joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f8e0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x007c99b0]
test rcx, rcx
jne 0x43f904
xor ecx, ecx
xor edx, edx
jmp 0x43f919
call fcn.00453e00
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.0043f880
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.004391a0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x43f986
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x43f9c2
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x0043fbe0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.00460560
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x43fa2b
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x0043fb60]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.00460560
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043f880
mov rcx, qword [rsp + 0x20]
mov al, byte [0x00746098]
test al, al
je 0x43fa6b
lea rax, [0x006b6158]
mov qword [rsp], rax
call fcn.00460560
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043f880
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x43fab8
lea rax, fcn.0043aa20
mov qword [rsp], rax
call fcn.00460560
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043f880
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x00746088]
test al, al
je 0x43fb44
lea rax, [0x006b6150]
mov qword [rsp], rax
call fcn.00460560
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043f880
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret
Function at 0x4447e0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444947
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x4447f2
cmp edx, ecx
jne 0x444935
nop word [rax + rax]
test rsi, rsi
jne 0x444935
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x444854
nop
call fcn.00464260
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00444700
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x444930
mov rdx, qword [0x00744f08]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x444925
mov rcx, qword [0x00744f00]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00745ff0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00745ff0], rax
nop
mov edx, 1
lea rsi, [0x00745ff8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x444913
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004acacf]
mov ebx, 0x28
nop
call fcn.00434820
mov rax, rsi
mov rcx, rdx
call fcn.00462960
call fcn.00433400
lea rax, [0x004abe5f]
mov ebx, 0x23
call fcn.00434820
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004447e0
Function at 0x4483a0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x4483e8
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x4483e8
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x4483f8
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.00432220
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x4484d1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.004324a0
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x4484d1
cmp qword [rcx + 8], rax
ja 0x4483f3
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x44fdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x44ff37
movzx edx, byte [rax]
test edx, edx
jne 0x44fdf4
nop dword [rax]
test r8b, r8b
jne 0x44fdf4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x44fe07
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x44fef7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x44fee5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x44fed7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44fe5d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x44fea0
mov eax, 1
cmp rax, rbx
ja 0x44fe8b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00462a20
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44fecf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x44fe93
mov rcx, r11
mov eax, r12d
jmp 0x44fe62
mov rcx, rbx
call fcn.00462960
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00462960
mov eax, r8d
mov rcx, rbx
call fcn.00462a20
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44ff2d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x44fef0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44fe0d
mov eax, edx
mov rcx, rbx
call fcn.00462960
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00462960
nop
int3

Function at 0x455c60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x455d15
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.004538e0
nop
test bl, bl
je 0x455d0f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00455d60]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00460560
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00455c60
Function at 0x458c80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458d2f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00458d80]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00460560
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00458c80
Function at 0x462480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403d43
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409ae0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403d20
cmp byte [0x007c99e8], 0
je 0x462495
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45f6c0
jmp 0x403d20

Function at 0x4624a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007c9cc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x007c99e8], 0
je 0x4624d5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x007c9fe0]
aesenc xmm0, xmmword [0x007c9ff0]
aesenc xmm0, xmmword [0x007ca000]
movq rax, xmm0
ret
jmp 0x409d00

Function at 0x4624e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007c9cc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x007c99e8], 0
je 0x462516
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007c9fe0]
aesenc xmm0, xmmword [0x007c9ff0]
aesenc xmm0, xmmword [0x007ca000]
movq rax, xmm0
ret
jmp 0x409d60

Function at 0x4642a0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4642d4
mov rcx, 0x28
jmp 0x4642df
shl rcx, 3
add rcx, 0x1480
mov qword [0x007c9bf0], rcx
pop rbp
ret
Function at 0x47b280
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b34a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004032e0
xorps xmm15, xmm15
mov r14, qword [0x007c9bf0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47b32f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00491c00]
xor ebx, ebx
mov rcx, rdx
call fcn.00448f20
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047b5e0
inc rbx
cmp rcx, rbx
jae 0x47b31e
mov edi, 1
lea rsi, [0x00491c00]
call fcn.00449000
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006cfb78]
lea rsi, [0x006cf558]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460680
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047b280
Function at 0x140011244
Capabilities:
Terminate process

Disassembly:
jmp 0x140013850
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112df
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014ba0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014bc0
xor al, al
jmp 0x140014c41
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014bd3
xor al, al
jmp 0x140014c41
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140014bfd
xor al, al
jmp 0x140014c41
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140014c11
xor al, al
jmp 0x140014c41
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140014c23
xor al, al
jmp 0x140014c41
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140014c3f
xor al, al
jmp 0x140014c41
mov al, 1
add rsp, 0x38
ret
Function at 0x4015e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x98
lea rbp, [rsp + 0x30]
mov qword [rsp + 0xf0], r8
mov r14, rcx
mov r12, rdx
lea rdx, [0x00410003]
mov r8d, 0x58
mov rcx, rbp
mov qword [rsp + 0xf8], r9
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
call fcn.00408d40
test eax, eax
mov ebx, eax
jne 0x40187a
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x401830
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x401850
mov r15d, dword [r12 + 8]
cmp r15, 0x2000
mov r9, qword [r14]
mov edx, 1
mov rcx, rsi
mov r13d, 0x2000
cmovbe r13, r15
mov r8, r13
call sub.msvcrt.dll_fread
cmp r13, rax
jne 0x401870
mov rcx, qword [r14]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x401870
mov dword [rsp + 0x38], r13d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], eax
xor edx, edx
mov rcx, rbp
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x48], 0x2000
call fcn.00408de0
cmp eax, 0xfffffffc
mov ebx, eax
jl 0x401755
cmp eax, 0xfffffffe
jle 0x401750
cmp eax, 2
jne 0x401755
mov r10d, 0xfffffffd
lea rdx, [r12 + 0x12]
mov r8d, r10d
mov ebx, 0xffffffff
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.00402260
mov rcx, rbp
call fcn.0040aa30
mov rcx, rsi
call sub.msvcrt.dll_free
mov rcx, rdi
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0x98
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov r10d, eax
jmp 0x401703
mov eax, dword [rsp + 0x48]
mov r11d, 0x2000
sub r11, rax
mov r9, rax
cmp qword [rsp + 0xf0], 0
je 0x4017f0
mov r8, r11
mov edx, 1
mov rcx, rdi
mov qword [rsp + 0x20], r11
mov r9, qword [rsp + 0xf0]
call sub.msvcrt.dll_fwrite
mov r11, qword [rsp + 0x20]
cmp r11, rax
jne 0x401898
mov rcx, qword [rsp + 0xf0]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x401898
mov r9d, dword [rsp + 0x48]
test r9d, r9d
je 0x4016d5
mov r10d, ebx
sub r15, r13
mov ebx, dword [rsp + 0x28]
cmp r10d, 1
je 0x4017db
test r15, r15
jne 0x40168a
cmp r10d, 1
je 0x40171c
jmp 0x401703
cmp qword [rsp + 0xf8], 0
je 0x4017b9
mov rcx, qword [rsp + 0xf8]
mov r8, r11
mov rdx, rdi
mov qword [rsp + 0x20], r11
mov dword [rsp + 0x2c], eax
call sub.msvcrt.dll_memcpy
mov r11, qword [rsp + 0x20]
mov r9d, dword [rsp + 0x2c]
add qword [rsp + 0xf8], r11
jmp 0x4017b9
lea r8, [r12 + 0x12]
xor edi, edi
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.004022c0
jmp 0x40171c
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.004022c0
jmp 0x40171c
mov ebx, 0xffffffff
jmp 0x40171c
lea rdx, [r12 + 0x12]
mov r8d, eax
mov ebx, 0xffffffff
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.00402260
jmp 0x401734
mov r10d, 0xffffffff
jmp 0x401703
Function at 0x401920
Capabilities:
Read file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, qword [rcx]
mov rbp, rdx
test rcx, rcx
je 0x401a40
mov edx, dword [rbp + 4]
xor r8d, r8d
add edx, dword [rsi + 8]
call fcn.0040da80
test eax, eax
js 0x401a54
mov ebx, dword [rbp + 0xc]
mov rcx, rbx
call sub.msvcrt.dll_malloc
test rax, rax
mov r12, rax
je 0x401a73
cmp byte [rbp + 0x10], 1
je 0x401a10
test rbx, rbx
mov r13, rax
mov r14d, 0x2000
jne 0x4019b8
mov rcx, qword [rsi]
test rcx, rcx
je 0x401999
call sub.msvcrt.dll_fclose
mov qword [rsi], 0
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
add r13, rdi
sub rbx, rdi
je 0x401985
cmp rbx, 0x2000
mov rdi, r14
mov r9, qword [rsi]
mov rcx, r13
cmovbe rdi, rbx
mov r8d, 1
mov rdx, rdi
call sub.msvcrt.dll_fread
test rax, rax
jne 0x4019b0
lea r8, [rbp + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.004022c0
mov rcx, r12
xor r12d, r12d
call sub.msvcrt.dll_free
mov rcx, qword [rsi]
test rcx, rcx
jne 0x40198d
jmp 0x401999
xor r8d, r8d
mov r9, rax
mov rdx, rbp
mov rcx, rsi
call fcn.004015e0
test eax, eax
jne 0x4019f6
mov rcx, qword [rsi]
test rcx, rcx
jne 0x40198d
jmp 0x401999
mov rcx, rsi
call fcn.004015b0
test eax, eax
jne 0x401a92
mov rcx, qword [rsi]
jmp 0x401940
lea r8, [rbp + 0x12]
xor r12d, r12d
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.004022c0
jmp 0x401999
lea r8, [rbp + 0x12]
mov r9d, ebx
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.004022c0
jmp 0x401985
lea rdx, [rbp + 0x12]
xor r12d, r12d
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.00402260
jmp 0x401999
Function at 0x401ab0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rsi, rdx
call fcn.00406660
cmp eax, 0xffffffff
mov edi, eax
je 0x401bf1
lea r12, [rsi + 0x12]
lea rcx, [rbx + 0x3078]
mov rdx, r12
call fcn.004068a0
test rax, rax
mov rbp, rax
je 0x401c7d
mov rcx, qword [rbx]
test rcx, rcx
je 0x401c10
mov edx, dword [rsi + 4]
xor r8d, r8d
add edx, dword [rbx + 8]
call fcn.0040da80
test eax, eax
js 0x401c44
cmp byte [rsi + 0x10], 1
je 0x401bc2
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov r13, rax
je 0x401c9d
mov esi, dword [rsi + 0xc]
mov r14d, 0x2000
test rsi, rsi
jne 0x401b76
jmp 0x401c02
mov r9, rbp
mov r8d, 1
mov rdx, rdi
mov rcx, r13
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x401c24
sub rsi, rdi
je 0x401c02
cmp rsi, 0x2000
mov rdi, r14
mov r9, qword [rbx]
mov rcx, r13
cmovbe rdi, rsi
mov r8d, 1
mov rdx, rdi
call sub.msvcrt.dll_fread
test rax, rax
jne 0x401b50
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
mov r8, r12
mov edi, 0xffffffff
lea rcx, str.fread
call fcn.004022c0
mov rcx, r13
call sub.msvcrt.dll_free
jmp 0x401bd5
xor r9d, r9d
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.004015e0
mov edi, eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x401be9
call sub.msvcrt.dll_fclose
mov qword [rbx], 0
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov eax, edi
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
xor edi, edi
jmp 0x401bb8
mov rcx, rbx
call fcn.004015b0
test eax, eax
jne 0x401c64
mov rcx, qword [rbx]
jmp 0x401aff
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
mov r8, r12
mov edi, 0xffffffff
lea rcx, str.fwrite
call fcn.004022c0
jmp 0x401bb8
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
mov r8, r12
mov edi, 0xffffffff
lea rcx, str.fseek
call fcn.004022c0
jmp 0x401bd5
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
mov rdx, r12
mov edi, 0xffffffff
call fcn.00402260
jmp 0x401bd5
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
mov r8, r12
mov edi, 0xffffffff
lea rcx, str.fopen
call fcn.004022c0
jmp 0x401bf1
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
mov r8, r12
mov edi, 0xffffffff
lea rcx, str.malloc
call fcn.004022c0
jmp 0x401bd5