joyce8/EMBER2024-capa huggingface dataset:
Function at 0x71a2dd91
Capabilities:
Get common file path
Query environment variable
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2b0
mov eax, dword [0x71a3405c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2a8], eax
lea eax, [ebp - 0x2a0]
push eax
mov dword [ebp - 0x2a0], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x71a2df3c
cmp dword [ebp - 0x290], 2
push ebx
push esi
push edi
mov ebx, 0x71a2bc64
jne 0x71a2de81
lea eax, [ebp - 0x2a4]
push eax
push 0x20019
push 0
push 0x71a2df70
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
mov esi, 0x104
jne 0x71a2de61
lea eax, [ebp - 0x2ac]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x2b0]
push eax
push 0
push 0x71a2df60
push dword [ebp - 0x2a4]
mov dword [ebp - 0x2ac], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2a4]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x71a2de61
push esi
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
jne 0x71a2de97
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x71a2de7a
xor eax, eax
jmp 0x71a2df39
mov ebx, 0x71a2df50
jmp 0x71a2de97
push 0x104
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x71a2de73
lea eax, [ebp - 0x108]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71a2dea0
sub eax, edx
cmp byte [ebp + eax - 0x109], 0x5c
je 0x71a2dec9
lea edi, [ebp - 0x108]
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x71a2deba
mov esi, 0x71a2df4c
movsw word es:[edi], word [esi]
mov eax, ebx
mov edx, ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71a2decd
lea edi, [ebp - 0x108]
sub eax, edx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x71a2dedd
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [ebp - 0x2a8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, eax
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x71a2defd
lea edi, [ebp - 0x108]
sub eax, ecx
mov esi, ecx
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x71a2df0f
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x108]
and ecx, 3
push 0x71a2df48
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.msvcrt.dll_fopen]
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
call fcn.71a2269d
leave
ret 4
Function at 0x71a2e491
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x248
cmp dword [0x71a34050], 0x71a22c29
mov eax, dword [0x71a3405c]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jne 0x71a2e4d3
cmp dword [0x71a34054], 0
je 0x71a2e4d3
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 0x248], eax
jne 0x71a2e4e6
lea eax, [ebp - 0x248]
push eax
call fcn.71a23cb3
test eax, eax
je 0x71a2e4e6
push eax
jmp 0x71a2e507
test esi, esi
je 0x71a2e502
cmp dword [ebp + 0x10], 0x17
lea eax, [ebp - 0x240]
mov dword [ebp - 0x244], eax
jne 0x71a2e523
cmp dword [ebp + 0xc], 0x10
je 0x71a2e514
push 0x2726
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x71a2e5a3
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.71a2e389
jmp 0x71a2e530
push esi
lea eax, [ebp - 0x104]
push eax
call fcn.71a2e3d9
push 0
push 0x71a348d0
lea eax, [ebp - 0x104]
push eax
push 0x13c
lea eax, [ebp - 0x244]
push eax
call fcn.71a25578
test eax, eax
je 0x71a2e56d
mov ecx, dword [ebp - 0x248]
push eax
call fcn.71a25983
mov esi, eax
test esi, esi
je 0x71a2e587
push esi
call fcn.71a25c74
jmp 0x71a2e587
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x277c
jne 0x71a2e587
push 0x2afc
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp - 0x240]
cmp dword [ebp - 0x244], eax
je 0x71a2e5a1
push dword [ebp - 0x244]
call fcn.71a2136d
pop ecx
mov eax, esi
mov ecx, dword [ebp - 4]
pop esi
call fcn.71a2269d
leave
ret 0xc
Function at 0x71a2e5b5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x148
cmp dword [0x71a34050], 0x71a22c29
mov eax, dword [0x71a3405c]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jne 0x71a2e5f7
cmp dword [0x71a34054], 0
je 0x71a2e5f7
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 0x148], eax
jne 0x71a2e615
lea eax, [ebp - 0x148]
push eax
call fcn.71a23cb3
test eax, eax
je 0x71a2e615
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x71a2e6e8
test edi, edi
lea eax, [ebp - 0x140]
mov dword [ebp - 0x144], eax
jne 0x71a2e62a
mov edi, 0x71a2bc64
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71a2e62f
sub eax, edx
add eax, 7
push esi
push eax
call fcn.71a225f6
mov esi, eax
test esi, esi
pop ecx
jne 0x71a2e658
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x71a2e6e7
mov eax, dword [ebp + 8]
push edi
and eax, 0xffff
push eax
push 0x71a2e6f8
push esi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
push 0
push 0x71a348e0
push esi
push 0x13c
lea eax, [ebp - 0x144]
push eax
call fcn.71a25578
push esi
mov edi, eax
call fcn.71a2136d
test edi, edi
pop ecx
jne 0x71a2e6b3
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x277d
jne 0x71a2e6cb
push 0x2afc
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x71a2e6cb
mov ecx, dword [ebp - 0x148]
push edi
call fcn.71a2e429
mov esi, eax
test esi, esi
je 0x71a2e6cb
push esi
call fcn.71a2e2a1
lea eax, [ebp - 0x140]
cmp dword [ebp - 0x144], eax
je 0x71a2e6e5
push dword [ebp - 0x144]
call fcn.71a2136d
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
call fcn.71a2269d
leave
ret 8
Function at 0x71a2e703
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x148
cmp dword [0x71a34050], 0x71a22c29
mov eax, dword [0x71a3405c]
push ebx
mov ebx, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
jne 0x71a2e749
cmp dword [0x71a34054], 0
je 0x71a2e749
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 0x148], eax
jne 0x71a2e75c
lea eax, [ebp - 0x148]
push eax
call fcn.71a23cb3
test eax, eax
je 0x71a2e75c
push eax
jmp 0x71a2e765
test ebx, ebx
jne 0x71a2e772
push 0x2726
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x71a2e84e
test edi, edi
lea eax, [ebp - 0x140]
mov dword [ebp - 0x144], eax
jne 0x71a2e787
mov edi, 0x71a2bc64
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x71a2e78c
sub eax, edx
mov ecx, eax
mov eax, edi
push esi
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x71a2e79d
sub eax, esi
lea eax, [eax + ecx + 2]
push eax
call fcn.71a225f6
mov esi, eax
test esi, esi
pop ecx
jne 0x71a2e7c6
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x71a2e84d
push edi
push ebx
push 0x71a2e85c
push esi
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
push 0
push 0x71a348e0
push esi
push 0x13c
lea eax, [ebp - 0x144]
push eax
call fcn.71a25578
push esi
mov edi, eax
call fcn.71a2136d
test edi, edi
pop ecx
jne 0x71a2e819
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x277d
jne 0x71a2e831
push 0x2afc
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x71a2e831
mov ecx, dword [ebp - 0x148]
push edi
call fcn.71a2e429
mov esi, eax
test esi, esi
je 0x71a2e831
push esi
call fcn.71a2e2a1
lea eax, [ebp - 0x140]
cmp dword [ebp - 0x144], eax
je 0x71a2e84b
push dword [ebp - 0x144]
call fcn.71a2136d
pop ecx
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.71a2269d
leave
ret 8

Function at 0x71a2f66a
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x71a34050], 0x71a22c29
push esi
jne 0x71a2f6a0
cmp dword [0x71a34054], 0
je 0x71a2f6a0
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 8], eax
je 0x71a2f6a0
and dword [ebp - 4], 0
jmp 0x71a2f6b0
lea eax, [ebp - 8]
push eax
call fcn.71a23cb3
test eax, eax
mov dword [ebp - 4], eax
jne 0x71a2f70f
push dword [ebp + 8]
call fcn.71a22e2e
mov esi, eax
test esi, esi
je 0x71a2f708
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 8]
mov eax, dword [esi + 0xc]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x5c]
mov ecx, esi
mov edi, eax
call fcn.71a22e13
test edi, edi
pop edi
jne 0x71a2f6f9
xor eax, eax
jmp 0x71a2f71b
cmp dword [ebp - 4], 0
jne 0x71a2f70f
mov dword [ebp - 4], 0x277b
jmp 0x71a2f70f
mov dword [ebp - 4], 0x2736
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop esi
leave
ret 0x24
Function at 0x71a30aad
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x71a34050], 0x71a22c29
push esi
jne 0x71a30ae3
cmp dword [0x71a34054], 0
je 0x71a30ae3
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 8], eax
je 0x71a30ae3
and dword [ebp - 4], 0
jmp 0x71a30af3
lea eax, [ebp - 8]
push eax
call fcn.71a23cb3
test eax, eax
mov dword [ebp - 4], eax
jne 0x71a30b52
push dword [ebp + 8]
call fcn.71a22e2e
mov esi, eax
test esi, esi
je 0x71a30b4b
push edi
lea ecx, [ebp - 4]
push ecx
push dword [ebp - 8]
mov eax, dword [esi + 0xc]
push dword [ebp + 0x28]
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x6c]
mov ecx, esi
mov edi, eax
call fcn.71a22e13
test edi, edi
pop edi
jne 0x71a30b3c
xor eax, eax
jmp 0x71a30b5e
cmp dword [ebp - 4], 0
jne 0x71a30b52
mov dword [ebp - 4], 0x277b
jmp 0x71a30b52
mov dword [ebp - 4], 0x2736
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop esi
leave
ret 0x24

