joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4237a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x42389e
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp + 8], 0
jmp 0x4237e0
mov rax, qword [rsp + 0x50]
mov rcx, rdx
mov rbx, qword [rsp + 0x58]
nop
cmp qword [rsp + 8], rbx
jae 0x42388f
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov rax, rcx
call fcn.00424300
nop dword [rax]
test rax, rax
je 0x42388f
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
lea rcx, [0x004238e0]
mov qword [rsp + 0x10], rcx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rbx, [rsp + 0x10]
mov qword [rsp], rbx
call fcn.004648a0
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x60]
test rdx, rdx
jne 0x42387d
xor eax, eax
jmp 0x423887
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x60]
test al, al
je 0x4237d2
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004237a0

Function at 0x45cbc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45cc79
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0045ccc0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004648a0
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0045cbc0
Function at 0x466a80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402f8f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00409bc0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402f60
cmp byte [0x005d15cf], 0
je 0x466a95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x463ae0
jmp 0x402f60

Function at 0x466aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a02f
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.0040a120
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x005d18a0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.0040a100
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
nop dword [rax]
call fcn.0040a100
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x409fc0
cmp byte [0x005d15cf], 0
je 0x466ad5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005d1be0]
aesenc xmm0, xmmword [0x005d1bf0]
aesenc xmm0, xmmword [0x005d1c00]
movq rax, xmm0
ret
jmp 0x409fc0

Function at 0x466ae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40a0cf
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
mov qword [rsp + 0x28], rbx
call fcn.0040a160
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x005d18a0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.0040a100
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
nop dword [rax]
call fcn.0040a100
mov rbp, qword [rsp + 0x10]
add rsp, 0x18
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40a060
cmp byte [0x005d15cf], 0
je 0x466b16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005d1be0]
aesenc xmm0, xmmword [0x005d1bf0]
aesenc xmm0, xmmword [0x005d1c00]
movq rax, xmm0
ret
jmp 0x40a060

Function at 0x468520
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x005d1b60]
mov qword [rsp + 8], rdx
lea r8d, [0x005d15e8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.004669c0
add rsp, 0x30
ret
Function at 0x468a60
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x468a90
mov rcx, 0x28
jmp 0x468a9b
shl rcx, 3
add rcx, 0x1480
mov qword [0x005d17a8], rcx
ret
Function at 0x4943e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4945d6
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00402ee0
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x494472
jmp 0x4944bd
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x004f81c8]
mov qword [rsp + 0x40], rdx
lea rsi, [0x004f7b08]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rcx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rcx
inc rcx
mov qword [rsp + 0x30], rcx
lea rax, [0x004d3ce0]
mov rbx, rcx
nop dword [rax]
call fcn.0044d1a0
mov rdx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x30]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rdx
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rdx
mov qword [rsp + 0xa0], rsi
mov rdx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdx
mov rsi, qword [rsp + 0x98]
mov qword [rsp + 0x28], rsi
cmp rsi, rdx
jg 0x49454a
jmp 0x494551
mov qword [rsp + 0x28], rdx
jmp 0x494553
jmp 0x494553
mov rdx, qword [rsp + 0x90]
nop dword [rax + rax]
cmp qword [rsp + 0x50], rdx
jne 0x494569
jmp 0x494587
mov rcx, qword [rsp + 0x28]
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x50]
call fcn.004679e0
jmp 0x494589
jmp 0x494589
mov rdx, qword [rsp + 0x78]
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004943e0
Function at 0x4947a0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4949fa
sub rsp, 0xb0
mov qword [rsp + 0xa8], rbp
lea rbp, [rsp + 0xa8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x40], xmm15
mov rax, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0xc0]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov byte [rsp + 0x10], 0
call fcn.00402ee0
xorps xmm15, xmm15
mov r14, qword [0x005d17a8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
cmp rax, 0xffffffffffffffff
jne 0x494832
jmp 0x49487d
mov qword [rsp + 0x60], 0
movups xmmword [rsp + 0x68], xmm15
lea rdx, [0x004f81c8]
mov qword [rsp + 0x40], rdx
lea rsi, [0x004f7b08]
mov qword [rsp + 0x48], rsi
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov rdx, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rdx
lea rcx, [rdx + rdx]
lea rcx, [rcx + 1]
lea rax, [0x004d3c20]
xor ebx, ebx
nop dword [rax + rax]
call fcn.0044d1a0
mov rdx, qword [rsp + 0x38]
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 0
lea rdx, [rdx + rdx]
lea rdx, [rdx + 1]
mov qword [rsp + 0x88], rdx
mov rdx, qword [rsp + 0xb8]
mov rsi, qword [rsp + 0xc0]
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], 0
jmp 0x4948f0
mov rdx, qword [rsp + 0x30]
cmp qword [rsp + 0x58], rdx
jg 0x494905
nop dword [rax]
jmp 0x49498e
mov rdx, qword [rsp + 0x30]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x50]
add rdx, qword [rsp + 0x30]
movzx edx, byte [rdx]
mov dword [rsp + 0x24], edx
cmp edx, 0x80
jl 0x49492a
jmp 0x494931
inc qword [rsp + 0x30]
jmp 0x494950
mov rcx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
call fcn.00460020
mov dword [rsp + 0x24], eax
mov qword [rsp + 0x30], rbx
jmp 0x494950
mov edi, dword [rsp + 0x24]
mov dword [rsp + 0x20], edi
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
call fcn.004920a0
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x88], rcx
jmp 0x494989
jmp 0x4948f0
mov rax, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor edi, edi
call fcn.004920a0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rbx
mov qword [rsp + 0xa0], rcx
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rcx
movups xmmword [rsp + 0x40], xmm15
mov rbx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
xor edi, edi
xor esi, esi
mov rbp, qword [rsp + 0xa8]
add rsp, 0xb0
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004649e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004947a0
Function at 0x1800016b4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x140
mov rdi, rcx
cmp edx, 1
jne 0x18000172e
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x104
mov rbx, rax
call fcn.180003930
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.rundll32.exe
lea rcx, [rsp + 0x30]
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x18000172e
and qword [rsp + 0x28], rax
lea r8, [0x18000195c]
and dword [rsp + 0x20], eax
mov r9, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x150]
mov eax, 1
add rsp, 0x140
pop rdi
ret
Function at 0x180001744
Capabilities:
Allocate or change rwx memory
Read file via mapping
Resolve function by parsing pe exports

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x90
mov qword [r11 - 0x40], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
xor eax, eax
mov qword [r11 - 0x58], rax
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x48], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsp + 0x40], rax
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x58], rax
mov r9d, SafeArrayCopy
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
nop
mov r12, qword [rsp + 0x60]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r15 + 1]
lea rcx, str.c:windows_system32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r13, rax
mov qword [rsp + 0x80], rax
movsxd rbx, dword [r12 + 0x3c]
add rbx, r12
mov qword [rsp + 0x88], rbx
movzx edi, r15w
cmp di, word [rbx + 6]
jae 0x180001902
movzx eax, di
lea rdx, [rax + rax*4]
movzx ecx, word [rbx + 0x14]
add rcx, rbx
lea r15, [rcx + rdx*8]
lea rdx, str..text
lea rcx, [r15 + 0x18]
call fcn.18000f840
test eax, eax
jne 0x1800018fa
mov esi, dword [r15 + 0x24]
lea rsi, [rsi + r12]
mov r14d, dword [r15 + 0x20]
mov dword [rsp + 0xc0], eax
lea r9, [rsp + 0xc0]
lea r8d, [rax + 0x40]
mov edx, r14d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
mov edx, dword [r15 + 0x24]
add rdx, r13
test r14, r14
je 0x1800018dd
test rsi, rsi
je 0x1800018cc
mov r8, r14
mov rcx, rsi
test rdx, rdx
je 0x1800018c7
call fcn.180005e50
jmp 0x1800018dd
call fcn.180003930
call fcn.180006794
mov dword [rax], reloc.OLEAUT32.dll_SafeArrayAccessData
call fcn.180006600
nop
lea r9, [rsp + 0xc0]
mov r8d, dword [rsp + 0xc0]
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
inc di
jmp 0x180001844
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180002018
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rdi, rcx
mov ecx, SafeArrayCopy
call fcn.180002498
mov rbx, rax
mov esi, 1
test rax, rax
je 0x18000206e
and qword [rax + 8], 0
lea rcx, str.Sharp
mov dword [rax + 0x10], esi
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1800021cb
jmp 0x180002070
xor ebx, ebx
test rbx, rbx
je 0x1800021cb
call fcn.1800016ac
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800020a6
movsxd rdx, dword [rax + 0x3c]
lea rcx, [rdx - 0x40]
cmp rcx, 0x3bf
ja 0x1800020a6
cmp dword [rax + rdx], 0x4550
jne 0x1800020a6
mov rax, qword [rbp + 0x6f]
mov ecx, SafeArrayAccessData
mov qword [rbp - 9], rax
mov word [rbp - 0x11], cx
lea rcx, [rbp + 0x27]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
and dword [rbp + 0x6f], 0
mov ecx, SafeArrayGetDim
mov r8d, esi
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov rcx, rax
lea r8, [rbp - 0x11]
lea rdx, [rbp + 0x6f]
mov rsi, rax
call qword [sym.imp.OLEAUT32.dll_SafeArrayCopy]
movups xmm0, xmmword [rbp - 0x29]
mov rcx, qword [rdi]
movsd xmm1, qword [rbp - 0x19]
movaps xmmword [rbp + 7], xmm0
movsd qword [rbp + 0x17], xmm1
test rcx, rcx
je 0x1800021c0
mov rax, qword [rcx]
lea rdx, [rbp + 0x27]
mov qword [rsp + 0x30], rdx
xor r9d, r9d
lea rdx, [rbp + 7]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdx
mov r8d, 0x118
mov rdx, qword [rbx]
call qword [rax + 0x1c8]
mov rcx, rsi
call qword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
lea rcx, [rbp - 0x29]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x27]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp - 0x11]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
or eax, 0xffffffff
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x18000219f
mov rcx, qword [rbx]
test rcx, rcx
je 0x18000217f
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
and qword [rbx], 0
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180002192
call fcn.1800028b8
and qword [rbx + 8], 0
mov edx, SafeArrayCopy
mov rcx, rbx
call fcn.1800028b8
mov rcx, qword [rdi]
test rcx, rcx
je 0x1800021ad
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetDim]
mov rbx, qword [rsp + 0xd0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
mov ecx, 0x80004003
call fcn.1800031a0
int3
mov ecx, 0x8007000e
call fcn.1800031a0
int3
Function at 0x140001050
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.13
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000b3b0
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002ad0
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.140010f20
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140002830
jmp 0x14000126c
mov ecx, 0x2000
call fcn.140010f20
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140002830
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000e188
cmp rax, rbx
jne 0x14000125e
mov rcx, rdi
call fcn.14000defc
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140009820
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.14000e6b0
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000defc
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000c920
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002ad0
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000b080
mov rcx, r13
call fcn.140010f0c
mov rcx, rbp
call fcn.140010f0c
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x1050
call fcn.14000bb50
sub rsp, rax
mov rax, qword [0x140039018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rsi, rdx
mov r13, rcx
add rcx, 0x70
lea rdx, [0x1400267d4]
mov ebp, 0xffffffff
call fcn.140003f50
mov r14, rax
test rax, rax
jne 0x140001311
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002ad0
xor ebx, ebx
jmp 0x14000143a
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r13]
mov rcx, r14
call fcn.14000e458
test eax, eax
jns 0x14000134d
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002830
mov rcx, r14
call fcn.14000de6c
xor ebx, ebx
jmp 0x14000143a
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x1048], r12
call fcn.140010f20
mov r12, rax
mov rbx, rax
test rax, rax
jne 0x140001390
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002830
mov rcx, r14
call fcn.14000de6c
jmp 0x140001432
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1040], r15
jne 0x140001463
mov r9, r12
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
jne 0x1400014d7
mov rcx, r14
add rsi, 0x12
call fcn.14000de6c
mov rdx, rsi
lea rcx, [r13 + 0x3070]
call fcn.140007670
test eax, eax
js 0x140001422
mov qword [rsp + 0x28], rsi
lea r9, [r13 + 0x3070]
lea r8, str._s_c_s
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.140001e90
cmp eax, 0x1000
jge 0x140001422
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1400040f0
mov ebp, eax
mov rdi, qword [rsp + 0x1090]
mov r15, qword [rsp + 0x1040]
mov r12, qword [rsp + 0x1048]
mov rcx, rbx
call fcn.140010f0c
mov eax, ebp
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14000bbb0
add rsp, 0x1050
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [rsi + 0xc]
mov r15, r12
test rdi, rdi
je 0x1400013c3
mov eax, 0x2000
nop word [rax + rax]
cmp rdi, rax
mov rbp, rdi
mov r9, r14
mov r8d, 1
cmova rbp, rax
mov rcx, r15
mov rdx, rbp
call fcn.14000e188
cmp rax, 1
jb 0x1400014bb
add r15, rbp
mov eax, 0x2000
sub rdi, rbp
jne 0x140001480
mov ebp, 0xffffffff
jmp 0x1400013c3
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002830
mov ebp, 0xffffffff
mov rcx, r12
call fcn.140010f0c
mov rcx, r14
call fcn.14000de6c
xor ebx, ebx
jmp 0x140001422