joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140018910
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov eax, dword [rcx]
test rdx, rdx
mov rbx, rcx
mov rsi, rdx
je 0x140018a38
cmp eax, 1
je 0x14001896b
call fcn.140017890
lea rbp, [rax + 8]
mov rdi, rax
mov rcx, rbp
call fcn.140017210
mov r12d, dword [rbx]
test r12d, r12d
je 0x140018980
cmp r12d, 1
jne 0x140018a10
mov rcx, rbp
call fcn.140017500
test rdi, rdi
je 0x14001896b
mov rcx, rdi
call fcn.140017c30
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
lea rax, [0x140017d10]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.140017f90
mov ecx, dword [0x14002a328]
mov r12, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call r12
test rax, rax
je 0x140018a78
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x30], rax
lock or qword [rsp], 0
call fcn.140017f90
mov ecx, dword [0x14002a328]
call r12
test rax, rax
je 0x140018a60
lea rdx, [rsp + 0x20]
mov qword [rax + 0x18], rdx
lock or qword [rsp], 0
call rsi
call fcn.140017f90
mov ecx, dword [0x14002a328]
call r12
test rax, rax
je 0x140018a50
mov rdx, qword [rsp + 0x30]
mov qword [rax + 0x18], rdx
mov dword [rbx], 1
jmp 0x140018956
mov ecx, 2
call qword [fcn.140016ae0]
mov r9d, r12d
mov r8, rbx
lea rdx, str._once__p_is__d_n
mov rcx, rax
call sub.msvcrt.dll_fprintf
jmp 0x140018956
mov eax, 0x16
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140018040
test rax, rax
jne 0x1400189f9
jmp 0x140029535
call fcn.140018040
test rax, rax
jne 0x1400189d5
jmp 0x14002954e
call fcn.140018040
test rax, rax
jne 0x1400189af
jmp 0x140029544
mov rax, qword [rsp + 0x30]
mov qword [0], rax
ud2
mov rax, qword [pe_dos_header]
ud2
lea rax, [rsp + 0x20]
mov qword [0], rax
ud2

Function at 0x140018d00
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov esi, ecx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018d78
lea rbp, [rbx + 0x68]
xor r12d, r12d
mov rcx, rbp
call fcn.14001b310
cmp esi, dword [rbx + 0x48]
jae 0x140018d53
mov rax, qword [rbx + 0x58]
cmp byte [rax + rsi], 0
je 0x140018d53
mov rax, qword [rbx + 0x50]
mov r12, qword [rax + rsi*8]
mov rcx, rbp
call fcn.14001b350
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.140018040
mov rbx, rax
jmp 0x140018d2d
Function at 0x140018d90
Capabilities:
Get thread local storage value

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov esi, ecx
mov r12, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140018ea0
lea r14, [rbx + 0x68]
mov rcx, r14
call fcn.14001b310
cmp esi, dword [rbx + 0x48]
jae 0x140018e20
mov rdi, qword [rbx + 0x50]
mov qword [rdi + rsi*8], r12
mov rax, qword [rbx + 0x58]
mov rcx, r14
mov byte [rax + rsi], 1
call fcn.14001b350
mov ecx, ebp
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rbx + 0x50]
lea r15d, [rsi + 1]
movsxd r13, r15d
lea rdx, [r13*8]
call sub.msvcrt.dll_realloc
test rax, rax
mov rdi, rax
je 0x140018ead
mov rcx, qword [rbx + 0x58]
mov rdx, r13
movq xmm6, rdi
call sub.msvcrt.dll_realloc
movq xmm0, rax
test rax, rax
mov r13, rax
punpcklqdq xmm6, xmm0
je 0x140018ead
mov eax, dword [rbx + 0x48]
mov edx, r15d
lea rcx, [rdi + rax*8]
sub edx, eax
lea r8, [rdx*8]
xor edx, edx
call sub.msvcrt.dll_memset
mov edx, dword [rbx + 0x48]
mov r8d, r15d
lea rcx, [r13 + rdx]
sub r8d, edx
xor edx, edx
call sub.msvcrt.dll_memset
movaps xmmword [rbx + 0x50], xmm6
mov dword [rbx + 0x48], r15d
jmp 0x140018de4
call fcn.140018040
mov rbx, rax
jmp 0x140018dcf
mov rcx, r14
call fcn.14001b350
mov eax, 0xc
jmp 0x140018e02

Function at 0x140018f30
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018f58
mov rax, qword [rax + 0x30]
add rsp, 0x28
ret
call fcn.140018040
test rax, rax
jne 0x140018f4a
add rsp, 0x28
ret

Function at 0x140018fc0
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140018fe8
add rax, 0x18
add rsp, 0x28
ret
call fcn.140018040
test rax, rax
jne 0x140018fda
jmp 0x140018fde

Function at 0x140019100
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x28
mov eax, dword [0x140035e18]
test eax, eax
jne 0x140019118
xor eax, eax
add rsp, 0x28
ret
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140019148
mov edx, dword [rax + 0x20]
test edx, edx
jg 0x14001910e
test byte [rax + 0x40], 3
je 0x14001910e
mov eax, dword [rax + 0x44]
and eax, 1
jmp 0x140019110
call fcn.140018040
test rax, rax
jne 0x14001912e
jmp 0x14001910e
Function at 0x140019160
Capabilities:
Get thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x1400191a0
test ebx, ebx
jle 0x140019190
lock add dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
lock sub dword [rax + 0x20], 1
add rsp, 0x20
pop rbx
ret
call fcn.140018040
test rax, rax
jne 0x14001917d
add rsp, 0x20
pop rbx
ret

Function at 0x140019290
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140019308
test byte [rbx + 0x40], 0xc
jne 0x1400192bf
mov eax, dword [0x140035e18]
test eax, eax
jne 0x1400192d0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140017210
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x1400192f3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x1400192f3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001931c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140017500
call fcn.140018040
test rax, rax
mov rbx, rax
jne 0x1400192af
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001933a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140017500
call fcn.1400191b0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400193c0
call fcn.14001a4a0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x1400193f8
call fcn.140017f90
mov ecx, dword [0x14002a328]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140019450
test esi, esi
je 0x1400193d6
call fcn.140019290
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140019430
mov edx, edi
call fcn.14001a550
call fcn.140019290
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140019440
call fcn.140019290
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140019290
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140017f90
mov ecx, dword [0x14002a328]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x140019395
call fcn.140018040
mov rbx, rax
jmp 0x140019395
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400193ae
call fcn.140018040
jmp 0x1400193d6
call fcn.140018040
mov rbx, rax
jmp 0x140019391
Function at 0x140019350
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140019308
test byte [rbx + 0x40], 0xc
jne 0x1400192bf
mov eax, dword [0x140035e18]
test eax, eax
jne 0x1400192d0
add rsp, 0x28
pop rbx
pop rsi
ret
lea rsi, [rbx + 0x38]
mov rcx, rsi
call fcn.140017210
movzx eax, byte [rbx + 0x40]
test al, 3
je 0x1400192f3
mov edx, dword [rbx + 0x44]
test dl, 1
je 0x1400192f3
mov ecx, dword [rbx + 0x20]
test ecx, ecx
jle 0x14001931c
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.140017500
call fcn.140018040
test rax, rax
mov rbx, rax
jne 0x1400192af
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, qword [rbx + 0x30]
and eax, 0xfffffff3
and edx, 0xfffffffe
or eax, 4
mov dword [rbx + 0x44], edx
mov byte [rbx + 0x40], al
test rcx, rcx
je 0x14001933a
call qword [sym.imp.KERNEL32.dll_ResetEvent]
mov rcx, rsi
call fcn.140017500
call fcn.1400191b0
nop
nop dword [rax + rax]
push rdi
push rsi
push rbx
sub rsp, 0x20
test rcx, rcx
je 0x1400193c0
call fcn.14001a4a0
mov rsi, rax
mov eax, 0xfffffffe
cmp rax, rsi
jb 0x1400193f8
call fcn.140017f90
mov ecx, dword [0x14002a328]
mov edi, esi
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x140019450
test esi, esi
je 0x1400193d6
call fcn.140019290
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x140019430
mov edx, edi
call fcn.14001a550
call fcn.140019290
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x140019440
call fcn.140019290
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140019290
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
call fcn.140017f90
mov ecx, dword [0x14002a328]
mov edi, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
jne 0x140019395
call fcn.140018040
mov rbx, rax
jmp 0x140019395
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400193ae
call fcn.140018040
jmp 0x1400193d6
call fcn.140018040
mov rbx, rax
jmp 0x140019391

Function at 0x140019460
Capabilities:
Get thread local storage value

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov esi, ecx
call fcn.140017f90
mov ecx, dword [0x14002a328]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x1400194d0
test esi, esi
je 0x1400194b0
call fcn.140019290
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x1400194e0
mov edx, esi
call fcn.14001a550
call fcn.140019290
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140019290
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140019290
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
call fcn.140018040
mov rbx, rax
jmp 0x140019481
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001949a
Function at 0x140130000
Capabilities:
Access peb ldr_data
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], r9
xchg r11, r8
mov qword [rsp + 0x18], r11
jmp 0x14013012f
xchg r11, r8
mov qword [rsp + 0x10], rdx
Function at 0x140133890
Capabilities:
Execute syscall

Disassembly:
xchg esi, ecx
invalid
js 0x1401331bb
push rbp
int3
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
xchg r10, rcx
jmp 0x1401338bc
xchg rdi, rax
mov dword [rsp + 8], 0
xchg r14, rax
mov r14, qword [rsp + 0x30]
jmp 0x1401338db
mov qword [rsp + 8], r10
xchg rcx, r10
sub rsp, 0x28
lea rax, [0x140133b90]
xchg rdi, rax
mov qword [rsp + 0x18], rdi
jmp 0x1401338a6
xchg r14, rax
mov qword [rsp + 0x10], rax
jmp 0x140133971
xchg r10, rax
mov r10, qword [rsp + 0x10]
xchg r10, rax
inc rax
mov qword [rsp + 0x10], rax
je 0x140133939
jne 0x140133939
div rbx
pause
xor r15d, 0x8eb60361
mov r14d, 0x103775bf
sub r13d, 0xcfd6c67d
dec rdi
jmp rax
fld qword [rcx - 0x3f]
xlatb
out 0x41, al
pop rbp
sub r15d, 0x8d0f2824
call fcn.1401336f8
movabs rbx, 0x566b9113121e36eb
jbe 0x14013313c
jmp 0x140133971
cmp r9d, 0xe8886fe
rol r14d, 0x61
call fcn.140132fa8
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x10], rax
jae 0x140133b8b
mov byte [rsp], 0
jmp 0x140133985
mov eax, dword [rsp + 0x38]
xchg rcx, r13
mov r13, qword [rsp + 0x30]
xchg rcx, r13
jmp 0x140133957
mov dword [rsp + 4], 0
jmp 0x140133a16
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jne 0x1401339b7
je 0x1401339b7
or r14d, 0xed09cfbd
or r11d, 0xe7c0cc10
or r9d, 0x8d34d39
movabs r10, 0x5d5a29d87ed25deb
ror ebx, 0xae
pause
cmp r12d, 0xd8fc7d9b
call fcn.14013323c
jle 0x1401346cc
jmp 0x140133a16
jne 0x140133924
jle 0x140133086
ret 0x20
mov ecx, dword [rsp + 4]
mov rdx, qword [rsp + 0x48]
mov ecx, dword [rdx + rcx*4]
mov rdx, qword [rsp + 0x40]
jmp 0x1401339fb
add rcx, qword [rdx + rax*8]
mov rax, rcx
cmp qword [rsp + 0x10], rax
jae 0x140133a96
mov byte [rsp], 1
jmp 0x140133a9b
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 4], eax
jae 0x140133a9b
mov eax, dword [rsp + 4]
xchg rcx, r9
mov r9, qword [rsp + 0x40]
xchg rcx, r9
jmp 0x140133a38
mov rax, qword [rcx + rax*8]
cmp qword [rsp + 0x10], rax
jb 0x140133a96
mov eax, dword [rsp + 4]
jne 0x140133a86
je 0x140133a86
lea ebx, [rbp + 0x46c7]
or r12d, 0x5b637ca5
pause
popf
and ebx, 0x4ffad191
push r12
jns 0x140132db4
dec rbp
mov esi, 0x622aadc9
jmp rcx
jmp 0x1401339e5
jmp 0x140133992
movzx eax, byte [rsp]
test eax, eax
je 0x140133aac
jmp 0x1401338e7
xor edx, edx
mov eax, dword [rsp + 8]
mov ecx, 0x20
jne 0x140133aed
je 0x140133aed
jmp rcx
jmp 0x140133b80
mov rcx, qword [rsp + 0x10]
mov byte [rcx], al
mov eax, dword [rsp + 8]
inc eax
je 0x140133b37
jne 0x140133b37
pop rsi
cmp r14d, 0x54a36342
test ebp, 0x2d4cbc3c
ret
jmp 0x140133b77
mov rcx, qword [rsp + 0x18]
movzx eax, byte [rcx + rax]
mov rcx, qword [rsp + 0x10]
movzx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
jmp 0x140133b15
mov dword [rsp + 8], eax
jmp 0x1401338e7
div ecx
mov eax, edx
mov eax, eax
jmp 0x140133b5d
add rsp, 0x28
ret
cmpsb byte [rsi], byte [rdi]
ret
Function at 0x1400016b1
Capabilities:
Execute syscall

Disassembly:
mov r10, rcx
mov eax, dword [section..data]
syscall
ret

Function at 0x140001f90
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001fda
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001fda
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001fda
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001fda
cmp dword [rcx + 0x84], 0xe
jbe 0x140001fda
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001fdc
xor al, al
add rsp, 0x28
ret
Function at 0x140001120
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
sub rsp, 0x10
cmp dword [0x140004680], 0
jne 0x140001323
mov rax, qword gs:[0x60]
xor r15d, r15d
mov edx, r15d
mov rcx, qword [rax + 0x18]
mov r8, qword [rcx + 0x10]
mov rax, qword [r8 + 0x30]
test rax, rax
je 0x14000132f
nop word [rax + rax]
mov r10, rax
movsxd rax, dword [rax + 0x3c]
mov ecx, dword [rax + r10 + 0x88]
test ecx, ecx
je 0x14000119d
lea rdx, [r10 + rcx]
mov ecx, dword [r10 + rcx + 0xc]
mov eax, dword [rcx + r10]
or eax, 0x20202020
cmp eax, 0x6c64746e
jne 0x14000119d
mov eax, dword [rcx + r10 + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x1400011a9
mov r8, qword [r8]
mov rax, qword [r8 + 0x30]
test rax, rax
jne 0x140001160
test rdx, rdx
je 0x14000132f
mov qword [rsp + 0x20], rbx
mov r11d, r15d
mov ebx, dword [rdx + 0x18]
mov qword [rsp + 0x28], rbp
mov ebp, dword [rdx + 0x24]
mov qword [rsp + 0x30], rsi
mov esi, dword [rdx + 0x1c]
mov qword [rsp + 0x38], rdi
add rsi, r10
mov edi, dword [rdx + 0x20]
mov qword [rsp + 8], r12
add rdi, r10
mov qword [rsp], r14
add rbp, r10
mov r12d, 0x775a
lea r14, [0x140004680]
nop dword [rax]
nop dword [rax + rax]
lea eax, [rbx - 1]
mov r9d, dword [rdi + rax*4]
add r9, r10
cmp word [r9], r12w
jne 0x140001266
mov edx, r15d
mov r8d, 0xd15373f5
mov rax, r9
nop dword [rax]
movzx eax, word [rax]
mov ecx, r8d
ror ecx, 8
inc edx
add ecx, eax
mov eax, edx
add rax, r9
xor r8d, ecx
cmp byte [rax], r15b
jne 0x140001220
mov edx, r11d
lea eax, [rbx - 1]
add rdx, rdx
inc r11d
mov dword [r14 + rdx*8 + 8], r8d
movzx eax, word [rbp + rax*2]
mov eax, dword [rsi + rax*4]
mov dword [r14 + rdx*8 + 0xc], eax
mov qword [r14 + rdx*8 + 0x10], r15
cmp r11d, 0x258
je 0x14000126b
add ebx, 0xffffffff
jne 0x140001200
mov r12, qword [rsp + 8]
lea eax, [r11 - 1]
mov rbp, qword [rsp + 0x28]
mov r8d, r15d
mov dword [0x140004680], r11d
test eax, eax
je 0x140001310
nop dword [rax + rax]
mov ecx, r11d
mov eax, r15d
sub ecx, r8d
cmp ecx, 1
je 0x140001304
nop
lea ebx, [rax + 1]
mov r10d, eax
add r10, r10
mov r9d, ebx
add r9, r9
mov esi, dword [r14 + r10*8 + 0xc]
mov edi, dword [r14 + r9*8 + 0xc]
cmp esi, edi
jbe 0x1400012f6
mov eax, dword [r14 + r9*8 + 8]
mov edx, dword [r14 + r10*8 + 8]
mov rcx, qword [r14 + r10*8 + 0x10]
mov dword [r14 + r10*8 + 8], eax
mov rax, qword [r14 + r9*8 + 0x10]
mov qword [r14 + r10*8 + 0x10], rax
mov dword [r14 + r10*8 + 0xc], edi
mov dword [r14 + r9*8 + 8], edx
mov dword [r14 + r9*8 + 0xc], esi
mov qword [r14 + r9*8 + 0x10], rcx
mov r11d, dword [0x140004680]
mov ecx, r11d
mov eax, ebx
sub ecx, r8d
dec ecx
cmp ebx, ecx
jb 0x1400012a0
inc r8d
lea eax, [r11 - 1]
cmp r8d, eax
jb 0x140001290
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x20]
mov r14, qword [rsp]
mov eax, 1
add rsp, 0x10
pop r15
ret
xor eax, eax
add rsp, 0x10
pop r15
ret
Function at 0x140001d98
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001de2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001de2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001de2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001de2
cmp dword [rcx + 0x84], 0xe
jbe 0x140001de2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001de4
xor al, al
add rsp, 0x28
ret
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r14, rdx
xor esi, esi
lea rdx, [0x14002c8d4]
mov r15d, esi
mov rdi, r8
mov rbx, rcx
mov r13d, 0xffffffff
call fcn.140004560
mov r12, rax
test rax, rax
jne 0x1400010a9
lea rdx, [r14 + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002710
jmp 0x1400011ca
mov edx, dword [r14 + 4]
xor r8d, r8d
add rdx, qword [rbx + 0x1000]
mov rcx, r12
call fcn.140010584
test eax, eax
jns 0x1400010e6
call fcn.140014fd4
lea r9, [r14 + 0x12]
lea r8, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
mov edx, dword [rax]
call fcn.140002910
jmp 0x1400011ac
mov ecx, dword [r14 + 0xc]
call fcn.140015020
mov r15, rax
test rax, rax
jne 0x140001122
mov ebx, dword [r14 + 0xc]
call fcn.140014fd4
lea r9, [r14 + 0x12]
mov dword [rsp + 0x20], ebx
lea r8, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
mov edx, dword [rax]
call fcn.140002910
jmp 0x1400011ac
cmp byte [r14 + 0x10], 1
jne 0x14000113c
mov r9, r15
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call fcn.140001210
jmp 0x14000119d
mov ebx, dword [r14 + 0xc]
mov qword [rsp + 0x60], rbp
mov rbp, r15
test rbx, rbx
je 0x140001191
mov eax, 0x2000
nop dword [rax]
nop word [rax + rax]
cmp rbx, rax
mov rdi, rbx
mov r9, r12
mov r8d, 1
cmova rdi, rax
mov rcx, rbp
mov rdx, rdi
call fcn.140010238
cmp rax, 1
jb 0x1400011ed
add rbp, rdi
mov eax, 0x2000
sub rbx, rdi
jne 0x140001160
mov eax, esi
mov rdi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x60]
test eax, eax
je 0x1400011ac
mov rcx, r15
call fcn.140015010
mov r15, rsi
mov rcx, r12
call fcn.14000fedc
mov rsi, r15
test r15, r15
je 0x1400011ca
mov rdx, rdi
mov rcx, r15
call fcn.140004690
mov r13d, eax
mov rcx, rsi
call fcn.140015010
mov rbx, qword [rsp + 0x68]
mov eax, r13d
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
call fcn.140014fd4
lea r9, [r14 + 0x12]
lea r8, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov edx, dword [rax]
call fcn.140002910
mov eax, r13d
jmp 0x140001193
Function at 0x140001210
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
mov r8d, 0x58
mov qword [rsp + 0x60], rax
lea rdx, str.1.3.1
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov ebp, eax
mov rsi, r9
call fcn.14000bc10
mov r15d, eax
test eax, eax
je 0x140001297
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002710
mov eax, 0xffffffff
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.140015020
mov r13, rax
test rax, rax
jne 0x1400012d4
call fcn.140014fd4
lea r9, [rbx + 0x12]
lea r8, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
mov edx, dword [rax]
call fcn.140002910
jmp 0x140001439
mov ecx, 0x2000
call fcn.140015020
mov rbp, rax
test rax, rax
jne 0x140001309
call fcn.140014fd4
lea r9, [rbx + 0x12]
lea r8, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
mov edx, dword [rax]
call fcn.140002910
jmp 0x140001439
mov qword [rsp + 0xd0], r12
mov r15d, 0xffffffff
mov r12d, dword [rbx + 8]
nop dword [rax + rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.140010238
cmp rax, rbx
jne 0x140001431
mov rcx, rdi
call fcn.14000ffa0
test eax, eax
jne 0x140001431
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.14000a050
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001416
cmp eax, 2
je 0x140001411
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x1400013d4
mov r9, r14
mov r8, rbx
mov edx, 1
mov rcx, rbp
call fcn.14001098c
cmp rax, rbx
jne 0x1400013cf
mov rcx, r14
call fcn.14000ffa0
test eax, eax
je 0x1400013ea
mov edi, r15d
jmp 0x140001416
test rsi, rsi
je 0x1400013ea
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.140029f10
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x140001370
cmp edi, 1
je 0x14000140c
test r12, r12
je 0x140001416
mov rdi, qword [rsp + 0xc0]
jmp 0x140001320
xor r15d, r15d
jmp 0x140001431
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002710
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000b8f0
mov rcx, r13
call fcn.140015010
mov rcx, rbp
call fcn.140015010
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret