0x54], xmm0
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
movups xmm0, xmmword [edi + 0x68]
movups xmmword [esi + 0x68], xmm0
movq xmm0, qword [edi + 0x78]
movq qword [esi + 0x78], xmm0
mov eax, dword [edi + 0x80]
mov dword [esi + 0x80], eax
mov eax, dword [edi + 0x84]
mov dword [esi + 0x84], eax
mov eax, dword [edi + 0x88]
mov dword [esi + 0x88], eax
mov eax, dword [edi + 0x8c]
mov dword [esi + 0x8c], eax
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov eax, dword [edi + 0x90]
push eax
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x24]
push dword [eax]
call fcn.004083b0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 1
push 0x10
mov dword [ebp - 0x10], 0
call fcn.0050058b
mov edx, eax
add esp, 4
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x40688c
mov dword [edx], edx
mov dword [edx + 4], edx
jmp 0x40689f
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [edx], ecx
mov dword [edx + 4], eax
mov dword [ecx + 4], edx
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x94], eax
mov eax, esi
mov dword [esi + 0x90], edx
mov ecx, dword [edi + 0x98]
mov edx, dword [edi + 0x9c]
mov dword [esi + 0x98], ecx
mov dword [esi + 0x9c], edx
mov ecx, dword [edi + 0xa0]
mov dword [esi + 0xa0], ecx
mov ecx, dword [edi + 0xa4]
mov dword [esi + 0xa4], ecx
mov ecx, dword [edi + 0xa8]
mov dword [esi + 0xa8], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x4076a0
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
mov esi, ecx
push esi
push sym.XinZhiZao.exe_protected:_static_unsigned_long_int___stdcall_itas109::CSerialPort::CommThread_void__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 4], eax
test eax, eax
pop esi
setne cl
mov eax, ecx
ret

Function at 0x4076d0
Capabilities:
Resume thread

Disassembly:
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
ret

Function at 0x4076e0
Capabilities:
Suspend thread

Disassembly:
push dword [ecx + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, 1
ret

Function at 0x4076f0
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40770b
xor eax, eax
pop edi
pop ebp
ret 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
test edi, edi
pop edi
setne al
pop ebp
ret 4