joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400b4e35
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x1400b4ee7
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x10]
movabs r8, 0x736f6d6570736575
xor r8, rax
movabs r9, 0x646f72616e646f6d
xor r9, rdx
movabs r10, 0x6c7967656e657261
xor r10, rax
movabs r11, 0x7465646279746573
xor r11, rdx
lea rcx, [rsp + 0x30]
mov qword [rcx], r8
mov qword [rcx + 8], r10
mov qword [rcx + 0x10], r9
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rdx
xorps xmm0, xmm0
movups xmmword [rcx + 0x30], xmm0
mov qword [rcx + 0x40], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
mov r8d, 8
call fcn.1400b5099
test rdi, rdi
je 0x1400b4f60
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x1400b4f77
movabs rcx, 0x100000001b3
mov rdx, qword [rsi]
xor eax, eax
test rdx, rdx
setne al
mov qword [rsp + 0x30], rax
movabs rax, 0xcbf29ce484222325
xor r8d, r8d
movzx r9d, byte [rsp + r8 + 0x30]
inc r8
xor rax, r9
imul rax, rcx
cmp r8, 8
jne 0x1400b4f0e
test rdx, rdx
je 0x1400b506c
mov rdx, qword [rsi + 0x10]
test rdx, rdx
je 0x1400b508d
mov r8, qword [rsi + 8]
xor r9d, r9d
mov r10, rax
movzx eax, byte [r8 + r9]
xor rax, r10
imul rax, rcx
inc r9
mov r10, rax
cmp rdx, r9
jne 0x1400b4f44
jmp 0x1400b508d
movzx eax, byte [rsi + 8]
lea rdx, [rsp + 0x28]
mov qword [rdx], rax
lea rcx, [rsp + 0x30]
mov r8d, 8
call fcn.1400b5099
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rax, qword [rsp + 0x48]
mov r8, qword [rsp + 0x30]
add r8, rcx
rol rcx, 0xd
xor rax, r9
xor rcx, r8
rol r8, 0x20
mov rdx, qword [rsp + 0x38]
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rax, r8
xor rcx, rdx
rol rdx, 0x20
xor r8, r9
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
xor rdx, 0xff
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
rol r8, 0x20
add rdx, rax
rol rax, 0x10
xor rax, rdx
add r8, rax
rol rax, 0x15
add rdx, rcx
rol rcx, 0x11
xor rcx, rdx
rol rdx, 0x20
xor rax, r8
add r8, rcx
rol rcx, 0xd
xor rcx, r8
add rdx, rax
shl rax, 0x10
xor rax, rdx
shr rax, 0x2b
add rdx, rcx
shr rcx, 0x2f
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x1400b508d
movzx edx, byte [rsi + 8]
mov qword [rsp + 0x30], rdx
xor edx, edx
movzx r8d, byte [rsp + rdx + 0x30]
inc rdx
xor rax, r8
imul rax, rcx
cmp rdx, 8
jne 0x1400b5077
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x1400b5099
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x1400b50cf
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x1400b50d7
mov esi, dword [rdx]
mov r9d, 4
jmp 0x1400b50dc
xor r10d, r10d
jmp 0x1400b518a
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400b50ff
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400b5116
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400b5136
add r11, r8
jmp 0x1400b525a
mov r11, qword [rax + 0x18]
mov r9, qword [rax + 0x10]
mov rcx, qword [rax]
add rcx, r9
rol r9, 0xd
xor r11, rsi
xor r9, rcx
rol rcx, 0x20
mov rdi, qword [rax + 8]
add rdi, r11
rol r11, 0x10
xor r11, rdi
add rcx, r11
rol r11, 0x15
xor r11, rcx
add rdi, r9
rol r9, 0x11
mov qword [rax + 0x18], r11
xor r9, rdi
rol rdi, 0x20
mov qword [rax + 0x10], r9
mov qword [rax + 8], rdi
xor rcx, rsi
mov qword [rax], rcx
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400b51fe
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
add rcx, rsi
rol rsi, 0xd
mov rbx, qword [rdx + r10]
xor rsi, rcx
rol rcx, 0x20
xor rdi, rbx
add r9, rdi
rol rdi, 0x10
xor rdi, r9
add rcx, rdi
rol rdi, 0x15
add r9, rsi
rol rsi, 0x11
xor rsi, r9
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400b51ac
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400b5210
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x1400b5216
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x1400b523c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x1400b5256
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x1401a4d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f0
mov rsi, rcx
mov rdi, qword [rdx + 8]
cmp rdi, 0xffffffffffffffff
je 0x1401a4ea3
mov rbx, rdx
mov eax, dword [rdx + 0x10]
movzx ebp, word [rdx + 0x40]
movzx r15d, word [rdx + 0x42]
movzx r12d, word [rdx + 0x44]
mov dword [rdx + 0x10], 0
cmp eax, 1
jne 0x1401a4dba
mov r14, qword [rbx]
cmp bp, 0x2e
jne 0x1401a4eaf
test r15w, r15w
je 0x1401a4dba
cmp r15w, 0x2e
jne 0x1401a4eaf
test r12w, r12w
jne 0x1401a4eaf
lea r14, [rsp + 0x80]
mov r8d, 0x250
mov rcx, r14
xor edx, edx
call fcn.140331590
mov rcx, rdi
mov rdx, r14
call qword [0x14033d318]
test eax, eax
je 0x1401a4e95
mov r14, qword [rbx]
lea rbx, [rsp + 0x80]
mov r15, qword [0x14033d318]
jmp 0x1401a4e11
mov rcx, rdi
mov rdx, rbx
call r15
test eax, eax
je 0x1401a4e95
cmp word [rsp + 0xac], 0x2e
jne 0x1401a4e3a
movzx eax, word [rsp + 0xae]
test ax, ax
je 0x1401a4e00
cmp ax, 0x2e
jne 0x1401a4e3a
cmp word [rsp + 0xb0], 0
je 0x1401a4e00
lock inc qword [r14]
jle 0x1401a4f97
mov rdi, qword [rsp + 0x80]
movups xmm0, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rsp + 0x98]
movaps xmmword [rsp + 0x30], xmm0
mov eax, dword [rsp + 0xa8]
mov dword [rsp + 0x40], eax
movzx ebp, word [rsp + 0xac]
movzx r15d, word [rsp + 0xae]
movzx r12d, word [rsp + 0xb0]
lea rdx, [rsp + 0xb2]
jmp 0x1401a4eda
call fcn.14031caf0
cmp eax, 0x12
jne 0x1401a4f26
mov qword [rsi], 0
jmp 0x1401a4f85
lock inc qword [r14]
jle 0x1401a4f97
lea rdx, [rbx + 0x46]
mov rdi, qword [rbx + 0x14]
mov eax, dword [rbx + 0x3c]
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rbx + 0x2c]
movaps xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [rbx + 0x1c]
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x2d2]
mov r8d, 0x21e
call fcn.140330ef0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x70], eax
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0x2d2]
mov r8d, 0x21e
call fcn.140330ef0
jmp 0x1401a4f38
call fcn.14031caf0
mov edi, eax
shl rdi, 0x20
or rdi, 2
xor r14d, r14d
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rdi
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movups xmmword [rsi + 0x18], xmm0
movups xmmword [rsi + 0x28], xmm1
mov eax, dword [rsp + 0x70]
mov dword [rsi + 0x38], eax
mov word [rsi + 0x3c], bp
mov word [rsi + 0x3e], r15w
mov word [rsi + 0x40], r12w
lea rcx, [rsi + 0x42]
lea rdx, [rsp + 0x80]
mov r8d, 0x21e
call fcn.140330ef0
mov qword [rsi], 1
add rsp, 0x4f0
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
ud2
Function at 0x1402d793c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r15, rcx
mov qword [rcx], rbx
mov rbp, r8
mov r12, rdx
lea r13d, [rbx + 0x28]
mov ecx, r13d
call fcn.1402ac840
mov rdi, rax
test rax, rax
jne 0x1402d7982
lea ebx, [rax + 7]
jmp 0x1402d7a13
cmp byte [0x14047d104], bl
je 0x1402d79e3
mov rax, qword [0x14047d290]
test rax, rax
je 0x1402d79a1
mov ecx, 0xc8
call rax
test eax, eax
jne 0x1402d79e3
lea r14, [rdi + 8]
mov qword [rdi + 0x18], rbp
lea rsi, [rdi + 0x10]
mov qword [rsp + 0x28], r14
mov r9, rdi
mov dword [rsp + 0x20], ebx
lea r8, [0x1402ba614]
mov qword [rsi], r12
xor edx, edx
xor ecx, ecx
call fcn.1403245e4
mov qword [rdi], rax
test rax, rax
jne 0x1402d79f8
mov r8, r13
xor edx, edx
mov rcx, rdi
call fcn.140331590
jmp 0x1402d79f8
mov r8, r13
xor edx, edx
mov rcx, rdi
call fcn.140331590
lea rsi, [rdi + 0x10]
lea r14, [rdi + 8]
cmp qword [rsi], rbx
jne 0x1402d7a10
call qword [0x14033d550]
mov rcx, rbp
mov dword [r14], eax
call r12
mov qword [rdi + 0x20], rax
mov qword [r15], rdi
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14031d76c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14033d2e8]
test rax, rax
je 0x14031d7b6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14031d7b6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14031d7b6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14031d7b6
cmp dword [rcx + 0x84], 0xe
jbe 0x14031d7b6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14031d7b8
xor al, al
add rsp, 0x28
ret

Function at 0x140325678
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140325468
Function at 0x140001480
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
pxor xmm0, xmm0
lea r14, [rsp + 0x40]
mov r13, rcx
mov r12, rdx
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x100], r8
lea rdx, section..rdata
mov r8d, 0x58
mov rcx, r14
mov qword [rsp + 0x108], r9
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
call fcn.140009d00
test eax, eax
mov ebx, eax
jne 0x1400016c3
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x140001700
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rbp, rax
je 0x1400016e1
mov r15d, dword [r12 + 8]
mov ebx, 0x2000
mov r9, r13
mov edx, 1
cmp r15, rbx
mov rcx, rdi
cmovbe rbx, r15
mov r8, rbx
call sub.msvcrt.dll_fread
cmp rax, rbx
jne 0x1400015af
mov rcx, r13
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x1400015af
mov dword [rsp + 0x48], ebx
mov esi, eax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], 0x2000
call fcn.140009dd0
cmp eax, 0xffffffff
mov ebx, eax
jge 0x140001590
cmp eax, 0xfffffffc
jl 0x1400015e8
mov r10d, eax
jmp 0x14000159b
cmp eax, 2
jne 0x1400015e8
mov r10d, 0xfffffffd
lea rdx, [r12 + 0x12]
mov r8d, r10d
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.140002790
mov ebx, 0xffffffff
mov rcx, r14
call fcn.14000bb80
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rbp
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x58]
mov r8d, 0x2000
sub r8, rax
mov r9, rax
cmp qword [rsp + 0x100], 0
je 0x140001680
mov r9, qword [rsp + 0x100]
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], r8
call sub.msvcrt.dll_fwrite
mov r8, qword [rsp + 0x30]
cmp rax, r8
jne 0x1400016b8
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x1400016b8
mov r9d, dword [rsp + 0x58]
test r9d, r9d
je 0x140001564
mov eax, esi
mov esi, ebx
mov rbx, qword [rsp + 0x28]
sub r15, rbx
cmp esi, 1
je 0x14000171f
test r15, r15
jne 0x140001524
cmp esi, 1
mov r10d, esi
mov ebx, eax
je 0x1400015b4
jmp 0x14000159b
cmp qword [rsp + 0x108], 0
je 0x140001641
mov rcx, qword [rsp + 0x108]
mov rdx, rbp
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x3c], eax
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x3c]
add qword [rsp + 0x108], r8
jmp 0x140001641
mov r10d, 0xffffffff
jmp 0x14000159b
lea rdx, [r12 + 0x12]
mov r8d, eax
mov ebx, 0xffffffff
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002790
jmp 0x1400015cc
lea r8, [r12 + 0x12]
xor ebp, ebp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.1400028f0
jmp 0x1400015b4
lea r8, [r12 + 0x12]
xor ebp, ebp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.1400028f0
jmp 0x1400015b4
mov ebx, eax
jmp 0x1400015b4
Function at 0x140001770
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov r12, rdx
mov rbx, rcx
lea rdx, [0x14001812c]
call fcn.140004060
test rax, rax
mov rbp, rax
je 0x1400018a0
mov edx, dword [r12 + 4]
xor r8d, r8d
mov rcx, rax
add edx, dword [rbx + 0x1000]
call fcn.14000e6d0
test eax, eax
js 0x140001880
mov esi, dword [r12 + 0xc]
mov rcx, rsi
call sub.msvcrt.dll_malloc
test rax, rax
mov r13, rax
je 0x1400018b6
cmp byte [r12 + 0x10], 1
je 0x140001860
test rsi, rsi
mov rdi, rax
jne 0x1400017f8
jmp 0x140001840
add rdi, rbx
sub rsi, rbx
je 0x140001840
mov ebx, 0x2000
mov r9, rbp
mov r8d, 1
cmp rsi, rbx
mov rcx, rdi
cmovbe rbx, rsi
mov rdx, rbx
call sub.msvcrt.dll_fread
test rax, rax
jne 0x1400017f0
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.1400028f0
mov rcx, r13
call sub.msvcrt.dll_free
xor r13d, r13d
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r8d, r8d
mov r9, rax
mov rdx, r12
mov rcx, rbp
call fcn.140001480
test eax, eax
je 0x140001840
jmp 0x140001835
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.1400028f0
jmp 0x14000183d
lea rdx, [r12 + 0x12]
xor r13d, r13d
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002790
jmp 0x140001848
lea r8, [r12 + 0x12]
mov r9d, esi
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.1400028f0
jmp 0x14000183d
Function at 0x1400018e0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp byte [rdx + 0x11], 0x6e
mov rbx, rcx
mov r13, rdx
mov rdi, r8
je 0x140001a00
lea rdx, [0x140018254]
mov rcx, r8
call fcn.140004060
test rax, rax
mov r12, rax
je 0x140001af1
lea rdx, [0x14001812c]
mov rcx, rbx
call fcn.140004060
test rax, rax
mov rbp, rax
je 0x140001a88
mov edx, dword [r13 + 4]
xor r8d, r8d
mov rcx, rax
add edx, dword [rbx + 0x1000]
call fcn.14000e6d0
test eax, eax
js 0x140001ad0
cmp byte [r13 + 0x10], 1
je 0x140001a38
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x140001b12
mov esi, dword [r13 + 0xc]
test rsi, rsi
jne 0x1400019ae
jmp 0x140001aa0
mov r9, r12
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x140001ab0
sub rsi, rbx
je 0x140001aa0
mov ebx, 0x2000
mov r9, rbp
mov r8d, 1
cmp rsi, rbx
mov rcx, rdi
cmovbe rbx, rsi
mov rdx, rbx
call sub.msvcrt.dll_fread
test rax, rax
jne 0x140001988
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.1400028f0
mov ebx, 0xffffffff
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x140001a4b
call fcn.140001770
test rax, rax
mov rsi, rax
je 0x140001a6a
mov rdx, rdi
mov rcx, rax
call fcn.140004100
mov rcx, rsi
mov ebx, eax
call sub.msvcrt.dll_free
test ebx, ebx
js 0x140001a70
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r9d, r9d
mov r8, r12
mov rdx, r13
mov rcx, rbp
call fcn.140001480
mov ebx, eax
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov rcx, r12
call sub.msvcrt.dll_fclose
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov ebx, 0xffffffff
nop
lea rdx, [r13 + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140002790
jmp 0x140001a26
lea rdx, [r13 + 0x12]
mov ebx, 0xffffffff
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002790
jmp 0x140001a53
xor ebx, ebx
jmp 0x1400019ef
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
call fcn.1400028f0
jmp 0x1400019ea
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.1400028f0
mov ebx, 0xffffffff
jmp 0x140001a4b
lea r8, [r13 + 0x12]
mov ebx, 0xffffffff
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.1400028f0
jmp 0x140001a26
lea r8, [r13 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.1400028f0
jmp 0x140001ae7
Function at 0x140007390
Capabilities:
Create directory

Disassembly:
push r15
mov eax, 0x3038
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000de60
sub rsp, rax
mov rbx, r8
mov r14, rcx
mov rcx, rdx
mov rdi, rdx
call sub.msvcrt.dll_strlen
mov rcx, rbx
mov rsi, rax
call sub.msvcrt.dll_strlen
lea rax, [rsi + rax + 1]
cmp rax, 0xfff
ja 0x140007490
lea rsi, [rsp + 0x30]
mov r9, rdi
mov edx, 0x1000
mov dword [rsp + 0x20], 0x5c
lea r8, str._s_c
mov rcx, rsi
mov ebp, 0x1000
call fcn.140007370
mov edx, 0x5c
mov rcx, rbx
lea r12, [0x140019be5]
movsxd rdi, eax
call sub.msvcrt.dll_strchr
lea r13, [rsp + 0x1030]
sub rbp, rdi
add rdi, rsi
test rax, rax
mov r15, rax
jne 0x140007446
jmp 0x1400074a0
lea rcx, [r15 + 1]
mov edx, 0x5c
call sub.msvcrt.dll_strchr
test rax, rax
mov r15, rax
je 0x1400074a0
mov r9d, r15d
mov r8, r12
mov rdx, rbp
mov qword [rsp + 0x20], rbx
sub r9d, ebx
mov rcx, rdi
call fcn.140007370
mov rcx, rsi
call fcn.140004020
test eax, eax
jne 0x140007430
mov r8d, 0x1000
mov rdx, r13
mov rcx, rsi
call fcn.140008490
mov rdx, qword [r14 + 0x3038]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140007430
mov eax, 0xffffffff
jmp 0x1400074a2
xor eax, eax
add rsp, 0x3038
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret

Function at 0x1400074c0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rdi
mov eax, 0x1020
push rsi
push rbx
call fcn.14000de60
sub rsp, rax
mov rsi, rdx
lea rdx, [0x140019bea]
call fcn.140004060
test rax, rax
mov rbx, rax
je 0x1400075ae
lea rdx, [0x140019bed]
mov rcx, rsi
call fcn.140004060
test rax, rax
mov rsi, rax
je 0x1400075a6
lea rdi, [rsp + 0x20]
jmp 0x14000754f
mov r8d, 0x1000
mov r9, rbx
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fread
test rax, rax
mov r8, rax
je 0x140007590
mov r9, rsi
mov edx, 1
mov rcx, rdi
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x140007580
mov rcx, rsi
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x140007580
mov rcx, rbx
call sub.msvcrt.dll_feof
test eax, eax
je 0x140007510
xor edi, edi
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov eax, edi
add rsp, 0x1020
pop rbx
pop rsi
pop rdi
ret
mov rcx, rsi
call sub.msvcrt.dll_clearerr
mov edi, 0xffffffff
jmp 0x14000755d
mov rcx, rbx
call sub.msvcrt.dll_ferror
test eax, eax
je 0x14000755b
mov rcx, rbx
call sub.msvcrt.dll_clearerr
jmp 0x140007588
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov edi, 0xffffffff
jmp 0x14000756d
Function at 0x1400075c0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov r12, rcx
mov ecx, 0x2000
mov rbp, rdx
mov rdi, r8
call sub.msvcrt.dll_malloc
test rax, rax
mov rsi, rax
je 0x1400076b0
xor edx, edx
mov r8d, 2
mov rcx, r12
call fcn.14000e6d0
test eax, eax
js 0x1400076b0
mov rcx, r12
call fcn.14000e770
movsxd rbx, eax
cmp rbx, rdi
jb 0x1400076b0
mov r15d, 1
sub r15, rdi
mov qword [rsp + 0x28], r15
mov r13d, 0x2000
cmp rbx, r13
cmovae r13, rbx
lea r14, [r13 - 0x2000]
sub rbx, r14
cmp rbx, rdi
jb 0x1400076b0
xor r8d, r8d
mov edx, r14d
mov rcx, r12
call fcn.14000e6d0
test eax, eax
js 0x1400076b0
mov r9, r12
mov r8, rbx
mov edx, 1
mov rcx, rsi
call sub.msvcrt.dll_fread
cmp rax, rbx
jne 0x1400076b0
mov rdx, qword [rsp + 0x28]
lea rbx, [rdx + rax]
jmp 0x14000769a
lea r15, [rbx - 1]
mov r8, rdi
mov rdx, rbp
lea rcx, [rsi + r15]
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1400076d0
mov rbx, r15
test rbx, rbx
jne 0x140007680
lea rbx, [r14 + rdi - 1]
test r14, r14
jne 0x140007629
nop dword [rax]
xor ebx, ebx
mov rcx, rsi
call sub.msvcrt.dll_free
mov rax, rbx
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea rbx, [r13 + rbx - 0x2001]
jmp 0x1400076b2

Function at 0x1400076e0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push r15
mov eax, 0x2288
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000de60
sub rsp, rax
mov r14, qword [sym.imp.msvcrt.dll__snwprintf]
lea r8, str._s
mov edx, 0x1000
lea r13, [rsp + 0x280]
mov qword [rsp + 0x22d0], rcx
mov r9, rcx
mov rcx, r13
call r14
cmp eax, 0xfff
jg 0x140007848
lea rsi, [rsp + 0x30]
mov r12d, 0x1000
mov rcx, r13
lea ebx, [rax - 1]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
sub r12d, ebx
cmp rax, 0xffffffffffffffff
mov r15, rax
je 0x140007848
movsxd rax, ebx
mov rdi, qword [sym.imp.KERNEL32.dll_FindNextFileW]
lea rax, [r13 + rax*2]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5c]
movsxd rax, r12d
lea rbp, [0x140019c0a]
mov qword [rsp + 0x28], rax
mov rdx, rbp
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400077e0
lea rdx, [0x140019c0e]
mov rcx, rbx
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x1400077e0
mov rdx, qword [rsp + 0x28]
mov r9, rbx
mov rcx, qword [rsp + 0x20]
lea r8, [0x140019c14]
call r14
cmp eax, r12d
jge 0x1400077e0
mov eax, dword [rsp + 0x30]
mov rcx, r13
test al, 0x10
je 0x140007828
test ah, 4
je 0x1400077da
cmp dword [rsp + 0x54], 0xa000000c
je 0x140007840
call fcn.1400076e0
nop
mov rdx, rsi
mov rcx, r15
call rdi
test eax, eax
jne 0x140007782
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rsp + 0x22d0]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 1
setne al
movzx eax, al
neg eax
add rsp, 0x2288
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rdx, rsi
mov rcx, r15
call rdi
test eax, eax
jne 0x140007782
jmp 0x1400077ec
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1400077e0
mov eax, 0xffffffff
jmp 0x14000780e
Function at 0x1400079c0
Capabilities:
Query environment variable

Disassembly:
push rsi
mov eax, 0x4028
push rbx
call fcn.14000de60
sub rsp, rax
xor r8d, r8d
xor edx, edx
call fcn.140008490
lea rbx, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0xffe
ja 0x140007a38
lea rsi, [rsp + 0x2020]
mov r8d, 0x1000
mov rcx, rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
sub eax, 1
cmp eax, 0xffe
ja 0x140007a38
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call fcn.140008390
add rsp, 0x4028
pop rbx
pop rsi
ret
xor eax, eax
add rsp, 0x4028
pop rbx
pop rsi
ret