joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002c800
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x14002c839
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x14002c927
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x14002c8cf
cmp qword [rsp + 0x20], 0
jle 0x14002c8cf
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x14002c879
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.14001ee00
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x14002c917
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x14002c917
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x14002c930
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x14002c964
xor eax, eax
jmp 0x14002cb60
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x14002c996
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x14002cb60
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x14002ca47
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.14001b2b0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.14001ee00
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x14002cb50
mov rcx, qword [rsp + 0x80]
call fcn.14002dfa0
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x14002cafd
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x14002caf8
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x14002cb60
jmp 0x14002ca73
cmp qword [rsp + 0x50], 0
jbe 0x14002cb50
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140033c30
add rsp, 0x78
ret
Function at 0x14002e060
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0xa8
mov rax, qword [0x14003f040]
xor rax, rsp
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0xb0]
cmp qword [rax + 0x68], 0
je 0x14002e09d
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14002e0a4
mov al, 1
jmp 0x14002e1fc
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x50], rax
call fcn.14002ee40
mov dword [rsp + 0x38], eax
mov edx, dword [rsp + 0x38]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x50]
mov dword [rsp + 0x3c], eax
call fcn.14002ee40
mov dword [rsp + 0x40], eax
mov edx, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x40]
call fcn.14002eea0
movzx eax, al
test eax, eax
je 0x14002e0f9
xor al, al
jmp 0x14002e1fc
mov qword [rsp + 0x60], 0x20
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax + 0x68]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x90]
mov rcx, qword [rsp + 0xb0]
add rcx, 0x74
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rsp + 0x70]
mov rdx, rcx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
je 0x14002e169
cmp dword [rsp + 0x30], 1
je 0x14002e175
cmp dword [rsp + 0x30], 3
je 0x14002e1ea
jmp 0x14002e1fa
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
lea rax, [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jbe 0x14002e1c1
mov rax, qword [rsp + 0xb0]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x48]
mov edx, 1
lea rcx, [rsp + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x48], rax
je 0x14002e1c1
xor al, al
jmp 0x14002e1fc
mov rax, qword [rsp + 0xb0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14002e1db
mov dword [rsp + 0x34], 1
jmp 0x14002e1e3
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
jmp 0x14002e1fc
mov rax, qword [rsp + 0xb0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14002e1fc
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.140033c30
add rsp, 0xa8
ret

Function at 0x140033764
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14003379e
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x1400337a3
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x1400337ec
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140036740]
cmp byte [rcx + rax], 0
je 0x1400337ec
dec r8
sub rdx, 1
jne 0x1400337d2
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret
Function at 0x140033ae4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rdx, rcx
mov ecx, 0x105
call fcn.140033804
mov ebx, eax
test eax, eax
jne 0x140033b14
and dword [rsp + 0x38], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x3c], eax
jmp 0x140033b77
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140033b6e
test al, 0x10
je 0x140033b6e
bt eax, 0xa
jae 0x140033b67
mov r9d, 0x2000000
lea rcx, [rsp + 0x38]
mov r8d, 0x80
mov rdx, rdi
call fcn.140033b88
mov rcx, qword [rsp + 0x38]
mov edi, eax
cmp rcx, 0xffffffffffffffff
je 0x140033b63
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x140033b63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_abort]
int3
test edi, edi
jne 0x140033b6e
and dword [rsp + 0x3c], 0
jmp 0x140033b73
or dword [rsp + 0x3c], 0xffffffff
mov dword [rsp + 0x38], ebx
mov rax, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14003481c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140034866
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140034866
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140034866
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140034866
cmp dword [rcx + 0x84], 0xe
jbe 0x140034866
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140034868
xor al, al
add rsp, 0x28
ret
Function at 0x1400013f0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rdi, rdx
mov rbx, rcx
add rcx, 0x70
lea rdx, [0x1400170a8]
call fcn.1400034e0
test rax, rax
je 0x140001467
mov rsi, rax
mov edx, dword [rdi + 4]
add edx, dword [rbx]
mov rcx, rax
xor r8d, r8d
call fcn.14000e630
test eax, eax
js 0x140001481
mov r14d, dword [rdi + 0xc]
mov rcx, r14
call sub.msvcrt.dll_malloc
test rax, rax
je 0x1400014a0
mov rbx, rax
cmp byte [rdi + 0x10], 1
jne 0x1400014bf
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9, rbx
call fcn.140001550
test eax, eax
jne 0x14000151e
jmp 0x140001528
add rdi, 0x12
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
mov rdx, rdi
call fcn.1400021d0
xor ebx, ebx
jmp 0x140001530
add rdi, 0x12
lea rcx, str.fseek
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
mov r8, rdi
call fcn.140002290
jmp 0x140001526
add rdi, 0x12
lea rcx, [0x140017120]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
mov r8, rdi
mov r9d, r14d
call fcn.140002290
jmp 0x140001526
test r14, r14
je 0x140001528
mov r15, rbx
nop word [rax + rax]
cmp r14, 0x2000
mov r12d, 0x2000
cmovb r12, r14
mov r8d, 1
mov rcx, r15
mov rdx, r12
mov r9, rsi
call sub.msvcrt.dll_fread
test rax, rax
je 0x140001504
add r15, r12
sub r14, r12
jne 0x1400014d0
jmp 0x140001528
add rdi, 0x12
lea rcx, [0x140017236]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
mov r8, rdi
call fcn.140002290
mov rcx, rbx
call sub.msvcrt.dll_free
xor ebx, ebx
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rax, rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140001550
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x98
mov r12, r9
mov r14, r8
mov rdi, rdx
mov r15, rcx
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
lea rdx, [0x140017325]
lea rcx, [rsp + 0x40]
mov r8d, 0x58
call fcn.14000a000
test eax, eax
je 0x1400015cf
add rdi, 0x12
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
mov rdx, rdi
mov r8d, eax
call fcn.1400021d0
mov ebp, 0xffffffff
jmp 0x1400017b4
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
mov rsi, rax
test rax, rax
je 0x14000173e
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
je 0x140001752
mov rbx, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x28], rsi
mov eax, dword [rdi + 8]
mov ebp, 0xffffffff
cmp rax, 0x2000
mov esi, 0x2000
mov qword [rsp + 0x30], rax
cmovb rsi, rax
mov edx, 1
mov rcx, qword [rsp + 0x28]
mov r8, rsi
mov r15, qword [rsp + 0x38]
mov r9, r15
call sub.msvcrt.dll_fread
cmp rax, rsi
jne 0x140001795
mov rcx, r15
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x140001795
sub qword [rsp + 0x30], rsi
mov dword [rsp + 0x48], esi
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x40], rax
nop word [rax + rax]
mov dword [rsp + 0x58], 0x2000
mov qword [rsp + 0x50], rbx
lea rcx, [rsp + 0x40]
xor edx, edx
call fcn.14000a160
mov esi, eax
lea eax, [rsi + 4]
cmp eax, 7
jae 0x1400016a1
mov ecx, 0x47
bt ecx, eax
jb 0x140001772
mov eax, dword [rsp + 0x58]
mov r13d, 0x2000
sub r13, rax
test r14, r14
je 0x1400016f0
mov edx, 1
mov rcx, rbx
mov r8, r13
mov r9, r14
call sub.msvcrt.dll_fwrite
mov r15d, 0xffffffff
cmp rax, r13
jne 0x14000177f
mov rcx, r14
call sub.msvcrt.dll_ferror
test eax, eax
je 0x140001706
jmp 0x14000177f
test r12, r12
je 0x140001714
mov rcx, r12
mov rdx, rbx
mov r8, r13
call sub.msvcrt.dll_memcpy
add r12, r13
mov eax, dword [rsp + 0x58]
test eax, eax
je 0x140001670
jmp 0x14000171f
xor r12d, r12d
test eax, eax
je 0x140001670
cmp esi, 1
mov rax, qword [rsp + 0x30]
je 0x140001732
test rax, rax
jne 0x14000160d
mov r15d, esi
cmp esi, 1
jne 0x14000177f
xor ebp, ebp
jmp 0x140001795
add rdi, 0x12
lea rcx, [0x140017120]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
jmp 0x140001764
add rdi, 0x12
lea rcx, [0x140017120]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
mov r8, rdi
call fcn.140002290
xor ebx, ebx
xor ebp, ebp
jmp 0x14000179a
mov eax, eax
lea rcx, [0x1400174e4]
mov r15d, dword [rcx + rax*4]
add rdi, 0x12
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
mov rdx, rdi
mov r8d, r15d
call fcn.1400021d0
mov rsi, qword [rsp + 0x28]
lea rcx, [rsp + 0x40]
call fcn.14000c400
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, rbx
call sub.msvcrt.dll_free
mov eax, ebp
add rsp, 0x98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400017d0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
mov eax, 0x1038
call fcn.14000de6c
sub rsp, rax
cmp dword [rcx + 0x5074], 1
jne 0x140001885
mov rbx, rdx
mov r15, rcx
cmp byte [rdx + 0x11], 0x6e
jne 0x14000189b
mov rcx, r15
mov rdx, rbx
call fcn.1400013f0
mov rsi, rax
test rax, rax
je 0x14000185c
add r15, 0x3070
lea rdi, [rbx + 0x12]
mov rcx, r15
mov rdx, rdi
call fcn.140006ec0
test eax, eax
js 0x14000185c
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x5c
lea r8, [0x140017464]
lea rcx, [rsp + 0x30]
mov r9, r15
call fcn.140001e20
cmp eax, 0x1000
jl 0x140001942
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, 0xffffffff
add rbx, 0x12
lea rcx, str.Failed_to_create_symbolic_link__s__n
mov rdx, rbx
mov esi, eax
call fcn.1400021d0
mov eax, esi
jmp 0x140001a0f
lea rcx, str.pyi_arch_extract2fs_was_called_before_temporary_directory_was_initialized__n
call fcn.1400021d0
mov eax, 0xffffffff
jmp 0x140001a0f
lea rcx, [r15 + 0x3070]
lea r14, [rbx + 0x12]
mov rdx, r14
call fcn.140007020
test rax, rax
je 0x140001909
mov rsi, rax
lea rcx, [r15 + 0x70]
lea rdx, [0x1400170a8]
call fcn.1400034e0
test rax, rax
je 0x140001929
mov rdi, rax
mov edx, dword [rbx + 4]
add edx, dword [r15]
mov rcx, rax
xor r8d, r8d
call fcn.14000e630
test eax, eax
js 0x140001968
cmp byte [rbx + 0x10], 1
jne 0x140001978
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
xor r9d, r9d
call fcn.140001550
mov ebx, eax
jmp 0x1400019fd
lea rcx, str.fopen
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
mov r8, r14
call fcn.140002290
mov eax, 0xffffffff
jmp 0x140001a0f
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
mov rdx, r14
call fcn.1400021d0
mov ebx, 0xffffffff
jmp 0x140001a05
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400035c0
