joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4046d3
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x422e08], 0
je 0x404758
push str.Closing_Read_Thread_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x422e10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 0xa
mov ecx, dword [0x422dfc]
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0x2710
mov edx, dword [0x422e08]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x404758
push str.Read_thread_not_exiting.__Terminating_it._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
mov eax, dword [0x422e08]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x422e08]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x422e08], 0
mov dword [0x422e00], 0
pop ebp
ret

Function at 0x40475a
Capabilities:
Print debug messages
Terminate thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x422e0c], 0
je 0x4047df
push str.Closing_Write_Thread_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [0x422e10]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
push 5
mov ecx, dword [0x422dfc]
push ecx
call dword [sym.imp.KERNEL32.dll_PurgeComm]
push 0x2710
mov edx, dword [0x422e0c]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4047df
push str.Write_thread_not_exiting.__Terminating_it._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
mov eax, dword [0x422e0c]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [0x422e0c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x422e0c], 0
mov dword [0x422e04], 0
pop ebp
ret
Function at 0x40490f
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov eax, dword [0x422e10]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
add eax, dword [ebp - 8]
push eax
mov ecx, dword [0x422dfc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404aca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 6
jne 0x40497d
push 0x41f448
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x404aeb
cmp dword [ebp - 0x10], 0x3e5
je 0x4049c2
push 0
push 0x422e30
push str.Error_to_writing_to_CommFile
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x41f4b8
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 1
push 0x400
mov edx, dword [0x422df8]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
jmp 0x404aeb
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x18]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ecx
cmp dword [ebp - 0x1c], 0
je 0x4049ef
cmp dword [ebp - 0x1c], 1
je 0x4049f6
cmp dword [ebp - 0x1c], 0xffffffff
je 0x4049f8
jmp 0x404a29
xor eax, eax
jmp 0x404aeb
jmp 0x404a59
push 0
push 0x422e34
push str.Write_WAIT_FAILED
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 1
push 0x400
mov edx, dword [0x422df8]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
jmp 0x404aeb
push 0
push 0x422e38
push 0x41f4dc
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 1
push 0x400
mov eax, dword [0x422df8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
jmp 0x404aeb
push 1
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [0x422dfc]
push eax
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
jne 0x404aca
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 6
jne 0x404a91
push 0x41f4fc
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x404aeb
push 0
push 0x422e3c
push str.Error_writing_to_CommFile_while_waiting
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push str.Closing_TAPI_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
push 1
push 0x400
mov ecx, dword [0x422df8]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
jmp 0x404aeb
mov edx, dword [ebp + 0x10]
sub edx, dword [ebp - 4]
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 0
ja 0x404934
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x404f0f
Capabilities:
Print debug messages
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [0x422e10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x404f2f
xor eax, eax
jmp 0x404fc4
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [0x422dfc]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404f6a
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00405048
add esp, 8
test eax, eax
jne 0x404f68
xor eax, eax
jmp 0x404fc4
jmp 0x404f13
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3e5
jne 0x404f83
mov eax, 1
jmp 0x404fc4
cmp dword [ebp - 4], 6
jne 0x404f98
push 0x41f61c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x404fc4
push 0
push 0x422e54
push str.Unexpected_ReadFile_error:
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 1
push 0x400
mov edx, dword [0x422df8]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x404fc8
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [0x422dfc]
push edx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x404ffb
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00405048
add esp, 8
jmp 0x405044
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 6
jne 0x405019
push 0x41f688
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x405044
push 0
push 0x422e58
push str.Unexpected_GetOverlappedResult_Read_Error:
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
push 1
push 0x400
mov eax, dword [0x422df8]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4050c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
mov eax, dword [0x422e10]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4050e0
xor eax, eax
jmp 0x405161
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [0x422dfc]
push eax
call dword [sym.imp.KERNEL32.dll_WaitCommEvent]
test eax, eax
je 0x40511d
push str.Event__Error__waiting_before_WaitCommEvent._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call fcn.00405165
add esp, 0xc
test eax, eax
jne 0x40511b
xor eax, eax
jmp 0x405161
jmp 0x4050c4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x3e5
jne 0x405136
mov eax, 1
jmp 0x405161
cmp dword [ebp - 4], 6
jne 0x40514b
push 0x41f77c
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
jmp 0x405161
push 0
push 0x422e68
push str.Unexpected_WaitCommEvent_error:
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x408bed
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x419418
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x804
mov dword [ebp - 0x810], ecx
mov ecx, dword [ebp - 0x810]
call sub.MFC42.DLL_CFrameWnd::CFrameWnd
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x810]
add ecx, 0xd0
call sub.MFC42.DLL_CStatusBar::CStatusBar
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x810]
add ecx, 0x170
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 2
push 0
mov ecx, dword [ebp - 0x810]
add ecx, 0x174
call fcn.00406190
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x810]
add ecx, 0x1dc
call sub.MFC42.DLL_CToolBar::CToolBar
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0x810]
mov dword [eax], 0x41b650
mov ecx, dword [ebp - 0x810]
mov dword [0x427c0c], ecx
mov edx, dword [ebp - 0x810]
mov dword [edx + 0x1d4], 0
lea eax, [ebp - 0x80c]
push eax
push 0x800
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x80c]
push ecx
call sub.MSVCRT.dll_strlen
add esp, 4
movsx edx, byte [ebp + eax - 0x80d]
cmp edx, 0x5c
je 0x408ce3
push 0x4206d4
lea eax, [ebp - 0x80c]
push eax
call sub.MSVCRT.dll_strcat
add esp, 8
lea ecx, [ebp - 0x80c]
push ecx
mov ecx, dword [ebp - 0x810]
add ecx, 0x170
call fcn.004186b0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x810]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x409aa7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 2
mov eax, dword [ebp + 8]
push eax
call fcn.004041d0
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx], 0
jne 0x409ad6
xor eax, eax
jmp 0x409b79
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call fcn.004041d0
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edx, dword [ebp - 0x10]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax + 4], 0
jne 0x409afb
xor eax, eax
jmp 0x409b79
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x409b15
xor eax, eax
jmp 0x409b79
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x14]
lea ecx, [ecx + eax + 0x400]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
call sub.MFC42.DLL_operatornew
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 8]
push edx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 8]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 8]
mov ecx, dword [ecx]
lea edx, [eax + ecx + 0x400]
mov eax, dword [ebp - 0x10]
mov dword [eax + 0xc], edx
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x409b80
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0xc], eax
push 0x42ad80
call fcn.00410534
add esp, 4
movsx eax, ax
test eax, eax
je 0x409bd2
push 0
call fcn.00406350
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 0x68]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0xc]
cmp eax, 0x3e8
jb 0x409bd0
or eax, 0xffffffff
jmp 0x409c2d
jmp 0x409b92
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x409bea
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp + 0xc]
jge 0x409c11
mov eax, dword [0x42ad8c]
push eax
mov ecx, dword [ebp - 4]
mov dl, byte [ecx]
push edx
call fcn.00410b21
add esp, 8
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x409be1
push 0x42ad80
call fcn.00410512
add esp, 4
push 0x42ad80
call fcn.004105b9
add esp, 4
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40ce21
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 4]
cmp eax, dword [ebp + 8]
jae 0x40cea2
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x40ce98
cmp dword [ebp - 0x1c], 0x12
jne 0x40ce64
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x40cea2
cmp dword [ebp - 0x1c], 0x10
jne 0x40ce82
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40cea2
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
jmp 0x40cea0
push 2
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40ce30
mov esp, ebp
pop ebp
ret

Function at 0x40cfee
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
call fcn.00406350
cmp dword [eax + 0xc8], 3
je 0x40d013
call fcn.00406350
cmp dword [eax + 0xc8], 2
jne 0x40d053
mov eax, dword [ebp - 8]
cmp dword [eax + 0x5c], 0
je 0x40d051
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx + 0x5c]
mov edx, dword [ebp - 8]
mov eax, dword [edx + 0x5c]
mov edx, dword [eax]
call dword [edx + 0xc0]
test eax, eax
je 0x40d051
mov ax, word [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 8]
mov ecx, dword [edx + 0x5c]
mov eax, dword [ebp - 8]
mov edx, dword [eax + 0x5c]
mov eax, dword [edx]
call dword [eax + 0xc8]
jmp 0x40d0a2
push 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x40d086
push 0
push 0x42dec8
push str.Internal_error:_WriteFile_failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x10]
je 0x40d0a2
push 0
push 0x42decc
push str.Internal_error:_write_to_pipe_failed
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40d0a8
Capabilities:
Read file on windows
Read pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
call fcn.00406350
cmp dword [eax + 0xc8], 3
je 0x40d0d1
call fcn.00406350
cmp dword [eax + 0xc8], 2
jne 0x40d170
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x60], 0
je 0x40d0e3
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x64], 0
jne 0x40d0ea
xor eax, eax
jmp 0x40d1ee
push 0
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x40d122
push 0
push 0
push 0x420bb4
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x40d1ee
mov dword [ebp - 0xc], 0
cmp dword [ebp - 4], 0
je 0x40d16b
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x60]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d156
mov ecx, dword [ebp - 0xc]
cmp ecx, dword [ebp - 4]
je 0x40d16b
push 0
push 0
push 0x420bd8
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x40d1ee
mov eax, dword [ebp - 0xc]
jmp 0x40d1ee
push 0
lea edx, [ebp - 0x14]
push edx
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x70]
push ecx
call dword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x40d1a5
push 0
push 0
push str.Internal_error:_PeekNamedPipeFailed
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x40d1ee
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x10], 0
je 0x40d1eb
push 0
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40d1d9
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [ebp - 0x10]
je 0x40d1eb
push 0
push 0
push str.Internal_error:_ReadFile_failed
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x40d1ee
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x411f40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
mov edx, dword [ebp + 0xc]
and edx, 0xff
cmp edx, 1
jne 0x411f89
push 0x421368
push 0
push str.LINUXPORT
push 0x421354
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x411f89
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
add ecx, 0x3e8
mov edx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x412370
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4197ee
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
push esi
mov dword [ebp - 0x84], ecx
push 0
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov ecx, dword [ebp - 0x84]
call fcn.00411373
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x84]
mov dword [eax], vtable.F2Conversation.0
cmp dword [0x42e3e8], 0
jne 0x4123e0
mov dword [0x42e3e8], 1
mov ecx, dword [ebp - 0x84]
mov dword [ecx + 0x1a20], 0xffffffff
mov edx, dword [ebp - 0x84]
mov dword [edx + 0x4c], 1
push 0
push 0
call fcn.00406350
mov eax, dword [eax + 0x20]
push eax
mov ecx, dword [sym.imp.MFC42.DLL_CRectconstCFrameWnd::rectDefault]
push ecx
push 0x40000000
mov edx, dword [ebp + 0x10]
push edx
push str.F2_Conversation:
lea ecx, [ebp - 0x7c]
call sub.MFC42.DLL_CString::CString_1
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x88]
mov dword [ebp - 0x8c], eax
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x8c]
push ecx
lea edx, [ebp - 0x80]
push edx
call sub.MFC42.DLL_operator_1
mov dword [ebp - 0x90], eax
mov eax, dword [ebp - 0x90]
mov dword [ebp - 0x94], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x94]
call fcn.00402650
push eax
push 0
mov ecx, dword [ebp - 0x84]
call sub.MFC42.DLL_CWnd::Create
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x80]
call fcn.004183d4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7c]
call fcn.004183d4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 0x14]
call fcn.00411fa0
mov esi, eax
mov ecx, 0x42e3d4
call fcn.00411fa0
cmp esi, eax
jne 0x412540
push 0x4215a4
push 0
push str.Delay1
push 0x4215b8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x10], eax
push 0x4215c0
push 0
push str.Delay2
push 0x4215d4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x10], 0
jne 0x4124fe
cmp dword [ebp - 0x14], 0
je 0x412540
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x10]
push edx
push str.Waiting_for_C1Test_Delay1__d_Msec.__Delay2__d_Msec
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x10
push str.Fidia.ini
push 0
push str.verbose
push str.C1test
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x412540
push 0
push 0
lea ecx, [ebp - 0x78]
push ecx
call sub.MFC42.DLL_AfxMessageBox
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov ecx, dword [ebp - 0x84]
call fcn.0041293a
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x84]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret 0x18
Function at 0x41293a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], ecx
push 0x40000000
mov eax, dword [ebp - 0xc]
add eax, 0x1a20
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.CpuDriverInterface.dll_public:_static_class_CCncMemI____cdecl_CCncMemI::Instance_void_]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x10]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x10]
call dword [eax]
mov byte [ebp - 8], al
mov ecx, dword [ebp - 0xc]
cmp dword [ecx + 0x1a20], 0xffffffff
je 0x412984
mov edx, dword [ebp - 8]
and edx, 0xff
test edx, edx
jne 0x412998
push str.La_DoConnect__CreateFile__e_fallita
call fcn.00412935
add esp, 4
xor eax, eax
jmp 0x412b04
cmp dword [ebp + 0x10], 0
je 0x4129aa
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.00412c73
mov dword [ebp - 4], 0x64
push str.FIDIA.INI
push 0
push str.NoCpu5Reset
push str.LOADER
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
je 0x4129d5
mov ecx, dword [ebp - 4]
imul ecx, ecx, 0x3c
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
jle 0x412a1e
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 0x1a20]
push eax
call dword [sym.imp.CpuDriverInterface.dll_public:_static_class_CCncMemI____cdecl_CCncMemI::Instance_void_]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x14]
call dword [edx + 0x24]
and eax, 0xff
test eax, eax
jne 0x412a15
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x412a1c
mov dword [ebp - 4], 0xfffffff6
jmp 0x4129d5
cmp dword [ebp - 4], 0xfffffff6
je 0x412a39
push 0
push 0
push str.GENERAL_FAILURE___CNC_IS_EITHER_CRASHED__OR_OFF____
call sub.MFC42.DLL_AfxMessageBox
xor eax, eax
jmp 0x412b04
push 0x14
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 0x1a00
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x14
push 0
mov edx, dword [ebp - 0xc]
add edx, 0x19ec
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x1a1c], eax
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x1a10], eax
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x19fc], eax
push 0
push 0
push 0
push 0
mov edx, dword [ebp - 0xc]
push edx
push 0x412591
call sub.MFC42.DLL_AfxBeginThread
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov dword [ecx + 0x1a14], edx
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
push 0x412832
call sub.MFC42.DLL_AfxBeginThread
mov ecx, dword [ebp - 0xc]
mov edx, dword [eax + 0x30]
mov dword [ecx + 0x1a18], edx
push 0
push 0
push 0x465
mov ecx, dword [ebp - 0xc]
call fcn.00402660
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc