joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d990
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor eax, eax
cmp dword [0x457b54], 1
jne 0x40d9cd
or eax, 0xffffffff
push 0x41
push 0
push 0
push 0xfffff830
push 0xfffff830
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
ret

Function at 0x40da20
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
sub esp, 0x20
push ebx
push edi
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
cmp dword [0x457b54], 1
jne 0x40da4d
or eax, 8
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [esp + 0x2c], 0
mov ecx, dword [esi + 0x884]
push 0
je 0x40dad1
push 0x32
push 0x32
push 0xffffffffffffff9c
push 0xffffffffffffff9c
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esi + 0x928]
mov eax, dword [edx + 0x28]
lea ecx, [esi + 0x928]
push 1
push 0x448890
call eax
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esi + 0x940], eax
jmp 0x40dae9
push 0x172
push 0x26c
push 0x10f
push 0x38
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
cmp byte [esi + 0x9f8], 0
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0x49
je 0x40db04
mov edi, 0x4b
jmp 0x40db12
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 0
mov ecx, esi
call eax
push eax
call ebx
xor ecx, ecx
cmp dword [0x457b54], 1
jne 0x40db20
or ecx, 0xffffffff
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x14]
push edi
add eax, dword [esp + 0x28]
push 0
cdq
sub eax, edx
sar eax, 1
push 0
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x20]
add eax, dword [esp + 0x30]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
push eax
mov eax, dword [edx + 0x48]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 1
mov ecx, esi
call eax
push eax
call ebx
pop edi
pop ebx
add esp, 0x20
ret 4
Function at 0x410f50
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov word [esp + 0xc], cx
mov ecx, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x410f82
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xc]
call fcn.00405100
push str._ShowDeskTop
mov ebx, 0xc
xor eax, eax
mov edx, esi
call fcn.00404e30
cmp eax, 0xffffffff
setne bl
cmp dword [esp + 0x20], 8
jb 0x410fc8
mov edx, dword [esp + 0xc]
push edx
call fcn.004283fc
add esp, 4
mov ecx, dword [esp + 0x24]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00428407
add esp, 0x20
ret

Function at 0x4111d0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push 0xffffffffffffffff
push 0x443422
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov edi, dword [esp + 0x28]
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov dword [edi], 0x448edc
mov dword [edi + 0x58], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
lea esi, [edi + 8]
push esi
mov dword [esp + 0x24], ebx
push edi
mov dword [esp + 0x1c], 1
call fcn.004120f0
mov dword [esp + 0x20], 1
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push esi
mov dword [edi + ecx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.00412880
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x48], bl
mov byte [esi + 0x41], bl
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ebx
mov eax, dword [esi + 0x24]
mov dword [eax], ebx
mov ecx, dword [esi + 0x34]
mov dword [ecx], ebx
mov edx, dword [esi + 0x10]
mov dword [edx], ebx
mov eax, dword [esi + 0x20]
mov edx, dword [0x457bf4]
mov dword [eax], ebx
mov ecx, dword [esi + 0x30]
mov dword [ecx], ebx
mov dword [esi + 0x4c], ebx
mov dword [esi + 0x44], edx
mov dword [esi + 0x3c], ebx
mov eax, dword [esp + 0x2c]
push eax
mov ebx, esi
mov byte [esp + 0x24], 2
call fcn.00412190
test eax, eax
jne 0x4112d5
mov ecx, dword [edi]
mov ecx, dword [ecx + 4]
mov eax, dword [ecx + edi + 8]
add ecx, edi
or eax, 2
cmp dword [ecx + 0x28], 0
jne 0x4112c3
or eax, 4
and eax, 0x17
mov dword [ecx + 8], eax
test dword [ecx + 0xc], eax
je 0x4112d5
push 0
call fcn.004142c0
mov eax, edi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x417430
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4428dc
mov eax, dword fs:[0]
push eax
sub esp, 0x248
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x244], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x25c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x26c]
xor ebx, ebx
mov eax, 1
mov dword [esp + 0x30], ebx
test byte [0x457dd4], al
jne 0x4174b0
or dword [0x457dd4], eax
xor eax, eax
push 0x443f30
mov dword [0x457dd0], 7
mov dword [0x457dcc], ebx
mov word [0x457dbc], ax
call fcn.00429ab3
add esp, 4
cmp dword [0x457dcc], ebx
je 0x4174d0
xor ecx, ecx
push 0xffffffffffffffff
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], ebx
mov word [ebp + 4], cx
push ebx
jmp 0x41766d
push ebx
push 0x1a
lea edx, [esp + 0x58]
push edx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [esp + 0x50]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4174e6
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x54]
mov esi, 0x457db8
call fcn.00405100
mov edi, esi
lea eax, [esp + 0x14]
call fcn.004171d0
push 0xffffffffffffffff
push ebx
mov ecx, esi
mov dword [esp + 0x26c], ebx
call fcn.00405010
mov edi, 8
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x417543
mov eax, dword [esp + 0x18]
push eax
call fcn.004283fc
add esp, 4
push 0x457db8
mov ebx, str.liebao_
lea esi, [esp + 0x18]
call fcn.00412c00
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, 0x457db8
mov dword [esp + 0x26c], 1
call fcn.00405010
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x417590
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004283fc
add esp, 4
push 0x457db8
mov ebx, str.qqtx
lea esi, [esp + 0x18]
call fcn.00412c00
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, 0x457db8
mov dword [esp + 0x26c], 2
call fcn.00405010
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x2c], edi
jb 0x4175dd
mov edx, dword [esp + 0x18]
push edx
call fcn.004283fc
add esp, 4
push 0x457db8
mov ebx, 0x4495cc
lea esi, [esp + 0x38]
call fcn.00412c00
add esp, 4
push 0xffffffffffffffff
push 0
mov ecx, 0x457db8
mov dword [esp + 0x26c], 3
call fcn.00405010
mov dword [esp + 0x264], 0xffffffff
cmp dword [esp + 0x4c], edi
jb 0x41762a
mov eax, dword [esp + 0x38]
push eax
call fcn.004283fc
add esp, 4
xor ecx, ecx
cmp dword [0x457dd0], edi
mov edi, dword [0x457dbc]
mov esi, 7
mov dword [esp + 0x4c], esi
mov dword [esp + 0x48], 0
mov word [esp + 0x38], cx
jae 0x417655
mov edi, 0x457dbc
call fcn.004176b0
xor edx, edx
push 0xffffffffffffffff
mov dword [ebp + 0x18], esi
mov dword [ebp + 0x14], 0
mov word [ebp + 4], dx
push edx
mov eax, 0x457db8
mov ecx, ebp
call fcn.00405010
mov eax, ebp
mov ecx, dword [esp + 0x25c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.00428407
add esp, 0x254
ret
Function at 0x4176b0
Capabilities:
Check if file exists
Create directory

Disassembly:
push 0xffffffffffffffff
push 0x441cd8
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push ebp
push esi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
xor ebx, ebx
cmp edi, ebx
je 0x41776d
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebp
xor eax, eax
mov word [esp + 0x30], ax
mov eax, edi
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], ebx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x417710
sub eax, edx
sar eax, 1
push eax
mov eax, edi
lea esi, [esp + 0x30]
call fcn.00405100
mov dword [esp + 0x54], ebx
push 0x4495cc
mov ebx, 1
xor eax, eax
mov edx, esi
call fcn.00404e30
mov esi, eax
cmp esi, 0xffffffff
jne 0x417774
push edi
call ebp
test eax, eax
jne 0x417800
