joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41f7f3
Capabilities:
Capture screenshot
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff44
push ebx
push edx
push esi
mov eax, dword [ebp + 0x10]
push dword [eax + 4]
push dword [eax]
call fcn.0042339a
mov ebx, eax
mov edx, dword [ebx]
push edx
lea eax, [ebp - 0xb8]
push eax
push ebx
call fcn.0042b450
push dword [ebp - 0x6c]
push 5
call fcn.0042347c
mov esi, eax
mov eax, dword [0x43ca95]
cmp dword [ebp + 0xc], eax
jne 0x41f85b
cmp dword [0x43df00], 0
jne 0x41f85b
cmp dword [esi + 0x1c], 0
je 0x41f852
push dword [esi + 0x1c]
call fcn.00428720
mov dword [esi + 0x1c], 0
mov dword [ebp - 0x18], 1
jmp 0x41f862
mov dword [ebp - 0x18], 0
push dword [ebp - 0x90]
call fcn.00428a0e
mov dword [ebp - 0x1c], eax
push dword [0x43c15c]
push dword [0x43c160]
lea eax, [ebp - 0xb8]
push eax
call fcn.0041fea0
mov dword [ebp - 4], eax
push dword [ebp - 0x94]
push dword [ebp - 0x64]
push 0
call fcn.0040a2ee
mov dword [ebp - 0xbc], eax
push 0
push dword [ebp - 0xbc]
push 0x30
push dword [ebp - 4]
call fcn.00428924
push dword [ebp - 0x90]
pop dword [esi + 0x10]
push dword [ebp - 0x8c]
pop dword [esi + 0x18]
push dword [ebp - 0x1c]
pop dword [esi + 4]
push dword [ebp - 4]
pop dword [esi + 0x1c]
push dword [ebp - 0xbc]
pop dword [esi + 8]
mov dword [esi], 1
push esi
push 0xffffffffffffffeb
push dword [ebp - 4]
call fcn.0042896c
push 1
push dword [ebp - 4]
call fcn.0042898a
push dword [ebp - 4]
call fcn.004289b4
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 4]
call fcn.00428846
push dword [ebp - 4]
call fcn.004287b6
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
call fcn.004289d8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
sub dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x34]
sub dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x20]
call fcn.004289d2
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push dword [ebp - 8]
call fcn.00428ace
mov dword [ebp - 0x28], eax
push 0
push dword [ebp - 0x84]
call fcn.0040a1e8
mov dword [ebp - 0x14], eax
cmp dword [esi + 0x20], 0
je 0x41f966
push dword [esi + 0x20]
pop dword [ebp - 0x14]
push dword [ebp - 0x14]
push dword [ebp - 4]
call fcn.0042897e
cmp dword [ebp - 0x9c], 0
jne 0x41f97c
jmp 0x41f98f
push dword [esi + 0x28]
push dword [esi + 0x2c]
push 0xb6
push dword [ebp - 4]
call fcn.00428924
push 0xe
push dword [ebp - 8]
push 0x317
push dword [ebp - 4]
call fcn.00428924
push 0xcc0020
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0xac]
push dword [ebp - 0xb0]
push dword [ebp + 8]
call fcn.004289c0
push dword [ebp - 0x28]
push dword [ebp - 8]
call fcn.00428ace
push dword [ebp - 0x24]
call fcn.00428a1a
push dword [ebp - 8]
call fcn.00428a14
push dword [ebp - 0x20]
push dword [ebp - 4]
call fcn.0042890c
cmp dword [ebp - 0x18], 0
jne 0x41fa31
mov dword [esi + 0x10], 0
mov dword [esi + 0x18], 0
mov dword [esi + 4], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 8], 0
push dword [ebp - 0x1c]
call fcn.00428a1a
push dword [ebp - 0xbc]
call fcn.00428a1a
push dword [ebp - 4]
call fcn.00428720
pop esi
pop edx
pop ebx
leave
ret 0xc
Function at 0x41fba8
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push 0xffffffffffffffeb
push dword [ebp + 8]
call fcn.00428840
mov esi, eax
cmp dword [esi + 0x20], 0
je 0x41fbde
push 0x8000
push 0
push dword [esi + 0x20]
call fcn.00428672
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
push dword [ebp + 8]
call fcn.00428858
or eax, eax
je 0x41fc12
inc eax
mov dword [esi + 0x24], eax
push 4
push 0x1000
push dword [esi + 0x24]
push 0
call fcn.0042866c
mov dword [esi + 0x20], eax
push dword [esi + 0x20]
push dword [esi + 0x24]
push 0xd
push dword [ebp + 8]
call fcn.00428924
push dword [esi + 4]
call fcn.00428a1a
push dword [esi + 8]
call fcn.00428a1a
mov dword [esi + 0x1c], 0
mov dword [esi + 0x34], 1
push 0
push 0
push 0xce
push dword [ebp + 8]
call fcn.00428924
mov dword [esi + 0x28], eax
push 0
push 0xffffffffffffffff
push 0xbb
push dword [ebp + 8]
call fcn.00428924
mov dword [esi + 0x2c], eax
push 0
push eax
push 0xd6
push dword [ebp + 8]
call fcn.00428924
mov ax, 1
push eax
push 0
push 0xd7
push dword [ebp + 8]
call fcn.00428924
and eax, 0xffff
sub eax, dword [esi + 0x2c]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call fcn.004287a4
mov eax, dword [ebp - 0xc]
inc eax
shl eax, 0x10
and dword [ebp - 8], 0xffff
dec dword [ebp - 8]
or eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push 0xd7
push dword [ebp + 8]
call fcn.00428924
and eax, 0xffff
add eax, dword [esi + 0x28]
mov dword [esi + 0x30], eax
push dword [ebp + 8]
call fcn.00428720
pop esi
leave
ret 4
Function at 0x4206f6
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push esi
push edi
push dword [ebp + 8]
call fcn.0042062a
mov edi, eax
mov esi, dword [ebp + 0xc]
cmp dword [esi], 4
jne 0x4208dd
mov dword [ebp - 8], 0x810
cmp dword [edi + 0x20], 0
jne 0x420727
or dword [ebp - 8], 0
jmp 0x420737
cmp dword [edi + 0x20], 1
jne 0x420733
or dword [ebp - 8], 2
jmp 0x420737
or dword [ebp - 8], 1
cmp dword [edi + 0x28], 0
jne 0x420743
or dword [ebp - 8], 0
jmp 0x420753
cmp dword [edi + 0x28], 1
jne 0x42074f
or dword [ebp - 8], 8
jmp 0x420753
or dword [ebp - 8], 4
push dword [esi + 0x14]
push dword [esi + 0x18]
call fcn.0041fcd4
mov dword [ebp - 0x20], eax
push eax
push dword [esi + 0x18]
call fcn.00428ace
mov dword [ebp - 0x28], eax
push 1
push dword [esi + 0x18]
call fcn.00428ae6
mov dword [ebp - 0x24], eax
push dword [esi + 0x14]
call fcn.00428858
mov dword [ebp - 0x18], eax
inc eax
mov dword [ebp - 0x1c], eax
push 4
push 0x1000
push dword [ebp - 0x1c]
push 0
call fcn.0042866c
mov dword [ebp - 4], eax
push dword [ebp - 0x1c]
push dword [ebp - 4]
push dword [esi + 0x14]
call fcn.00428852
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.004286ea
lea eax, [esi + 0x1c]
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.004286ea
mov eax, 0xffffffff
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x18]
push dword [ebp - 4]
push dword [esi + 0x18]
call fcn.00428744
add eax, 2
mov dword [ebp - 0x14], eax
push 0xfffffffffffffffc
push 0xfffffffffffffffc
lea eax, [ebp - 0x48]
push eax
call fcn.0042885e
cmp dword [edi + 0x1c], 0
je 0x42081d
push 0x10
push 4
lea eax, [esi + 0x1c]
push eax
push dword [esi + 0x18]
call fcn.0042873e
push dword [ebp - 0x10]
push dword [ebp - 0xc]
lea eax, [ebp - 0x38]
push eax
call fcn.0042885e
push dword [ebp - 0x20]
lea eax, [ebp - 0x38]
push eax
push dword [esi + 0x18]
call fcn.00428774
test dword [esi + 0x10], 1
je 0x42086a
cmp dword [edi + 0x1c], 0
je 0x42085d
push 0x210
push 4
lea eax, [esi + 0x1c]
push eax
push dword [esi + 0x18]
call fcn.0042873e
push dword [ebp - 0x20]
lea eax, [ebp - 0x38]
push eax
push dword [esi + 0x18]
call fcn.00428774
push 1
push 1
lea eax, [ebp - 0x38]
push eax
call fcn.004288dc
mov eax, dword [edi + 0x18]
cmp eax, dword [ebp - 0x14]
jbe 0x42087a
sub eax, dword [ebp - 0x14]
shr eax, 1
add dword [ebp - 0x34], eax
push dword [ebp - 8]
lea eax, [ebp - 0x38]
push eax
push dword [ebp - 0x18]
push dword [ebp - 4]
push dword [esi + 0x18]
call fcn.00428744
test dword [esi + 0x10], 0x10
je 0x4208ad
test dword [esi + 0x10], 1
jne 0x4208ad
lea eax, [ebp - 0x48]
push eax
push dword [esi + 0x18]
call fcn.00428738
push 0x8000
push 0
push dword [ebp - 4]
call fcn.00428672
push dword [ebp - 0x24]
push dword [esi + 0x18]
call fcn.00428ae6
push dword [ebp - 0x28]
push dword [esi + 0x18]
call fcn.00428ace
push dword [esi + 0x14]
push dword [esi + 0x18]
call fcn.0041fd18
mov eax, 1
pop edi
pop esi
leave
ret 8
Function at 0x42103d
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push esi
push 0xffffffffffffffeb
push dword [ebp + 8]
call fcn.00428840
mov esi, eax
cmp dword [esi + 0x20], 0
je 0x421065
push 0x8000
push 0
push dword [esi + 0x20]
call fcn.00428672
push dword [ebp + 8]
call fcn.00428858
or eax, eax
je 0x421099
inc eax
mov dword [esi + 0x24], eax
push 4
push 0x1000
push dword [esi + 0x24]
push 0
call fcn.0042866c
mov dword [esi + 0x20], eax
push dword [esi + 0x20]
push dword [esi + 0x24]
push 0xd
push dword [ebp + 8]
call fcn.00428924
push dword [esi + 4]
call fcn.00428a1a
push dword [esi + 8]
call fcn.00428a1a
mov dword [esi + 0x1c], 0
mov dword [esi + 0x2c], 1
push 0
push 0
push 0x147
push dword [ebp + 8]
call fcn.00428924
mov dword [esi + 0x28], eax
push dword [ebp + 8]
call fcn.00428720
pop esi
leave
ret 4
Function at 0x422bd6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push esi
push ecx
push ebx
push edi
push dword [ebp + 8]
call fcn.0042b3c4
mov dword [ebp - 4], eax
push dword [ebp + 0xc]
call fcn.0042b3c4
add dword [ebp - 4], eax
add dword [ebp - 4], 0x64
push dword [ebp - 4]
push 0
push dword [0x43c044]
call fcn.004285fa
or eax, eax
jne 0x422c95
pushfd
pushal
sub esp, 0x6c
wait
fnsave dword [esp]
cld
mov eax, esp
and esp, 0xfffffffc
push eax
mov eax, dword [eax + 0x88]
push 0x43c054
call fcn.00428558
push str.DBPLUGIN
push 0
push 0xff
push str.MemAlloc_failed
call fcn.0042947b
test dword [0x43c050], 1
je 0x422c6a
push str.DBPLUGIN
push 0
push 0x808080
push str.__frmcommn.asm__244_
call fcn.0042947b
push str.DBPLUGIN
push 0x80
push 0
push 0x437574
call fcn.0042947b
push 0x43c054
call fcn.00428618
pop esp
frstor dword [esp]
add esp, 0x6c
popal
popfd
xor eax, eax
mov dword [ebp - 8], eax
or eax, eax
je 0x422db0
mov byte [eax], 0
push dword [ebp + 8]
push dword [ebp - 8]
call fcn.0042868a
push 0x43c5ce
push dword [ebp - 8]
push 1
call fcn.0042b2f8
mov dword [ebp - 4], eax
push dword [ebp - 8]
call fcn.0042b3c4
cmp dword [ebp - 4], 0
jbe 0x422ce1
cmp dword [ebp - 4], eax
jne 0x422cda
mov eax, 0x43c5bb
jmp 0x422ce6
mov eax, 0x43c5c2
jmp 0x422ce6
mov eax, 0x43c5ce
push eax
push dword [ebp - 8]
call fcn.0042868a
push dword [ebp + 0xc]
push dword [ebp - 8]
call fcn.0042868a
push 1
push 0
push 0
push dword [ebp - 8]
push 0x413a1d
push dword [0x43c160]
call sub.8485868788898A8B8C8D8E8F909192939495969798999A9B9C9D9E9FA0A1A2A3A4A5A6A7A8A9AAABACADAEAFB0B1B2B3B4B5B6B7B8B9BABBBCBDBEBFC0
push eax
push dword [ebp - 8]
push 0
push dword [0x43c044]
call fcn.00428600
or eax, eax
jne 0x422daf
pushfd
pushal
sub esp, 0x6c
wait
fnsave dword [esp]
cld
mov eax, esp
and esp, 0xfffffffc
push eax
mov eax, dword [eax + 0x88]
push 0x43c054
call fcn.00428558
push str.DBPLUGIN
push 0
push 0xff
push str.MemFree_failed
call fcn.0042947b
test dword [0x43c050], 1
je 0x422d84
push str.DBPLUGIN
push 0
push 0x808080
push str.__frmcommn.asm__268_
call fcn.0042947b
push str.DBPLUGIN
push 0x80
push 0
push 0x437574
call fcn.0042947b
push 0x43c054
call fcn.00428618
pop esp
frstor dword [esp]
add esp, 0x6c
popal
popfd
xor eax, eax
pop eax
cmp eax, 0x20
jbe 0x422dbc
mov eax, 0
jmp 0x422dde
push dword [0x44d854]
push 0xf
call fcn.0040a1e8
push 0
push 0
push eax
push dword [0x43c160]
call fcn.004288ca
mov eax, 1
pop edi
pop ebx
pop ecx
pop esi
leave
ret 8
Function at 0x423654
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbf8
mov dword [ebp - 4], 0
lea eax, [ebp - 0x208]
push eax
push 0x200
call fcn.004285ca
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call fcn.0042868a
cmp dword [ebp + 0x10], 0
jne 0x423695
lea eax, [ebp - 0x408]
mov dword [ebp - 8], eax
jmp 0x42369b
push dword [ebp + 0x10]
pop dword [ebp - 8]
mov eax, dword [ebp + 0xc]
inc dword [eax]
inc dword [ebp - 4]
push dword [eax]
lea eax, [ebp - 0x208]
push eax
push dword [ebp - 8]
call fcn.004286b4
add esp, 0xc
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push dword [ebp - 8]
call fcn.00428540
cmp eax, 0xffffffff
je 0x4236da
jmp 0x4236e2
cmp dword [ebp - 4], 0xa
jae 0x4236e2
jmp 0x42369b
leave
ret 0xc

Function at 0x4236e6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe00
lea eax, [ebp - 0x200]
push eax
push 0x200
call fcn.004285ca
push dword [ebp + 8]
lea eax, [ebp - 0x200]
push eax
call fcn.0042868a
push dword [ebp + 0xc]
lea eax, [ebp - 0x200]
push eax
push dword [ebp + 0x10]
call fcn.004286b4
add esp, 0xc
leave
ret 0xc

Function at 0x423728
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
lea eax, [ebp - 0x204]
push eax
push 0x200
call fcn.004285ca
push dword [ebp + 8]
lea eax, [ebp - 0x204]
push eax
call fcn.0042868a
mov eax, dword [0x43df04]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x423763
leave
ret 8
push dword [ebp - 4]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.004286b4
add esp, 0xc
lea eax, [ebp - 0x404]
push eax
call fcn.00428552
dec dword [ebp - 4]
jmp 0x423759
Function at 0x424810
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffb58
push edi
push esi
push 0xa5
lea eax, [ebp - 0x4a5]
push eax
push dword [ebp + 8]
call fcn.0042b450
lea edi, [ebp - 0x400]
add edi, dword [ebp - 0x467]
mov esi, dword [ebp - 0x481]
push esi
call fcn.004286a2
jmp 0x424a57
cmp byte [esi], 0xa
jne 0x424a4a
cmp byte [esi - 2], 0xa
jne 0x424a4a
mov cl, byte [esi]
mov byte [edi], cl
inc esi
inc edi
mov byte [edi], 0
mov byte [ebp - 0x463], 1
mov dword [ebp - 0x475], esi
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x4a5]
push eax
call fcn.00424644
lea eax, [ebp - 0x43c]
push eax
call fcn.0042ad14
mov word [ebp - 0x469], ax
cmp byte [ebp - 0x43c], 0x33
jne 0x424966
mov byte [ebp - 0x461], 1
lea eax, [ebp - 0x400]
push eax
call fcn.004286cc
lea eax, [ebp - 0x400]
push eax
call fcn.004286a2
mov ecx, eax
lea edi, [ebp - 0x400]
mov al, 0x6c
repne scasb al, byte es:[edi]
push edi
push ecx
dec edi
mov esi, str.location:
mov ecx, 9
repe cmpsb byte [esi], byte es:[edi]
mov esi, edi
pop ecx
pop edi
je 0x4248fd
test ecx, ecx
jne 0x4248cf
lea eax, [ebp - 0x4a5]
push eax
call fcn.0042449f
jmp 0x424a5f
push 0x200
lea eax, [ebp - 0x200]
push eax
call fcn.00428642
mov edi, esi
lea esi, [ebp - 0x200]
cmp byte [edi], 0x20
jne 0x424925
mov al, 0x20
mov ecx, 0x200
repe scasb al, byte es:[edi]
dec edi
jmp 0x42492d
mov al, byte [edi]
mov byte [esi], al
inc edi
inc esi
cmp byte [edi], 0
je 0x42493c
cmp byte [edi], 0xd
je 0x42493c
cmp byte [edi], 0xa
jne 0x424927
lea eax, [ebp - 0x200]
push eax
pop dword [ebp - 0x440]
lea eax, [ebp - 0x4a5]
push eax
call fcn.004244e0
lea eax, [ebp - 0x4a5]
push eax
call fcn.0042417a
jmp 0x424a46
cmp word [ebp - 0x469], 0xcc
je 0x42497a
cmp byte [ebp - 0x43c], 0x34
jne 0x42498b
lea eax, [ebp - 0x4a5]
push eax
call fcn.0042449f
jmp 0x424a46
cmp byte [ebp - 0x43c], 0x32
je 0x4249a1
cmp byte [ebp - 0x43c], 0x35
jne 0x424a3a
push str.multipart_
lea eax, [ebp - 0x400]
push eax
call fcn.00424a79
cmp eax, 0
jbe 0x4249d3
mov byte [ebp - 0x45b], 1
mov byte [ebp - 0x45a], 1
lea eax, [ebp - 0x4a5]
push eax
call fcn.00424767
jmp 0x424a46
push str.accept_ranges:
lea eax, [ebp - 0x400]
push eax
call fcn.00424a79
cmp eax, 0
ja 0x4249f4
cmp word [ebp - 0x469], 0xce
jne 0x4249fd
mov byte [ebp - 0x45b], 1
jmp 0x424a1a
push str.Content_Range:
lea eax, [ebp - 0x400]
push eax
call fcn.00424a79
cmp eax, 0
jbe 0x424a1a
mov byte [ebp - 0x45b], 1
cmp dword [ebp - 0x418], 2
je 0x424a2c
cmp dword [ebp - 0x418], 3
jne 0x424a38
lea eax, [ebp - 0x4a5]
push eax
call fcn.00424c35
jmp 0x424a46
lea eax, [ebp - 0x4a5]
push eax
call fcn.0042449f
jmp 0x424a5f
mov cl, byte [esi]
mov byte [edi], cl
inc edi
inc esi
inc dword [ebp - 0x467]
dec eax
or eax, eax
jne 0x42484c
push 0xa5
push dword [ebp + 8]
lea eax, [ebp - 0x4a5]
push eax
call fcn.0042b450
pop esi
pop edi
leave
ret 4
Function at 0x424cf0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x2c], 0
je 0x424d46
cmp dword [esi + 0x8d], 3
jne 0x424d32
cmp dword [esi + 0x95], 0
jne 0x424d32
push 4
push 0x1000
push dword [esi + 0x2c]
push 0
call fcn.0042866c
mov dword [esi + 0x95], eax
push dword [esi + 0x2c]
pop dword [esi + 0x99]
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x38]
cmp eax, dword [esi + 0x2c]
jbe 0x424d46
mov eax, dword [esi + 0x2c]
sub eax, dword [esi + 0x38]
mov dword [ebp + 0x10], eax
mov eax, dword [ebp + 0x10]
add eax, dword [esi + 0x38]
cmp eax, dword [esi + 0x2c]
jne 0x424d58
mov dword [esi + 0x75], 1
cmp dword [esi + 0x8d], 2
jne 0x424d7b
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi + 0x6d]
call fcn.00428684
push eax
jmp 0x424e2e
cmp dword [esi + 0x8d], 3
jne 0x424e2e
mov eax, dword [esi + 0x9d]
add eax, dword [ebp + 0x10]
cmp eax, dword [esi + 0x99]
ja 0x424da2
cmp dword [esi + 0x95], 0
jne 0x424dfc
shl eax, 1
mov dword [ebp - 8], eax
push 4
push 0x1000
push dword [ebp - 8]
push 0
call fcn.0042866c
mov dword [ebp - 4], eax
cmp dword [esi + 0x95], 0
je 0x424dea
push dword [esi + 0x9d]
push dword [ebp - 4]
push dword [esi + 0x95]
call fcn.0042b450
push 0x8000
push 0
push dword [esi + 0x95]
call fcn.00428672
push dword [ebp - 4]
pop dword [esi + 0x95]
push dword [ebp - 8]
pop dword [esi + 0x99]
cmp dword [esi + 0x95], 0
je 0x424e2e
mov eax, dword [esi + 0x95]
add eax, dword [esi + 0x9d]
push dword [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.0042b450
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
add dword [esi + 0x9d], eax
mov eax, 1
cmp eax, 1
jne 0x424e4a
mov eax, dword [ebp - 0xc]
add dword [esi + 0x38], eax
add dword [esi + 0x4c], eax
cmp dword [esi + 0x71], 0
je 0x424e4a
push dword [ebp + 8]
call fcn.00423a5e
pop eax
pop esi
leave
ret 0xc
Function at 0x425d5d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4495f8
cmp edx, dword [eax]
je 0x425d7f
add eax, 8
inc ecx
cmp eax, 0x449688
jl 0x425d70
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4495f8]
jne 0x425ead
mov eax, dword [0x44f6a4]
cmp eax, 1
je 0x425e87
test eax, eax
jne 0x425db0
cmp dword [0x449548], 1
je 0x425e87
cmp edx, 0xfc
je 0x425ead
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [0x4371cc]
test eax, eax
jne 0x425de7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00426340
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004264f0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x425e2a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004264f0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4380a8
push edi
call fcn.00427b90
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00426340
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00426350
lea eax, [ebp - 0xa0]
push 0x438088
push eax
call fcn.00426350
push dword [esi + 0x4495fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.00426350
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00427b04
add esp, 0x2c
pop edi
jmp 0x425ead
lea eax, [ebp + 8]
lea esi, [esi + 0x4495fc]
push 0
push eax
push dword [esi]
call fcn.004264f0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [0x4371b4]
push eax
call dword [0x4371f8]
pop esi
leave
ret
Function at 0x429200
Capabilities:
Create process on windows
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffec4
push ebx
cmp dword [0x43c06c], 0xffffffff
jne 0x42921a
xor eax, eax
jmp 0x429399
push dword [0x43c06c]
call fcn.00428882
or eax, eax
jne 0x429361
push 0
push str.DebugCenter
call fcn.0042877a
or eax, eax
jne 0x4292fd
lea ebx, [ebp - 0x130]
lea eax, [ebp - 0x134]
push eax
push 0xf003f
push 0
push 0x43816e
push Ordinal_4
call fcn.00432896
mov dword [ebp - 0x13c], 0x104
lea eax, [ebp - 0x13c]
push eax
push ebx
lea eax, [ebp - 0x138]
push eax
push 0
push str.Path
push dword [ebp - 0x134]
call fcn.0043289c
or eax, eax
jne 0x4292d9
push ebx
call fcn.0042a860
or eax, eax
je 0x4292b3
push 1
push ebx
call fcn.004350e2
push 0
push str.DebugCenter
call fcn.0042877a
jmp 0x4292fd
push 0x10
push str.Debug_Error
push str.Debug_Center_not_found_
push 0
call fcn.004288ca
mov dword [0x43c06c], 0xffffffff
xor eax, eax
jmp 0x429399
push 0x10
push str.Debug_Error
push str.Registration_error__r_nStart_DebugCenter_manually...
push 0
call fcn.004288ca
mov dword [0x43c06c], 0xffffffff
xor eax, eax
jmp 0x429399
or eax, eax
je 0x429340
mov dword [0x43c06c], eax
mov dword [ebp - 0x2c], 0x2c
lea eax, [ebp - 0x2c]
push eax
push dword [0x43c06c]
call fcn.00435100
cmp dword [ebp - 0x24], 2
jne 0x429339
push 0
push 0x3e7
push 0x111
push dword [0x43c06c]
call fcn.00428924
mov eax, 1
jmp 0x429399
push 0x10
push str.Debug_Error
push str.Debug_Center_can_not_be_opened_
push 0
call fcn.004288ca
mov dword [0x43c06c], 0xffffffff
xor eax, eax
jmp 0x429399
mov dword [ebp - 0x2c], 0x2c
lea eax, [ebp - 0x2c]
push eax
push dword [0x43c06c]
call fcn.00435100
cmp dword [ebp - 0x24], 2
jne 0x429394
push 0
push 0x3e7
push 0x111
push dword [0x43c06c]
call fcn.00428924
mov eax, 1
pop ebx
leave
ret
Function at 0x42947b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
cmp dword [ebp + 8], 0
jne 0x429495
mov dword [ebp + 8], str.String_NULL_Pointer
mov dword [ebp + 0xc], 0xff
mov eax, dword [0x43c04c]
cmp eax, 2
jne 0x4294f4
call fcn.004293d8
call fcn.004293d8
or eax, eax
je 0x4294ca
push dword [ebp + 8]
call fcn.0042a680
lea edx, [ebp - 4]
push 0
push edx
push eax
push dword [ebp + 8]
push dword [0x43c06c]
call fcn.00428684
test dword [ebp + 0x10], 0x80
je 0x429633
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x438140
push dword [0x43c06c]
call fcn.00428684
jmp 0x429633
cmp eax, 1
jne 0x42958f
call fcn.0042939c
or eax, eax
je 0x429633
mov eax, dword [ebp + 0xc]
test eax, 0xf0
je 0x42951d
mov dword [ebp - 8], 4
jmp 0x429524
mov dword [ebp - 8], 0
test eax, 0xf000
je 0x42952f
or dword [ebp - 8], 2
test eax, 0xf00000
je 0x42953a
or dword [ebp - 8], 1
or dword [ebp - 8], 8
push dword [ebp - 8]
push dword [0x43c06c]
call fcn.004350d6
push dword [ebp + 8]
call fcn.0042a680
lea ecx, [ebp - 4]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [0x43c06c]
call fcn.004350e8
test dword [ebp + 0x10], 0x80
je 0x42958a
push 0
lea eax, [ebp - 4]
push eax
push 2
push 0x438140
push dword [0x43c06c]
call fcn.004350e8
jmp 0x429633
call fcn.00429200
or eax, eax
je 0x429633
mov dword [ebp - 0x18], 0x58adf9ac
push dword [ebp + 8]
call fcn.0042a680
add eax, 0xe
push eax
push dword [ebp + 0x14]
call fcn.0042a680
add eax, 6
push eax
add eax, dword [esp + 4]
mov dword [ebp - 0x14], eax
push eax
push 0x40
call fcn.004285dc
mov dword [ebp - 0x10], eax
mov byte [eax], 0
push dword [esp]
pop dword [eax + 1]
push dword [ebp + 0x14]
lea eax, [eax + 5]
push eax
call fcn.0042a810
mov ecx, dword [ebp - 0x10]
add ecx, dword [esp]
mov byte [ecx], 2
push dword [esp + 4]
pop dword [ecx + 1]
push dword [ebp + 0x10]
pop dword [ecx + 9]
push dword [ebp + 0xc]
pop dword [ecx + 5]
push dword [ebp + 8]
lea eax, [ecx + 0xd]
push eax
call fcn.0042a810
add esp, 8
lea eax, [ebp - 0xc]
push eax
push 0x1388
push 1
lea eax, [ebp - 0x18]
push eax
push 0xffffffffffffffff
push 0x4a
push dword [0x43c06c]
call fcn.00435106
push dword [ebp - 0x10]
call fcn.004285e2
leave
ret 0x10

Function at 0x42a220
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
push ebx
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x242]
push eax
call fcn.0042a830
push 0x4394f0
push eax
call fcn.0042ac40
lea eax, [ebp - 0x13e]
push eax
lea eax, [ebp - 0x242]
push eax
call fcn.0042856a
cmp eax, 0xffffffff
je 0x42a26a
push eax
call fcn.00428564
mov eax, 1
jmp 0x42a2be
mov ebx, dword [ebp + 8]
push 0x5c
push ebx
call fcn.0042ac60
or eax, eax
je 0x42a2be
inc eax
mov esi, eax
push 0x5c
push esi
call fcn.0042ac60
mov esi, eax
or eax, eax
je 0x42a29c
sub eax, ebx
push eax
push ebx
lea eax, [ebp - 0x242]
push eax
call fcn.0042ac90
jmp 0x42a2a9
push ebx
lea eax, [ebp - 0x242]
push eax
call fcn.0042a810
push 0
lea eax, [ebp - 0x242]
push eax
call fcn.004350ee
or esi, esi
je 0x42a2be
inc esi
jmp 0x42a27c
pop esi
pop ebx
leave
ret 4