joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013500
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14007b010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14009fba0]
mov edi, ecx
cmp byte [rbx + 0x4235], 0
jne 0x140013561
cmp byte [rbx + 0x4236], 0
jne 0x140013561
movsx r9d, word [rbx + 0x531a]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.140004140
test dil, 1
je 0x140013688
jmp 0x1400135ea
movss xmm1, dword [rbx + 0x3890]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x531a]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x140071104]
mulss xmm1, dword [0x1400710ec]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xdf4]
addss xmm1, dword [rbx + 0xdf8]
mov qword [rbx + 0x3fa0], rax
mov dword [rbx + 0x3f8c], 1
movss dword [rbx + 0x3f98], xmm0
movss dword [rbx + 0x3f9c], xmm1
movss xmm0, dword [rbx + 0x38ec]
mulss xmm0, dword [0x140070ff4]
or dword [rbx + 0x3f88], 0x41
movss dword [rbx + 0x3fe8], xmm0
call fcn.140004140
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140013640
lea r11, [0x14006b710]
nop word [rax + rax]
cmp r9b, 0x23
jne 0x140013623
cmp byte [r8], r9b
jne 0x140013623
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140013610
not ecx
call fcn.14000c6c0
test rax, rax
je 0x140013688
cmp byte [rax + 0x96], 0
je 0x140013688
mov byte [rax + 0x9d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x531a]
mov edx, 0x10
movsx r9d, word [rbx + 0x531a]
call fcn.140004140
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000ee40
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140067470
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x140017a90
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x53c8], 0
lea rbx, [rcx + 0x53d0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x140017b37
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x140017aea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140019b50
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.140004b60
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x53c8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x53d8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14009fbb0]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x140017b3f
mov rcx, rbx
call fcn.140004b60
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400180b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14009fba0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140018113
mov qword [rsp], rbx
lea rbx, [0x14006b710]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400180f3
cmp byte [r8], r9b
jne 0x1400180f3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1400180e0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5378]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x140018147
mov r10, qword [r10 + 0x5380]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x14001814e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x140018134
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140040e80
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
mov rax, qword [0x14009fc78]
mov r11, rdx
mov r10, rcx
cmp byte [rax], 0
je 0x1400410bc
movups xmm0, xmmword [0x140070568]
movsd xmm5, qword [rcx + 0x10]
movups xmmword [rsp + 0x30], xmm0
psrldq xmm0, 0xf
movd eax, xmm0
test al, al
je 0x140041094
xor r8d, r8d
cmp dword [0x14007b018], 2
jl 0x140041058
movdqa xmm0, xmmword [str.4444444444444444]
lea rcx, [rsp + 0x34]
movdqa xmm4, xmmword [0x140071850]
mov eax, 5
movaps xmmword [rsp + 0x80], xmm6
movdqa xmm6, xmmword [0x1400713b0]
movaps xmmword [rsp + 0x70], xmm7
movaps xmmword [rsp + 0x60], xmm8
movdqa xmm8, xmmword [0x1400713d0]
movd xmm7, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
movaps xmmword [rsp + 0x50], xmm9
movd xmm9, eax
nop dword [rax + rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm6
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm6
pmuldq xmm0, xmm4
add r8d, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm7
movdqa xmm0, xmm1
psrld xmm0, xmm9
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x140071410]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
pxor xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm7
movdqa xmm0, xmm1
psrld xmm0, xmm9
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, edx
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140071410]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
pxor xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp r8d, 0x10
jl 0x140040f30
movaps xmm9, xmmword [rsp + 0x50]
movaps xmm8, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
jmp 0x140041094
lea r9, [rsp + 0x30]
nop dword [rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9 - 1], al
cmp r8d, 0x10
jl 0x140041060
movsd xmm3, qword [r10 + 8]
lea rcx, [rsp + 0x30]
movsd xmm2, qword [r10]
movq r9, xmm3
movq r8, xmm2
movsd qword [rsp + 0x20], xmm5
mov rdx, r11
call fcn.140002b40
add rsp, 0x98
ret
Function at 0x1400410d0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [0x14009fc78]
mov r10, rdx
movaps xmmword [rsp + 0x20], xmm9
movaps xmm9, xmm0
cmp byte [rax], 0
je 0x14004128a
cmp byte [0x140070ad7], 0
mov rax, qword [0x140070ad0]
mov qword [rsp + 0x60], rax
je 0x140041274
xor r8d, r8d
cmp dword [0x14007b018], 2
jl 0x140041234
movdqa xmm2, xmmword [0x1400713b0]
mov eax, 5
movdqa xmm3, xmmword [0x1400713c0]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x140071850]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x30], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400713d0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x60]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
pand xmm2, xmmword [0x140071410]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
pxor xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x60], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400713d0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x64]
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x140071410]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.4444444444444444]
pxor xmm2, xmm0
movd dword [rsp + 0x64], xmm2
jmp 0x140041274
lea r9, [rsp + 0x60]
nop dword [rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 1]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x3a
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x34
xor byte [r9 - 1], al
cmp r8d, 8
jl 0x140041240
movaps xmm2, xmm9
lea rcx, [rsp + 0x60]
movq r8, xmm2
mov rdx, r10
call fcn.140002b40
movaps xmm9, xmmword [rsp + 0x20]
add rsp, 0x48
ret
Function at 0x14004c100
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14007b010]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], ecx
xorps xmm0, xmm0
xor ecx, ecx
mov dword [rsp + 0x24], edx
mov edx, 0x1000
mov qword [rsp + 0x38], 0
mov r8d, edx
movdqu xmmword [rsp + 0x28], xmm0
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14004c15e
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140067470
add rsp, 0x50
pop rdi
ret
movdqu xmm0, xmmword [0x14009fcf0]
lea rdx, [0x14009fcf0]
mov eax, 0x10
movdqa xmm2, xmmword [0x140071860]
mov ecx, eax
movdqa xmm1, xmm2
mov qword [rsp + 0x70], rbx
pxor xmm1, xmm0
movdqu xmmword [0x14009fcf0], xmm1
xor byte [rcx + rdx], 0xfa
inc rcx
cmp rcx, 0x1e
jb 0x14004c191
movups xmm0, xmmword [0x14009fcf0]
movups xmmword [rdi], xmm0
movsd xmm1, qword [0x14009fd00]
movsd qword [rdi + 0x10], xmm1
mov ecx, dword [0x14009fd08]
mov dword [rdi + 0x18], ecx
movzx ecx, word [0x14009fd0c]
mov word [rdi + 0x1c], cx
movdqu xmm0, xmmword [0x14009fcf0]
pxor xmm2, xmm0
movdqu xmmword [0x14009fcf0], xmm2
nop dword [rax]
xor byte [rax + rdx], 0xfa
inc rax
cmp rax, 0x1e
jb 0x14004c1e0
mov edx, 1
lea rcx, [rsp + 0x20]
call rdi
xor edx, edx
mov r8d, 0x1000
mov rcx, rdi
mov ebx, eax
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test ebx, ebx
mov rbx, qword [rsp + 0x70]
setg al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140067470
add rsp, 0x50
pop rdi
ret
Function at 0x140068084
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400680ce
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400680ce
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400680ce
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400680ce
cmp dword [rcx + 0x84], 0xe
jbe 0x1400680ce
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400680d0
xor al, al
add rsp, 0x28
ret
Function at 0x140001780
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rcx, qword [rcx]
mov r12, rdx
test rcx, rcx
je 0x140001880
mov edx, dword [r12 + 4]
xor r8d, r8d
add edx, dword [rbp + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x1400018c8
mov esi, dword [r12 + 0xc]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
mov r13, rax
je 0x1400018e2
cmp byte [r12 + 0x10], 1
je 0x140001860
test rsi, rsi
mov rdi, rax
jne 0x1400017f0
jmp 0x140001839
add rdi, rbx
sub rsi, rbx
je 0x140001839
mov ebx, 0x2000
mov r9, qword [rbp]
mov r8d, 1
mov rcx, rdi
cmp rsi, rbx
cmovbe rbx, rsi
mov rdx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test rax, rax
jne 0x1400017e8
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002ac0
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor r13d, r13d
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000184f
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov qword [rbp], 0
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r8d, r8d
mov r9, rax
mov rdx, r12
mov rcx, rbp
call fcn.140001490
test eax, eax
je 0x140001839
jmp 0x14000182e
lea rcx, [rbp + 0x78]
lea rdx, [0x140010150]
call fcn.140003f50
test rax, rax
mov rcx, rax
mov qword [rbp], rax
jne 0x14000179e
lea rdx, [r12 + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002940
xor r13d, r13d
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002ac0
jmp 0x1400018b1
lea r8, [r12 + 0x12]
mov r9d, esi
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002ac0
jmp 0x140001836
Function at 0x140001910
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rdi, rcx
mov rbx, rdx
call fcn.140006fc0
cmp eax, 0xffffffff
je 0x140001ade
lea r13, [rbx + 0x12]
lea rcx, [rdi + 0x3078]
mov rdx, r13
call fcn.140007210
test rax, rax
mov r12, rax
je 0x140001ac8
mov rcx, qword [rdi]
test rcx, rcx
je 0x140001a50
mov edx, dword [rbx + 4]
xor r8d, r8d
add edx, dword [rdi + 8]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x140001ab0
cmp byte [rbx + 0x10], 1
je 0x140001a10
mov ecx, 0x2000
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
mov rbp, rax
je 0x140001ae8
mov esi, dword [rbx + 0xc]
test rsi, rsi
jne 0x1400019c6
jmp 0x140001a88
mov r9, r12
mov r8d, 1
mov rdx, rbx
mov rcx, rbp
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
test rax, rax
je 0x140001a90
sub rsi, rbx
je 0x140001a88
mov ebx, 0x2000
mov r9, qword [rdi]
mov r8d, 1
mov rcx, rbp
cmp rsi, rbx
cmovbe rbx, rsi
mov rdx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test rax, rax
jne 0x1400019a0
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
mov r8, r13
lea rcx, str.fread
call fcn.140002ac0
mov ebx, 0xffffffff
mov rcx, rbp
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140001a23
mov rdx, rbx
xor r9d, r9d
mov r8, r12
mov rcx, rdi
call fcn.140001490
mov ebx, eax
mov rcx, qword [rdi]
test rcx, rcx
je 0x140001a37
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov qword [rdi], 0
mov rcx, r12
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov eax, ebx
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rcx, [rdi + 0x78]
lea rdx, [0x140010150]
call fcn.140003f50
test rax, rax
mov rcx, rax
mov qword [rdi], rax
jne 0x14000195b
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
mov rdx, r13
call fcn.140002940
mov ebx, 0xffffffff
jmp 0x140001a23
xor ebx, ebx
jmp 0x140001a06
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
mov r8, r13
lea rcx, str.fwrite
call fcn.140002ac0
jmp 0x140001a01
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
mov r8, r13
lea rcx, str.fseek
call fcn.140002ac0
jmp 0x140001a7e
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
mov r8, r13
lea rcx, str.fopen
call fcn.140002ac0
mov ebx, 0xffffffff
jmp 0x140001a3f
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
mov r8, r13
lea rcx, str.malloc
call fcn.140002ac0
jmp 0x140001a7e
Function at 0x140001b10
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140001ce0
mov rax, qword [0x140015eb0]
mov r8d, 8
mov rdx, qword [rax]
mov qword [rsp + 0x28], rdx
shr rdx, 0x18
add edx, 0xc
mov byte [rsp + 0x2b], dl
lea rdx, [rsp + 0x28]
call fcn.140007900
test rax, rax
mov rbx, rax
je 0x140001d1b
mov rcx, qword [rdi]
xor r8d, r8d
mov edx, eax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
test eax, eax
js 0x140001d45
mov r9, qword [rdi]
lea rcx, [rdi + 0x20]
mov r8d, 1
mov edx, 0x58
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test rax, rax
je 0x140001d08
mov eax, dword [rdi + 0x28]
add rbx, 0x58
mov dword [rdi + 0x507c], 0
mov edx, dword [rdi + 0x2c]
mov ecx, dword [rdi + 0x30]
mov r8d, dword [rdi + 0x34]
bswap eax
movd xmm0, eax
mov eax, eax
bswap edx
movd xmm2, edx
sub rbx, rax
punpckldq xmm0, xmm2
bswap ecx
movq qword [rdi + 0x28], xmm0
movd xmm0, ecx
mov rcx, qword [rdi]
bswap r8d
movd xmm3, r8d
add edx, ebx
punpckldq xmm0, xmm3
mov qword [rdi + 8], rbx
movq qword [rdi + 0x30], xmm0
mov dword [0x140019040], r8d
xor r8d, r8d
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fseek
movsxd rbx, dword [rdi + 0x30]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
mov rcx, rax
mov qword [rdi + 0x10], rax
je 0x140001d5a
mov r9, qword [rdi]
mov r8d, 1
mov rdx, rbx
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fread
test rax, rax
je 0x140001d22
movsxd rax, dword [rdi + 0x30]
add rax, qword [rdi + 0x10]
mov rcx, qword [rdi]
mov qword [rdi + 0x18], rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_ferror
test eax, eax
mov ebx, eax
jne 0x140001d37
mov rax, qword [rdi + 0x10]
lea rsi, str.Cannot_read_Table_of_Contents._n
mov r9, qword [rdi + 0x18]
nop dword [rax + rax]
cmp rax, r9
jae 0x140001cb8
mov ecx, dword [rax + 4]
mov edx, dword [rax]
mov r8d, dword [rax + 8]
bswap ecx
movd xmm0, ecx
mov ecx, dword [rax + 0xc]
bswap edx
mov dword [rax], edx
movsxd rdx, edx
bswap r8d
movd xmm1, r8d
punpckldq xmm0, xmm1
movq qword [rax + 4], xmm0
bswap ecx
mov dword [rax + 0xc], ecx
add rax, rdx
cmp rax, qword [rdi + 0x10]
jae 0x140001c60
mov rcx, rsi
call fcn.140002940
mov rax, qword [rdi + 0x18]
mov r9, rax
cmp rax, r9
jb 0x140001c65
nop dword [rax]
mov rcx, qword [rdi]
test rcx, rcx
je 0x140001ccc
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fclose
mov qword [rdi], 0
mov eax, ebx
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
lea rcx, [rdi + 0x78]
lea rdx, [0x140010150]
call fcn.140003f50
test rax, rax
mov rcx, rax
mov qword [rdi], rax
jne 0x140001b26
jmp 0x140001d1b
lea rdx, str.Failed_to_read_cookie__n
lea rcx, str.fread
call fcn.140002ac0
mov ebx, 0xffffffff
jmp 0x140001ccc
lea rdx, str.Could_not_read_full_TOC__n
lea rcx, str.fread
call fcn.140002ac0
jmp 0x140001d1b
lea rcx, str.Error_on_file._n
call fcn.140002940
jmp 0x140001d1b
lea rdx, str.Failed_to_seek_to_cookie_position__n
lea rcx, str.fseek
call fcn.140002ac0
jmp 0x140001d1b
lea rdx, str.Could_not_allocate_buffer_for_TOC__n
lea rcx, str.malloc
call fcn.140002ac0
jmp 0x140001d1b
Function at 0x140006b50
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x4020
call fcn.14000d8d0
sub rsp, rax
xor r8d, r8d
lea rbx, [rsp + 0x20]
mov rdx, rcx
xor ecx, ecx
call fcn.140007e20
mov r8d, 0x2000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140006b98
xor eax, eax
add rsp, 0x4020
pop rbx
ret
lea rdx, [rsp + 0x2020]
mov r8d, 0x2000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
xor r8d, r8d
mov rdx, rbx
call fcn.140007c50
test rax, rax
mov rcx, rax
je 0x140006b86
cmp byte [rax], 0
je 0x140006b86
call sub.api_ms_win_crt_string_l1_1_0.dll__strdup
add rsp, 0x4020
pop rbx
ret

Function at 0x140006c40
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rdx, rcx
xor ecx, ecx
call fcn.140007e20
xor edx, edx
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
mov esi, eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret

Function at 0x140006c80
Capabilities:
Create directory
Query environment variable

Disassembly:
push rbp
mov eax, 0x4028
push rdi
push rsi
push rbx
call fcn.14000d8d0
sub rsp, rax
xor r8d, r8d
mov rdx, rcx
xor ecx, ecx
call fcn.140007e20
test rax, rax
mov rbx, rax
je 0x140006dc0
lea rdi, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rax
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rbx
mov esi, eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test esi, esi
je 0x140006da0
mov rcx, rdi
call fcn.140008250
test eax, eax
jne 0x140006d88
mov r8d, 0x1000
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wfullpath]
mov rsi, rax
test rsi, rsi
je 0x140006dd0
lea rdi, [rsp + 0x2020]
xor edx, edx
mov r8d, 0x2000
mov rcx, rdi
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, 0x5c
mov rcx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_wcschr
mov rbp, qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test rax, rax
mov rbx, rax
je 0x140006d6d
nop dword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
sub r8, rsi
sar r8, 1
add r8, 1
call sub.api_ms_win_crt_string_l1_1_0.dll_wcsncpy
xor edx, edx
mov rcx, rdi
call rbp
lea rcx, [rbx + 2]
mov edx, 0x5c
call sub.api_ms_win_crt_private_l1_1_0.dll_wcschr
test rax, rax
mov rbx, rax
jne 0x140006d38
xor edx, edx
mov rcx, rsi
call rbp
mov rax, rsi
add rsp, 0x4028
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsdup_1]
mov rsi, rax
jmp 0x140006cf7
lea rcx, str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
xor esi, esi
call fcn.140002940
mov rax, rsi
add rsp, 0x4028
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rcx, str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
xor esi, esi
call fcn.140002940
jmp 0x140006dae
lea rcx, str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
xor esi, esi
call fcn.140002940
jmp 0x140006dae
Function at 0x140006de0
Capabilities:
Get common file path
Set environment variable

Disassembly:
push r15
mov eax, 0x2048
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000d8d0
sub rsp, rax
test rdx, rdx
mov r15, rcx
mov rdi, rdx
je 0x140006ef0
lea rcx, [0x14001251b]
call fcn.140006b50
mov rcx, rdi
mov r13, rax
call fcn.140006c80
test rax, rax
mov rbx, rax
je 0x140006ed7
lea rcx, [0x140012520]
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wputenv_s]
mov rcx, rbx
mov esi, eax
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test esi, esi
jne 0x140006f78
lea r12, [rsp + 0x40]
mov ecx, 0x1000
mov esi, 5
lea rbp, [rsp + 0x20]
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__getpid
lea r8, str._MEI_d
mov edx, 0x10
mov rcx, rbp
mov r9d, eax
call fcn.1400069f0
mov r14, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wtempnam]
mov rdx, rbp
mov rcx, r12
call r14
mov rcx, rax
mov rbx, rax
call fcn.140008050
test eax, eax
je 0x140006f00
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
sub esi, 1
jne 0x140006e8d
test rdi, rdi
je 0x140006ed7
test r13, r13
je 0x140006f48
lea rcx, [0x14001251b]
mov rdx, r13
call fcn.140006be0
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
xor eax, eax
add rsp, 0x2048
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor r13d, r13d
jmp 0x140006e4d
mov r8d, 0x1000
mov rdx, rbx
mov rcx, r15
call fcn.140007c50
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test rdi, rdi
je 0x140006f3a
test r13, r13
je 0x140006f89
lea rcx, [0x14001251b]
mov rdx, r13
call fcn.140006be0
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov eax, 1
jmp 0x140006ed9
lea rdx, [0x14001251b]
xor r8d, r8d
xor ecx, ecx
call fcn.140007e20
xor edx, edx
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140006ed7
lea rcx, str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
call fcn.140002940
jmp 0x140006ed7
lea rdx, [0x14001251b]
xor r8d, r8d
xor ecx, ecx
call fcn.140007e20
xor edx, edx
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140006f3a