joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0770
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4f07a6
mov dword [0x53d030], eax
mov edx, 0x4f0750
mov dword [esp + 4], edx
mov dword [esp], eax
call fcn.004f0e40
test eax, eax
sete al
movzx eax, al
mov dword [0x503e60], eax
leave
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [0x503e60], eax
leave
ret

Function at 0x4f0890
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp - 0xc]
sub esp, 0x68
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x40]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x28], 0x4ee970
mov dword [ebp - 0x24], 0x4f37c0
mov dword [ebp - 0x1c], 0x4f0950
mov dword [ebp - 0x18], esp
mov dword [esp], eax
call fcn.004f13e0
cmp dword [0x503e60], 0
mov dword [ebp - 0x44], 0x53d040
je 0x4f0930
jl 0x4f0970
mov dword [ebp - 0x3c], 1
mov eax, dword [0x53d030]
mov dword [ebp - 0x4c], eax
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
sub esp, 4
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x54]
sub esp, 4
test eax, eax
mov dword [ebp - 0x48], eax
je 0x4f0a13
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x44], eax
lea esi, [esi]
lea eax, [ebp - 0x40]
mov dword [esp], eax
call fcn.004f14c0
mov eax, dword [ebp - 0x44]
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [0x53d070]
mov eax, 0xffffffff
test edx, edx
je 0x4f098a
mov eax, dword [0x503e64]
test eax, eax
je 0x4f09ca
xor eax, eax
test eax, eax
jne 0x4f09c0
mov edi, dword [0x503e60]
test edi, edi
js 0x4f09c0
mov dword [ebp - 0x44], 0x53d040
mov ebx, dword [0x503e60]
test ebx, ebx
je 0x4f0930
jmp 0x4f08de
xor esi, esi
mov dword [0x503e60], esi
jmp 0x4f0998
mov dword [esp], 0x503e68
mov dword [ebp - 0x3c], 1
call sub.KERNEL32.dll_InterlockedIncrement
sub esp, 4
test eax, eax
je 0x4f0a51
mov eax, dword [0x503e64]
test eax, eax
jne 0x4f0988
mov dword [esp], 0
mov eax, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x3c], 1
call eax
sub esp, 4
mov eax, dword [0x503e64]
test eax, eax
je 0x4f09ed
jmp 0x4f0988
mov dword [esp], 8
call sub.msvcrt.dll_malloc
mov dword [ebp - 0x48], eax
test eax, eax
je 0x4f0a45
mov dword [esp + 4], eax
mov eax, dword [0x53d030]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
xor edx, edx
test eax, eax
je 0x4f0a7a
test edx, edx
je 0x4f0a65
mov dword [ebp - 0x3c], 1
call fcn.004f02f0
call fcn.004f0770
mov eax, 1
mov dword [0x503e64], eax
jmp 0x4f0988
mov eax, dword [ebp - 0x48]
mov dword [eax], 0
mov dword [eax + 4], 0
jmp 0x4f0926
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
jmp 0x4f0a41
Function at 0x4f0ce0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.004f12a0
call fcn.004f0f40
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x4f0d18
jmp 0x4f0db6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x4f0d17
cmp cl, 0x22
je 0x4f0d70
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x4f0d90
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x4f0d90
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x4f0d50
jmp 0x4f0d90
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x4f0d70
cmp cl, 0x22
je 0x4f0df2
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x4f0db0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x4f0da0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x4f0dd4
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.004039c0
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x4f0d90

Function at 0x4f12d0
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [0x53d0d0]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4f1310
mov dword [ebx + 0x2c], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp], eax
call fcn.004f0e40
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
sete al
movzx eax, al
mov dword [ebx + 0x30], eax
add esp, 0x14
pop ebx
pop ebp
ret
Function at 0x4f16c0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov eax, dword [0x53d0d0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4f179c
mov ecx, dword [eax + 0x30]
test ecx, ecx
js 0x4f17b1
mov edx, dword [eax + 0x30]
test edx, edx
jne 0x4f1770
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
jmp 0x4f1708
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
xor ecx, ecx
test eax, eax
mov edx, 5
je 0x4f1718
mov ecx, dword [eax + 0x18]
xor edx, edx
cmp edx, 5
je 0x4f1763
