joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49c424
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x4bf0b0], 0
jne 0x49c4a5
cmp dword [0x4bf0d0], 0
jne 0x49c454
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x4bf0d0], eax
test eax, eax
jne 0x49c454
push str.GetEnvironmentStrings_failed
call fcn.0049bca4
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x4bf0d0]
jmp 0x49c468
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.00495908
pop ecx
mov edi, eax
test eax, eax
jne 0x49c460
lea edi, [ebp + 1]
push edi
call fcn.004951ec
pop ecx
mov ebx, eax
mov dword [0x4bf0b4], ebx
test ebx, ebx
jne 0x49c492
xor eax, eax
jmp 0x49c568
push edi
mov edx, dword [0x4bf0d0]
push edx
push ebx
call fcn.004957b8
add esp, 0xc
jmp 0x49c4c5
xor esi, esi
mov ebx, dword [0x4bf0b0]
jmp 0x49c4bf
push eax
call fcn.00495908
pop ecx
test eax, eax
jne 0x49c4bb
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x49c4af
lea ebx, [esi + 4]
push 4
mov dword [0x4bf0b8], ebx
inc ebx
push ebx
call fcn.00494cc4
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x49c4e8
xor eax, eax
jmp 0x49c568
cmp dword [0x4bf0b0], 0
jne 0x49c519
xor esi, esi
mov ebx, dword [0x4bf0b4]
mov eax, dword [esp]
mov ebp, eax
jmp 0x49c50a
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.00495908
pop ecx
mov edi, eax
test eax, eax
jne 0x49c500
jmp 0x49c54a
xor esi, esi
mov ebx, dword [0x4bf0b0]
mov eax, dword [esp]
mov edi, eax
jmp 0x49c544
push eax
call fcn.00495908
pop ecx
test eax, eax
je 0x49c539
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x49c53d
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x49c528
mov eax, dword [0x4bf0b0]
test eax, eax
je 0x49c55a
push eax
call fcn.004951fc
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x4bf0b0], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4a2dd0
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4a2dfe
mov eax, ebx
call fcn.004a3888
cmp dword [ebx + 0x3c], 0
je 0x4a2df7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4a2e6f
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4a2e61
cmp dword [ebx + 8], 0
je 0x4a2e20
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4a2e32
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4a2e61
cmp dword [ebx + 8], 0
je 0x4a2e13
cmp eax, 3
je 0x4a2e45
dec eax
jne 0x4a2e13
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4a2e13
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4a2e13
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4a2e8d
cmp dword [ebx + 0x10], 0xcc
je 0x4a2e8d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004a2e98
pop ebx
ret
Function at 0x401000
Capabilities:
Allocate thread local storage

Disassembly:
push 0x30
push 0
push 0x470988
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call sub.KERNEL32.DLL_GetModuleHandleW
mov dword [0x47098c], eax
push 0
push 0x1000
push 0
call sub.KERNEL32.DLL_HeapCreate
mov dword [0x470988], eax
call fcn.004286a0
call fcn.00427cd0
call fcn.00427ba5
call fcn.00426ff9
call fcn.00426887
call fcn.004267f5
call fcn.00425716
call fcn.0042552b
call fcn.00424d70
call fcn.00423d7b
call fcn.00422769
call fcn.00421bc5
call fcn.004064b0
call fcn.00406237
lea eax, [0x402711]
push eax
lea eax, [0x402394]
push eax
lea eax, [0x4026ac]
push eax
lea eax, [0x402821]
push eax
lea eax, [0x402000]
push eax
call fcn.0040302e
push 0
push 0x451020
call fcn.0040317a
mov dword [0x4709ac], eax
push dword [0x4709ac]
call fcn.004032a1
push 1
push str._a_z0_9_._____a_z0_9.__._a_z_2_4_
push 0
call fcn.004064f0
push 0x109
push 0x163
push 0
push 0
call fcn.0040204d
call fcn.00423ebc
