joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c8b
Capabilities:
Copy file
Delete file
Get file size
Move file
Set file attributes

Disassembly:
mov eax, 0x44ca18
call fcn.00429dec
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
mov esi, 0x80
push ebx
push esi
push 3
push ebx
push 3
push SysReAllocString
push dword [esp + 0x48]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402cc6
xor eax, eax
jmp 0x402df8
push ebp
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebp, dword [esp + 0x30]
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [esp + 0x18], ebx
jne 0x402de2
mov edi, dword [esp + 0x38]
lea ecx, [esp + 0x38]
push edi
call fcn.00440eeb
push str..bak
lea ecx, [esp + 0x3c]
mov dword [esp + 0x28], ebx
call fcn.00441259
push esi
push dword [esp + 0x3c]
call ebp
push dword [esp + 0x38]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 1
pop eax
push ebx
push edi
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
call fcn.0042a54d
pop ecx
cmp eax, 0xffffffff
pop ecx
je 0x402d64
push dword [esp + 0x38]
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x402d64
push ebx
push dword [esp + 0x3c]
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402d64
push str.Backup_file_failed._n
call fcn.00402a24
pop ecx
mov dword [esp + 0x14], ebx
push esi
push edi
call ebp
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
push edi
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402e08
push str.MoveFile_failed._n
call fcn.00402a24
pop ecx
mov dword [esp + 0x10], ebx
mov eax, dword [esp + 0x10]
cmp eax, ebx
mov dword [esp + 0x18], eax
jne 0x402dce
cmp dword [esp + 0x14], ebx
je 0x402dce
push edi
push dword [esp + 0x3c]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x402dce
push ebx
push edi
push dword [esp + 0x40]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x402dce
push str.Restore_file_failed._n
call fcn.00402a24
pop ecx
or dword [esp + 0x24], 0xffffffff
lea ecx, [esp + 0x38]
call fcn.00440e7d
cmp dword [esp + 0x10], ebx
je 0x402df3
push esi
push dword [esp + 0x38]
call ebp
push dword [esp + 0x34]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x18]
pop ebp
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push ebx
push esi
push 3
push ebx
push 3
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
je 0x402d8e
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, dword [esp + 0x30]
je 0x402e3a
mov dword [esp + 0x10], ebx
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402d92
Function at 0x407ee8
Capabilities:
Terminate process

Disassembly:
push esi
push dword [esp + 8]
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x407f23
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, eax
test ebx, ebx
je 0x407f20
cmp dword [esp + 0x10], 0
je 0x407f20
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, ebx
pop ebx
pop esi
ret 8

Function at 0x40935c
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x44d184
call fcn.00429dec
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
or dword [esi + 8], 0xffffffff
or dword [esi + 4], 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [esi + 0xc], edi
mov dword [esi], 0x451910
mov al, byte [ebp + 0xb]
lea ecx, [esi + 0x20]
push edi
mov dword [ebp - 4], edi
mov byte [ecx], al
call fcn.00404e15
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x10], edi
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], edi
mov dword [esi], 0x4518c8
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4

Function at 0x40dd24
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40dd86
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40dd86
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret
Function at 0x414e41
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x44e7bf
call fcn.00429dec
mov eax, 0x10cc
call fcn.00429f40
push ebx
push esi
push edi
push 1
pop ebx
mov edi, ecx
push ebx
push 3
lea ecx, [ebp - 0xd8]
call fcn.0040494e
and dword [ebp - 4], 0
lea eax, [ebp - 0x10d8]
push eax
mov dword [0x46c4d4], 5
call fcn.00401153
mov eax, dword [0x4664dc]
pop ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], bl
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x26]
push eax
movzx eax, word [ebp - 0x2a]
push eax
movzx eax, word [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14]
push str._.4d__.2d__.2d
push eax
call fcn.0043f76e
mov eax, dword [ebp - 0x14]
push dword [eax - 8]
push eax
push 0
call fcn.00402a67
add esp, 0x20
lea ecx, [ebp - 0x1c]
call fcn.00407d8a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00407dc7
mov esi, str.edpscr_c.exe
add edi, 8
push esi
lea eax, [ebp - 0x10]
push edi
push eax
call fcn.00441112
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00440fb6
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00440e7d
push ebx
push 0
push dword [ebp - 0x14]
lea ecx, [ebp - 0x1c]
call fcn.00407e71
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
mov dword [ebp - 0x10], 5
mov eax, dword [ebp - 0x10]
push 0x64
mov dword [0x46c4d4], eax
call edi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0x10
jl 0x414f24
and dword [ebp - 0x10], 0
push esi
mov dword [0x46c4d4], 0x10
call fcn.004017dc
test eax, eax
pop ecx
je 0x414f9d
lea eax, [ebp - 0x3c]
push eax
call fcn.004010e3
mov dword [esp], str.End_edpscr_c.exe_process__r_n
push eax
lea eax, [ebp - 0x4c]
mov byte [ebp - 4], 4
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 5
push dword [ebp + 8]
call fcn.004010b0
add esp, 0x14
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 4
push ebx
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00404e15
mov dword [ebp - 0x10], ebx
push 0x14
pop esi
push 0x64
mov dword [0x46c4d4], esi
call edi
inc esi
cmp esi, 0x19
jle 0x414fa0
cmp dword [ebp - 0x10], ebx
jne 0x415027
lea eax, [ebp - 0x4c]
push eax
call fcn.004010e3
mov dword [esp], str.TRUE__bflagkill____r_n
push eax
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 6
push eax
call fcn.00406636
push eax
mov byte [ebp - 4], 7
push dword [ebp + 8]
call fcn.004010b0
add esp, 0x14
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 6
push ebx
call fcn.00404e15
push ebx
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00404e15
push str.wmic_process_where_name_edpscr_c.exe__delete
lea ecx, [ebp - 0x10]
call fcn.00440eeb
push 3
pop esi
push 0
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x64
call edi
dec esi
jne 0x41500d
lea ecx, [ebp - 0x10]
call fcn.00440e7d
push 0x19
pop esi
push 0x64
mov dword [0x46c4d4], esi
call edi
inc esi
cmp esi, 0x2d
jle 0x41502a
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.00407db3
and byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.00440e7d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xd8]
call fcn.0040185b
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x416259
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4162bb
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push esi
push esi
lea eax, [ebp - 0x14]
push esi
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4162bb
push esi
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop esi
leave
ret

Function at 0x416471
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
je 0x4164e5
mov esi, dword [ebp + 0xc]
cmp esi, ebx
je 0x4164e5
cmp byte [esi], bl
je 0x4164e5
cmp dword [ebp + 0x18], ebx
je 0x4164e5
cmp dword [ebp + 0x1c], ebx
je 0x4164e5
call fcn.0040118a
cmp eax, 1
lea eax, [ebp + 0xc]
push eax
jne 0x4164a7
push 0x20119
jmp 0x4164ac
push 0x20019
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x4164e5
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, ebx
sete al
jmp 0x4164e7
xor eax, eax
pop esi
pop ebx
pop ebp
ret

Function at 0x4164eb
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
xor edi, edi
push 0x20000000
push edi
push edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x41650f
xor eax, eax
jmp 0x416554
push ebx
push esi
push 0x34
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
cmp ebx, edi
je 0x41654b
lea eax, [ebp - 0x24]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x416548
cmp dword [ebp - 0x20], 4
jne 0x416545
mov dword [ebp - 4], 1
mov edi, dword [ebp - 4]
push ebx
call esi
push dword [ebp - 8]
call esi
pop esi
mov eax, edi
pop ebx
pop edi
leave
ret
Function at 0x416557
Capabilities:
Check for time delay via gettickcount
Print debug messages
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
push edi
push 6
xor esi, esi
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
push 0xf003f
mov dword [ebp - 0x30], esi
push esi
rep stosd dword es:[edi], eax
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
cmp eax, esi
mov dword [ebp - 4], eax
jne 0x416592
push 0x464678
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x416693
push ebx
push 0xf01ff
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
cmp edi, esi
mov dword [ebp + 8], edi
jne 0x4165bb
push 0x464668
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x41667c
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0x464658
call esi
mov ebx, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x30]
push eax
push edi
call ebx
test eax, eax
je 0x41666e
push 0x464644
call esi
cmp dword [ebp - 0x2c], 1
jne 0x4165f4
push 0x464634
jmp 0x41667a
push 0x464624
call esi
lea eax, [ebp - 0x4c]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x416613
push 0x46460c
jmp 0x41667a
push 0x4645f8
call esi
lea eax, [ebp - 0x30]
push eax
push edi
call ebx
test eax, eax
je 0x41666e
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0x2c], 3
jne 0x41667c
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4645e8
call esi
lea eax, [ebp - 0x30]
push eax
push dword [ebp + 8]
call ebx
test eax, eax
je 0x41666e
call edi
xor edx, edx
sub eax, dword [ebp - 0xc]
push edx
pop ecx
sbb edx, ecx
mov dword [ebp - 0x10], edx
jne 0x416675
cmp eax, 0x3a98
ja 0x416675
jmp 0x416630
push 0x4645d4
jmp 0x41667a
push 0x4645b0
call esi
cmp dword [ebp + 8], 0
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop ebx
je 0x41668e
push dword [ebp + 8]
call esi
push dword [ebp - 4]
call esi
xor eax, eax
cmp dword [ebp - 0x2c], 1
pop edi
pop esi
sete al
leave
ret
Function at 0x4179bd
Capabilities:
Delete file
Enumerate gui resources
Set file attributes

Disassembly:
mov eax, 0x44ed1c
call fcn.00429dec
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov eax, dword [edi + 0x3c]
cmp eax, ebx
je 0x417a69
mov al, byte [ebp - 0xd]
push ebx
push ebx
lea ecx, [ebp - 0x24]
mov byte [ebp - 0x24], al
call fcn.0041969c
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
mov eax, dword [edi + 0x38]
mov dword [ebp - 4], ebx
mov esi, dword [eax]
cmp esi, eax
je 0x417a5d
cmp dword [esi + 0x14], ebx
je 0x417a2f
mov eax, dword [esi + 0x1c]
cmp eax, ebx
jne 0x417a0f
mov eax, 0x451648
push eax
push ebx
call dword [sym.imp.USER32.dll_FindWindowA]
cmp eax, ebx
je 0x417a42
push dword [esi + 0x10]
push dword [esi + 0xc]
push dword [esi + 8]
push eax
call fcn.00401bf3
add esp, 0x10
jmp 0x417a42
lea eax, [esi + 8]
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push dword [ebp - 0x20]
push eax
call fcn.00419349
mov esi, dword [esi]
cmp esi, dword [edi + 0x38]
jne 0x4179fe
cmp dword [ebp - 0x1c], ebx
je 0x417a5d
lea eax, [ebp - 0x24]
push eax
push 0x41793b
call dword [sym.imp.USER32.dll_EnumWindows]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0041912f
mov eax, dword [edi + 0x54]
cmp eax, ebx
je 0x417ade
mov eax, dword [edi + 0x50]
mov esi, dword [eax]
cmp esi, eax
je 0x417ade
mov eax, dword [esi + 8]
cmp eax, 1
jne 0x417aa7
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x417a8d
mov eax, 0x451648
push 0x4628d8
push eax
call fcn.0042a53a
pop ecx
cmp eax, ebx
pop ecx
je 0x417ad7
push eax
call fcn.0042a48c
pop ecx
jmp 0x417ad7
cmp eax, 2
jne 0x417ad7
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x417ab8
mov eax, 0x451648
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x417ad0
mov eax, 0x451648
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [esi]
cmp esi, dword [edi + 0x50]
jne 0x417a79
cmp dword [edi + 0x48], ebx
je 0x417aee
lea eax, [edi + 0x40]
mov ecx, edi
push eax
call fcn.00417b5e
cmp dword [edi + 0x60], ebx
je 0x417b4f
lea ecx, [ebp - 0x18]
call fcn.00407d8a
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], 1
call fcn.00407dc7
test eax, eax
je 0x417b43
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [edi + 0x5c]
mov esi, dword [eax]
cmp esi, eax
je 0x417b43
mov eax, dword [esi + 0x10]
cmp eax, ebx
jne 0x417b2e
mov eax, 0x451648
push dword [esi + 8]
lea ecx, [ebp - 0x18]
push 1
push eax
call fcn.00407e71
mov esi, dword [esi]
cmp esi, dword [edi + 0x5c]
jne 0x417b22
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00407db3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41a75b
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
push edi
push dword [esp + 0xc]
lea edi, [esi + 0xcc]
mov ecx, edi
call fcn.0041c616
test al, al
jne 0x41a77b
push str.m_centralDir.IsValidIndex_uIndex__r_n
jmp 0x41a7a9
lea ecx, [esi + 0x60]
call fcn.0041b871
cmp eax, 1
jne 0x41a78f
push str.m_storage.IsSpanMode____1__r_n
jmp 0x41a7a9
mov al, byte [esi + 0xc8]
test al, al
je 0x41a7b6
cmp al, 0xff
jne 0x41a7a4
push str.m_iFileOpened__extract__r_n
jmp 0x41a7a9
push str.m_iFileOpened______r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
jmp 0x41a849
lea ecx, [esi + 8]
call fcn.0041c103
push dword [esp + 0xc]
mov ecx, edi
call fcn.0041c624
mov ecx, esi
call fcn.0041a8b7
mov di, word [eax + 0xe]
test di, di
je 0x41a7e8
cmp di, 8
je 0x41a7ee
push 0xffffffffffffff9b
mov ecx, esi
call fcn.0041a4b7
cmp di, 8
jne 0x41a81a
mov al, byte [esi + 6]
lea ecx, [esi + 0xac]
neg al
sbb eax, eax
push 0x38
and eax, ecx
push str.1.1.3
mov dword [esi + 0x38], eax
lea eax, [esi + 0x10]
push 0xfffffffffffffff1
push eax
call fcn.0041cac0
push eax
mov ecx, esi
call fcn.0041a8a1
mov ecx, esi
call fcn.0041a8b7
mov eax, dword [eax + 0x18]
mov ecx, esi
mov dword [esi + 0x4c], eax
call fcn.0041a8b7
mov eax, dword [eax + 0x1c]
and dword [esi + 0x50], 0
and dword [esi + 0x24], 0
and dword [esi + 0x14], 0
or byte [esi + 0xc8], 0xff
mov dword [esi + 0x48], eax
mov al, 1
pop edi
pop esi
ret 4
Function at 0x41aa58
Capabilities:
Print debug messages
Set file attributes

