joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x10028a0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x10028b6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x10028d1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret

Function at 0x10028e0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
push ebx
movzx ebx, word [ecx + 6]
add eax, 0x18
push esi
xor edx, edx
add eax, ecx
push edi
test ebx, ebx
je 0x100291e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x1002916
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x1002920
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x1002906
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x4073e2
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461134], 0
jne 0x407420
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4073f6
mov dword [ecx*4 + 0x461130], eax
inc ecx
cmp ecx, 0x100
jl 0x4073f1
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x40744d
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461130]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x40742e
not eax
pop ebp
ret 0xc

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x403daa
nop
sub eax, 0x403d50
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219
Function at 0x10008c80
Capabilities:
Allocate or change rwx memory
Create process on windows
Encode data using base64
Execute anti-debugging instructions
Execute shellcode via indirect call
Hide graphical window
Parse credit card information
Parse pe header
Resume thread

Disassembly:
jmp 0x100094d4
push ebp
bsr eax, esi
sub ax, 0x488d
jmp 0x1001009f
mov ebp, esp
bt ax, 0x28
sub eax, 0x72902bbd
sal ax, cl
push ebx
bsr eax, edx
push edi
xor ah, bl
push esi
sub esp, 0x1a8
mov eax, dword [0x1007a400]
xor eax, ebp
test ecx, 0x36816f34
jmp 0x10015a8b
mov dword [ebp - 0x10], eax
test cl, al
mov dword [ebp - 0x1a8], 0xb1bda9ac
bswap eax

Function at 0x1001ad30
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x1001ad6f
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1001ad6f
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ad6f
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x1001ad6f
cmp dword [ecx + 0x74], 0xe
jbe 0x1001ad6f
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1001da2d
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1001daca
push ebx
push esi
call fcn.1001d9f6
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1001d98a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1001da77
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001dac9
push edi
push eax
call fcn.1001ba6d
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1001da97
call fcn.1001c4d2
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1001dac8
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1001d98a
add esp, 0x20
test eax, eax
jne 0x1001dab6
push edi
call fcn.1001c4d2
jmp 0x1001dabe
push ebx
call fcn.1001c4d2
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x1001dd37
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025d10
push 0x10025d08
push str.FlsAlloc
push 0x1f
call fcn.1001dc53
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001dd6b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002414c]
call esi
jmp 0x1001dd71
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1001ddb5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025d20
push 0x10025d18
push str.FlsGetValue
push 0x21
call fcn.1001dc53
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001ddec
push dword [ebp + 8]
mov ecx, esi
call dword [0x1002414c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1001ddf4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10025d28
push 0x10025d20
push str.FlsSetValue
push 0x22
call fcn.1001dc53
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1001de2e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1002414c]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100233d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100233fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100233fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x183bdd0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe5b000]
push edi
or ebp, 0xffffffff
jmp 0x183bdf2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x183bdf9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x183bde8
mov eax, 1
add ebx, ebx
jne 0x183be0b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x183be1c
jne 0x183be3b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x183be3b
dec eax
add ebx, ebx
jne 0x183be28
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x183be00
add ebx, ebx
jne 0x183be37
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x183be8d
xor ecx, ecx
sub eax, 3
jb 0x183be53
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x183bec2
sar eax, 1
mov ebp, eax
jmp 0x183be5e
add ebx, ebx
jne 0x183be5e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x183be2c
inc ecx
add ebx, ebx
jne 0x183be6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x183be2c
add ebx, ebx
jne 0x183be79
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x183be6e
jne 0x183be8a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x183be6e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x183beac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x183be9e
jmp 0x183bdee
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x183beac
add edi, ecx
jmp 0x183bdee
pop esi
mov edi, esi
mov ecx, 0x450d41
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x183bee7
cmp byte [edi], 0x9c
jne 0x183becc
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x183beca
lea edi, [esi + 0x1437000]
mov eax, dword [edi]
or eax, eax
je 0x183bf2f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1440c14]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1440d90]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x183beed
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1440d94]
or eax, eax
je 0x183bf29
mov dword [ebx], eax
add ebx, 4
jmp 0x183bf0a
call dword [esi + 0x1440da4]
mov ebp, dword [esi + 0x1440d98]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x183bf63
sub esp, 0xffffff80
jmp 0x8a47a4
Function at 0x40a500
Capabilities:
Set registry value

Disassembly:
sub esp, 8
push esi
mov esi, eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareBinary_NoiseSoda_Player
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40a5b0
push edi
mov edi, dword [esp + 8]
test edi, edi
je 0x40a5af
lea ebx, [ebx]
cmp dword [eax*8 + 0x41c030], esi
je 0x40a552
inc eax
cmp eax, 0xa
jb 0x40a540
or eax, 0xffffffff
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
lea edx, [esp + 0x18]
push edx
push 4
push 0
push str.Randomize
push edi
mov dword [esp + 0x20], eax
call esi
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push 0
push str.Transparent
push edi
call esi
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.ModelNumber
push edi
call esi
push 4
lea edx, [esp + 0x20]
push edx
push 4
push 0
push str.Large
push edi
call esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
add esp, 8
ret

Function at 0x40a5c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0x10]
push edi
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x18]
push edx
push 0
push 0xf003f
push 0
push 0
mov edi, eax
mov eax, dword [esp + 0x28]
push 0
mov dword [edi], 0
mov dword [eax], 1
push str.SoftwareBinary_NoiseSoda_Player
mov dword [ebp], 0
push SysReAllocString
mov dword [ebx], 5
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40a697
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40a696
lea eax, [esp + 0x18]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
push ecx
push 0
push str.Randomize
push esi
mov dword [esp + 0x30], 4
call edi
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push eax
lea ecx, [esp + 0x14]
push ecx
push 0
push str.Transparent
push esi
call edi
lea edx, [esp + 0x18]
push edx
push ebx
lea eax, [esp + 0x14]
push eax
push 0
push str.ModelNumber
push esi
call edi
lea ecx, [esp + 0x18]
push ecx
push ebp
lea edx, [esp + 0x14]
push edx
push 0
push str.Large
push esi
call edi
cmp dword [ebx], 0xa
jb 0x40a68f
mov dword [ebx], 5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
pop ebp
pop ecx
ret
Function at 0x40a7d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 8]
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
push 0x41a24c
push eax
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40a88c
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40a88b
cmp ebp, 2
jbe 0x40a88b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40a88b
push pe_nt_image_headers32
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x40a87a
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, eax
call fcn.00409ae0
mov ebx, eax
test ebx, ebx
je 0x40a88b
cmp byte [esi], 0x5a
jne 0x40a883
cmp byte [esi + 1], 0x5a
jne 0x40a883
push 0
lea edx, [esp + 0x1c]
push edx
push esi
call fcn.00416c60
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40a88b
push esi
mov ecx, ebx
call fcn.00409f00
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret
pop ebp
pop edi
xor ebx, ebx
pop esi
mov eax, ebx
pop ebx
ret
push esi
mov ecx, ebx
call fcn.00409f00
pop ebp
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x40b3f0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x41d2a0]
push edi
push 0
push eax
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push SysReAllocString
push str.Soda
push str.SODA
push 0x80088
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edi, eax
test edi, edi
je 0x40b4a7
push ebx
push esi
push 0x200
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x40b44a
push edi
mov ecx, eax
call fcn.0040b320
mov esi, eax
jmp 0x40b44c
xor esi, esi
mov ebx, dword [esp + 0x14]
push ebx
mov ecx, esi
call fcn.00409bc0
push ebx
lea ecx, [esi + 0xf8]
call fcn.00409bc0
push esi
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov eax, dword [esp + 0x10]
fld qword [eax + 0x68]
push 0
push 0x32
fstp qword [esi + 0x68]
mov cl, byte [eax + 0xe0]
push 1
push edi
mov byte [esi + 0xe0], cl
call dword [sym.imp.USER32.dll_SetTimer]
push 5
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
push edi
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebx
mov al, 1
pop edi
ret
xor al, al
pop edi
ret
Function at 0x40b510
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x28]
push 0
push edi
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push SysReAllocString
push str.Soda
push str.SODA
push 0x80088
mov dword [0x41d2a0], edi
