joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ea7c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40eab0
xor eax, eax
jmp 0x40eb01
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40eae4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40eae4
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40fda8
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edx, dword [0x41a6dc]
mov edx, dword [edx]
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
call fcn.0040ca04
mov ebp, 0xff
mov eax, 0x1a
call fcn.00417368
mov esi, eax
dec esi
test esi, esi
jl 0x40fe1a
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x41a674]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
call fcn.00409398
mov eax, dword [0x41a674]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.0040bbb0
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40fe16
mov ebp, ebx
inc ebx
dec esi
jne 0x40fddc
cmp ebp, 0xff
jne 0x40fe5a
mov eax, 0x1a
call fcn.00417368
mov esi, eax
dec esi
test esi, esi
jl 0x40fe5a
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x41a674]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40fe80
call fcn.00403a54
jne 0x40fe56
mov ebp, ebx
jmp 0x40fe5a
inc ebx
dec esi
jne 0x40fe36
cmp ebp, 0xff
jne 0x40fe64
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
mov edx, ebp
call fcn.0040d3a0
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x411ff0
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x412011
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x41201c
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.004038f0
add esp, 0x104
pop ebx
ret

Function at 0x412034
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.004038f0
add esp, 0x3f0
pop ebx
ret
Function at 0x4138fc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x413adb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x41a688]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x41b7a4]
mov eax, dword [eax + 0x5c]
call fcn.0040ca04
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
call fcn.0040cf1c
mov eax, 0x28
call fcn.00417368
mov edi, eax
dec edi
test edi, edi
jl 0x413ac0
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x41a684]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.0040bbb0
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x413ab8
mov eax, dword [0x41a684]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 0xc]
xor edx, edx
call fcn.004125a8
mov eax, dword [0x41a684]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x10]
xor edx, edx
call fcn.004125a8
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00406114
mov eax, dword [0x41a684]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.0040bbb0
mov dword [ebp - 8], eax
mov eax, dword [0x41a684]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.0040bbb0
dec eax
jne 0x413a73
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402a7c
mov dword [ebp - 0x50], 0x3c
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
mov dword [ebp - 0x48], eax
mov eax, 0x413aec
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
call fcn.00403b08
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
call fcn.00403b08
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
call fcn.00403b08
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x4c], 0x240
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
je 0x413aa7
jmp 0x413a56
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
call fcn.0040cf1c
push 0x32
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x413a4a
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle
jmp 0x413aa7
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403b08
push eax
mov eax, dword [ebp - 0x10]
call fcn.00403b08
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403b08
push eax
push 0x413aec
mov eax, dword [0x41a6c8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
push eax
call sub.shell32.dll_ShellExecuteA
push 0
push 0x2800
mov eax, dword [0x41b7a4]
call fcn.00412770
inc ebx
dec edi
jne 0x41395f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413ae2
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004036cc
ret
Function at 0x413fbc
Capabilities:
Delete file

Disassembly:
push ebx
add esp, 0xfffffff0
mov ebx, eax
cmp dword [0x41b7c4], 0
jle 0x413fdb
mov eax, dword [0x41b7d0]
call fcn.00403b08
push eax
call sub.kernel32.dll_DeleteFileA
mov eax, ebx
call fcn.0040bd74
mov dword [esp], eax
mov eax, dword [esp]
mov edx, 0x414090
call fcn.0040739c
mov eax, 0x75
call fcn.00417368
cmp eax, dword [0x41b7c4]
jne 0x414019
mov eax, 0x76
call fcn.00417368
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
jmp 0x41402c
mov eax, 0x5f
call fcn.00417368
cdq
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
cmp dword [0x41b7cc], 1
jne 0x41405b
mov eax, 0x5f
call fcn.00417368
mov edx, eax
imul edx, dword [0x41b7c4]
mov eax, dword [0x41a6b4]
add edx, dword [eax]
mov eax, dword [0x41b7c8]
xor ecx, ecx
call fcn.00407484
push dword [esp + 0xc]
push dword [esp + 0xc]
mov eax, dword [esp + 8]
call fcn.00413db8
mov eax, dword [esp]
call fcn.0040b304
mov eax, 0x41b7d0
mov edx, ebx
call fcn.004036fc
add esp, 0x10
pop ebx
ret
Function at 0x4142f8
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov esi, edx
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], ecx
mov esi, eax
xor eax, eax
push ebp
push 0x4144b6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 1
lea eax, [esi + esi*2]
mov edx, dword [0x41a6e4]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
lea ecx, [ebp - 0x24]
xor edx, edx
call fcn.004125a8
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.004036fc
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403b08
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41444d
test bl, 0x10
jne 0x41444d
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403b08
push eax
call sub.kernel32.dll_CreateFileA
mov edi, eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push edi
call sub.kernel32.dll_GetFileTime
push edi
call sub.kernel32.dll_CloseHandle
lea eax, [esi + esi*2]
mov edx, dword [0x41a6e4]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 4]
call fcn.0040bbb0
cmp eax, 4
ja case.default.0x4143bf
jmp dword [eax*4 + 0x4143c6]
push ebp
call fcn.004140f8
pop ecx
jmp case.default.0x4143bf
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.0040604c
dec eax
jne 0x4143fa
push ebp
call fcn.004140f8
pop ecx
jmp case.default.0x4143bf
mov byte [ebp - 0x1d], 0
jmp case.default.0x4143bf
mov byte [ebp - 0x1d], 1
jmp case.default.0x4143bf
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
call fcn.0040604c
dec eax
sete byte [ebp - 0x1d]
jmp case.default.0x4143bf
mov byte [ebp - 0x1d], 0
cmp byte [ebp - 0x1d], 0
je 0x414462
test bl, 1
je 0x41443b
and ebx, 0xfffffffe
push ebx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403b08
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00403b08
push eax
call sub.kernel32.dll_DeleteFileA
jmp 0x414462
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
call fcn.00406114
mov eax, dword [ebp - 0x28]
call fcn.004061ac
cmp byte [ebp - 0x1d], 0
jne 0x414472
mov eax, dword [ebp - 0xc]
call fcn.004036a8
jmp 0x414498
lea eax, [esi + esi*2]
mov edx, dword [0x41a6e4]
mov edx, dword [edx]
mov eax, dword [edx + eax*4 + 8]
call fcn.0040bbb0
dec eax
jne 0x414498
mov edx, dword [ebp - 0xc]
mov edx, dword [edx]
mov eax, dword [0x41b7d4]
call fcn.0040d49c
mov bl, byte [ebp - 0x1d]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4144bd
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.004036cc
ret
Function at 0x41743c
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x417515
push dword fs:[eax]
mov dword fs:[eax], esp
xor edi, edi
lea ecx, [ebp - 4]
xor edx, edx
mov eax, edi
call fcn.00417378
mov eax, dword [ebp - 4]
call fcn.00403b08
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
cmp edi, 0x12
jne 0x41745b
test bl, bl
je 0x4174d2
mov eax, 0x1a
call fcn.00417368
mov esi, eax
add esi, 0x14
sub esi, 0x14
jl 0x4174d2
inc esi
mov edi, 0x14
lea ecx, [ebp - 8]
xor edx, edx
mov eax, edi
call fcn.00417378
mov eax, dword [ebp - 8]
call fcn.00403b08
push eax
call sub.kernel32.dll_DeleteFileA
lea ecx, [ebp - 0xc]
lea eax, [edi + 0x1e]
xor edx, edx
call fcn.00417378
mov eax, dword [ebp - 0xc]
call fcn.00403b08
push eax
call sub.kernel32.dll_DeleteFileA
inc edi
dec esi
jne 0x417499
lea ecx, [ebp - 0x14]
xor edx, edx
mov eax, 1
call fcn.00417378
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00406114
mov eax, dword [ebp - 0x10]
call fcn.00403b08
push eax
call sub.kernel32.dll_RemoveDirectoryA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41751c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.004036cc
ret

Function at 0x4178ac
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff0
mov byte [esp], 0
lea eax, [esp + 4]
push eax
push 0xffffffffffffffff
push 8
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.advapi32.dll_OpenThreadToken
mov ebx, eax
test ebx, ebx
jne 0x4178f0
call sub.kernel32.dll_GetLastError
cmp eax, 0x3f0
jne 0x4178f0
lea eax, [esp + 4]
push eax
push 8
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
mov ebx, eax
test ebx, ebx
je 0x417987
mov eax, 0x400
call fcn.00402830
mov esi, eax
lea eax, [esp + 8]
push eax
push 0x400
push esi
push 2
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_GetTokenInformation
mov ebx, eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
test ebx, ebx
je 0x417980
lea eax, [esp + 0xc]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push 0x220
push 0x20
push 2
push 0x41a660
call sub.advapi32.dll_AllocateAndInitializeSid
mov ebx, dword [esi]
dec ebx
test ebx, ebx
jl 0x417976
inc ebx
xor edi, edi
mov eax, dword [esi + edi*8 + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.advapi32.dll_EqualSid
test eax, eax
je 0x417972
mov byte [esp], 1
jmp 0x417976
inc edi
dec ebx
jne 0x417959
mov eax, dword [esp + 0xc]
push eax
call sub.advapi32.dll_FreeSid
mov eax, esi
call fcn.00402860
mov al, byte [esp]
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x417c80
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403af8
xor eax, eax
push ebp
push 0x417cf1
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040bbe4
mov edx, dword [ebp - 8]
mov eax, 0x41b874
call fcn.004036fc
xor eax, eax
mov dword [0x41b870], eax
push 0
push 0x417b94
call sub.user32.dll_EnumWindows
mov ebx, dword [0x41b870]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417cf8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004036cc
ret

Function at 0x417d00
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, eax
xor ebx, ebx
test esi, esi
jns 0x417d11
call fcn.00402d08
push esi
push 0xffffffffffffffff
push 0x1f0fff
call sub.kernel32.dll_OpenProcess
mov edi, eax
test edi, edi
jns 0x417d29
call fcn.00402d08
push esp
mov esi, edi
test esi, esi
jns 0x417d35
call fcn.00402d08
push esi
call sub.kernel32.dll_GetExitCodeProcess
test edi, edi
je 0x417d58
mov eax, dword [esp]
push eax
test edi, edi
jns 0x417d4c
call fcn.00402d08
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
test edi, edi
jns 0x417d61
call fcn.00402d08
push esi
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4061ae
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
invalid
invalid

Function at 0x406752
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406776
xor eax, eax
test eax, eax
je 0x406789
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406789
xor ecx, ecx
jmp 0x40678c
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4
Function at 0x401928
Capabilities:
Move file

Disassembly:
push ecx
push ebx
push ebp
mov ebp, 0x400
push ebp
call fcn.00418af7
pop ecx
mov ebx, eax
push ebp
push ebx
call fcn.0041b2b3
push ebx
push str._Extractor__Working_dir_is__s_n
call fcn.00409ab5
push ebx
call fcn.00418a1a
add esp, 0x14
push esi
call fcn.00409415
test eax, eax
pop ecx
je 0x4019a6
push str._Rename__The_target_already_exists._Deleting._n
call fcn.00409ab5
mov dword [esp], 0x104
call fcn.00418af7
pop ecx
push esi
mov ebx, eax
push str.Remove__s
push ebx
call fcn.004197bd
add esp, 0xc
push ebx
push esi
call fcn.0041978f
test eax, eax
pop ecx
pop ecx
push ebx
jne 0x401a30
call fcn.004092e8
pop ecx
push ebx
call fcn.00418a1a
pop ecx
push esi
push edi
call fcn.0041978f
pop ecx
xor ebp, ebp
test eax, eax
pop ecx
je 0x401a1d
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
cmp ebp, 0xa
jge 0x401a52
call fcn.00418f19
push dword [eax]
push esi
push edi
push str._Rename__Could_not_rename__s_to__s___d__n
call fcn.00409ab5
add esp, 0x10
push 0x32
call ebx
push str._Rename__Windows___this_FS_seems_to_not_supported_renaming._Trying_alternative_method..._n
call fcn.00409ab5
pop ecx
push 3
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401a45
push str.MoveFileEx
push str.Extractor
call fcn.00408cfe
pop ecx
pop ecx
push 0x12c
call ebx
push esi
push edi
inc ebp
call fcn.0041978f
test eax, eax
pop ecx
pop ecx
jne 0x4019bb
push esi
push edi
push str._Rename__File__s_renamed_to__s_n
call fcn.00409ab5
add esp, 0xc
pop ebp
pop ebx
pop ecx
ret
call fcn.00418a1a
pop ecx
push esi
push str._Rename__Unable_to_rename_folder__s_prior_to_deletion.
call fcn.00409ab5
pop ecx
pop ecx
jmp 0x401a2c
push str._Rename__MoveFileEx_worked._Assuming_success._n
call fcn.00409ab5
pop ecx
xor eax, eax
test eax, eax
je 0x401a1d
call fcn.00418f19
push dword [eax]
push esi
push edi
push str._Rename___FAIL__Could_not_rename__s_to__s___d__n
call fcn.00409ab5
push str._Rename__Can_do_no_better_than_a_copy_on_this_filesystem_n
call fcn.00409ab5
add esp, 0x14
push esi
call fcn.004099d0
pop ecx
push esi
push str._Rename__Created_folder__s_n
call fcn.00409ab5
push esi
push edi
call fcn.00401b26
add esp, 0x10
test eax, eax
je 0x401aa2
push str._Rename__Copy_failed_too__Severe_filesystem_issues._n
call fcn.00409ab5
jmp 0x401a42
push esi
push edi
push str._Rename__Copied__s_to__s_n
jmp 0x401a24

Function at 0x401aae
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4400e0
push dword [esp + 0x1c]
call fcn.0041a088
mov ebp, eax
test ebp, ebp
pop ecx
pop ecx
jne 0x401adc
push dword [esp + 0x18]
push str._Extractor___Unable_to_open_destination_file_for_copy__s_n
call fcn.00409ab5
pop ecx
xor al, al
jmp 0x401b1f
mov ebx, 0xc350
mov esi, 0x44aa88
push dword [esp + 0x1c]
push ebx
push 1
push esi
call fcn.0041a377
mov edi, eax
add esp, 0x10
test edi, edi
jbe 0x401b09
push ebp
push edi
push 1
push esi
call fcn.0041b0ba
add esp, 0x10
cmp edi, ebx
je 0x401ae6
push dword [esp + 0x1c]
call fcn.0041b78d
pop ecx
push ebp
call fcn.0041b78d
mov al, 1
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x402db5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x402e35
push 0x440cf4
push dword [ebp + 8]
call fcn.0041a3a0
test eax, eax
pop ecx
pop ecx
jne 0x402e35
push str._Extractor__Authorised_to_override_the_splash_image._n
call fcn.00409ab5
xor eax, eax
cmp dword [ebp + 0xc], esi
pop ecx
push dword [ebp + 0x10]
setne al
push eax
push str._Extractor__DynamicSplash_is__d__size_is__d_n
call fcn.00409ab5
add esp, 0xc
cmp dword [ebp + 0xc], esi
je 0x402e35
cmp dword [ebp + 0x10], esi
jbe 0x402e35
push dword [ebp + 0x14]
push str._Extractor__Overwriting_splash_image_at__s_n
call fcn.00409ab5
push 0x4400e0
push dword [ebp + 0x14]
call fcn.0041a088
mov esi, eax
push esi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.0041b0ba
push esi
call fcn.0041b78d
add esp, 0x24
pop esi
pop ecx
pop ebp
ret

Function at 0x402e39
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x44008c
push dword [ebp + 8]
call fcn.0041a088
mov edi, eax
xor esi, esi
cmp edi, esi
pop ecx
pop ecx
jne 0x402e6d
push dword [ebp + 8]
push str._Extractor___Failed_to_extract_wrapper_params___couldnt_open_file__s_n
call fcn.00409ab5
pop ecx
pop ecx
push 1
call fcn.00419ad0
mov dword [ebp - 4], esi
push edi
call fcn.0041b809
inc dword [ebp - 4]
pop ecx
push edi
mov ebx, eax
call fcn.0041c980
test eax, eax
pop ecx
jne 0x402eb2
mov eax, dword [ebp + 0xc]
cmp bl, byte [esi + eax]
jne 0x402e92
inc esi
jmp 0x402e94
xor esi, esi
cmp esi, 0x40
jne 0x402e70
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [0x456e90], eax
je 0x402e66
push edi
call fcn.00407c9a
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push str.Params
push str.Could_not_find_marker:__s_n
jmp 0x402e5f

Function at 0x402ebe
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x44008c
push dword [ebp + 8]
call fcn.0041a088
mov edi, eax
xor esi, esi
cmp edi, esi
pop ecx
pop ecx
jne 0x402ef2
push dword [ebp + 8]
push str._Extractor___Failed_to_extract_wrapper_tail___couldnt_open_file__s_n
call fcn.00409ab5
pop ecx
pop ecx
push 1
call fcn.00419ad0
mov dword [ebp - 4], esi
push edi
call fcn.0041b809
inc dword [ebp - 4]
pop ecx
push edi
mov ebx, eax
call fcn.0041c980
test eax, eax
pop ecx
jne 0x402f45
mov eax, dword [ebp + 0xc]
cmp bl, byte [esi + eax]
jne 0x402f17
inc esi
jmp 0x402f19
xor esi, esi
cmp esi, 0x80
jne 0x402ef5
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
mov dword [0x456e90], eax
je 0x402eeb
push str._Extractor__Found_tail_marker_n
call fcn.00409ab5
pop ecx
push edi
call fcn.00407c9a
pop ecx
pop edi
pop esi
pop ebx
leave
ret
push str.Tail
push str.Could_not_find_marker:__s_n
jmp 0x402ee4
Function at 0x404ad4
Capabilities:
Create thread

Disassembly:
push esi
xor esi, esi
cmp dword [0x448c34], esi
push esi
jne 0x404b32
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x448c38
push esi
push 0x448c34
push 0x404ba8
push esi
push esi
mov dword [0x448c3c], eax
call fcn.0041ba76
add esp, 0x18
push 0x1388
push dword [0x448c3c]
mov dword [0x448c34], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x404b42
push str.Error_starting_SplashThread_n
call fcn.00409ab5
pop ecx
pop esi
ret
push 2
push 6
push dword [0x448c38]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
pop esi
ret

Function at 0x404b44
Capabilities:
Terminate thread

Disassembly:
cmp dword [0x448c34], 0
je 0x404ba0
push 0
push 0
push 0x12
push dword [0x448c38]
call dword [sym.imp.USER32.dll_PostThreadMessageA]
push 0x2328
push dword [0x448c34]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x404b88
push 0x8ae
push dword [0x448c34]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
push dword [0x448c34]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [0x448c3c]
call esi
pop esi
and dword [0x448c34], 0
ret