joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4676c5
Capabilities:
Create process on windows

Disassembly:
push 5
xor eax, eax
push eax
push eax
push ecx
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret

Function at 0x4676d5
Capabilities:
Terminate process

Disassembly:
mov eax, 0x47d0fb
call fcn.0047c7d4
push ecx
and dword [ebp - 4], 0
lea ecx, [ebp + 0x1c]
call fcn.004678a1
test al, al
je 0x46777e
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0x10]
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
mov ecx, dword [ebp + 8]
movzx eax, cx
push eax
shr ecx, 0x10
lea eax, [ebp - 0x10]
push ecx
push str.You_currently_use_version__u._u_of_this_program._The_newest_version__u._u_is_available_online_for_Free._Do_you_want_to_see_more_information_
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__17]
add esp, 0x18
mov ecx, 0x4e81c0
push 0x44
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x46775e
mov ecx, dword [ebp + 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
mov ecx, eax
call fcn.004676c5
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0x1c]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0x18
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 2
push str.This_version_has_expired__please_upgrade_to_the_latest_version._Exiting..
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__17]
pop ecx
pop ecx
push 0x40
mov ecx, 0x4e81c0
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp + 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
mov ecx, eax
call fcn.004676c5
push 1
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x467b9f
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push edi
mov esi, ecx
call dword [sym.imp.mfc140u.dll_CMFCPropertyPage::OnInitDialog]
mov ebx, dword [sym.imp.mfc140u.dll_CWnd::SetWindowTextW]
lea ecx, [esi + 0x328]
push str.Download_and_Convert_
call ebx
lea ebp, [esi + 0x3a8]
push str.Also_Download_Video_
mov ecx, ebp
call ebx
lea edi, [esi + 0x428]
push str.Compatible_with_TV_IPhone
mov ecx, edi
call ebx
push str.Click_Here_To_Get_Pro_Version_
lea ecx, [esi + 0x630]
call ebx
push str.paste_url_like:_https:__www.youtube.com_watch_vnv_5K4YDsew
push 0x420
mov ecx, esi
call dword [sym.imp.mfc140u.dll_CWnd::GetDlgItem]
mov ecx, eax
call ebx
push ecx
lea ecx, [esi + 0x630]
call fcn.0046a81d
push 1
push 0
lea ecx, [esi + 0x1d8]
call dword [sym.imp.mfc140u.dll_CMFCEditBrowseCtrl::EnableFolderBrowseButton]
mov ecx, 0x4e8194
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [esi + 0x1d8]
call ebx
push dword [0x4e81ac]
mov ecx, ebp
call fcn.0046a806
push dword [0x4e81b4]
mov ecx, edi
call fcn.0046a806
mov ebx, esi
xor ebp, ebp
push ebp
lea ecx, [ebx + 0x5a8]
call dword [sym.imp.mfc140u.dll_CWnd::EnableWindow]
push ecx
push ecx
lea ecx, [ebx + 0x528]
call fcn.0046a7ee
cmp dword [0x4e81b0], 1
mov ecx, ebx
je 0x467c7f
call 0x467df8
jmp 0x467c84
call 0x467d51
lea ecx, [ebx + 0x158]
call dword [sym.imp.mfc140u.dll_CWnd::SetFocus]
lea eax, [esp + 0x14]
push eax
push ebp
push ebp
push 0x1c
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderLocation]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
push dword [esp + 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [esp + 0x18]
mov ecx, 0x4e8060
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
mov ebp, dword [sym.imp.mfc140u.dll_CWnd::GetDlgItem]
mov edi, 0x4a4d74
push edi
push edi
push 0x3fd
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.0046a7e3
mov esi, dword [sym.imp.UxTheme.dll_SetWindowTheme]
push eax
call esi
push edi
push edi
push 0x3fe
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.0046a7e3
push eax
call esi
push edi
push edi
push 0x43b
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.0046a7e3
push eax
call esi
push edi
push edi
push 0x3fb
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.0046a7e3
push eax
call esi
push edi
push edi
push 0x43e
mov ecx, ebx
call ebp
mov ecx, eax
call fcn.0046a7e3
push eax
call esi
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x210
ret
Function at 0x4681cb
Capabilities:
Create directory

Disassembly:
mov eax, 0x47d20d
call fcn.0047c7d4
sub esp, 0x20
push ebx
push esi
push edi
push 0x4e8194
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push ecx
mov ecx, esp
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
call 0x46819a
pop ecx
test al, al
je 0x46820b
mov bl, 1
jmp 0x468302
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_5884]
dec eax
lea ecx, [ebp - 0x10]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator__]
push 0x5c
pop edi
cmp ax, di
je 0x468231
push edi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::AppendChar]
lea ecx, [ebp - 0x2c]
call fcn.00463ee2
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_296]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
xor bl, bl
xor esi, esi
call dword [sym.imp.mfc140u.dll_Ordinal_5884]
test eax, eax
jle 0x46829a
push esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator__]
cmp ax, di
je 0x468276
push esi
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator__]
movzx eax, ax
push eax
jmp 0x468283
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0046a264
push edi
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::AppendChar]
lea ecx, [ebp - 0x10]
inc esi
call dword [sym.imp.mfc140u.dll_Ordinal_5884]
cmp esi, eax
jl 0x468257
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00463e6b
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
jmp 0x4682d8
push 0
lea ecx, [ebp - 0x14]
call fcn.0045ecc3
mov ecx, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x14]
setne bl
call fcn.0046a250
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00463e57
push eax
lea ecx, [ebp - 0x14]
call fcn.0046a242
test al, al
jne 0x4682ad
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x2c]
call fcn.0046a269
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov al, bl
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x468669
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x47d2a3
call fcn.0047c7d4
sub esp, 0x1c
push esi
mov esi, dword [sym.imp.msi.dll_MsiRecordGetStringA]
push edi
push str.196BB40D_1578_3D01_B289_BEFC77A11A1E
mov edi, ecx
call esi
cmp eax, 5
je 0x4687b1
push str.DA5E371C_6333_3D8A_93A4_6FD5B20BCC6E
call esi
cmp eax, 5
je 0x4687b1
push str.F0C3E5D1_1ADE_321E_8167_68EF0DE699A5
call esi
cmp eax, 5
je 0x4687b1
push str.1D8E6291_B0D5_35EC_8441_6616F567A0F7
call esi
cmp eax, 5
je 0x4687b1
push str._vcredist_x86.exe
mov edx, 0x4e8070
lea ecx, [ebp - 0x10]
call fcn.0045f219
pop ecx
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4687a4
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push str.Upgrading_library
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__16]
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x18]
push dword [edi]
mov edx, 0x4e81c0
push 0x4e81bc
call fcn.0045ed13
pop ecx
mov ecx, eax
mov byte [ebp - 4], 2
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push ecx
mov ecx, esp
mov dword [ebp - 0x20], esp
push str.Please_wait.
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__16]
push ecx
mov byte [ebp - 4], 3
mov ecx, esp
mov dword [ebp - 0x24], esp
push str.Upgrading_Microsoft_runtime_library_for_the_first_running..
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__16]
push ecx
mov byte [ebp - 4], 4
lea eax, [ebp - 0x10]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
push str._download_updates_vcredist_x86.exe
mov edx, 0x4e8074
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x14]
call fcn.0045f219
pop ecx
mov byte [ebp - 4], 6
mov ecx, eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
mov ecx, 0x4e6ff0
mov byte [ebp - 4], 8
call fcn.0046d678
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x18]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp - 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
xor eax, eax
jmp 0x4687b4
xor eax, eax
inc eax
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
Function at 0x46c9c7
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x47d923
call fcn.0047c7d4
sub esp, 0x14
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
push ecx
xor esi, esi
lea eax, [ebp + 0xc]
inc esi
mov ecx, esp
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x10], edi
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
mov ecx, ebx
call 0x46c837
mov dword [ebp - 0x1c], eax
push 2
pop ecx
cmp eax, esi
je 0x46ca06
cmp eax, ecx
jne 0x46ca29
lea eax, [ebp - 0x18]
push eax
push 0x20019
push edi
lea ecx, [ebx + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebx], eax
test eax, eax
je 0x46ca3b
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
jmp 0x46cae2
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push edi
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
push dword [ebp - 0x18]
call edi
mov eax, dword [ebp - 0x10]
xor ecx, ecx
add eax, 2
mov dword [ebp - 0x10], eax
push 2
shr eax, 1
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call dword [sym.imp.mfc140u.dll_operator]
pop ecx
mov esi, eax
lea ecx, [ebp + 0xc]
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push dword [ebp - 0x18]
call edi
lea ecx, [ebp - 0x14]
mov dword [ebx], eax
call dword [sym.imp.mfc140u.dll_Ordinal_296]
push 2
pop eax
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], al
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::operator]
push esi
call dword [sym.imp.mfc140u.dll_operator_1]
mov esi, dword [ebx]
pop ecx
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0x10]
test esi, esi
jne 0x46cad2
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t__10]
lea ecx, [ebp - 0x14]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0x10]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0xc
Function at 0x46cb91
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
lea eax, [ebp - 4]
mov ebx, ecx
push eax
push 0x20006
xor edi, edi
push edi
lea ecx, [ebx + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push dword [ebx + 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x46cbf8
push esi
push 4
lea eax, [ebp + 0xc]
push eax
push 3
push edi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb esi, esi
cmp dword [ebx + 8], edi
jne 0x46cbeb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esi + 1]
pop esi
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov eax, edi
pop edi
pop ebx
leave
ret 8
Function at 0x46f5ac
Capabilities:
Create process on windows
Create process suspended
Move file
Terminate process

Disassembly:
mov eax, 0x47dc70
call fcn.0047c7d4
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor edi, edi
mov dword [ebp - 4], edi
push 0x44
pop esi
push esi
lea eax, [ebp - 0x64]
mov byte [ebp - 4], 2
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x64], esi
xor ebx, ebx
lea ecx, [ebp + 0xc]
inc ebx
or dword [ebp - 0x38], ebx
push ebx
mov word [ebp - 0x34], bx
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_ATL::CSimpleStringT_wchar_t_1_::GetBuffer]
mov esi, eax
mov ecx, 0x4e8070
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
call dword [sym.imp.mfc140u.dll_Ordinal_1663]
push eax
push edi
push edi
push edi
push edi
push edi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x46f63e
push ebx
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
mov eax, 0x46f63e
ret
lea ecx, [ebp + 8]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
lea ecx, [ebp + 0xc]
call dword [sym.imp.mfc140u.dll_Ordinal_1045]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8

Function at 0x47196d
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x4719ac
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4719ac
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4719ac
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x4719ac
cmp dword [ecx + 0x74], 0xe
jbe 0x4719ac
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x473810
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47dfc4
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x4b2040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov eax, dword [ebp + 8]
test eax, eax
js 0x473905
push 0
push 0
push 0
push 0
push dword [ebp + 0xc]
push eax
push 1
call sub.mfc140u.dll_CListCtrl::InsertItem
mov edi, eax
test edi, edi
js 0x473908
mov ecx, ebx
call fcn.00473460
mov esi, eax
xor ecx, ecx
mov edx, 0x4c
mov dword [ebp + 8], esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call sub.mfc140u.dll_operator
add esp, 4
mov dword [ebp + 0xc], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x4738ba
push 0x472150
push 0x471fc0
push dword [ebp + 8]
mov dword [eax], esi
lea esi, [eax + 4]
push 0x4c
push esi
call fcn.00471438
jmp 0x4738bc
xor esi, esi
mov dword [ebp - 4], 0xffffffff
test esi, esi
je 0x473905
mov eax, dword [ebp + 0x10]
mov ecx, ebx
push esi
push 0
push 0
push 0
push 0
push 4
push 0
mov dword [esi + 0x2c], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [esi + 0x30], eax
mov dword [esi + 0xc], 0xffffffff
call sub.mfc140u.dll_CListCtrl::SetItem
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403a50
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
mov edi, edx
push esi
xor edi, edx
push ebx
mov esi, eax
mov eax, ecx
sub esp, 0x3c
xor ebx, ebx
or edi, eax
mov ebp, dword [esp + 0x50]
mov ecx, edx
jne 0x403bd0
mov eax, ebp
mul edx
cmp edx, dword [0x471094]
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
jae 0x403b62
mov dword [esp], ecx
mov dword [esp + 4], ebp
mov dword [esp + 0x1c], ecx
call fcn.0042bf70
mov ecx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x2c], eax
je 0x403bfc
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 4], ebp
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call sub.msvcrt.dll_fread
mov ecx, dword [esp + 0x1c]
mov edx, ebx
xor eax, ecx
or edx, eax
jne 0x403b90
mov dword [esp], ecx
mov dword [esp + 4], 8
mov dword [esp + 0x1c], ecx
call fcn.0042bf70
mov ecx, dword [esp + 0x1c]
test eax, eax
mov dword [esp + 0x20], eax
je 0x403c1d
mov esi, ecx
mov edi, ebx
add esi, 0xffffffff
mov edx, ebx
adc edi, 0xffffffff
or edx, ecx
je 0x403b4a
mov ebx, ebp
imul ebx, esi
add ebx, dword [esp + 0x2c]
mov dword [esp + 0x18], ebp
mov edx, dword [esp + 0x18]
mov dword [esp], ebx
mov dword [esp + 4], edx
call dword [0x472cf4]
mov ebp, dword [esp + 0x20]
lea ecx, [esi*8]
sub ebx, dword [esp + 0x18]
mov dword [ebp + ecx], eax
mov eax, esi
add esi, 0xffffffff
mov dword [ebp + ecx + 4], edx
mov edx, edi
adc edi, 0xffffffff
or edx, eax
jne 0x403b14
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov eax, dword [esp + 0x20]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
jbe 0x403b82
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp], str.Invalid_number_of_dynamic_entries:__llu_n
call fcn.00436bb0
mov dword [esp + 0x20], 0
jmp 0x403b56
cmp eax, dword [0x471090]
jbe 0x403a87
jmp 0x403b64
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp], str.Unable_to_read_in__llu_bytes_of_dynamic_data_n
mov dword [esp + 4], eax
mov dword [esp + 8], edx
call fcn.00436bb0
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_free
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x20]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov dword [esp + 4], edx
mov dword [esp], str.Size_truncation_prevents_reading__llu_elements_of_size__u_n
call fcn.00436bb0
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x20]
add esp, 0x3c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp], str.Out_of_memory_reading__llu_dynamic_entries_n
call fcn.00436bb0
mov dword [esp + 0x20], 0
jmp 0x403b56
mov dword [esp + 4], ecx
mov dword [esp + 8], ebx
mov dword [esp], str.Out_of_memory_allocating_space_for__llu_dynamic_entries_n
call fcn.00436bb0
jmp 0x403b4a
Function at 0x405fd0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, 0xc
push ebx
mov ebx, eax
sub esp, 0x14
test eax, eax
jne 0x405fe9
jmp 0x406040
sub esi, 1
shr ebx, 1
je 0x406040
test bl, 1
je 0x405fe2
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp + 4], eax
mov eax, dword [esi*4 + 0x462fc0]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
cmp ebx, 1
jbe 0x405fe2
mov eax, dword [sym.imp.msvcrt.dll__iob]
