joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fbe70
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x531304]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0
mov byte [ebp - 0x118], 0
push 0x103
push 0
lea eax, [ebp - 0x117]
push eax
call fcn.00415fc0
add esp, 0xc
mov byte [ebp - 0x220], 0
push 0x103
push 0
lea ecx, [ebp - 0x21f]
push ecx
call fcn.00415fc0
add esp, 0xc
mov dword [ebp - 8], 0x104
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 4]
push ecx
push str.MachineIDEx
push str.SoftwareUCBrowserPID
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x4fbf59
lea edx, [ebp - 0x118]
push edx
call fcn.00415e20
add esp, 4
cmp eax, 5
jb 0x4fbf59
push str.Preferences
push 0x104
lea eax, [ebp - 0x220]
push eax
call fcn.004188fa
add esp, 0xc
lea ecx, [ebp - 0x118]
push ecx
push 0x104
lea edx, [ebp - 0x220]
push edx
call fcn.004189df
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x220]
push edx
call fcn.004fbd20
add esp, 0xc
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004158f4
mov esp, ebp
pop ebp
ret
Function at 0x500e10
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50cc42
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x531304]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x245], 0
mov dword [ebp - 0x244], 0
mov byte [ebp - 0x11c], 0
push 0x103
push 0
lea eax, [ebp - 0x11b]
push eax
call fcn.00415fc0
add esp, 0xc
lea ecx, [ebp - 0x240]
call fcn.004011e0
mov dword [ebp - 4], 0
cmp dword [0x55b9f4], 0
jne 0x500eb8
push 0x520860
call fcn.004e4170
add esp, 4
mov dword [ebp - 0x250], 0xfffffffc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00401260
mov eax, dword [ebp - 0x250]
jmp 0x5010ac
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f9c00
add esp, 4
mov dword [ebp - 0x24c], eax
mov edx, dword [ebp - 0x24c]
push edx
call fcn.00415e20
add esp, 4
test eax, eax
jne 0x500f04
mov dword [ebp - 0x254], 0xfffffffd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00401260
mov eax, dword [ebp - 0x254]
jmp 0x5010ac
push 0x520884
call fcn.004f49c0
add esp, 4
test eax, eax
je 0x500f22
push str.opera.exe
call fcn.004349e0
add esp, 4
mov eax, dword [ebp - 0x24c]
push eax
push str._DEBUGINFO__LOCK__SET_LockOpera_url___s_n
call fcn.004e4170
add esp, 8
push 0x104
push 0
lea ecx, [ebp - 0x11c]
push ecx
call fcn.00415fc0
add esp, 0xc
push 0
push 0x1a
lea edx, [ebp - 0x11c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea eax, [ebp - 0x11c]
push eax
lea ecx, [ebp - 0x240]
call fcn.004012a0
push str.Opera_SoftwareOpera_StableSecure_Preferences
lea ecx, [ebp - 0x240]
call fcn.0040bb70
lea ecx, [ebp - 0x240]
call fcn.004012e0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x500fb7
lea ecx, [ebp - 0x240]
call fcn.004012e0
push eax
push str._DEBUGINFO__LOCK__SET_LockOpera_path___s_n
call fcn.004e4170
add esp, 8
mov byte [ebp - 0x245], 1
movzx ecx, byte [ebp - 0x245]
test ecx, ecx
jne 0x500fe9
mov dword [ebp - 0x258], 0xffffffff
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00401260
mov eax, dword [ebp - 0x258]
jmp 0x5010ac
mov byte [ebp - 0x224], 0
push 0x103
push 0
lea edx, [ebp - 0x223]
push edx
call fcn.00415fc0
add esp, 0xc
lea ecx, [ebp - 0x240]
call fcn.004012e0
push eax
push 0x104
lea eax, [ebp - 0x224]
push eax
call fcn.004188fa
add esp, 0xc
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [ebp - 0x224]
push edx
call fcn.004f4b10
add esp, 4
test eax, eax
je 0x50106a
mov dword [ebp - 0x25c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00401260
mov eax, dword [ebp - 0x25c]
jmp 0x5010ac
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x240]
call fcn.004012e0
push eax
call fcn.004ffe50
add esp, 8
mov dword [ebp - 0x244], eax
mov ecx, dword [ebp - 0x244]
mov dword [ebp - 0x260], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x240]
call fcn.00401260
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004158f4
mov esp, ebp
pop ebp
ret 4
Function at 0x5048d0
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x50ce6f
mov eax, dword fs:[0]
push eax
sub esp, 0x23c
mov eax, dword [0x531304]
xor eax, ebp
mov dword [ebp - 0x20], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov byte [ebp - 0x239], 0
mov byte [ebp - 0x12c], 0
push 0x103
push 0
lea eax, [ebp - 0x12b]
push eax
call fcn.00415fc0
add esp, 0xc
mov dword [ebp - 0x238], 0
cmp dword [0x55b9f4], 0
jne 0x504949
push 0x5240e0
call fcn.004e4170
add esp, 4
mov eax, 0xfffffffc
jmp 0x504b48
mov ecx, dword [ebp + 8]
push ecx
call fcn.004f9c00
add esp, 4
mov dword [ebp - 0x240], eax
mov edx, dword [ebp - 0x240]
push edx
call fcn.00415e20
add esp, 4
test eax, eax
jne 0x504978
mov eax, 0xfffffffd
jmp 0x504b48
push 0x524104
call fcn.004f49c0
add esp, 4
test eax, eax
je 0x504996
push str.msedge.exe
call fcn.004349e0
add esp, 4
mov eax, dword [ebp - 0x240]
push eax
push 0x52411c
call fcn.004e4170
add esp, 8
push 0x104
push 0
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00415fc0
add esp, 0xc
push 0
push 0x1c
lea edx, [ebp - 0x12c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push str.MicrosoftEdgeUser_Data
push 0x104
lea eax, [ebp - 0x12c]
push eax
call fcn.004189df
add esp, 0xc
lea ecx, [ebp - 0x12c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x504a05
or eax, 0xffffffff
jmp 0x504b48
mov byte [ebp - 0x234], 0
push 0x103
push 0
lea edx, [ebp - 0x233]
push edx
call fcn.00415fc0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.00413270
mov dword [ebp - 4], 0
push 0x524164
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x12c]
push ecx
call fcn.00434ca0
add esp, 0xc
lea ecx, [ebp - 0x1c]
call fcn.004132c0
test eax, eax
jbe 0x504b18
mov dword [ebp - 0x244], 0
jmp 0x504a74
mov edx, dword [ebp - 0x244]
add edx, 1
mov dword [ebp - 0x244], edx
lea ecx, [ebp - 0x1c]
call fcn.004132c0
cmp dword [ebp - 0x244], eax
jae 0x504b18
mov eax, dword [ebp - 0x244]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00413300
push eax
call fcn.004f4b10
add esp, 4
test eax, eax
jne 0x504b13
push 0x104
push 0
lea ecx, [ebp - 0x234]
push ecx
call fcn.00415fc0
add esp, 0xc
mov edx, dword [ebp - 0x244]
push edx
lea ecx, [ebp - 0x1c]
call fcn.00413300
push eax
push 0x104
lea eax, [ebp - 0x234]
push eax
call fcn.004188fa
add esp, 0xc
push 0x524178
push 0x104
lea ecx, [ebp - 0x234]
push ecx
call fcn.004189df
add esp, 0xc
mov edx, dword [ebp - 0x240]
push edx
lea eax, [ebp - 0x234]
push eax
call fcn.00502af0
add esp, 8
mov dword [ebp - 0x238], eax
jmp 0x504a65
mov ecx, dword [ebp - 0x240]
push ecx
call fcn.00415c75
add esp, 4
mov edx, dword [ebp - 0x238]
mov dword [ebp - 0x248], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.004132a0
mov eax, dword [ebp - 0x248]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x20]
xor ecx, ebp
call fcn.004158f4
mov esp, ebp
pop ebp
ret 4
Function at 0x5079f0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x52dff0
push 0x41c9b0
mov eax, dword fs:[0]
push eax
add esp, 0xfffffff4
push ebx
push esi
push edi
mov eax, dword [0x531304]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.005067d0
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.005055b0
mov dword [ebp - 0x1c], eax
push 0x52592c
push 0x525938
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x507a6f
push str._DEBUGINFO__LOCK__SET_Lock360chrome_delete_reg__Software360ChromeXHomepageDefault__homepage_faild_n
call fcn.004e4170
add esp, 4
push 0x5259c8
push str.Software360ChromeXHomepageDefault
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
test eax, eax
je 0x507a95
push str._DEBUGINFO__LOCK__SET_Lock360chrome_delete_reg__Software360ChromeXHomepageDefault__urls_to_restore_on_startup_faild_n
call fcn.004e4170
add esp, 4
mov dword [ebp - 4], 0xfffffffe
jmp 0x507ab5
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x50f000
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
jmp 0x50f016
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x50f035
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x53f3e4]
mov dword [edx + ecx*4 + 0x88], eax
jmp 0x50f00d
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0
mov esp, ebp
pop ebp
ret
Function at 0x50fce0
Capabilities:
Get user security identifier

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x51e8c0]
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x14], ecx
mov edx, dword [0x51e8c0]
shl edx, 1
push edx
call fcn.00415d52
add esp, 4
mov dword [ebp - 4], eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x50fd97
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x50fd97
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp + 0x10]
jbe 0x50fd54
mov ecx, dword [ebp - 4]
push ecx
call fcn.00415c75
add esp, 4
xor eax, eax
jmp 0x50fdac
mov edx, dword [ebp - 8]
cmp edx, dword [0x51e8c0]
jbe 0x50fd74
mov eax, dword [ebp - 8]
shl eax, 1
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00418eb1
add esp, 8
mov dword [ebp - 4], eax
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov dword [ebp - 0x10], eax
mov edx, dword [ebp - 4]
push edx
call fcn.00415c75
add esp, 4
xor eax, eax
cmp dword [ebp - 0x10], 0
setne al
mov esp, ebp
pop ebp
ret

Function at 0x50fdb0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x531304]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 0
cmp dword [ebp + 8], 0
jne 0x50fdd4
xor eax, eax
jmp 0x50fe4f
mov eax, dword [ebp + 8]
mov dword [eax], 0
push 0x104
lea ecx, [ebp - 0x220]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x50fdf7
xor eax, eax
jmp 0x50fe4f
push 0x5403d8
lea edx, [ebp - 0x220]
push edx
call fcn.0041a21d
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x50fe1d
mov eax, dword [ebp - 4]
mov word [eax + 2], 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0
lea edx, [ebp - 0x220]
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x50fe42
xor eax, eax
jmp 0x50fe4f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, 1
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.004158f4
mov esp, ebp
pop ebp
ret
Function at 0x50fe60
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x531304]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x50fee8
lea eax, [ebp - 0x428]
mov dword [ebp - 0x42c], eax
push 0x400
mov ecx, dword [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0050fce0
add esp, 0xc
test eax, eax
je 0x50fee8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x42c]
push ecx
call fcn.0050fa80
add esp, 8
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004158f4
mov esp, ebp
pop ebp
ret

Function at 0x50ff00
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x531304]
xor eax, ebp
mov dword [ebp - 8], eax
mov word [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x26], eax
mov dword [ebp - 0x22], eax
mov dword [ebp - 0x1e], eax
mov dword [ebp - 0x1a], eax
mov dword [ebp - 0x16], eax
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov word [ebp - 0xa], ax
mov dword [ebp - 4], 0x10
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x50ff88
lea eax, [ebp - 0x428]
mov dword [ebp - 0x42c], eax
push 0x400
mov ecx, dword [ebp - 0x42c]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.0050fce0
add esp, 0xc
test eax, eax
je 0x50ff88
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x42c]
push ecx
call fcn.0050fbb0
add esp, 8
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
mov eax, dword [ebp + 0xc]
push eax
call fcn.0050fdb0
add esp, 4
test eax, eax
jne 0x50ffaa
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004158f4
mov esp, ebp
pop ebp
ret
Function at 0x510230
Capabilities:
Authenticate hmac

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x531304]
xor eax, ebp
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x10], 0x40
jne 0x510255
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], 0x40
jmp 0x5102cd
cmp dword [ebp + 0x10], 0x40
jbe 0x51027e
mov dword [ebp - 0xc], 0x20
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.0050f6a0
add esp, 0xc
lea ecx, [ebp - 0x34]
mov dword [ebp - 4], ecx
jmp 0x51028a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov ecx, 0x40
sub ecx, dword [ebp - 0xc]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
push 0x36
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax + 0x2a0]
push edx
call fcn.00415fc0
add esp, 0xc
mov eax, dword [ebp - 0x10]
push eax
push 0x5c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
lea eax, [edx + ecx + 0x2e0]
push eax
call fcn.00415fc0
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x5102df
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
cmp edx, dword [ebp - 0xc]
jge 0x510319
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor ecx, 0x36
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov byte [edx + 0x2a0], cl
mov eax, dword [ebp - 4]
add eax, dword [ebp - 8]
movzx ecx, byte [eax]
xor ecx, 0x5c
mov edx, dword [ebp + 8]
add edx, dword [ebp - 8]
mov byte [edx + 0x2e0], cl
jmp 0x5102d6
mov eax, dword [ebp + 8]
push eax
call section..algo
add esp, 4
push 0x40
mov ecx, dword [ebp + 8]
add ecx, 0x2a0
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0050f5a0
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0xa8
push eax
call section..algo
add esp, 4
push 0x40
mov ecx, dword [ebp + 8]
add ecx, 0x2e0
push ecx
mov edx, dword [ebp + 8]
add edx, 0xa8
push edx
call fcn.0050f5a0
add esp, 0xc
push 0xa8
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x150
push ecx
call fcn.00415910
add esp, 0xc
push 0xa8
mov edx, dword [ebp + 8]
add edx, 0xa8
push edx
mov eax, dword [ebp + 8]
add eax, 0x1f8
push eax
call fcn.00415910
add esp, 0xc
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004158f4
mov esp, ebp
pop ebp
ret
Function at 0x401040
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
lea eax, [esp + 0x18]
push 0x38
push str.1.2.13
push eax
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
mov dword [esp + 0x4c], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call fcn.0040ace0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x401094
mov eax, dword [esp + 0x58]
push esi
add eax, 0x12
push eax
push str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00402680
add esp, 0xc
or eax, 0xffffffff
pop esi
pop ebx
add esp, 0x48
ret
push 0x2000
call fcn.00412db9
