joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015b9
Capabilities:
Read file on windows

Disassembly:
jmp 0x40f3b0
push ecx
xor eax, eax
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov word [esp + 8], ax
push esi
push edi
xor esi, esi
mov byte [esp + 0x12], al
mov eax, dword [esp + 0x18]
xor edi, edi
cmp esi, 3
jae 0x40f402
mov edx, 3
lea ecx, [esp + 0x18]
push 0
sub edx, esi
push ecx
lea eax, [esp + esi + 0x18]
push edx
push eax
push ebx
mov dword [esp + 0x2c], 0
call ebp
mov ecx, dword [esp + 0x18]
add esi, ecx
inc edi
cmp edi, 5
jl 0x40f3d2
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x401640
Capabilities:
Delete registry value

Disassembly:
jmp 0x43bdb0
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp]
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x43bddf
xor eax, eax
pop ecx
ret 8
mov edx, dword [esp + 0xc]
mov eax, dword [esp]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x43be04
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 8
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 8

Function at 0x40171c
Capabilities:
Get number of processors

Disassembly:
jmp 0x42b090
push 0xffffffffffffffff
push 0x49f6c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0x4a656c
xor ebx, ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x3c], ebx
call fcn.0040178f
mov ecx, 7
xor eax, eax
lea edi, [esp + 0x18]
mov ebp, dword [esp + 0x44]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x48]
and ecx, 0xffffd093
sub esp, 0x1c
or ecx, 0x5093
lea esi, [esp + 0x34]
mov dword [esp + 0x3c], ecx
mov ecx, 7
mov edi, esp
mov dword [esp + 0x34], 0x1c
mov dword [esp + 0x38], eax
mov byte [esp + 0x46], 8
mov byte [esp + 0x47], bl
mov byte [esp + 0x48], bl
rep movsd dword es:[edi], dword [esi]
push ebp
lea ecx, [esp + 0x30]
mov byte [esp + 0x5c], 1
call fcn.004017ee
sub esp, 0x14
mov eax, 0x64
mov ecx, 5
lea esi, [esp + 0x2c]
mov edi, esp
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], ebx
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], 0x1f4
rep movsd dword es:[edi], dword [esi]
push ebp
lea ecx, [esp + 0x28]
call fcn.00401a05
push ebp
lea ecx, [esp + 0x14]
mov esi, eax
call fcn.004019c4
push 1
push ebp
lea ecx, [esp + 0x18]
call fcn.00401e9c
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], bl
call fcn.0040228e
mov ecx, dword [esp + 0x34]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x30
ret 8

Function at 0x4017b2
Capabilities:
Write file on windows

Disassembly:
jmp 0x4313f0
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push eax
mov eax, dword [esp + 0xc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 0x10
Function at 0x4017d5
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x42d7b0
push 0xffffffffffffffff
push 0x49faa0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x14]
call fcn.0040178f
mov dword [esp + 0x2c], 0
call fcn.0047b29b
test eax, eax
je 0x42d7f2
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov edi, eax
jmp 0x42d7f4
xor edi, edi
mov eax, dword [0x4c2da4]
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x2c], 2
xor esi, esi
push esi
call fcn.00401f96
add esp, 4
cmp eax, 1
je 0x42d85d
inc esi
cmp esi, 8
jl 0x42d808
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.0047aabc
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.0047aabc
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040228e
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
add esp, 0x24
ret
lea eax, [esp + 0xc]
push esi
push eax
call fcn.004012a3
add esp, 8
lea ecx, [esp + 0xc]
push 0
push 0x4c1f64
call fcn.0046c302
mov ecx, dword [esp + 0xc]
push str.USB
mov dl, byte [eax + ecx - 1]
lea ecx, [esp + 0x24]
mov byte [esp + 0x1c], dl
call fcn.0047ab2a
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push ecx
push eax
push edx
mov byte [esp + 0x38], 3
call fcn.0046bc89
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x30], 4
call fcn.0047abf5
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 3
call fcn.0047aabc
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 2
call fcn.0047aabc
add edi, 0xc4
push str.MultiMonitor
lea eax, [esp + 0x24]
push edi
push eax
call fcn.0047ad51
mov ecx, dword [ebp + 0x5c]
mov edx, dword [esp + 0x10]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x38], 5
call fcn.004017c1
lea ecx, [esp + 0x20]
mov byte [esp + 0x2c], 2
call fcn.0047aabc
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 1
call fcn.0047aabc
lea ecx, [esp + 0xc]
mov byte [esp + 0x2c], 0
call fcn.0047aabc
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040228e
mov ecx, dword [esp + 0x24]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x401848
Capabilities:
Read file on windows