test edx, edx
jne 0x4f1756
test ecx, ecx
je 0x4f1700
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov eax, dword [edi]
mov edx, dword [edi + 4]
mov dword [esp], 1
mov dword [esp + 8], eax
mov eax, 1
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
call ecx
cmp eax, 6
je 0x4f17c0
cmp eax, 8
je 0x4f1700
mov eax, 3
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea esp, [ebp - 0xc]
mov eax, 5
pop ebx
pop esi
pop edi
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x4f16f2
call fcn.004f1060
mov eax, dword [0x53d0d0]
mov ecx, dword [eax + 0x30]
test ecx, ecx
jns 0x4f16e4
call fcn.004f1330
mov eax, dword [0x53d0d0]
jmp 0x4f16e4
mov dword [edi + 0xc], 0
mov eax, dword [ebp - 0x14]
mov edx, ebx
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.004f1630
cmp eax, 7
jne 0x4f175b
mov eax, dword [0x53d0d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4f1813
mov edi, dword [eax + 0x30]
test edi, edi
js 0x4f183e
mov esi, dword [eax + 0x30]
test esi, esi
jne 0x4f181f
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.004f1060
mov eax, dword [0x53d0d0]
jmp 0x4f17f1
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4f1802
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4f1802
call fcn.004f1330
mov eax, dword [0x53d0d0]
jmp 0x4f17f8
Function at 0x4f1aa0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [0x53d0d0]
mov edi, dword [ebp + 8]
test eax, eax
je 0x4f1b34
mov esi, dword [eax + 0x30]
test esi, esi
js 0x4f1b50
mov ebx, dword [eax + 0x30]
test ebx, ebx
jne 0x4f1b70
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp - 0x14], eax
test ecx, ecx
jne 0x4f1b28
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.004f1630
cmp eax, 7
jne 0x4f1bef
mov eax, dword [0x53d0d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4f1bc6
mov edx, dword [eax + 0x30]
test edx, edx
js 0x4f1be0
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x4f1ba0
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
lea edx, [ebp - 0x14]
mov eax, edi
call fcn.004f1850
jmp 0x4f1ae5
call fcn.004f1060
mov eax, dword [0x53d0d0]
mov esi, dword [eax + 0x30]
test esi, esi
jns 0x4f1ac0
lea esi, [esi]
call fcn.004f1330
mov eax, dword [0x53d0d0]
mov ebx, dword [eax + 0x30]
test ebx, ebx
je 0x4f1acb
lea esi, [esi]
lea edi, [edi]
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x4f1ace
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4f1b17
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4f1b17
call fcn.004f1060
mov eax, dword [0x53d0d0]
mov edx, dword [eax + 0x30]
test edx, edx
jns 0x4f1b09
nop
lea esi, [esi]
call fcn.004f1330
mov eax, dword [0x53d0d0]
jmp 0x4f1b09
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]
Function at 0x4f1c00
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov esi, dword [edi + 0xc]
test esi, esi
je 0x4f1c92
mov eax, dword [0x53d0d0]
test eax, eax
je 0x4f1c86
mov ebx, dword [eax + 0x30]
test ebx, ebx
js 0x4f1d01
mov ecx, dword [eax + 0x30]
test ecx, ecx
jne 0x4f1ca7
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x14]
mov dword [ebp - 0x14], eax
mov eax, edi
call fcn.004f1850
cmp eax, 7
jne 0x4f1d1f
mov eax, dword [0x53d0d0]
mov ebx, dword [ebp - 0x14]
test eax, eax
je 0x4f1cf2
mov edx, dword [eax + 0x30]
test edx, edx
js 0x4f1d10
mov edi, dword [eax + 0x30]
test edi, edi
jne 0x4f1cd3
mov dword [eax + 0x28], ebx
mov eax, dword [ebp - 0x14]
lea edx, [eax + 0x20]
mov ecx, dword [edx + 4]
mov ebp, dword [eax + 0x20]
mov esp, dword [edx + 8]
jmp ecx
call fcn.004f1060
mov eax, dword [0x53d0d0]
jmp 0x4f1c22
mov dword [esp], edi
call fcn.004f16c0
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov ebx, dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
sub esp, 4
mov ebx, eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, ebx
sub esp, 4
jmp 0x4f1c37
mov eax, dword [eax + 0x2c]
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
sub esp, 8
test eax, eax
jne 0x4f1c75
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4f1c75
call fcn.004f1060
mov eax, dword [0x53d0d0]
jmp 0x4f1c60
call fcn.004f1330
mov eax, dword [0x53d0d0]
jmp 0x4f1c2d
call fcn.004f1330
mov eax, dword [0x53d0d0]
jmp 0x4f1c6b
call sub.msvcrt.dll_abort
lea esi, [esi]
lea edi, [edi]

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x59c31acb
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x47774237
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x401040
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
push edi
push 0x428530
push esi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00402fb0
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
jne 0x401095
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00401d10
add esp, 8
push ebp
call fcn.00412ef9
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x24]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [esi + 0x1000]
adc eax, dword [esi + 0x1004]
push eax
push ecx
push edi
call fcn.0040dde1
add esp, 0x10
test eax, eax
jns 0x4010d7
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00401cf0
add esp, 0xc
jmp 0x4011a1
push dword [ebx + 0xc]
call fcn.00412f14
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x401106
push dword [ebx + 0xc]
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00401cf0
add esp, 0x10
jmp 0x4011a1
cmp byte [ebx + 0x10], 1
jne 0x40111b
push ebp
push 0
push ebx
push edi
call fcn.004011e0
add esp, 0x10
jmp 0x401192
mov esi, dword [ebx + 0xc]
xor ebx, ebx
mov dword [esp + 0x10], eax
test esi, esi
je 0x40116d
test ebx, ebx
jb 0x40113d
ja 0x401136
cmp esi, 0x2000
jbe 0x40113d
mov edi, 0x2000
jmp 0x40113f
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push eax
call fcn.0040d9bd
add esp, 0x10
cmp eax, 1
jb 0x401171
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
add eax, edi
mov dword [esp + 0x10], eax
test ebx, ebx
ja 0x401136
jb 0x40116d
test esi, esi
jne 0x401128
xor eax, eax
jmp 0x40118e
mov eax, dword [esp + 0x24]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00401cf0
add esp, 0xc
or eax, 0xffffffff
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4011a1
push ebp
call fcn.00412ef9
add esp, 4
xor ebp, ebp
push edi
call fcn.0040d75c
add esp, 4
pop ebx
test ebp, ebp
je 0x4011c0
push dword [esp + 0x24]
push ebp
call fcn.004030c0
add esp, 8
mov dword [esp + 0x14], eax
push ebp
call fcn.00412ef9
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x4011e0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.3.1
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.004099c0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401234
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00401d10
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.00412f14
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x401268
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.00401cf0
add esp, 0xc
jmp 0x40138e
push 0x2000
call fcn.00412f14
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x40129a
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.00401cf0
add esp, 0xc
jmp 0x40138e
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x4012c9
ja 0x4012c2
cmp eax, 0x2000
jbe 0x4012c9
mov esi, 0x2000
jmp 0x4012cb
mov esi, eax
push dword [esp + 0x5c]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040d9bd
add esp, 0x10
cmp eax, esi
jne 0x401389
push dword [esp + 0x5c]
call fcn.0040d7b8
add esp, 4
test eax, eax
jne 0x401389
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
nop
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00407ed0
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x40133e.1
movzx ecx, byte [ecx + 0x401414]
jmp dword [ecx*4 + 0x401408]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x4013b2
push ebp
push esi
push 1
push ebx
call fcn.0040e0e0
add esp, 0x10
cmp eax, esi
jne 0x401370
push ebp
call fcn.0040d7b8
add esp, 4
test eax, eax
je 0x4013c3
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00401d10
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.004097b0
push dword [esp + 0x14]
call fcn.00412ef9
push ebx
call fcn.00412ef9
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x4013c7
push esi
push ebx
push edi
call fcn.0040aec0
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401310
cmp eax, 1
je 0x401401
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x4013e5
cmp dword [esp + 0x10], ecx
jbe 0x401373
mov eax, dword [esp + 0x10]
jmp 0x4012b5
mov eax, 0xfffffffd
jmp 0x401373
cmp eax, 1
jne 0x401373
xor esi, esi
jmp 0x40138c
Function at 0x401420
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x14]
xor ebp, ebp
push edi
push 0x428530
push esi
call fcn.00402fb0
mov edi, eax
add esp, 8
mov dword [esp + 0xc], edi
test edi, edi
jne 0x401462
mov eax, dword [esp + 0x1c]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00401d10
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x20]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [esi + 0x1000]
adc eax, dword [esi + 0x1004]
push eax
push ecx
push edi
call fcn.0040dde1
add esp, 0x10
test eax, eax
jns 0x4014b2
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00401cf0
add esp, 0xc
push edi
call fcn.0040d75c
add esp, 4
mov eax, ebp
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
push dword [ebx + 0xc]
call fcn.00412f14
mov ebp, eax
add esp, 4
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x4014f3
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00401cf0
add esp, 0x10
push edi
call fcn.0040d75c
add esp, 4
mov eax, ebp
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
cmp byte [ebx + 0x10], 1
jne 0x401508
push ebp
push 0
push ebx
push edi
call fcn.004011e0
add esp, 0x10
jmp 0x401577
mov esi, dword [ebx + 0xc]
xor ebx, ebx
test esi, esi
je 0x40154e
test ebx, ebx
jb 0x401526
ja 0x40151f
cmp esi, 0x2000
jbe 0x401526
mov edi, 0x2000
jmp 0x401528
mov edi, esi
push dword [esp + 0x10]
push 1
push edi
push ebp
call fcn.0040d9bd
add esp, 0x10
cmp eax, 1
jb 0x401552
sub esi, edi
sbb ebx, 0
add ebp, edi
test ebx, ebx
ja 0x40151f
jb 0x40154e
test esi, esi
jne 0x401511
xor eax, eax
jmp 0x40156f
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00401cf0
add esp, 0xc
or eax, 0xffffffff
mov ebp, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
test eax, eax
je 0x401586
push ebp
call fcn.00412ef9
add esp, 4
xor ebp, ebp
push edi
call fcn.0040d75c
add esp, 4
mov eax, ebp
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
Function at 0x4015a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
cmp byte [ebx + 0x11], 0x6e
jne 0x4015df
push dword [esp + 0x20]
push ebx
push dword [esp + 0x20]
call fcn.00401040
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x4015d7
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_create_symbolic_link__s__n
call fcn.00401d10
add esp, 8
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret
push edi
push 0x428618
push dword [esp + 0x28]
call fcn.00402fb0
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
test edi, edi
jne 0x40161b
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_target_file__n
push str.fopen
call fcn.00401cf0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x1c]
push ebp
push 0x428530
push esi
call fcn.00402fb0
mov ebp, eax
add esp, 8
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x401651
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00401d10
add esp, 8
or edi, 0xffffffff
jmp 0x40178c
mov ecx, dword [ebx + 4]
xor eax, eax
add ecx, dword [esi + 0x1000]
push 0
adc eax, dword [esi + 0x1004]
push eax
push ecx
push ebp
call fcn.0040dde1
add esp, 0x10
test eax, eax
jns 0x401691
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00401cf0
add esp, 0xc
or edi, 0xffffffff
jmp 0x401783
cmp byte [ebx + 0x10], 1
jne 0x4016ab
push 0
push edi
push ebx
push ebp
call fcn.004011e0
add esp, 0x10
mov edi, eax
jmp 0x401783
push 0x2000
xor edi, edi
call fcn.00412f14
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4016e0
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
push str.malloc
call fcn.00401cf0
add esp, 0xc
or edi, 0xffffffff
jmp 0x401783
mov esi, dword [ebx + 0xc]
xor ebp, ebp
test esi, esi
je 0x401776
nop dword [eax]
test ebp, ebp
jb 0x401705
ja 0x4016fe
cmp esi, 0x2000
jbe 0x401705
mov edi, 0x2000
jmp 0x401707
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push eax
call fcn.0040d9bd
add esp, 0x10
cmp eax, 1
jb 0x401759
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040e0e0
add esp, 0x10
cmp eax, 1
jb 0x401749
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebp, 0
jne 0x4016f0
jb 0x401745
test esi, esi
jne 0x4016f0
xor edi, edi
jmp 0x401772
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_write_data_chunk__n
push str.fwrite
jmp 0x401767
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00401cf0
add esp, 0xc
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.00412ef9
mov ebp, dword [esp + 0x18]
add esp, 4
push ebp
call fcn.0040d75c
add esp, 4
push dword [esp + 0x18]
call fcn.0040d75c
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret