joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405820
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x4548f4]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
nop
cmp eax, 0x8cf
jne 0x405842
push 0
push 0
call edi
mov eax, dword [0x4548f4]
cmp esi, 0x845013
jne 0x405859
mov eax, dword [0x44b930]
add eax, 0xa231
mov dword [0x4548f4], eax
cmp eax, 0x141
jne 0x405874
mov dword [0x44cff0], 0xec58acac
mov dword [0x44cff4], 0xffffffff
inc esi
cmp esi, 0xbbe2a98
jl 0x405830
call fcn.00405560
pop edi
xor eax, eax
pop esi
ret 0x10
Function at 0x409420
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push 0x100
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409459
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004042f0
jmp 0x409462
mov eax, ebx
mov edx, esi
call fcn.00404254
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40946c
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40948d
mov al, byte [esp]
jmp 0x40948f
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40a61c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40a680
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404468
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00408398
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40a687
lea eax, [ebp - 0xc]
call fcn.00404200
ret

Function at 0x41c298
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x45ba20
cmp dword [edi], 0
jne 0x41c314
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x45ba1c]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x4534bc
mov ecx, 2
call fcn.004028c0
mov edx, 0x41c270
lea eax, [esi + 5]
call fcn.0041c290
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.0041c290
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x41c2e9
mov dword [0x45ba1c], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41d508
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41d50e
ret
Function at 0x43af0c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, dword [0x45af08]
cmp byte [eax + 0xc], 0
je 0x43b079
push 0x8000
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x43b072
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x45bbc0], 0
jne 0x43af60
push 0x43b080
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
push 0x43b088
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbc0], eax
cmp dword [0x4539ac], 0
jne 0x43b05b
push 0x43b098
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4539ac], eax
cmp dword [0x4539ac], 0
je 0x43b05b
push 0x43b0a4
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbc4], eax
push 0x43b0b4
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbc8], eax
push 0x43b0c8
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbcc], eax
push 0x43b0e0
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbd0], eax
push 0x43b0f8
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbd4], eax
push 0x43b10c
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbd8], eax
push 0x43b124
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbdc], eax
push 0x43b13c
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbe0], eax
push 0x43b158
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbe4], eax
push 0x43b164
mov eax, dword [0x4539ac]
push eax
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x45bbe8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b079
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_SetErrorMode
ret
pop ebx
pop ecx
pop ebp
ret

Function at 0x43ec8c
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.00404200
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.user32.dll_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x43ecdb
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.user32.dll_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00404468
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x446b5c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x446bac]
test si, 4
je 0x446b70
or bl, 1
test si, 8
je 0x446b7a
or bl, 4
test si, 1
je 0x446b84
or bl, 8
test si, 2
je 0x446b8e
or bl, 0x10
test si, 0x10
je 0x446b98
or bl, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x446ba7
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x446bb0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x446be8]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x446bc9
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x446bd8
or bl, 4
test esi, 0x20000000
je 0x446be3
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44d1ec
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44d1fe
add esp, 0xfffffff0
call fcn.004037f8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b214
mov eax, dword [0x45ac1c]
mov dword [eax + 4], ebx
mov dword [eax], 0x44d590
mov eax, dword [0x45ac28]
mov dword [eax + 4], ebx
mov dword [eax], 0x44d59c
mov eax, ebx
call fcn.0044d5a8
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x411274]
call fcn.0040347c
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x411274]
call fcn.0040347c
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x411274]
call fcn.0040347c
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x411274]
call fcn.0040347c
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x411274]
call fcn.0040347c
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x449a70
push eax
push 0
push 0
mov eax, dword [0x45ad54]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41cc0c]
call fcn.0041e010
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41cc0c]
call fcn.0041e010
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41cc0c]
call fcn.0041e010
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044d9c8
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d8a4
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d8a4
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44d8a4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44d33b
call fcn.00403850
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44d688
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44d833
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44d814
mov dl, 1
mov eax, dword [0x411764]
call fcn.0040347c
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404200
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44d803
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043b26c
test al, al
je 0x44d7f6
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44d844
lea eax, [ebp - 0x254]
call fcn.00408d38
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44d7f6
xor eax, eax
push ebp
push 0x44d7ef
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x100
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44d87c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44d7d8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404468
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44d7d8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, 0x100
call fcn.00404468
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d7f6
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44d6f9
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.004158ac
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44d83a
lea eax, [ebp - 0x260]
call fcn.00404200
ret

Function at 0x44e168
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x45bc04]
cmp byte [eax + 0xa5], 0
jne 0x44e1d9
cmp dword [0x45bc1c], 0
jne 0x44e19a
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44e124
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x45bc1c], eax
cmp dword [0x45bc18], 0
jne 0x44e1b5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x45bc18], eax
cmp dword [0x45bc20], 0
jne 0x44e1d9
push esp
push 0
push 0
push 0x44e0c8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x45bc20], eax
pop edx
ret
Function at 0x44e2d0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44e2e7
add esp, 0xfffffff0
call fcn.004037f8
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b214
mov eax, dword [0x45ad44]
cmp word [eax + 2], 0
jne 0x44e30f
mov eax, dword [0x45ad44]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044f904
mov eax, dword [0x45adcc]
cmp word [eax + 2], 0
jne 0x44e329
mov eax, dword [0x45adcc]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044fafc
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x411274]
call fcn.0040347c
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x411274]
call fcn.0040347c
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41d3bc]
call fcn.00423004
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44e4b0
mov eax, dword [0x45ac74]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004233d4
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x45006c
push 0x100
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x45ac74]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040a5b4
test eax, eax
je 0x44e41e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408694
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040a5dc
test eax, eax
je 0x44e432
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, 0x100
call fcn.00404468
mov eax, dword [0x45ab90]
cmp byte [eax], 0
jne 0x44e466
mov eax, ebx
call fcn.0044e5d8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00450248
mov eax, ebx
call fcn.00450b88
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44e4a6
call fcn.00403850
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44e84c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x45bc04]
cmp dword [eax + 0x30], 0
je 0x44e8f6
cmp dword [ebx + 0x94], 0
jne 0x44e8f0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e7dc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44e8f0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e8b6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e8f0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413914
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e8c5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44f3d4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44f409
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004042f0
jmp 0x44f416
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404254
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x450424
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x450465
mov eax, esi
call fcn.00436aec
test al, al
je 0x450465
mov eax, dword [ebx + 0x84]
call fcn.004367e8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x450465
push 0
mov eax, dword [ebx + 0x84]
call fcn.004367e8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x401030
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.2.11
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.00407ca0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401084
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00401be0
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.0040bc9f
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010b8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.00401bc0
add esp, 0xc
jmp 0x4011e0
push 0x2000
call fcn.0040bc9f
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010ea
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.00401bc0
add esp, 0xc
jmp 0x4011e0
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401119
ja 0x401112
cmp eax, 0x2000
jbe 0x401119
mov esi, 0x2000
jmp 0x40111b
mov esi, eax
mov eax, dword [esp + 0x5c]
push dword [eax]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040affe
add esp, 0x10
cmp eax, esi
jne 0x4011db
mov eax, dword [esp + 0x5c]
push dword [eax]
call fcn.0040adec
add esp, 4
test eax, eax
jne 0x4011db
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00406310
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x401190.1
movzx ecx, byte [ecx + 0x401264]
jmp dword [ecx*4 + 0x401258]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401204
push ebp
push esi
push 1
push ebx
call fcn.0040bc16
add esp, 0x10
cmp eax, esi
jne 0x4011c2
push ebp
call fcn.0040adec
add esp, 4
test eax, eax
je 0x401215
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00401be0
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.00407ae0
push dword [esp + 0x14]
call fcn.0040bc84
push ebx
call fcn.0040bc84
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401219
push esi
push ebx
push edi
call fcn.00409a50
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401162
cmp eax, 1
je 0x401253
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401237
cmp dword [esp + 0x10], ecx
jbe 0x4011c5
mov eax, dword [esp + 0x10]
jmp 0x401105
mov eax, 0xfffffffd
jmp 0x4011c5
cmp eax, 1
jne 0x4011c5
xor esi, esi
jmp 0x4011de
Function at 0x401290
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
mov edx, dword [ebp]
test edx, edx
jne 0x4012d1
lea eax, [ebp + 0x70]
push 0x423210
push eax
call fcn.00402b60
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4012d1
mov eax, dword [esp + 0x10]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00401be0
add esp, 8
xor eax, eax
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [ebp + 8]
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040b3f5
add esp, 0x10
test eax, eax
jns 0x40130e
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00401bc0
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
pop ecx
ret
push esi
push edi
push dword [ebx + 0xc]
call fcn.0040bc9f
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
jne 0x401340
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00401bc0
add esp, 0x10
jmp 0x4013bb
cmp byte [ebx + 0x10], 1
jne 0x401364
push esi
push 0
push ebx
push ebp
call fcn.00401030
add esp, 0x10
test eax, eax
je 0x4013bb
push esi
call fcn.0040bc84
add esp, 4
xor esi, esi
jmp 0x4013bb
mov eax, esi
mov esi, dword [ebx + 0xc]
xor ebx, ebx
mov dword [esp + 0x10], eax
test esi, esi
je 0x4013b7
test ebx, ebx
jb 0x401388
ja 0x401381
cmp esi, 0x2000
jbe 0x401388
mov edi, 0x2000
jmp 0x40138a
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040affe
add esp, 0x10
cmp eax, 1
jb 0x4013da
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
add eax, edi
mov dword [esp + 0x10], eax
test ebx, ebx
ja 0x401381
jb 0x4013b7
test esi, esi
jne 0x401373
mov esi, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
je 0x4013d2
push eax
call fcn.0040ad3c
add esp, 4
mov dword [ebp], 0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x1c]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00401bc0
mov esi, dword [esp + 0x24]
add esp, 0xc
push esi
call fcn.0040bc84
add esp, 4
xor esi, esi
jmp 0x4013bb
Function at 0x401410
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push ebp
call fcn.00404f90
add esp, 4
cmp eax, 0xffffffff
jne 0x40142d
or eax, eax
pop ebp
add esp, 0xc
ret
push ebx
push esi
mov esi, dword [esp + 0x20]
lea eax, [ebp + 0x2070]
push edi
lea ebx, [esi + 0x12]
push ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.00405260
mov edi, eax
add esp, 8
mov dword [esp + 0x18], edi
test edi, edi
jne 0x401473
push ebx
push str.Failed_to_extract__s:_failed_to_open_target_file__n
push str.fopen
call fcn.00401bc0
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
mov edx, dword [ebp]
test edx, edx
jne 0x4014aa
lea eax, [ebp + 0x70]
push 0x423210
push eax
call fcn.00402b60
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4014aa
push ebx
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00401be0
add esp, 8
or edi, 0xffffffff
jmp 0x4015d0
mov ecx, dword [esi + 4]
xor eax, eax
add ecx, dword [ebp + 8]
push 0
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040b3f5
add esp, 0x10
test eax, eax
jns 0x4014e1
push ebx
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00401bc0
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015d0
cmp byte [esi + 0x10], 1
jne 0x4014fb
push 0
push edi
push esi
push ebp
call fcn.00401030
add esp, 0x10
mov edi, eax
jmp 0x4015d0
push 0x2000
xor edi, edi
call fcn.0040bc9f
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40152d
push ebx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
push str.malloc
call fcn.00401bc0
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015d0
mov esi, dword [esi + 0xc]
xor ebx, ebx
test esi, esi
je 0x4015c7
nop word [eax + eax]
test ebx, ebx
jb 0x401555
ja 0x40154e
cmp esi, 0x2000
jbe 0x401555
mov edi, 0x2000
jmp 0x401557
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040affe
add esp, 0x10
cmp eax, 1
jb 0x4015aa
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040bc16
add esp, 0x10
cmp eax, 1
jb 0x40159a
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
test ebx, ebx
ja 0x40154e
jb 0x401596
test esi, esi
jne 0x401540
xor edi, edi
jmp 0x4015c3
push dword [esp + 0x14]
push str.Failed_to_extract__s:_failed_to_write_data_chunk__n
push str.fwrite
jmp 0x4015b8
push dword [esp + 0x14]
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00401bc0
add esp, 0xc
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.0040bc84
add esp, 4
mov eax, dword [ebp]
test eax, eax
je 0x4015e7
push eax
call fcn.0040ad3c
add esp, 4
mov dword [ebp], 0
push dword [esp + 0x18]
call fcn.0040ad3c
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret