joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422b00
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557130
mov eax, dword fs:[0]
push eax
sub esp, 0x26c
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
lea ecx, [ebp - 0x14]
call fcn.00403160
push 0x58ddd0
mov eax, dword [ebp + 8]
push eax
call fcn.0043d570
add esp, 8
push eax
lea ecx, [ebp - 0x14]
call fcn.00402b50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x268]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00402c10
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x270], eax
cmp dword [ebp - 0x270], 0xffffffff
jne 0x422b9f
mov dword [ebp - 0x278], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004031d0
mov eax, dword [ebp - 0x278]
jmp 0x422c9e
mov dword [ebp - 0x26c], 0
mov edx, dword [ebp - 0x268]
and edx, 0x10
jne 0x422bcb
mov eax, dword [ebp - 0x26c]
add eax, dword [ebp - 0x248]
mov dword [ebp - 0x26c], eax
jmp 0x422c54
push 0x58ddcc
lea ecx, [ebp - 0x23c]
push ecx
call fcn.00440710
add esp, 8
movzx edx, al
test edx, edx
jne 0x422c54
push 0x58ddec
lea eax, [ebp - 0x23c]
push eax
call fcn.00440710
add esp, 8
movzx ecx, al
test ecx, ecx
jne 0x422c54
push 4
lea ecx, [ebp - 0x18]
call fcn.00403160
lea edx, [ebp - 0x23c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0043d570
add esp, 8
push eax
lea ecx, [ebp - 0x18]
call fcn.00402b50
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
call fcn.00402c10
push eax
call fcn.00422b00
add esp, 4
add eax, dword [ebp - 0x26c]
mov dword [ebp - 0x26c], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x18]
call fcn.004031d0
lea ecx, [ebp - 0x268]
push ecx
mov edx, dword [ebp - 0x270]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x422ba9
mov eax, dword [ebp - 0x270]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x26c]
mov dword [ebp - 0x274], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004031d0
mov eax, dword [ebp - 0x274]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret

Function at 0x422cc0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x14]
push eax
call fcn.004406b0
add esp, 4
lea ecx, [eax + eax + 2]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 0x14]
push eax
push 1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x422d07
mov dword [ebp - 4], 1
jmp 0x422d0e
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x422d20
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 4
lea eax, [ebp + 0x14]
push eax
push 4
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x422d52
mov dword [ebp - 4], 1
jmp 0x422d59
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x423030
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x557198
mov eax, dword fs:[0]
push eax
sub esp, 0xe2c
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xe38], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0xe1c], 0
lea eax, [ebp + 8]
push eax
mov ecx, 0x5c4dc8
call fcn.00407f70
lea ecx, [ebp + 8]
call fcn.00408050
push eax
call fcn.0043d8a0
add esp, 4
mov byte [ebp - 0xe15], al
movzx ecx, byte [ebp - 0xe15]
test ecx, ecx
jne 0x4230b1
mov dword [ebp - 0xe1c], 1
jmp 0x4231f2
push 0xa
push 1
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xe20], eax
mov edx, dword [ebp - 0xe20]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xe28], eax
mov eax, dword [ebp - 0xe28]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xe2c], eax
mov ecx, dword [ebp - 0xe20]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xe24], eax
lea edx, [ebp - 0xe14]
push edx
mov eax, dword [ebp - 0xe24]
push eax
mov ecx, dword [ebp - 0xe2c]
push ecx
call fcn.0043dbd0
add esp, 0xc
mov byte [ebp - 0xe15], al
lea edx, [ebp - 0xe14]
push edx
call fcn.00421ea0
add esp, 4
mov byte [ebp - 0xe15], al
movzx eax, byte [ebp - 0xe15]
test eax, eax
jne 0x423159
mov dword [ebp - 0xe1c], 2
jmp 0x4231f2
call fcn.00422950
push 1
call fcn.00422580
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x42318c
push 0
call fcn.00422580
add esp, 4
movzx edx, al
test edx, edx
jne 0x42318c
mov dword [ebp - 0xe1c], 3
jmp 0x4231f2
push 1
call fcn.004227e0
add esp, 4
movzx eax, al
test eax, eax
jne 0x4231ba
push 0
call fcn.004227e0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x4231ba
mov dword [ebp - 0xe1c], 4
jmp 0x4231f2
sub esp, 0x18
mov ecx, esp
mov dword [ebp - 0xe30], esp
lea edx, [ebp + 8]
push edx
call fcn.00407e30
mov dword [ebp - 0xe34], eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00422e20
add esp, 0x1c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004041c0
jmp 0x423224
cmp dword [ebp - 0xe1c], 1
je 0x423204
cmp dword [ebp - 0xe1c], 2
jne 0x423215
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004041c0
jmp 0x423224
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004041c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret 0x18
Function at 0x42aeb0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558308
mov eax, dword fs:[0]
push eax
sub esp, 0x50
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], ecx
push 0x58ff50
lea ecx, [ebp - 0x34]
call fcn.00404180
mov dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push eax
call fcn.0045e790
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x42af71
push 0xc
lea ecx, [ebp - 0x1c]
call fcn.00403160
lea ecx, [ebp - 0x1c]
call fcn.00404210
mov byte [ebp - 4], 1
push 0x58ff2c
lea ecx, [ebp - 0x5c]
call fcn.00404180
mov byte [ebp - 4], 2
lea edx, [ebp - 0x5c]
push edx
lea ecx, [ebp - 0x1c]
call fcn.0042ef70
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x5c]
call fcn.004041c0
push 0
sub esp, 0xc
mov ecx, esp
mov dword [ebp - 0x44], esp
lea eax, [ebp - 0x1c]
push eax
call fcn.0042ee80
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x34]
push ecx
call fcn.0045e3d0
add esp, 0x14
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.0042f090
jmp 0x42af78
mov byte [0x5c4538], 1
call fcn.00421590
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x42d2f0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0xc], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x42d3c1
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ecx, [ebp + 8]
call fcn.00404100
lea eax, [eax + eax + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42d351
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 0x10], 2
lea ecx, [ebp + 8]
call fcn.004041c0
mov eax, dword [ebp - 0x10]
jmp 0x42d3e3
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
lea ecx, [ebp + 8]
call fcn.00404100
shl eax, 1
push eax
lea ecx, [ebp + 8]
call fcn.00408050
push eax
mov edx, dword [ebp - 8]
push edx
call fcn.005166a0
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.00404100
xor ecx, ecx
mov edx, dword [ebp - 8]
mov word [edx + eax*2], cx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push ecx
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 0x14], 0
lea ecx, [ebp + 8]
call fcn.004041c0
mov eax, dword [ebp - 0x14]
jmp 0x42d3e3
call dword [sym.imp.USER32.dll_CloseClipboard]
mov dword [ebp - 0x18], 1
lea ecx, [ebp + 8]
call fcn.004041c0
mov eax, dword [ebp - 0x18]
jmp 0x42d3e3
mov esp, ebp
pop ebp
ret 0x18
Function at 0x42d920
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x558848
mov eax, dword fs:[0]
push eax
sub esp, 0x8c
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x3c], 0
lea ecx, [ebp - 0x28]
call fcn.00403f80
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x34]
add ecx, 0x834
call fcn.00411730
test eax, eax
jne 0x42d988
push str.empty
lea ecx, [ebp - 0x28]
call fcn.00409e20
jmp 0x42da51
mov dword [ebp - 0x30], 0
jmp 0x42d99a
mov eax, dword [ebp - 0x30]
add eax, 1
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x834
call fcn.00411730
cmp dword [ebp - 0x30], eax
jae 0x42da51
push 0x590780
lea ecx, [ebp - 0x80]
call fcn.00403ff0
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x40], ecx
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x40]
push edx
push 0
push 0x5907b8
mov eax, dword [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 0x834
call fcn.0042f0b0
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp - 0x34]
add ecx, 0x810
call fcn.0047a955
mov ecx, eax
call fcn.0047aaed
mov ecx, eax
call fcn.0047a955
mov ecx, eax
call fcn.0047af4b
push eax
lea edx, [ebp - 0x68]
push edx
call fcn.004304c0
add esp, 0xc
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x50]
push ecx
lea ecx, [ebp - 0x28]
call fcn.0042eb40
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x68]
call fcn.004040e0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x80]
call fcn.004040e0
jmp 0x42d991
mov dword [ebp - 0x2c], 0
lea edx, [ebp - 0x2c]
push edx
push 0
push 0x40000001
lea ecx, [ebp - 0x28]
call fcn.00404100
push eax
lea ecx, [ebp - 0x28]
call fcn.00406710
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov eax, dword [ebp - 0x2c]
push eax
call fcn.00516cfd
add esp, 4
mov dword [ebp - 0x38], eax
lea ecx, [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 0x40000001
lea ecx, [ebp - 0x28]
call fcn.00404100
push eax
lea ecx, [ebp - 0x28]
call fcn.00406710
push eax
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
lea ecx, [ebp - 0x98]
call fcn.00403fb0
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
push edx
lea ecx, [ebp - 0x28]
call fcn.00404030
lea ecx, [ebp - 0x98]
call fcn.004040e0
mov eax, dword [ebp - 0x38]
push eax
call fcn.005165cb
add esp, 4
lea ecx, [ebp - 0x28]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00407de0
mov edx, dword [ebp - 0x3c]
or edx, 1
mov dword [ebp - 0x3c], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.004040e0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret 4
Function at 0x438d00
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5590ab
mov eax, dword fs:[0]
push eax
sub esp, 0x9c
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
call fcn.004c71b1
add esp, 4
push 0x84
lea ecx, [ebp - 0x94]
call fcn.00403160
lea eax, [ebp - 0x94]
push eax
call fcn.004c249c
add esp, 4
mov dword [ebp - 4], 0
call fcn.004c266f
mov dword [ebp - 0x9c], eax
mov ecx, dword [ebp - 0x9c]
sub ecx, 1
mov dword [ebp - 0x9c], ecx
cmp dword [ebp - 0x9c], 3
ja case.default.0x438d88
mov edx, dword [ebp - 0x9c]
jmp dword [edx*4 + 0x438f34]
push 0x5913c4
lea ecx, [ebp - 0x94]
call fcn.004c8be1
lea ecx, [ebp - 0x94]
call fcn.0047b7af
push eax
call fcn.004c7168
add esp, 4
jmp case.default.0x438d88
push 0x5913b4
lea ecx, [ebp - 0x94]
call fcn.004c8be1
lea ecx, [ebp - 0x94]
call fcn.0047b7af
push eax
call fcn.004c7168
add esp, 4
push 0x5913e4
push ecx
mov ecx, esp
mov dword [ebp - 0xa8], esp
push str.IDR_RES
call fcn.00402b50
call fcn.0043b9c0
mov ecx, eax
call fcn.004dbbd6
jmp case.default.0x438d88
push 0x5913f8
lea ecx, [ebp - 0x94]
call fcn.004c8be1
lea ecx, [ebp - 0x94]
call fcn.0047b7af
push eax
call fcn.004c7168
add esp, 4
push str.skin
push 1
push str.pdfeditor_skin.zip
call fcn.004c724c
add esp, 0xc
jmp case.default.0x438d88
push str.layout_
lea ecx, [ebp - 0x94]
call fcn.004c8be1
lea ecx, [ebp - 0x94]
call fcn.0047b7af
push eax
call fcn.004c7168
add esp, 4
push str.ZIPRES
push str.IDR_ZIPRES
call fcn.004c265a
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
je case.default.0x438d88
mov dword [ebp - 0xa0], 0
mov eax, dword [ebp - 0x98]
push eax
call fcn.004c265a
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xa4], eax
cmp dword [ebp - 0xa4], 0
je 0x438efb
mov ecx, dword [ebp - 0x98]
push ecx
call fcn.004c265a
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xa0], eax
cmp dword [ebp - 0xa0], 0
jbe 0x438efb
push str.xfpdfeditor
mov edx, dword [ebp - 0xa0]
push edx
mov eax, dword [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.004c71be
add esp, 0xc
mov ecx, dword [ebp - 0x98]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x94]
call fcn.004c8aaa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret
Function at 0x43d5e0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5595c8
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x5b7780]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
lea ecx, [ebp - 0x14]
call fcn.00403160
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402b50
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00402c10
cmp eax, 0xffffffff
jne 0x43d666
mov byte [ebp - 0x1b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0043d3b0
mov al, byte [ebp - 0x1b]
jmp 0x43d6e9
push 0
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402c10
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x20], eax
xor ecx, ecx
jne 0x43d686
cmp dword [ebp - 0x20], 0
je 0x43d69e
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x18]
je 0x43d69e
mov byte [ebp - 0x19], 1
jmp 0x43d6a2
mov byte [ebp - 0x19], 0
movzx eax, byte [ebp - 0x19]
push eax
call fcn.004063c0
add esp, 4
xor ecx, ecx
jne 0x43d686
cmp dword [ebp - 0x20], 0
je 0x43d6ca
mov edx, dword [ebp + 0x10]
cmp edx, dword [ebp - 0x18]
jne 0x43d6ca
mov dword [ebp - 0x24], 1
jmp 0x43d6d1
mov dword [ebp - 0x24], 0
mov al, byte [ebp - 0x24]
mov byte [ebp - 0x1a], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0043d3b0
mov al, byte [ebp - 0x1a]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00516529
mov esp, ebp
pop ebp
ret

Function at 0x43d850
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43d86f
mov al, 1
jmp 0x43d88f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x43d885
mov dword [ebp - 4], 1
jmp 0x43d88c
mov dword [ebp - 4], 0
mov al, byte [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x43df70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
je 0x43dfa1
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
cmp eax, 0x2d
jne 0x43dfb5
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
test eax, eax
jne 0x43dfb5
call fcn.0051ed92
mov ecx, 0x20
shl ecx, 0
add eax, ecx
mov dword [ebp - 4], eax
jmp 0x43e000
push 0x594898
mov edx, dword [ebp + 8]
push edx
call fcn.005206c0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43e000
mov eax, dword [ebp + 8]
push eax
push 0x59489c
call fcn.0051ed92
mov ecx, 0x20
shl ecx, 1
add eax, ecx
push eax
call fcn.00520c4b
add esp, 0xc
push 0
call fcn.005206d5
add esp, 4
push 1
call fcn.00520b03
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x43fd30
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0043fc70
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43fd8b
call fcn.0051e84a
cmp dword [eax], 0x22
jne 0x43fd77
push 0x594f80
call fcn.0051ed92
mov edx, 0x20
shl edx, 1
add eax, edx
push eax
call fcn.00520c4b
add esp, 8
jmp 0x43fd84
push 0x594fe8
call fcn.005206d5
add esp, 4
push 1
call fcn.00520b03
cmp dword [0x5c45e4], 0
je 0x43fdcf
cmp dword [ebp + 0x10], 0
je 0x43fda2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
jmp 0x43fda9
mov dword [ebp - 8], str._stdout_
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 8]
push eax
push 0x594fb8
call fcn.0051ed92
mov ecx, 0x20
shl ecx, 1
add eax, ecx
push eax
call fcn.00520c4b
add esp, 0x10
mov edx, dword [0x5c45e0]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0xc
ja case.default.0x43fde5
mov eax, dword [ebp - 0xc]
jmp dword [eax*4 + 0x43ff14]
mov ecx, dword [0x5c45e0]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0043e050
add esp, 0xc
jmp 0x43ff02
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0043e840
add esp, 8
jmp 0x43ff02
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043eb60
add esp, 8
jmp 0x43ff02
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0043efc0
add esp, 8
jmp 0x43ff02
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0043f440
add esp, 8
jmp 0x43ff02
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043fa60
add esp, 0xc
jmp 0x43ff02
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0043fa60
add esp, 0xc
jmp 0x43ff02
push 0
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0043f780
add esp, 0x10
jmp 0x43ff02
push 0
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.0043f780
add esp, 0x10
jmp 0x43ff02
push 1
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.0043f780
add esp, 0x10
jmp 0x43ff02
push 1
push 1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0043f780
add esp, 0x10
jmp 0x43ff02
push 0x594fd0
call fcn.0051ed92
mov ecx, 0x20
shl ecx, 1
add eax, ecx
push eax
call fcn.00520c4b
add esp, 8
push 1
call fcn.00520b03
mov edx, dword [ebp - 4]
push edx
call fcn.00471ce2
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4404e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
mov dword [0x5b8920], eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00516540
add esp, 4
mov dword [ebp - 4], eax
cmp dword [0x5c45f4], 0
je 0x440534
cmp dword [0x5c45fc], 4
jle 0x440534
push 4
push 0x595158
call fcn.0051ed92
mov edx, 0x20
shl edx, 1
add eax, edx
push eax
call fcn.00520c4b
add esp, 0xc
push 1
call fcn.00520b03
jmp 0x44056b
cmp dword [0x5c45f4], 0
jne 0x44056b
cmp dword [0x5c45fc], 0x28
jle 0x44056b
push 0x28
push str.Version_should_be_less_or_equal_to__d._n
call fcn.0051ed92
mov ecx, 0x20
shl ecx, 1
add eax, ecx
push eax
call fcn.00520c4b
add esp, 0xc
push 1
call fcn.00520b03
cmp dword [0x5b8928], 0
jge 0x440593
cmp dword [0x5c45f4], 0
je 0x440589
mov dword [0x5b8928], 2
jmp 0x440593
mov dword [0x5b8928], 4
cmp dword [0x5c45f4], 0
je 0x4405f4
cmp dword [0x5c45fc], 0
jne 0x4405c8
push str.Version_must_be_specified_to_encode_a_Micro_QR_Code_symbol._n
call fcn.0051ed92
mov edx, 0x20
shl edx, 1
add eax, edx
push eax
call fcn.00520c4b
add esp, 8
push 1
call fcn.00520b03
cmp dword [0x5c45f0], 0
je 0x4405f4
push str.Micro_QR_Code_does_not_support_structured_symbols._n
call fcn.0051ed92
mov ecx, 0x20
shl ecx, 1
add eax, ecx
push eax
call fcn.00520c4b
add esp, 8
push 1
call fcn.00520b03
cmp dword [0x5c45f0], 0
je 0x44063f
cmp dword [0x5c45fc], 0
jne 0x440629
push str.Version_must_be_specified_to_encode_structured_symbols._n
call fcn.0051ed92
mov edx, 0x20
shl edx, 1
add eax, edx
push eax
call fcn.00520c4b
add esp, 8
push 1
call fcn.00520b03
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0043ffb0
add esp, 0xc
jmp 0x440653
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.0043fd30
add esp, 0xc
mov esp, ebp
pop ebp
ret