Function at 0x71a30dc1
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x71a34050], 0x71a22c29
push ebx
push esi
jne 0x71a30df8
cmp dword [0x71a34054], 0
je 0x71a30df8
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 8], eax
je 0x71a30df8
and dword [ebp - 4], 0
jmp 0x71a30e08
lea eax, [ebp - 8]
push eax
call fcn.71a23cb3
test eax, eax
mov dword [ebp - 4], eax
jne 0x71a30e71
push dword [ebp + 8]
call fcn.71a22e2e
mov esi, eax
test esi, esi
je 0x71a30e6a
mov cl, byte [esi + 0x16]
mov eax, dword [ebp - 8]
neg cl
push edi
mov edi, dword [eax + 0x50]
sbb ecx, ecx
and ecx, 0xffffffe0
add ecx, 0x20
mov dword [eax + 0x50], ecx
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 8]
mov ebx, eax
mov eax, dword [ebp - 8]
mov ecx, esi
mov dword [eax + 0x50], edi
call fcn.71a22e13
cmp ebx, 0xffffffff
pop edi
je 0x71a30e71
cmp ebx, dword [ebp + 8]
je 0x71a30e66
push ebx
call fcn.71a24345
mov eax, ebx
jmp 0x71a30e7d
mov dword [ebp - 4], 0x2736
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop esi
pop ebx
leave
ret 0x14
Function at 0x71a30f70
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x71a34050], 0x71a22c29
push ebx
push esi
jne 0x71a30fa7
cmp dword [0x71a34054], 0
je 0x71a30fa7
push dword [0x71a34048]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
mov dword [ebp - 8], eax
je 0x71a30fa7
and dword [ebp - 4], 0
jmp 0x71a30fb7
lea eax, [ebp - 8]
push eax
call fcn.71a23cb3
test eax, eax
mov dword [ebp - 4], eax
jne 0x71a31029
push dword [ebp + 8]
call fcn.71a22e2e
mov esi, eax
test esi, esi
je 0x71a31022
mov cl, byte [esi + 0x16]
mov eax, dword [ebp - 8]
neg cl
push edi
mov edi, dword [eax + 0x50]
sbb ecx, ecx
and ecx, 0xffffffe0
add ecx, 0x20
mov dword [eax + 0x50], ecx
mov eax, dword [esi + 0xc]
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0x24]
push dword [ebp + 0x20]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [eax + 0x4c]
mov ebx, eax
mov eax, dword [ebp - 8]
mov ecx, esi
mov dword [eax + 0x50], edi
call fcn.71a22e13
cmp ebx, 0xffffffff
pop edi
je 0x71a31029
cmp ebx, dword [ebp + 8]
je 0x71a3101e
push ebx
call fcn.71a24345
mov eax, ebx
jmp 0x71a31035
mov dword [ebp - 4], 0x2736
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SetLastError]
or eax, 0xffffffff
pop esi
pop ebx
leave
ret 0x20

Function at 0x71a320b7
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x71a3405c]
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push 0x71a277b0
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
inc dword [ebp + 0xc]
push 4
lea eax, [ebp + 0xc]
push eax
push 0x71a27580
push esi
call fcn.71a31f1b
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
pop esi
call fcn.71a2269d
leave
ret 0xc
Function at 0x71a32145
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push edi
lea eax, [ebp - 8]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x71a32206
push ebx
push 0x104
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 1
call fcn.71a225f6
mov ebx, eax
cmp ebx, edi
pop ecx
jne 0x71a32193
mov dword [ebp - 4], 0xe
jmp 0x71a321d8
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, edi
jne 0x71a321ce
push ebx
push dword [ebp - 8]
call fcn.71a32145
cmp eax, edi
je 0x71a321c7
mov dword [ebp - 0xc], edi
mov dword [ebp - 4], eax
cmp dword [ebp - 0xc], edi
je 0x71a321d8
jmp 0x71a32193
cmp eax, 0x103
je 0x71a321d8
mov dword [ebp - 4], eax
push ebx
call fcn.71a2136d
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, edi
pop ebx
je 0x71a321f0
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, edi
je 0x71a32203
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 8

Function at 0x71a32210
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x104
mov dword [ebp - 8], 1
call fcn.71a225f6
mov ebx, eax
xor esi, esi
cmp ebx, esi
pop ecx
jne 0x71a32239
push 8
pop eax
jmp 0x71a3228c
mov dword [ebp - 4], esi
lea eax, [ebp - 0x14]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push dword [ebp + 8]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
jne 0x71a32278
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp eax, esi
je 0x71a32271
mov dword [ebp - 8], esi
mov dword [ebp - 4], eax
cmp dword [ebp - 8], esi
je 0x71a32282
jmp 0x71a3223c
cmp eax, 0x103
je 0x71a32282
mov dword [ebp - 4], eax
push ebx
call fcn.71a2136d
mov eax, dword [ebp - 4]
pop ecx
pop esi
pop ebx
leave
ret 4

Function at 0x71a36e00
Capabilities:
Encode data using xor

Disassembly:
pop edi
mov eax, 0x78cf51db
mov ecx, 0x6ba
xor byte [edi], al
inc edi
dec eax
loopne 0x71a36e0b
call fcn.71a36e24
Function at 0x401006
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f004]
jne 0x401010
repz ret
jmp fcn.00401460

Function at 0x4082b5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004058a1
and dword [ebp - 4], 0
cmp dword [0x431798], 0
mov ebx, eax
jne 0x408366
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408417
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408417
push eax
call fcn.0040582f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x431798], eax
call esi
push eax
call fcn.0040582f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43179c], eax
call esi
push eax
call fcn.0040582f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4317a0], eax
call esi
push eax
call fcn.0040582f
pop ecx
mov dword [0x4317a8], eax
test eax, eax
je 0x408366
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040582f
pop ecx
mov dword [0x4317a4], eax
mov eax, dword [0x4317a4]
cmp eax, ebx
je 0x4083be
cmp dword [0x4317a8], ebx
je 0x4083be
push eax
call fcn.004058aa
push dword [0x4317a8]
mov esi, eax
call fcn.004058aa
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4083be
test edi, edi
je 0x4083be
call esi
test eax, eax
je 0x4083b5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4083b5
test byte [ebp - 0xc], 1
jne 0x4083be
or dword [ebp + 0x10], 0x200000
jmp 0x4083f7
mov eax, dword [0x43179c]
cmp eax, ebx
je 0x4083f7
push eax
call fcn.004058aa
pop ecx
test eax, eax
je 0x4083f7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4083f7
mov eax, dword [0x4317a0]
cmp eax, ebx
je 0x4083f7
push eax
call fcn.004058aa
pop ecx
test eax, eax
je 0x4083f7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x431798]
call fcn.004058aa
pop ecx
test eax, eax
je 0x408417
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408419
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x428120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
push ebx
push esi
push edi
push eax
push ecx
mov ebx, 1
xor esi, esi
mov dword [ebp - 8], esi
push ebx
call fcn.0042f860
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
add esp, 0xc
test edx, edx
je 0x4282db
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, accept
mov dword [ecx + 0x280], eax
mov dword [edx + 0x284], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
push 0x40
push 0x4a8ff0
mov dword [eax + 0x288], esi
push edx
mov dword [ecx + 0x28c], esi
call fcn.0042f4e0
push esi
push eax
call fcn.004a90b0
add esp, 0x14
test eax, eax
je 0x4281a0
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov ecx, dword [ebp - 4]
push esi
push eax
push edi
push ecx
call fcn.0042f9d0
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push edx
mov edx, dword [ebp - 4]
push eax
push ecx
push edx
call fcn.0042f560
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.0042e9f0
add esp, 0x28
test eax, eax
jne 0x4281e1
mov dword [ebp - 8], ebx
mov edx, dword [ebp - 8]
test edx, edx
jne 0x428223
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov dword [eax + 0xb4], 0x2000
mov edx, dword [ecx + 0xb4]
mov eax, dword [ebp - 4]
push edx
push eax
call fcn.0042fac0
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
add esp, 8
mov dword [ecx + 0xb0], eax
cmp dword [edx + 0xb0], 0
jne 0x428223
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov dword [eax + 0x98], 0x42d530
mov eax, dword [ebp - 4]
mov dword [ecx + 0x9c], fcn.0042d580
mov ecx, dword [ebp - 8]
test ecx, ecx
mov dword [eax + 0xa0], edx
jne case.0x42826e.0
mov edx, dword [ebp - 4]
push 0x38
add edx, 0x78
push str.1.2.7
push edx
call fcn.0042fd10
add eax, 6
add esp, 0xc
cmp eax, 6
ja case.0x42826e.5
jmp dword [eax*4 + 0x428324]
push str.zlib_memory_error
jmp 0x428297
mov ecx, dword [ebp - 4]
push str.zlib_stream_error
push ecx
jmp 0x42829b
mov edx, dword [ebp - 4]
push str.zlib_version_error
push edx
jmp 0x42829b
push 0x50a110
mov eax, dword [ebp - 4]
push eax
call fcn.0042f580
mov dword [ebp - 8], ebx
add esp, 8
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x4282e4
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0xb0]
mov ecx, dword [ebp - 4]
push eax
push ecx
call fcn.0042fa90
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
push edi
push esi
push eax
mov dword [edx + 0xb0], 0
call fcn.0042f910
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xb0]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x84], edx
mov ecx, dword [ebp - 4]
mov edx, dword [eax + 0xb4]
mov eax, dword [ebp - 4]
push 0
push 0
push eax
mov dword [ecx + 0x88], edx
call fcn.0042f120
mov eax, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x437c30
Capabilities:
Hash data with crc32

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
movzx ecx, byte [esp + 8]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x50f060]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
add eax, 1
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x50f060]
mov dword [edx + 8], ecx
ret

Function at 0x437cd0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
cmp byte [esi + 0x2d], 0
mov eax, edi
je 0x437d53
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x437d01
cmp dword [esi + 0x40], ebx
jae 0x437d01
push eax
call fcn.00463d2b
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x437d19
lea eax, [ebx + ebx]
push eax
call fcn.00464009
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], ebx
mov ecx, dword [esi + 0x3c]
push ebx
push edi
push ecx
call fcn.0046ed30
add esp, 0xc
xor edi, edi
test ebx, ebx
jbe 0x437d50
push ebp
lea ebp, [esi + 0x30]
mov edx, dword [esi + 0x3c]
movzx eax, byte [edi + edx]
push eax
push ebp
call fcn.00437ca0
mov ecx, dword [esi + 0x3c]
mov byte [edi + ecx], al
add edi, 1
add esp, 8
cmp edi, ebx
jb 0x437d31
pop ebp
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x437d8c
mov ecx, dword [esi + 0x24]
lea edi, [ecx + ebx]
cmp edi, dword [esi + 0x28]
jb 0x437d74
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push ebx
push eax
add ecx, edx
push ecx
call fcn.0046ed30
add esp, 0xc
add dword [esi + 0x24], ebx
pop edi
pop esi
mov eax, ebx
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x437dad
push 0
lea edx, [esp + 0x14]
push edx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8