joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14021a910
Capabilities:
Get system information on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x180
mov rdi, rdx
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x178], rax
mov qword [rcx + 8], rdx
mov eax, dword [0x1402b5268]
mov ecx, dword [0x1402a76e4]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14021ab79
mov rax, qword [0x1402b5260]
test rax, rax
je 0x14021a9f7
lea rdx, [rsp + 0x174]
mov dword [rdx], 0xaaaaaaaa
mov rcx, rdi
call qword [case.0x1401e9be0.0]
test eax, eax
je 0x14021a9a5
cmp dword [rsp + 0x174], 0
setne byte [rsi + 0x81]
je 0x14021a9fe
mov byte [rsi + 0x80], 0
mov dl, 1
jmp 0x14021aa33
cmp dword [0x1402acb48], 2
jg 0x14021a9f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rbx, [rsp + 0x30]
mov rcx, rbx
mov r8d, 0x4b
mov r9d, 2
call fcn.1401ed840
lea rcx, [rsp + 0x40]
lea rdx, [0x14027e490]
mov r8d, 0xe
call fcn.1401bd290
mov rcx, rbx
call fcn.1401ed8c0
mov byte [rsi + 0x81], 0
movaps xmm0, xmmword [0x140268c70]
lea rbx, [rsp + 0x30]
movaps xmmword [rbx + 0x20], xmm0
movaps xmmword [rbx + 0x10], xmm0
movaps xmmword [rbx], xmm0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbx], 9
sete byte [rsi + 0x80]
cmp byte [rsi + 0x81], 0
setne dl
lea rax, [rsi + 0x30]
lea r9, [rsi + 0x28]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov r8, rsi
call fcn.14021abc0
test al, al
jne 0x14021aab6
cmp dword [0x1402acb48], 2
jg 0x14021aa97
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x21e
mov r9d, 2
call fcn.140004b00
lea rcx, [rsp + 0x40]
lea rdx, str.GetProcessBasicInformation_failed
mov r8d, 0x21
call fcn.1401bd290
mov rcx, rsi
call fcn.140004bf0
xor esi, esi
mov rcx, qword [rsp + 0x178]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x180
pop rbx
pop rdi
pop rsi
ret
cmp byte [rsi + 0x80], 0
mov rdx, qword [rsi + 0x28]
mov rcx, rdi
mov r8, rsi
je 0x14021aad0
call fcn.14021ade0
jmp 0x14021aad5
call fcn.14021b430
test al, al
jne 0x14021ab19
cmp dword [0x1402acb48], 2
jg 0x14021aa97
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x227
mov r9d, 2
call fcn.140004b00
lea rcx, [rsp + 0x40]
lea rdx, str.ReadProcessData_failed
mov r8d, 0x16
jmp 0x14021aa8a
mov dl, byte [rsi + 0x80]
mov rcx, rdi
mov r8, rsi
call fcn.1400cca40
mov sil, 1
test al, al
jne 0x14021aa99
cmp dword [0x1402acb48], 2
jg 0x14021aa97
lea rdx, str....._third_partycrashpadcrashpadutilwinprocess_info.cc
lea rsi, [rsp + 0x30]
mov rcx, rsi
mov r8d, 0x22c
mov r9d, 2
call fcn.140004b00
lea rcx, [rsp + 0x40]
lea rdx, str.ReadMemoryInfo_failed
mov r8d, 0x15
jmp 0x14021aa8a
lea rcx, [0x1402b5268]
call fcn.1401805cc
cmp dword [0x1402b5268], 0xffffffff
jne 0x14021a95b
lea rcx, [0x140272d0a]
lea rdx, str.::IsWow64Process
xor r8d, r8d
call fcn.1400cc920
mov qword [0x1402b5260], rax
lea rcx, [0x1402b5268]
call fcn.140180634
jmp 0x14021a95b
Function at 0x1402268d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, r8
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, 0xaaaaaaaa
lea rdi, [rsp + 0x44]
mov dword [rdi], eax
lea r8, [rsp + 0x40]
mov dword [r8], eax
lea rax, [rsp + 0x3c]
mov dword [rax], 4
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
xor r8d, r8d
mov r9, rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [rdi]
xor ecx, 4
or ecx, eax
sete bl
jne 0x140226930
mov eax, dword [rsp + 0x40]
mov dword [rsi], eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401830b0
mov eax, ebx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140233e00
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x140268c70]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401c30b0
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14023c310
test al, al
je 0x140233f55
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x140233ecd
mov rcx, r14
call fcn.1401c30b0
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0x108
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14023c310
test al, al
je 0x140233f16
cmp dword [rbx], 0x4550
jne 0x140233f86
mov sil, 1
test rdi, rdi
je 0x140233f65
mov qword [rdi], r14
jmp 0x140233f65
mov ecx, 1
call fcn.1400e83b0
test al, al
je 0x140233f63
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x140233ffa
mov ecx, 1
call fcn.1400e83b0
test al, al
je 0x140233f63
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140233ff4
mov ecx, 1
call fcn.1400e83b0
test al, al
jne 0x140233fc8
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400e83b0
test al, al
je 0x140233f63
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x140233ffa
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401bd290
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14023400f
and r8d, 0x7f
jmp 0x140234016
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401bd290
mov rcx, rdi
call fcn.140004bf0
jmp 0x140233f63
Function at 0x140234030
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x1b0
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov rax, qword [0x140297028]
xor rax, rsp
mov qword [rsp + 0x1a8], rax
movaps xmm0, xmmword [0x140268c70]
lea r15, [rsp + 0x160]
movaps xmmword [r15 + 0x30], xmm0
movaps xmmword [r15 + 0x20], xmm0
movaps xmmword [r15 + 0x10], xmm0
movaps xmmword [r15], xmm0
lea r14, [rcx + 0x18]
mov rcx, r14
call fcn.1401c30b0
mov r8d, 0x40
mov rcx, rsi
mov rdx, rax
mov r9, r15
call fcn.14023c310
test al, al
je 0x140234185
movzx eax, word [rsp + 0x160]
cmp eax, 0x5a4d
jne 0x1402340fd
mov rcx, r14
call fcn.1401c30b0
movsxd r14, dword [rsp + 0x19c]
add r14, rax
mov r8d, 0xf8
mov rcx, rsi
mov rdx, r14
mov r9, rbx
call fcn.14023c310
test al, al
je 0x140234146
cmp dword [rbx], 0x4550
jne 0x1402341b6
mov sil, 1
test rdi, rdi
je 0x140234195
mov qword [rdi], r14
jmp 0x140234195
mov ecx, 1
call fcn.1400e83b0
test al, al
je 0x140234193
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x15a
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_e_magic_in_dos_header_of
mov r8d, 0x21
jmp 0x14023422a
mov ecx, 1
call fcn.1400e83b0
test al, al
je 0x140234193
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x162
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_nt_headers_from
jmp 0x140234224
mov ecx, 1
call fcn.1400e83b0
test al, al
jne 0x1402341f8
xor esi, esi
mov rcx, qword [rsp + 0x1a8]
xor rcx, rsp
call fcn.1401830b0
mov eax, esi
add rsp, 0x1b0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov ecx, 1
call fcn.1400e83b0
test al, al
je 0x140234193
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x168
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.invalid_signature_in_nt_headers_of
mov r8d, 0x23
jmp 0x14023422a
lea rdx, str....._third_partycrashpadcrashpad_snapshotwinpe_image_reader.cc
lea rdi, [rsp + 0x28]
mov rcx, rdi
mov r8d, 0x154
mov r9d, 1
call fcn.140004b00
lea rcx, [rsp + 0x38]
lea rdx, str.could_not_read_dos_header_from
mov r8d, 0x1f
call fcn.1401bd290
movzx r8d, byte [rsi + 0x17]
test r8b, r8b
js 0x14023423f
and r8d, 0x7f
jmp 0x140234246
mov r8, qword [rsi + 8]
mov rsi, qword [rsi]
mov rcx, rax
mov rdx, rsi
call fcn.1401bd290
mov rcx, rdi
call fcn.140004bf0
jmp 0x140234193
Function at 0x14000d990
Capabilities:
Parse pe header
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x50
mov rax, qword [0x14004de00]
xor rax, rsp
mov qword [rsp + 0x40], rax
and qword [rsp + 0x20], 0
mov rbx, rcx
mov rdx, rcx
lea rcx, [rsp + 0x20]
lea r8, [0x140040c04]
call fcn.140020100
mov r9, qword [rsp + 0x20]
test eax, eax
jne 0x14000db36
test r9, r9
je 0x14000db36
lea esi, [rax + 1]
lea r8d, [rax + 2]
lea rcx, [rsp + 0x30]
mov rdx, rsi
call fcn.14001ffa8
cmp rax, 2
jne 0x14000db20
cmp byte [rsp + 0x30], 0x4d
jne 0x14000db20
cmp byte [rsp + 0x31], 0x5a
jne 0x14000db20
mov rcx, qword [rsp + 0x20]
lea edx, [rsi + 0x3b]
xor r8d, r8d
call fcn.14001fbdc
test eax, eax
je 0x14000da42
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_2__S
mov rdx, rbx
call fcn.140016394
jmp 0x14000db48
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x2c]
mov r8, rsi
mov edx, 4
call fcn.14001ffa8
mov rcx, qword [rsp + 0x20]
cmp rax, rsi
je 0x14000da71
call fcn.14001ee5c
lea rcx, str.no_PE32_file_3__S
jmp 0x14000da35
mov edx, dword [rsp + 0x2c]
xor r8d, r8d
call fcn.14001fbdc
test eax, eax
je 0x14000da94
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_4__S
jmp 0x14000da35
mov r9, qword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov rdx, rsi
call fcn.14001ffa8
cmp rax, 4
jne 0x14000db0a
cmp byte [rsp + 0x30], 0x50
jne 0x14000db0a
cmp byte [rsp + 0x31], 0x45
jne 0x14000db0a
cmp byte [rsp + 0x32], 0
jne 0x14000db0a
cmp byte [rsp + 0x33], 0
jne 0x14000db0a
mov r9, qword [rsp + 0x20]
lea edx, [rax - 2]
lea rcx, [rsp + 0x28]
mov r8, rsi
call fcn.14001ffa8
mov rcx, qword [rsp + 0x20]
cmp rax, rsi
je 0x14000dafe
call fcn.14001ee5c
lea rcx, str.no_PE32_file_6__S
jmp 0x14000da35
call fcn.14001ee5c
movzx eax, word [rsp + 0x28]
jmp 0x14000db4a
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file_5__S
jmp 0x14000da35
mov rcx, qword [rsp + 0x20]
call fcn.14001ee5c
lea rcx, str.no_PE32_file__S
jmp 0x14000da35
lea rcx, str.could_not_open__S__d__p
mov r8d, eax
mov rdx, rbx
call fcn.140016394
xor eax, eax
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14001c510
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rsi
ret

Function at 0x140015960
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r10, rdx
test r8d, r8d
jle 0x140015994
mov r9d, r8d
mov r8d, dword [rcx]
movsx eax, byte [r10]
inc r10
xor rax, r8
shr r8d, 8
movzx edx, al
lea rax, [0x14004d4a0]
mov eax, dword [rax + rdx*4]
xor eax, r8d
sub r9, 1
mov dword [rcx], eax
jne 0x14001596b
repz ret
Function at 0x140016f78
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0x50
movss xmm0, dword [0x14004dcb8]
and dword [rax + 0x20], 0
and dword [rax - 0x38], 0
ucomiss xmm0, dword [0x1400425b8]
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
xorps xmm7, xmm7
jp 0x14001701a
jne 0x14001701a
movss xmm6, dword [0x1400425b4]
lea rcx, str.J2D_UISCALE
movss dword [0x14004dcb8], xmm6
call fcn.14001f9ac
test rax, rax
je 0x140017012
xor edx, edx
mov rcx, rax
call fcn.140020e84
cvtsd2ss xmm1, xmm0
movss dword [0x14004dcb8], xmm1
call fcn.140020c78
cmp dword [rax], 0x22
je 0x140017005
movss xmm0, dword [0x14004dcb8]
comiss xmm7, xmm0
jb 0x14001701a
movaps xmm0, xmm6
movss dword [0x14004dcb8], xmm0
jmp 0x14001701a
movss xmm0, dword [0x14004dcb8]
comiss xmm0, xmm7
jbe 0x14001702c
movss dword [rbx], xmm0
movss dword [rdi], xmm0
jmp 0x140017119
cmp qword [0x14005b460], 0
jne 0x140017068
lea rcx, str.shcore.dll
call qword [0x14003d148]
mov qword [0x14005b460], rax
test rax, rax
je 0x140017068
lea rdx, str.GetDpiForMonitor
mov rcx, rax
call qword [0x14003d140]
mov qword [0x14005b458], rax
jmp 0x14001706f
mov rax, qword [0x14005b458]
test rax, rax
je 0x1400170b1
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x78]
xor edx, edx
mov rcx, rsi
call rax
test eax, eax
jne 0x140017119
mov eax, dword [rsp + 0x78]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2ss xmm0, rax
mov eax, dword [rsp + 0x20]
cvtsi2ss xmm1, rax
movss dword [rdi], xmm0
movss dword [rbx], xmm1
jmp 0x140017119
lea rcx, str.D2d1.dll
call qword [0x14003d148]
mov qword [0x14005b450], rax
test rax, rax
je 0x140017119
lea rdx, [0x140042558]
mov rcx, rax
call qword [0x14003d140]
mov qword [0x14005b448], rax
test rax, rax
je 0x140017119
lea r9, [rsp + 0x28]
lea rdx, [0x140042548]
xor r8d, r8d
xor ecx, ecx
call rax
test eax, eax
jne 0x140017119
mov rcx, qword [rsp + 0x28]
mov r8, rbx
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
add rsp, 0x50
pop rdi
ret
Function at 0x140001490
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
pxor xmm0, xmm0
lea r14, [rsp + 0x40]
mov r13, rcx
mov r12, rdx
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x100], r8
lea rdx, section..rdata
mov r8d, 0x58
mov rcx, r14
mov qword [rsp + 0x108], r9
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
call fcn.14000a4a0
test eax, eax
mov ebx, eax
jne 0x1400016d3
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x140001710
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rbp, rax
je 0x1400016f1
mov r15d, dword [r12 + 8]
mov ebx, 0x2000
mov r9, r13
mov edx, 1
cmp r15, rbx
mov rcx, rdi
cmovbe rbx, r15
mov r8, rbx
call sub.msvcrt.dll_fread
cmp rax, rbx
jne 0x1400015bf
mov rcx, r13
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x1400015bf
mov dword [rsp + 0x48], ebx
mov esi, eax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], 0x2000
call fcn.14000a570
cmp eax, 0xffffffff
mov ebx, eax
jge 0x1400015a0
cmp eax, 0xfffffffc
jl 0x1400015f8
mov r10d, eax
jmp 0x1400015ab
cmp eax, 2
jne 0x1400015f8
mov r10d, 0xfffffffd
lea rdx, [r12 + 0x12]
mov r8d, r10d
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.140002a50
mov ebx, 0xffffffff
mov rcx, r14
call fcn.14000c320
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rbp
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x58]
mov r8d, 0x2000
sub r8, rax
mov r9, rax
cmp qword [rsp + 0x100], 0
je 0x140001690
mov r9, qword [rsp + 0x100]
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], r8
call sub.msvcrt.dll_fwrite
mov r8, qword [rsp + 0x30]
cmp rax, r8
jne 0x1400016c8
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x1400016c8
mov r9d, dword [rsp + 0x58]
test r9d, r9d
je 0x140001574
mov eax, esi
mov esi, ebx
mov rbx, qword [rsp + 0x28]
sub r15, rbx
cmp esi, 1
je 0x14000172f
test r15, r15
jne 0x140001534
cmp esi, 1
mov r10d, esi
mov ebx, eax
je 0x1400015c4
jmp 0x1400015ab
cmp qword [rsp + 0x108], 0
je 0x140001651
mov rcx, qword [rsp + 0x108]
mov rdx, rbp
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x3c], eax
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x3c]
add qword [rsp + 0x108], r8
jmp 0x140001651
mov r10d, 0xffffffff
jmp 0x1400015ab
lea rdx, [r12 + 0x12]
mov r8d, eax
mov ebx, 0xffffffff
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002a50
jmp 0x1400015dc
lea r8, [r12 + 0x12]
xor ebp, ebp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140002bd0
jmp 0x1400015c4
lea r8, [r12 + 0x12]
xor ebp, ebp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140002bd0
jmp 0x1400015c4
mov ebx, eax
jmp 0x1400015c4
Function at 0x140001780
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r12, rdx
lea rcx, [rcx + 0x70]
lea rdx, [0x140019129]
call fcn.1400041a0
test rax, rax
mov rbp, rax
je 0x1400018b0
mov edx, dword [r12 + 4]
xor r8d, r8d
mov rcx, rax
add edx, dword [rbx]
call fcn.14000f0e0
test eax, eax
js 0x140001890
mov esi, dword [r12 + 0xc]
mov rcx, rsi
call sub.msvcrt.dll_malloc
test rax, rax
mov r13, rax
je 0x1400018c6
cmp byte [r12 + 0x10], 1
je 0x140001870
test rsi, rsi
mov rdi, rax
jne 0x140001808
jmp 0x140001850
add rdi, rbx
sub rsi, rbx
je 0x140001850
mov ebx, 0x2000
mov r9, rbp
mov r8d, 1
cmp rsi, rbx
mov rcx, rdi
cmovbe rbx, rsi
mov rdx, rbx
call sub.msvcrt.dll_fread
test rax, rax
jne 0x140001800
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002bd0
mov rcx, r13
call sub.msvcrt.dll_free
xor r13d, r13d
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r8d, r8d
mov r9, rax
mov rdx, r12
mov rcx, rbp
call fcn.140001490
test eax, eax
je 0x140001850
jmp 0x140001845
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002bd0
jmp 0x14000184d
lea rdx, [r12 + 0x12]
xor r13d, r13d
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002a50
jmp 0x140001858
lea r8, [r12 + 0x12]
mov r9d, esi
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002bd0
jmp 0x14000184d
Function at 0x140001990
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [rcx + 0x5070], 1
mov rsi, rcx
mov rbx, rdx
jne 0x140001b90
cmp byte [rdx + 0x11], 0x6e
je 0x140001ab0
lea r13, [rdx + 0x12]
lea rcx, [rcx + 0x3070]
mov rdx, r13
call fcn.1400080a0
test rax, rax
mov r12, rax
je 0x140001ba6
lea rcx, [rsi + 0x70]
lea rdx, [0x140019129]
call fcn.1400041a0
test rax, rax
mov rbp, rax
je 0x140001b20
mov edx, dword [rbx + 4]
xor r8d, r8d
mov rcx, rax
add edx, dword [rsi]
call fcn.14000f0e0
test eax, eax
js 0x140001b70
cmp byte [rbx + 0x10], 1
je 0x140001ad0
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x140001bbe
mov esi, dword [rbx + 0xc]
test rsi, rsi
jne 0x140001a66
jmp 0x140001b40
mov r9, r12
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x140001b50
sub rsi, rbx
je 0x140001b40
mov ebx, 0x2000
mov r9, rbp
mov r8d, 1
cmp rsi, rbx
mov rcx, rdi
cmovbe rbx, rsi
mov rdx, rbx
call sub.msvcrt.dll_fread
test rax, rax
jne 0x140001a40
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
mov r8, r13
lea rcx, str.fread
call fcn.140002bd0
mov esi, 0xffffffff
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x140001ae3
call fcn.1400018f0
test eax, eax
mov esi, eax
js 0x140001b08
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r9d, r9d
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call fcn.140001490
mov esi, eax
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov rcx, r12
call sub.msvcrt.dll_fclose
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [rbx + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140002a50
jmp 0x140001abb
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
mov rdx, r13
mov esi, 0xffffffff
call fcn.140002a50
jmp 0x140001aeb
xor esi, esi
jmp 0x140001aa6
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
mov r8, r13
lea rcx, str.fwrite
call fcn.140002bd0
jmp 0x140001aa1
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
mov r8, r13
lea rcx, str.fseek
call fcn.140002bd0
mov esi, 0xffffffff
jmp 0x140001ae3
lea rcx, str.pyi_arch_extract2fs_was_called_before_temporary_directory_was_initialized__n
call fcn.140002a50
mov esi, 0xffffffff
jmp 0x140001abb
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
mov r8, r13
lea rcx, str.fopen
call fcn.140002bd0
jmp 0x140001b9c
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
mov r8, r13
lea rcx, str.malloc
call fcn.140002bd0
jmp 0x140001b86
Function at 0x140001be0
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rdx, [0x140019129]
mov rsi, rcx
lea rcx, [rcx + 0x70]
call fcn.1400041a0
test rax, rax
mov rbx, rax
je 0x140001e01
mov rax, qword [0x14001f2e0]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rbx
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
shr rax, 0x18
add eax, 0xc
mov byte [rsp + 0x2b], al
call fcn.1400086d0
test rax, rax
mov rdi, rax
jne 0x140001c58
mov edi, 0xffffffff
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.14000f0e0
test eax, eax
js 0x140001db0
lea rcx, [rsi + 0x18]
mov r9, rbx
mov r8d, 1
mov edx, 0x58
call sub.msvcrt.dll_fread
test rax, rax
je 0x140001dd0
mov eax, dword [rsi + 0x20]
add rdi, 0x58
mov dword [rsi + 0x5074], 0
mov edx, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x28]
mov r8d, dword [rsi + 0x2c]
bswap eax
movd xmm0, eax
mov eax, eax
bswap edx
movd xmm2, edx
sub rdi, rax
punpckldq xmm0, xmm2
bswap ecx
movq qword [rsi + 0x20], xmm0
movd xmm0, ecx
bswap r8d
movd xmm3, r8d
add edx, edi
mov qword [rsi], rdi
punpckldq xmm0, xmm3
mov dword [0x140022040], r8d
mov rcx, rbx
xor r8d, r8d
movq qword [rsi + 0x28], xmm0
call fcn.14000f0e0
movsxd rdi, dword [rsi + 0x28]
mov rcx, rdi
call sub.msvcrt.dll_malloc
test rax, rax
mov rcx, rax
mov qword [rsi + 8], rax
je 0x140001e0b
mov r9, rbx
mov r8d, 1
mov rdx, rdi
call sub.msvcrt.dll_fread
test rax, rax
je 0x140001d98
movsxd rax, dword [rsi + 0x28]
mov rcx, rbx
add rax, qword [rsi + 8]
mov qword [rsi + 0x10], rax
call sub.msvcrt.dll_ferror
test eax, eax
mov edi, eax
jne 0x140001df0
mov rax, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
cmp rax, r9
jae 0x140001c40
nop dword [rax]
mov ecx, dword [rax + 4]
mov edx, dword [rax]
mov r8d, dword [rax + 8]
bswap ecx
movd xmm0, ecx
mov ecx, dword [rax + 0xc]
bswap edx
mov dword [rax], edx
movsxd rdx, edx
bswap r8d
movd xmm1, r8d
punpckldq xmm0, xmm1
movq qword [rax + 4], xmm0
bswap ecx
mov dword [rax + 0xc], ecx
add rax, rdx
cmp rax, r9
jb 0x140001d58
jmp 0x140001c40
lea rdx, str.Could_not_read_full_TOC__n
lea rcx, str.fread
call fcn.140002bd0
jmp 0x140001c3b
lea rdx, str.Failed_to_seek_to_cookie_position__n
lea rcx, str.fseek
call fcn.140002bd0
jmp 0x140001c3b
lea rdx, str.Failed_to_read_cookie__n
lea rcx, str.fread
call fcn.140002bd0
jmp 0x140001c3b
lea rcx, str.Error_on_file._n
call fcn.140002a50
jmp 0x140001c3b
mov edi, 0xffffffff
jmp 0x140001c48
lea rdx, str.Could_not_allocate_buffer_for_TOC__n
lea rcx, str.malloc
call fcn.140002bd0
jmp 0x140001c3b