joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ddac
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40deb6
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
push 9
push 0
mov eax, esi
call fcn.00403fa8
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40de83
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x40de7a
cmp dword [ebp - 0x10], 1
jae 0x40de1f
mov dword [ebp - 0x10], 1
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00404090
xor edi, edi
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00403fa8
push eax
push edi
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x40de7a
mov eax, dword [ebp - 8]
call fcn.00403fa8
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.00403ce8
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040ddac
test al, al
jne 0x40de2c
inc edi
jmp 0x40de2c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
mov eax, esi
call fcn.00403fa8
push eax
push ebx
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete al
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40debd
lea eax, [ebp - 0x14]
call fcn.00403b0c
lea eax, [ebp - 8]
call fcn.00403b0c
ret

Function at 0x40e62c
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
mov eax, ebx
call fcn.00403fa8
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov eax, esi
mov edx, esp
mov ecx, 0x105
call fcn.00403d60
add esp, 0x108
pop esi
pop ebx
ret
Function at 0x40e6dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], ecx
mov edi, edx
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00403f98
xor eax, eax
push ebp
push 0x40e80f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
mov ebx, eax
push ebx
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x40e7e3
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
mov ecx, 1
mov edx, dword [0x40e6b8]
call fcn.004048a4
add esp, 4
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0
push ebx
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x40e824
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40e7e3
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx + 0xc]
mov dword [ebp - 8], eax
mov esi, dword [ebx + 8]
mov dword [ebp - 4], esi
lea eax, [ebp - 0x20]
push eax
mov eax, esi
call fcn.00405740
movzx eax, ax
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
movzx eax, word [ebx + 8]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], 0
mov eax, dword [ebx + 0xc]
call fcn.00405740
movzx eax, ax
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
movzx eax, word [ebx + 0xc]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0
lea edx, [ebp - 0x40]
mov ecx, 3
mov eax, 0x40e830
call fcn.0040cdf0
mov edx, dword [ebp - 0x20]
mov eax, edi
call fcn.00403b60
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e816
lea eax, [ebp - 0x20]
call fcn.00403b0c
lea eax, [ebp - 0x18]
mov edx, dword [0x40e6b8]
call fcn.004048b0
lea eax, [ebp - 0xc]
call fcn.00403b0c
ret

Function at 0x40e948
Capabilities:
Read file via mapping

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov bl, 1
mov eax, dword [0x44aa00]
call fcn.00403fa8
push eax
push 0xffffffffffffffff
push 4
call sub.kernel32.dll_OpenFileMappingA
mov esi, eax
test esi, esi
je 0x40e9ca
push 4
push 0
push 0
push 4
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [esp], eax
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov eax, dword [esp + 4]
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov dword [esp + 4], eax
push 0
push 0
push 0x10
mov eax, dword [esp + 0xc]
mov eax, dword [eax]
push eax
call sub.user32.dll_PostMessageA
push 0xbb8
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x40e9ca
xor ebx, ebx
mov eax, ebx
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x40e9d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
xor eax, eax
push ebp
push 0x40ea46
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x44aa28], 0
je 0x40e9fb
mov eax, dword [0x44aa28]
push eax
call sub.kernel32.dll_CloseHandle
push 0
push 0
lea eax, [ebp - 4]
mov ecx, dword [0x44aa00]
mov edx, 0x40ea58
call fcn.00403df4
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 0x40ea68
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x40f0fc
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40f32f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 4]
mov edx, 0x40f344
mov eax, dword [0x44a9f0]
call fcn.00406828
mov edx, dword [ebp - 4]
mov eax, 0x44aa18
call fcn.00403b60
mov edx, 0x44a9f8
mov eax, dword [0x44aa18]
call fcn.0040e6dc
cmp edx, dword [0x44aa20]
jne 0x40f158
cmp eax, dword [0x44aa1c]
jb 0x40f19f
jmp 0x40f15a
jl 0x40f19f
push 0x50040
push dword [0x44aa10]
push 0x40f360
push 0x40f370
lea eax, [ebp - 8]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 8]
call fcn.00403fa8
push eax
push 0x40f37c
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
call sub.kernel32.dll_ExitProcess_1
cmp dword [0x44aa08], 0
je 0x40f1ae
call dword [0x44aa08]
call fcn.0040e948
test al, al
jne 0x40f1be
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
mov eax, dword [0x44aa18]
call fcn.00403fa8
push eax
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.004064c8
mov eax, dword [ebp - 0xc]
call fcn.00403fa8
push eax
call sub.kernel32.dll_CopyFileA
test eax, eax
jne 0x40f24d
push 0x50030
push dword [0x44aa10]
push 0x40f360
push 0x40f3b8
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
call sub.kernel32.dll_GetLastError
lea edx, [ebp - 0x18]
call fcn.00405c48
mov ecx, dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 0x40f3d0
call fcn.00403df4
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
call sub.kernel32.dll_ExitProcess_1
push 0x80
mov eax, dword [0x44aa18]
call fcn.00403fa8
push eax
call sub.kernel32.dll_SetFileAttributesA
push dword [0x44aa24]
push 0x40f3f8
push 0x40f40c
push dword [0x44aa00]
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.00403e68
mov edx, dword [ebp - 0x1c]
mov eax, 0x80000002
call fcn.00406758
mov ebx, eax
push 0
push 0x400
mov eax, dword [0x44aa18]
call fcn.0040661c
call fcn.00404654
mov ecx, eax
mov edx, 0x40f418
mov eax, ebx
call fcn.0040688c
mov ecx, dword [0x44a9f4]
mov edx, 0x40f430
mov eax, ebx
call fcn.004068c4
mov eax, ebx
call fcn.00406904
push 0x50040
push dword [0x44aa10]
push 0x40f360
push 0x40f370
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x20]
call fcn.00403fa8
push eax
push 0x40f440
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
call fcn.0040e9d4
Function at 0x40f460
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
xor eax, eax
push ebp
push 0x40f5e1
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040e948
test al, al
jne 0x40f48b
push 0
call sub.kernel32.dll_ExitProcess_1
push 0
push 0
push 0x40f5f8
push dword [0x44aa00]
push 0x40f610
lea eax, [ebp - 4]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 4]
call fcn.00403fa8
push eax
push 0x40f614
push 0
push 0
call sub.shell32.dll_ShellExecuteA
lea eax, [ebp - 8]
mov ecx, dword [0x44aa00]
mov edx, 0x40f628
call fcn.00403df4
mov edx, dword [ebp - 8]
mov eax, 0x80000002
call fcn.0040ddac
push dword [0x44aa24]
push 0x40f63c
push 0x40f650
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403e68
mov edx, dword [ebp - 0xc]
mov eax, 0x80000002
call fcn.00406728
mov ebx, eax
mov edx, dword [0x44aa00]
mov eax, ebx
call fcn.00406910
mov eax, ebx
call fcn.00406904
push 0x50040
push dword [0x44aa10]
push 0x40f65c
push 0x40f66c
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403e68
mov eax, dword [ebp - 0x10]
call fcn.00403fa8
push eax
push 0x40f678
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
push 0
push 0
push 0x40f69c
push dword [0x44a9fc]
push 0x40f6b4
lea edx, [ebp - 0x18]
mov eax, dword [0x44a9fc]
call fcn.00406684
push dword [ebp - 0x18]
push 0x40f6c8
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00403e68
mov eax, dword [ebp - 0x14]
call fcn.00403fa8
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x40f6d4
call fcn.0040e62c
mov eax, dword [ebp - 0x1c]
call fcn.00403fa8
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1

Function at 0x40f6dc
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x40f78d
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 8]
mov edx, 0x40f7a0
mov eax, dword [0x44a9f0]
call fcn.00406828
mov edx, dword [ebp - 8]
mov eax, 0x44aa18
call fcn.00403b60
mov eax, dword [0x44aa00]
call fcn.00403fa8
push eax
push 4
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov dword [0x44aa28], eax
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
jne 0x40f746
push 0
call sub.kernel32.dll_ExitProcess_1
push 4
push 0
push 0
push 0xf001f
mov eax, dword [0x44aa28]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 4], eax
mov eax, dword [0x44a8a8]
call fcn.0040d05c
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_UnmapViewOfFile
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f794
lea eax, [ebp - 8]
call fcn.00403b0c
ret
Function at 0x411a28
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x411a61
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403bfc
jmp 0x411a6a
mov eax, ebx
mov edx, esi
call fcn.00403b60
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x411a74
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x411a95
mov al, byte [esp]
jmp 0x411a97
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41212c
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x411f94
mov eax, dword [0x4497dc]
cmp byte [eax], 0
je 0x4121a8
mov eax, dword [0x449738]
call fcn.00402ab4
call fcn.0040298c
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00410efc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4121f0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4121de
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x449718]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x44a660]
call fcn.0040495c
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret

Function at 0x412bcc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x412c30
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403d60
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00410dc4
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412c37
lea eax, [ebp - 0xc]
call fcn.00403b0c
ret
Function at 0x4278c8
Capabilities:
Read file on windows

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
push 4
push 0x1000
mov eax, dword [ebx + 0x50]
push eax
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov dword [esp], eax
push 0
push 0
call fcn.00402b74
fild qword [ebx + 0x58]
fmulp st(1)
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [esp + 0x18]
call fcn.00406208
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x14]
push edx
push eax
mov eax, dword [ebx + 0x50]
dec eax
xor edx, edx
not eax
not edx
and eax, dword [esp]
and edx, dword [esp + 4]
add esp, 8
push edx
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_SetFilePointerEx
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [ebx + 0x50]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [ebx + 0x28]
push eax
call sub.kernel32.dll_ReadFile
push 0x8000
push 0
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_VirtualFree_1
add esp, 0x10
pop ebx
ret
Function at 0x432454
Capabilities:
Create process on windows

Disassembly:
push ebx
mov bl, byte [0x44ac78]
xor bl, 1
test bl, bl
je 0x43249e
push 0x50044
mov eax, dword [0x44ac84]
call fcn.00403fa8
push eax
push 0x4324a4
mov eax, dword [0x44a8a8]
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_MessageBoxA_2
cmp eax, 6
jne 0x43249e
push 5
push 0
push 0
push 0x4324fc
push 0
push 0
call sub.shell32.dll_ShellExecuteA
mov eax, ebx
pop ebx
ret
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, 0x403a6b
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x44b94987
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x7adb1a15
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401030
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.2.11
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.004084a0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401084
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.004023e0
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.0040c4cf
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010b8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.00402280
add esp, 0xc
jmp 0x4011e0
push 0x2000
call fcn.0040c4cf
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010ea
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.00402280
add esp, 0xc
jmp 0x4011e0
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401119
ja 0x401112
cmp eax, 0x2000
jbe 0x401119
mov esi, 0x2000
jmp 0x40111b
mov esi, eax
mov eax, dword [esp + 0x5c]
push dword [eax]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040b82e
add esp, 0x10
cmp eax, esi
jne 0x4011db
mov eax, dword [esp + 0x5c]
push dword [eax]
call fcn.0040b61c
add esp, 4
test eax, eax
jne 0x4011db
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00406b10
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x401190.1
movzx ecx, byte [ecx + 0x401264]
jmp dword [ecx*4 + 0x401258]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401204
push ebp
push esi
push 1
push ebx
call fcn.0040c446
add esp, 0x10
cmp eax, esi
jne 0x4011c2
push ebp
call fcn.0040b61c
add esp, 4
test eax, eax
je 0x401215
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.004023e0
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.004082e0
push dword [esp + 0x14]
call fcn.0040c4b4
push ebx
call fcn.0040c4b4
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401219
push esi
push ebx
push edi
call fcn.0040a280
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401162
cmp eax, 1
je 0x401253
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401237
cmp dword [esp + 0x10], ecx
jbe 0x4011c5
mov eax, dword [esp + 0x10]
jmp 0x401105
mov eax, 0xfffffffd
jmp 0x4011c5
cmp eax, 1
jne 0x4011c5
xor esi, esi
jmp 0x4011de
Function at 0x401290
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebp
mov ebp, dword [esp + 0xc]
mov edx, dword [ebp]
test edx, edx
jne 0x4012d1
lea eax, [ebp + 0x70]
push 0x423280
push eax
call fcn.00403600
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4012d1
mov eax, dword [esp + 0x10]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.004023e0
add esp, 8
xor eax, eax
pop ebp
pop ecx
ret
push ebx
mov ebx, dword [esp + 0x14]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [ebp + 8]
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040bc25
add esp, 0x10
test eax, eax
jns 0x40130e
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402280
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
pop ecx
ret
push esi
push edi
push dword [ebx + 0xc]
call fcn.0040c4cf
mov esi, eax
add esp, 4
mov dword [esp + 0x18], esi
test esi, esi
jne 0x401340
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00402280
add esp, 0x10
jmp 0x4013bb
cmp byte [ebx + 0x10], 1
jne 0x401364
push esi
push 0
push ebx
push ebp
call fcn.00401030
add esp, 0x10
test eax, eax
je 0x4013bb
push esi
call fcn.0040c4b4
add esp, 4
xor esi, esi
jmp 0x4013bb
mov eax, esi
mov esi, dword [ebx + 0xc]
xor ebx, ebx
mov dword [esp + 0x10], eax
test esi, esi
je 0x4013b7
test ebx, ebx
jb 0x401388
ja 0x401381
cmp esi, 0x2000
jbe 0x401388
mov edi, 0x2000
jmp 0x40138a
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040b82e
add esp, 0x10
cmp eax, 1
jb 0x4013da
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
add eax, edi
mov dword [esp + 0x10], eax
test ebx, ebx
ja 0x401381
jb 0x4013b7
test esi, esi
jne 0x401373
mov esi, dword [esp + 0x18]
mov eax, dword [ebp]
test eax, eax
je 0x4013d2
push eax
call fcn.0040b56c
add esp, 4
mov dword [ebp], 0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
pop ecx
ret
mov eax, dword [esp + 0x1c]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402280
mov esi, dword [esp + 0x24]
add esp, 0xc
push esi
call fcn.0040c4b4
add esp, 4
xor esi, esi
jmp 0x4013bb
Function at 0x401410
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push ebp
call fcn.00405a20
add esp, 4
cmp eax, 0xffffffff
jne 0x40142d
or eax, eax
pop ebp
add esp, 0xc
ret
push ebx
push esi
mov esi, dword [esp + 0x20]
lea eax, [ebp + 0x2070]
push edi
lea ebx, [esi + 0x12]
push ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.00405cf0
mov edi, eax
add esp, 8
mov dword [esp + 0x18], edi
test edi, edi
jne 0x401473
push ebx
push str.Failed_to_extract__s:_failed_to_open_target_file__n
push str.fopen
call fcn.00402280
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
mov edx, dword [ebp]
test edx, edx
jne 0x4014aa
lea eax, [ebp + 0x70]
push 0x423280
push eax
call fcn.00403600
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4014aa
push ebx
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.004023e0
add esp, 8
or edi, 0xffffffff
jmp 0x4015d0
mov ecx, dword [esi + 4]
xor eax, eax
add ecx, dword [ebp + 8]
push 0
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040bc25
add esp, 0x10
test eax, eax
jns 0x4014e1
push ebx
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402280
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015d0
cmp byte [esi + 0x10], 1
jne 0x4014fb
push 0
push edi
push esi
push ebp
call fcn.00401030
add esp, 0x10
mov edi, eax
jmp 0x4015d0
push 0x2000
xor edi, edi
call fcn.0040c4cf
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40152d
push ebx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
push str.malloc
call fcn.00402280
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015d0
mov esi, dword [esi + 0xc]
xor ebx, ebx
test esi, esi
je 0x4015c7
nop word [eax + eax]
test ebx, ebx
jb 0x401555
ja 0x40154e
cmp esi, 0x2000
jbe 0x401555
mov edi, 0x2000
jmp 0x401557
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040b82e
add esp, 0x10
cmp eax, 1
jb 0x4015aa
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040c446
add esp, 0x10
cmp eax, 1
jb 0x40159a
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
test ebx, ebx
ja 0x40154e
jb 0x401596
test esi, esi
jne 0x401540
xor edi, edi
jmp 0x4015c3
push dword [esp + 0x14]
push str.Failed_to_extract__s:_failed_to_write_data_chunk__n
push str.fwrite
jmp 0x4015b8
push dword [esp + 0x14]
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402280
add esp, 0xc
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.0040c4b4
add esp, 4
mov eax, dword [ebp]
test eax, eax
je 0x4015e7
push eax
call fcn.0040b56c
add esp, 4
mov dword [ebp], 0
push dword [esp + 0x18]
call fcn.0040b56c
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret