joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430520
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov byte [ebp - 0x36], 0x50
mov ebx, dword [ebp + 8]
mov byte [ebp - 0x35], 0x4b
mov byte [ebp - 0x34], 1
mov byte [ebp - 0x33], 2
mov eax, dword [ebx + 4]
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x32], al
sar ax, 8
mov byte [ebp - 0x31], al
mov ax, word [ebx + 6]
mov byte [ebp - 0x30], al
sar ax, 8
mov byte [ebp - 0x2f], al
mov eax, dword [ebx + 8]
mov byte [ebp - 0x2e], al
sar ax, 8
mov byte [ebp - 0x2d], al
mov ax, word [ebx + 0xa]
mov byte [ebp - 0x2c], al
sar ax, 8
mov byte [ebp - 0x2b], al
mov eax, dword [ebx + 0xc]
mov byte [ebp - 0x2a], al
sar ax, 8
mov byte [ebp - 0x29], al
mov ax, word [ebx + 0xe]
mov byte [ebp - 0x28], al
sar ax, 8
mov byte [ebp - 0x27], al
mov eax, dword [ebx + 0x10]
mov byte [ebp - 0x26], al
sar eax, 8
mov byte [ebp - 0x25], al
sar eax, 8
mov byte [ebp - 0x24], al
sar eax, 8
mov byte [ebp - 0x23], al
mov eax, dword [ebx + 0x14]
mov byte [ebp - 0x22], al
sar eax, 8
mov byte [ebp - 0x21], al
sar eax, 8
mov byte [ebp - 0x20], al
sar eax, 8
mov byte [ebp - 0x1f], al
mov eax, dword [ebx + 0x18]
mov byte [ebp - 0x1e], al
sar eax, 8
mov byte [ebp - 0x1d], al
sar eax, 8
mov byte [ebp - 0x1c], al
sar eax, 8
mov byte [ebp - 0x1b], al
mov eax, dword [ebx + 0x1c]
mov byte [ebp - 0x1a], al
sar ax, 8
mov byte [ebp - 0x19], al
mov ax, word [ebx + 0x1e]
mov byte [ebp - 0x18], al
sar ax, 8
mov byte [ebp - 0x17], al
mov eax, dword [ebx + 0x20]
mov byte [ebp - 0x16], al
sar ax, 8
mov byte [ebp - 0x15], al
mov ax, word [ebx + 0x22]
mov byte [ebp - 0x14], al
sar ax, 8
mov byte [ebp - 0x13], al
mov eax, dword [ebx + 0x24]
mov byte [ebp - 0x12], al
sar ax, 8
mov byte [ebp - 0x11], al
mov eax, dword [ebx + 0x28]
mov byte [ebp - 0x10], al
sar eax, 8
mov byte [ebp - 0xf], al
sar eax, 8
mov byte [ebp - 0xe], al
sar eax, 8
mov byte [ebp - 0xd], al
mov eax, dword [ebx + 0x2c]
mov byte [ebp - 0xc], al
sar eax, 8
mov byte [ebp - 0xb], al
sar eax, 8
mov byte [ebp - 0xa], al
sar eax, 8
mov byte [ebp - 9], al
lea eax, [ebp - 0x36]
push esi
push 0x2e
push 1
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov ecx, 0x80000000
cmp eax, 0x2e
je 0x430670
lea esp, [ebp - 8]
mov eax, ecx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebx + 0x1c]
test ax, ax
jne 0x4306bf
mov ax, word [ebx + 0x1e]
test ax, ax
jne 0x4306ec
mov eax, dword [ebx + 0x20]
test ax, ax
jne 0x430694
xor ecx, ecx
lea esp, [ebp - 8]
mov eax, ecx
pop ebx
pop esi
pop ebp
ret
and eax, 0xffff
push esi
push eax
push 1
mov eax, dword [ebx + 0x38]
push eax
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x20]
add esp, 0x10
and edx, 0xffff
mov ecx, 0x80000000
cmp eax, edx
jne 0x430665
xor ecx, ecx
jmp 0x43068b
and eax, 0xffff
push esi
push eax
push 1
mov eax, dword [ebx + 0x30]
push eax
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x1c]
add esp, 0x10
and edx, 0xffff
mov ecx, 0x80000000
cmp eax, edx
jne 0x430665
jmp 0x430678
and eax, 0xffff
push esi
push eax
push 1
mov eax, dword [ebx + 0x34]
push eax
call sub.msvcrt.dll_fwrite
mov dx, word [ebx + 0x1e]
add esp, 0x10
and edx, 0xffff
mov ecx, 0x80000000
cmp eax, edx
jne 0x430665
jmp 0x430681
Function at 0x430800
Capabilities:
Enumerate pe sections
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x20
mov byte [ebp - 0x1e], 0x50
mov ebx, dword [ebp + 8]
mov byte [ebp - 0x1d], 0x4b
mov byte [ebp - 0x1c], 5
mov byte [ebp - 0x1b], 6
mov eax, dword [ebx + 4]
mov esi, dword [ebp + 0xc]
mov byte [ebp - 0x1a], al
sar ax, 8
mov byte [ebp - 0x19], al
mov ax, word [ebx + 6]
mov byte [ebp - 0x18], al
sar ax, 8
mov byte [ebp - 0x17], al
mov eax, dword [ebx + 8]
mov byte [ebp - 0x16], al
sar ax, 8
mov byte [ebp - 0x15], al
mov ax, word [ebx + 0xa]
mov byte [ebp - 0x14], al
sar ax, 8
mov byte [ebp - 0x13], al
mov eax, dword [ebx + 0xc]
mov byte [ebp - 0x12], al
sar eax, 8
mov byte [ebp - 0x11], al
sar eax, 8
mov byte [ebp - 0x10], al
sar eax, 8
mov byte [ebp - 0xf], al
mov eax, dword [ebx + 0x10]
mov byte [ebp - 0xe], al
sar eax, 8
mov byte [ebp - 0xd], al
sar eax, 8
mov byte [ebp - 0xc], al
sar eax, 8
mov byte [ebp - 0xb], al
mov eax, dword [ebx + 0x14]
mov byte [ebp - 0xa], al
sar ax, 8
mov byte [ebp - 9], al
lea eax, [ebp - 0x1e]
push esi
push 0x16
push 1
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
mov ecx, 0x80000000
cmp eax, 0x16
je 0x4308b5
lea esp, [ebp - 8]
mov eax, ecx
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebx + 0x14]
test ax, ax
jne 0x4308c8
xor ecx, ecx
lea esp, [ebp - 8]
mov eax, ecx
pop ebx
pop esi
pop ebp
ret
and eax, 0xffff
push esi
push 1
push eax
mov ecx, dword [ebx + 0x18]
push ecx
call sub.msvcrt.dll_fwrite
mov edx, dword [ebx + 0x14]
add esp, 0x10
and edx, 0xffff
mov ecx, 0x80000000
cmp eax, edx
jne 0x4308ac
xor ecx, ecx
jmp 0x4308bf
Function at 0x430aa0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x800c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00485f10
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
cmp edi, esi
je 0x430b90
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x430b90
mov eax, 0x80000000
cmp edi, esi
jl 0x430b40
jmp 0x430b92
mov eax, dword [ebp - 0x8010]
mov edx, dword [ebp + 0xc]
push edx
push eax
lea eax, [ebp - 0x800c]
push 1
push eax
call sub.msvcrt.dll_fread
add esp, 0x10
mov ebx, eax
cmp eax, dword [ebp - 0x8010]
jne 0x430b9a
push eax
mov eax, dword [ebp + 0xc]
push 0
push edi
push eax
call sub.msvcrt.dll_fseek
add esp, 0x10
test eax, eax
jne 0x430bc0
mov eax, dword [ebp + 0xc]
push eax
lea eax, [ebp - 0x800c]
push ebx
push 1
push eax
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp ebx, eax
jne 0x430bc8
sub dword [ebp + 0x18], ebx
je 0x430b90
add esi, ebx
add edi, ebx
mov dword [ebp - 0x8010], 0x8000
cmp dword [ebp + 0x18], 0x7fff
ja 0x430b5c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x8010], eax
mov ecx, dword [ebp + 0xc]
push ebx
push 0
push esi
push ecx
call sub.msvcrt.dll_fseek
add esp, 0x10
test eax, eax
je 0x430ad7
push esi
push str.filemove_src_seek__ld_failed_n
push 0x4b3720
push 3
call fcn.0044c320
mov eax, 0x80000000
add esp, 0x10
jmp 0x430b92
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
mov eax, dword [ebp - 0x8010]
push esi
push eax
push str.filemove_read__ld_off_ld_failed_n
push 0x4b3720
push 3
call fcn.0044c320
mov eax, 0x80000000
add esp, 0x20
jmp 0x430b92
push edi
push str.filemove_dst_seek__ld_failed_n
jmp 0x430b7a
sub esp, 0xc
push edi
push ebx
push str.filemove_write__ld_off_ld_failed_n
jmp 0x430baa

Function at 0x430c20
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x800c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00485f10
mov ebx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
test ebx, ebx
je 0x430c4e
push ecx
push 0
push 0
push 0
call fcn.0047ae90
mov edx, dword [ebp + 0x18]
add esp, 0x10
mov dword [edx], eax
lea edi, [ebp - 0x800c]
test esi, esi
jne 0x430cb3
jmp 0x430cc1
mov ebx, 0x8000
mov eax, 0x8000
mov edx, dword [ebp + 0x10]
push edx
push eax
push 1
push edi
call sub.msvcrt.dll_fread
add esp, 0x10
cmp eax, ebx
jne 0x430ccb
mov eax, dword [ebp + 0x18]
test eax, eax
je 0x430c9b
push eax
push ebx
push edi
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
push eax
call fcn.0047ae90
mov edx, dword [ebp + 0x18]
add esp, 0x10
mov dword [edx], eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
push 1
push edi
call sub.msvcrt.dll_fwrite
add esp, 0x10
cmp ebx, eax
jne 0x430ced
sub esi, ebx
je 0x430cc1
cmp esi, 0x7fff
jg 0x430c60
mov eax, esi
mov ebx, esi
jmp 0x430c6a
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
push ebx
push str.fread__d_bytes_failed_n
push 0x4b3720
push 3
call fcn.0044c320
mov eax, 0x80000000
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push ebx
push str.fwrite__d_bytes_failed_n
jmp 0x430cd1
Function at 0x430d00
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push eax
mov ebx, dword [ebp + 0x14]
push 0
mov esi, dword [ebp + 0x18]
push 0
push 0
call fcn.0047ae90
add esp, 0x10
mov dword [esi], eax
test ebx, ebx
jne 0x430d30
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov edx, dword [ebp + 0x10]
push ecx
push ebx
push edx
push eax
call fcn.0047ae90
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
push eax
push ebx
push 1
push esi
call sub.msvcrt.dll_fwrite
add esp, 0x20
cmp eax, ebx
je 0x430d20
push ebx
push str.fwrite__d_bytes_failed_n
push 0x4b3720
push 3
call fcn.0044c320
mov eax, 0x80000000
add esp, 0x10
jmp 0x430d22

Function at 0x430d80
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov eax, 0x800c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00485f10
mov edi, dword [ebp + 0x14]
push eax
push 0
push 0
push 0
call fcn.0047ae90
lea esi, [ebp - 0x800c]
mov dword [edi], eax
add esp, 0x10
lea esi, [esi]
mov eax, dword [ebp + 0x10]
push eax
push 0x8000
push 1
push esi
call sub.msvcrt.dll_fread
add esp, 0x10
mov ebx, eax
mov eax, dword [ebp + 0x10]
test byte [eax + 0xc], 0x20
jne 0x430e1f
mov eax, dword [ebp + 0xc]
test byte [eax + 0xc], 0x20
jne 0x430e1f
test ebx, ebx
je 0x430e33
push eax
push ebx
push esi
mov eax, dword [edi]
push eax
call fcn.0047ae90
mov dword [edi], eax
mov eax, dword [ebp + 0xc]
push eax
push ebx
push 1
push esi
call sub.msvcrt.dll_fwrite
add esp, 0x20
cmp ebx, eax
je 0x430db0
push ebx
push str.fwrite__d_bytes_failed_n
push 0x4b3720
push 3
call fcn.0044c320
mov eax, 0x80000000
add esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
call sub.msvcrt.dll__errno
mov eax, dword [eax]
call fcn.00430720
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x431190
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x18
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebx + 0x44]
mov eax, dword [ebx + 0x40]
mov dword [ebp - 0x10], eax
push edi
call sub.msvcrt.dll_malloc
add esp, 0x10
mov esi, eax
test eax, eax
je 0x431224
push eax
mov eax, dword [ebp + 8]
push 0
push 0
mov ecx, dword [eax]
push ecx
call sub.msvcrt.dll_fseek
add esp, 0xc
push 0
mov eax, dword [ebx + 0x20]
mov edx, dword [ebx + 0x58]
and eax, 0xffff
add eax, edx
mov dx, word [ebx + 0x22]
and edx, 0xffff
lea eax, [eax + edx + 0x1e]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call sub.msvcrt.dll_fseek
add esp, 0x10
test eax, eax
jne 0x431216
mov ax, word [ebx + 0x36]
test ax, ax
jne 0x431230
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
push edi
push 1
push esi
call sub.msvcrt.dll_fread
add esp, 0x10
cmp edi, eax
je 0x431224
sub esp, 0xc
push esi
xor esi, esi
call sub.msvcrt.dll_free
add esp, 0x10
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
cmp ax, 8
jne 0x431216
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
push edx
push edi
push esi
mov eax, dword [eax]
push eax
call fcn.00445c00
add esp, 0x10
test al, al
jne 0x431224
sub esp, 0xc
push esi
call sub.msvcrt.dll_free
xor esi, esi
add esp, 0x10
jmp 0x431224
Function at 0x4361b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x4c
lea ebx, [ebp - 0x4c]
mov esi, dword [ebp + 0x14]
nop
push eax
push eax
push ebx
mov eax, dword [esi]
push eax
call sub.msvcrt.dll__stat
add esp, 0x10
inc eax
jne 0x436220
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x4361c0
call sub.msvcrt.dll__errno
mov edx, 1
cmp dword [eax], 2
je 0x436216
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push eax
call sub.msvcrt.dll_strerror
mov dword [esp], eax
mov eax, dword [esi]
push eax
push str.failed_to_stat_file__s:__s_n
push 0x4b3dd1
push 5
call fcn.0044c320
xor edx, edx
add esp, 0x20
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp - 0x38]
cmp eax, 0xb
jle 0x436265
push edi
push edi
push 0
mov ebx, dword [esi]
push ebx
call sub.msvcrt.dll__open
add esp, 0x10
mov edi, eax
cmp eax, 0xffffffff
jne 0x436273
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x436228
call sub.msvcrt.dll__errno
sub esp, 0xc
mov eax, dword [eax]
push eax
call sub.msvcrt.dll_strerror
mov dword [esp], eax
mov eax, dword [esi]
push eax
push str.failed_to_open_file__s:__s_n
jmp 0x436205
sub esp, 0xc
push eax
mov eax, dword [esi]
push eax
push str.file__s_has_unexpectedly_small_size_zd_n
jmp 0x436205
mov ebx, 0xc
lea esi, [ebp - 0x1c]
nop
lea esi, [esi]
mov eax, esi
push ecx
sub eax, ebx
push ebx
push eax
push edi
call sub.msvcrt.dll__read
add esp, 0x10
cmp eax, 0xffffffff
je 0x436336
test eax, eax
js 0x436344
sub ebx, eax
jne 0x436280
sub esp, 0xc
push edi
call sub.msvcrt.dll__close
add esp, 0x10
inc eax
jne 0x4362be
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x4362a5
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push 0xc
push eax
call fcn.004398b0
add esp, 0x10
test al, al
je 0x43635d
lea eax, [ebp - 0x18]
mov edx, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push str.resources.arsc
push edx
push eax
call fcn.00436120
add esp, 0x10
test al, al
je 0x43635d
mov eax, dword [ebp + 0x10]
push esi
push str.resources.arsc
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00436120
add esp, 0x10
test al, al
je 0x43635d
mov eax, dword [ebp - 0x10]
mov edx, 1
cmp eax, dword [ebp - 0x18]
jne 0x436216
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x1c]
setne al
xor edx, edx
mov dl, al
jmp 0x436216
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x436280
sub esp, 0xc
push edi
call sub.msvcrt.dll__close
add esp, 0x10
inc eax
jne 0x43635d
call sub.msvcrt.dll__errno
cmp dword [eax], 4
je 0x436344
xor edx, edx
jmp 0x436216
Function at 0x445c00
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
push 0x8000
call fcn.004a39a0
mov esi, eax
add esp, 0x10
xor eax, eax
test esi, esi
je 0x445d2a
lea eax, [ebp - 0x44]
mov ecx, 0xe
mov dword [ebp - 0x50], eax
xor eax, eax
cld
mov edi, dword [ebp - 0x50]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x18], 2
lea eax, [ebp - 0x44]
push 0x38
push 0x4b6294
push 0xfffffffffffffff1
push eax
call fcn.0047da80
add esp, 0x10
mov ebx, dword [ebp + 0x14]
test eax, eax
jne 0x445d32
nop
lea esi, [esi]
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x445cc6
mov edi, ebx
cmp ebx, 0x8000
jbe 0x445ca6
mov edi, 0x8000
mov eax, dword [ebp + 8]
push eax
push edi
push 1
push esi
call sub.msvcrt.dll_fread
add esp, 0x10
cmp edi, eax
jne 0x445d8b
sub ebx, edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edi
lea eax, [ebp - 0x44]
push ecx
push ecx
push 0
push eax
call fcn.0047bcc0
add esp, 0x10
cmp eax, 1
ja 0x445d72
test eax, eax
je 0x445c90
mov eax, dword [ebp - 0x30]
mov bl, 1
cmp eax, dword [ebp + 0x10]
je 0x445d0b
sub esp, 0xc
mov edx, dword [ebp + 0x10]
xor ebx, ebx
push edx
push eax
push 0x4b6350
push str.ziputil
push 5
call fcn.0044c320
add esp, 0x20
sub esp, 0xc
lea eax, [ebp - 0x44]
push eax
call fcn.0047b7b0
add esp, 0x10
sub esp, 0xc
push esi
call fcn.004a3970
xor eax, eax
add esp, 0x10
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xfffffffa
je 0x445d66
push eax
push 0x4b62e0
push str.ziputil
push 6
call fcn.0044c320
add esp, 0x10
sub esp, 0xc
xor ebx, ebx
push esi
call fcn.004a3970
xor eax, eax
add esp, 0x10
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push 0x4b6294
push 0x4b629c
jmp 0x445d3d
push eax
push str.zlib_inflate_call_failed__zerr_d__n
push str.ziputil
push 3
call fcn.0044c320
xor ebx, ebx
add esp, 0x10
jmp 0x445d0b
sub esp, 0xc
xor ebx, ebx
push edi
push eax
push str.inflate_read_failed___d_vs__ld__n
push str.ziputil
push 3
call fcn.0044c320
add esp, 0x20
jmp 0x445d0b
Function at 0x445db0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x58
push 0x8000
call fcn.004a39a0
mov esi, eax
add esp, 0x10
xor eax, eax
test esi, esi
je 0x445ed9
lea eax, [ebp - 0x44]
mov ecx, 0xe
mov dword [ebp - 0x50], eax
xor eax, eax
cld
mov edi, dword [ebp - 0x50]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x18], 2
lea eax, [ebp - 0x44]
push 0x38
push 0x4b6294
push 0xfffffffffffffff1
push eax
call fcn.0047da80
add esp, 0x10
mov ebx, dword [ebp + 0x14]
test eax, eax
jne 0x445ee1
nop
lea esi, [esi]
mov eax, dword [ebp - 0x40]
test eax, eax
jne 0x445e75
mov edi, ebx
cmp ebx, 0x8000
jbe 0x445e56
mov edi, 0x8000
push eax
push edi
push esi
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll__read
add esp, 0x10
cmp eax, edi
jne 0x445f3a
sub ebx, edi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], edi
lea eax, [ebp - 0x44]
push ecx
push ecx
push 0
push eax
call fcn.0047bcc0
add esp, 0x10
cmp eax, 1
ja 0x445f21
test eax, eax
je 0x445e40
mov eax, dword [ebp - 0x30]
mov bl, 1
cmp eax, dword [ebp + 0x10]
je 0x445eba
sub esp, 0xc
mov edx, dword [ebp + 0x10]
xor ebx, ebx
push edx
push eax
push 0x4b6350
push str.ziputil
push 5
call fcn.0044c320
add esp, 0x20
sub esp, 0xc
lea eax, [ebp - 0x44]
push eax
call fcn.0047b7b0
add esp, 0x10
sub esp, 0xc
push esi
call fcn.004a3970
xor eax, eax
add esp, 0x10
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
cmp eax, 0xfffffffa
je 0x445f15
push eax
push 0x4b62e0
push str.ziputil
push 6
call fcn.0044c320
add esp, 0x10
sub esp, 0xc
xor ebx, ebx
push esi
call fcn.004a3970
xor eax, eax
add esp, 0x10
mov al, bl
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
push 0x4b6294
push 0x4b629c
jmp 0x445eec
push eax
push str.zlib_inflate_call_failed__zerr_d__n
push str.ziputil
push 3
call fcn.0044c320
xor ebx, ebx
add esp, 0x10
jmp 0x445eba
sub esp, 0xc
xor ebx, ebx
push edi
push eax
push str.inflate_read_failed___d_vs__ld__n
push str.ziputil
push 3
call fcn.0044c320
add esp, 0x20
jmp 0x445eba
Function at 0x447480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x1c]
push 8
call fcn.004a3a30
mov edx, dword [ebp + 8]
add esp, 8
mov dword [eax], edx
mov edx, dword [ebp + 0xc]
mov dword [eax + 4], edx
lea edx, [ebp - 8]
push edx
push 0
push eax
push 0x446d80
push 0
push 0
call sub.KERNEL32.dll_CreateThread
pop edx
test eax, eax
pop ecx
je 0x4474e0
sub esp, 0xc
push eax
call sub.KERNEL32.dll_CloseHandle
mov eax, 1
add esp, 0xc
test ebx, ebx
je 0x4474d9
mov eax, dword [ebp - 8]
mov dword [ebx], eax
mov eax, 1
mov ebx, dword [ebp - 4]
leave
ret
push eax
push str.WARNING:_thread_create_failed_n
push 0x4b63fb
push 5
call fcn.0044c320
xor eax, eax
add esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x44b5d0
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x5c
mov edx, dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], edx
mov dl, byte [ebp + 0x20]
mov dword [ebp - 0x50], eax
mov byte [ebp - 0x51], dl
cmp dword [0x4a6014], 0xffffffff
je 0x44b6f0
cmp byte [ebp - 0x51], 1
sbb ebx, ebx
sub esp, 0xc
mov edi, dword [ebp + 0x10]
and ebx, 2
push edi
call sub.msvcrt.dll__get_osfhandle
mov ecx, dword [ebp + 8]
add ebx, 2
mov dword [ecx + 0x20], eax
pop ecx
pop esi
push 0
push 0
push 0
push ebx
push 0
push eax
call sub.KERNEL32.dll_CreateFileMappingA
mov esi, eax
mov eax, dword [ebp + 8]
test esi, esi
mov dword [eax + 0x24], esi
pop eax
pop edx
je 0x44b70c
mov eax, dword [0x4a6014]
mov ecx, dword [ebp - 0x50]
mov edx, eax
mov ebx, dword [ebp - 0x4c]
sar edx, 0x1f
push edx
push eax
push ebx
push ecx
call fcn.00486200
mov ebx, dword [ebp - 0x4c]
mov ecx, eax
mov dword [ebp - 0x60], eax
sar ecx, 0x1f
mov dword [ebp - 0x5c], ecx
mov ecx, dword [ebp - 0x50]
sub ecx, dword [ebp - 0x60]
sbb ebx, dword [ebp - 0x5c]
mov dword [ebp - 0x48], ecx
cmp byte [ebp - 0x51], 1
mov dword [ebp - 0x44], ebx
mov ebx, eax
mov eax, dword [ebp + 0x1c]
lea edi, [ebx + eax]
sbb eax, eax
mov dword [esp], edi
and eax, 0xf001b
push ecx
add eax, 4
push 0
push eax
push esi
call sub.KERNEL32.dll_MapViewOfFile
mov edx, dword [ebp + 8]
add esp, 0xc
test eax, eax
mov dword [edx + 8], eax
je 0x44b734
mov ecx, dword [ebp + 0xc]
xor eax, eax
test ecx, ecx
je 0x44b6bb
sub esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
call sub.msvcrt.dll__strdup
add esp, 0x10
mov edx, dword [ebp + 8]
mov dword [edx + 4], eax
mov dword [edx + 0xc], edi
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x50]
mov edx, dword [ebp - 0x4c]
mov dword [ecx + 0x10], eax
mov eax, dword [ecx + 8]
add ebx, eax
mov dword [ecx + 0x14], edx
mov dword [ecx + 0x18], ebx
mov eax, 1
mov ebx, dword [ebp + 0x1c]
mov dword [ecx + 0x1c], ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
sub esp, 0xc
lea eax, [ebp - 0x34]
push eax
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov dword [0x4a6014], eax
jmp 0x44b5f8
call fcn.0048ea5c
mov edx, dword [ebp + 8]
push edi
push edi
push eax
push ebx
mov esi, dword [edx + 0x20]
push esi
push str.CreateFileMapping__p___lx__failed_with_error__ld_n
push str.filemap
push 6
call fcn.0044c320
xor eax, eax
add esp, 0x20
jmp 0x44b6e6
call fcn.0048ea5c
mov esi, dword [ebp - 0x48]
push edx
push eax
push edi
mov edi, dword [ebp - 0x44]
push edi
push esi
push str.MapViewOfFile__ld___ld__failed_with_error__ld_n
push str.filemap
push 6
call fcn.0044c320
mov ecx, dword [ebp + 8]
add esp, 0x14
mov ebx, dword [ecx + 0x24]
push ebx
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [ebp + 8]
xor eax, eax
add esp, 0xc
mov dword [ebx + 0x24], 0xffffffff
jmp 0x44b6e6