mov edi, eax
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, edi
test edi, edi
jns 0x140001a0f
jmp 0x140001869
lea rcx, str.fseek
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
jmp 0x1400019f0
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
je 0x1400019e2
mov r15, rax
mov r12d, dword [rbx + 0xc]
test r12, r12
je 0x140001a20
cmp r12, 0x2000
mov ebx, 0x2000
cmovb rbx, r12
mov r8d, 1
mov rcx, r15
mov rdx, rbx
mov r9, rdi
call sub.msvcrt.dll_fread
test rax, rax
je 0x140001a2c
mov r8d, 1
mov rcx, r15
mov rdx, rbx
mov r9, rsi
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x140001a3c
sub r12, rbx
jne 0x140001997
xor ebx, ebx
jmp 0x140001a57
lea rcx, [0x140017120]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
mov r8, r14
call fcn.140002290
mov ebx, 0xffffffff
mov rcx, rdi
call sub.msvcrt.dll_fclose
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov eax, ebx
add rsp, 0x1038
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov rcx, r15
call sub.msvcrt.dll_free
xor ebx, ebx
jmp 0x1400019fd
lea rcx, [0x140017236]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
jmp 0x140001a4a
lea rcx, [0x1400174a7]
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
mov r8, r14
call fcn.140002290
mov ebx, 0xffffffff
mov rcx, r15
call sub.msvcrt.dll_free
jmp 0x1400019fd
Function at 0x140001a70
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, rcx
add rcx, 0x70
lea rdx, [0x1400170a8]
call fcn.1400034e0
test rax, rax
je 0x140001bb4
mov rsi, rax
mov rax, qword [0x140017500]
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
shr eax, 0x18
add al, 0xc
mov byte [rsp + 0x23], al
lea rdx, [rsp + 0x20]
mov r8d, 8
mov rcx, rsi
call fcn.140007620
mov edi, 0xffffffff
test rax, rax
je 0x140001c5c
mov r14, rax
mov rcx, rsi
mov edx, r14d
xor r8d, r8d
call fcn.14000e630
test eax, eax
js 0x140001bbe
lea rcx, [rbx + 0x18]
mov edx, 0x58
mov r8d, 1
mov r9, rsi
call sub.msvcrt.dll_fread
test rax, rax
je 0x140001bd6
mov eax, dword [rbx + 0x20]
mov ecx, dword [rbx + 0x24]
bswap eax
mov dword [rbx + 0x20], eax
bswap ecx
mov dword [rbx + 0x24], ecx
mov edx, dword [rbx + 0x28]
bswap edx
mov dword [rbx + 0x28], edx
mov edx, dword [rbx + 0x2c]
bswap edx
mov dword [rbx + 0x2c], edx
sub r14, rax
add r14, 0x58
mov qword [rbx], r14
mov dword [rbx + 0x5078], 0
mov dword [0x1400210cc], edx
add r14d, ecx
mov rcx, rsi
mov edx, r14d
xor r8d, r8d
call fcn.14000e630
movsxd r14, dword [rbx + 0x28]
mov rcx, r14
call sub.msvcrt.dll_malloc
mov qword [rbx + 8], rax
test rax, rax
je 0x140001beb
mov r8d, 1
mov rcx, rax
mov rdx, r14
mov r9, rsi
call sub.msvcrt.dll_fread
test rax, rax
je 0x140001c00
mov r14, qword [rbx + 8]
movsxd r12, dword [rbx + 0x28]
lea r15, [r14 + r12]
mov qword [rbx + 0x10], r15
mov rcx, rsi
call sub.msvcrt.dll_ferror
test eax, eax
je 0x140001c15
lea rcx, str.Error_on_file._n
call fcn.1400021d0
jmp 0x140001c5c
mov edi, 0xffffffff
jmp 0x140001c64
lea rcx, str.fseek
lea rdx, str.Failed_to_seek_to_cookie_position__n
call fcn.140002290
jmp 0x140001c5c
lea rcx, [0x140017236]
lea rdx, str.Failed_to_read_cookie__n
call fcn.140002290
jmp 0x140001c5c
lea rcx, [0x140017120]
lea rdx, str.Could_not_allocate_buffer_for_TOC__n
call fcn.140002290
jmp 0x140001c5c
lea rcx, [0x140017236]
lea rdx, str.Could_not_read_full_TOC__n
call fcn.140002290
jmp 0x140001c5c
xor edi, edi
test r12d, r12d
jle 0x140001c5c
pxor xmm0, xmm0
movdqu xmm1, xmmword [r14]
movdqa xmm2, xmm1
punpckhbw xmm2, xmm0
pshuflw xmm2, xmm2, 0x1b
pshufhw xmm2, xmm2, 0x1b
punpcklbw xmm1, xmm0
pshuflw xmm1, xmm1, 0x1b
pshufhw xmm1, xmm1, 0x1b
packuswb xmm1, xmm2
movdqu xmmword [r14], xmm1
movd eax, xmm1
cdqe
add r14, rax
cmp r14, r15
jb 0x140001c20
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov eax, edi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400067b0
Capabilities:
Query environment variable

Disassembly:
push rsi
push rdi
mov eax, 0x4028
call fcn.14000de6c
sub rsp, rax
mov rdx, rcx
xor esi, esi
xor ecx, ecx
xor r8d, r8d
call fcn.140007a80
lea rdx, [rsp + 0x20]
mov rcx, rax
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000682a
lea rdi, [rsp + 0x20]
lea rdx, [rsp + 0x2020]
mov rcx, rdi
mov r8d, 0x2000
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
xor ecx, ecx
mov rdx, rdi
xor r8d, r8d
call fcn.140007830
test rax, rax
je 0x14000682a
cmp byte [rax], 0
je 0x140006828
mov rcx, rax
call sub.msvcrt.dll__strdup
mov rsi, rax
jmp 0x14000682a
xor esi, esi
mov rax, rsi
add rsp, 0x4028
pop rdi
pop rsi
ret

Function at 0x1400068a0
Capabilities:
Set environment variable

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdx, rcx
xor ecx, ecx
xor r8d, r8d
call fcn.140007a80
mov rsi, rax
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov edi, eax
mov rcx, rsi
call sub.msvcrt.dll_free
mov eax, edi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x140006c80
Capabilities:
Delete directory

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
mov eax, 0x44a0
call fcn.14000de6c
sub rsp, rax
mov rdx, rcx
lea rsi, [rsp + 0x2490]
mov r8d, 0x1000
mov rcx, rsi
call fcn.140007a80
lea rdi, [rsp + 0x480]
mov rcx, rdi
mov rdx, rsi
call sub.msvcrt.dll_wcscpy
mov rcx, rdi
call sub.msvcrt.dll_wcslen
mov rsi, rax
movzx eax, word [rsp + rax*2 + 0x47e]
cmp eax, 0x2f
je 0x140006cf4
cmp eax, 0x5c
je 0x140006cf4
lea rdx, [0x140019428]
lea rcx, [rsp + 0x480]
call sub.msvcrt.dll_wcscat
inc rsi
lea rdx, [0x14001942c]
lea rdi, [rsp + 0x480]
mov rcx, rdi
call sub.msvcrt.dll_wcscat
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.14000e370
cmp rax, 0xffffffffffffffff
je 0x140006db7
mov rdi, rax
lea rbx, [rsp + 0x250]
lea r14, [rsp + 0x20]
mov r8d, 0x230
mov rcx, rbx
mov rdx, r14
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x480]
mov rdx, rsi
mov r8, rbx
call fcn.140006de0
mov rcx, rdi
mov rdx, r14
call fcn.14000e3f0
test eax, eax
jne 0x140006dae
lea rbx, [rsp + 0x250]
lea r14, [rsp + 0x20]
lea r15, [rsp + 0x480]
nop word [rax + rax]
mov r8d, 0x230
mov rcx, rbx
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov rcx, r15
mov rdx, rsi
mov r8, rbx
call fcn.140006de0
mov rcx, rdi
mov rdx, r14
call fcn.14000e3f0
test eax, eax
je 0x140006d80
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__findclose]
lea rcx, [rsp + 0x2490]
call qword [sym.imp.msvcrt.dll__wrmdir]
nop
add rsp, 0x44a0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x140006de0
Capabilities:
Delete directory
Delete file

Disassembly:
push r14
push rsi
push rdi
push rbx
mov eax, 0x1028
call fcn.14000de6c
sub rsp, rax
mov rdi, r8
mov r14, rdx
mov rsi, rcx
lea rbx, [r8 + 0x24]
lea rdx, [0x1400195ee]
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140006eb2
lea rdx, [0x1400195f2]
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140006eb2
mov word [rsi + r14*2], 0
mov rcx, rsi
mov rdx, rbx
call sub.msvcrt.dll_wcscat
test byte [rdi], 0x10
jne 0x140006e72
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__wremove]
test eax, eax
je 0x140006eb2
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rsi
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.msvcrt.dll__wremove]
mov rcx, rsi
call fcn.140007e20
test eax, eax
je 0x140006e94
mov rcx, rsi
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [sym.imp.msvcrt.dll__wrmdir]
lea rdi, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rdi
mov rdx, rsi
call fcn.140007830
mov rcx, rdi
call fcn.140006c80
nop
add rsp, 0x1028
pop rbx
pop rdi
pop rsi
pop r14
ret