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ebp, eax
test ebp, ebp
je 0x40b680
push 0x200
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x40b577
push ebp
mov ecx, eax
call fcn.0040b320
mov esi, eax
jmp 0x40b579
xor esi, esi
push esi
push 0
push ebp
call dword [sym.imp.USER32.dll_SetWindowLongA]
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x24]
push ecx
lea ebx, [esp + 0x18]
lea eax, [esp + 0x24]
call fcn.0040a5c0
mov edx, dword [esp + 0x18]
mov eax, dword [edx*8 + 0x41c030]
push eax
push edi
call fcn.0040a7d0
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x40b680
push ebx
mov ecx, esi
call fcn.00409bc0
push ebx
lea ecx, [esi + 0xf8]
call fcn.00409bc0
xor edi, edi
nop
mov ecx, dword [edi + 0x41c030]
mov edx, dword [esp + 0x28]
push ecx
push edx
call fcn.0040a7d0
add esp, 8
test eax, eax
mov dword [esp + 0x14], eax
je 0x40b5fd
push 0
lea eax, [esp + 0x18]
push eax
mov ecx, 0x41d2a4
call fcn.0040ab20
add edi, 8
cmp edi, 0x50
jb 0x40b5d0
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40b615
fld dword [0x41a790]
jmp 0x40b61b
fld dword [0x41a78c]
sub esp, 8
mov ecx, esi
fstp qword [esp]
call fcn.00406c30
mov eax, dword [esp + 0x1c]
test eax, eax
setne cl
push 0
mov byte [esi + 0x90], cl
mov edi, dword [esp + 0x24]
push 0x32
test edi, edi
push 1
setne dl
push ebp
mov byte [esi + 0xe0], dl
call dword [sym.imp.USER32.dll_SetTimer]
mov eax, dword [esp + 0x2c]
push eax
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push ebp
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, ebx
call fcn.00409b90
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x14
ret
Function at 0x40c910
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x40c91d
xor eax, eax
pop esi
ret
push ebx
mov ebx, dword [esp + 0x10]
test ebx, ebx
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll__mbsnbicmp]
push edi
mov dword [esp + 0x14], 0
mov edi, esi
jle 0x40c9d5
lea esp, [esp]
mov al, byte [esi]
dec ebx
test al, al
je 0x40c9d5
cmp al, 0x26
jne 0x40c9c3
push 3
inc esi
push 0x41a804
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x40c969
add esi, 2
sub ebx, 3
jmp 0x40c9c3
push 3
push 0x41a800
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x40c982
add esi, 2
sub ebx, 3
jmp 0x40c9c3
push 4
push str.amp_
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x40c99b
add esi, 3
sub ebx, 4
jmp 0x40c9c3
push 5
push str.apos_
push esi
call ebp
add esp, 0xc
test eax, eax
je 0x40c9bd
push 5
push str.quot_
push esi
call ebp
add esp, 0xc
test eax, eax
jne 0x40ca28
add esi, 4
sub ebx, 5
mov edx, dword [esp + 0x14]
inc edx
inc esi
test ebx, ebx
mov dword [esp + 0x14], edx
jg 0x40c940
mov edx, dword [esp + 0x14]
inc edx
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov esi, eax
mov eax, dword [esp + 0x18]
add esp, 4
test eax, eax
mov ebx, esi
je 0x40caf0
mov dword [esp + 0x14], eax
jmp 0x40ca00
mov al, byte [edi]
cmp al, 0x26
jne 0x40cae2
push 3
inc edi
push 0x41a804
push edi
call ebp
add esp, 0xc
test eax, eax
jne 0x40ca8b
mov byte [esi], 0x3c
inc esi
add edi, 3
jmp 0x40cae6
mov al, byte [esi]
xor edi, edi
test al, al
je 0x40ca42
cmp al, 0x3b
je 0x40ca42
cmp edi, 0xa
jge 0x40ca42
mov al, byte [edi + esi + 1]
inc edi
test al, al
jne 0x40ca30
inc edi
lea eax, [edi + 1]
push eax
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test edi, edi
lea eax, [ebx + edi]
mov byte [eax], 0
je 0x40ca6a
sub esi, ebx
mov edi, edi
mov cl, byte [esi + eax - 1]
dec eax
dec edi
mov byte [eax], cl
jne 0x40ca60
push ebx
push str.unknown_escape_character:__s
call dword [sym.imp.MSVCRT.dll_printf]
push ebx
call dword [sym.imp.MSVCRT.dll_free]
add esp, 0xc
push 0xff
call dword [sym.imp.MSVCRT.dll_exit]
push 3
push 0x41a800
push edi
call ebp
add esp, 0xc
test eax, eax
jne 0x40caa5
mov byte [esi], 0x3e
inc esi
add edi, 3
jmp 0x40cae6
push 4
push str.amp_
push edi
call ebp
add esp, 0xc
test eax, eax
jne 0x40cabf
mov byte [esi], 0x26
inc esi
add edi, 4
jmp 0x40cae6
push 5
push str.apos_
push edi
call ebp
add esp, 0xc
test eax, eax
jne 0x40cad9
mov byte [esi], 0x27
inc esi
add edi, 5
jmp 0x40cae6
mov byte [esi], 0x22
inc esi
add edi, 5
jmp 0x40cae6
mov byte [esi], al
inc esi
inc edi
dec dword [esp + 0x14]
jne 0x40ca00
pop edi
pop ebp
mov eax, ebx
pop ebx
mov byte [esi], 0
pop esi
ret
Function at 0x40e1d0
Capabilities:
Read file on windows

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebx
push ebp
push 0x41a85c
push eax
call dword [sym.imp.MSVCRT.dll__wfopen]
mov ebp, eax
xor ebx, ebx
add esp, 8
cmp ebp, ebx
jne 0x40e221
mov eax, dword [esp + 0x1c]
cmp eax, ebx
je 0x40e202
mov dword [eax], 0xa
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
mov ecx, dword [0x41d4e0]
cmp ecx, ebx
mov eax, dword [esp + 0x10]
mov dword [eax], ecx
je 0x40e2e9
mov edx, dword [ecx + 0x30]
inc edx
pop ebp
mov dword [ecx + 0x30], edx
pop ebx
pop ecx
ret
push esi
push edi
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebx
push ebp
call edi
push ebp
call dword [sym.imp.MSVCRT.dll_ftell]
push ebx
push ebx
push ebp
mov esi, eax
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_malloc]
lea edx, [esi + 1]
push edx
call ebx
push ebp
push 1
mov edi, eax
push esi
push edi
call dword [sym.imp.MSVCRT.dll_fread]
push ebp
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x34
cmp esi, 0x2710
mov byte [edi + esi], 0
mov eax, esi
jl 0x40e273
mov eax, 0x2710
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_IsTextUnicode]
test eax, eax
je 0x40e2ac
sar esi, 1
lea ebp, [esi + 2]
push ebp
call ebx
add esp, 4
push 0
push 0
push ebp
mov ebx, eax
push ebx
push esi
push edi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push edi
call dword [sym.imp.MSVCRT.dll_free]
add esp, 4
mov edi, ebx
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x18]
push edi
push edx
call fcn.0040df70
push edi
call dword [sym.imp.MSVCRT.dll_free]
mov eax, dword [esp + 0x24]
mov esi, dword [esp + 0x2c]
add esp, 0x14
test eax, eax
mov dword [esi], eax
je 0x40e2dc
inc dword [eax + 0x30]
push eax
call fcn.0040d470
add esp, 4
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret