joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42aee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc8
xor edx, edx
push ebx
push esi
push edi
xor esi, esi
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
dec eax
cmp eax, 0x29
jl 0x42b056
mov ecx, eax
sub ecx, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x42af17
mov dword [ebp - 0xc], 1
xor edx, edx
mov dword [ebp - 8], edx
mov ecx, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
add ecx, 0x14
mov dword [ebp - 4], ecx
lea ebx, [eax - 0x14]
push 0x7a
push 0x4972f4
push ebx
call fcn.00410fb4
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x42af59
push 0x7d
push 0x49730c
push 0x41
push 0x7a
push 4
call fcn.0043531c
add esp, 0x14
or eax, 0xffffffff
jmp 0x42b07c
push ebx
lea ecx, [ebp - 0x24]
mov edx, dword [ebp - 4]
push edx
push 0x14
push ecx
call fcn.0042b178
add esp, 0x10
mov eax, dword [ebp - 8]
lea edx, [ebp + eax - 0x24]
cmp eax, 0x14
jge 0x42af8c
mov ecx, eax
mov edi, dword [ebp + 0x10]
sub ecx, dword [ebp - 8]
inc eax
mov cl, byte [edi + ecx]
xor byte [edx], cl
inc edx
cmp eax, 0x14
jl 0x42af78
push 0x14
lea eax, [ebp - 0x24]
push eax
push ebx
push esi
call fcn.0042b178
mov edx, esi
add esp, 0x10
mov dword [ebp - 0x10], edx
xor eax, eax
mov ecx, dword [ebp - 4]
cmp ebx, eax
mov edx, ecx
jle 0x42afbc
mov cl, byte [edx]
mov edi, dword [ebp - 0x10]
xor byte [edi], cl
inc eax
inc dword [ebp - 0x10]
inc edx
cmp ebx, eax
jg 0x42afac
push 0
call fcn.004371cc
push eax
lea eax, [ebp - 0x38]
push 0
push eax
mov edx, dword [ebp + 0x20]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
call fcn.0043707c
add esp, 0x18
lea eax, [ebp - 0x38]
push 0x14
push eax
push esi
call fcn.004062f4
add esp, 0xc
test eax, eax
jne 0x42b056
cmp dword [ebp - 0xc], 0
jne 0x42b056
mov eax, 0x14
lea edx, [esi + 0x14]
cmp ebx, eax
jle 0x42b00a
cmp byte [edx], 0
jne 0x42b00a
inc eax
inc edx
cmp ebx, eax
jg 0x42afff
cmp byte [esi + eax], 1
jne 0x42b056
mov ecx, eax
inc eax
cmp ebx, ecx
jle 0x42b056
sub ebx, eax
cmp ebx, dword [ebp + 0xc]
jle 0x42b03b
push 0x9b
push 0x497324
push 0x6d
push 0x7a
push 4
call fcn.0043531c
add esp, 0x14
or ebx, 0xffffffff
jmp 0x42b04b
push ebx
add eax, esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0040602c
add esp, 0xc
push esi
call fcn.00411174
pop ecx
mov eax, ebx
jmp 0x42b07c
push 0xa8
push str..crypto_rsa_rsa_oaep.c
push 0x79
push 0x7a
push 4
call fcn.0043531c
add esp, 0x14
test esi, esi
je 0x42b079
push esi
call fcn.00411174
pop ecx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42b218
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
cmp edx, dword [ebp + 0x18]
jne 0x42b233
mov cl, byte [eax]
cmp cl, 0x6a
je 0x42b254
cmp cl, 0x6b
je 0x42b254
push 0x72
push 0x49736c
push 0x89
push 0x80
push 4
call fcn.0043531c
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
mov cl, byte [eax]
inc eax
cmp cl, 0x6b
jne 0x42b2c5
lea esi, [edx - 3]
xor ecx, ecx
cmp esi, ecx
jle 0x42b29b
mov dl, byte [eax]
inc eax
cmp dl, 0xba
je 0x42b29b
cmp dl, 0xbb
je 0x42b296
push 0x81
push 0x497384
push 0x8a
push 0x80
push 4
call fcn.0043531c
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
inc ecx
cmp esi, ecx
jg 0x42b265
sub esi, ecx
test ecx, ecx
jne 0x42b2c8
push 0x8a
push 0x49739c
push 0x8a
push 0x80
push 4
call fcn.0043531c
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
lea esi, [edx - 2]
cmp byte [eax + esi], 0xcc
je 0x42b2f2
push 0x93
push str..crypto_rsa_rsa_x931.c
push 0x8b
push 0x80
push 4
call fcn.0043531c
add esp, 0x14
or eax, 0xffffffff
pop esi
pop ebp
ret
push esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.0040602c
add esp, 0xc
mov eax, esi
pop esi
pop ebp
ret
Function at 0x437e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor ecx, ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x437e19
cmp dword [esi + 8], 0
jne 0x437e20
xor eax, eax
jmp 0x437f13
mov edx, dword [esi + 4]
and edx, 0x100
mov dword [ebp - 8], edx
mov eax, dword [esi]
test eax, eax
jne 0x437e3b
mov dword [ebp - 4], 1
jmp 0x437e98
mov dword [ebp - 4], eax
xor eax, eax
mov edx, dword [esi + 8]
cmp dword [ebp - 8], 0
mov al, byte [edx]
jne 0x437e59
cmp eax, 0x7f
jle 0x437e59
mov ebx, 1
xor ecx, ecx
jmp 0x437e95
cmp dword [ebp - 8], 0
je 0x437e95
cmp eax, 0x80
jle 0x437e6f
mov ebx, 1
mov cl, 0xff
jmp 0x437e95
cmp eax, 0x80
jne 0x437e95
mov eax, 1
mov edx, dword [esi + 8]
inc edx
jmp 0x437e91
cmp byte [edx], 0
je 0x437e8f
mov ebx, 1
mov cl, 0xff
jmp 0x437e95
inc eax
inc edx
cmp eax, dword [esi]
jl 0x437e81
add dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0
jne 0x437ea3
mov eax, dword [ebp - 4]
jmp 0x437f13
mov edx, dword [ebp + 0xc]
test ebx, ebx
mov edx, dword [edx]
je 0x437eaf
mov byte [edx], cl
inc edx
cmp dword [esi], 0
jne 0x437eb9
mov byte [edx], 0
jmp 0x437f08
cmp dword [ebp - 8], 0
jne 0x437ed1
mov eax, dword [esi]
push eax
mov ecx, dword [esi + 8]
push ecx
push edx
call fcn.0040602c
add esp, 0xc
jmp 0x437f08
mov eax, dword [esi]
mov ecx, dword [esi + 8]
add ecx, eax
mov ebx, eax
dec ebx
dec ecx
add edx, ebx
jmp 0x437ee6
mov byte [edx], 0
dec edx
dec ecx
dec eax
cmp byte [ecx], 0
je 0x437ee0
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
inc ebx
mov byte [edx], bl
dec edx
test eax, eax
jle 0x437f08
mov bl, byte [ecx]
dec ecx
xor bl, 0xff
dec eax
mov byte [edx], bl
dec edx
test eax, eax
jg 0x437efa
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
add dword [eax], edx
mov eax, dword [ebp - 4]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x437f1c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
cmp dword [ebp + 8], 0
je 0x437f32
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x437f50
push 2
call fcn.0043c24c
pop ecx
mov esi, eax
test eax, eax
jne 0x437f47
xor eax, eax
jmp 0x43809a
mov dword [esi + 4], 2
jmp 0x437f55
mov edx, dword [ebp + 8]
mov esi, dword [edx]
mov eax, dword [ebp + 0xc]
mov ebx, dword [eax]
mov eax, dword [ebp + 0x10]
add eax, ebx
mov dword [ebp - 4], eax
push 0xc7
push 0x4a7920
mov edx, dword [ebp + 0x10]
inc edx
push edx
call fcn.00410fb4
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x437f8c
mov eax, 0x41
jmp 0x438066
cmp dword [ebp + 0x10], 0
mov edx, dword [ebp - 8]
jne 0x437fa1
mov dword [esi + 4], 2
jmp 0x438036
test byte [ebx], 0x80
je 0x43800f
mov dword [esi + 4], 0x102
cmp byte [ebx], 0xff
jne 0x437fbc
cmp dword [ebp + 0x10], 1
je 0x437fbc
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
lea ecx, [eax - 1]
add ebx, ecx
add edx, ecx
jmp 0x437fce
mov byte [edx], 0
dec edx
dec eax
dec ebx
cmp byte [ebx], 0
jne 0x437fd7
test eax, eax
jne 0x437fc8
test eax, eax
jne 0x437ff0
mov edx, dword [ebp - 8]
mov byte [edx], 1
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov byte [eax + edx], 0
inc dword [ebp + 0x10]
jmp 0x438036
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
inc ecx
mov byte [edx], cl
dec edx
test eax, eax
jle 0x438036
mov cl, byte [ebx]
dec ebx
xor cl, 0xff
dec eax
mov byte [edx], cl
dec edx
test eax, eax
jg 0x437fff
jmp 0x438036
mov dword [esi + 4], 2
cmp byte [ebx], 0
jne 0x438025
cmp dword [ebp + 0x10], 1
je 0x438025
inc ebx
dec dword [ebp + 0x10]
mov eax, dword [ebp + 0x10]
push eax
push ebx
mov edx, dword [ebp - 8]
push edx
call fcn.0040602c
add esp, 0xc
mov eax, dword [esi + 8]
test eax, eax
je 0x438044
push eax
call fcn.00411174
pop ecx
mov edx, dword [ebp - 8]
mov dword [esi + 8], edx
mov ecx, dword [ebp + 0x10]
mov dword [esi], ecx
cmp dword [ebp + 8], 0
je 0x43805a
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 4]
mov dword [edx], ecx
mov eax, esi
jmp 0x43809a
push 0x103
push 0x4a7936
push eax
push 0xc2
push 0xd
call fcn.0043531c
add esp, 0x14
test esi, esi
je 0x438098
cmp dword [ebp + 8], 0
je 0x438091
mov edx, dword [ebp + 8]
cmp esi, dword [edx]
je 0x438098
push esi
call fcn.0043c29c
pop ecx
xor eax, eax
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4b6d50
Capabilities:
Packed with generic packer

Disassembly:
push ebp
movsx bx, bl
nop
mov byte [esp], 0xf6
setge bh
mov ebx, dword [esp + 4]
jmp fcn.004d7dcf

Function at 0x4d742d
Capabilities:
Packed with generic packer

Disassembly:
pushfd
lea eax, [eax + 0x66be7d3a]
call fcn.004ce248
sbb ebx, dword [esi + 0x57]
shr byte [edx - 0x60], 1
popal
cmp edi, dword [ecx + 0x31]
test byte [ebp + 0x486afa61], ch
and ecx, dword [esi + 0xebe7f93]
add eax, edi
inc esi
mov ebx, 0xfd8ff7af
jg 0x4d7483
cmp ah, bh
adc byte [ebx], dl
dec edx
cmpsb byte [esi], byte es:[edi]
movsd dword es:[edi], dword [esi]
jnp 0x4d7489
lodsd eax, dword [esi]
psraw mm3, qword [edi]
mov esp, dword [0xa022667a]
mov byte [edx], dh
pop esp
adc cl, 0x5d
ljmp 0x5fb7
push esi
fbld tbyte [edx - 0x65c8796b]
xchg esi, eax
imul esp, dword [ebp - 0x1d], 0xa58303cb
sbb eax, 0x1ed5e7a1
lcall 0x3cb, 0xe3656996
and dword [ebp - 0x2a185ee3], 0x1e
pop ds
mov edi, 0xc7043831
mov dword [esp + 0x20], 0x37fdeea5

Function at 0x4d7778
Capabilities:
Encode data using xor

Disassembly:
push 0x5714680e
push edx
mov eax, dword [eax + 0x9ed37]
jmp 0x4c2f50
add al, 0x24
jmp 0x4beb78
mov byte [esp], dh
lea eax, [eax - 0x16cd2cc0]
pushal
mov byte [esp + 8], bh
call fcn.004d2a77
jg 0x4bf4e8
xor dword [ebx], ebp
mov dh, 0xf2
pop eax
js 0x4bf4e7
inc ecx
sbb eax, 0xf3d22801
pop edx
loop 0x4bf5ba
push ebx
lodsd eax, dword [esi]
sub esp, dword [ebx + 0x8e74dc5]
invalid
jle 0x4bf61e
ljmp 0xd009:0xd34b2b1e
xchg esi, eax
xlatb
cmc
invalid
jmp 0x4bf531
mov eax, 0x420c94
jmp 0x4bafa2
xchg dword [esp + 8], eax
jmp 0x4d6343
mov dword [esp + 4], eax
mov byte [esp], bh
jmp 0x4cf5a3
bswap ax
pushfd
nop
not ah
movsx ax, cl
lea eax, [eax + 0xdb5a49d]
mov eax, dword [esp + 4]
jmp 0x4d132e
Function at 0x401040
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.2.13
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.00409ac0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401094
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00402360
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.00411cd9
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010c8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.00402200
add esp, 0xc
jmp 0x4011f0
push 0x2000
call fcn.00411cd9
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010fa
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.00402200
add esp, 0xc
jmp 0x4011f0
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401129
ja 0x401122
cmp eax, 0x2000
jbe 0x401129
mov esi, 0x2000
jmp 0x40112b
mov esi, eax
mov eax, dword [esp + 0x5c]
push dword [eax]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040dbd2
add esp, 0x10
cmp eax, esi
jne 0x4011eb
mov eax, dword [esp + 0x5c]
push dword [eax]
call fcn.0040d9cd
add esp, 4
test eax, eax
jne 0x4011eb
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00407fd0
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x4011a0.1
movzx ecx, byte [ecx + 0x401274]
jmp dword [ecx*4 + 0x401268]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401214
push ebp
push esi
push 1
push ebx
call fcn.0040e2f5
add esp, 0x10
cmp eax, esi
jne 0x4011d2
push ebp
call fcn.0040d9cd
add esp, 4
test eax, eax
je 0x401225
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00402360
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.004098b0
push dword [esp + 0x14]
call fcn.00411cbe
push ebx
call fcn.00411cbe
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401229
push esi
push ebx
push edi
call fcn.0040b0b0
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401172
cmp eax, 1
je 0x401263
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401247
cmp dword [esp + 0x10], ecx
jbe 0x4011d5
mov eax, dword [esp + 0x10]
jmp 0x401115
mov eax, 0xfffffffd
jmp 0x4011d5
cmp eax, 1
jne 0x4011d5
xor esi, esi
jmp 0x4011ee
Function at 0x4012a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
mov edx, dword [ebp]
test edx, edx
jne 0x4012e5
lea eax, [ebp + 0x70]
push 0x4273b0
push eax
call fcn.00403770
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4012e5
mov eax, dword [esp + 0x14]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402360
add esp, 8
xor eax, eax
pop ebp
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x18]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [ebp + 8]
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040dff6
add esp, 0x10
test eax, eax
jns 0x401324
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402200
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
add esp, 8
ret
push esi
push dword [ebx + 0xc]
call fcn.00411cd9
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
test esi, esi
jne 0x401358
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00402200
add esp, 0x10
jmp 0x4013f9
cmp byte [ebx + 0x10], 1
jne 0x401370
push esi
push 0
push ebx
push ebp
call fcn.00401040
add esp, 0x10
jmp 0x4013ea
mov eax, esi
mov esi, dword [ebx + 0xc]
xor ebx, ebx
mov dword [esp + 0xc], eax
push edi
test esi, esi
je 0x4013c4
test ebx, ebx
jb 0x401395
ja 0x40138e
cmp esi, 0x2000
jbe 0x401395
mov edi, 0x2000
jmp 0x401397
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040dbd2
add esp, 0x10
cmp eax, 1
jb 0x4013c8
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
add eax, edi
mov dword [esp + 0x10], eax
test ebx, ebx
ja 0x40138e
jb 0x4013c4
test esi, esi
jne 0x401380
xor eax, eax
jmp 0x4013e5
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402200
add esp, 0xc
or eax, 0xffffffff
mov esi, dword [esp + 0x14]
pop edi
test eax, eax
je 0x4013f9
push esi
call fcn.00411cbe
add esp, 4
xor esi, esi
mov eax, dword [ebp]
test eax, eax
je 0x401410
push eax
call fcn.0040d971
add esp, 4
mov dword [ebp], 0
mov eax, esi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x401420
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x14]
push ebx
call fcn.00406200
add esp, 4
cmp eax, 0xffffffff
jne 0x40143d
or eax, eax
pop ebx
add esp, 0xc
ret
push ebp
push esi
mov esi, dword [esp + 0x20]
lea eax, [ebx + 0x3070]
push edi
lea ebp, [esi + 0x12]
push ebp
push eax
mov dword [esp + 0x1c], ebp
call fcn.004064d0
mov edi, eax
add esp, 8
mov dword [esp + 0x18], edi
test edi, edi
jne 0x401483
push ebp
push str.Failed_to_extract__s:_failed_to_open_target_file__n
push str.fopen
call fcn.00402200
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov edx, dword [ebx]
test edx, edx
jne 0x4014b8
lea eax, [ebx + 0x70]
push 0x4273b0
push eax
call fcn.00403770
mov edx, eax
add esp, 8
mov dword [ebx], edx
test edx, edx
jne 0x4014b8
push ebp
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402360
add esp, 8
or edi, 0xffffffff
jmp 0x4015d5
mov ecx, dword [esi + 4]
xor eax, eax
add ecx, dword [ebx + 8]
push 0
adc eax, dword [ebx + 0xc]
push eax
push ecx
push edx
call fcn.0040dff6
add esp, 0x10
test eax, eax
jns 0x4014ef
push ebp
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402200
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015d5
cmp byte [esi + 0x10], 1
jne 0x401509
push 0
push edi
push esi
push ebx
call fcn.00401040
add esp, 0x10
mov edi, eax
jmp 0x4015d5
push 0x2000
xor edi, edi
call fcn.00411cd9
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40153b
push ebp
push str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
push str.malloc
call fcn.00402200
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015d5
mov esi, dword [esi + 0xc]
xor ebp, ebp
test esi, esi
je 0x4015cc
test ebp, ebp
jb 0x40155d
ja 0x401556
cmp esi, 0x2000
jbe 0x40155d
mov edi, 0x2000
jmp 0x40155f
mov edi, esi
push dword [ebx]
push 1
push edi
push eax
call fcn.0040dbd2
add esp, 0x10
cmp eax, 1
jb 0x4015af
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040e2f5
add esp, 0x10
cmp eax, 1
jb 0x40159f
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebp, 0
jne 0x401548
jb 0x40159b
test esi, esi
jne 0x401548
xor edi, edi
jmp 0x4015c8
push dword [esp + 0x14]
push str.Failed_to_extract__s:_failed_to_write_data_chunk__n
push str.fwrite
jmp 0x4015bd
push dword [esp + 0x14]
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402200
add esp, 0xc
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.00411cbe
add esp, 4
mov eax, dword [ebx]
test eax, eax
je 0x4015ea
push eax
call fcn.0040d971
add esp, 4
mov dword [ebx], 0
push dword [esp + 0x18]
call fcn.0040d971
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x405f50
Capabilities:
Create directory
Query environment variable

Disassembly:
mov eax, 0x4004
call fcn.0040a2e0
mov eax, dword [0x435040]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push edi
push 0
push eax
push 0
call fcn.00407270
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x405fa8
push str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.00402360
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040a2c7
add esp, 0x4004
ret
push esi
push 0x1000
lea eax, [esp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov esi, eax
call fcn.00411cbe
add esp, 4
test esi, esi
jne 0x405fef
push str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.00402360
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040a2c7
add esp, 0x4004
ret
lea eax, [esp + 8]
push eax
call fcn.00407020
add esp, 4
test eax, eax
lea eax, [esp + 8]
je 0x40600f
push eax
call fcn.004137f4
add esp, 4
jmp 0x40601f
push 0x1000
push eax
push 0
call fcn.00412e28
add esp, 0xc
mov esi, eax
test esi, esi
jne 0x40604b
push str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.00402360
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040a2c7
add esp, 0x4004
ret
push 0x2000
lea eax, [esp + 0x200c]
push 0
push eax
call fcn.0040b630
push 0x5c
push esi
call fcn.0040b9f7
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4060ad
mov ecx, edi
lea eax, [esp + 0x2008]
sub ecx, esi
sar ecx, 1
inc ecx
push ecx
push esi
push eax
call fcn.00413853
add esp, 0xc
lea eax, [esp + 0x2008]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [edi + 2]
push 0x5c
push eax
call fcn.0040b9f7
mov edi, eax
add esp, 8
test edi, edi
jne 0x406070
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [esp + 0x4008]
mov eax, esi
pop esi
pop edi
xor ecx, esp
call fcn.0040a2c7
add esp, 0x4004
ret
Function at 0x4060d0
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1004
call fcn.0040a2e0
mov eax, dword [0x435040]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1018]
push 0x4273b0
push eax
call fcn.00403770
push esi
push edi
mov ebx, eax
call fcn.004064d0
add esp, 0x10
xor edi, edi
mov esi, eax
test ebx, ebx
je 0x4061cf
push ebx
test esi, esi
je 0x4061d4
call fcn.0040d9a1
add esp, 4
test eax, eax
jne 0x4061a6
nop dword [eax + eax]
push ebx
push 0x1000
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040dbd2
add esp, 0x10
test eax, eax
jne 0x406169
push ebx
call fcn.0040d9cd
add esp, 4
test eax, eax
je 0x40618b
push ebx
jmp 0x40619b
push esi
push eax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040e2f5
add esp, 0x10
test eax, eax
je 0x40619a
push esi
call fcn.0040d9cd
add esp, 4
test eax, eax
jne 0x40619a
push ebx
call fcn.0040d9a1
add esp, 4
test eax, eax
je 0x406140
jmp 0x4061a6
push esi
call fcn.004149bc
add esp, 4
or edi, 0xffffffff
push ebx
call fcn.0040d971
push esi
call fcn.0040d971
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0040a2c7
add esp, 0x1004
ret
test esi, esi
je 0x4061dc
push esi
call fcn.0040d971
add esp, 4
mov ecx, dword [esp + 0x100c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a2c7
add esp, 0x1004
ret
Function at 0x406250
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov eax, 0x2028
call fcn.0040a2e0
mov eax, dword [0x435040]
xor eax, esp
mov dword [esp + 0x2024], eax
mov eax, dword [esp + 0x202c]
push ebx
push ebp
mov ebp, dword [esp + 0x2038]
mov dword [esp + 8], eax
push esi
push edi
test ebp, ebp
je 0x4062cf
push 0x429794
call fcn.00406420
push ebp
mov ebx, eax
call fcn.00405f50
mov edi, eax
add esp, 8
test edi, edi
je 0x40638b
push edi
push 0x429798
call fcn.00413e2f
push edi
mov esi, eax
call fcn.00411cbe
add esp, 0xc
test esi, esi
je 0x4062d3
push str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
call fcn.00402360
add esp, 4
xor eax, eax
jmp 0x406405
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str._MEI_d
lea eax, [esp + 0x1c]
push 0x10
push eax
call fcn.004021d0
add esp, 0x10
xor esi, esi
nop
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.004149a1
mov edi, eax
push edi
call fcn.00407110
add esp, 0xc
test eax, eax
je 0x40638f
push edi
call fcn.00411cbe
inc esi
add esp, 4
cmp esi, 5
jl 0x406300
test ebp, ebp
je 0x40638b
push 0
push 0x429794
push 0
call fcn.00407270
test ebx, ebx
je 0x406374
push 0
push ebx
push 0
mov edi, eax
call fcn.00407270
mov esi, eax
push esi
push edi
call fcn.00413e2f
push edi
call fcn.00411cbe
push esi
call fcn.00411cbe
push ebx
call fcn.00411cbe
add esp, 0x2c
xor eax, eax
jmp 0x406405
add esp, 0xc
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
call fcn.00411cbe
add esp, 4
xor eax, eax
jmp 0x406405
push 0x1000
push edi
push dword [esp + 0x18]
call fcn.00407310
push edi
call fcn.00411cbe
add esp, 0x10
test ebp, ebp
je 0x406400
push 0
push 0x429794
push 0
call fcn.00407270
test ebx, ebx
je 0x4063e9
push 0
push ebx
push 0
mov edi, eax
call fcn.00407270
mov esi, eax
push esi
push edi
call fcn.00413e2f
push edi
call fcn.00411cbe
push esi
call fcn.00411cbe
push ebx
call fcn.00411cbe
add esp, 0x2c
jmp 0x406400
add esp, 0xc
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
call fcn.00411cbe
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x2034]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a2c7
add esp, 0x2028
ret