joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413b17
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x413b3e
call fcn.00413229
mov dword [eax], esi
call fcn.00413216
push 0x16
pop esi
mov dword [eax], esi
call fcn.0041972d
mov eax, esi
jmp 0x413b93
test dword [ebp + 0xc], 0xfffffff9
jne 0x413b24
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x413b6b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041323c
pop ecx
call fcn.00413216
mov eax, dword [eax]
jmp 0x413b93
test al, 0x10
jne 0x413b91
test al, 1
je 0x413b91
test byte [ebp + 0xc], 2
je 0x413b91
call fcn.00413229
mov dword [eax], 5
call fcn.00413216
mov dword [eax], 0xd
jmp 0x413b62
xor eax, eax
pop esi
pop ebp
ret

Function at 0x425d53
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x434674]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004190ac
and dword [ebp - 0x14], 0
cmp dword [0x436f0c], 0
mov dword [ebp - 0x18], eax
jne 0x425e06
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x425eae
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x425eae
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x436f0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x436f10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x436f14], eax
call edi
push eax
call esi
mov dword [0x436f1c], eax
test eax, eax
je 0x425e06
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x436f18], eax
mov eax, dword [0x436f18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x425e5f
cmp dword [0x436f1c], ecx
je 0x425e5f
push eax
call esi
push dword [0x436f1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x425e5f
test ebx, ebx
je 0x425e5f
call edi
test eax, eax
je 0x425e56
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x425e56
test byte [ebp - 8], 1
jne 0x425e5f
or dword [ebp + 0x10], 0x200000
jmp 0x425e92
mov eax, dword [0x436f10]
cmp eax, dword [ebp - 0x18]
je 0x425e92
push eax
call esi
test eax, eax
je 0x425e92
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x425e92
mov eax, dword [0x436f14]
cmp eax, dword [ebp - 0x18]
je 0x425e92
push eax
call esi
test eax, eax
je 0x425e92
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x436f0c]
call esi
test eax, eax
je 0x425eae
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x425eb0
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00411d2c
leave
ret
Function at 0x40ed1b
Capabilities:
Encode data using xor

Disassembly:
cmp dword ss:[ebx], 0x1ba74b64
xor byte [edi], bl
jnp 0x40ed74
cmpsd dword [esi], dword es:[edi]
cmp dl, byte [esp + 0x51]
xchg ebp, eax
test dword [eax], ebp
mov al, 0x67
push cs
pop edi
daa
outsb dx, byte [esi]
cmpsb byte [esi], byte es:[edi]
sub byte [ebp + 0x63], 0x8f
xor al, 0x16
pop edx
or bh, byte [ebp + 0x79]
test al, 0xa
invalid
push esp
sbb dword [eax], eax
and eax, 0x9acee37
mov edi, 0x2b5ad4fe
outsd dx, dword [esi]
call 0x93a42c39
cld
out dx, al
xor byte [eax - 0x7b], 0xce
std
in al, 0xb8
pop edi
push esp
mov edi, 0x6e3f64f
pop edi
dec esi
add byte [edx], ch
inc ebp
and byte [ecx], 0xa2
xor dword [ebx - 0x1b7d506e], esi
adc ah, byte [ebp - 3]
jge 0x40ed99
jp 0x40ed71
sub byte [edi - 0x1c], dl
push esi
mov esi, 0xfadfe023
adc al, 0xfd
push eax
dec ebx
dec eax
sub ecx, dword [ecx - 0x685092cb]
invalid

