joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406302
Capabilities:
Print debug messages
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc
mov eax, dword [0x42f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, ecx
lea edx, [ebp - 0x8c]
push esi
xor eax, eax
mov dword [ebp - 0x94], ebx
push edi
lea esi, [ebx + 0x14]
mov dword [ebp - 0x98], eax
mov ecx, dword [esi]
mov dword [ebp - 0x8c], eax
mov dword [ebp - 0x9c], esi
call fcn.00404faf
mov eax, dword [ebp - 0x8c]
cmp eax, dword [ebx + 4]
jbe 0x406356
mov ecx, ebx
call fcn.0040652c
xor eax, eax
cmp byte [ebx + 0xa], al
setne al
xor ecx, ecx
push ecx
push 0x80
lea eax, [eax*2 + 2]
push eax
push ecx
push 3
push 0x40000000
push dword [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 0x18], eax
cmp eax, 0xffffffff
jne 0x40638f
xor edi, edi
xor al, al
mov dword [ebx + 0x18], edi
jmp 0x4063f7
mov edx, esi
lea ecx, [ebp - 0x8c]
call fcn.00406c73
mov esi, dword [ebp - 0x8c]
lea edi, [ebp - 0x28]
push 9
pop ecx
xor eax, eax
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x28]
xor edi, edi
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x406406
call fcn.00406d55
push dword [ebx + 0x14]
push dword [ebx + 0x1c]
push str.LOG_SYSTEM:___s_:_ERROR___Log_path__s_has_a_reparse_point
call fcn.00406f32
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebx + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebx + 0x18], edi
lea ecx, [esi - 0x10]
call fcn.00401251
mov al, byte [ebp - 0x98]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409f24
leave
ret
mov eax, dword [ebp - 0x28]
shr eax, 0xa
and al, 1
jne 0x4063c3
mov ecx, dword [ebx + 0x18]
call fcn.00405031
test al, al
jne 0x4063c3
lea ecx, [ebp - 0xbc]
call fcn.004030a8
push 0x221
push 0x20
push 2
lea eax, [ebp - 0x88]
push 0x42a7fc
push eax
call fcn.00402c08
add esp, 0x10
lea eax, [ebp - 0x88]
lea ecx, [ebp - 0xbc]
push 0xc0010000
push eax
call fcn.00403125
lea ecx, [ebp - 0x88]
mov bl, al
call fcn.00402cf1
test bl, bl
je 0x406483
push ecx
lea eax, [ebp - 0xbc]
push eax
mov eax, dword [ebp - 0x9c]
mov ecx, dword [eax]
call fcn.004039a4
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4064bc
mov eax, dword [ebp - 0x94]
cmp byte [eax + 0xb], 0
je 0x4064bc
xor ecx, ecx
push ecx
mov dword [ebp - 0x94], ecx
lea ecx, [ebp - 0x94]
push ecx
push 2
push 0x42a558
push dword [eax + 0x18]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea ecx, [ebp - 0xbc]
mov byte [ebp - 0x98], 1
call fcn.004030ee
jmp 0x4063e9
Function at 0x4064d3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
mov esi, ecx
push ebx
push 0x80
push 5
push ebx
push 3
push 0x40000000
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp dword [esi + 0x18], 0xffffffff
mov edi, eax
jne 0x406503
xor al, al
jmp 0x406527
cmp byte [esi + 0xb], bl
je 0x40651e
push ebx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push 2
push 0x42a558
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4065ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x42f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x18
mov dword [ebp - 0x74], ecx
lea edi, [ebp - 0x68]
pop ecx
mov esi, str.SYSTEMCurrentControlSetControlSession_Manager
lea eax, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
push eax
push 0x20019
xor ebx, ebx
lea eax, [ebp - 0x68]
push ebx
push eax
push 0x80000002
movsw word es:[edi], word [esi]
mov dword [ebp - 0x70], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4066d3
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x6c]
push 7
pop esi
push eax
push ebx
lea eax, [ebp - 0x78]
mov dword [ebp - 0x6c], ebx
push eax
push ebx
push 0x42ab80
push dword [ebp - 0x70]
mov dword [ebp - 0x78], esi
call edi
test eax, eax
jne 0x4066d3
cmp dword [ebp - 0x78], esi
jne 0x4066d3
push dword [ebp - 0x6c]
call fcn.0041a7cd
push dword [ebp - 0x6c]
mov esi, eax
push ebx
push esi
call fcn.0040aab0
add esp, 0x10
lea eax, [ebp - 0x6c]
push eax
push esi
push ebx
push ebx
push 0x42ab80
push dword [ebp - 0x70]
call edi
test eax, eax
jne 0x4066c4
mov edi, dword [ebp - 0x6c]
shr edi, 1
mov dword [ebp - 0x7c], edi
lea eax, [edi - 2]
cmp eax, 0xffffd
ja 0x4066c4
cmp word [esi + edi*2 - 4], bx
jne 0x4066c4
cmp word [esi + edi*2 - 2], bx
jne 0x4066c4
mov eax, dword [ebp - 0x74]
lea ecx, [ebp - 0x74]
add eax, 0x14
mov edx, str.___
push eax
call fcn.004068d7
test edi, edi
mov edi, dword [ebp - 0x74]
pop ecx
je 0x4066b3
lea eax, [esi + ebx*2]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4066b6
lea eax, [esi + ebx*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
add ebx, eax
cmp ebx, dword [ebp - 0x7c]
jb 0x406692
or ebx, 0xffffffff
cmp ebx, 0xffffffff
lea ecx, [edi - 0x10]
setne bl
call fcn.00401251
test esi, esi
je 0x4066cf
push esi
call fcn.0040a93b
pop ecx
mov al, bl
jmp 0x4066d5
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409f24
leave
ret
Function at 0x406869
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x406876
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4068af
cmp eax, 0x80
je 0x4068af
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406f32
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x406872
mov al, 1
pop esi
ret

Function at 0x406a2d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x42f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x118
xor edi, edi
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.0040aab0
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je case.0x406b47.2
mov ebx, dword [ebp - 0x11c]
cmp ebx, 6
je 0x406ad8
cmp ebx, 0xa
je 0x406ad8
cmp ebx, 5
jne case.0x406b47.2
cmp dword [ebp - 0x118], 2
jne 0x406ac1
cmp byte [ebp - 6], 1
jne 0x406aa3
call fcn.004069e1
cmp eax, 9
je case.0x406b47.1
test dword [ebp - 8], 0x8000
je case.0x406b47.7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00409f24
leave
ret
cmp dword [ebp - 0x118], 1
jne case.0x406b47.2
test dword [ebp - 8], 0x200
jne case.0x406b47.2
xor eax, eax
inc eax
jmp 0x406ab2
mov eax, dword [ebp - 0x118]
mov ecx, 0x42a7b0
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x128], eax
call fcn.004040ec
mov esi, eax
test esi, esi
je case.0x406b47.2
push str.GetProductInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406b1e
lea ecx, [ebp - 0x124]
push ecx
push edi
push edi
push dword [ebp - 0x128]
push ebx
call eax
mov edi, eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
test edi, edi
je case.0x406b47.2
mov eax, dword [ebp - 0x124]
cmp eax, 0x1b
ja 0x406b56
je case.0x406b47.4
dec eax
cmp eax, 0x18
ja case.0x406b47.2
movzx eax, byte [eax + 0x406bb9]
jmp dword [eax*4 + 0x406ba9]
push 2
pop eax
jmp 0x406ab2
cmp eax, 0x54
ja 0x406b76
je case.0x406b47.4
sub eax, 0x30
je case.0x406b47.1
sub eax, 0x16
je case.0x406b47.4
dec eax
sub eax, 1
je case.0x406b47.4
jmp case.0x406b47.2
cmp eax, 0x79
jb case.0x406b47.2
cmp eax, 0x7a
jbe 0x406ba4
cmp eax, 0x7c
jbe case.0x406b47.2
cmp eax, 0x7e
jbe case.0x406b47.4
add eax, 0xffffff7f
cmp eax, 1
ja case.0x406b47.2
push 3
jmp 0x406b50
push 4
jmp 0x406b50
Function at 0x40700d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x42f008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x802
lea eax, [ebp - 0x808]
mov edi, edx
push 0
push eax
mov ebx, ecx
call fcn.0040aab0
mov esi, dword [0x430bac]
lea ecx, [ebp - 0x80c]
xor edx, edx
call fcn.00404da8
push edi
push str.baselogging.cc
push 0
push esi
push dword [ebp - 0x80c]
lea eax, [ebp - 0x808]
push ebx
push str.Exception__x_in__s__s__u_r_n_r_n_hs:_d_r_n
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov ecx, dword [ebp - 0x80c]
add esp, 0x2c
lea ecx, [ecx - 0x10]
call fcn.00401251
lea ecx, [ebp - 0x808]
call fcn.00407545
push 0x250012
push str.Exception
lea eax, [ebp - 0x808]
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
sub eax, 3
je 0x4070c1
sub eax, 1
jne 0x4070b2
int3
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.00409f24
leave
ret
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x407545
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4075b4
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x407590
push ebx
push edi
push eax
call fcn.0040bee0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x4075ab
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x4016a3
Capabilities:
Move file

Disassembly:
push ebx
push ebp
push esi
mov ebp, 0x400
push ebp
mov esi, eax
call fcn.00418420
pop ecx
mov ebx, eax
push ebp
push ebx
call fcn.0041aae5
push ebx
push str._Extractor__Working_dir_is__s_n
call fcn.00409785
push ebx
call fcn.00418343
add esp, 0x14
call fcn.004092fe
test eax, eax
je 0x4016ec
push str._Rename__The_target_already_exists._Deleting._n
call fcn.00409785
pop ecx
push esi
call fcn.004091d3
pop ecx
push esi
push edi
call fcn.00418ee5
pop ecx
xor ebp, ebp
test eax, eax
pop ecx
je 0x40175f
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 0xa
jge 0x40177f
call fcn.00418849
push dword [eax]
push esi
push edi
push str._Rename__Could_not_rename__s_to__s___d__n
call fcn.00409785
add esp, 0x10
push 0x32
call ebx
push str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.00409785
pop ecx
push 3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401772
push str.MoveFileEx
push str.Extractor
call fcn.00408d32
pop ecx
pop ecx
push 0x12c
call ebx
push esi
push edi
inc ebp
call fcn.00418ee5
test eax, eax
pop ecx
pop ecx
jne 0x401701
push esi
push edi
push str._Rename__File__s_renamed_to__s_n
call fcn.00409785
add esp, 0xc
pop esi
pop ebp
pop ebx
ret
push str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.00409785
pop ecx
xor eax, eax
test eax, eax
je 0x40175f
call fcn.00418849
push dword [eax]
push esi
push edi
push str._Rename___FAIL__Could_not_rename__s_to__s___d__n
call fcn.00409785
push str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.00409785
add esp, 0x14
push esi
call fcn.00409660
pop ecx
push esi
push str._Rename__Created_folder__s_n
call fcn.00409785
push esi
push edi
call fcn.0040184f
add esp, 0x10
test eax, eax
je 0x4017d0
push str._Rename__Copy_failed_too__Severe_filesystem_issues._n
call fcn.00409785
pop ecx
jmp 0x40176e
push esi
push edi
push str._Rename__Copied__s_to__s_n
jmp 0x401766

Function at 0x4017d9
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x43e018
push dword [ebp + 8]
call fcn.004196b6
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 4], eax
jne 0x401806
push dword [ebp + 8]
push str._Extractor___Unable_to_open_destination_file_for_copy__s_n
call fcn.00409785
pop ecx
jmp 0x401849
mov edi, 0xc350
mov esi, 0x449a50
push dword [ebp + 0xc]
push edi
push 1
push esi
call fcn.00419b27
mov ebx, eax
add esp, 0x10
test ebx, ebx
jbe 0x401834
push dword [ebp - 4]
push ebx
push 1
push esi
call fcn.0041a8ec
add esp, 0x10
cmp ebx, edi
je 0x401810
push dword [ebp + 0xc]
call fcn.0041b0c3
pop ecx
push dword [ebp - 4]
call fcn.0041b0c3
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40184f
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x272c
call fcn.0041d020
mov eax, dword [0x446504]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x2728], esi
mov dword [ebp - 0x272c], eax
call fcn.0040107c
test eax, eax
pop ecx
mov dword [ebp - 0x271c], eax
jne 0x4018ab
push esi
push str._CopyFolder__SourceDir_from__s_is_NULL_n
call fcn.00409785
pop ecx
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00418334
leave
ret
call fcn.004011a6
mov esi, eax
test esi, esi
je 0x401a42
mov edi, 0x449a50
mov eax, dword [esi]
cmp byte [eax], 0x2e
jne 0x4018d6
push eax
call fcn.004185b0
cmp eax, 2
pop ecx
jbe 0x401a2d
push dword [esi]
lea eax, [ebp - 0x1390]
push dword [ebp - 0x2728]
call fcn.004096fe
push dword [esi]
lea eax, [ebp - 0x2718]
push dword [ebp - 0x272c]
call fcn.004096fe
lea eax, [ebp - 0x1390]
push eax
call fcn.0040107c
add esp, 0x14
test eax, eax
je 0x40198e
mov esi, eax
call fcn.00401167
lea eax, [ebp - 0x2718]
push eax
push str._CopyFolder__Copying_DIR__s_n
call fcn.00409785
lea eax, [ebp - 0x2718]
push eax
call fcn.00409660
mov ebx, eax
add esp, 0xc
test ebx, ebx
lea eax, [ebp - 0x2718]
push eax
lea eax, [ebp - 0x1390]
push eax
jne 0x401a49
call fcn.0040184f
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x401a2d
lea eax, [ebp - 0x2718]
push eax
lea eax, [ebp - 0x1390]
push eax
push str._CopyFolder___Failed_to_copy__s_to__s_n
call fcn.00409785
add esp, 0xc
mov edi, esi
mov esi, dword [ebp - 0x271c]
call fcn.00401167
mov eax, edi
jmp 0x40189c
lea eax, [ebp - 0x2718]
push eax
push str._CopyFolder__Copying_FILE__s_n
call fcn.00409785
lea eax, [ebp - 0x1390]
push 0x43dfc4
push eax
call fcn.004196b6
add esp, 0x10
test eax, eax
mov dword [ebp - 0x2724], eax
je 0x401a68
lea eax, [ebp - 0x2718]
push 0x43e018
push eax
call fcn.004196b6
test eax, eax
pop ecx
pop ecx
mov dword [ebp - 0x2720], eax
je 0x401a83
push dword [ebp - 0x2724]
mov ebx, 0xc350
push ebx
push 1
push edi
call fcn.00419b27
mov esi, eax
add esp, 0x10
test esi, esi
jbe 0x401a11
push dword [ebp - 0x2720]
push esi
push 1
push edi
call fcn.0041a8ec
add esp, 0x10
cmp esi, ebx
je 0x4019e2
push dword [ebp - 0x2724]
call fcn.0041b0c3
pop ecx
push dword [ebp - 0x2720]
call fcn.0041b0c3
pop ecx
mov eax, dword [ebp - 0x271c]
call fcn.004011a6
mov esi, eax
test esi, esi
jne 0x4018bf
xor edi, edi
jmp 0x40197c
push str._CopyFolder___Failed_to_copy__s_to__s__could_not_create_target_folder__n
call fcn.00409785
mov esi, dword [ebp - 0x271c]
add esp, 0xc
call fcn.00401167
mov eax, ebx
jmp 0x40189c
lea eax, [ebp - 0x1390]
push eax
push str._CopyFolder___Unable_to_open_source_file_for_copy__s_n
call fcn.00409785
pop ecx
xor edi, edi
pop ecx
inc edi
jmp 0x40197c
lea eax, [ebp - 0x2718]
push eax
push str._CopyFolder___Unable_to_open_destination_file_for_copy__s_n
jmp 0x401a74
Function at 0x402b07
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
push 0x64
mov edi, eax
call fcn.00418420
pop ecx
push dword [ebp + 8]
mov esi, eax
push str._JavaCheck__Checking_file_version_of__s_n
mov byte [esi], 0x30
mov byte [esi + 1], bl
call fcn.00409785
cmp edi, ebx
pop ecx
pop ecx
je 0x402c20
push edi
call fcn.00418420
mov dword [ebp - 4], eax
mov dword [esp], str._JavaCheck__Got_version_size_n
call fcn.00409785
pop ecx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402c0b
push str._JavaCheck__Got_version_info_n
call fcn.00409785
pop ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x43ed80
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402c04
push str._JavaCheck__Queried_value_n
call fcn.00409785
cmp dword [ebp - 0xc], ebx
pop ecx
je 0x402bfd
push str._JavaCheck__Size_OK_n
call fcn.00409785
mov edi, dword [ebp - 0x10]
cmp dword [edi], 0xfeef04bd
pop ecx
jne 0x402bf6
push dword [edi + 0x10]
push str._JavaCheck__file_version_MS_is__ld_n
call fcn.00409785
push dword [edi + 0x14]
push str._JavaCheck__file_version_LS_is__ld_n
call fcn.00409785
movzx eax, word [edi + 0x12]
push eax
push 0x43ee00
push esi
call fcn.00418f13
add esp, 0x1c
jmp 0x402c16
push str._JavaCheck__signature_is_wrong_n
jmp 0x402c10
push str._JavaCheck__size_is_null_n
jmp 0x402c10
push str._JavaCheck__ver_query_value_function_call_failed_n
jmp 0x402c10
push str._JavaCheck__get_file_version_info_call_failed_n
call fcn.00409785
pop ecx
push dword [ebp - 4]
call fcn.00418343
jmp 0x402c2a
push str._JavaCheck__verSize_is_zero_n
call fcn.00409785
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x402c32
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x402cb2
push 0x43eec4
push dword [ebp + 8]
call fcn.00419b50
test eax, eax
pop ecx
pop ecx
jne 0x402cb2
push str._Extractor__Authorised_to_override_the_splash_image._n
call fcn.00409785
xor eax, eax
cmp dword [ebp + 0xc], esi
pop ecx
push dword [ebp + 0x10]
setne al
push eax
push str._Extractor__DynamicSplash_is__d__size_is__d_n
call fcn.00409785
add esp, 0xc
cmp dword [ebp + 0xc], esi
je 0x402cb2
cmp dword [ebp + 0x10], esi
jbe 0x402cb2
push dword [ebp + 0x14]
push str._Extractor__Overwriting_splash_image_at__s_n
call fcn.00409785
push 0x43e018
push dword [ebp + 0x14]
call fcn.004196b6
mov esi, eax
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0041a8ec
push esi
call fcn.0041b0c3
add esp, 0x24
pop esi
pop ecx
pop ebp
ret
Function at 0x4030e7
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x43dfc4
push dword [ebp + 8]
call fcn.004196b6
mov edi, eax
xor esi, esi
cmp edi, esi
pop ecx
pop ecx
jne 0x40311b
push dword [ebp + 8]
push str._Extractor___Failed_to_extract_wrapper_params___couldnt_open_file__s_n
call fcn.00409785
pop ecx
pop ecx
push 1
call fcn.0041928e
mov dword [ebp - 4], esi
push edi
call fcn.0041b13f
inc dword [ebp - 4]
pop ecx
push edi
mov ebx, eax
call fcn.0041bd5e
test eax, eax
pop ecx
jne 0x403160
mov eax, dword [ebp + 0xc]
cmp bl, byte [esi + eax]
jne 0x403140
inc esi
jmp 0x403142
xor esi, esi
cmp esi, 0x40
jne 0x40311e
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [0x455e54], eax
je 0x403114
push edi
call fcn.00407ee0
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push str.Params
push str.Could_not_find_marker:__s_n
jmp 0x40310d

Function at 0x40316c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x43dfc4
push dword [ebp + 8]
call fcn.004196b6
mov edi, eax
xor esi, esi
cmp edi, esi
pop ecx
pop ecx
jne 0x4031a0
push dword [ebp + 8]
push str._Extractor___Failed_to_extract_wrapper_tail___couldnt_open_file__s_n
call fcn.00409785
pop ecx
pop ecx
push 1
call fcn.0041928e
mov dword [ebp - 4], esi
push edi
call fcn.0041b13f
inc dword [ebp - 4]
pop ecx
push edi
mov ebx, eax
call fcn.0041bd5e
test eax, eax
pop ecx
jne 0x4031f3
mov eax, dword [ebp + 0xc]
cmp bl, byte [esi + eax]
jne 0x4031c5
inc esi
jmp 0x4031c7
xor esi, esi
cmp esi, 0x80
jne 0x4031a3
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [0x455e54], eax
je 0x403199
push str._Extractor__Found_tail_marker_n
call fcn.00409785
pop ecx
push edi
call fcn.00407ee0
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push str.Tail
push str.Could_not_find_marker:__s_n
jmp 0x403192
Function at 0x404b75
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x447c64], esi
push esi
jne 0x404bd3
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x447c68
push esi
push 0x447c64
push 0x404c49
push esi
push esi
mov dword [0x447c6c], eax
call fcn.0041b3ac
add esp, 0x18
push 0x1388
push dword [0x447c6c]
mov dword [0x447c64], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x404be3
push str.Error_starting_SplashThread_n
call fcn.00409785
pop ecx
pop esi
ret
push 2
push 6
push dword [0x447c68]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
pop esi
ret
Function at 0x405aa0
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x447c64], 0
je 0x404c41
push 0
push 0
push 0x12
push dword [0x447c68]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0x2328
push dword [0x447c64]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x404c29
push 0x8ae
push dword [0x447c64]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push dword [0x447c64]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x447c6c]
call esi
pop esi
and dword [0x447c64], 0
ret
call fcn.004011ed
test al, al
je 0x405aae
jmp 0x40737b
jmp 0x404be5
cmp dword [0x447c20], 0
je 0x4073d7
push 0
push 0
push 0x12
push dword [0x447c24]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0x2328
push dword [0x447c20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x4073bf
push 0x8ae
push dword [0x447c20]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push dword [0x447c20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x447c28]
call esi
pop esi
and dword [0x447c20], 0
ret