mov dword [0x4709a0], eax
push dword [0x4709a0]
call fcn.004023f4
mov ebx, eax
and ebx, ebx
jne 0x4010f9
push 0
call 0x401133
call fcn.004286f0
push dword [0x470988]
call sub.KERNEL32.DLL_HeapDestroy
call sub.KERNEL32.DLL_ExitProcess
call fcn.004064e0
call fcn.004227d9
call fcn.00423d64
call fcn.00424c15
call fcn.00424d60
call fcn.004255f4
call fcn.0042687b
call fcn.00427094
call fcn.00427cf0
ret
Function at 0x4023f4
Capabilities:
Get common file path

Disassembly:
push ebx
xor eax, eax
push eax
push eax
push eax
push dword [esp + 0x14]
mov ebx, 0x333c
cmp ebx, dword [esp]
jne 0x402417
xor eax, eax
add esp, 4
jmp 0x40268b
mov ebx, 0x332d
cmp ebx, dword [esp]
jne 0x40242d
call fcn.00425601
push eax
pop eax
jmp 0x402681
mov ebx, 0x332c
cmp ebx, dword [esp]
jne 0x402681
call fcn.00425610
push eax
mov ebx, dword [0x470990]
cmp ebx, dword [esp]
jne 0x402456
jmp 0x401114
mov ebx, dword [0x470994]
cmp ebx, dword [esp]
jne 0x402475
push str.Keyword_Researcher_Pro_v10.72__c__Clever_Gizmos_r_nKeyfile_Maker_by_d__DVT
push str.About
call fcn.0040629d
jmp 0x402680
mov ebx, dword [0x4709b4]
cmp ebx, dword [esp]
jne 0x402680
push dword [0x470df0]
push dword [0x470df0]
push dword [0x47099c]
call fcn.00423843
lea eax, [esp + 0xc]
push eax
call fcn.00428720
push dword [esp + 8]
push 0
call fcn.004065f0
and eax, eax
je 0x4024bb
xor eax, eax
jmp 0x4024c0
mov eax, 1
and eax, eax
je 0x4024e0
push str.Do_you_know_what_an_email_address_looks_like__Perhaps_you_should_google_it__r_nOh__btw__dont_use_overly_long_or_short_TLDs__the_part_after_the_last_dot___only_2_4_character_TLDs_allowed_
push str.Invalid_email
call fcn.0040629d
mov eax, 1
add esp, 8
jmp 0x40268b
push dword [0x470df0]
call fcn.00402837
lea eax, [esp + 0x10]
push eax
call fcn.00428720
push dword [0x470df0]
push dword [0x470df0]
push 0x104
call fcn.00405d50
lea eax, [esp + 0x14]
push eax
call fcn.00428720
push 1
push 0x23
mov eax, dword [esp + 0x18]
push eax
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderPathW
and eax, eax
je 0x402536
xor eax, eax
jmp 0x40253b
mov eax, 1
and eax, eax
je 0x40255b
push str.Could_not_find_ProgramData_AllUsersAppData_directory
push str.Not_found
call fcn.0040629d
mov eax, 1
add esp, 8
jmp 0x40268b
push dword [0x470df0]
mov edx, dword [esp + 0x14]
push dword [0x470df0]
call fcn.004287a0
mov edx, str.KeywordResearcherPro
call fcn.004287a0
mov edx, dword [0x46f500]
add dword [esp], edx
call fcn.00424c25
pop dword [0x470df0]
push dword [0x470df0]
mov edx, dword [esp + 0x14]
push dword [0x470df0]
call fcn.004287a0
mov edx, 0x451040
call fcn.004287a0
add dword [0x470df0], 2
push 0
mov edx, dword [0x46f500]
add dword [esp + 4], edx
call fcn.00424f10
pop dword [0x470df0]
and eax, eax
je 0x4025d6
xor eax, eax
jmp 0x4025db
mov eax, 1
and eax, eax
je 0x4025fb
push str.Could_not_create_license_file
push str.Error
call fcn.0040629d
mov eax, 1
add esp, 8
jmp 0x40268b
push dword [0x470df0]
push dword [0x470df0]
push dword [esp + 0x10]
call fcn.00402a3a
add dword [0x470df0], 2
push 0
mov edx, dword [0x46f500]
add dword [esp + 4], edx
call fcn.00424fe0
pop dword [0x470df0]
push dword [0x470df0]
push dword [0x470df0]
push dword [esp + 0x14]
call fcn.00402a3a
add dword [0x470df0], 2
push 0
mov edx, dword [0x46f500]
add dword [esp + 4], edx
call fcn.00424fe0
pop dword [0x470df0]
push 0
call fcn.00424cf0
push str.Created_license_file_
push str.Done
call fcn.0040629d
pop eax
pop eax
mov eax, 1
jmp 0x40268b
push dword [esp + 4]
call fcn.00428800
push dword [esp + 8]
call fcn.00428800
push dword [esp]
call fcn.00428800
add esp, 0xc
pop ebx
ret 4
Function at 0x406331
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [esp + 0x10], ebx
je 0x406380
push dword [esp + 0x10]
push 0x4062af
call dword [sym.imp.USER32.DLL_EnumWindows]
mov esi, dword [0x470a38]
cmp esi, ebx
je 0x4063d4
mov edi, dword [esi]
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [esi + 8], eax
jne 0x406378
cmp byte [esi + 0x10], bl
je 0x406378
push 3
push ebx
push ebx
push ebx
push ebx
push 0xfffffffffffffffe
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
mov esi, edi
cmp edi, ebx
jne 0x406355
jmp 0x4063d4
mov esi, dword [0x470a38]
cmp esi, ebx
je 0x4063d4
push ebp
mov ebp, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x4063cd
cmp byte [esi + 0x11], bl
je 0x4063aa
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_EnableWindow]
cmp byte [esi + 0x10], bl
je 0x4063c0
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push dword [esi + 0xc]
call dword [sym.imp.USER32.DLL_SetWindowPos]
push edi
push 0x470a38
call fcn.00428651
pop ecx
pop ecx
mov esi, ebp
cmp ebp, ebx
jne 0x40638b
pop ebp
pop edi
pop esi
pop ebx
ret 4
Function at 0x4221b2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, 0x1000
xor esi, esi
cmp dword [ebp + 0xc], 0x18
push edi
mov dword [ebp - 0xc], ebx
je 0x422259
cmp dword [ebp + 0xc], 0x19
je 0x422259
push 0x2000
push esi
push dword [0x470988]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
jmp 0x42222f
cmp dword [ebp - 0x10], 2
jne 0x422248
cmp dword [ebp - 0xc], 0
jne 0x422217
lea eax, [esi + esi + 0x2000]
push eax
push edi
push 8
push dword [0x470988]
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov edi, eax
mov dword [ebp - 0xc], ebx
mov ax, word [ebp - 8]
cmp ax, 0xa
je 0x422248
cmp ax, 0xd
je 0x42222f
mov word [edi + esi*2], ax
inc esi
dec dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 2
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4221ef
push dword [ebp + 0x10]
xor eax, eax
push edi
mov word [edi + esi*2], ax
call fcn.004370b0
jmp 0x4222d7
push ebx
push esi
push dword [0x470988]
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov edi, eax
jmp 0x4222a4
cmp dword [ebp - 0x10], 1
jne 0x4222bd
cmp dword [ebp - 0xc], 0
jne 0x422292
lea eax, [esi + 0x1000]
push eax
push edi
push 8
push dword [0x470988]
call dword [sym.imp.KERNEL32.DLL_HeapReAlloc]
mov edi, eax
mov dword [ebp - 0xc], ebx
mov al, byte [ebp - 1]
cmp al, 0xa
je 0x4222bd
cmp al, 0xd
je 0x4222a4
mov byte [edi + esi], al
inc esi
dec dword [ebp - 0xc]
push 0
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x42226b
cmp dword [ebp + 0xc], 0x18
push dword [ebp + 0x10]
mov byte [edi + esi], 0
push edi
jne 0x4222d2
call fcn.00437100
jmp 0x4222d7
call fcn.00437050
push edi
push 0
push dword [0x470988]
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x423843
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x477d88]
call fcn.00427fab
mov edi, eax
test edi, edi
je 0x4238a7
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x42386c
push dword [esp + 0xc]
push edi
call eax
jmp 0x4238a7
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthW]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00428930
mov ebx, eax
xor eax, eax
mov word [ebx], ax
lea eax, [esi + 1]
push eax
push ebx
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextW]
push ebx
call sub.MSVCRT.dll_wcslen
pop ecx
sub esi, eax
push esi
call fcn.00428a40
pop esi
pop ebx
pop edi
ret 8
Function at 0x424446
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x10
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x4244c2
push 9
call esi
test bl, al
je 0x4244c2
push 0x11
call esi
test bl, al
jne 0x4244c2