Function at 0x417e10
Capabilities:
Get common file path

Disassembly:
sub esp, 0x58
mov eax, dword [0x633038]
mov dword [esp + 4], 0
push esi
lea ecx, [eax + eax]
mov eax, dword [0x63303c]
or ecx, eax
mov dword [esp + 4], ecx
mov ecx, dword [esp + 0x60]
fild qword [esp + 4]
test ecx, ecx
fadd qword [0x633050]
fstp qword [0x633050]
je 0x417e63
mov eax, dword [0x636800]
test eax, eax
je 0x417e57
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
pop esi
add esp, 0x58
ret 4
mov dl, byte [0x633042]
mov cl, byte [0x633049]
xor cl, dl
mov edx, dword [0x633030]
mov byte [0x633049], cl
mov ecx, dword [0x633034]
and ecx, 4
and eax, 0xc
add edx, ecx
mov esi, dword [0x633038]
mov dword [0x633030], edx
mov edx, dword [0x633048]
and edx, 0xff
push ebp
imul eax, edx
xor esi, eax
push edi
lea eax, [esp + 0x14]
push 0x50
push eax
mov dword [0x633038], esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.dsound.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x15]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [0x63304e]
mov ecx, ebp
and ecx, 3
lea edx, [esp + 0x14]
rep movsb byte es:[edi], byte [esi]
mov cl, byte [0x633040]
push edx
and cl, al
mov byte [0x633040], cl
mov cl, byte [0x633047]
or cl, 2
shr cl, 1
and ecx, 0xff
mov dword [esp + 0x6c], ecx
fild dword [esp + 0x6c]
fdivr qword [0x633050]
fadd qword [0x62f760]
fstp qword [0x6369d0]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop edi
mov dword [0x636800], eax
test eax, eax
pop ebp
je 0x417f88
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DirectSoundCreate
push eax
call esi
mov dword [0x6367fc], eax
mov eax, dword [0x636800]
push str.DirectSoundEnumerateA
push eax
call esi
mov ecx, dword [0x6367fc]
mov dword [0x636804], eax
test ecx, ecx
je 0x417f7e
test eax, eax
je 0x417f7e
mov eax, 1
pop esi
add esp, 0x58
ret 4
mov dword [0x636800], 0
xor eax, eax
pop esi
add esp, 0x58
ret 4
Function at 0x4260cb
Capabilities:
Encode data using xor

Disassembly:
add esi, dword [edi + 0x60]
out dx, al
mov word [ebp + 0x5f6805fb], fs
out 0xcf, al
fidiv word [ebp + 0x43368784]
cmp dword [ecx + 0x16], edi
mov dword [eax - 0x27], eax
popal
xor al, 9
das
add al, 0x61
jnp 0x4260d6
iretd
inc edi
dec ebp
jbe 0x426160
add byte [esi - 0x22], bh
push ss
sub byte [ebx - 0x57e3266d], bl
xor al, 0xcb
jnp 0x426147
pop dword [esi + 0x5da4363e]
add dword [edx + 0x56], 0x8cd94239
dec ebx
cli
pop esi
dec esi
pushfd
lodsd eax, dword [esi]
nop
dec ecx
shr bl, cl
inc ebp
or eax, 0x7ad8af70
invalid
jmp 0x42615b
sbb al, 0x48
aam 0xb
adc dword [edi + eax*2 + 0x43d3a227], esp
leave
invalid
mov eax, dword [0xe1eef658]
in al, 0xb9
mov byte [0x5ab5855b], al
adc ebp, eax
pop edx
int 0x35
sub dword [edx - 0x25b05c6b], ebx
in eax, dx
aas
cmp dl, byte [esi]
in eax, dx
pop ebp
das
cmp dl, byte [eax + 0x60]
sal esi, cl
sbb dh, byte [eax - 0x7515ffb8]
pop eax
into
cmpsd dword [esi], dword es:[edi]
wait
sbb al, 0x77
loope 0x426114
xchg esi, eax
xchg esp, eax
invalid

Function at 0x49e307
Capabilities:
Encode data using xor

Disassembly:
loop 0x49e2ad
sub byte [esi], al
push es
or ebx, esi
out 0xc, al
ret
aaa
or al, 0xdd
or eax, 0x96a25a25
mov ebx, 0x105a5973
lodsd eax, dword [esi]
sub dword [ebp - 0x9484cff], ebx
mov byte [0x5973bb96], al
pop edx
adc byte [ebp - 0x4cfe62d7], ch
mov bh, 0xf6
popfd
add dword [ebx + 0x6a30f6b7], esi
adc ebp, edi
xor byte [edx + 0x11], ch
std
push ss
pushal
adc al, dl
lahf
jns 0x49e2a7
fist word [edx + 0xfbc2ebf]
mov ebx, 0x5bf2718
sub ebx, 0x3f1e6b55
btc dword [eax], ebx
daa
mov edi, 0xeb816505
push ebp
imul ebx, dword [esi], 0x3f
shl byte [esi + 0x78], cl
or dword [eax], eax
jmp 0x49e283
jae 0x49e2b6
jbe 0x49e284
not byte [edx - 0x6a]
nop
inc ax
bound ebx, qword [ebp + 0x53]
pushal
mov bl, 0x3d
sub al, 0xb3
mov byte [0x90df7cb5], al
cbw
add dword [ebp + 6], esi
dec ebp
and al, byte [edx + 0x46]
and dl, byte [ecx + 0x683b021]
cmp dl, byte [eax]
xchg ebx, eax
add eax, 0x26a5f39d
lodsb al, byte [esi]
out 0x39, ax
rcr dword [ebp - 0x2b], 1
popal
xchg esi, eax
xchg esi, eax
and eax, 0xf12d628f
inc edi
dec esi
aam 0x61
loope 0x49e391
in eax, dx
outsd dx, dword [esi]
jns 0x49e2cb
cmp dl, dh
mov edx, 0x745e0c0c
daa
sub al, 0x41
mov word [edi + 0x59], es
and cl, al
rcr dword ss:[ebp + ebx*4 + 0x15], cl
xlatb
mov dh, 0xa
xchg edi, eax
xchg ebx, eax
mov al, 0x5d
push esp
je 0x49e392
das
push ecx
and al, 0x32
scasb al, byte es:[edi]
and eax, 0x446fccee
xor ch, byte [esi + 0x6fccee25]
inc esp
push cs
push ecx
cld
sbb dword [ebp + 0x5b], edx
xchg esi, eax
loopne 0x49e31a
jg 0x49e2fd
jb 0x49e360
inc dword [edx]
daa
cmp al, 0xb
xor al, 0x2b
xor eax, 0x9b01ba48
push esi
xor al, 0x60
jae 0x49e3f7
enter 0x1610, 0xffffffffffffff98
rcr edx, 0xc5
lds edi, [esi - 0x2e]
jle 0x49e366
xor ebp, dword [edi - 0x29]
push es
lahf
int3
insd dword es:[edi], dx
invalid
Function at 0x4a04c9
Capabilities:
Encode data using xor

Disassembly:
dec ecx
scasd eax, dword es:[edi]
jbe 0x4a051c
jp 0x4a04d7
outsb dx, byte [esi]
pop ebp
mov edx, 0xa2039b3c
cmp al, 0x9b
add esp, dword [edx - 0x303e3ee5]
test dword [ecx + edx], ebx
sbb eax, ecx
ror edi, 0x85
sbb al, 0x11
je 0x4a0546
arpl bp, cx
call 0xb94f472a
invalid
xchg ebp, eax
cmp dh, cl
cwde
mov word [0x44604b7c], gs
sbb eax, 0x61588e41
sub byte [eax], 0xd5
clc
outsd dx, dword [esi]
invalid
jmp 0x4a051e
les ecx, [esi]
lds edi, [ecx - 0x71eca4f5]
xchg ebp, eax
jp 0x4a04e7
jo 0x4a04fb
invalid
int1
jae 0x4a050d
bnd jmp 0x4a04d3
or eax, 0x3d78800f
pop edi
jp 0x4a053c
adc dword [ebx - 0x12f658e9], 0x5c2eb6f0
pop esp
fist dword [edi + edx]
adc al, 0xd6
push edi
xchg byte [esi + 0x55], cl
sub al, 0xf9
in eax, 4
xor al, 0xf
je 0xd8f6a580
fsubr qword [ecx + edi - 0x97eedee]
stc
xchg eax, esi
cdq
push ebx
in al, 0x4a
stc
mov dl, 0x85
jge 0x4a0556
mov word [ecx + ecx], cs
sal ch, cl
rcr dword [esi + 0x3e], 1
int1
sbb dl, byte [ebp - 0x1f]
popal
push edx
mov dword [0xe4538674], eax
or byte [ecx], bh
mov edi, 0x587e1fd7
fsubr qword [edx + 0x60]
push ebx
sub dword [edi - 0x2d354e7f], ebp
mov byte [ebx + 0x28], ah
mov bl, 0xa2
sbb esp, dword [esi - 8]
lahf
adc byte [0xa4a1fa0f], cl
invalid

Function at 0x4d71da
Capabilities:
Accept command line arguments

Disassembly:
push ebx
add byte [eax], al
add byte [ecx], al
push es
jnp 0x4d7189
sub bl, byte [0xe875fff1]

Function at 0x629f45
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6333d0
cmp edx, dword [eax]
je 0x629f67
add eax, 8
inc ecx
cmp eax, 0x633460
jl 0x629f58
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6333d0]
jne 0x62a095
mov eax, dword [0x638d6c]
cmp eax, 1
je 0x62a06f
test eax, eax
jne 0x629f98
cmp dword [0x6332f8], 1
je 0x62a06f
cmp edx, 0xfc
je 0x62a095
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x629fcf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0062a930
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0062adc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x62a012
lea eax, [ebp - 0x1a4]
push eax
call fcn.0062adc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x62fae4
push edi
call fcn.0062cc90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0062a930
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0062a940
lea eax, [ebp - 0xa0]
push 0x62fac4
push eax
call fcn.0062a940
push dword [esi + 0x6333d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0062a940
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0062cc04
add esp, 0x2c
pop edi
jmp 0x62a095
lea eax, [ebp + 8]
lea esi, [esi + 0x6333d4]
push 0
push eax
push dword [esi]
call fcn.0062adc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401b80
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55dd6e
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x640040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push 0
push dword [eax - 0xc]
push eax
push dword [esi + 0xc]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov dword [esi + 0x10], eax
test eax, eax
jns 0x401bfb
push 0x71
push str.c:DevjenkinsworkspaceiTools_for_IDMDeployer_V9.87IDMCommonidmcommonchecksumhandler.cpp
push 0x587798
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec040
push dword [esi + 0x10]
push str.CCheckSumMSCNGBase::AddBuffer::_Error_0x_x_returned_by_BCryptHashData_n
call fcn.00402580
add esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1046]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x401c50
Capabilities:
Hash data via bcrypt

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55dd9e
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x640040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 0xc]
push 0
add ecx, ecx
push ecx
push eax
push dword [esi + 0xc]
call dword [sym.imp.bcrypt.dll_BCryptHashData]
mov dword [esi + 0x10], eax
test eax, eax
jns 0x401cd3
push 0x87
push str.c:DevjenkinsworkspaceiTools_for_IDMDeployer_V9.87IDMCommonidmcommonchecksumhandler.cpp
push 0x587798
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec040
push dword [esi + 0x10]
push str.CCheckSumMSCNGBase::AddBuffer::_Error_0x_x_returned_by_BCryptHashData_n
call fcn.00402580
add esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4037c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55e270
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
cmp dword [esi + 0x1d8], 0
jne 0x40385d
mov dword [ebp - 0x18], 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x1d8], eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push 0x404520
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
jmp 0x403866
mov dword [ebp - 4], 0xffffffff
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret
Function at 0x4082b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55ecfe
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x640040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [edi + 0x18], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
inc eax
push eax
call dword [sym.imp.mfc140u.dll_operator_1]
mov dword [edi + 0x1c], eax
mov ecx, dword [ebp + 0xc]
mov ecx, dword [ecx - 0xc]
inc ecx
push ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax - 0xc]
push 0
push 0
push ecx
push dword [edi + 0x1c]
push ecx
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov al, byte [ebp + 0x10]
mov byte [edi + 0x20], al
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x24], eax
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov byte [ebp - 4], 1
push str.iabout.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [edi], eax
test eax, eax
je 0x408403
push str.iToolsAboutInitialize
push eax
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [edi + 4], eax
push str.iToolsAboutUninitialize
push dword [edi]
call esi
mov dword [edi + 8], eax
push str.iToolsShowSplashScreen
push dword [edi]
call esi
mov dword [edi + 0xc], eax
push str.iToolsRemoveSplashScreen
push dword [edi]
call esi
mov dword [edi + 0x10], eax
push str.iToolsShowAboutBox
push dword [edi]
call esi
mov dword [edi + 0x14], eax
mov eax, dword [edi + 4]
test eax, eax
je 0x4083b8
call eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40e220
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55f800
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 4], 0
cmp byte [esi + 0x510], 0
je 0x40e287
push 0x402
push str.c:DevjenkinsworkspaceiTools_for_IDMDeployer_V9.87_servermodbusMainFrm.cpp
push 0x587798
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec040
add esp, 0x10
jmp 0x40e343
mov dword [ebp - 0x18], 0
cmp dword [esi + 0x50c], 0
je 0x40e29e
mov al, 1
jmp 0x40e345
cmp dword [esi + 0x514], 0
jne 0x40e2bb
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x514], eax
lea eax, [ebp - 0x18]
push eax
push 0
push esi
push 0x40e4a0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x50c], eax
test eax, eax
jne 0x40e297
push str.Failed_to_start_General_Service_Handling_Thread
push 0x3e9
mov eax, dword [0x641a88]
add eax, 0x32c
push eax
call fcn.004ec2c0
add esp, 0xc
jmp 0x40e343
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret
Function at 0x414ef0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5608ed
mov eax, dword fs:[0]
push eax
sub esp, 0x810
mov eax, dword [0x640040]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp byte [esi + 0x1b09], 0
je 0x41513f
push dword [esi + 0x1adc]
mov eax, dword [0x641a88]
push str.Disconnecting_Modem_on_hardware_port__s
add eax, 0x32c
push 0x3eb
push eax
call fcn.004ec2c0
add esp, 0x10
mov dword [ebp - 0x818], 0
lea eax, [ebp - 0x410]
mov dword [ebp - 0x814], 0
push 0
push 0
push 0x400
push eax
push 0xffffffffffffffff
push 0x58f568
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xbb8
call ebx
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x414fa0
push 0
lea eax, [ebp - 0x818]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x410]
push eax
push dword [esi + 0x1ad8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0xbb8
call ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
lea eax, [ebp - 0x814]
push 0
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push dword [esi + 0x1ad8]
call ebx
mov eax, dword [ebp - 0x814]
cmp eax, 0x400
jae 0x41515c
mov byte [ebp + eax - 0x810], 0
test eax, eax
je 0x415059
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x81c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__20]
mov dword [ebp - 4], 0
push dword [eax]
mov eax, dword [0x641a88]
push 0x58f570
add eax, 0x32c
push 0x3eb
push eax
call fcn.004ec2c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
push 0
push 0
push 0x400
lea eax, [ebp - 0x410]
push eax
push 0xffffffffffffffff
push str.ATH0_r_n
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea ecx, [ebp - 0x410]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x415083
push 0
lea eax, [ebp - 0x818]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x410]
push eax
push dword [esi + 0x1ad8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x814]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push dword [esi + 0x1ad8]
call ebx
mov eax, dword [ebp - 0x814]
cmp eax, 0x400
jae 0x41515c
mov byte [ebp + eax - 0x810], 0
test eax, eax
je 0x41512f
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x81c]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__20]
mov dword [ebp - 4], 1
push dword [eax]
mov eax, dword [0x641a88]
push 0x58f570
add eax, 0x32c
push 0x3eb
push eax
call fcn.004ec2c0
add esp, 0x10
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x81c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor eax, eax
mov byte [esi + 0x1b09], 0
mov word [esi + 0x1b0a], ax
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0055c86d
mov esp, ebp
pop ebp
ret
call fcn.0055c99e
int3