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x417800
lea esi, [esp + 0x2c]
call fcn.004133b0
xor al, al
jmp 0x41782d
lea ecx, [esp + 0x2c]
lea ebp, [esi + 1]
push ecx
mov ecx, ebp
xor edx, edx
lea esi, [esp + 0x14]
call fcn.0040dea0
mov eax, dword [esp + 0x14]
mov esi, 8
cmp dword [esp + 0x28], esi
jae 0x41779c
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4177c6
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], esi
jae 0x4177b5
lea eax, [esp + 0x14]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x41784b
push 0x4495cc
mov ebx, 1
mov eax, ebp
lea edx, [esp + 0x30]
call fcn.00404e30
cmp dword [esp + 0x28], 8
mov esi, eax
jb 0x4177f1
mov edx, dword [esp + 0x14]
push edx
call fcn.004283fc
add esp, 4
cmp esi, 0xffffffff
jne 0x417774
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebp
test eax, eax
jne 0x417817
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x417764
cmp dword [esp + 0x44], 8
jb 0x41782b
mov eax, dword [esp + 0x30]
push eax
call fcn.004283fc
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00428407
add esp, 0x48
ret
cmp dword [esp + 0x28], esi
jb 0x41785e
mov eax, dword [esp + 0x14]
push eax
call fcn.004283fc
add esp, 4
xor ecx, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], cx
cmp dword [esp + 0x44], esi
jb 0x417888
mov edx, dword [esp + 0x30]
push edx
call fcn.004283fc
add esp, 4
xor al, al
jmp 0x41782d
Function at 0x421d30
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x441bc8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4531a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4c]
mov ebp, dword [esp + 0x48]
xor edi, edi
mov dword [esp + 0x14], edi
xor ecx, ecx
mov word [esp + 0x1c], cx
mov ecx, eax
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
lea esi, [ecx + 2]
jmp 0x421d90
mov dx, word [ecx]
add ecx, 2
cmp dx, di
jne 0x421d90
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0x1c]
call fcn.00405100
mov dword [esp + 0x40], edi
lea edi, [esp + 0x14]
mov ebx, esi
mov dword [esp + 0x14], 0x2f
call fcn.00422400
mov esi, ebp
cmp eax, 0xffffffff
jne 0x421df4
xor edx, edx
mov dword [ebp + 0x18], 7
mov dword [ebp + 0x14], 0
push edx
mov eax, 0x44813c
mov word [ebp + 4], dx
call fcn.00405100
cmp dword [esp + 0x30], 8
jb 0x421e18
mov eax, dword [esp + 0x1c]
push eax
jmp 0x421e10
lea ecx, [esp + 0x18]
push ecx
lea edx, [eax + 1]
or ecx, 0xffffffff
call fcn.0040dea0
cmp dword [esp + 0x30], 8
jb 0x421e18
mov edx, dword [esp + 0x1c]
push edx
call fcn.004283fc
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.00428407
add esp, 0x30
ret 8
Function at 0x422c30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x518
mov eax, dword [0x4531a0]
xor eax, esp
mov dword [esp + 0x514], eax
push ebx
xor ebx, ebx
cmp edi, ebx
jne 0x422c63
xor al, al
pop ebx
mov ecx, dword [esp + 0x514]
xor ecx, esp
call fcn.00428407
add esp, 0x518
ret
push esi
push 0x3ff
lea eax, [esp + 0x121]
push ebx
push eax
mov byte [esp + 0x128], bl
call fcn.0042c510
push 0xfe
lea edx, [esp + 0x2e]
xor ecx, ecx
push ebx
mov esi, 0x400
push edx
mov dword [esp + 0x20], esi
mov word [esp + 0x34], cx
call fcn.0042c510
lea eax, [esp + 0x34]
add esp, 0x18
lea ecx, [edi + 8]
test eax, eax
je 0x422cd3
cmp ecx, ebx
je 0x422cd3
mov eax, ecx
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x422cb5
sub eax, esi
inc eax
push eax
lea edx, [esp + 0x20]
push edx
push eax
push ecx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov esi, dword [esp + 8]
lea eax, [esp + 0x1c]
push eax
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_sConnection
push 0xffffffffffffffff
shr esi, 1
lea ecx, [esp + 0x128]
push esi
push ecx
call fcn.00428b30
add esp, 0x14
lea edx, [esp + 0xc]
push edx
push 0x20019
push ebx
lea eax, [esp + 0x128]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x422d31
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x514]
xor ecx, esp
call fcn.00428407
add esp, 0x518
ret
push 0x400
lea ecx, [esp + 0x120]
push ebx
push ecx
mov dword [esp + 0x1c], ebx
call fcn.0042c510
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
add esp, 0xc
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x120]
push eax
lea ecx, [esp + 0x18]
push ecx
push ebx
push str.PnpInstanceID
push edx
call esi
test eax, eax
jne 0x422e26
lea ecx, [esp + 0x11c]
push ecx
push 0x449bf0
push 0xffffffffffffffff
lea edx, [esp + 0x20]
push 4
push edx
mov word [esp + 0x28], ax
mov dword [esp + 0x2a], eax
mov word [esp + 0x2e], ax
call fcn.00428b30
lea eax, [esp + 0x28]
push 4
push eax
call fcn.0042bbea
lea ecx, [esp + 0x30]
push 0x449bf8
push ecx
call fcn.0042bd12
add esp, 0x24
test eax, eax
jne 0x422e26
call fcn.00422bd0
test al, al
je 0x422dd5
cmp dword [edi + 0x1a0], 6
jmp 0x422e22
push 0x400
lea edx, [esp + 0x120]
push ebx
push edx
call fcn.0042c510
add esp, 0xc
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x18]
push edx
push ebx
push str.MediaSubType
push eax
mov dword [esp + 0x20], 0x400
mov dword [esp + 0x28], ebx
call esi
test eax, eax
jne 0x422e26
cmp dword [esp + 0x11c], 1
jne 0x422e26
mov bl, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x51c]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00428407
add esp, 0x518
ret
Function at 0x401064
Capabilities:
Terminate process

Disassembly:
jmp 0x426d58
push ebp
sub esp, 0x5c
lea ebp, [esp - 4]
mov eax, dword [0x4776c8]
xor eax, ebp
mov dword [ebp + 0x5c], eax
push 0x134
mov eax, 0x45e788
call fcn.0042942c
push 0xf
pop esi
xor edi, edi
push edi
lea ecx, [ebp + 0x40]
mov dword [ebp + 0x58], esi
call fcn.0040168b
push edi
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp + 0x20], esi
call fcn.0040168b
push edi
lea ecx, [ebp + 0x24]
mov dword [ebp + 0x3c], esi
call fcn.0040168b
fld qword [ebp + 0x70]
push str.programD_NameSm.txt
fstp qword [ebp]
lea eax, [ebp - 0x28]
push 0x477354
push eax
mov byte [ebp - 4], 2
call fcn.00401285
add esp, 0xc
push 0xffffffffffffffff
push edi
push eax
lea ecx, [ebp + 0x24]
mov byte [ebp - 4], 3
call fcn.00401668
xor ebx, ebx
push edi
inc ebx
push ebx
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.0040150a
cmp dword [ebp + 0x3c], 0x10
mov eax, dword [ebp + 0x28]
jae 0x426df2
lea eax, [ebp + 0x28]
push ebx
push 0x40
pop esi
push esi
push ebx
push eax
lea ecx, [ebp - 0x140]
call fcn.00401721
mov eax, dword [ebp - 0x140]
mov eax, dword [eax + 4]
lea eax, [ebp + eax - 0x140]
mov ecx, dword [eax + 8]
and cl, 6
neg cl
mov byte [ebp - 4], 4
sbb ecx, ecx
not ecx
test eax, ecx
je 0x426f7d
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x140]
push eax
call fcn.00401073
pop ecx
pop ecx
lea ecx, [ebp - 0x140]
call fcn.004014dd
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x426e55
lea eax, [ebp + 0xc]
push ebx
push esi
push ebx
push eax
lea ecx, [ebp - 0xb4]
call fcn.00401721
mov eax, dword [ebp - 0xb4]
mov ecx, dword [eax + 4]
lea eax, [ebp + ecx - 0xb4]
mov edx, dword [eax + 8]
and dl, 6
neg dl
mov byte [ebp - 4], 5
sbb edx, edx
not edx
test eax, edx
je 0x426f65
test byte [ebp + ecx - 0xac], bl
jne 0x426f01
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp - 0xb4]
push eax
call fcn.00401073
cmp dword [ebp + 0x58], 0x10
mov eax, dword [ebp + 0x44]
pop ecx
pop ecx
jae 0x426eb3
lea eax, [ebp + 0x44]
push eax
call fcn.0042a51d
fldz
pop ecx
push eax
sub esp, 0x20
fstp qword [esp + 0x18]
fld qword [0x463370]
fstp qword [esp + 0x10]
fld qword [ebp]
fstp qword [esp + 8]
fld qword [ebp + 0x68]
fstp qword [esp]
call fcn.0040127b
fld qword [ebp]
mov eax, dword [ebp - 0xb4]
fsub qword [0x4634b0]
mov eax, dword [eax + 4]
add esp, 0x24
test byte [ebp + eax - 0xac], bl
fstp qword [ebp]
je 0x426e95
lea ecx, [ebp - 0xb4]
call fcn.004014dd
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
call fcn.00401776
lea ecx, [ebp - 0x140]
mov byte [ebp - 4], 2
call fcn.00401776
push edi
push ebx
lea ecx, [ebp + 0x24]
call fcn.0040150a
push edi
push ebx
lea ecx, [ebp + 8]
call fcn.0040150a
push edi
push ebx
lea ecx, [ebp + 0x40]
call fcn.0040150a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x5c]
xor ecx, ebp
call fcn.00427492
add ebp, 0x60
leave
ret
push esi
push 0x463b84
push 0x4644bc
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
push ebx
call fcn.00427406
push esi
push 0x463b84
push 0x46449c
jmp 0x426f70
Function at 0x40148d
Capabilities:
Terminate process

Disassembly:
jmp 0x4268f2
push 0x40
mov eax, 0x45e720
call fcn.00429495
xor esi, esi
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.0040168b
push str.programD_Color.txt
lea eax, [ebp - 0x4c]
push 0x477354
push eax
mov dword [ebp - 4], esi
call fcn.00401285
add esp, 0xc
push 0xffffffffffffffff
push esi
push eax
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.00401668
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.0040150a
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x426950
lea eax, [ebp - 0x28]
push 0x46374c
push eax
lea eax, [ebp - 0x30]
push eax
call fcn.00428266
add esp, 0xc
test eax, eax
je 0x426980
push 0x40
push 0x463f20
push 0x464344
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call fcn.00427406
push 0x479f4c
push 0x479f40
push 0x479f48
push str._ld__ld__ld
push dword [ebp - 0x30]
call fcn.00428153
push dword [ebp - 0x30]
call fcn.00427f5e
fld qword [0x464328]
fld qword [0x479b58]
add esp, 0x18
fcom st(1)
fnstsw ax
fstp st(1)
test ah, 0x41
jp 0x4269c8
fstp st(0)
fld qword [0x463370]
jmp 0x426a24
fld qword [0x464318]
fcomp st(1)
fnstsw ax
test ah, 1
jne 0x4269e1
fstp st(0)
fld qword [0x463270]
jmp 0x426a24
fld qword [0x464308]
fcomp st(1)
fnstsw ax
test ah, 1
jne 0x4269fa
fstp st(0)
fld qword [0x4634b0]
jmp 0x426a24
fld qword [0x4642f8]
fcom st(1)
fnstsw ax
test ah, 1
jne 0x426a15
fstp st(1)
fstp st(0)
fld qword [0x463170]
jmp 0x426a24
fcompp
fnstsw ax
test ah, 5
jp 0x426a2a
fld qword [0x463410]
fstp qword [0x4794a0]
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040150a
call fcn.00429518
ret
Function at 0x401541
Capabilities:
Write file on windows

Disassembly:
jmp 0x41e4b3
push 0x48
mov eax, 0x45e1b4
call fcn.00429495
mov esi, ecx
xor edi, edi
cmp dword [esi + 0x3c], edi
je 0x41e5bf
cmp byte [esi + 0x41], 0
je 0x41e5bf
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x41e4e9
xor al, al
jmp 0x41e5c1
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00401744
mov dword [ebp - 4], edi
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401091
mov ecx, eax
call fcn.00401389
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401091
mov ecx, eax
call fcn.00401389
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x41e559
dec eax
je 0x41e55d
dec eax
dec eax
je 0x41e5bb
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.0040150a
mov al, bl
jmp 0x41e5c1
mov byte [esi + 0x41], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401091
mov ecx, eax
call fcn.00401389
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x41e59d
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401091
mov ecx, eax
call fcn.00401389
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00429fbe
add esp, 0x10
cmp edi, eax
jne 0x41e547
cmp byte [esi + 0x41], 0
je 0x41e5bb
test edi, edi
jne 0x41e4f7
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.004017c1
jmp 0x41e4f7
mov bl, 1
jmp 0x41e549
mov al, 1
call fcn.00429518
ret