Disassembly:
jmp 0x407af0
push 0xffffffffffffffff
push 0x49cbe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0x4a656c
mov eax, dword [esi + 0x98]
xor edi, edi
mov ebx, 1
cmp eax, edi
mov dword [esp + 0x40], edi
mov dword [esi + 0x84], ebx
je 0x407c84
mov ebp, dword [sym.imp.KERNEL32.dll_WaitCommEvent]
mov eax, dword [esi + 0xbc]
push 3
push eax
lea ecx, [esp + 0x18]
call fcn.00401e9c
cmp dword [esi + 0x84], edi
je 0x407b82
mov eax, dword [esi + 0xbc]
xor ecx, ecx
lea edx, [esp + 0x24]
mov word [esp + 0x24], cx
push edx
push eax
mov byte [esp + 0x2e], cl
call fcn.00401aaa
add esp, 8
test eax, eax
je 0x407c66
mov dword [esi + 0x84], edi
push 0xc8
push ebx
mov ecx, esi
mov dword [esi + 0x70], edi
call fcn.004022bb
push 0x2710
push 2
mov ecx, esi
mov dword [esi + 0x9c], eax
call fcn.004022bb
mov dword [esi + 0xa0], eax
mov eax, dword [esi + 0xbc]
xor ecx, ecx
lea edx, [esp + 0x14]
push edi
mov word [esp + 0x28], cx
push edx
push eax
mov byte [esp + 0x32], cl
call ebp
mov ecx, dword [esi + 0xbc]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetCommMask]
test byte [esp + 0x14], bl
je 0x407c47
mov edx, dword [esi + 0xa0]
mov ecx, esi
push edx
call fcn.00401b18
push 0x2710
push 2
mov ecx, esi
call fcn.004022bb
mov edx, dword [esi + 0xbc]
mov dword [esi + 0xa0], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
mov dword [esi + 0x70], ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_ClearCommError]
cmp dword [esp + 0x30], 3
jne 0x407c3b
mov edx, dword [esi + 0xbc]
lea eax, [esp + 0x18]
push edi
push eax
lea ecx, [esp + 0x2c]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x25]
mov ecx, esi
push eax
call fcn.00402040
cmp dword [esi + 0x98], edi
jne 0x407b3b
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push ecx
mov dword [esi + 0x98], edi
mov ecx, esp
mov dword [esp + 0x24], esp
push str.Calibration_Error_____CX_Command__
call fcn.0047ab2a
mov ecx, esi
call fcn.00401ece
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret
Function at 0x4018bb
Capabilities:
Read file on windows

Disassembly:
jmp 0x41a4f0
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
mov ebp, ecx
xor eax, eax
push edi
push eax
mov dword [esp + 0x20], 2
mov dword [esp + 0x14], eax
mov dword [ebp + 0x2d0], eax
call esi
push 1
mov dword [esp + 0x18], eax
call esi
mov dword [esp + 0x18], eax
mov eax, dword [ebp + 0x2d0]
test eax, eax
jne 0x41a641
mov eax, dword [ebp + 0x6c]
mov dword [ebp + 0x2d4], 1
cmp eax, 0xffffffff
je 0x41a569
lea ecx, [ebp + 0xb8]
lea edx, [esp + 0x10]
push ecx
xor ecx, ecx
mov cx, word [ebp + 0x2c]
push edx
lea edx, [ebp + 0x1cc]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp + 0xa8], eax
mov dl, byte [ebp + 0x1cd]
mov bl, byte [ebp + 0x1cf]
movsx eax, byte [ebp + 0x1ce]
movsx ecx, dl
shl eax, 8
add eax, ecx
movsx ecx, byte [ebp + 0x1d0]
movsx esi, bl
shl ecx, 8
add ecx, esi
test dl, dl
jge 0x41a59c
add eax, 0x100
test bl, bl
jge 0x41a5a6
add ecx, 0x100
imul eax, dword [esp + 0x14]
cdq
and edx, 0x7ff
add eax, edx
mov esi, eax
mov eax, ecx
imul eax, dword [esp + 0x18]
cdq
and edx, 0x7ff
lea ecx, [esp + 0x1c]
add eax, edx
xor edx, edx
mov edi, eax
mov al, byte [ebp + 0x1d1]
sar esi, 0xb
sar edi, 0xb
test al, al
setle dl
dec edx
push edi
and edx, 2
push esi
dec edx
push edx
call fcn.004010a5
test eax, eax
jne 0x41a60b
push edi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0
push 0
push edi
push esi
push 2
call dword [sym.imp.USER32.dll_mouse_event]
jmp 0x41a522
cmp eax, 2
jne 0x41a62b
push edi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
push 0
push 0
push edi
push esi
push 4
call dword [sym.imp.USER32.dll_mouse_event]
jmp 0x41a522
cmp eax, 1
jne 0x41a522
push edi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
jmp 0x41a522
mov dword [ebp + 0x2d4], 0
jmp 0x41a641

Function at 0x4018e3
Capabilities:
Create process on windows

Disassembly:
jmp 0x427670
push 0xffffffffffffffff
push 0x49f228
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x18], 0
call fcn.0047a831
mov ecx, esi
call fcn.004018c5
test eax, eax
jne 0x4276ef
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x1c]
push 1
push eax
push eax
push ecx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jae 0x4276ef
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0047aabc
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0047aabc
mov ecx, dword [esp + 8]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4

Function at 0x401906
Capabilities:
Terminate thread

Disassembly:
jmp 0x42dbe0
mov eax, dword [ecx + 0x74]
push 0xffffffffffffffff
push eax
mov dword [ecx + 0x70], 1
call dword [sym.imp.KERNEL32.dll_TerminateThread]
ret
Function at 0x40192e
Capabilities:
Create process on windows

Disassembly:
jmp 0x43ac10
push 0xffffffffffffffff
push 0x4a0de8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x18], 0
call fcn.0047a831
mov ecx, esi
call fcn.00402072
test eax, eax
jne 0x43ac8f
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x1c]
push 1
push eax
push eax
push ecx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jae 0x43ac8f
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0047aabc
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0047aabc
mov ecx, dword [esp + 8]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4

Function at 0x401ae1
Capabilities:
Write file on windows

Disassembly:
jmp 0x41a480
push esi
mov esi, ecx
push 0
lea ecx, [esi + 0xb4]
lea eax, [esi + 0xcc]
push ecx
push 2
mov byte [eax], 0
push eax
mov eax, dword [esi + 0x68]
mov byte [esi + 0xcd], 0xa
push eax
mov dword [ecx], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
mov dword [esi + 0xa8], eax
jne 0x41a4c3
mov ecx, dword [esi + 0x68]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x401bb3
Capabilities:
Set registry value

Disassembly:
jmp 0x43b4a0
sub esp, 8
lea eax, [esp + 4]
push esi
mov esi, ecx
push edi
lea ecx, [esp + 8]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareDigitechOption
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea edx, [esi + 0x8c]
push 4
push edx
push 4
push 0
push str.SpanState
push eax
call edi
mov ecx, dword [esp + 8]
add esi, 0x90
push 4
push esi
push 4
push 0
push str.SpanEnable
push ecx
call edi
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x401c21
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x43b3c0
sub esp, 0xc
push ebx
push esi
mov esi, ecx
lea eax, [esp + 0x10]
push edi
lea ecx, [esp + 0xc]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareDigitechOption
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x10]
lea edi, [esi + 0x8c]
push edx
push edi
push 0
push 0
push str.SpanState
push eax
mov dword [esp + 0x28], 4
call ebx
test eax, eax
je 0x43b423
mov dword [edi], 2
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edi, [esi + 0x90]
push ecx
push edi
push 0
push 0
push str.SpanEnable
push edx
call ebx
test eax, eax
je 0x43b449
mov dword [edi], 0
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, esi
call fcn.00401bb3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc
ret
Function at 0x401e3d
Capabilities:
Create process on windows

Disassembly:
jmp 0x4330d0
push 0xffffffffffffffff
push 0x4a0358
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x18], 0
call fcn.0047a831
mov ecx, esi
call fcn.00401258
test eax, eax
jne 0x43314f
mov ecx, dword [esp + 0x18]
mov edx, dword [esi + 0x1c]
push 1
push eax
push eax
push ecx
push str.open
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jae 0x43314f
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0047aabc
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0047aabc
mov ecx, dword [esp + 8]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4

Function at 0x401e6f
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
jmp 0x42d9d0
push 0xffffffffffffffff
push 0x49fae8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebp
mov ebp, ecx
push esi
push edi
lea ecx, [esp + 0x10]
call fcn.0040178f
xor esi, esi
mov dword [esp + 0x24], esi
call fcn.0047b29b
cmp eax, esi
je 0x42da10
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x74]
mov edi, eax
jmp 0x42da12
xor edi, edi
mov eax, dword [0x4c2da4]
mov dword [esp + 0x14], eax
mov dword [esp + 0xc], eax
mov byte [esp + 0x24], 2
push esi
call fcn.00401910
add esp, 4
cmp eax, 1
je 0x42da79
inc esi
cmp esi, 8
jl 0x42da24
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.0047aabc
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.0047aabc
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040228e
pop edi
pop esi
xor eax, eax
pop ebp
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
add esp, 0x1c
ret
push 0x4c17cc
lea ecx, [esp + 0x1c]
call fcn.0047ab2a
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 3
call fcn.0047abf5
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 2
call fcn.0047aabc
inc esi
lea eax, [esp + 0xc]
push esi
push str.COM_d
push eax
call fcn.0046c67a
add esp, 0xc
add edi, 0xc4
lea ecx, [esp + 0x18]
push str.MultiMonitor
push edi
push ecx
call fcn.0047ad51
mov edx, dword [ebp + 0x5c]
mov ecx, dword [esp + 0xc]
mov eax, dword [eax]
push edx
push ecx
push eax
lea ecx, [esp + 0x1c]
mov byte [esp + 0x30], 4
call fcn.004017c1
lea ecx, [esp + 0x18]
mov byte [esp + 0x24], 2
call fcn.0047aabc
lea ecx, [esp + 0xc]
mov byte [esp + 0x24], 1
call fcn.0047aabc
lea ecx, [esp + 0x14]
mov byte [esp + 0x24], 0
call fcn.0047aabc
lea ecx, [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
call fcn.0040228e
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
pop ebp
mov dword fs:[0], ecx
add esp, 0x1c
ret
Function at 0x401ea1
Capabilities:
Read file on windows

Disassembly:
jmp 0x40f430
sub esp, 8
xor eax, eax
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [esp + 8], eax
push esi
push edi
xor esi, esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
xor edi, edi
cmp esi, 8
jae 0x40f483
mov edx, 8
lea ecx, [esp + 0x1c]
push 0
sub edx, esi
push ecx
lea eax, [esp + esi + 0x18]
push edx
push eax
push ebx
mov dword [esp + 0x30], 0
call ebp
mov ecx, dword [esp + 0x1c]
add esi, ecx
inc edi
cmp edi, 5
jl 0x40f453
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x401eba
Capabilities:
Access peb ldr_data

Disassembly:
jmp 0x4240f0
push 0xffffffffffffffff
push 0x49ed00
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
mov dword [esp + 0xc], 0x4a656c
mov dword [esp + 0x30], eax
mov edi, dword [esp + 0x38]
mov byte [esp + 0x10], al
mov dword [esp + 0x11], eax
or ecx, 0xffffffff
mov dword [esp + 0x15], eax
lea edx, [esp + 0x1c]
mov byte [esp + 0x19], al
mov byte [esp + 0x30], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [esp + 0x10]
call fcn.004013ca
mov esi, eax
mov ecx, ebx
push esi
call fcn.00401302
lea edx, [esp + 0x10]
push edx
push esi
call fcn.00401b0e
add esp, 8
lea edi, [ebx + 0x94]
test eax, eax
jne 0x424191
push str.Unknown
mov ecx, edi
call fcn.0047ac45
jmp 0x4241ab
movsx eax, byte [esp + 0x12]
movsx ecx, byte [esp + 0x11]
push eax
push ecx
push str._x._x
push edi
call fcn.0046c67a
add esp, 0x10
push esi
lea ecx, [esp + 0x10]
call fcn.00401b6d
mov edi, dword [edi]
push str.Unknown
push edi
call fcn.0043f7be
add esp, 8
mov dword [esp + 0x30], 0xffffffff
test eax, eax
pop edi
pop esi
pop ebx
lea ecx, [esp + 0x2c]
jne 0x4241f0
call fcn.0047aabc
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
call fcn.0047aabc
mov ecx, dword [esp + 0x1c]
mov eax, 1
mov dword fs:[0], ecx
add esp, 0x28
ret 8

Function at 0x401feb
Capabilities:
Terminate process

Disassembly:
jmp 0x43acf0
push 0xffffffffffffffff
push 0x4a0e08
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push ecx
lea eax, [esp + 0x1c]
mov ecx, esp
mov dword [esp + 8], esp
push eax
mov dword [esp + 0x18], 0
call fcn.0047a831
mov ecx, esi
call fcn.00402072
test eax, eax
jne 0x43ad52
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0047aabc
xor eax, eax
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0047aabc
mov ecx, dword [esp + 8]
mov eax, 1
mov dword fs:[0], ecx
pop esi
add esp, 0x10
ret 4
Function at 0x4020a9
Capabilities:
Read file on windows

Disassembly:
jmp 0x407890
push 0xffffffffffffffff
push 0x49cbc8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push ebp
push esi
push edi
mov esi, ecx
mov dword [esp + 0x10], 0x4a656c
mov eax, dword [esi + 0x98]
xor edi, edi
mov ebx, 1
cmp eax, edi
mov dword [esp + 0x40], edi
mov dword [esi + 0x84], ebx
je 0x407a4e
mov ebp, dword [sym.imp.KERNEL32.dll_WaitCommEvent]
mov eax, dword [esi + 0xbc]
push 3
push eax
lea ecx, [esp + 0x18]
call fcn.00401e9c
cmp dword [esi + 0x84], edi
je 0x40794c
push ecx
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Do_Not_Touch___
call fcn.0047ab2a
mov ecx, esi
call fcn.00401e0b
mov ecx, esi
call fcn.004018c0
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esi + 0xbc]
xor ecx, ecx
lea edx, [esp + 0x24]
mov word [esp + 0x24], cx
push edx
push eax
mov byte [esp + 0x2e], cl
call fcn.00401a5a
add esp, 8
test eax, eax
je 0x407a30
mov dword [esi + 0x84], edi
push 0xc8
push ebx
mov ecx, esi
mov dword [esi + 0x70], edi
call fcn.004022bb
push 0x2710
push 2
mov ecx, esi
mov dword [esi + 0x9c], eax
call fcn.004022bb
mov dword [esi + 0xa0], eax
mov eax, dword [esi + 0xbc]
xor ecx, ecx
lea edx, [esp + 0x14]
push edi
mov word [esp + 0x28], cx
push edx
push eax
mov byte [esp + 0x32], cl
call ebp
mov ecx, dword [esi + 0xbc]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_SetCommMask]
test byte [esp + 0x14], bl
je 0x407a11
mov edx, dword [esi + 0xa0]
mov ecx, esi
push edx
call fcn.00401b18
push 0x2710
push 2
mov ecx, esi
call fcn.004022bb
mov edx, dword [esi + 0xbc]
mov dword [esi + 0xa0], eax
lea eax, [esp + 0x2c]
lea ecx, [esp + 0x20]
push eax
push ecx
push edx
mov dword [esi + 0x70], ebx
mov dword [esp + 0x24], edi
call dword [sym.imp.KERNEL32.dll_ClearCommError]
cmp dword [esp + 0x30], 3
jne 0x407a05
mov edx, dword [esi + 0xbc]
lea eax, [esp + 0x18]
push edi
push eax
lea ecx, [esp + 0x2c]
push 3
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x25]
mov ecx, esi
push eax
call fcn.00401dac
cmp dword [esi + 0x98], edi
jne 0x4078db
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34
ret
push ecx
mov dword [esi + 0x98], edi
mov ecx, esp
mov dword [esp + 0x20], esp
push str.Calibration_Error_____CX_Command__
call fcn.0047ab2a
mov ecx, esi
call fcn.00401ece
mov ecx, dword [esp + 0x38]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x34
ret