joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov rsi, rcx
mov rdi, qword [rcx]
test rdi, rdi
je 0x140012c82
mov r11, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
cmp r9, r11
jae 0x140012c82
movzx eax, byte [rdi + r9]
cmp eax, 0x49
je 0x140012c9d
cmp eax, 0x42
jne 0x140012c82
lea rcx, [r9 + 1]
mov qword [rsi + 0x10], rcx
cmp rcx, r11
jae 0x140012cda
cmp byte [rdi + rcx], 0x5f
jne 0x140012cda
lea rax, [r9 + 2]
mov qword [rsi + 0x10], rax
xor eax, eax
jmp 0x140012dd2
mov rcx, rsi
xor edx, edx
call fcn.14000e6a0
mov edi, eax
add dil, dil
mov eax, edi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
inc r9
mov qword [rsi + 0x10], r9
mov rcx, rsi
xor edx, edx
call fcn.14000e6a0
test al, al
jne 0x140012cd5
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140012d4c
lea rdx, [0x140044f03]
mov r8d, 1
call fcn.1400097e0
test al, al
je 0x140012d4c
mov dil, 2
jmp 0x140012c91
xor eax, eax
mov r10d, 0x3e
nop word cs:[rax + rax]
mov r8b, 1
cmp rcx, r11
jae 0x140012dee
movzx edx, byte [rdi + rcx]
cmp dl, 0x5f
je 0x140012dc6
lea ebx, [rdx - 0x30]
cmp bl, 0xa
jb 0x140012d2f
lea ebx, [rdx - 0x61]
cmp bl, 0x1a
jae 0x140012d1e
add dl, 0xa9
jmp 0x140012d2d
lea ebx, [rdx - 0x41]
cmp bl, 0x1a
jae 0x140012dee
add dl, 0xe3
mov ebx, edx
inc rcx
mov qword [rsi + 0x10], rcx
mul r10
jo 0x140012dee
movzx edx, bl
add rax, rdx
jae 0x140012cf0
jmp 0x140012dee
mov rax, qword [rsi]
mov dil, 1
test rax, rax
je 0x140012c91
xor ebx, ebx
lea r14, [0x1400452de]
nop word cs:[rax + rax]
mov rcx, qword [rsi + 0x10]
cmp rcx, qword [rsi + 8]
jae 0x140012d84
cmp byte [rax + rcx], 0x45
je 0x140012e7c
sub rbx, 1
jb 0x140012da9
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140012da9
mov r8d, 2
mov rdx, r14
call fcn.1400097e0
test al, al
jne 0x140012cd5
mov rcx, rsi
call fcn.140012e90
test al, al
jne 0x140012cd5
mov rax, qword [rsi]
test rax, rax
jne 0x140012d70
jmp 0x140012c91
inc rcx
mov qword [rsi + 0x10], rcx
inc rax
je 0x140012dee
cmp rax, r9
jae 0x140012deb
mov ecx, dword [rsi + 0x18]
inc ecx
cmp ecx, 0x1f4
jbe 0x140012e3f
mov bl, 1
xor r8d, r8d
jmp 0x140012df0
mov r8b, 1
xor ebx, ebx
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x140012e2e
lea rax, [0x1400452a9]
lea rdx, str.recursion_limit_reachedinvalid_syntax
test r8b, r8b
cmovne rdx, rax
xor r8b, 1
movzx eax, r8b
lea r8, [rax + rax*8]
or r8, 0x10
call fcn.1400097e0
mov dil, 2
test al, al
jne 0x140012c91
mov qword [rsi], 0
mov byte [rsi + 8], bl
xor edi, edi
jmp 0x140012c91
cmp qword [rsi + 0x20], 0
je 0x140012e38
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi + 0x10], rax
mov dword [rsi + 0x18], ecx
mov rcx, rsi
call fcn.140012c30
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm1
jmp 0x140012c93
inc rcx
mov qword [rsi + 0x10], rcx
jmp 0x140012c91
Function at 0x14001a420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
movzx ebx, byte [rdx + 0x39]
xor r15d, r15d
cmp bl, 1
setne dl
mov eax, 0
sbb eax, eax
mov r14, rcx
or al, dl
movzx ecx, al
cmp cl, 0xff
je 0x14001a453
test ecx, ecx
jne 0x14001a4a2
movzx r15d, byte [rdi + 0x38]
cmp al, 0xff
je 0x14001a460
test ecx, ecx
jne 0x14001a4a2
mov rcx, rdi
call fcn.14001a300
movzx r10d, al
test bl, bl
jne 0x14001a4a9
lea rax, [rdi + 0x10]
xor esi, esi
cmp byte [rdi + 0x10], 6
cmove rax, rsi
je case.0x14001a496.2
movzx ecx, byte [rax]
mov esi, 6
lea rdx, [0x14001a61c]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov rsi, qword [rax + 0x10]
add rsi, 4
jmp case.0x14001a496.2
xor r10d, r10d
test bl, bl
je 0x14001a470
xor esi, esi
movzx eax, r15b
lea rcx, [r10 + rax]
add rcx, rsi
mov rdx, qword [rdi + 8]
cmp rdx, rcx
jb 0x14001a5fe
mov r11, qword [rdi]
lea r9, [r11 + rcx]
movzx r8d, byte [rdi + 0x10]
cmp rdx, rcx
jne 0x14001a4db
xor edi, edi
jmp 0x14001a558
add rsi, r10
add rsi, rax
sub rsi, rdx
inc rsi
lea rax, [rdx + r11]
dec rax
xor edi, edi
cmp r8b, 3
jae 0x14001a520
nop word cs:[rax + rax]
cmp byte [rax], 0x5c
je 0x14001a53b
inc rsi
dec rax
cmp rsi, 1
jne 0x14001a500
jmp 0x14001a558
movzx ebx, byte [rax]
cmp ebx, 0x2f
je 0x14001a53b
cmp ebx, 0x5c
je 0x14001a53b
inc rsi
dec rax
cmp rsi, 1
jne 0x14001a520
jmp 0x14001a558
neg rsi
add rcx, rsi
inc rcx
cmp rdx, rcx
jb 0x14001a60c
add r11, rcx
mov edi, 1
mov r9, r11
sub rdx, rcx
je 0x14001a582
mov al, 9
cmp rdx, 2
je 0x14001a586
cmp rdx, 1
jne 0x14001a596
cmp byte [r9], 0x2e
jne 0x14001a596
xor eax, eax
cmp r8b, 3
setae al
lea eax, [rax + rax*2]
add eax, 7
jmp 0x14001a596
mov al, 0xa
jmp 0x14001a596
cmp byte [r9], 0x2e
jne 0x14001a596
cmp byte [r9 + 1], 0x2e
sete al
xor al, 9
add rdi, rdx
mov qword [r14], rdi
mov qword [r14 + 8], r9
mov qword [r14 + 0x10], rdx
mov byte [r14 + 0x18], al
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 8
jmp case.0x14001a496.2
mov rcx, qword [rax + 0x10]
mov rax, qword [rax + 0x20]
lea rdx, [rax + 1]
test rax, rax
cmove rdx, rax
lea rsi, [rcx + rdx]
add rsi, 2
jmp case.0x14001a496.2
mov esi, 2
jmp case.0x14001a496.2
lea r8, str.library_std_srcpath.rs
call fcn.14003dfd0
ud2
lea r8, str.library_std_srcpath.rs
call fcn.14003dfd0
ud2
Function at 0x140028090
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
movdqa xmmword [rbp - 0x10], xmm6
mov qword [rbp - 0x18], 0xfffffffffffffffe
mov rsi, rcx
lea rcx, [rbp - 0x40]
call fcn.14001dbf0
mov rdi, qword [rbp - 0x40]
test rdi, rdi
je 0x1400280db
movdqu xmm6, xmmword [rbp - 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14002813e
mov qword [rsi], rdi
movdqu xmmword [rsi + 8], xmm6
jmp 0x140028132
mov rdx, qword [rbp - 0x38]
mov eax, edx
and eax, 3
cmp eax, 1
jne 0x14002812b
lea rax, [rdx - 1]
mov qword [rbp - 0x28], rax
mov rcx, qword [rdx - 1]
mov qword [rbp - 0x20], rdx
mov rax, qword [rdx + 7]
call qword [rax]
mov rax, qword [rbp - 0x20]
mov rax, qword [rax + 7]
cmp qword [rax + 8], 0
mov rdi, qword [rbp - 0x28]
je 0x14002811e
mov rdx, qword [rax + 0x10]
mov rcx, qword [rdi]
call fcn.140007000
mov edx, 8
mov rcx, rdi
call fcn.140007000
mov qword [rsi], 0
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
mov qword [rsi], 0
movq rax, xmm6
test rax, rax
je 0x140028132
mov edx, 2
mov rcx, rdi
movaps xmm6, xmmword [rbp - 0x10]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
jmp fcn.140007000
Function at 0x14002ac50
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1098
call fcn.140030090
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1000], xmm6
mov qword [rbp + 0xff8], 0xfffffffffffffffe
mov rsi, rdx
mov rbx, rcx
mov qword [rbp + 0xfb0], rcx
mov qword [rbp + 0xfb8], rdx
lea rdi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rdi
xor edx, edx
call fcn.140031310
mov dword [rbp + 0xfe8], 0
xorps xmm6, xmm6
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
lea rax, [0x140021190]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xfc0]
mov qword [rbp + 0xfe0], rbx
mov rcx, rbx
mov rdx, rdi
mov r8d, 0x1000
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
je 0x14002ae5c
mov r14, qword [sym.imp.KERNEL32.dll_SleepEx]
mov r15d, 0xffffffff
lea r12, [rbp + 0xfc0]
mov ecx, 0xffffffff
mov edx, 1
call r14
cmp dword [rbp + 0xfe8], 1
jne 0x14002ad20
cmp dword [rbp + 0xfec], 0
jne 0x14002ae62
mov eax, dword [rbp + 0xff0]
test eax, eax
je 0x14002ae62
mov ebx, eax
cmp eax, 0x1000
ja 0x14002aead
xor edi, edi
cmp rdi, rbx
ja 0x14002ae92
lea rdx, [rdi + rbp]
add rdx, 0xffffffffffffffb0
mov r13, rbx
sub rbx, rdi
cmp rbx, r15
cmovae rbx, r15
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
lea rax, [0x140021190]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov r8d, ebx
mov r9, r12
call qword [sym.imp.KERNEL32.dll_WriteFileEx]
test eax, eax
je 0x14002ae5c
nop dword [rax + rax]
mov ecx, 0xffffffff
mov edx, 1
call r14
cmp dword [rbp + 0xfe8], 1
jne 0x14002add0
cmp dword [rbp + 0xfec], 0
jne 0x14002ae62
mov eax, dword [rbp + 0xff0]
add rdi, rax
mov rbx, r13
cmp rdi, r13
jne 0x14002ad60
mov dword [rbp + 0xfe8], 0
movaps xmmword [rbp + 0xfc0], xmm6
mov qword [rbp + 0xfd0], 0
lea rax, [rbp + 0xfe8]
mov qword [rbp + 0xfd8], rax
lea rax, [0x140021190]
mov qword [rsp + 0x20], rax
mov rcx, qword [rbp + 0xfe0]
lea rdx, [rbp - 0x50]
mov r8d, 0x1000
mov r9, r12
call qword [sym.imp.KERNEL32.dll_ReadFileEx]
test eax, eax
jne 0x14002ad20
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xfe0]
call rdi
mov rcx, rsi
call rdi
movaps xmm6, xmmword [rbp + 0x1000]
add rsp, 0x1098
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea r8, str.library_std_src_syswindowspipe.rs
mov rcx, rdi
mov qword [rbp + 0xfe0], rbx
mov rdx, rbx
call fcn.14003e040
jmp 0x14002aec8
lea r8, str.library_std_src_syswindowspipe.rs
mov edx, 0x1000
mov qword [rbp + 0xfe0], rbx
mov rcx, rbx
call fcn.14003dfe0
ud2
Function at 0x14002af30
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov dword [rbp + 0x14], ecx
xorps xmm0, xmm0
movaps xmmword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
mov edx, 0x10
call qword [sym.imp.ADVAPI32.dll_SystemFunction036]
test al, al
je 0x14002af72
mov rax, qword [rbp - 0x10]
add rsp, 0xa0
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rbp + 8], rax
lea rax, [rbp + 8]
mov qword [rbp - 0x30], rax
lea rax, [0x14001b8b0]
mov qword [rbp - 0x28], rax
lea rax, [rbp + 0x14]
mov qword [rbp - 0x20], rax
lea rax, [0x14000d830]
mov qword [rbp - 0x18], rax
lea rax, [0x140048050]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 2
lea rax, [0x140048070]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
lea rax, [rbp - 0x30]
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 2
lea rdx, str.library_std_src_syswindows_rand.rsRNG_broken:___fallback_RNG_broken:
lea rcx, [rbp - 0x60]
call fcn.14003df10
ud2

Function at 0x140030854
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14003089e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14003089e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14003089e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14003089e
cmp dword [rcx + 0x84], 0xe
jbe 0x14003089e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400308a0
xor al, al
add rsp, 0x28
ret

Function at 0x140034acc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1400348f8
Function at 0x140001280
Capabilities:
Terminate process

Disassembly:
jmp 0x14000f25c
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, 2
call fcn.1400013ac
movzx ecx, bx
mov r11, rax
cmp ebx, ecx
je 0x14000f28b
lea rcx, str.Internal_buffer_overflow
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400013e8
mov eax, ebx
mov byte [r11 + 1], bl
sar eax, 8
mov byte [r11], al
add rsp, 0x20
pop rbx
ret

Function at 0x140001325
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x14001aeec
mov qword [rsp + 8], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xa0]
mov bl, r8b
mov r14d, dword [rsi + 8]
mov rdi, rcx
xor r8d, r8d
add r14d, dword [rbp + 8]
xor edx, edx
xor ecx, ecx
call fcn.140001393
cmp qword [rbp + 8], 0
mov r15d, eax
je 0x14001af50
mov r8d, dword [rbp + 8]
mov rdx, qword [rbp]
mov ecx, eax
call fcn.140001393
mov r15d, eax
cmp qword [rsi + 8], 0
je 0x14001af69
mov r8d, dword [rsi + 8]
mov rdx, qword [rsi]
mov ecx, r15d
call fcn.140001393
mov r15d, eax
test bl, bl
je 0x14001af8d
test r14d, r14d
jle 0x14001af8d
mov r8, rsi
mov rdx, rbp
mov rcx, rdi
mov r12b, 1
call fcn.1400015b4
test al, al
je 0x14001af8d
mov r13d, dword [rdi + 0x40]
jmp 0x14001af93
xor r12b, r12b
mov r13d, r14d
mov r9d, dword [rsp + 0x98]
mov rdx, qword [rsp + 0x88]
mov dword [rsp + 0x30], r15d
test r12b, r12b
mov rcx, rdi
mov dword [rsp + 0x28], r13d
sete bl
mov dword [rsp + 0x20], r14d
mov r8b, bl
call fcn.140001537
mov r9d, dword [rsp + 0x98]
mov rdx, qword [rsp + 0x88]
mov dword [rsp + 0x30], r15d
mov r8b, bl
mov rcx, rdi
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
call fcn.140001442
mov rcx, rdi
test r12b, r12b
je 0x14001afff
mov r8d, dword [rdi + 0x40]
mov rdx, qword [rdi + 0x38]
jmp 0x14001b016
mov r8d, dword [rbp + 8]
mov rdx, qword [rbp]
call fcn.14000141a
mov r8d, dword [rsi + 8]
mov rdx, qword [rsi]
mov rcx, rdi
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
jmp fcn.14000141a
Function at 0x1400013e8
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a3dc
push rbx
sub rsp, 0x20
test rcx, rcx
lea rbx, str.corrupt_pack_file_or_internal_error
mov rax, rdx
cmovne rbx, rcx
test rdx, rdx
jne 0x14001a428
call fcn.1400011ea
test rax, rax
jne 0x14001a428
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rdx, str.Error:_unpacker:__s_n
mov r8, rbx
lea rcx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fprintf]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.MSVCR100.dll_abort]
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.140001631

Function at 0x14000141a
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x14001a58c
test r8d, r8d
jle 0x14001a5df
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov r9, qword [rdi]
movsxd r8, ebx
mov edx, 1
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fwrite]
test eax, eax
jle 0x14001a5e0
add dword [rdi + 0x34], eax
movsxd rcx, eax
sub ebx, eax
add rsi, rcx
test ebx, ebx
jg 0x14001a5a9
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.MSVCR100.dll__errno]
mov rcx, qword [rdi + 0x50]
lea rdx, str.Error:_write_on_output_file_failed_err_d_n
mov rcx, qword [rcx + 0xc0]
mov r8d, dword [rax]
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x14000153c
Capabilities:
Terminate process

Disassembly:
jmp 0x14000d100
push rbx
sub rsp, 0x20
movsxd r11, r9d
mov rbx, r8
mov r10, rcx
test edx, edx
jns 0x14000d11c
lea rcx, str.bad_value_count
jmp 0x14000d191
mov r9, qword [rcx]
cmp r11d, 1
je 0x14000d161
mov ecx, 0x100
cmp dword [rsp + 0x50], ecx
je 0x14000d161
sub ecx, dword [rsp + 0x50]
mov r8d, r11d
jmp 0x14000d154
inc r9
dec r8d
je 0x14000d14a
movzx eax, byte [r9 - 1]
cmp eax, ecx
jge 0x14000d154
dec edx
mov r8d, r11d
cmp r9, rbx
ja 0x14000d18a
test edx, edx
jg 0x14000d139
mov qword [r10], r9
add rsp, 0x20
pop rbx
ret
movsxd r8, edx
mov rcx, r11
xor edx, edx
imul r11, r8
mov rax, r11
div rcx
cmp rax, r8
jne 0x14000d18a
lea rax, [r11 + r9]
cmp rax, rbx
ja 0x14000d18a
mov qword [r10], rax
add rsp, 0x20
pop rbx
ret
lea rcx, str.EOF_reading_band
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400013e8
Function at 0x14000162c
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a730
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140028ec0]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsxd rdi, edx
mov rbx, rcx
test edx, edx
je 0x14001a76f
cmp edi, dword [rcx + 0xc]
jne 0x14001a763
mov eax, dword [rcx + 0x10]
jmp 0x14001a832
mov eax, dword [rcx + 8]
cmp eax, 0
cmove eax, edi
mov dword [rcx + 8], eax
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rdx + 0x24]
call sub.MSVCR100.dll_memset
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR100.dll__gmtime64]
mov r10, rax
test rax, rax
jne 0x14001a7bb
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_gmtime_failure__invalid_input_archive_n
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 2
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov dword [rbx + 0xc], edi
mov r11d, dword [rax + 0x14]
mov edx, 0x7bc
add r11d, 0x76c
cmp r11d, edx
jge 0x14001a7f8
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, 1
mov rcx, rbx
mov r8d, r9d
call fcn.14000132a
mov r11d, eax
jmp 0x14001a82b
add r11d, 0xffffffc4
shl r11d, 9
or r11d, dword [rax + 0xc]
shl r11d, 5
or r11d, dword [rax + 8]
shl r11d, 6
or r11d, dword [rax + 4]
mov eax, dword [rax + 0x10]
inc eax
shl r11d, 5
shl eax, 0x15
or r11d, eax
mov eax, dword [r10]
shr eax, 1
or r11d, eax
mov dword [rbx + 0x10], r11d
mov eax, r11d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001c540
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x140001631
Capabilities:
Terminate process

Disassembly:
jmp 0x140010750
sub rsp, 0x28
test rdx, rdx
lea r8, str.error_unpacking_archive
cmovne r8, rdx
cmp byte [r8], 0x40
jne 0x14001076b
inc r8
mov rcx, qword [rcx + 0xc0]
lea rdx, [0x140024dc0]
call qword [sym.imp.MSVCR100.dll_fprintf]
or ecx, 0xffffffff
call qword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x14000164a
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a630
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14001a685
lea rdx, [0x140025b44]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fopen]
mov qword [rbx], rax
test rax, rax
jne 0x14001a685
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_Could_not_open_jar_file:__s_n
mov r8, rdi
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 3
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140001659
Capabilities:
Create directory

Disassembly:
jmp 0x14001a328
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x140028ec0]
xor rax, rsp
mov qword [rsp + 0x130], rax
movsxd rbx, ecx
mov rcx, rdx
mov rdi, rdx
call sub.MSVCR100.dll_strlen
cmp rax, rbx
jbe 0x14001a396
lea rcx, [rsp + 0x20]
mov rdx, rdi
call sub.MSVCR100.dll_strcpy
lea rcx, [rsp + 0x20]
mov edx, 0x2f
call qword [sym.imp.MSVCR100.dll_strrchr]
test rax, rax
je 0x14001a396
lea rdx, [rsp + 0x20]
mov ecx, ebx
mov byte [rax], 0
call fcn.140001659
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR100.dll__mkdir]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14001c540
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x140003d34
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov ebp, dword [rcx + 0x44]
mov rdi, rcx
mov edx, dword [rdi + 0x94]
mov ebx, dword [rdi + 0x58]
mov eax, dword [rdi + 0x44]
sub ebx, dword [rdi + 0x9c]
lea ecx, [rbp + rax - 0x106]
sub ebx, edx
cmp edx, ecx
jb 0x140003dea
mov rcx, qword [rdi + 0x50]
mov r8, rbp
lea rdx, [rcx + rbp]
call sub.MSVCR100.dll_memcpy
mov r9d, dword [rdi + 0x74]
mov rax, qword [rdi + 0x68]
sub dword [rdi + 0x98], ebp
sub dword [rdi + 0x94], ebp
sub dword [rdi + 0x84], ebp
lea r8, [rax + r9*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
dec r9d
mov word [r8], ax
jne 0x140003d9f
mov rax, qword [rdi + 0x60]
mov r9d, ebp
lea r8, [rax + rbp*2]
sub r8, 2
xor eax, eax
movzx edx, word [r8]
movzx ecx, dx
sub cx, bp
cmp edx, ebp
cmovae ax, cx
dec r9d
mov word [r8], ax
jne 0x140003dc9
add ebx, ebp
mov rsi, qword [rdi]
cmp dword [rsi + 8], 0
je 0x140003ec3
mov eax, dword [rdi + 0x94]
mov r13d, dword [rdi + 0x9c]
add r13, rax
mov eax, dword [rsi + 8]
add r13, qword [rdi + 0x50]
cmp eax, ebx
mov r12d, eax
cmova r12d, ebx
test r12d, r12d
je 0x140003e6c
sub eax, r12d
mov dword [rsi + 8], eax
mov rax, qword [rsi + 0x28]
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x140003e3e
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.14000142e
jmp 0x140003e51
cmp ecx, 2
jne 0x140003e54
mov rdx, qword [rsi]
mov ecx, dword [rsi + 0x4c]
mov r8d, r12d
call fcn.140001393
mov dword [rsi + 0x4c], eax
mov rdx, qword [rsi]
mov r8d, r12d
mov rcx, r13
mov ebx, r12d
call sub.MSVCR100.dll_memcpy
add qword [rsi], rbx
add dword [rsi + 0xc], r12d
add dword [rdi + 0x9c], r12d
mov r9d, dword [rdi + 0x9c]
cmp r9d, 3
jb 0x140003ead
mov eax, dword [rdi + 0x94]
mov rdx, qword [rdi + 0x50]
mov ecx, dword [rdi + 0x80]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x70], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x7c]
mov dword [rdi + 0x70], r8d
cmp r9d, 0x106
jae 0x140003ec3
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x140003d52
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14000d100
Capabilities:
Terminate process

Disassembly:
jmp 0x14000d100
push rbx
sub rsp, 0x20
movsxd r11, r9d
mov rbx, r8
mov r10, rcx
test edx, edx
jns 0x14000d11c
lea rcx, str.bad_value_count
jmp 0x14000d191
mov r9, qword [rcx]
cmp r11d, 1
je 0x14000d161
mov ecx, 0x100
cmp dword [rsp + 0x50], ecx
je 0x14000d161
sub ecx, dword [rsp + 0x50]
mov r8d, r11d
jmp 0x14000d154
inc r9
dec r8d
je 0x14000d14a
movzx eax, byte [r9 - 1]
cmp eax, ecx
jge 0x14000d154
dec edx
mov r8d, r11d
cmp r9, rbx
ja 0x14000d18a
test edx, edx
jg 0x14000d139
mov qword [r10], r9
add rsp, 0x20
pop rbx
ret
movsxd r8, edx
mov rcx, r11
xor edx, edx
imul r11, r8
mov rax, r11
div rcx
cmp rax, r8
jne 0x14000d18a
lea rax, [r11 + r9]
cmp rax, rbx
ja 0x14000d18a
mov qword [r10], rax
add rsp, 0x20
pop rbx
ret
lea rcx, str.EOF_reading_band
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400013e8
Function at 0x14000f25c
Capabilities:
Terminate process

Disassembly:
jmp 0x14000f25c
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, 2
call fcn.1400013ac
movzx ecx, bx
mov r11, rax
cmp ebx, ecx
je 0x14000f28b
lea rcx, str.Internal_buffer_overflow
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.1400013e8
mov eax, ebx
mov byte [r11 + 1], bl
sar eax, 8
mov byte [r11], al
add rsp, 0x20
pop rbx
ret

Function at 0x140010750
Capabilities:
Terminate process

Disassembly:
jmp 0x140010750
sub rsp, 0x28
test rdx, rdx
lea r8, str.error_unpacking_archive
cmovne r8, rdx
cmp byte [r8], 0x40
jne 0x14001076b
inc r8
mov rcx, qword [rcx + 0xc0]
lea rdx, [0x140024dc0]
call qword [sym.imp.MSVCR100.dll_fprintf]
or ecx, 0xffffffff
call qword [sym.imp.MSVCR100.dll_exit]
int3