joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a7e5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x1000a7f4
pop dword [ebp - 0x50]
mov eax, 0x1000a7f4
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x78a302d7
add dword [ebp - 0x60], 0xd5af4274
mov dword [ebp - 0x5c], 0x95677433
sub dword [ebp - 0x5c], 0x633427ee
mov dword [ebp - 0x58], 0xe32e3fa9
add dword [ebp - 0x58], 0x691e0485
mov dword [ebp - 0x54], 0xd6c488db
add dword [ebp - 0x54], 0x293b7725
lea eax, [ebp - 0x60]
push eax
mov eax, 0x58a56994
add eax, 0xb75b5690
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0xe0ba1d0d
add dword [ebp - 0x60], 0x93b84c49
mov dword [ebp - 0x5c], 0xd6de7da9
add dword [ebp - 0x5c], 0x6a8de3cc
mov dword [ebp - 0x58], 0x2c8b9a5e
add dword [ebp - 0x58], 0x36e3d20e
mov dword [ebp - 0x54], 0x674a54a
add dword [ebp - 0x54], 0xf98b5ab6
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x37ae4
push 0
call eax
mov ecx, 0xba68b719
sub ecx, 0xba687025
mov edi, eax
mov ebx, 0x10047400
add ebx, dword [ebp - 0x50]
mov esi, 0xeba53613
sub esi, 0x86d90a48
xor dword [ebp - 0x24], 0x398c68d8
mov edx, dword [ebx]
mov dword [ebp - 0x34], 0xa4c2ebf6
sub edx, esi
xor dword [ebp - 4], 0x4bcca74a
mov dword [edi], edx
xor dword [ebp - 0x48], 0xedeefc55
add edi, 4
add ebx, 0xeb28a005
add ebx, 0x14d75fff
loop 0x1000a906
add eax, 0x6ad449f5
sub eax, 0x6ad33b52
mov ebx, eax
add eax, 0x95352222
add eax, 0x6acadde3
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x40a340
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push esi
cmc
xor eax, dword [eax*4 - 0x7cee8a40]
ror dword [edi + ebx*4], 0xff
adc eax, 0x7fc02c
xor eax, eax
pop esi
jae 0x40a3c9
add al, 0
cmp eax, 1
xchg esp, eax
or al, 0x8b
inc ecx
or byte [eax - 0x33], dl
or dh, byte [eax]
rol byte [eax + 0x6c], 0xeb
jae 0xe3b5a66d
mov ecx, dword [ecx + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x40a358
jge 0x40a3ba
cwde
rol byte [eax], 0xff
salc
sal byte es:[ecx + ecx*8 - 1], 0x97
xchg edi, eax
nop
Function at 0x423110
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [0x4ae3f4]
mov edx, ecx
movss xmm1, dword [0x4ae3ec]
movss xmm3, dword [0x4a0124]
movd xmm2, eax
mov eax, dword [section..data]
cvtdq2ps xmm2, xmm2
movd xmm0, eax
cvtdq2ps xmm0, xmm0
subss xmm1, xmm0
subss xmm2, xmm1
movss xmm1, dword [0x4a3ee8]
cvttss2si eax, xmm2
mov dword [0x4ae3f4], eax
movss xmm0, dword [0x4ae3ec]
subss xmm0, xmm3
movss dword [0x4ae3ec], xmm0
mov dword [edx], 0
mov dword [edx + 4], 0
mov ax, word [0x4ae274]
movsx ecx, ax
mov eax, dword [0x4ae164]
add eax, 0x85b6f7
add eax, ecx
mov word [0x4ae274], ax
dec dword [0x4ae164]
mov dword [edx + 8], 0x67452301
movss xmm2, dword [0x4ae460]
movss xmm0, dword [0x4ae460]
subss xmm2, dword [0x4a3fc0]
subss xmm0, xmm3
comiss xmm1, xmm2
movss dword [0x4ae460], xmm0
jbe 0x4231e4
inc dword [0x4ae414]
mov eax, dword [0x4ae414]
sub eax, 0x749569b7
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [0x4ae0fc], xmm0
mov dword [edx + 0xc], 0xefcdab89
movsx eax, word [0x4ae020]
cmp eax, 0x5b2c6786
je 0x423276
movsx eax, word [0x4ae2a8]
movss xmm1, dword [0x4ae484]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
addss xmm1, xmm0
movss xmm0, dword [0x4ae2ac]
dec word [0x4ae2a8]
subss xmm1, dword [0x4a2220]
comiss xmm0, xmm1
jbe 0x423276
dec dword [0x4ae2e4]
movss xmm0, dword [0x4ae1ec]
addss xmm0, xmm3
movss dword [0x4ae1ec], xmm0
mov eax, dword [0x4ae2e4]
add eax, dword [0x4ae434]
movss xmm0, dword [0x4ae1ec]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
addss xmm0, xmm1
cvttss2si eax, xmm0
mov dword [0x4ae414], eax
inc dword [0x4ae434]
mov dword [edx + 0x10], 0x98badcfe