Disassembly:
mov eax, 0x44f24c
call fcn.00429dec
sub esp, 0x12c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
push str._______________CZipArchive::CloseFile_Start___________________
mov dword [ebp - 0x1c], edi
call esi
cmp byte [edi + 0xc8], 0xff
je 0x41aa90
xor al, al
jmp 0x41abb0
xor ebx, ebx
cmp dword [edi + 0x48], ebx
jne 0x41aaaf
mov ecx, edi
call fcn.0041a8b7
mov ecx, dword [edi + 0x50]
cmp ecx, dword [eax + 0x14]
je 0x41aaaf
push 0xffffffffffffff9a
mov ecx, edi
call fcn.0041a4b7
mov ecx, edi
call fcn.0041a8b7
cmp word [eax + 0xe], 8
jne 0x41aac6
lea eax, [edi + 0x10]
push eax
call fcn.0041ca70
cmp dword [ebp + 8], ebx
mov byte [ebp - 0x11], 1
je 0x41ab8d
push str._______________CZipArchive::CloseFile_try_Line_1___________________
mov dword [ebp - 4], ebx
call esi
lea eax, [ebp - 0x18]
push eax
call fcn.0043f9cb
mov eax, dword [eax]
push str._______________CZipArchive::CloseFile_try_Line_2___________________
mov dword [ebp - 0x130], eax
mov dword [ebp - 0x138], eax
call esi
push str._______________CZipArchive::CloseFile_try_Line_3___________________
mov byte [ebp - 0x128], bl
call esi
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0041a8b7
mov ecx, eax
call fcn.0041b543
mov eax, dword [eax]
push str._______________CZipArchive::CloseFile_try_Line_4___________________
mov dword [ebp - 0x134], eax
call esi
lea eax, [ebp - 0x138]
push eax
push dword [ebp + 8]
call fcn.00445bfe
push str._______________CZipArchive::CloseFile_try_Line_5___________________
call esi
mov ecx, edi
call fcn.0041a8b7
push dword [eax + 0x2c]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
push str._______________CZipArchive::CloseFile_try_Line_6___________________
setne byte [ebp - 0x11]
call esi
jmp 0x41ab89
or dword [ebp - 4], 0xffffffff
lea ecx, [edi + 0xcc]
call fcn.0041c6dc
lea ecx, [edi + 0x54]
mov byte [edi + 0xc8], bl
call fcn.0041c980
push str._______________CZipArchive::CloseFile_End___________________
call esi
mov al, byte [ebp - 0x11]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
Function at 0x41ad2e
Capabilities:
Create directory

Disassembly:
mov eax, 0x44f2d8
call fcn.00429dec
push ecx
push ebx
lea ecx, [ebp + 8]
push dword [ebp + 8]
call fcn.00440eeb
and dword [ebp - 4], 0
push 0x4628b4
lea ecx, [ebp + 8]
call fcn.0043f781
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041abc1
push dword [ebp + 8]
mov eax, dword [eax]
mov byte [ebp - 4], 1
push eax
call fcn.0042b380
add esp, 0x10
test eax, eax
je 0x41ad8f
push dword [ebp + 8]
call fcn.0041ae03
cmp eax, 0xffffffff
pop ecx
sete al
test al, al
jne 0x41ad8f
xor bl, bl
jmp 0x41ad91
mov bl, 1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00440e7d
test bl, bl
jne 0x41ade6
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041abc1
push dword [eax]
mov byte [ebp - 4], 2
call fcn.0041ad2e
mov bl, al
add esp, 0xc
neg bl
sbb bl, bl
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
inc bl
call fcn.00440e7d
test bl, bl
je 0x41add7
xor bl, bl
jmp 0x41ade8
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x41add3
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00440e7d
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x41aefa
Capabilities:
Print debug messages
Set file attributes

Disassembly:
mov eax, 0x44f330
call fcn.00429dec
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push edi
mov ebx, ecx
push str._____________________CZipArchive::ExtractFile_start__________________________
call esi
cmp dword [ebp + 0x10], 0
jne 0x41af2b
push str.nBufSize__0_____r_n
call esi
jmp 0x41aff9
lea ecx, [ebp - 0x78]
call fcn.0041b1b3
push dword [ebp + 8]
and dword [ebp - 4], 0
lea eax, [ebp - 0x78]
mov ecx, ebx
push eax
call fcn.0041a550
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00440eeb
mov edi, 0x4628b4
lea ecx, [ebp - 0x10]
push edi
mov byte [ebp - 4], 1
call fcn.0043f781
push dword [ebp - 0x44]
lea eax, [ebp - 0x14]
push eax
call fcn.0041ac83
pop ecx
pop ecx
push eax
lea eax, [ebp + 0xc]
push edi
push eax
mov byte [ebp - 4], 2
call fcn.00441186
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00441295
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 2
call fcn.00440e7d
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00440e7d
push dword [ebp + 8]
mov ecx, ebx
call fcn.0041aeb9
test al, al
je 0x41afcc
push dword [ebp - 0x10]
call fcn.0041ad2e
pop ecx
push dword [ebp - 0x4c]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x41b0d3
push dword [ebp + 8]
mov ecx, ebx
call fcn.0041a75b
test al, al
jne 0x41b000
push str.OpenFile_
call esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00440e7d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.0041b22d
xor al, al
jmp 0x41b0f4
push str.OpenFile
call esi
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
call fcn.0041abc1
push dword [eax]
mov byte [ebp - 4], 4
call fcn.0041ad2e
add esp, 0xc
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00440e7d
push dword [ebp - 0x10]
call esi
push str.CFile_f_szFile__CFile::modeWrite__CFile::modeCreate__CFile::shareDenyWrite_
call esi
push 0x1021
lea ecx, [ebp - 0x30]
push dword [ebp - 0x10]
call fcn.00445d80
push 0x464eb8
mov byte [ebp - 4], 5
call esi
push 0
lea ecx, [ebp - 0x20]
push dword [ebp + 0x10]
call fcn.0041c94d
push 0x464ea8
mov byte [ebp - 4], 6
call esi
lea ecx, [ebp - 0x20]
call fcn.0041c97c
push eax
lea ecx, [ebp - 0x20]
call fcn.004085c6
push eax
mov ecx, ebx
call fcn.0041a8be
mov edi, eax
test edi, edi
je 0x41b09d
push edi
lea ecx, [ebp - 0x20]
call fcn.004085c6
push eax
lea ecx, [ebp - 0x30]
call fcn.00446034
lea ecx, [ebp - 0x20]
call fcn.0041c97c
cmp edi, eax
je 0x41b06c
push 0x464e98
call esi
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.0041a9f9
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.0041c971
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00445e20
push str._____________________CZipArchive::ExtractFile_End__________________________
call esi
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00440e7d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.0041b22d
mov al, 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc