joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003150
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rdi
mov rbp, rsp
sub rsp, 0x40
lea rax, [0x14000b6b0]
mov rdi, rcx
lea rcx, [0x14000b688]
mov qword [0x14000b6b8], rax
mov qword [0x14000b6b0], rax
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_InitializeCriticalSection]
nop dword [rax + rax]
call fcn.1400045f0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_CreateEventW]
nop dword [rax + rax]
mov qword [rdi], rax
test rax, rax
jne 0x1400031cb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x14000331f
mov cl, 1
call fcn.1400025f4
test eax, eax
jns 0x1400031dd
xor ecx, ecx
call fcn.1400025f4
call qword [sym.imp.api_ms_win_core_kernel32_legacy_l1_1_0.dll_WTSGetActiveConsoleSessionId]
nop dword [rax + rax]
mov ecx, eax
call fcn.1400043f0
mov ebx, eax
test eax, eax
jns 0x140003264
cmp dword [section..data], 2
jbe 0x14000325d
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x14000325d
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x14000325d
mov dword [rbp + 0x20], eax
lea rdx, [0x140008dd9]
lea rax, str.onecorexboxgameinput2published_svc_service.cpp
mov dword [rbp + 0x28], 0x23b
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x14000331f
mov r8, rdi
lea rdx, [0x140002580]
lea rcx, str.GameInputSvc
call qword [sym.imp.api_ms_win_service_core_l1_1_0.dll_RegisterServiceCtrlHandlerExW]
nop dword [rax + rax]
mov qword [rdi + 8], rax
test rax, rax
jne 0x14000331d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140003303
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140003303
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140003303
mov dword [rbp + 0x20], eax
lea rdx, [0x140008e66]
lea rax, str.onecorexboxgameinput2published_svc_service.cpp
mov dword [rbp + 0x28], 0x23e
mov qword [rbp + 0x30], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x14000330e
mov eax, 0x8000ffff
jmp 0x14000331f
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x14000331f
xor eax, eax
add rsp, 0x40
pop rdi
pop rbx
pop rbp
ret
Function at 0x14000363c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rcx, qword [rcx + 0x68]
test rcx, rcx
je 0x14000375d
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_SetEvent]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x78]
test rcx, rcx
je 0x14000371d
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
test eax, eax
je 0x14000370d
mov rcx, qword [rbx + 0x78]
mov edx, 0x5b4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
nop dword [rax + rax]
cmp dword [section..data], 2
jbe 0x14000370d
mov edx, 0x800
test qword [0x14000b010], rdx
je 0x14000370d
mov rax, qword [0x14000b018]
and rax, rdx
cmp rax, qword [0x14000b018]
jne 0x14000370d
lea rax, str.GameInput_Instance_timeout_during_Session_deletion
mov dword [rsp + 0x50], 0x45
mov qword [rsp + 0x58], rax
lea rdx, [0x140008f25]
lea rax, str.onecorexboxgameinput2published_svc_session.cpp
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
call fcn.140001168
mov rcx, qword [rbx + 0x78]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x80]
test rcx, rcx
je 0x14000374d
mov edx, 0x1388
call qword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_WaitForSingleObject]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
nop dword [rax + rax]
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp fcn.140005f94
Function at 0x1400049a4
Capabilities:
Check if file exists
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdi, r8
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_file_l1_1_0.dll_SetFileAttributesW]
nop dword [rax + rax]
test eax, eax
jne 0x140004a62
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140004a45
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004a45
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004a45
mov dword [rbp + 0x28], eax
lea rdx, [0x140008e66]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rbp - 0x10], 0x5d
mov qword [rbp - 8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x140004a53
mov eax, 0x8000ffff
jmp 0x140004ae0
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x140004ae0
mov r8, rdi
mov rcx, rbx
call fcn.140004814
mov ebx, eax
test eax, eax
jns 0x140004ade
cmp dword [section..data], 2
jbe 0x140004ada
mov r8d, 0x800
test qword [0x14000b010], r8
je 0x140004ada
mov rcx, qword [0x14000b018]
and rcx, r8
cmp rcx, qword [0x14000b018]
jne 0x140004ada
mov dword [rbp + 0x28], eax
lea rdx, [0x140008dd9]
lea rax, str.onecorexboxgameinput2published_svc_sfpmodify.cpp
mov dword [rbp - 0x10], 0x62
mov qword [rbp - 8], rax
lea rax, [rbp + 0x28]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 8]
mov qword [rsp + 0x20], rax
call fcn.140001008
mov eax, ebx
jmp 0x140004ae0
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x140006bd4
Capabilities:
Check for peb beingdebugged flag
Terminate process

Disassembly:
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov rax, qword gs:[0x60]
movzx eax, byte [rax + 2]
test eax, eax
jne 0x140006c07
mov eax, 0x2d4
add rax, 0x7ffe0000
movzx eax, byte [rax]
and eax, 3
cmp eax, 3
jne 0x140006c08
int3
lea rcx, [0x14000b6c0]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
nop dword [rax + rax]
mov rax, qword [rsp + 0x28]
mov qword [0x14000b7b8], rax
lea rax, [rsp + 0x28]
add rax, 8
mov qword [0x14000b758], rax
mov dword [0x14000bb90], 0x40000015
mov dword [0x14000bb94], 1
mov qword [0x14000bb98], 0
mov rax, qword [0x14000b7b8]
mov qword [0x14000bba0], rax
mov dword [0x14000bba8], 2
movsxd rax, dword [rsp + 0x30]
mov ecx, 8
imul rcx, rcx, 0
lea rdx, [0x14000bbb0]
mov qword [rdx + rcx], rax
mov eax, dword [rsp + 0x38]
mov ecx, 8
imul rcx, rcx, 1
lea rdx, [0x14000bbb0]
mov qword [rdx + rcx], rax
mov r8d, 2
lea rdx, [0x14000b6c0]
lea rcx, [0x14000bb90]
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_2.dll_RaiseFailFastException]
nop dword [rax + rax]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
nop dword [rax + rax]
mov edx, dword [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.ntdll.dll_NtTerminateProcess]
nop dword [rax + rax]
add rsp, 0x28
ret

Function at 0x140006cf8
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
lea rdx, [rsp + 0x50]
mov r8d, 0x104
mov byte [0x14000b686], dil
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_libraryloader_l1_2_0.dll_GetModuleFileNameW]
nop dword [rax + rax]
test eax, eax
jne 0x140006dd0
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp dword [section..data], 2
mov ebx, eax
jbe 0x140006db6
test byte [0x14000b010], 2
je 0x140006db6
mov rcx, qword [0x14000b018]
and ecx, 2
cmp rcx, qword [0x14000b018]
jne 0x140006db6
mov dword [rsp + 0x40], eax
lea rdx, [0x140009077]
lea rax, str.onecorexboxgameinput2commonPlatformInfo.cpp
mov dword [rsp + 0x44], 0x17
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x44]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call fcn.140001008
test ebx, ebx
jne 0x140006dc1
mov eax, 0x8000ffff
jmp 0x140006e35
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x140006e35
lea r8, [rsp + 0x50]
or rax, 0xffffffffffffffff
lea rcx, [rsp + 0x50]
inc rax
cmp word [rcx + rax*2], di
jne 0x140006dde
movsxd rcx, eax
mov ebx, 1
test eax, eax
js 0x140006e12
cmp word [rsp + rcx*2 + 0x50], 0x5c
je 0x140006e04
sub eax, ebx
sub rcx, rbx
jns 0x140006df3
jmp 0x140006e12
inc eax
lea r8, [rsp + 0x50]
movsxd rcx, eax
lea r8, [r8 + rcx*2]
lea rdx, str.dwm.exe
mov rcx, r8
call sub.ntdll.dll__wcsicmp
movzx ecx, byte [0x14000b686]
test eax, eax
cmove ecx, ebx
xor eax, eax
mov byte [0x14000b686], cl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400073d0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x1400071c0
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rsp + 0xb0], rax
call fcn.140006e60
xor edi, edi
test eax, eax
js 0x14000736c
call fcn.140006830
call fcn.140005fc8
test eax, eax
js 0x14000736c
cmp qword [0x14000b020], rdi
mov rax, qword [0x14000b008]
movups xmm0, xmmword [rax - 0x10]
movdqu xmmword [rsp + 0xa0], xmm0
je 0x140007222
lea ecx, [rdi + 5]
int 0x29
xorps xmm0, xmm0
lea r9, [0x14000b020]
lea r8, [section..data]
lea rdx, [0x140001350]
lea rcx, [rsp + 0xa0]
movdqu xmmword [0x14000b028], xmm0
call qword [sym.imp.ntdll.dll_EtwEventRegister]
nop dword [rax + rax]
test eax, eax
jne 0x14000728d
mov rax, qword [0x14000b5f8]
test rax, rax
je 0x14000728d
mov r8, qword [0x14000b008]
movzx r9d, word [r8]
movabs r10, 0xd1313e1f72571970
mov rcx, qword [0x14000b020]
mov edx, 2
call qword [0x140008510]
call qword [sym.imp.api_ms_win_core_processenvironment_l1_1_0.dll_GetCommandLineW]
nop dword [rax + rax]
mov rbx, rax
mov dl, dil
movzx eax, word [rax]
test ax, ax
je 0x1400072e5
movzx ecx, ax
cmp cx, 0x20
ja 0x1400072b7
movzx eax, cx
test dl, dl
je 0x1400072e0
cmp cx, 0x22
jne 0x1400072c2
test dl, dl
sete dl
add rbx, 2
movzx eax, word [rbx]
movzx ecx, ax
test ax, ax
jne 0x1400072aa
jmp 0x1400072e0
cmp ax, 0x20
ja 0x1400072e5
add rbx, 2
movzx eax, word [rbx]
test ax, ax
jne 0x1400072d3
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetStartupInfoW]
nop dword [rax + rax]
lea rdx, str._install
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
je 0x14000732a
lea rdx, str._uninstall
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsicmp]
nop dword [rax + rax]
test eax, eax
jne 0x140007331
mov ebx, 0x80004001
jmp 0x140007362
mov r8d, 0x17
lea rdx, str.GlobalGameInputSession
mov rcx, rbx
call qword [sym.imp.ntdll.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
jne 0x14000735b
mov rcx, rbx
call fcn.140005760
jmp 0x140007360
call fcn.140003424
mov ebx, eax
call fcn.1400070cc
shr ebx, 0x1f
mov eax, ebx
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1400073d0
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
sub rsp, 0x28
call 0x140007550
add rsp, 0x28
jmp 0x1400071c0
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.13
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000ac70
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002ad0
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.1400145a0
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140002830
jmp 0x14000126c
mov ecx, 0x2000
call fcn.1400145a0
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140002830
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi]
mov eax, 0x2000
cmp r12, rax
mov rbx, r12
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000fc58
cmp rax, rbx
jne 0x14000125e
mov rcx, qword [rdi]
call fcn.14000f9cc
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.1400090c0
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.140010364
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000f9cc
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000c1c0
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002ad0
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000a950
mov rcx, r13
call fcn.14001458c
mov rcx, rbp
call fcn.14001458c
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r13
push r14
push r15
mov eax, 0x1058
call fcn.14000b3e0
sub rsp, rax
mov rax, qword [0x14003d018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rax, qword [rcx]
mov rsi, rdx
mov r14, rcx
mov r13d, 0xffffffff
test rax, rax
jne 0x14000131b
add rcx, 0x78
lea rdx, [0x14002a650]
call fcn.140004060
mov qword [r14], rax
test rax, rax
jne 0x14000131b
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002ad0
xor r15d, r15d
jmp 0x1400014b5
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, rax
call fcn.14000ff70
test eax, eax
jns 0x140001350
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002830
xor r15d, r15d
jmp 0x1400014b5
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x1040], r12
call fcn.1400145a0
xor r15d, r15d
mov r12, rax
test rax, rax
jne 0x14000138b
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002830
jmp 0x14000143d
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x1090], rbx
mov qword [rsp + 0x1050], rbp
mov qword [rsp + 0x1048], rdi
jne 0x1400013c0
mov r9, r12
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
je 0x140001425
jmp 0x14000141a
mov ebx, dword [rsi + 0xc]
mov rbp, r12
test rbx, rbx
je 0x140001425
mov eax, 0x2000
mov r9, qword [r14]
cmp rbx, rax
mov rdi, rbx
mov r8d, 1
cmova rdi, rax
mov rcx, rbp
mov rdx, rdi
call fcn.14000fc58
cmp rax, 1
jb 0x140001403
add rbp, rdi
mov eax, 0x2000
sub rbx, rdi
jne 0x1400013d0
jmp 0x140001425
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002830
mov rcx, r12
call fcn.14001458c
mov r12, r15
mov rdi, qword [rsp + 0x1048]
mov rbp, qword [rsp + 0x1050]
mov rbx, qword [rsp + 0x1090]
mov rcx, qword [r14]
test rcx, rcx
je 0x14000144d
call fcn.14000f908
mov qword [r14], r15
add rsi, 0x12
mov r15, r12
test r12, r12
je 0x1400014ad
mov rdx, rsi
lea rcx, [r14 + 0x3078]
call fcn.140006d10
test eax, eax
js 0x1400014ad
mov qword [rsp + 0x28], rsi
lea r9, [r14 + 0x3078]
lea r8, str._s_c_s
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.140001e90
cmp eax, 0x1000
jge 0x1400014ad
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140004200
mov r13d, eax
mov r12, qword [rsp + 0x1040]
mov rcx, r15
call fcn.14001458c
mov eax, r13d
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14000b440
add rsp, 0x1058
pop r15
pop r14
pop r13
pop rsi
ret
Function at 0x1400014e0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov rax, qword [rcx]
mov rsi, rdx
mov r14, rcx
test rax, rax
jne 0x140001528
add rcx, 0x78
lea rdx, [0x14002a650]
call fcn.140004060
mov qword [r14], rax
test rax, rax
jne 0x140001528
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002ad0
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, rax
call fcn.14000ff70
test eax, eax
jns 0x14000155f
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002830
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x20], r15
call fcn.1400145a0
mov r15, rax
test rax, rax
jne 0x140001594
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002830
jmp 0x140001644
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r12
jne 0x1400015c5
mov r9, r15
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
je 0x140001630
jmp 0x140001625
mov ebx, dword [rsi + 0xc]
mov rbp, r15
test rbx, rbx
je 0x140001630
mov r12d, 0x2000
nop word [rax + rax]
mov r9, qword [r14]
cmp rbx, r12
mov rdi, rbx
mov r8d, 1
cmova rdi, r12
mov rcx, rbp
mov rdx, rdi
call fcn.14000fc58
cmp rax, 1
jb 0x14000160e
add rbp, rdi
sub rbx, rdi
jne 0x1400015e0
jmp 0x140001630
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002830
mov rcx, r15
call fcn.14001458c
xor r15d, r15d
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov rcx, qword [r14]
test rcx, rcx
je 0x140001658
call fcn.14000f908
mov qword [r14], 0
mov rax, r15
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x140001670
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov r14, rcx
call fcn.140006ea0
cmp eax, 0xffffffff
jne 0x140001692
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
cmp byte [rdi + 0x11], 0x6e
jne 0x1400016c4
mov rdx, rdi
mov rcx, r14
call fcn.1400012b0
mov ebx, eax
test eax, eax
jns 0x1400016b9
lea rdx, [rdi + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140002ad0
mov eax, ebx
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
lea rcx, [r14 + 0x3078]
lea rbp, [rdi + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.1400071c0
mov r12, rax
test rax, rax
jne 0x140001709
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.140002830
lea eax, [r12 - 1]
jmp 0x140001875
mov rcx, r14
call fcn.140001c10
test eax, eax
je 0x14000172e
mov rdx, rbp
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002ad0
mov ebx, 0xffffffff
jmp 0x140001857
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, qword [r14]
call fcn.14000ff70
test eax, eax
jns 0x140001764
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002830
mov ebx, 0xffffffff
jmp 0x140001857
cmp byte [rdi + 0x10], 1
jne 0x140001782
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r14
call fcn.140001050
mov ebx, eax
jmp 0x140001857
mov qword [rsp + 0x28], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x20], r15
mov ecx, r13d
call fcn.1400145a0
mov r15, rax
test rax, rax
jne 0x1400017c3
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.140002830
lea ebx, [r15 - 1]
jmp 0x14000184d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001845
mov qword [rsp + 0x58], rsi
mov r9, qword [r14]
cmp rdi, r13
mov rsi, rdi
mov r8d, 1
cmova rsi, r13
mov rcx, r15
mov rdx, rsi
call fcn.14000fc58
cmp rax, 1
jb 0x140001825
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r15
call fcn.140010364
cmp rax, 1
jb 0x140001815
sub rdi, rsi
jne 0x1400017d0
jmp 0x140001840
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
jmp 0x140001833
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov r8, rbp
call fcn.140002830
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r15
call fcn.14001458c
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rcx, qword [r14]
test rcx, rcx
je 0x14000186b
call fcn.14000f908
mov qword [r14], 0
mov rcx, r12
call fcn.14000f908
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret