joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002ebc0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400dfb08], 1
je 0x14002ebfe
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x16
jne 0x14002ebd0
mov dword [0x1400dfb08], 1
mov eax, 0xbbfbd788
ret

Function at 0x14002ec10
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dfaec], 1
je 0x14002ec79
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
mov eax, 0x18
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x18], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1e
mov rdx, rsi
jne 0x14002ec30
mov dword [0x1400dfaec], 1
mov eax, 0x73e74d67
pop rsi
ret

Function at 0x14002ec80
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dfaa8], 1
je 0x14002ece3
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
mov eax, 0x13
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffed
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x13], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x17
mov rdx, rsi
jne 0x14002eca0
mov dword [0x1400dfaa8], 1
mov eax, 0x767d57bd
pop rsi
ret

Function at 0x14002ecf0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dfab4], 1
je 0x14002ed69
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1a
mov r9, rax
jne 0x14002ed20
mov dword [0x1400dfab4], 1
mov eax, 0x8a0eac3c
pop rsi
ret

Function at 0x14002ed70
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400dfac8], 1
je 0x14002edda
mov r8, rdx
movabs r10, 0xe38e38e38e38e38f
xor r9d, r9d
mov eax, 0x12
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
neg rax
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x12], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x1f
mov rdx, rsi
jne 0x14002ed90
mov dword [0x1400dfac8], 1
mov eax, 0xe7da16ca
pop rsi
ret

Function at 0x14002ee50
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400df46c], 1
je 0x14002eeb3
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, 0x16
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x22
mov rdx, rsi
jne 0x14002ee70
mov dword [0x1400df46c], 1
mov eax, 0x88b3e1c7
pop rsi
ret
Function at 0x140030280
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp dword [0x1400df3dc], 1
je 0x1400302e5
mov eax, 0xf0f0f0f1
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x24
mov r11d, r10d
shl r11d, 4
add r11d, r10d
movzx r10d, byte [rdx + r8 + 0x11]
sub r9d, r11d
movsxd r9, r9d
xor r10b, byte [rdx + r9]
mov byte [rcx + r8], r10b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x2b
jne 0x1400302a0
mov dword [0x1400df3dc], 1
mov eax, 0x2cebfc28
ret

Function at 0x1400302f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400df3fc], 1
je 0x14003036f
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, 0x1f
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x38
mov r9, rax
jne 0x140030320
mov dword [0x1400df3fc], 1
mov eax, 0x478ff090
pop rsi
ret

Function at 0x1400303f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400df410], 1
je 0x140030453
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
mov eax, 0x1a
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1a], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x27
mov rdx, rsi
jne 0x140030410
mov dword [0x1400df410], 1
mov eax, 0xc0e88b9e
pop rsi
ret

Function at 0x140030460
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400df41c], 1
je 0x1400304d0
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x23
mov rax, rsi
jne 0x140030490
mov dword [0x1400df41c], 1
mov eax, 0xaeaebc60
pop rsi
ret

Function at 0x1400305e0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400df45c], 1
je 0x14003063f
mov eax, 0xb21642c9
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x24
imul r10d, r10d, 0xffffffe9
movzx r11d, byte [rdx + r8 + 0x17]
add r10d, r8d
movsxd r9, r10d
xor r11b, byte [rdx + r9]
mov byte [rcx + r8], r11b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x3a
jne 0x140030600
mov dword [0x1400df45c], 1
mov eax, 0xef8f4758
ret
Function at 0x140030650
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400e039c], 1
je 0x1400306b7
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe7
movzx edx, byte [r8 + r9 + 0x19]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x140030670
mov dword [0x1400e039c], 1
mov eax, 0x902d249e
ret

Function at 0x1400306c0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400dfa64], 1
je 0x140030725
xor eax, eax
nop dword [rax + rax]
mov r8d, eax
mov r9d, eax
imul r9, r9, 0x2f684bdb
shr r9, 0x20
mov r10d, eax
sub r10d, r9d
shr r10d, 1
add r10d, r9d
shr r10d, 4
imul r9d, r10d, 0xffffffe5
movzx r10d, byte [rdx + rax + 0x1b]
add r9d, eax
movsxd r8, r9d
xor r10b, byte [rdx + r8]
mov byte [rcx + rax], r10b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x556
jne 0x1400306d0
mov dword [0x1400dfa64], 1
mov eax, 0x54ba6069
ret