sub esi, 1
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x447522
add eax, 0x20
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
shr ebx, 1
jne 0x405fe9
lea esi, [esi]
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x406310
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, eax
sub esp, 0x18
test eax, eax
je 0x406340
test al, 1
jne 0x406360
test al, 2
jne 0x4063da
test bl, 4
mov eax, 1
je 0x406399
mov eax, 0x445b4b
jmp 0x406419
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0x30
add eax, 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
add esp, 0x18
pop ebx
ret
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], str.INEX
add eax, 0x20
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
test bl, 2
mov eax, 0x447525
jne 0x4063e0
xor eax, eax
test bl, 4
jne 0x406414
test bl, 8
je 0x406400
test eax, eax
je 0x40642e
mov eax, 0x445b4b
mov dword [esp + 4], eax
mov dword [esp], str._sDIV0
call sub.msvcrt.dll_printf
and ebx, 0x10
je 0x406358
mov eax, 0x447525
mov dword [esp + 4], eax
mov dword [esp], str._sINVAL
call sub.msvcrt.dll_printf
add esp, 0x18
pop ebx
ret
mov eax, 0x445b4b
nop
mov dword [esp + 4], eax
mov dword [esp], str._sUFLO
call sub.msvcrt.dll_printf
test bl, 4
jne 0x406414
xor eax, eax
test bl, 8
jne 0x40642e
lea esi, [esi]
and ebx, 0x10
je 0x406358
test eax, eax
je 0x4063c0
mov eax, 0x445b4b
jmp 0x4063c5
mov eax, 0x447525
mov dword [esp + 4], eax
mov dword [esp], str._sOFLO
call sub.msvcrt.dll_printf
test bl, 8
je 0x4063bb
mov eax, 0x447525
mov dword [esp + 4], eax
mov dword [esp], str._sDIV0
call sub.msvcrt.dll_printf
jmp 0x4063bb
Function at 0x412e00
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x5c
cmp word [esp + 0x60], 0
mov dword [esp + 0x4c], ebx
mov ebx, eax
mov dword [esp + 0x50], esi
mov esi, dword [esp + 0x64]
mov dword [esp + 0x54], edi
mov edi, dword [esp + 0x68]
mov dword [esp + 0x58], ebp
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ecx
jne 0x412e31
mov esi, edx
mov edi, ecx
mov ecx, dword [ebx + 0x14]
lea ebp, [esp + 0x38]
mov edx, dword [ebx + 0x10]
mov eax, dword [ebx + 0xc]
mov dword [esp + 8], esi
movzx esi, word [esp + 0x60]
mov dword [esp + 0x14], ebp
lea ebp, [esp + 0x34]
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], edi
mov word [esp + 4], si
mov ebx, dword [ebx + 0x18]
mov dword [esp], ebx
call fcn.00406560
mov edx, dword [esp + 0x2c]
mov ecx, 4
mov eax, dword [esp + 0x28]
call fcn.004026f0
mov edx, dword [esp + 0x34]
xor eax, eax
test edx, edx
je 0x412eeb
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 2
mov dword [esp + 4], 1
mov dword [esp], 0x44a7f1
add eax, 0x20
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x20
mov dword [esp + 4], eax
mov eax, dword [esp + 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_fputs
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x3c]
or edx, eax
jne 0x412f00
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp], 0x3e
add eax, 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_fputc
mov eax, dword [esp + 0x34]
mov ebx, dword [esp + 0x4c]
mov esi, dword [esp + 0x50]
mov edi, dword [esp + 0x54]
mov ebp, dword [esp + 0x58]
add esp, 0x5c
ret
mov dword [esp + 4], eax
mov dword [esp], str.0x_lx
call sub.msvcrt.dll_printf
jmp 0x412ecf
Function at 0x437b60
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
mov dword [esp + 8], 0
mov esi, dword [esp + 0x28]
mov dword [esp + 4], eax
mov eax, dword [ebx + 4]
mov dword [esp], eax
call sub.msvcrt.dll_fseek
test eax, eax
jne 0x437be1
mov eax, dword [ebx + 4]
mov dword [esp + 8], 0x3c
mov dword [esp + 4], 1
mov dword [esp + 0xc], eax
lea eax, [ebx + 0x34]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 0x3c
jne 0x437c00
lea eax, [ebx + 0x6e]
mov dword [esp + 8], 2
mov dword [esp + 4], 0x46a6c2
mov dword [esp], eax
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x437c14
mov dword [esp + 0x24], esi
mov dword [esp + 0x20], ebx
add esp, 0x14
pop ebx
pop esi
jmp fcn.00437c30
mov eax, dword [ebx]
mov dword [esp], str._s:_failed_to_seek_to_next_file_name_n
mov dword [esp + 4], eax
call fcn.00436bb0
add esp, 0x14
xor eax, eax
pop ebx
pop esi
ret
mov eax, dword [ebx]
mov dword [esp], str._s:_failed_to_read_archive_header_n
mov dword [esp + 4], eax
call fcn.00436bb0
jmp 0x437bf3
mov eax, dword [ebx]
mov dword [esp], str._s:_did_not_find_a_valid_archive_header_n
mov dword [esp + 4], eax
call fcn.00436bb0
jmp 0x437bf3