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4010c8
mov eax, dword [esp + 0x58]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
push str.malloc
call fcn.00402520
add esp, 0xc
jmp 0x4011ee
push 0x2000
call fcn.00412db9
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x4010fa
mov ecx, dword [esp + 0x58]
add ecx, 0x12
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
push str.malloc
call fcn.00402520
add esp, 0xc
jmp 0x4011ee
mov eax, dword [esp + 0x58]
xor ecx, ecx
push ebp
mov ebp, dword [esp + 0x60]
push edi
mov eax, dword [eax + 8]
mov edi, dword [esp + 0x68]
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], ecx
test ecx, ecx
jb 0x401129
ja 0x401122
cmp eax, 0x2000
jbe 0x401129
mov esi, 0x2000
jmp 0x40112b
mov esi, eax
push dword [esp + 0x5c]
push esi
push 1
push dword [esp + 0x24]
call fcn.0040ecb2
add esp, 0x10
cmp eax, esi
jne 0x4011e9
push dword [esp + 0x5c]
call fcn.0040eaad
add esp, 4
test eax, eax
jne 0x4011e9
sub dword [esp + 0x10], esi
mov dword [esp + 0x24], esi
sbb dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 0x20], eax
nop
lea eax, [esp + 0x20]
mov dword [esp + 0x30], 0x2000
push 0
push eax
mov dword [esp + 0x34], ebx
call fcn.00409380
add esp, 8
mov dword [esp + 0x1c], eax
lea ecx, [eax + 4]
cmp ecx, 6
ja case.0x40119e.1
movzx ecx, byte [ecx + 0x401274]
jmp dword [ecx*4 + 0x401268]
mov esi, 0x2000
sub esi, dword [esp + 0x30]
test ebp, ebp
je 0x401212
push ebp
push esi
push 1
push ebx
call fcn.0040f3d5
add esp, 0x10
cmp eax, esi
jne 0x4011d0
push ebp
call fcn.0040eaad
add esp, 4
test eax, eax
je 0x401223
or eax, 0xffffffff
push eax
mov eax, dword [esp + 0x64]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00402680
add esp, 0xc
or esi, 0xffffffff
pop edi
pop ebp
lea eax, [esp + 0x18]
push eax
call fcn.0040aad0
push dword [esp + 0x14]
call fcn.00412d9e
push ebx
call fcn.00412d9e
add esp, 0xc
mov eax, esi
pop esi
pop ebx
add esp, 0x48
ret
test edi, edi
je 0x401227
push esi
push ebx
push edi
call fcn.0040c180
add esp, 0xc
add edi, esi
mov eax, dword [esp + 0x1c]
cmp dword [esp + 0x30], 0
je 0x401170
cmp eax, 1
je 0x401261
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x401245
cmp dword [esp + 0x10], ecx
jbe 0x4011d3
mov eax, dword [esp + 0x10]
jmp 0x401115
mov eax, 0xfffffffd
jmp 0x4011d3
cmp eax, 1
jne 0x4011d3
xor esi, esi
jmp 0x4011ec
Function at 0x401280
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x101c
call fcn.0040b500
mov eax, dword [0x437034]
xor eax, esp
mov dword [esp + 0x1018], eax
push ebx
mov ebx, dword [esp + 0x1028]
push ebp
push esi
mov esi, dword [esp + 0x102c]
push edi
push 0x428580
mov dword [esp + 0x20], esi
lea eax, [esi + 0x68]
mov dword [esp + 0x24], 0xffffffff
push eax
call fcn.00403c10
mov ebp, eax
add esp, 8
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x4012e4
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402680
jmp 0x401460
mov ecx, dword [ebx + 4]
xor eax, eax
add ecx, dword [esi]
push 0
adc eax, dword [esi + 4]
push eax
push ecx
push ebp
call fcn.0040f0d6
add esp, 0x10
test eax, eax
jns 0x401320
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402520
push ebp
call fcn.0040ea51
add esp, 0x10
jmp 0x401463
push dword [ebx + 0xc]
call fcn.00412db9
add esp, 4
mov dword [esp + 0x14], eax
mov edi, eax
mov dword [esp + 0x24], edi
test eax, eax
jne 0x40135d
push dword [ebx + 0xc]
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00402520
push ebp
call fcn.0040ea51
add esp, 0x14
jmp 0x401465
cmp byte [ebx + 0x10], 1
jne 0x40137e
push eax
push 0
push ebx
push ebp
call fcn.00401040
add esp, 0x10
test eax, eax
jne 0x401451
mov dword [esp + 0x14], edi
jmp 0x4013e1
mov edi, dword [ebx + 0xc]
xor ebp, ebp
mov dword [esp + 0x18], eax
test edi, edi
je 0x4013d9
nop dword [eax + eax]
test ebp, ebp
jb 0x4013a5
ja 0x40139e
cmp edi, 0x2000
jbe 0x4013a5
mov esi, 0x2000
jmp 0x4013a7
mov esi, edi
push dword [esp + 0x10]
push 1
push esi
push eax
call fcn.0040ecb2
add esp, 0x10
cmp eax, 1
jb 0x401437
mov eax, dword [esp + 0x18]
sub edi, esi
sbb ebp, 0
add eax, esi
mov dword [esp + 0x18], eax
test ebp, ebp
ja 0x40139e
jb 0x4013d5
test edi, edi
jne 0x401390
mov esi, dword [esp + 0x1c]
mov edi, dword [esp + 0x24]
mov ebp, dword [esp + 0x10]
push ebp
add ebx, 0x12
call fcn.0040ea51
add esi, 0x3068
push ebx
push esi
call fcn.00407600
add esp, 0xc
test eax, eax
js 0x401465
push ebx
push 0x5c
push esi
push str._s_c_s
lea eax, [esp + 0x38]
push 0x1000
push eax
call fcn.00401da0
add esp, 0x18
cmp eax, 0x1000
jge 0x401465
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x18]
call fcn.00403d80
add esp, 8
mov dword [esp + 0x20], eax
jmp 0x401465
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402520
mov ebp, dword [esp + 0x1c]
add esp, 0xc
push dword [esp + 0x14]
call fcn.00412d9e
push ebp
call fcn.0040ea51
add esp, 8
xor edi, edi
push edi
call fcn.00412d9e
mov ecx, dword [esp + 0x102c]
add esp, 4
mov eax, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b4e7
add esp, 0x101c
ret
Function at 0x401530
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push 0x428580
xor edi, edi
lea eax, [esi + 0x68]
push eax
call fcn.00403c10
mov ebp, eax
add esp, 8
mov dword [esp + 0x10], ebp
test ebp, ebp
jne 0x401575
mov eax, dword [esp + 0x1c]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402680
add esp, 8
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 8
ret
push ebx
mov ebx, dword [esp + 0x20]
xor eax, eax
push 0
mov ecx, dword [ebx + 4]
add ecx, dword [esi]
adc eax, dword [esi + 4]
push eax
push ecx
push ebp
call fcn.0040f0d6
add esp, 0x10
test eax, eax
jns 0x4015ad
lea eax, [ebx + 0x12]
push eax
push str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
push str.fseek
call fcn.00402520
add esp, 0xc
jmp 0x4015dd
push dword [ebx + 0xc]
call fcn.00412db9
add esp, 4
mov dword [esp + 0x10], eax
test eax, eax
jne 0x4015f3
push dword [ebx + 0xc]
lea ecx, [ebx + 0x12]
push ecx
push str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
push str.malloc
call fcn.00402520
add esp, 0x10
mov edi, dword [esp + 0x10]
push dword [esp + 0x14]
call fcn.0040ea51
add esp, 4
mov eax, edi
pop ebx
pop edi
pop esi
pop ebp
add esp, 8
ret
cmp byte [ebx + 0x10], 1
jne 0x40161b
push eax
push 0
push ebx
push ebp
call fcn.00401040
add esp, 0x10
test eax, eax
je 0x4015d9
mov edi, dword [esp + 0x10]
push edi
call fcn.00412d9e
add esp, 4
xor edi, edi
jmp 0x4015dd
mov esi, dword [ebx + 0xc]
mov ebp, eax
xor ebx, ebx
test esi, esi
je 0x40169a
test ebx, ebx
jb 0x40163b
ja 0x401634
cmp esi, 0x2000
jbe 0x40163b
mov edi, 0x2000
jmp 0x40163d
mov edi, esi
push dword [esp + 0x14]
push 1
push edi
push ebp
call fcn.0040ecb2
add esp, 0x10
cmp eax, 1
jb 0x40166c
sub esi, edi
sbb ebx, 0
add ebp, edi
test ebx, ebx
ja 0x401634
jb 0x4015d9
test esi, esi
jne 0x401626
jmp 0x4015d9
mov eax, dword [esp + 0x20]
add eax, 0x12
push eax
push str.Failed_to_extract__s:_failed_to_read_data_chunk__n
push str.fread
call fcn.00402520
mov edi, dword [esp + 0x1c]
add esp, 0xc
push edi
call fcn.00412d9e
add esp, 4
xor edi, edi
jmp 0x4015dd
mov edi, eax
jmp 0x4015dd