push 0x10
call esi
test bl, al
jne 0x4244c2
push 0x12
call esi
test bl, al
jne 0x4244c2
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameW]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x4244c2
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageW]
test eax, 0x800
jne 0x4244c2
xor eax, eax
jmp 0x424544
push ebp
mov ebp, dword [esp + 0x24]
test ebp, ebp
je 0x4244eb
push 0x11
call esi
test bl, al
jne 0x4244e3
push 0x10
call esi
test bl, al
jne 0x4244e3
push 0x12
call esi
test bl, al
je 0x4244eb
push 1
push ebp
call fcn.004243ff
mov esi, dword [sym.imp.USER32.DLL_GetPropW]
test edi, edi
je 0x424501
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x424541
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x424541
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x424541
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x424541
dec esi
push esi
push dword [0x477d90]
call fcn.00427fab
test eax, eax
je 0x424541
mov eax, dword [eax + 8]
jmp 0x424543
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret 4

Function at 0x424c25
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
cmp dword [ebp + 8], 0
je 0x424c9b
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcsncpy
xor eax, eax
mov word [ebp - 4], ax
lea eax, [ebp - 0x20c]
push eax
call sub.MSVCRT.dll_wcslen
add esp, 0x10
lea eax, [ebp + eax*2 - 0x20c]
jmp 0x424c7c
movzx edx, word [eax - 2]
cmp edx, 0x20
je 0x424c79
cmp edx, 0x5c
je 0x424c79
cmp edx, 0x2f
jne 0x424c86
add eax, 0xfffffffe
lea ecx, [ebp - 0x20c]
cmp eax, ecx
ja 0x424c66
xor ecx, ecx
mov word [eax], cx
push ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
jmp 0x424c9d
xor eax, eax
leave
ret 4

Function at 0x424cb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x424ce5
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4
Function at 0x424fe0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x477da4]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.00427fab
mov esi, eax
test esi, esi
je 0x4250be
mov eax, dword [esp + 0x14]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_WriteFile]
test eax, eax
je 0x425076
cmp word [eax], 0
je 0x425076
push edi
lea edx, [esp + 0x18]
push edx
push eax
push 0xfde9
call fcn.004250d0
mov edi, eax
test edi, edi
je 0x425075
cmp dword [esi + 4], 0
je 0x425053
mov eax, dword [esp + 0x18]
push eax
push edi
push esi
call fcn.00425130
mov dword [esp + 0xc], eax
jmp 0x425065
mov edx, dword [esp + 0x18]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push edx
push edi
push eax
call ebx
mov ecx, dword [0x470988]
push edi
push 0
push ecx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
cmp dword [esi + 4], 0
je 0x425099
push 2
push 0x44ba50
push esi
call fcn.00425130
mov ecx, eax
mov eax, dword [esp + 8]
pop ebx
add eax, ecx
pop esi
add esp, 8
ret 8
mov eax, dword [esi]
push 0
lea edx, [esp + 0x10]
push edx
push 2
push 0x44ba50
push eax
call ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
pop ebx
add eax, ecx
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 8

Function at 0x425130
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x425165
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x4251da
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
dec ecx
je 0x4251c7
dec ecx
je 0x4251b2
sub ecx, 2
je 0x42519f
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.00424cb0
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x425207
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x425eb0
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x426ff9
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
xor edi, edi
mov dword [0x470d84], eax
cmp eax, edi
je 0x42702a
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x470d88], eax
lea eax, [ebp - 0x114]
push eax
mov dword [0x470d80], 1
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je 0x42707a
cmp dword [ebp - 0x104], 1
je 0x42708b
cmp dword [ebp - 0x104], 2
jne 0x42707a
cmp dword [ebp - 0x110], 5
jb 0x42708b
jne 0x42707a
cmp dword [ebp - 0x10c], edi
jne 0x42707a
mov dword [0x470d80], edi
cmp dword [0x470d80], edi
je 0x427091
call fcn.00426f40
test eax, eax
jne 0x427091
mov dword [0x470d80], edi
pop edi
leave
ret
Function at 0x428ab0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
push edi
push eax
push ecx
mov ebx, 1
xor esi, esi
mov dword [ebp - 8], esi
push ebx
call fcn.00431410
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add esp, 0xc
test edx, edx
je 0x428c6d
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, 0x7fffffff
mov dword [ecx + 0x280], eax
mov dword [edx + 0x284], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [sym.imp.MSVCRT.dll_longjmp]
mov dword [eax + 0x288], esi
mov eax, dword [ebp - 4]
push 0x40
push edx
push eax
mov dword [ecx + 0x28c], esi
call fcn.0042c480
push esi
push eax
call sub.MSVCRT.dll__setjmp3
add esp, 0x14
test eax, eax
je 0x428b32
push esi
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
mov esi, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov edx, dword [ebp - 4]
push esi
push ecx
push edi
push edx
call fcn.004314e0
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push ecx
push edx
push eax
call fcn.0042c4e0
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 4]
push ecx
push edx
call fcn.0042b8c0
add esp, 0x28
test eax, eax
jne 0x428b73
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 8]
test eax, eax
jne 0x428bb5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xb4], 0x2000
mov eax, dword [edx + 0xb4]
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.00431600
mov edx, dword [ebp - 4]
mov dword [edx + 0xb0], eax
mov eax, dword [ebp - 4]
add esp, 8
cmp dword [eax + 0xb0], 0
jne 0x428bb5
mov dword [ebp - 8], ebx
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x98], 0x429e10
mov ecx, dword [ebp - 4]
mov dword [edx + 0x9c], fcn.00429e60
mov edx, dword [ebp - 8]
mov dword [ecx + 0xa0], eax
test edx, edx
jne case.0x428c00.0
mov eax, dword [ebp - 4]
push 0x38
add eax, 0x78
push str.1.2.8
push eax
call fcn.00437640
add eax, 6
add esp, 0xc
cmp eax, 6
ja case.0x428c00.5
jmp dword [eax*4 + 0x428cb0]
push str.zlib_memory_error
jmp 0x428c29
mov edx, dword [ebp - 4]
push str.zlib_stream_error
push edx
jmp 0x428c2d
mov eax, dword [ebp - 4]
push str.zlib_version_error
push eax
jmp 0x428c2d
push str.Unknown_zlib_error
mov ecx, dword [ebp - 4]
push ecx
call fcn.0042c510
mov dword [ebp - 8], ebx
add esp, 8
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
test edx, edx
mov edx, dword [ebp - 4]
je 0x428c76
mov ecx, dword [eax + 0xb0]
push ecx
push edx
call fcn.004315d0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
push edi
push esi
push ecx
mov dword [eax + 0xb0], 0
call fcn.00431490
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [eax + 0xb0]
mov dword [edx + 0x84], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 4]
push 0
push 0
push eax
mov dword [ecx + 0x88], edx
call fcn.0042c770
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42c4a0
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
test ecx, ecx
je 0x42c4ba
mov eax, dword [ecx + 0x40]
test eax, eax
je 0x42c4ba
mov edx, dword [esp + 8]
push edx
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]