Function at 0x140030730
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400dfa8c], 1
je 0x14003078d
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 2
mov eax, edx
imul eax, edx, 0xffffffea
movzx edx, byte [r8 + r9 + 0x16]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x22
jne 0x140030750
mov dword [0x1400dfa8c], 1
mov eax, 0xb946a7e3
ret

Function at 0x1400307a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400df368], 1
je 0x140030819
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1c
mov r9, rax
jne 0x1400307d0
mov dword [0x1400df368], 1
mov eax, 0x617edadd
pop rsi
ret

Function at 0x140030820
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400df380], 1
je 0x140030883
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x31
mov rdx, rsi
jne 0x140030840
mov dword [0x1400df380], 1
mov eax, 0xc8f25549
pop rsi
ret
Function at 0x140030890
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400df3ac], 1
je 0x1400308f1
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl eax, 2
lea eax, [rax + rax*4]
movzx edx, byte [r8 + r9 + 0x14]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x27
jne 0x1400308b0
mov dword [0x1400df3ac], 1
mov eax, 0x55978f8d
ret

Function at 0x140030900
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400e0180], 1
je 0x140030970
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x2e
mov rax, rsi
jne 0x140030930
mov dword [0x1400e0180], 1
mov eax, 0x8090e397
pop rsi
ret

Function at 0x140030980
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400e0194], 1
je 0x1400309e3
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x2b
mov rdx, rsi
jne 0x1400309a0
mov dword [0x1400e0194], 1
mov eax, 0x564ad34e
pop rsi
ret

Function at 0x1400309f0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400df360], 1
je 0x140030a51
mov r8, rdx
movabs r10, 0xcccccccccccccccd
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl eax, 2
lea eax, [rax + rax*4]
movzx edx, byte [r8 + r9 + 0x14]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x17
jne 0x140030a10
mov dword [0x1400df360], 1
mov eax, 0x737a84aa
ret

Function at 0x140030c10
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400e0168], 1
je 0x140030c6f
mov eax, 0x88888889
xor r8d, r8d
nop word cs:[rax + rax]
nop dword [rax + rax]
mov r9d, r8d
mov r10d, r8d
imul r10, rax
shr r10, 0x24
imul r10d, r10d, 0xffffffe2
movzx r11d, byte [rdx + r8 + 0x1e]
add r10d, r8d
movsxd r9, r10d
xor r11b, byte [rdx + r9]
mov byte [rcx + r8], r11b
mov r9, r8
inc r9
mov r8, r9
cmp r9d, 0x3f
jne 0x140030c30
mov dword [0x1400e0168], 1
mov eax, 0x17ec8675
ret
Function at 0x140031900
Capabilities:
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
lea rsi, [0x1400df470]
lea rdi, [0x14003b26b]
mov rbp, qword [sym.imp.KERNEL32.dll_CreateFileA]
lea rbx, [rsp + 0x40]
mov r14, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r12, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r15b, 1
jmp 0x140031966
mov r15d, eax
mov qword [rsp + 0x40], 1
mov rcx, rbx
call fcn.14000c470
mov ecx, 0xfffffff5
call r14
mov rcx, rax
mov dx, 7
call r12
mov rcx, rsi
mov rdx, rdi
call fcn.1400322a0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0xc0000000
xor r8d, r8d
xor r9d, r9d
call rbp
cmp rax, 0xffffffffffffffff
jne 0x140031a4a
mov eax, r15d
test r15b, 1
je 0x140031940
mov ecx, 0xfffffff5
call r14
mov rcx, rax
mov dx, 0xa
call r12
lea r15, [0x1400df460]
mov rcx, r15
lea rdx, [0x14003b237]
call fcn.14002ee50
mov r13, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rcx, r13
mov rdx, r15
call fcn.140006020
mov ecx, 0xfffffff5
call r14
mov rcx, rax
mov dx, 7
call r12
lea r15, [0x1400df4ec]
mov rcx, r15
lea rdx, [0x14003b35d]
call fcn.1400323d0
mov rcx, r13
mov rdx, r15
call fcn.140006020
mov r15, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, r15
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, r15
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, r15
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
xor eax, eax
jmp 0x140031940
mov rsi, rax
call fcn.14002f9e0
lea rdi, [0x1400df48c]
lea rdx, [0x14003b2b0]
mov rcx, rdi
call fcn.140032310
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov rcx, rbx
mov rdx, rdi
call fcn.140006020
mov rcx, rax
call fcn.14002cf10
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14002f9e0
lea rsi, [0x1400df4c0]
lea rdx, [0x14003b305]
mov rcx, rsi
call fcn.140032360
mov rcx, rbx
mov rdx, rsi
call fcn.140006020
mov rcx, rax
call fcn.14002cf10
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x1400322a0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400df488], 1
je 0x1400322fd
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 2
mov eax, edx
imul eax, edx, 0xffffffea
movzx edx, byte [r8 + r9 + 0x16]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x18
jne 0x1400322c0
mov dword [0x1400df488], 1
mov eax, 0x1e74961c
ret
Function at 0x140032310
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400df4bc], 1
je 0x14003234e
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x2e
jne 0x140032320
mov dword [0x1400df4bc], 1
mov eax, 0xa6b70dd7
ret

Function at 0x140032360
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400df4e8], 1
je 0x1400323c7
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe3
movzx edx, byte [r8 + r9 + 0x1d]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x25
jne 0x140032380
mov dword [0x1400df4e8], 1
mov eax, 0x2b83c78b
ret

Function at 0x1400323d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400df508], 1
je 0x14003244f
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, 0x1f
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x39
mov r9, rax
jne 0x140032400
mov dword [0x1400df508], 1
mov eax, 0xe32a8d7
pop rsi
ret

Function at 0x140034140
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14003417a
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14003417f
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400341c8
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140036030]
cmp byte [rcx + rax], 0
je 0x1400341c8
dec r8
sub rdx, 1
jne 0x1400341ae
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14003455c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400345a6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400345a6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400345a6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400345a6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400345a6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400345a8
xor al, al
add rsp, 0x28
ret
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.13
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000b500
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002ad0
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.140014fa0
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140002830
jmp 0x14000126c
mov ecx, 0x2000
call fcn.140014fa0
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140002830
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.1400104ec
cmp rax, rbx
jne 0x14000125e
mov rcx, rdi
call fcn.140010260
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140009950
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.140010c2c
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.140010260
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000ca50
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002ad0
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000b1e0
mov rcx, r13
call fcn.140014f8c
mov rcx, rbp
call fcn.140014f8c
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x1050
call fcn.14000bc70
sub rsp, rax
mov rax, qword [0x14003e018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rsi, rdx
mov r13, rcx
add rcx, 0x70
lea rdx, [0x14002b834]
mov ebp, 0xffffffff
call fcn.140003f60
mov r14, rax
test rax, rax
jne 0x140001311
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002ad0
xor ebx, ebx
jmp 0x14000143a
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r13]
mov rcx, r14
call fcn.140010824
test eax, eax
jns 0x14000134d
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002830
mov rcx, r14
call fcn.14001019c
xor ebx, ebx
jmp 0x14000143a
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x1048], r12
call fcn.140014fa0
mov r12, rax
mov rbx, rax
test rax, rax
jne 0x140001390
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002830
mov rcx, r14
call fcn.14001019c
jmp 0x140001432
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1040], r15
jne 0x140001463
mov r9, r12
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
jne 0x1400014d7
mov rcx, r14
add rsi, 0x12
call fcn.14001019c
mov rdx, rsi
lea rcx, [r13 + 0x3070]
call fcn.140007780
test eax, eax
js 0x140001422
mov qword [rsp + 0x28], rsi
lea r9, [r13 + 0x3070]
lea r8, str._s_c_s
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.140001e90
cmp eax, 0x1000
jge 0x140001422
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140004100
mov ebp, eax
mov rdi, qword [rsp + 0x1090]
mov r15, qword [rsp + 0x1040]
mov r12, qword [rsp + 0x1048]
mov rcx, rbx
call fcn.140014f8c
mov eax, ebp
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14000bcd0
add rsp, 0x1050
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [rsi + 0xc]
mov r15, r12
test rdi, rdi
je 0x1400013c3
mov eax, 0x2000
nop word [rax + rax]
cmp rdi, rax
mov rbp, rdi
mov r9, r14
mov r8d, 1
cmova rbp, rax
mov rcx, r15
mov rdx, rbp
call fcn.1400104ec
cmp rax, 1
jb 0x1400014bb
add r15, rbp
mov eax, 0x2000
sub rdi, rbp
jne 0x140001480
mov ebp, 0xffffffff
jmp 0x1400013c3
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002830
mov ebp, 0xffffffff
mov rcx, r12
call fcn.140014f8c
mov rcx, r14
call fcn.14001019c
xor ebx, ebx
jmp 0x140001422