joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401a2380
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x98
movabs rax, 0x6c6320726f727245
movabs rdx, 0x7520676e696e6165
mov qword [rsp + 0x20], rax
movabs rax, 0x6b5f6e6970732070
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20726f6620737965
mov qword [rsp + 0x30], rax
movabs rax, 0x20646165726874
mov qword [rsp + 0x38], rdx
xor edx, edx
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov word [rsp + 0x88], ax
mov byte [rsp + 0x8a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0x47]
mov r8d, 0xa
mov ecx, eax
call qword [sym.imp.msvcrt.dll__ultoa]
cmp byte [rsp + 0x47], 0
je 0x1401a2492
mov eax, 0x28
lea rcx, [rsp + 0x20]
jmp 0x1401a246a
add rax, 1
cmp rax, 0x6b
je 0x1401a2487
cmp byte [rcx + rax], 0
movsxd rdx, eax
jne 0x1401a2460
cmp edx, 0x6a
je 0x1401a2487
lea eax, [rdx + 1]
cdqe
mov byte [rsp + rdx + 0x20], 0xa
mov byte [rsp + rax + 0x20], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call sub.msvcrt.dll_abort
mov eax, 0x28
mov edx, 0x27
lea rcx, [rsp + 0x20]
jmp 0x1401a247b
Function at 0x1401a2ea0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, qword [0x1403929e0]
mov rax, qword [rsi]
test rax, rax
je 0x1401a3090
cmp qword [rax + 0x28], 0
jne 0x1401a3078
lea rcx, [0x14042c998]
cmp dword [rcx], 1
mov qword [rax + 0x28], rcx
je 0x1401a3085
call fcn.1401a24b0
mov rax, qword [rsi]
test rax, rax
je 0x1401a2f20
cmp qword [rax + 0x30], 0
jne 0x1401a2f40
lea rdx, [0x1401ca208]
mov qword [rax + 0x30], rdx
mov rax, rdx
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
je 0x1401a2f54
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call fcn.1401a71c0
cmp qword [rax + 0x30], 0
mov rax, qword [rsi]
je 0x1401a2ef0
test rax, rax
jne 0x1401a2f40
call fcn.1401a71c0
nop dword [rax]
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov r12, rax
test rax, rax
jne 0x1401a2f0e
call fcn.1401a1ff0
cmp qword [0x140430050], 0
mov rbx, rax
je 0x1401a2f0e
test rax, rax
je 0x1401a2f0e
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
xor r9d, r9d
xor r8d, r8d
mov dword [rbx + 0x70], eax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x38], 0xffffffffffffffff
lea rcx, [rbx + 0x68]
mov qword [rbx + 0x30], rax
call fcn.1401a9060
cmp eax, 1
je 0x1401a30fd
mov rbp, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rbx + 0x68], 0xffffffffffffffff
mov dword [rbx + 0xb8], 0
mov qword [rbx + 0x28], 0
call rbp
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov r12, rax
call rbp
mov dword [rsp + 0x30], 2
mov r8, rdi
mov rdx, r12
mov dword [rsp + 0x28], 0
mov rcx, rax
lea r9, [rbx + 0x28]
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x1401ab136
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rbx + 0xbc], 0
mov dword [rbx + 0xc0], eax
movzx eax, byte [rbx + 0x40]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rbx + 0x40], al
mov rax, qword [rsi]
test rax, rax
je 0x1401a30d8
cmp qword [rax + 0x30], 0
je 0x1401a30c0
mov rax, qword [rax + 0x30]
mov ecx, dword [rax]
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x1401ab136
mov r12, rbx
mov rax, r12
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1401a2edc
mov rax, qword [rsi]
jmp 0x1401a2ee9
call fcn.1401a71c0
cmp qword [rax + 0x28], 0
mov rax, qword [rsi]
je 0x1401a2ec8
test rax, rax
jne 0x1401a3078
call fcn.1401a71c0
mov rcx, qword [rax + 0x28]
cmp dword [rcx], 1
jne 0x1401a2edc
jmp 0x1401a2ee1
lea rdx, [0x1401ca208]
mov qword [rax + 0x30], rdx
mov rax, rdx
jmp 0x1401a304e
call fcn.1401a71c0
mov r8, rax
mov rax, qword [rsi]
cmp qword [r8 + 0x30], 0
je 0x1401a30c0
test rax, rax
jne 0x1401a304a
call fcn.1401a71c0
jmp 0x1401a304a
call fcn.1401a2380
nop word cs:[rax + rax]
nop dword [rax]
mov rax, qword [0x1403929e0]
mov rdx, qword [rax]
lea rax, [0x14042c9a8]
mov qword [rdx + 0x10], rax
ret
Function at 0x1401a7040
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1401a7060
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x1401a70a8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1401a7054
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1401a7095
Function at 0x1401a71c0
Capabilities:
Check mutex on windows

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [0x14042ca80]
mov dword [rsp + 0x2c], eax
lea rcx, [rsp + 0x2c]
lea r9, [rsp + 0x30]
movzx eax, byte [rcx]
add rcx, 1
add rdx, 2
mov r8d, eax
and eax, 0xf
shr r8b, 4
add eax, 0x61
add r8d, 0x41
mov byte [rdx - 1], al
mov byte [rdx - 2], r8b
cmp rcx, r9
jne 0x1401a71e3
lea rax, [0x14042ca88]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x1a]
jmp 0x1401a722b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1401a7228
lea rax, [0x14042cac0]
mov ecx, 0x5f
lea rdx, str.__shmem3_winpthreads_tdm_
lea r8, [rax + 0x19]
jmp 0x1401a725b
movzx ecx, byte [rdx]
add rax, 1
add rdx, 1
mov byte [rax - 1], cl
cmp rax, r8
jne 0x1401a7258
xor ecx, ecx
mov byte [0x14042cad9], 0x2d
movabs rax, 0x6161616161616161
movabs rdx, 0x6161616161616161
mov qword [0x14042cae2], rdx
lea r8, [0x14042ca80]
lea rbx, [0x14042cada]
mov qword [0x14042caf2], rdx
mov qword [0x14042cb02], rdx
mov qword [0x14042cb12], rdx
xor edx, edx
mov qword [0x14042cada], rax
mov qword [0x14042caea], rax
mov qword [0x14042cafa], rax
mov qword [0x14042cb0a], rax
mov byte [0x14042cb1a], 0
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1401a7436
lea rcx, [0x14042cac0]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x1401a7381
lea rsi, [0x14042c9c0]
lea r8, [0x14042cb1a]
mov rax, rbx
lea ecx, [rbx + 0x40]
nop dword [rax]
mov edx, ecx
sub edx, eax
bt rsi, rdx
jae 0x1401a732d
mov byte [rax], 0x41
add rax, 1
cmp r8, rax
jne 0x1401a7320
lea rcx, [0x14042cac0]
call qword [sym.imp.KERNEL32.dll_AddAtomA]
test ax, ax
je 0x1401a7423
lea rcx, [0x1401a70d0]
mov qword [0x14042c9c0], rsi
call sub.msvcrt.dll__onexit
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x14042c9c0]
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
mov r8d, 0x5b
lea rdx, [0x14042cac0]
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_GetAtomNameA]
lea r8, [0x14042cb1a]
xor edx, edx
lea r10d, [rbx + 0x40]
mov r11d, eax
mov r9d, 1
mov rax, rbx
test r11d, r11d
je 0x1401a7456
nop dword [rax]
cmp byte [rax], 0x41
jne 0x1401a73d3
mov ecx, r10d
mov rbx, r9
sub ecx, eax
shl rbx, cl
or rdx, rbx
add rax, 1
cmp r8, rax
jne 0x1401a73c0
mov rax, rdx
mov qword [0x14042c9c0], rax
lea rsi, [0x14042c9c0]
jmp 0x1401a73f9
cmp rdx, rsi
je 0x1401a735f
mov rdx, rax
mov rax, qword [rax + 8]
test rax, rax
jne 0x1401a73f0
cmp rdx, rsi
je 0x1401a735f
mov qword [rdx + 8], rsi
lea rcx, [0x1401a70d0]
call sub.msvcrt.dll__onexit
jmp 0x1401a735f
lea rcx, str.failed_to_add_string_to_atom_table_n
call fcn.1401a7040
xor eax, eax
jmp 0x1401a7378
lea rcx, str.failed_to_to_lock_creation_mutex_n
call fcn.1401a7040
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret
lea rcx, str.failed_to_get_string_from_atom_n
call fcn.1401a7040
xor eax, eax
jmp 0x1401a73df
Function at 0x14000f46c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000f4f3
mov rsi, rbx
cmp word [rax], bp
je 0x14000f4b2
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000f49c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000f498
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000fea0
mov rdi, rax
test rax, rax
je 0x14000f4e0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.1400151d0
mov rbp, rdi
xor ecx, ecx
call fcn.14000e0f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140014ba0
Capabilities:
Access peb ldr_data

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0xa0
movups xmm0, xmmword [r8]
mov esi, edx
mov dword [rax - 0x68], 0x9fdd9ad9
movsd xmm1, qword [r8 + 0x10]
lea rdx, [rsp + 0x40]
mov dword [rax - 0x64], 0x8375e8e5
lea r8, [rsp + 0x20]
mov dword [rax - 0x60], 0xbbefb288
mov r14, rcx
mov dword [rax - 0x5c], 0xc6965ca5
lea rcx, [rsp + 0x78]
mov dword [rax - 0x58], 0x4a3b1e8d
mov dword [rax - 0x54], 0x3673de
mov eax, 0x8eee
movaps xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x58], ax
movsd qword [rsp + 0x30], xmm1
call fcn.140018380
xor edi, edi
movups xmm0, xmmword [rax]
movsd xmm1, qword [rax + 0x10]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x72], eax
mov rax, qword gs:[0x60]
movups xmmword [rsp + 0x5a], xmm0
movsd qword [rsp + 0x6a], xmm1
mov rbx, qword [rax + 0x18]
add rbx, 0x20
mov r11, qword [rbx]
cmp r11, rbx
je 0x140014cc0
nop
mov r9, qword [r11 + 0x50]
lea r10, [rsp + 0x5a]
test r9, r9
je 0x140014cb8
movzx edx, word [r9]
test dx, dx
je 0x140014cae
movzx eax, word [r10]
test ax, ax
je 0x140014ca8
lea ecx, [rdx - 0x41]
cmp cx, 0x19
lea r8d, [rdx + 0x20]
lea ecx, [rax + 0x20]
cmova r8w, dx
lea edx, [rax - 0x41]
cmp dx, 0x19
cmovbe ax, cx
cmp r8w, ax
jne 0x140014cb8
movzx edx, word [r9 + 2]
add r9, 2
add r10, 2
test dx, dx
jne 0x140014c67
jmp 0x140014cae
cmp word [r9], di
jne 0x140014cb8
cmp word [r10], di
je 0x140014d49
mov r11, qword [r11]
cmp r11, rbx
jne 0x140014c50
mov rbx, rdi
mov r8d, 0x50bc2b99
mov edx, esi
mov rcx, rbx
call fcn.140017b60
mov qword [r14], rax
test rax, rax
je 0x140014d52
mov r8d, 0xce2f024
mov edx, esi
mov rcx, rbx
call fcn.140017b60
mov qword [r14 + 8], rax
test rax, rax
je 0x140014d52
mov r8d, 0xdaa6dfe4
mov edx, esi
mov rcx, rbx
call fcn.140017b60
mov qword [r14 + 0x10], rax
test rax, rax
je 0x140014d52
mov r8d, 0xddf8ba05
mov edx, esi
mov rcx, rbx
call fcn.140017b60
mov qword [r14 + 0x18], rax
test rax, rax
je 0x140014d52
mov r8d, 0x53502286
mov edx, esi
mov rcx, rbx
call fcn.140017b60
test rax, rax
mov qword [r14 + 0x20], rax
mov ecx, 0xffffffff
cmove edi, ecx
mov eax, edi
jmp 0x140014d57
mov rbx, qword [r11 + 0x20]
jmp 0x140014cc3
mov eax, 0xffffffff
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret
Function at 0x140017b60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov ebp, r8d
mov r14d, edx
mov rdi, rcx
test rcx, rcx
je 0x140017c24
movsxd rax, dword [rcx + 0x3c]
xor r11d, r11d
mov r9d, dword [rax + rcx + 0x88]
add r9, rcx
mov ebx, dword [r9 + 0x20]
mov r15d, dword [r9 + 0x24]
add rbx, rcx
mov r12d, dword [r9 + 0x1c]
add r15, rcx
mov esi, dword [r9 + 0x18]
add r12, rcx
test esi, esi
je 0x140017c24
nop dword [rax + rax]
mov r9d, dword [rbx]
xor edx, edx
add r9, rdi
xor r10d, r10d
mov eax, r14d
movsx r8d, byte [r9]
test r8d, r8d
je 0x140017c14
nop word [rax + rax]
lea ecx, [r8 + rax]
imul edx, ecx, 0x41138696
lea r10d, [r10 + 1]
ror edx, 0x11
add edx, 0x41138696
add eax, edx
ror eax, 0xf
imul eax, r8d
movsx r8d, byte [r10 + r9]
add eax, eax
mov edx, eax
ror eax, 0xe
ror edx, 0x10
test r8d, r8d
jne 0x140017be0
cmp edx, ebp
je 0x140017c41
inc r11d
add rbx, 4
cmp r11d, esi
jb 0x140017bc0
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
movzx ecx, word [r15 + r11*2]
mov eax, dword [r12 + rcx*4]
add rax, rdi
jmp 0x140017c26
Function at 0x140017cd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x50]
sub rsp, 0x150
movups xmm0, xmmword [r9]
lea r8, [rbp - 0x50]
mov rdi, rdx
movsd xmm1, qword [r9 + 0x10]
lea rdx, [rsp + 0x20]
mov eax, 0x8aaf
movaps xmmword [rbp - 0x50], xmm0
mov rbx, rcx
mov dword [rsp + 0x20], 0xaf6b68c4
lea rcx, [rbp - 0x30]
mov dword [rsp + 0x24], 0x1e26e75c
mov dword [rsp + 0x28], 0x6aab8c62
mov dword [rsp + 0x2c], 0x7521f0ad
mov dword [rsp + 0x30], 0x9aec0fc1
mov dword [rsp + 0x34], 0x662b09f8
mov dword [rsp + 0x38], 0x9081fe4c
mov dword [rsp + 0x3c], 0xb4bdb8ab
mov dword [rsp + 0x40], 0x47ba9bff
mov dword [rsp + 0x44], 0x966faa6
mov dword [rsp + 0x48], 0xf2580c50
mov dword [rsp + 0x4c], 0x6c87ec5c
mov dword [rsp + 0x50], 0x3ab968e8
mov dword [rsp + 0x54], 0x96d2b1c4
mov dword [rsp + 0x58], 0x5a8b52e
mov dword [rsp + 0x5c], 0x216a5f25
mov dword [rsp + 0x60], 0x35dc6dd0
mov dword [rsp + 0x64], 0x14860bca
mov dword [rsp + 0x68], 0x2202d062
mov dword [rsp + 0x6c], 0xc4d20af7
mov dword [rsp + 0x70], 0xba017e68
mov dword [rsp + 0x74], 0x2d9c37f1
mov dword [rsp + 0x78], 0x74a33f66
mov dword [rsp + 0x7c], 0x2dee7f2c
mov dword [rbp - 0x80], 0xfd6febb5
mov dword [rbp - 0x7c], 0xeb0790d8
mov dword [rbp - 0x78], 0xf57596f9
mov dword [rbp - 0x74], 0xda430c6e
mov dword [rbp - 0x70], 0xa7ac26d9
mov dword [rbp - 0x6c], 0x1219cbd2
mov dword [rbp - 0x68], 0xef3cf944
mov word [rbp - 0x64], ax
movsd qword [rbp - 0x40], xmm1
call fcn.140018980
lea rcx, [rbp - 0x60]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rsp + 0x70], xmm1
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm1
call qword [rbx + 0x88]
lea rdx, [rbp + 0x60]
lea rcx, [rbp - 0x60]
call qword [rbx + pe_nt_image_headers64]
mov rcx, qword [rbp + 0x60]
mov eax, 0x8421085
mul ecx
mov r8d, ecx
mov eax, 0x8421085
sub r8d, edx
shr r8d, 1
add r8d, edx
mul ecx
mov eax, ecx
shr r8d, 5
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub ecx, eax
movzx ecx, word [rsp + rcx*2 + 0x20]
mov r9d, 1
mov word [rdi], cx
test r8d, r8d
je 0x140017ee4
nop
mov ecx, r8d
mov eax, 0x8421085
mul r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
imul eax, ecx, 0x3e
sub r8d, eax
mov eax, r8d
mov r8d, ecx
mov ecx, r9d
inc r9d
movzx eax, word [rsp + rax*2 + 0x20]
mov word [rdi + rcx*2], ax
test r8d, r8d
jne 0x140017eb0
mov eax, r9d
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x18]
inc r9d
mov word [rdi + rax*2], 0x2e
mov word [rdi + r9*2], 0x70
inc r9d
mov word [rdi + r9*2], 0x64
inc r9d
xor eax, eax
mov word [rdi + r9*2], 0x66
lea ecx, [r9 + 1]
mov word [rdi + rcx*2], ax
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x14006b4b0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14011c2a8]
test rax, rax
je 0x14006b4fa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14006b4fa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14006b4fa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14006b4fa
cmp dword [rcx + 0x84], 0xe
jbe 0x14006b4fa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14006b4fc
xor al, al
add rsp, 0x28
ret

Function at 0x14006fda0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14006fdc8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14006fdc8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rbp
push rsi
push r13
push r14
sub rsp, 0x20
mov r14, rdx
mov rsi, r8
lea rdx, [0x14002a844]
mov rbx, rcx
mov r13d, 0xffffffff
call fcn.140003f90
mov rbp, rax
test rax, rax
jne 0x14000109a
lea rdx, [r14 + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.1400025e0
xor ebx, ebx
jmp 0x140001167
mov edx, dword [r14 + 4]
xor r8d, r8d
add rdx, qword [rbx + 0x1000]
mov rcx, rbp
call fcn.1400101d4
test eax, eax
jns 0x1400010da
lea r8, [r14 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002750
mov rcx, rbp
call fcn.14000fb4c
xor ebx, ebx
jmp 0x140001167
mov ecx, dword [r14 + 0xc]
mov qword [rsp + 0x58], r12
call fcn.140014950
mov r12, rax
mov rbx, rax
test rax, rax
jne 0x140001118
mov r9d, dword [r14 + 0xc]
lea r8, [r14 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002750
mov rcx, rbp
call fcn.14000fb4c
jmp 0x140001162
cmp byte [r14 + 0x10], 1
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x68], r15
jne 0x14000117e
mov r9, r12
xor r8d, r8d
mov rdx, r14
mov rcx, rbp
call fcn.140001200
test eax, eax
jne 0x1400011e2
mov rcx, rbp
call fcn.14000fb4c
mov rdx, rsi
mov rcx, r12
call fcn.1400040c0
mov r13d, eax
mov rdi, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x58]
mov rcx, rbx
call fcn.14001493c
mov eax, r13d
add rsp, 0x20
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [r14 + 0xc]
mov r15, r12
test rdi, rdi
je 0x140001142
mov eax, 0x2000
nop
cmp rdi, rax
mov rsi, rdi
mov r9, rbp
mov r8d, 1
cmova rsi, rax
mov rcx, r15
mov rdx, rsi
call fcn.14000fe9c
cmp rax, 1
jb 0x1400011cb
add r15, rsi
mov eax, 0x2000
sub rdi, rsi
jne 0x140001190
mov rsi, qword [rsp + 0x60]
jmp 0x140001142
lea r8, [r14 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002750
mov rcx, r12
call fcn.14001493c
mov rcx, rbp
call fcn.14000fb4c
xor ebx, ebx
jmp 0x140001158
Function at 0x140001200
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.3.1
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000b0a0
mov r15d, eax
test eax, eax
je 0x140001283
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.1400025e0
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.140014950
mov r13, rax
test rax, rax
jne 0x1400012b9
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140002750
jmp 0x14000141c
mov ecx, 0x2000
call fcn.140014950
mov rbp, rax
test rax, rax
jne 0x1400012e7
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140002750
jmp 0x14000141c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000fe9c
cmp rax, rbx
jne 0x14000140e
mov rcx, rdi
call fcn.14000fc10
test eax, eax
jne 0x14000140e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140009520
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x1400013f1
cmp eax, 2
je 0x1400013ec
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x1400013b3
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.1400105dc
cmp rax, rbx
jne 0x1400013ae
mov rcx, r14
call fcn.14000fc10
test eax, eax
je 0x1400013c9
mov edi, r15d
jmp 0x1400013f1
test rsi, rsi
je 0x1400013c9
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000c630
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x140001350
cmp edi, 1
je 0x1400013e7
test r12, r12
je 0x1400013f1
mov rdi, qword [rsp + 0xc0]
jmp 0x140001300
xor r15d, r15d
jmp 0x140001414
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.1400025e0
jmp 0x140001414
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000ad70
mov rcx, r13
call fcn.14001493c
mov rcx, rbp
call fcn.14001493c
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140001460
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
lea rdx, [0x14002a844]
xor r14d, r14d
call fcn.140003f90
mov r15, rax
test rax, rax
jne 0x1400014ac
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.1400025e0
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [rbx + 0x1000]
mov rcx, r15
call fcn.1400101d4
test eax, eax
jns 0x1400014e1
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002750
jmp 0x1400015af
mov ecx, dword [rsi + 0xc]
call fcn.140014950
mov r14, rax
test rax, rax
jne 0x140001511
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002750
jmp 0x1400015af
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
jne 0x14000153d
mov r9, r14
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.140001200
test eax, eax
je 0x1400015a0
jmp 0x140001595
mov ebx, dword [rsi + 0xc]
mov rbp, r14
test rbx, rbx
je 0x1400015a0
mov r12d, 0x2000
nop
cmp rbx, r12
mov rdi, rbx
mov r9, r15
mov r8d, 1
cmova rdi, r12
mov rcx, rbp
mov rdx, rdi
call fcn.14000fe9c
cmp rax, 1
jb 0x14000157e
add rbp, rdi
sub rbx, rdi
jne 0x140001550
jmp 0x1400015a0
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002750
mov rcx, r14
call fcn.14001493c
xor r14d, r14d
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rcx, r15
call fcn.14000fb4c
mov rbx, qword [rsp + 0x58]
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop rsi
ret