joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47c88a
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x47c8c0
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 3
jbe 0x47c8c8
mov esi, dword [rdx]
mov r9d, 4
jmp 0x47c8cd
xor r10d, r10d
jmp 0x47c97b
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x47c8f0
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x47c907
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x47c927
add r11, r8
jmp 0x47ca4b
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x47c9ef
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x47c99d
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 3
jbe 0x47ca01
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x47ca07
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x47ca2d
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x47ca47
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret

Function at 0x47e5c3
Capabilities:
Set thread local storage value

Disassembly:
push rsi
push rdi
sub rsp, 0x68
mov rdi, rcx
mov rsi, qword [rcx]
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x47e5da
dec ecx
jmp 0x47e5e4
mov rcx, rsi
call dbg.init
mov ecx, eax
mov edx, 1
call fcn.004824b4
mov rcx, rdi
call sym._ZN4core3ptr211drop_in_place_LT_alloc..boxed..Box_LT_std..sys..common..thread_local..os_local..Value_LT_core..cell..RefCell_LT
mov ecx, dword [rsi + 0x18]
test ecx, ecx
je 0x47e601
dec ecx
jmp 0x47e60b
mov rcx, rsi
call dbg.init
mov ecx, eax
xor edx, edx
call fcn.004824b4
xor ecx, ecx
call sym._ZN4core3ptr130drop_in_place_LT_core..result..Result_LT__LP__RP__C_alloc..boxed..Box_LT_dyn_u20_core..any..Any_u2b_core..marke
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x47ee9f
Capabilities:
Create pipe

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov rdi, r9
mov rbx, r8
mov ebp, edx
mov rsi, rcx
lea r8, [rsp + 0x30]
mov dword [r8], 0x18
xor eax, eax
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], 1
lea rcx, [rsp + 0x20]
mov qword [rcx], rax
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
xor r9d, r9d
call sub.KERNEL32.dll_CreatePipe
test eax, eax
je 0x47ef42
mov rax, qword [rsp + 0x20]
mov r15, qword [rsp + 0x28]
test bpl, bpl
mov r14, rax
cmovne r14, r15
cmovne r15, rax
mov rcx, r14
xor edx, edx
call sym.subprocess::popen::os::set_inheritable::h23fd9eb92f84b0e7
test rax, rax
je 0x47ef64
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], rax
mov qword [rsi], 1
mov rcx, r15
call sub.KERNEL32.dll_CloseHandle
mov rcx, r14
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp sub.KERNEL32.dll_CloseHandle
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], rax
mov qword [rsi], 1
jmp 0x47efa0
cmp qword [rbx], 0
je 0x47ef73
mov rcx, qword [rbx + 8]
call sub.KERNEL32.dll_CloseHandle
mov qword [rbx], 1
mov qword [rbx + 8], r14
mov rcx, r15
call sym.alloc::rc::Rc_T_::new::h65d4ee56825b5967
mov rbx, rax
mov rcx, qword [rdi]
test rcx, rcx
je 0x47ef96
call sym.__alloc::rc::Rc_T_A__as_core::ops::drop::Drop_::drop::h233453c62e161623
mov qword [rdi], rbx
mov qword [rsi], 0
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x480d11
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x70
mov rsi, rcx
mov ecx, dword [0x00484130]
test ecx, ecx
je 0x480e92
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 2
jb 0x480d49
mov rbx, rax
cmp qword [rax + 8], 0
je 0x480d49
add rbx, 0x10
jmp 0x480e87
mov ecx, dword [0x00484130]
test ecx, ecx
je 0x480ea5
dec ecx
call sub.KERNEL32.dll_TlsGetValue
cmp rax, 1
je 0x480e25
mov rdi, rax
test rax, rax
jne 0x480dd8
mov qword [rsp + 0x28], 0
lea rax, sym.std::sys::common::thread_local::os_local::destroy_value::h840a6addf9c23629
mov qword [rsp + 0x20], rax
mov al, byte [0x004a0170]
mov ecx, 0x30
mov edx, 8
call sym.__rust_alloc
test rax, rax
je 0x480ecb
mov rdi, rax
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
movups xmm2, xmmword [rsp + 0x40]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov ecx, dword [0x00484130]
test ecx, ecx
je 0x480eb8
dec ecx
mov rdx, rdi
call fcn.004824b4
lea rbx, [rdi + 8]
test rsi, rsi
je 0x480e33
mov rax, qword [rsi + 0x20]
mov qword [rsp + 0x40], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x30], xmm1
movaps xmmword [rsp + 0x20], xmm0
mov qword [rsi], 0
cmp qword [rsp + 0x20], 0
je 0x480e29
movups xmm0, xmmword [rsp + 0x28]
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x68], rax
jmp 0x480e3b
xor ebx, ebx
jmp 0x480e87
lea rcx, [rsp + 0x20]
call sym._ZN4core3ptr159drop_in_place_LT_core..option..Option_LT_core..cell..RefCell_LT__u5b_core..option..Option_LT_alloc..rc..Rc_LT_s
xorps xmm0, xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rbx + 0x20]
lea rcx, [rsp + 0x20]
mov qword [rcx + 0x20], rax
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rcx + 0x10], xmm1
movaps xmmword [rcx], xmm0
mov qword [rdi + 8], 1
lea rbx, [rdi + 0x10]
movaps xmm0, xmmword [rsp + 0x50]
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
movups xmmword [rdi + 0x10], xmm0
mov qword [rdi + 0x20], rax
mov qword [rdi + 0x28], rdx
call sym._ZN4core3ptr159drop_in_place_LT_core..option..Option_LT_core..cell..RefCell_LT__u5b_core..option..Option_LT_alloc..rc..Rc_LT_s
mov rax, rbx
add rsp, 0x70
pop rbx
pop rdi
pop rsi
ret
lea rcx, sym.std::sys::common::thread_local::os_local::destroy_value::h840a6addf9c23629
call dbg.init
mov ecx, eax
jmp 0x480d2b
lea rcx, sym.std::sys::common::thread_local::os_local::destroy_value::h840a6addf9c23629
call dbg.init
mov ecx, eax
jmp 0x480d59
lea rcx, sym.std::sys::common::thread_local::os_local::destroy_value::h840a6addf9c23629
call dbg.init
mov ecx, eax
jmp 0x480dd0
lea rsi, [rsp + 0x28]
mov ecx, 8
mov edx, 0x30
call dbg.handle_alloc_error
ud2
Function at 0x483170
Capabilities:
Write file on windows

Disassembly:
push r12
push rbx
sub rsp, 0x38
mov r12, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call dbg.__acrt_iob_func
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sym.fwrite
mov rbx, qword [rsp + 0x28]
mov ecx, 2
call dbg.__acrt_iob_func
mov rdx, r12
mov rcx, rax
mov r8, rbx
call sym.vfprintf
call sym.abort
nop
nop word [rax + rax]

Function at 0x4831e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x50
movsxd rbx, dword [0x004a0234]
mov r12, rcx
test ebx, ebx
jle 0x483310
mov rax, qword [0x004a0238]
xor ecx, ecx
add rax, 0x18
nop word [rax + rax]
mov rdx, qword [rax]
cmp rdx, r12
ja 0x48322c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp r12, rdx
jb 0x4832b3
add ecx, 1
add rax, 0x28
cmp ecx, ebx
jne 0x483210
mov rcx, r12
call dbg.__mingw_GetSectionForAddress
mov rsi, rax
test rax, rax
je 0x483332
mov rax, qword [0x004a0238]
lea rbx, [rbx + rbx*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rsi
mov dword [rax], 0
call dbg._GetPEImageBase
mov ecx, dword [rsi + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x004a0238]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x483317
mov eax, dword [rsp + 0x44]
lea edx, [rax - 0x40]
and edx, 0xffffffbf
je 0x4832ac
lea edx, [rax - 4]
and edx, 0xfffffffb
jne 0x4832c0
add dword [0x004a0234], 1
add rsp, 0x50
pop rbx
pop rsi
pop r12
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 4
mov eax, 0x40
cmovne r8d, eax
add rbx, qword [0x004a0238]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4832ac
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call dbg.__report_error
nop dword [rax]
xor ebx, ebx
jmp 0x483237
mov rax, qword [0x004a0238]
mov edx, dword [rsi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call dbg.__report_error
mov rdx, r12
lea rcx, str.Address__p_has_no_image_section
call dbg.__report_error
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x483800
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x004a02a0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004a0280]
test rbx, rbx
je 0x483854
mov rdi, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [rbx]
call rdi
mov r12, rax
call rsi
test eax, eax
jne 0x48384b
test r12, r12
je 0x48384b
mov rax, qword [rbx + 8]
mov rcx, r12
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x483830
lea rcx, [0x004a02a0]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x483a70
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x483a88
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
je 0x483a90
ret
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x483aa0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
mov r8, rdx
lea rdx, [rax + rcx]
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x483aec
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov ecx, dword [rax + 0xc]
mov rdx, rcx
cmp rcx, r8
ja 0x483ae3
add edx, dword [rax + 8]
cmp rdx, r8
ja 0x483aee
add rax, 0x28
cmp rax, r9
jne 0x483ad0
xor eax, eax
ret

Function at 0x483af0
Capabilities:
Parse pe header

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
call sym.strlen
cmp rax, 8
ja 0x483b80
mov rdx, qword [0x00494920]
xor r12d, r12d
cmp word [rdx], 0x5a4d
jne 0x483b6e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x483b6e
cmp word [rax + 0x18], 0x20b
jne 0x483b6e
movzx edx, word [rax + 0x14]
lea r12, [rax + rdx + 0x18]
movzx eax, word [rax + 6]
test eax, eax
je 0x483b80
sub eax, 1
lea rax, [rax + rax*4]
lea rsi, [r12 + rax*8 + 0x28]
jmp 0x483b59
add r12, 0x28
cmp r12, rsi
je 0x483b80
mov r8d, 8
mov rdx, rbx
mov rcx, r12
call sym.strncmp
test eax, eax
jne 0x483b50
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
xor r12d, r12d
mov rax, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret

Function at 0x483b90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x00494920]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x483bb0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x483bb8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x483bb0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
movzx edx, word [r8 + 6]
lea rax, [r8 + rax + 0x18]
test edx, edx
je 0x483c05
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x483bfc
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x483bb0
add rax, 0x28
cmp rax, r9
jne 0x483be8
xor eax, eax
ret

Function at 0x483c10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00494920]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x483c30
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x483c38
mov eax, r8d
ret
cmp word [rax + 0x18], 0x20b
jne 0x483c30
movzx r8d, word [rax + 6]
mov eax, r8d
ret

Function at 0x483c50
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x00494920]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x483c70
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x483c78
ret
cmp word [rdx + 0x18], 0x20b
jne 0x483c70
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x483cb8
sub edx, 1
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x483caf
test rcx, rcx
je 0x483c70
sub rcx, 1
add rax, 0x28
cmp rax, rdx
jne 0x483ca0
xor eax, eax
ret
Function at 0x483cc0
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x00494920]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x483ce0
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x483ce8
mov rax, r8
ret
cmp word [rdx + 0x18], 0x20b
cmove r8, rax
mov rax, r8
ret

Function at 0x483d00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rax, qword [0x00494920]
xor r8d, r8d
cmp word [rax], 0x5a4d
jne 0x483d20
movsxd rdx, dword [rax + 0x3c]
add rdx, rax
cmp dword [rdx], 0x4550
je 0x483d28
mov eax, r8d
ret
cmp word [rdx + 0x18], 0x20b
jne 0x483d20
sub rcx, rax
movzx eax, word [rdx + 0x14]
lea rax, [rdx + rax + 0x18]
movzx edx, word [rdx + 6]
test edx, edx
je 0x483d20
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x483d64
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x483d78
add rax, 0x28
cmp r9, rax
jne 0x483d50
xor r8d, r8d
mov eax, r8d
ret
mov r8d, dword [rax + 0x24]
not r8d
shr r8d, 0x1f
mov eax, r8d
ret

Function at 0x483d90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x00494920]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x483db2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x483dc0
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x483db2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x483db2
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
movzx r8d, word [r8 + 6]
test r8d, r8d
je 0x483db2
sub r8d, 1
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop dword [rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x483e0d
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x483e20
add rdx, 0x28
cmp r10, rdx
jne 0x483df8
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x483e2f
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x483e3f
mov edx, dword [rax + 0xc]
test edx, edx
je 0x483e16
test ecx, ecx
jg 0x483e28
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x140001050
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.11
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.140008be0
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140001c40
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.14000fe74
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140001c00
jmp 0x14000126c
mov ecx, 0x2000
call fcn.14000fe74
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140001c00
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi]
mov eax, 0x2000
cmp r12, rax
mov rbx, r12
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000c488
cmp rax, rbx
jne 0x14000125e
mov rcx, qword [rdi]
call fcn.14000c1fc
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140007090
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.14000c9b0
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000c1fc
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000ac30
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140001c40
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.1400088c0
mov rcx, r13
call fcn.14000fe60
mov rcx, rbp
call fcn.14000fe60
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov rax, qword [rcx]
mov rsi, rdx
mov r14, rcx
test rax, rax
jne 0x1400012f8
add rcx, 0x78
lea rdx, [0x140025520]
call fcn.140002db0
mov qword [r14], rax
test rax, rax
jne 0x1400012f8
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140001c40
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, rax
call fcn.14000c758
test eax, eax
jns 0x14000132f
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001c00
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x20], r15
call fcn.14000fe74
mov r15, rax
test rax, rax
jne 0x140001364
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140001c00
jmp 0x140001414
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r12
jne 0x140001395
mov r9, r15
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
je 0x140001400
jmp 0x1400013f5
mov ebx, dword [rsi + 0xc]
mov rbp, r15
test rbx, rbx
je 0x140001400
mov r12d, 0x2000
nop word [rax + rax]
mov r9, qword [r14]
cmp rbx, r12
mov rdi, rbx
mov r8d, 1
cmova rdi, r12
mov rcx, rbp
mov rdx, rdi
call fcn.14000c488
cmp rax, 1
jb 0x1400013de
add rbp, rdi
sub rbx, rdi
jne 0x1400013b0
jmp 0x140001400
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140001c00
mov rcx, r15
call fcn.14000fe60
xor r15d, r15d
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov rcx, qword [r14]
test rcx, rcx
je 0x140001428
call fcn.14000c16c
mov qword [r14], 0
mov rax, r15
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x140001440
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov r14, rcx
call fcn.140005840
cmp eax, 0xffffffff
jne 0x140001462
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
lea rcx, [r14 + 0x3078]
lea rbp, [rdi + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.140005b60
mov r12, rax
test rax, rax
jne 0x1400014a7
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.140001c00
lea eax, [r12 - 1]
jmp 0x140001635
mov rax, qword [r14]
test rax, rax
jne 0x1400014e0
lea rcx, [r14 + 0x78]
lea rdx, [0x140025520]
call fcn.140002db0
mov qword [r14], rax
test rax, rax
jne 0x1400014e0
mov rdx, rbp
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140001c40
mov ebx, 0xffffffff
jmp 0x140001617
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, rax
call fcn.14000c758
test eax, eax
jns 0x140001516
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001c00
mov ebx, 0xffffffff
jmp 0x140001617
cmp byte [rdi + 0x10], 1
jne 0x140001534
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r14
call fcn.140001050
mov ebx, eax
jmp 0x140001617
mov qword [rsp + 0x28], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x20], r15
mov ecx, r13d
call fcn.14000fe74
mov r15, rax
test rax, rax
jne 0x140001575
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.140001c00
lea ebx, [r15 - 1]
jmp 0x14000160d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001605
mov qword [rsp + 0x58], rsi
nop word [rax + rax]
mov r9, qword [r14]
cmp rdi, r13
mov rsi, rdi
mov r8d, 1
cmova rsi, r13
mov rcx, r15
mov rdx, rsi
call fcn.14000c488
cmp rax, 1
jb 0x1400015e5
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r15
call fcn.14000c9b0
cmp rax, 1
jb 0x1400015d5
sub rdi, rsi
jne 0x140001590
jmp 0x140001600
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
jmp 0x1400015f3
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov r8, rbp
call fcn.140001c00
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r15
call fcn.14000fe60
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rcx, qword [r14]
test rcx, rcx
je 0x14000162b
call fcn.14000c16c
mov qword [r14], 0
mov rcx, r12
call fcn.14000c16c
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret