joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000afbd
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000afdb
je 0x14000afe6
call 0x14000b035
mov bl, 0xc7
lahf
pop rsi
jne 0x14000afc6
call 0x14000afde
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000afc6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000b014
je 0x14000b052
invalid
je 0x14000b063
jne 0x14000afc6
lea rax, [0x14000aeec]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x140006c4d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000b104
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000b15d
je 0x14000b163
call 0x14000b154
fild qword [rdi - 0x7c]
jmp 0x174f478d6
jne 0x14000b126
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000b0e6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000afc0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000afdb
je 0x14000afe6
call 0x14000b035
mov bl, 0xc7
lahf
pop rsi
jne 0x14000afc6
call 0x14000afde
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000afc6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000b014
je 0x14000b052
invalid
je 0x14000b063
jne 0x14000afc6
lea rax, [0x14000aeec]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x140006c4d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000b104
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000b15d
je 0x14000b163
call 0x14000b154
fild qword [rdi - 0x7c]
jmp 0x174f478d6
jne 0x14000b126
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000b0e6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000afd0
Capabilities:
Contain obfuscated stackstrings
Parse pe header

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000afdb
je 0x14000afe6
call 0x14000b035
mov bl, 0xc7
lahf
pop rsi
jne 0x14000afc6
call 0x14000afde
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000afc6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000b014
je 0x14000b052
invalid
je 0x14000b063
jne 0x14000afc6
lea rax, [0x14000aeec]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x140006c4d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000b104
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000b15d
je 0x14000b163
call 0x14000b154
fild qword [rdi - 0x7c]
jmp 0x174f478d6
jne 0x14000b126
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000b0e6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret
Function at 0x14000b035
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, qword [rsp + 8]
and rdx, 0
dec rax
cmp word [rax], 0x5a4d
jne 0x14000afdb
je 0x14000afe6
call 0x14000b035
mov bl, 0xc7
lahf
pop rsi
jne 0x14000afc6
call 0x14000afde
mov ecx, edi
xor eax, 0x3c508b0b
mov edx, dword [rax + 0x3c]
cmp edx, 0x400
jae 0x14000afc6
sub rax, 0x48b5
add rdx, rax
add rdx, 0x48b5
add rax, 0x48b5
cmp word [rdx], 0x4550
jne 0x14000b014
je 0x14000b052
invalid
je 0x14000b063
jne 0x14000afc6
lea rax, [0x14000aeec]
sub rsp, 8
mov qword [rsp], rcx
mov rcx, 0xffffffffffff2810
add rcx, 0xd960
add rcx, rax
push rcx
xchg rcx, rax
add rsp, 8
mov rcx, qword [rsp - 8]
mov rcx, qword [rsp]
add rsp, 8
call rax
lodsd eax, dword [rsi]
push rbp
movabs byte [0x894808ec8348c391], al
sub al, 0x24
mov rbp, rsp
mov qword [rsp - 8], 0
ret
add byte [rax], al
add byte [rax], al
sub rsp, 8
pop rax
add rax, rcx
sub rsp, 0x1e0
sub rsp, 0x20
and spl, 0xf0
mov byte [rbp - 0xd], 0x56
mov byte [rbp - 0xc], 0x69
mov byte [rbp - 0xb], 0x72
mov byte [rbp - 0xa], 0x74
mov byte [rbp - 9], 0x75
mov byte [rbp - 8], 0x61
mov byte [rbp - 7], 0x6c
mov byte [rbp - 6], 0x41
mov byte [rbp - 5], 0x6c
mov byte [rbp - 4], 0x6c
mov byte [rbp - 3], 0x6f
mov byte [rbp - 2], 0x63
mov byte [rbp - 1], 0
mov qword [rsp - 8], rsi
sub rsp, 8
add rsp, 8
mov rcx, qword [rsp - 8]
lea rdx, [rbp - 0xd]
call rax
sub rsp, 8
mov qword [rsp], 0
add rsp, 8
mov rcx, qword [rsp - 8]
mov rdx, 0x61be
mov r8, 0x3000
mov r9, 0x40
call rax
mov rcx, 0x4615
lea r9, [0x140006c4d]
dec rcx
mov dl, byte [r9 + rcx]
mov byte [rax + rcx], dl
test rcx, rcx
jne 0x14000b104
mov rcx, 0x3fe0
mov r9d, 0x15c13
mov r10d, 0x92819200
dec rcx
mov dl, byte [rax + rcx]
xor dl, r9b
mov byte [rax + rcx], dl
sub r10d, 0x26fe2
add r9d, r10d
add r9d, 0x26fe2
add r10d, 0x26fe2
rol r9d, 1
test rcx, rcx
jne 0x14000b15d
je 0x14000b163
call 0x14000b154
fild qword [rdi - 0x7c]
jmp 0x174f478d6
jne 0x14000b126
xor al, 1
add byte [rbp - 0x7f], dh
jne 0x14000b0e6
add rax, 0x1ed4
mov rsp, rbp
pop rbp
ret

Function at 0x14000f58c
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14000f6bc
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x14000f723
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000f723
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000f723
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000f723
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000f723
cmp dword [rcx + 0x84], 0xe
jbe 0x14000f723
cmp dword [rcx + 0xf8], 0
je 0x14000f723
mov ecx, ebx
call fcn.14000f608
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.14000f83c
cmp dword [rbp + 0x20], 0
je 0x14000f770
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000f664
int3
Function at 0x140131ef5
Capabilities:
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov ecx, r8d
lea rdx, [r9 + rcx*4]
mov ecx, dword [rdx + r11]
jmp 0x140131f4d
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140131fae
jmp 0x140131ecf
mov r8d, 0x800
call rdi
xchg r9, rax
mov rax, r9
xchg r9, rax
mov r8d, r13d
movsxd rcx, dword [rax + 0x3c]
jmp 0x140131fb6
cmp edx, 0xe97d3e5a
je 0x140131fd4
inc r8d
jmp 0x140131e64
xor edx, edx
lea rcx, [rsp + 0x63]
jmp 0x140131e91
mov edx, 0x2e4c61bb
add rcx, r9
movzx eax, byte [rcx]
je 0x140131f8c
jne 0x140131f8c
lea ecx, [rbx + 0x62b9]
call rcx
jmp rax
jmp 0x140131fa0
inc rcx
test al, al
je 0x140131edb
nop dword [rax]
movsx eax, al
jmp 0x140131e74
mov r10d, dword [rcx + rax + 0x88]
mov r11d, dword [r10 + rax + 0x20]
nop dword [rax]
nop dword [rax + rax]
jmp 0x140131e64
mov ecx, dword [r10 + r9 + 0x24]
xchg r13, rax
mov r13, rax
xchg r13, rax
jne 0x140132020
je 0x140132020
or r14d, 0x800d63c6
jmp 0x1401320b8
add rcx, r9
mov edx, r8d
movzx r8d, word [rcx + rdx*2]
mov ecx, dword [r10 + r9 + 0x1c]
or r11b, byte [rcx + rcx*2]
add ecx, ecx
nop word [rax + rax]
mov byte [rsp + rax + 0x63], r13b
inc rax
jmp 0x14013204c
Function at 0x140001180
Capabilities:
Terminate process

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x140015be0]
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
mov rax, qword gs:[0x30]
mov rsi, qword [rax + 8]
jmp 0x1400011c0
cmp rsi, rax
je 0x140001320
mov ecx, 0x3e8
call rbp
mov rax, rdi
lock cmpxchg qword [rbx], rsi
test rax, rax
jne 0x1400011b0
mov rsi, qword [0x140015bf0]
xor edi, edi
mov eax, dword [rsi]
cmp eax, 1
je 0x140001337
mov eax, dword [rsi]
test eax, eax
je 0x1400013a0
mov dword [0x140019008], 1
mov eax, dword [rsi]
cmp eax, 1
je 0x14000134c
test edi, edi
je 0x14000136d
mov rax, qword [0x140015b50]
mov rax, qword [rax]
test rax, rax
je 0x140001223
xor r8d, r8d
mov edx, 2
xor ecx, ecx
call rax
call fcn.14000cf30
mov rcx, qword [0x140015c70]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rdx, qword [0x140015bd0]
lea rcx, section..text
mov qword [rdx], rax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_invalid_parameter_handler
call fcn.14000cd40
mov ebx, dword [0x140019028]
lea r12d, [rbx + 1]
movsxd r12, r12d
shl r12, 3
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, qword [0x140019020]
mov rbp, rax
test ebx, ebx
jle 0x1400013c0
sub r12, 8
xor ebx, ebx
nop dword [rax]
mov rcx, qword [rdi + rbx]
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
lea rsi, [rax + rax + 2]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
mov qword [rbp + rbx], rax
mov rdx, qword [rdi + rbx]
mov rcx, rax
add rbx, 8
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
cmp rbx, r12
jne 0x140001288
add rbx, rbp
mov qword [rbx], 0
mov qword [0x140019020], rbp
call fcn.14000ca80
mov rax, qword [0x140015b60]
mov r8, qword [0x140019018]
mov ecx, dword [0x140019028]
mov rax, qword [rax]
mov qword [rax], r8
mov rdx, qword [0x140019020]
call fcn.14000caa0
mov ecx, dword [0x14001900c]
mov dword [0x140019010], eax
test ecx, ecx
je 0x1400013c8
mov edx, dword [0x140019008]
test edx, edx
je 0x140001380
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rsi, qword [0x140015bf0]
mov edi, 1
mov eax, dword [rsi]
cmp eax, 1
jne 0x1400011e1
mov ecx, 0x1f
call fcn.14000e300
mov eax, dword [rsi]
cmp eax, 1
jne 0x140001200
mov rdx, qword [0x140015c10]
mov rcx, qword [0x140015c00]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
mov dword [rsi], 2
test edi, edi
jne 0x140001208
xor eax, eax
xchg qword [rbx], rax
jmp 0x140001208
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
mov eax, dword [0x140019010]
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rdx, qword [0x140015c30]
mov rcx, qword [0x140015c20]
mov dword [rsi], 1
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
jmp 0x1400011f5
mov rbx, rax
jmp 0x1400012be
mov ecx, eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
nop
Function at 0x140001880
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, rdx
lea rdx, [0x140010129]
mov rbx, rcx
call fcn.1400040d0
mov rbp, rax
test rax, rax
je 0x1400019b0
mov edx, dword [r12 + 4]
xor r8d, r8d
mov rcx, rax
add edx, dword [rbx + 0x1000]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x140001990
mov esi, dword [r12 + 0xc]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r13, rax
test rax, rax
je 0x1400019c6
cmp byte [r12 + 0x10], 1
je 0x140001970
mov rdi, rax
test rsi, rsi
jne 0x140001908
jmp 0x140001950
add rdi, rbx
sub rsi, rbx
je 0x140001950
mov ebx, 0x2000
mov r9, rbp
mov r8d, 1
mov rcx, rdi
cmp rsi, rbx
cmovbe rbx, rsi
mov rdx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test rax, rax
jne 0x140001900
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002a40
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor r13d, r13d
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r8d, r8d
mov r9, rax
mov rdx, r12
mov rcx, rbp
call fcn.140001490
test eax, eax
je 0x140001950
jmp 0x140001945
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002a40
jmp 0x14000194d
lea rdx, [r12 + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
xor r13d, r13d
call fcn.1400028e0
jmp 0x140001958
mov r9d, esi
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002a40
jmp 0x14000194d
Function at 0x1400019f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [rdx + 0x11], 0x6e
mov rbx, rcx
mov r13, rdx
mov rsi, r8
je 0x140001b10
lea rdx, [0x140010254]
mov rcx, r8
call fcn.1400040d0
mov r12, rax
test rax, rax
je 0x140001c01
lea rdx, [0x140010129]
mov rcx, rbx
call fcn.1400040d0
mov rbp, rax
test rax, rax
je 0x140001b98
mov edx, dword [r13 + 4]
xor r8d, r8d
add edx, dword [rbx + 0x1000]
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x140001be0
cmp byte [r13 + 0x10], 1
je 0x140001b48
mov ecx, 0x2000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
test rax, rax
je 0x140001c22
mov esi, dword [r13 + 0xc]
test rsi, rsi
jne 0x140001abe
jmp 0x140001bb0
mov r9, r12
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test rax, rax
je 0x140001bc0
sub rsi, rbx
je 0x140001bb0
mov ebx, 0x2000
mov r9, rbp
mov r8d, 1
mov rcx, rdi
cmp rsi, rbx
cmovbe rbx, rsi
mov rdx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test rax, rax
jne 0x140001a98
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002a40
mov ebx, 0xffffffff
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140001b5b
call fcn.140001880
mov rdi, rax
test rax, rax
je 0x140001b7a
mov rcx, rax
mov rdx, rsi
call fcn.140004170
mov rcx, rdi
mov ebx, eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test ebx, ebx
js 0x140001b80
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r9d, r9d
mov r8, r12
mov rdx, r13
mov rcx, rbp
call fcn.140001490
mov ebx, eax
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, r12
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ebx, 0xffffffff
nop
lea rdx, [r13 + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.1400028e0
jmp 0x140001b36
lea rdx, [r13 + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
mov ebx, 0xffffffff
call fcn.1400028e0
jmp 0x140001b63
xor ebx, ebx
jmp 0x140001aff
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
call fcn.140002a40
jmp 0x140001afa
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002a40
mov ebx, 0xffffffff
jmp 0x140001b5b
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
mov ebx, 0xffffffff
lea rcx, str.fopen
call fcn.140002a40
jmp 0x140001b36
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.140002a40
jmp 0x140001bf7
Function at 0x140007240
Capabilities:
Create directory

Disassembly:
push r15
mov eax, 0x3038
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000db10
sub rsp, rax
mov rbx, r8
mov r14, rcx
mov rcx, rdx
mov rdi, rdx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
mov rcx, rbx
mov rsi, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
lea rax, [rsi + rax + 1]
cmp rax, 0xfff
ja 0x140007340
mov dword [rsp + 0x20], 0x5c
lea rsi, [rsp + 0x30]
mov r9, rdi
lea r8, str._s_c
mov edx, 0x1000
mov rcx, rsi
mov ebp, 0x1000
lea r12, [0x140011bc5]
lea r13, [rsp + 0x1030]
call fcn.14000e150
mov edx, 0x5c
mov rcx, rbx
movsxd rdi, eax
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
sub rbp, rdi
add rdi, rsi
mov r15, rax
test rax, rax
jne 0x1400072f6
jmp 0x140007350
lea rcx, [r15 + 1]
mov edx, 0x5c
call sub.api_ms_win_crt_private_l1_1_0.dll_strchr
mov r15, rax
test rax, rax
je 0x140007350
mov qword [rsp + 0x20], rbx
mov r9d, r15d
mov rcx, rdi
mov r8, r12
sub r9d, ebx
mov rdx, rbp
call fcn.14000e150
mov rcx, rsi
call fcn.140004090
test eax, eax
jne 0x1400072e0
mov rdx, r13
mov rcx, rsi
mov r8d, 0x1000
call fcn.1400081f0
mov rdx, qword [r14 + 0x3038]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400072e0
mov eax, 0xffffffff
jmp 0x140007352
xor eax, eax
add rsp, 0x3038
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x140007370
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rdi
mov eax, 0x1020
push rsi
push rbx
call fcn.14000db10
sub rsp, rax
mov rsi, rdx
lea rdx, [0x140011bca]
call fcn.1400040d0
mov rbx, rax
test rax, rax
je 0x14000745e
mov rcx, rsi
lea rdx, [0x140011bcd]
call fcn.1400040d0
mov rsi, rax
test rax, rax
je 0x140007456
lea rdi, [rsp + 0x20]
jmp 0x1400073ff
mov r8d, 0x1000
mov r9, rbx
mov edx, 1
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
mov r8, rax
test rax, rax
je 0x140007440
mov r9, rsi
mov edx, 1
mov rcx, rdi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test rax, rax
je 0x140007430
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
test eax, eax
jne 0x140007430
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_feof
test eax, eax
je 0x1400073c0
xor edi, edi
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov eax, edi
add rsp, 0x1020
pop rbx
pop rsi
pop rdi
ret
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_clearerr
mov edi, 0xffffffff
jmp 0x14000740d
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
test eax, eax
je 0x14000740b
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_clearerr
jmp 0x140007438
mov rcx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov edi, 0xffffffff
jmp 0x14000741d
Function at 0x140007470
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, rcx
mov ecx, 0x2000
mov rbp, rdx
mov rdi, r8
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rsi, rax
test rax, rax
je 0x140007560
xor edx, edx
mov r8d, 2
mov rcx, r12
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x140007560
mov rcx, r12
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ftell
movsxd rbx, eax
cmp rbx, rdi
jb 0x140007560
mov r15d, 1
sub r15, rdi
mov qword [rsp + 0x28], r15
mov r13d, 0x2000
cmp rbx, r13
cmovae r13, rbx
lea r14, [r13 - 0x2000]
sub rbx, r14
cmp rbx, rdi
jb 0x140007560
xor r8d, r8d
mov edx, r14d
mov rcx, r12
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x140007560
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, rsi
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
cmp rax, rbx
jne 0x140007560
mov rdx, qword [rsp + 0x28]
lea rbx, [rdx + rax]
jmp 0x14000754a
lea r15, [rbx - 1]
mov r8, rdi
mov rdx, rbp
lea rcx, [rsi + r15]
call sub.api_ms_win_crt_private_l1_1_0.dll_memcmp
test eax, eax
je 0x140007580
mov rbx, r15
test rbx, rbx
jne 0x140007530
lea rbx, [r14 + rdi - 1]
test r14, r14
jne 0x1400074d9
nop dword [rax]
xor ebx, ebx
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [r13 + rbx - 0x2001]
jmp 0x140007562