joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b0b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x220
mov dword [rsp + 4], 0
mov dword [rsp + 8], 0
lea rax, [rsp + 0x120]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, pe_nt_image_headers64
rep stosb byte [rdi], al
mov byte [rsp], 0
mov dword [rsp + 4], 0
jmp 0x14000b120
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 0x100
jge 0x14000b161
movsxd rax, dword [rsp + 4]
mov cl, byte [rsp + 4]
mov byte [rsp + rax + 0x20], cl
xor edx, edx
mov eax, dword [rsp + 4]
div dword [rsp + 0x248]
mov eax, edx
mov eax, eax
movsxd rcx, dword [rsp + 4]
mov rdx, qword [rsp + 0x240]
mov al, byte [rdx + rax]
mov byte [rsp + rcx + 0x120], al
jmp 0x14000b116
mov dword [rsp + 4], 0
jmp 0x14000b175
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
cmp dword [rsp + 4], 0x100
jge 0x14000b1e0
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 0x20]
mov ecx, dword [rsp + 8]
add ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 4]
movzx ecx, byte [rsp + rcx + 0x120]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 8], eax
movsxd rax, dword [rsp + 4]
mov al, byte [rsp + rax + 0x20]
mov byte [rsp], al
movsxd rax, dword [rsp + 8]
movsxd rcx, dword [rsp + 4]
mov al, byte [rsp + rax + 0x20]
mov byte [rsp + rcx + 0x20], al
movsxd rax, dword [rsp + 8]
mov cl, byte [rsp]
mov byte [rsp + rax + 0x20], cl
jmp 0x14000b16b
mov dword [rsp + 0x10], 0
mov dword [rsp + 4], 0
mov dword [rsp + 8], 0
mov byte [rsp], 0
mov dword [rsp + 0xc], 0
mov dword [rsp + 0xc], 0
jmp 0x14000b218
mov eax, dword [rsp + 0xc]
inc eax
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0x238]
cmp dword [rsp + 0xc], eax
jae 0x14000b2ef
mov eax, dword [rsp + 4]
inc eax
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 4], eax
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 0x20]
mov ecx, dword [rsp + 8]
add ecx, eax
mov eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 8], eax
movsxd rax, dword [rsp + 4]
mov al, byte [rsp + rax + 0x20]
mov byte [rsp], al
movsxd rax, dword [rsp + 8]
movsxd rcx, dword [rsp + 4]
mov al, byte [rsp + rax + 0x20]
mov byte [rsp + rcx + 0x20], al
movsxd rax, dword [rsp + 8]
mov cl, byte [rsp]
mov byte [rsp + rax + 0x20], cl
movsxd rax, dword [rsp + 4]
movzx eax, byte [rsp + rax + 0x20]
movsxd rcx, dword [rsp + 8]
movzx ecx, byte [rsp + rcx + 0x20]
add eax, ecx
cdq
and edx, 0xff
add eax, edx
and eax, 0xff
sub eax, edx
mov dword [rsp + 0x10], eax
movsxd rax, dword [rsp + 0x10]
movzx eax, byte [rsp + rax + 0x20]
mov ecx, dword [rsp + 0xc]
mov rdx, qword [rsp + 0x230]
movzx ecx, byte [rdx + rcx]
xor ecx, eax
mov eax, ecx
mov ecx, dword [rsp + 0xc]
mov rdx, qword [rsp + 0x230]
mov byte [rdx + rcx], al
jmp 0x14000b20e
add rsp, 0x220
pop rdi
ret
Function at 0x14000b2f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0
je 0x14000b31c
cmp qword [rsp + 0x88], 0
jne 0x14000b323
xor eax, eax
jmp 0x14000b50e
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
add rax, 0x88
mov qword [rsp + 0x48], rax
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x14000b37f
xor eax, eax
jmp 0x14000b50e
mov edx, dword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
call fcn.14000f7b8
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14000b39f
xor eax, eax
jmp 0x14000b50e
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x18]
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x14000b3d0
xor eax, eax
jmp 0x14000b50e
mov rax, qword [rsp + 0x38]
mov edx, dword [rax + 0x20]
mov rcx, qword [rsp + 0x28]
call fcn.14000f7b8
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14000b3f4
xor eax, eax
jmp 0x14000b50e
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x38]
mov edx, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x28]
call fcn.14000f7b8
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14000b42f
xor eax, eax
jmp 0x14000b50e
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x38]
mov edx, dword [rax + 0x24]
mov rcx, qword [rsp + 0x28]
call fcn.14000f7b8
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xffffffff
jne 0x14000b46a
xor eax, eax
jmp 0x14000b50e
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x24]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x50]
mov edx, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
call fcn.14000f7b8
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x58]
call fcn.140016090
test eax, eax
jne 0x14000b4f7
mov eax, dword [rsp + 0x24]
dec eax
mov eax, eax
mov rcx, qword [rsp + 0x60]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x68]
mov edx, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x28]
call fcn.14000f7b8
mov rcx, qword [rsp + 0x80]
add rcx, rax
mov rax, rcx
jmp 0x14000b50e
mov eax, dword [rsp + 0x24]
dec eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0
jne 0x14000b481
xor eax, eax
add rsp, 0x78
ret
Function at 0x14000f7b8
Capabilities:
Enumerate pe sections

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x18
cmp dword [rsp + 0x28], 0
jne 0x14000f7d8
mov rax, 0xffffffffffffffff
jmp 0x14000f880
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax + 6]
dec eax
mov dword [rsp], eax
jmp 0x14000f808
mov eax, dword [rsp]
dec eax
mov dword [rsp], eax
cmp dword [rsp], 0
jl 0x14000f879
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 8]
mov edx, dword [rsp + 0x28]
cmp dword [rcx + rax + 0xc], edx
ja 0x14000f877
movsxd rax, dword [rsp]
imul rax, rax, 0x28
movsxd rcx, dword [rsp]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 8]
mov eax, dword [rdx + rax + 0xc]
mov rdx, qword [rsp + 8]
add eax, dword [rdx + rcx + 0x10]
cmp dword [rsp + 0x28], eax
ja 0x14000f877
movsxd rax, dword [rsp]
imul rax, rax, 0x28
mov rcx, qword [rsp + 8]
mov eax, dword [rcx + rax + 0x14]
add eax, dword [rsp + 0x28]
movsxd rcx, dword [rsp]
imul rcx, rcx, 0x28
mov rdx, qword [rsp + 8]
sub eax, dword [rdx + rcx + 0xc]
mov eax, eax
jmp 0x14000f880
jmp 0x14000f800
mov rax, 0xffffffffffffffff
add rsp, 0x18
ret
Function at 0x1400105dc
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, rdx
lea r8, [rsp + 0x60]
mov ebx, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov r8d, ebx
mov ecx, 0x1300
neg eax
sbb r9d, r9d
and qword [rsp + 0x30], 0
and r9d, dword [rsp + 0x60]
xor edx, edx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x60], r9d
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x140010660
mov r8, qword [rdi]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x140025430]
cmp byte [rcx + rax], 0
je 0x140010660
dec r8
sub rdx, 1
jne 0x140010646
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x140011958
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400119a2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400119a2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400119a2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400119a2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400119a2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400119a4
xor al, al
add rsp, 0x28
ret

Function at 0x1400163d4
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x140016267
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140016267
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140016267
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140016267
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140016267
cmp dword [rcx + 0x84], 0xe
jbe 0x140016267
cmp dword [rcx + 0xf8], 0
je 0x140016267
mov ecx, ebx
call fcn.140016308
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.1400160f8
cmp dword [rbp + 0x20], 0
je 0x1400162b4
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.1400162bc
int3
xor r8d, r8d
xor edx, edx
jmp 0x140016200
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.12
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.140008c40
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140001c70
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.14001408c
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140001c30
jmp 0x14000126c
mov ecx, 0x2000
call fcn.14001408c
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140001c30
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi]
mov eax, 0x2000
cmp r12, rax
mov rbx, r12
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000e89c
cmp rax, rbx
jne 0x14000125e
mov rcx, qword [rdi]
call fcn.14000e610
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.1400070b0
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.14000efdc
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000e610
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000ae10
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140001c70
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.140008930
mov rcx, r13
call fcn.140014078
mov rcx, rbp
call fcn.140014078
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov rax, qword [rcx]
mov rsi, rdx
mov r14, rcx
test rax, rax
jne 0x1400012f8
add rcx, 0x78
lea rdx, [0x14002a570]
call fcn.140002de0
mov qword [r14], rax
test rax, rax
jne 0x1400012f8
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140001c70
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, rax
call fcn.14000ebd4
test eax, eax
jns 0x14000132f
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001c30
xor eax, eax
add rsp, 0x28
pop r14
pop rsi
ret
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x20], r15
call fcn.14001408c
mov r15, rax
test rax, rax
jne 0x140001364
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140001c30
jmp 0x140001414
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], r12
jne 0x140001395
mov r9, r15
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
je 0x140001400
jmp 0x1400013f5
mov ebx, dword [rsi + 0xc]
mov rbp, r15
test rbx, rbx
je 0x140001400
mov r12d, 0x2000
nop word [rax + rax]
mov r9, qword [r14]
cmp rbx, r12
mov rdi, rbx
mov r8d, 1
cmova rdi, r12
mov rcx, rbp
mov rdx, rdi
call fcn.14000e89c
cmp rax, 1
jb 0x1400013de
add rbp, rdi
sub rbx, rdi
jne 0x1400013b0
jmp 0x140001400
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140001c30
mov rcx, r15
call fcn.140014078
xor r15d, r15d
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x58]
mov rcx, qword [r14]
test rcx, rcx
je 0x140001428
call fcn.14000e54c
mov qword [r14], 0
mov rax, r15
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x140001440
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x30
mov rdi, rdx
mov r14, rcx
call fcn.140005860
cmp eax, 0xffffffff
jne 0x140001462
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
lea rcx, [r14 + 0x3078]
lea rbp, [rdi + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.140005b80
mov r12, rax
test rax, rax
jne 0x1400014a7
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.140001c30
lea eax, [r12 - 1]
jmp 0x140001635
mov rax, qword [r14]
test rax, rax
jne 0x1400014e0
lea rcx, [r14 + 0x78]
lea rdx, [0x14002a570]
call fcn.140002de0
mov qword [r14], rax
test rax, rax
jne 0x1400014e0
mov rdx, rbp
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140001c70
mov ebx, 0xffffffff
jmp 0x140001617
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [r14 + 8]
mov rcx, rax
call fcn.14000ebd4
test eax, eax
jns 0x140001516
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001c30
mov ebx, 0xffffffff
jmp 0x140001617
cmp byte [rdi + 0x10], 1
jne 0x140001534
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r14
call fcn.140001050
mov ebx, eax
jmp 0x140001617
mov qword [rsp + 0x28], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x20], r15
mov ecx, r13d
call fcn.14001408c
mov r15, rax
test rax, rax
jne 0x140001575
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.140001c30
lea ebx, [r15 - 1]
jmp 0x14000160d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001605
mov qword [rsp + 0x58], rsi
nop word [rax + rax]
mov r9, qword [r14]
cmp rdi, r13
mov rsi, rdi
mov r8d, 1
cmova rsi, r13
mov rcx, r15
mov rdx, rsi
call fcn.14000e89c
cmp rax, 1
jb 0x1400015e5
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r15
call fcn.14000efdc
cmp rax, 1
jb 0x1400015d5
sub rdi, rsi
jne 0x140001590
jmp 0x140001600
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
jmp 0x1400015f3
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov r8, rbp
call fcn.140001c30
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r15
call fcn.140014078
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x20]
mov rcx, qword [r14]
test rcx, rcx
je 0x14000162b
call fcn.14000e54c
mov qword [r14], 0
mov rcx, r12
call fcn.14000e54c
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rbx
ret
Function at 0x1400017b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x14003d008]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword [rcx]
mov rbx, rcx
test rax, rax
jne 0x1400017ec
add rcx, 0x78
lea rdx, [0x14002a570]
call fcn.140002de0
mov qword [rbx], rax
test rax, rax
je 0x14000183c
mov r8d, 8
mov dword [rsp + 0x20], 0x93272f74
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x24], 0x62d36d1b
mov rcx, rax
call fcn.1400062e0
mov rdi, rax
test rax, rax
je 0x14000183c
mov rcx, qword [rbx]
xor r8d, r8d
mov rdx, rax
call fcn.14000ebd4
test eax, eax
jns 0x140001846
lea rdx, str.Failed_to_seek_to_cookie_position__n
lea rcx, str.fseek
call fcn.140001c30
mov eax, 0xffffffff
jmp 0x1400019cf
mov r9, qword [rbx]
lea rcx, [rbx + 0x20]
mov edx, 0x58
lea r8d, [rdx - 0x57]
call fcn.14000e89c
cmp rax, 1
jae 0x14000187e
lea rdx, str.Failed_to_read_cookie__n
lea rcx, str.fread
call fcn.140001c30
mov eax, 0xffffffff
jmp 0x1400019cf
mov ecx, dword [rbx + 0x28]
xor r8d, r8d
mov eax, dword [rbx + 0x2c]
bswap eax
xor eax, 0x579019ab
mov dword [rbx + 0x2c], eax
mov eax, dword [rbx + 0x30]
bswap ecx
bswap eax
xor ecx, 0x78eba6ad
xor eax, 0x34e7a40f
sub rdi, rcx
mov dword [rbx + 0x30], eax
mov eax, dword [rbx + 0x34]
add rdi, 0x58
mov qword [rbx + 8], rdi
xor edi, edi
bswap eax
mov dword [rbx + 0x28], ecx
mov dword [rbx + 0x34], eax
mov dword [rbx + 0x507c], edi
mov dword [0x14003dc74], eax
mov edx, dword [rbx + 0x2c]
add rdx, qword [rbx + 8]
mov rcx, qword [rbx]
call fcn.14000ebd4
movsxd rcx, dword [rbx + 0x30]
call fcn.14001408c
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x140001906
lea rdx, str.Could_not_allocate_buffer_for_TOC__n
lea rcx, str.malloc
call fcn.140001c30
lea eax, [rdi - 1]
jmp 0x1400019cf
movsxd rdx, dword [rbx + 0x30]
mov r8d, 1
mov r9, qword [rbx]
mov rcx, rax
call fcn.14000e89c
cmp rax, 1
jae 0x14000192d
lea rdx, str.Could_not_read_full_TOC__n
jmp 0x140001868
movsxd rax, dword [rbx + 0x30]
add rax, qword [rbx + 0x10]
mov rcx, qword [rbx]
mov qword [rbx + 0x18], rax
call fcn.14000e610
test eax, eax
je 0x140001958
lea rcx, str.Error_on_file._n
call fcn.140001c70
mov eax, 0xffffffff
jmp 0x1400019cf
mov rax, qword [rbx + 0x10]
cmp rax, qword [rbx + 0x18]
jae 0x1400019bd
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rax + 4]
mov edx, dword [rax]
bswap ecx
xor ecx, 0x73c785fe
mov dword [rax + 4], ecx
mov ecx, dword [rax + 8]
bswap ecx
xor ecx, 0x9497d559
mov dword [rax + 8], ecx
mov ecx, dword [rax + 0xc]
bswap ecx
mov dword [rax + 0xc], ecx
bswap edx
mov dword [rax], edx
movsxd rcx, edx
add rcx, rax
mov rax, rcx
cmp rcx, qword [rbx + 0x10]
jb 0x1400019b1
cmp rcx, qword [rbx + 0x18]
jb 0x140001970
jmp 0x1400019bd
lea rcx, str.Cannot_read_Table_of_Contents._n
call fcn.140001c70
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400019cd
call fcn.14000e54c
mov qword [rbx], rdi
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000a060
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1400055c0
Capabilities:
Create directory
Query environment variable

Disassembly:
push rdi
mov eax, 0x4030
call fcn.14000a090
sub rsp, rax
mov rax, qword [0x14003d008]
xor rax, rsp
mov qword [rsp + 0x4020], rax
mov rdx, rcx
xor r8d, r8d
xor ecx, ecx
call fcn.140006d30
mov rdi, rax
test rax, rax
jne 0x140005609
lea rcx, str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.140001c70
xor eax, eax
jmp 0x140005718
mov r8d, 0x1000
mov qword [rsp + 0x4048], rbx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.140014078
test ebx, ebx
jne 0x140005646
lea rcx, str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.140001c70
xor eax, eax
jmp 0x140005710
lea rcx, [rsp + 0x20]
call fcn.1400068e0
test eax, eax
je 0x140005660
lea rcx, [rsp + 0x20]
call fcn.140015fe8
jmp 0x140005672
mov r8d, 0x1000
lea rdx, [rsp + 0x20]
xor ecx, ecx
call fcn.1400152f8
mov rbx, rax
test rax, rax
jne 0x14000568d
lea rcx, str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.140001c70
xor eax, eax
jmp 0x140005710
xor edx, edx
lea rcx, [rsp + 0x2020]
mov r8d, 0x2000
call fcn.14000b7d0
mov edx, 0x5c
mov rcx, rbx
call fcn.14000b644
mov rdi, rax
test rax, rax
je 0x140005702
nop word [rax + rax]
mov r8, rdi
lea rcx, [rsp + 0x2020]
sub r8, rbx
mov rdx, rbx
sar r8, 1
inc r8
call fcn.14001606c
xor edx, edx
lea rcx, [rsp + 0x2020]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.14000b644
mov rdi, rax
test rax, rax
jne 0x1400056c0
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rax, rbx
mov rbx, qword [rsp + 0x4048]
mov rcx, qword [rsp + 0x4020]
xor rcx, rsp
call fcn.14000a060
add rsp, 0x4030
pop rdi
ret

Function at 0x140005740
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x1030
call fcn.14000a090
sub rsp, rax
mov rax, qword [0x14003d008]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rbx, rdx
mov rdi, r8
lea rdx, [0x14002a570]
call fcn.140002de0
mov rdx, rdi
mov rcx, rbx
mov rsi, rax
call fcn.140005b80
xor edi, edi
mov rbx, rax
test rsi, rsi
je 0x140005833
mov rcx, rsi
test rax, rax
je 0x14000583b
call fcn.14000e5e4
test eax, eax
jne 0x14000581f
nop word [rax + rax]
mov r9, rsi
lea rcx, [rsp + 0x20]
mov edx, 1
mov r8d, 0x1000
call fcn.14000e89c
test rax, rax
jne 0x1400057de
mov rcx, rsi
call fcn.14000e610
test eax, eax
je 0x140005804
mov rcx, rsi
jmp 0x140005815
mov r9, rbx
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 1
call fcn.14000efdc
test rax, rax
je 0x140005812
mov rcx, rbx
call fcn.14000e610
test eax, eax
jne 0x140005812
mov rcx, rsi
call fcn.14000e5e4
test eax, eax
je 0x1400057b0
jmp 0x14000581f
mov rcx, rbx
call fcn.140017a14
mov edi, 0xffffffff
mov rcx, rsi
call fcn.14000e54c
mov rcx, rbx
call fcn.14000e54c
mov eax, edi
jmp 0x140005845
test rbx, rbx
je 0x140005840
mov rcx, rbx
call fcn.14000e54c
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000a060
add rsp, 0x1030
pop rdi
pop rsi
pop rbx
ret