mov eax, dword [0x4ae1ac]
movsd xmm1, qword [0x4ae278]
add eax, 0x4141491a
movsd xmm0, qword [0x4ae448]
movd xmm2, eax
cvtdq2pd xmm2, xmm2
subsd xmm2, xmm0
subsd xmm1, xmm2
movsd qword [0x4ae278], xmm1
movsd xmm0, qword [0x4ae448]
subsd xmm0, qword [0x4a0128]
movsd qword [0x4ae448], xmm0
inc dword [0x4ae1ac]
mov dword [edx + 0x14], 0x10325476
movzx eax, word [0x4ae330]
sub eax, 0x211e519d
mov word [0x4ae330], ax
ret

Function at 0x425510
Capabilities:
Terminate process

Disassembly:
movsx eax, word [0x4ae350]
dec word [0x4ae350]
sub eax, 0x525789f9
cmp eax, 0x6fa960b7
jge 0x4255a3
movsd xmm0, qword [0x4ae100]
subsd xmm0, qword [0x4a0128]
movsd qword [0x4ae100], xmm0
movsd xmm1, qword [0x4ae188]
movsd xmm0, qword [0x4ae100]
movsx eax, word [0x4ae118]
addsd xmm1, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
subsd xmm1, xmm0
movss xmm0, dword [0x4ae294]
cvtps2pd xmm0, xmm0
mulsd xmm0, xmm1
cvtpd2ps xmm0, xmm0
movss dword [0x4ae294], xmm0
dec word [0x4ae118]
movsd xmm0, qword [0x4ae188]
subsd xmm0, qword [0x4a0128]
movsd qword [0x4ae188], xmm0
push dword [0x4af408]
call fcn.0042c560
movss xmm0, dword [0x4ae1c4]
add esp, 4
mov eax, dword [0x4ae4ec]
cvtps2pd xmm2, xmm0
push 1
movsd xmm0, qword [0x4ae3d8]
movd xmm1, eax
cvtdq2pd xmm1, xmm1
subsd xmm1, xmm0
subsd xmm2, xmm1
cvtpd2ps xmm0, xmm2
movss dword [0x4ae1c4], xmm0
call fcn.004576c2
int3
Function at 0x4872e6
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004870da

Function at 0x489544
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00488d1e

Function at 0x48954f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00488f59

Function at 0x493244
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00492e49

Function at 0x49324f
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00492fca
Function at 0x414f04
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x57c
mov dword [esp], 0x10001
push esp
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov eax, dword [esp + 8]
cmp eax, 0x3ff
jae 0x414f27
adc ch, al
sbb byte [eax], al
add byte [eax], al
call 0x414f44
test eax, eax
je 0x414f3a
jmp eax
leave
push 0x42
jmp dword ss:[sym.imp.KERNEL32.dll_RaiseException]
Function at 0x4030bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x4030ca
pop dword [ebp - 0x10]
mov eax, 0x7531b3f
sub eax, 0x712ea75
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x61deeb46
add dword [ebp - 0x20], 0xec735a05
mov dword [ebp - 0x1c], 0x930882db
add dword [ebp - 0x1c], 0x9f2ac96a
mov dword [ebp - 0x18], 0x858c474d
add dword [ebp - 0x18], 0xc6bffce1
mov dword [ebp - 0x14], 0x3010d549
add dword [ebp - 0x14], 0xcfef2ab7
lea eax, [ebp - 0x20]
push eax
mov eax, 0x1480a59c
sub eax, 0x14402498
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xbf061fd8
add dword [ebp - 0x20], 0xb56c497e
mov dword [ebp - 0x1c], 0x19b936dc
sub dword [ebp - 0x1c], 0xd84cd567
mov dword [ebp - 0x18], 0x767b6263
sub dword [ebp - 0x18], 0x130bf5f7
mov dword [ebp - 0x14], 0xa29be108
sub dword [ebp - 0x14], 0xa29be108
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x73b8041e
sub eax, 0x7377831e
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x38820
push 0
call eax
mov ecx, 0xcf47319a
add ecx, 0x30b91c7b
xor esi, esi
add esi, eax
mov edx, 0x450400
add edx, dword [ebp - 0x10]
mov edi, 0x77499455
sub edi, 0x2d664edf
mov ebx, dword [edx]
sub dword [ebp - 0xc], 0xf32c2080
xor ebx, edi
xor dword [ebp - 0xc], 0xe2aa7237
mov dword [esi], ebx
mov dword [ebp - 8], 0x2236d699
add esi, 0x1a400b9e
sub esi, 0x1a400b9a
add edx, 0x65e601e5
sub edx, 0x65e601e1
loop 0x4031e8
add eax, 0xce7f3cbb
add eax, 0x3181ee6c
mov ebx, eax
add eax, 0xfae2cfc
sub eax, 0xfae2cf7
mov ecx, 0x400000
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x405e13
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, 0x4308e8
push 0x40a574
push ebx
call dword [sym.imp.kernel32.dll_lstrcpyW]
mov esi, dword [esp + 0x18]
mov ebp, dword [sym.imp.kernel32.dll_GetShortPathNameW]
test esi, esi
mov edi, 0x400
je 0x405e61
push 1
push 0
push esi
call fcn.00405cb9
push eax
call dword [sym.imp.kernel32.dll_CloseHandle]
push edi
push ebx
push esi
call ebp
test eax, eax
je 0x405f80
cmp eax, edi
jg 0x405f80
mov esi, 0x4310e8
push edi
push esi
push dword [esp + 0x1c]
call ebp
test eax, eax
je 0x405f80
cmp eax, edi
jg 0x405f80
push esi
push ebx
push str._ls_ls_r_n
push 0x4304e8
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x434ef0]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.004030bb
push 4
push 0xc0000000
push esi
call fcn.00405cb9
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x405f80
push 0
push ebp
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405f79
push edi
push esi
push ebp
call fcn.004030bb
test eax, eax
je 0x405f79
push str._Rename__r_n
push esi
call fcn.004030bb
test eax, eax
jne 0x405f17
lea eax, [esi + edi]
push str._Rename__r_n
push eax
call dword [sym.imp.kernel32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405f4c
add eax, 0xa
push 0x40a558
push eax
call fcn.004030bb
mov ebp, eax
test ebp, ebp
je 0x405f48
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405f39
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405f33
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x405f4e
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
add eax, esi
push 0x4304e8
push eax
call fcn.00405c74
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.kernel32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.004030bb
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
push ebp
call dword [sym.imp.kernel32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x405f85
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_MoveFileExW]
test eax, eax
jne 0x405fa8
push dword [esp + 8]
push dword [esp + 8]
call fcn.00405e13
pop ecx
pop ecx
inc dword [0x434f70]
ret 8

Function at 0x40656f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4318ec], 0
push esi
jne 0x4065a6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406580
mov dword [ecx*4 + 0x4318e8], eax
inc ecx
cmp ecx, 0x100
jl 0x40657b
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4065d7
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4318e8]
xor eax, esi
inc ecx
dec edx
jne 0x4065b9
pop edi
not eax
pop esi
ret 0xc
Function at 0x409350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x40935f
pop dword [ebp - 0x28]
mov eax, 0xd3a93173
sub eax, 0xd3689e14
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x8e5df
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x44be
xor esi, esi
add esi, eax
mov edx, 0x3518bbe2
add edx, 0xcb43e81e
add edx, dword [ebp - 0x28]
mov ebx, 0xf3c95eea
xor dword [ebp - 0xc], ecx
mov edi, dword [edx]
add dword [ebp - 0x1c], ecx
xor edi, ebx
sub dword [ebp - 0x14], ecx
mov dword [esi], edi
xor dword [ebp - 0x18], ecx
add esi, 0x8bd7d247
sub esi, 0x8bd7d243
add edx, 0xcec42e80
add edx, 0x313bd184
loop 0x4093af
add eax, 0x5f34044c
add eax, 0xa0cd017f
mov ebx, eax
add eax, 5
mov ecx, 0x6580e46a
add ecx, 0x9abf1b96
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x4cb795
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x549689
call fcn.00528c47
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call main
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x552bc8
call main
cmp eax, 0xffffffff
jne 0x4cb849
push 0
push 0x55a858
lea ecx, [ebp - 0x4d0]
call main
cmp eax, 0xffffffff
jne 0x4cb849
push 0
push 0x554a24
lea ecx, [ebp - 0x4d0]
call main
cmp eax, 0xffffffff
jne 0x4cb849
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call main
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.kernel32.dll_SearchPathW]
test eax, eax
jne 0x4cb825
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00401fd0
jmp 0x4cb878
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call main
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00401fd0
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4cb86f
mov ebx, dword [ebp - 0x4cc]
jmp 0x4cb878
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00401fd0
mov eax, ebx
call fcn.00528bf6
ret
Function at 0x401040
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.3.1
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.0040a0e0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401094
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00401e60
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.00412c43
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010c8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.00401e40
add esp, 0xc
jmp 0x4011ee
push 0x2000
call fcn.00412c43
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010fa
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.00401e40
add esp, 0xc
jmp 0x4011ee
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401129
ja 0x401122
cmp eax, 0x2000
jbe 0x401129
mov esi, 0x2000
jmp 0x40112b
mov esi, eax
push dword [esp + 0x5c]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040e092
add esp, 0x10
cmp eax, esi
jne 0x4011e9
push dword [esp + 0x5c]
call fcn.0040de8d
add esp, 4
test eax, eax
jne 0x4011e9
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
nop
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00408780
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x40119e.1
movzx ecx, byte [ecx + 0x401274]
jmp dword [ecx*4 + 0x401268]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401212
push ebp
push esi
push 1
push ebx
call fcn.0040e7b5
add esp, 0x10
cmp eax, esi
jne 0x4011d0
push ebp
call fcn.0040de8d
add esp, 4
test eax, eax
je 0x401223
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00401e60
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.00409ed0
push dword [esp + 0x14]
call fcn.00412c28
push ebx
call fcn.00412c28
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401227
push esi
push ebx
push edi
call fcn.0040b560
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401170
cmp eax, 1
je 0x401261
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401245
cmp dword [esp + 0x10], ecx
jbe 0x4011d3
mov eax, dword [esp + 0x10]
jmp 0x401115
mov eax, 0xfffffffd
jmp 0x4011d3
cmp eax, 1
jne 0x4011d3
xor esi, esi
jmp 0x4011ec
Function at 0x401280
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x101c
call fcn.0040a900
mov eax, dword [0x436014]
xor eax, esp
mov dword [esp + 0x1018], eax
push ebx
mov ebx, dword [esp + 0x1028]
push ebp
push esi
mov esi, dword [esp + 0x102c]
push edi
push 0x428520
mov dword [esp + 0x20], esi
lea eax, [esi + 0x68]
mov dword [esp + 0x24], 0xffffffff
push eax
call fcn.00402fc0
mov ebp, eax
add esp, 8
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x4012e4
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00401e60
jmp 0x401460
mov ecx, dword [ebx + 4]
xor eax, eax
add ecx, dword [esi]
push 0
adc eax, dword [esi + 4]
push eax
push ecx
push ebp
call fcn.0040e4b6
add esp, 0x10
test eax, eax
jns 0x401320
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00401e40
push ebp
call fcn.0040de31
add esp, 0x10
jmp 0x401463
push dword [ebx + 0xc]
call fcn.00412c43
add esp, 4
mov dword [esp + 0x14], eax
mov edi, eax
mov dword [esp + 0x24], edi
test eax, eax
jne 0x40135d
push dword [ebx + 0xc]
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00401e40
push ebp
call fcn.0040de31
add esp, 0x14
jmp 0x401465
cmp byte [ebx + 0x10], 1
jne 0x40137e
push eax
push 0
push ebx
push ebp
call fcn.00401040
add esp, 0x10
test eax, eax
jne 0x401451
mov dword [esp + 0x14], edi
jmp 0x4013e1
mov edi, dword [ebx + 0xc]
xor ebp, ebp
mov dword [esp + 0x18], eax
test edi, edi
je 0x4013d9
nop dword [eax + eax]
test ebp, ebp
jb 0x4013a5
ja 0x40139e
cmp edi, 0x2000
jbe 0x4013a5
mov esi, 0x2000
jmp 0x4013a7
mov esi, edi
push dword [esp + 0x10]
push 1
push esi
push eax
call fcn.0040e092
add esp, 0x10
cmp eax, 1
jb 0x401437
mov eax, dword [esp + 0x18]
sub edi, esi
sbb ebp, 0
add eax, esi
mov dword [esp + 0x18], eax
test ebp, ebp
ja 0x40139e
jb 0x4013d5
test edi, edi
jne 0x401390
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
push ebp
add ebx, 0x12
call fcn.0040de31
add esi, 0x3068
push ebx
push esi
call fcn.004067f0
add esp, 0xc
test eax, eax
js 0x401465
push ebx
push 0x5c
push esi
push str._s_c_s
lea eax, [esp + 0x38]
push 0x1000
push eax
call fcn.00401db0
add esp, 0x18
cmp eax, 0x1000
jge 0x401465
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x18]
call fcn.00403130
add esp, 8
mov dword [esp + 0x20], eax
jmp 0x401465
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00401e40
mov ebp, dword [esp + 0x1c]
add esp, 0xc
push dword [esp + 0x14]
call fcn.00412c28
push ebp
call fcn.0040de31
add esp, 8
xor edi, edi
push edi
call fcn.00412c28
mov ecx, dword [esp + 0x102c]
add esp, 4
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040a8e7
add esp, 0x101c
ret
Function at 0x401510
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 0x428520
xor edi, edi
lea eax, [esi + 0x68]
push eax
call fcn.00402fc0
mov ebp, eax
add esp, 8
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x401555
mov eax, dword [esp + 0x1c]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00401e60
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x20]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [esi]
adc eax, dword [esi + 4]
push eax
push ecx
push ebp
call fcn.0040e4b6
add esp, 0x10
test eax, eax
jns 0x40158d
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00401e40
add esp, 0xc
jmp 0x4015bd
push dword [ebx + 0xc]
call fcn.00412c43
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4015d3
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00401e40
add esp, 0x10
mov edi, dword [esp + 0x10]
push dword [esp + 0x14]
call fcn.0040de31
add esp, 4
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
cmp byte [ebx + 0x10], 1
jne 0x4015fb
push eax
push 0
push ebx
push ebp
call fcn.00401040
add esp, 0x10
test eax, eax
je 0x4015b9
mov edi, dword [esp + 0x10]
push edi
call fcn.00412c28
add esp, 4
xor edi, edi
jmp 0x4015bd
mov esi, dword [ebx + 0xc]
mov ebp, eax
xor ebx, ebx
test esi, esi
je 0x40167a
test ebx, ebx
jb 0x40161b
ja 0x401614
cmp esi, 0x2000
jbe 0x40161b
mov edi, 0x2000
jmp 0x40161d
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push ebp
call fcn.0040e092
add esp, 0x10
cmp eax, 1
jb 0x40164c
sub esi, edi
sbb ebx, 0
add ebp, edi
test ebx, ebx
ja 0x401614
jb 0x4015b9
test esi, esi
jne 0x401606
jmp 0x4015b9
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00401e40
mov edi, dword [esp + 0x1c]
add esp, 0xc
push edi
call fcn.00412c28
add esp, 4
xor edi, edi
jmp 0x4015bd
mov edi, eax
jmp 0x4015bd