joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488c10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffed8
mov ebx, ecx
mov edi, edx
mov esi, eax
call sub.user32.dll_GetMessagePos
call fcn.0040a380
mov dword [esp + 8], eax
movsx eax, word [esp + 8]
mov dword [esp + 0xc], eax
movsx eax, word [esp + 0xa]
mov dword [esp + 0x10], eax
mov ecx, esp
lea edx, [esp + 0xc]
mov eax, esi
call fcn.00482c48
test ebx, ebx
jne 0x488c63
push 0
push 0
lea edx, [esp + 8]
xor ecx, ecx
mov eax, esi
call fcn.00488a8c
mov ebx, eax
test ebx, ebx
je 0x488d59
cmp esi, ebx
je 0x488c8c
mov eax, dword [esp]
sub eax, dword [ebx + 0x40]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
sub eax, dword [ebx + 0x44]
mov dword [esp + 0x118], eax
jmp 0x488ca1
mov eax, dword [esp]
mov dword [esp + 0x114], eax
mov eax, dword [esp + 4]
mov dword [esp + 0x118], eax
movzx eax, word [edi + 8]
mov dword [esp + 0x11c], eax
mov eax, dword [edi + 4]
mov dword [esp + 0x124], eax
movzx eax, word [edi + 0xa]
cmp eax, 0x201
jge 0x488cd9
add eax, 0xffffff5f
sub eax, 2
jb 0x488cf1
dec eax
sub eax, 2
jb 0x488d05
dec eax
sub eax, 2
jb 0x488cfb
jmp 0x488d0f
add eax, 0xfffffdff
sub eax, 2
jb 0x488cf1
dec eax
sub eax, 2
jb 0x488d05
dec eax
sub eax, 2
jb 0x488cfb
jmp 0x488d0f
mov byte [esp + 0x120], 0
jmp 0x488d17
mov byte [esp + 0x120], 2
jmp 0x488d17
mov byte [esp + 0x120], 1
jmp 0x488d17
mov byte [esp + 0x120], 0
lea eax, [esp + 0x14]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [esp + 0x14]
call fcn.004a6b94
mov esi, eax
call fcn.0047f484
or si, ax
mov word [esp + 0x121], si
lea eax, [esp + 0x114]
push eax
xor ecx, ecx
mov edx, 0xb04b
mov eax, ebx
call fcn.00484608
mov dword [edi + 0xc], eax
mov al, 1
jmp 0x488d5b
xor eax, eax
add esp, 0x128
pop edi
pop esi
pop ebx
ret

Function at 0x4a669c
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
push ecx
mov byte [esp], cl
mov ebx, edx
mov esi, eax
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
mov edi, eax
test bl, bl
je 0x4a66bd
test edi, 0x40000
je 0x4a66d7
test bl, bl
jne 0x4a6758
mov eax, edi
and eax, 0x40000
cmp eax, 0x40000
jne 0x4a6758
push esi
call sub.user32.dll_IsIconic
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 2], al
push esi
call sub.user32.dll_IsWindowVisible
cmp eax, 1
sbb eax, eax
inc eax
mov byte [esp + 1], al
movzx eax, byte [esp + 1]
or al, byte [esp + 2]
je 0x4a670a
push 0
push esi
call sub.user32.dll_ShowWindow
test bl, bl
je 0x4a671f
or edi, 0x40000
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
jmp 0x4a672e
and edi, 0xfffbffff
push edi
push 0xffffffffffffffec
push esi
call sub.user32.dll_SetWindowLongW
movzx eax, byte [esp]
and al, byte [esp + 1]
jne 0x4a673f
cmp byte [esp + 2], 0
je 0x4a6758
cmp byte [esp + 2], 0
je 0x4a6750
push 6
push esi
call sub.user32.dll_ShowWindow
jmp 0x4a6758
push 5
push esi
call sub.user32.dll_ShowWindow
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x4a6a04
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
call sub.user32.dll_GetActiveWindow
mov dword [esp], eax
mov byte [esp + 4], 0
test bl, bl
je 0x4a6a2a
mov eax, esp
push eax
push 0x4a69cc
call sub.user32.dll_EnumWindows
jmp 0x4a6a3d
mov eax, esp
push eax
push 0x4a69ac
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_EnumThreadWindows
movzx eax, byte [esp + 4]
pop ecx
pop edx
pop ebx
ret

Function at 0x4a6b00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov ebx, eax
movzx esi, word [0x4a6b50]
test bl, 4
je 0x4a6b14
or si, 1
test bl, 8
je 0x4a6b1d
or si, 4
test bl, 1
je 0x4a6b26
or si, 8
test bl, 2
je 0x4a6b2f
or si, 0x10
test bl, 0x10
je 0x4a6b38
or si, 0x20
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4a6b48
or si, 2
mov eax, esi
pop esi
pop ebx
ret

Function at 0x4a6b54
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
movzx ebx, word [0x4a6b90]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4a6b6f
or bx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4a6b7f
or bx, 4
test esi, 0x20000000
je 0x4a6b8b
or bx, 2
mov eax, ebx
pop esi
pop ebx
ret
Function at 0x4afea0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc60
push ebx
xor edx, edx
mov dword [ebp - 0x3a0], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4afedd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x38], 0
jne 0x4afebe
mov dl, 1
mov eax, dword [0x42a358]
call fcn.004361a0
mov edx, dword [ebp - 4]
mov dword [edx + 0x38], eax
mov eax, dword [ebp - 4]
add eax, 0x3c
xor edx, edx
call fcn.00406844
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4afead
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00492458
test al, al
je 0x4afea0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x39c], eax
mov byte [ebp - 0x398], 0
lea ecx, [ebp - 0x39c]
mov edx, 0x4afeec
lea eax, [ebp - 0x394]
call fcn.00413124
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW_1
test eax, eax
jne 0x4afea0
xor eax, eax
push ebp
push 0x4afe99
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0x200
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x314]
push eax
push 0
push 0
push 0x4aff5c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExW_1
test eax, eax
jne 0x4afe82
lea eax, [ebp - 0x3a0]
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406a2c
mov edx, dword [ebp - 0x3a0]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x40]
jne 0x4afe82
mov eax, dword [ebp - 4]
add eax, 0x3c
lea edx, [ebp - 0x314]
mov ecx, pe_nt_image_headers32
call fcn.00406a2c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afea0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4afda3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x38]
mov byte [eax + 0x29], 0
mov dl, 1
call fcn.004360dc
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x38]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4afee4
lea eax, [ebp - 0x3a0]
call fcn.00406834
ret

Function at 0x4b0a3c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x4cc280]
cmp byte [eax + 0xad], 0
jne 0x4b0aae
cmp dword [0x4cc298], 0
jne 0x4b0a6e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, dword [0x4c6048]
push eax
push 3
call sub.user32.dll_SetWindowsHookExW
mov dword [0x4cc298], eax
cmp dword [0x4cc294], 0
jne 0x4b0a89
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov dword [0x4cc294], eax
cmp dword [0x4cc29c], 0
jne 0x4b0aae
push esp
push 0
push 0
mov eax, dword [0x4c6044]
push eax
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x4cc29c], eax
pop edx
ret
Function at 0x4b1474
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [ebx + 0x170]
test eax, eax
je 0x4b1516
cmp dword [ebx + 0x94], 0
jne 0x4b1510
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4b13c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4b1510
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongW
test al, 8
je 0x4b14d6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4b1510
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00432b64
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4b14e5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4b1734
Capabilities:
Enumerate gui resources
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
mov eax, dword [0x4cc280]
cmp dword [eax + 0x170], 0
je 0x4b1899
test bl, bl
jne 0x4b17e7
cmp dword [esi + 0x9c], 0
jne 0x4b17dc
mov eax, esi
call fcn.004b4624
push eax
push 0x4b1640
call sub.user32.dll_EnumWindows
cmp dword [esi + 0x44], 0
je 0x4b17ad
mov eax, dword [0x4cc280]
cmp byte [eax + 0xd3], 0
je 0x4b17ad
mov eax, dword [esi + 0xd8]
call fcn.00407e50
mov edi, eax
cmp edi, 0
jl 0x4b17ad
push 0
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b1796
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b17dc
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00432b64
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b17bc
inc dword [esi + 0x9c]
jmp 0x4b1899
cmp dword [esi + 0x9c], 0
jle 0x4b1899
dec dword [esi + 0x9c]
cmp dword [esi + 0x9c], 0
jne 0x4b1899
cmp dword [esi + 0x44], 0
je 0x4b1844
mov eax, dword [0x4cc280]
cmp byte [eax + 0xd3], 0
je 0x4b1844
mov eax, dword [esi + 0xd8]
call fcn.00407e50
mov edi, eax
cmp edi, 0
jl 0x4b1844
push 5
mov eax, dword [esi + 0xd8]
mov eax, dword [eax + edi*4]
push eax
call sub.user32.dll_ShowWindow
dec edi
cmp edi, 0xffffffff
jne 0x4b182d
mov eax, dword [esi + 0x98]
mov edi, dword [eax + 8]
dec edi
cmp edi, 0
jl 0x4b1873
cmp bl, 1
cmc
sbb eax, eax
push eax
mov edx, edi
mov eax, dword [esi + 0x98]
call fcn.00432b64
push eax
call sub.user32.dll_ShowOwnedPopups
dec edi
cmp edi, 0xffffffff
jne 0x4b1853
mov eax, dword [esi + 0x98]
mov edx, dword [eax]
call dword [edx + 8]
push 0
lea eax, [esi + 0xd8]
mov ecx, 1
mov edx, dword [0x4a49bc]
call fcn.00408010
add esp, 4
pop edi
pop esi
pop ebx
ret
Function at 0x4b24e8
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xfffffdfc
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xac], 0
je 0x4b2553
cmp byte [ebx + 0xd3], 0
jne 0x4b2553
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x170]
push eax
call sub.user32.dll_GetWindowTextW
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00406980
mov eax, dword [esi]
mov dword [esp + 0x200], eax
mov eax, dword [esp + 0x200]
test eax, eax
je 0x4b2540
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x4b2560
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406844
jmp 0x4b2560
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00406844
add esp, 0x204
pop esi
pop ebx
ret

Function at 0x4b3d88
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x4b3df6
mov eax, esi
call fcn.0048c410
test al, al
je 0x4b3df6
mov eax, dword [ebx + 0x84]
call fcn.0048c064
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x4b3df6
mov eax, dword [ebx + 0x84]
mov edx, dword [eax]
call dword [edx + 0xfc]
test al, al
je 0x4b3dea
push 0
mov eax, dword [ebx + 0x84]
call fcn.0048c064
push eax
call sub.user32.dll_ShowWindow
xor edx, edx
mov eax, dword [ebx + 0x84]
call fcn.00483038
jmp 0x4b3df6
mov cl, 1
mov edx, dword [ebx + 0x74]
mov eax, ebx
call fcn.004b3bc0
pop esi
pop ebx
ret
Function at 0x401040
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
push edi
push 0x4275c0
push esi
mov dword [esp + 0x1c], 0xffffffff
call fcn.00404070
mov edi, eax
add esp, 8
mov dword [esp + 0x10], edi
test edi, edi
jne 0x401095
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402470
add esp, 8
push ebp
call fcn.00412f7e
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
push ebx
mov ebx, dword [esp + 0x24]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [esi + 0x1000]
adc eax, dword [esi + 0x1004]
push eax
push ecx
push edi
call fcn.0040f206
add esp, 0x10
test eax, eax
jns 0x4010e0
call fcn.00412f60
mov ecx, eax
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push dword [ecx]
push str.fseek
call fcn.004025f0
add esp, 0x10
jmp 0x4011c2
push dword [ebx + 0xc]
call fcn.00412f99
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x401119
mov esi, dword [ebx + 0xc]
call fcn.00412f60
mov ecx, eax
lea eax, [ebx + 0x12]
push esi
push eax
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push dword [ecx]
push str.malloc
call fcn.004025f0
add esp, 0x14
jmp 0x4011c2
cmp byte [ebx + 0x10], 1
jne 0x401131
push ebp
push 0
push ebx
push edi
call fcn.00401200
add esp, 0x10
jmp 0x4011b3
mov esi, dword [ebx + 0xc]
xor ebx, ebx
mov dword [esp + 0x10], eax
test esi, esi
je 0x401185
nop
test ebx, ebx
jb 0x401155
ja 0x40114e
cmp esi, 0x2000
jbe 0x401155
mov edi, 0x2000
jmp 0x401157
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push eax
call fcn.0040ede2
add esp, 0x10
cmp eax, 1
jb 0x401189
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
add eax, edi
mov dword [esp + 0x10], eax
test ebx, ebx
ja 0x40114e
jb 0x401185
test esi, esi
jne 0x401140
xor eax, eax
jmp 0x4011af
call fcn.00412f60
mov ecx, eax
mov eax, dword [esp + 0x24]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push dword [ecx]
push str.fread
call fcn.004025f0
add esp, 0x10
or eax, 0xffffffff
mov edi, dword [esp + 0x14]
test eax, eax
je 0x4011c2
push ebp
call fcn.00412f7e
add esp, 4
xor ebp, ebp
push edi
call fcn.0040eb81
add esp, 4
pop ebx
test ebp, ebp
je 0x4011e1
push dword [esp + 0x24]
push ebp
call fcn.00404180
add esp, 8
mov dword [esp + 0x14], eax
push ebp
call fcn.00412f7e
mov eax, dword [esp + 0x18]
add esp, 4
pop edi
pop esi
pop ebp
add esp, 0xc
ret
Function at 0x401200
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.3.1
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.0040acb0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401254
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00402470
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.00412f99
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x401291
call fcn.00412f60
mov ecx, eax
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push dword [ecx]
push str.malloc
call fcn.004025f0
add esp, 0x10
jmp 0x4013be
push 0x2000
call fcn.00412f99
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4012ca
call fcn.00412f60
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push dword [eax]
push str.malloc
call fcn.004025f0
add esp, 0x10
jmp 0x4013be
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x4012f9
ja 0x4012f2
cmp eax, 0x2000
jbe 0x4012f9
mov esi, 0x2000
jmp 0x4012fb
mov esi, eax
push dword [esp + 0x5c]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040ede2
add esp, 0x10
cmp eax, esi
jne 0x4013b9
push dword [esp + 0x5c]
call fcn.0040ebdd
add esp, 4
test eax, eax
jne 0x4013b9
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
nop
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.004091c0
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x40136e.1
movzx ecx, byte [ecx + 0x401444]
jmp dword [ecx*4 + 0x401438]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x4013e2
push ebp
push esi
push 1
push ebx
call fcn.0040f505
add esp, 0x10
cmp eax, esi
jne 0x4013a0
push ebp
call fcn.0040ebdd
add esp, 4
test eax, eax
je 0x4013f3
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00402470
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.0040aaa0
push dword [esp + 0x14]
call fcn.00412f7e
push ebx
call fcn.00412f7e
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x4013f7
push esi
push ebx
push edi
call fcn.0040c2c0
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401340
cmp eax, 1
je 0x401431
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401415
cmp dword [esp + 0x10], ecx
jbe 0x4013a3
mov eax, dword [esp + 0x10]
jmp 0x4012e5
mov eax, 0xfffffffd
jmp 0x4013a3
cmp eax, 1
jne 0x4013a3
xor esi, esi
jmp 0x4013bc
Function at 0x401450
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
xor ebp, ebp
push 0x4275c0
push esi
call fcn.00404070
mov ebx, eax
add esp, 8
mov dword [esp + 0xc], ebx
test ebx, ebx
jne 0x401492
mov eax, dword [esp + 0x1c]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402470
add esp, 8
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 8
ret
push edi
mov edi, dword [esp + 0x20]
xor eax, eax
push 0
mov ecx, dword [edi + 4]
add ecx, dword [esi + 0x1000]
adc eax, dword [esi + 0x1004]
push eax
push ecx
push ebx
call fcn.0040f206
add esp, 0x10
test eax, eax
jns 0x4014eb
call fcn.00412f60
mov ecx, eax
lea eax, [edi + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push dword [ecx]
push str.fseek
call fcn.004025f0
add esp, 0x10
push ebx
call fcn.0040eb81
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
push dword [edi + 0xc]
call fcn.00412f99
mov ebp, eax
add esp, 4
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x401534
mov esi, dword [edi + 0xc]
call fcn.00412f60
push esi
lea ecx, [edi + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push dword [eax]
push str.malloc
call fcn.004025f0
add esp, 0x14
push ebx
call fcn.0040eb81
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp byte [edi + 0x10], 1
jne 0x401549
push ebp
push 0
push edi
push ebx
call fcn.00401200
add esp, 0x10
jmp 0x4015bf
mov esi, dword [edi + 0xc]
xor ebx, ebx
test esi, esi
je 0x40158f
test ebx, ebx
jb 0x401567
ja 0x401560
cmp esi, 0x2000
jbe 0x401567
mov edi, 0x2000
jmp 0x401569
mov edi, esi
push dword [esp + 0x10]
push 1
push edi
push ebp
call fcn.0040ede2
add esp, 0x10
cmp eax, 1
jb 0x401593
sub esi, edi
sbb ebx, 0
add ebp, edi
test ebx, ebx
ja 0x401560
jb 0x40158f
test esi, esi
jne 0x401552
xor eax, eax
jmp 0x4015b7
call fcn.00412f60
mov ecx, dword [esp + 0x20]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push dword [eax]
push str.fread
call fcn.004025f0
add esp, 0x10
or eax, 0xffffffff
mov ebx, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
test eax, eax
je 0x4015ce
push ebp
call fcn.00412f7e
add esp, 4
xor ebp, ebp
push ebx
call fcn.0040eb81
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4015f0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [esp + 0x18]
push esi
cmp byte [ebx + 0x11], 0x6e
jne 0x40162f
push dword [esp + 0x20]
push ebx
push dword [esp + 0x20]
call fcn.00401040
mov esi, eax
add esp, 0xc
test esi, esi
jns 0x401627
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_create_symbolic_link__s__n
call fcn.00402470
add esp, 8
mov eax, esi
pop esi
pop ebx
add esp, 0xc
ret
push edi
push 0x4276a8
push dword [esp + 0x28]
call fcn.00404070
mov edi, eax
add esp, 8
mov dword [esp + 0x14], edi
test edi, edi
jne 0x401672
call fcn.00412f60
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_open_target_file__n
push dword [eax]
push str.fopen
call fcn.004025f0
add esp, 0x10
or eax, 0xffffffff
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov esi, dword [esp + 0x1c]
push ebp
push 0x4275c0
push esi
call fcn.00404070
mov ebp, eax
add esp, 8
mov dword [esp + 0x14], ebp
test ebp, ebp
jne 0x4016a8
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402470
add esp, 8
or edi, 0xffffffff
jmp 0x4017fc
mov ecx, dword [ebx + 4]
xor eax, eax
add ecx, dword [esi + 0x1000]
push 0
adc eax, dword [esi + 0x1004]
push eax
push ecx
push ebp
call fcn.0040f206
add esp, 0x10
test eax, eax
jns 0x4016ef
call fcn.00412f60
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push dword [eax]
push str.fseek
call fcn.004025f0
add esp, 0x10
or edi, 0xffffffff
jmp 0x4017f3
cmp byte [ebx + 0x10], 1
jne 0x401709
push 0
push edi
push ebx
push ebp
call fcn.00401200
add esp, 0x10
mov edi, eax
jmp 0x4017f3
push 0x2000
xor edi, edi
call fcn.00412f99
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x401745
call fcn.00412f60
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
push dword [eax]
push str.malloc
call fcn.004025f0
add esp, 0x10
or edi, 0xffffffff
jmp 0x4017f3
mov esi, dword [ebx + 0xc]
xor ebp, ebp
test esi, esi
je 0x4017e6
test ebp, ebp
jb 0x401767
ja 0x401760
cmp esi, 0x2000
jbe 0x401767
mov edi, 0x2000
jmp 0x401769
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push eax
call fcn.0040ede2
add esp, 0x10
cmp eax, 1
jb 0x4017c2
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040f505
add esp, 0x10
cmp eax, 1
jb 0x4017ab
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebp, 0
jne 0x401752
jb 0x4017a7
test esi, esi
jne 0x401752
xor edi, edi
jmp 0x4017e2
call fcn.00412f60
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_write_data_chunk__n
push dword [eax]
push str.fwrite
jmp 0x4017d7
call fcn.00412f60
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push dword [eax]
push str.fread
call fcn.004025f0
add esp, 0x10
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.00412f7e
mov ebp, dword [esp + 0x18]
add esp, 4
push ebp
call fcn.0040eb81
add esp, 4
push dword [esp + 0x18]
call fcn.0040eb81
add esp, 4
mov eax, edi
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret