joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000750c
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x18000e150]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.18000274c
xor ebx, ebx
cmp qword [0x18000ed28], rbx
mov rdi, rax
jne 0x18000761f
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1800076f6
lea rdx, str.MessageBoxW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800076f6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x18000ed28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x18000ed30], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x18000ed38], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x18000ed48], rax
test rax, rax
je 0x180007616
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x18000ed40], rax
jmp 0x180007626
mov rax, qword [0x18000ed40]
jmp 0x18000762d
mov rax, qword [0x18000ed40]
mov r11, qword [0x18000ed48]
cmp rax, rdi
je 0x180007694
cmp r11, rdi
je 0x180007694
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x18000ed48]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x180007694
test rax, rax
je 0x180007694
call rsi
test rax, rax
je 0x18000768e
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x18000768e
test byte [rsp + 0x40], 1
jne 0x180007694
bts ebp, 0x15
jmp 0x1800076d4
mov rcx, qword [0x18000ed30]
cmp rcx, rdi
je 0x1800076d4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800076d4
call rax
mov rbx, rax
test rax, rax
je 0x1800076d4
mov rcx, qword [0x18000ed38]
cmp rcx, rdi
je 0x1800076d4
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800076d4
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x18000ed28]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800076f6
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1800076f8
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180005d90
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180008637
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x18000e150]
jne 0x180005daa
rol rcx, 0x10
test cx, 0xffff
jne 0x180005da6
repz ret
ror rcx, 0x10
jmp 0x180008590
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x18000edf0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x18000eee8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x180008615
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x18000edf0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x180008637
mov rax, qword [rsp + 0x88]
mov qword [0x18000eee8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x18000ee88], rax
mov rax, qword [0x18000eee8]
mov qword [0x18000ed60], rax
mov rax, qword [rsp + 0x90]
mov qword [0x18000ee70], rax
mov dword [0x18000ed50], 0xc0000409
mov dword [0x18000ed54], 1
mov rax, qword [0x18000e150]
mov qword [rsp + 0x68], rax
mov rax, qword [0x18000e158]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x18000ede8], eax
mov ecx, 1
call fcn.180006724
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x18000bc48]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x18000ede8], 0
jne 0x1800086be
mov ecx, 1
call fcn.180006724
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x1400010a0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push rbp
sub rsp, 0xa0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x18], 0xfffffffffffffffe
mov qword [rbp - 0x48], rcx
call fcn.140002660
mov qword [rbp - 0x40], rax
jmp 0x1400010c7
mov rdx, qword [rbp - 0x40]
mov qword [rbp - 0x38], rdx
mov qword [rbp - 8], 0
mov qword [rbp], 0
mov qword [rbp + 0x10], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov r8d, 0x1000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov qword [rbp - 0x50], rax
jmp 0x14000110a
mov rcx, qword [rbp - 0x48]
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x30], rax
call fcn.140002670
mov qword [rbp - 0x58], rax
jmp 0x140001121
mov rcx, qword [rbp - 0x50]
mov r8, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x58]
mov qword [rbp - 0x20], rdx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], r8
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp - 0x50]
mov qword [rbp - 0x28], rax
call rax
jmp 0x14000114a
mov rcx, qword [rbp - 0x50]
xor eax, eax
mov edx, eax
mov r8d, 0x8000
call sub.KERNEL32.dll_VirtualFree
jmp 0x14000115f
mov rcx, qword [rbp - 0x48]
call fcn.140001780
nop
add rsp, 0xa0
pop rbp
ret
Function at 0x14000c4b0
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 0
mov qword [rbp + 0x3d0], 2
mov qword [rbp + 0x3d8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor ebx, ebx
xor edi, edi
xor r12d, r12d
cmp r8, 0x201
jae 0x14000c550
jmp 0x14000c53f
jae 0x14000c610
cmp r8, 0x201
jae 0x14000c550
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x14000c5a8
sub r8, r12
sub rdi, r12
cmp rdi, r8
jae 0x14000c57f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140020cc0
mov rbx, qword [rbp + 0x3c8]
mov rax, qword [rbp + 0x3d0]
mov qword [rbp + 0x3e8], rax
mov eax, 0xffffffff
cmp rbx, rax
mov r12d, 0xffffffff
cmovb r12, rbx
mov qword [rbp + 0x3d8], r12
mov rdi, rbx
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x14000c5d1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000c678
mov r8d, r14d
cmp r15, r8
jne 0x14000c530
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000c6a5
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x14000c53f
jmp 0x14000c550
cmp rsi, r8
jb 0x14000c6bf
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14000d810
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rbx, rbx
je 0x14000c661
add rbx, rbx
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rbx
call fcn.140002a90
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
test rbx, rbx
jne 0x14000c649
jmp 0x14000c661
lea rcx, str.internal_error:_entered_unreachable_code_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_alloc_src_vecmod.rs
lea r8, str.library_std_src_syspalwindowsmod.rs
mov edx, 0x28
call fcn.140021470
jmp 0x14000c6d4
lea rax, str.library_std_src_syspalwindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.1400218c0
ud2
Function at 0x140011db0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rdi, rdx
mov rsi, rcx
mov rcx, qword [rsp + 0xe0]
movups xmm0, xmmword [0x140025030]
movaps xmmword [rsp + 0x60], xmm0
mov eax, 0xffffffff
cmp r9, rax
cmovb rax, r9
test rcx, rcx
je 0x140011df4
mov rdx, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rdx
test rcx, rcx
mov qword [rsp + 0x78], rcx
lea rdx, [rsp + 0x80]
cmove rdx, rcx
mov qword [rsp + 0x38], rdx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x140011e5a
mov rcx, rdi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rsp + 0x60]
cmp eax, 0x103
je 0x140011e91
test eax, eax
js 0x140011e6b
mov rax, qword [rsp + 0x68]
mov qword [rsi + 8], rax
xor eax, eax
jmp 0x140011e84
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov eax, 1
mov qword [rsi], rax
add rsp, 0xa8
pop rdi
pop rsi
ret
mov dword [rsp + 0x58], 0
mov byte [rsp + 0x5c], 0
lea rax, str.fatal_runtime_error:_I_O_error:_operation_failed_to_complete_synchronously_n
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], 1
lea rax, [rsp + 0x50]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
lea rcx, [rsp + 0x58]
lea rdx, [rsp + 0x78]
call fcn.14000d5e0
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.14000a890
mov ecx, 7
int 0x29
ud2
Function at 0x14001f050
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
test r8, r8
je 0x14001f0ca
mov rax, rdx
mov rdx, qword [rsp + 0x70]
mov esi, ecx
shr esi, 8
lea r8, [rax + r8*2]
xor r11d, r11d
mov rbx, rax
movzx edi, byte [rax + 1]
add rax, 2
lea r10, [r11 + rdi]
cmp byte [rbx], sil
jne 0x14001f0c0
cmp r11, r10
ja 0x14001f155
cmp r10, rdx
ja 0x14001f167
add r11, r9
xor ebx, ebx
nop dword [rax]
cmp rdi, rbx
je 0x14001f0c2
lea r14, [rbx + 1]
cmp byte [r11 + rbx], cl
mov rbx, r14
jne 0x14001f0a0
jmp 0x14001f137
ja 0x14001f0ca
mov r11, r10
cmp rax, r8
jne 0x14001f072
mov rdx, qword [rsp + 0x80]
test rdx, rdx
je 0x14001f13b
mov r8, qword [rsp + 0x78]
add rdx, r8
movzx ecx, cx
mov al, 1
nop word cs:[rax + rax]
lea r10, [r8 + 1]
movzx r9d, byte [r8]
test r9b, r9b
js 0x14001f110
mov r8, r10
sub ecx, r9d
jns 0x14001f12e
jmp 0x14001f13d
cmp r10, rdx
je 0x14001f149
movzx r10d, byte [r8 + 1]
add r8, 2
and r9d, 0x7f
shl r9d, 8
or r9d, r10d
sub ecx, r9d
js 0x14001f13d
xor al, 1
cmp r8, rdx
jne 0x14001f0f0
jmp 0x14001f13d
xor eax, eax
jmp 0x14001f13d
mov al, 1
and al, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
lea rcx, str.librarycore_srcunicodeprintable.rs
call fcn.140021310
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r11
mov rdx, r10
call fcn.140021940
lea r8, str.librarycore_srcunicodeprintable.rs
mov rcx, r10
call fcn.1400218c0
int3

Function at 0x140020678
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400206c2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400206c2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400206c2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400206c2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400206c2
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400206c4
xor al, al
add rsp, 0x28
ret
Function at 0x140001489
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x1050
call fcn.14000bd60
sub rsp, rax
mov rax, qword [0x14003e018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rsi, rdx
mov r13, rcx
add rcx, 0x70
lea rdx, [0x14002b834]
mov ebp, 0xffffffff
call fcn.140003fe0
mov r14, rax
test rax, rax
jne 0x140001311
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002b30
xor ebx, ebx
jmp 0x14000143a
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r13]
mov rcx, r14
call fcn.140010914
test eax, eax
jns 0x14000134d
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002890
mov rcx, r14
call fcn.14001028c
xor ebx, ebx
jmp 0x14000143a
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x1048], r12
call fcn.140015090
mov r12, rax
mov rbx, rax
test rax, rax
jne 0x140001390
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002890
mov rcx, r14
call fcn.14001028c
jmp 0x140001432
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1040], r15
jne 0x140001463
mov r9, r12
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
jne 0x1400014d7
mov rcx, r14
add rsi, 0x12
call fcn.14001028c
mov rdx, rsi
lea rcx, [r13 + 0x3070]
call fcn.1400077d0
test eax, eax
js 0x140001422
mov qword [rsp + 0x28], rsi
lea r9, [r13 + 0x3070]
lea r8, str._s_c_s
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.140001ef0
cmp eax, 0x1000
jge 0x140001422
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140004180
mov ebp, eax
mov rdi, qword [rsp + 0x1090]
mov r15, qword [rsp + 0x1040]
mov r12, qword [rsp + 0x1048]
mov rcx, rbx
call fcn.14001507c
mov eax, ebp
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14000bdc0
add rsp, 0x1050
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [rsi + 0xc]
mov r15, r12
test rdi, rdi
je 0x1400013c3
mov eax, 0x2000
nop word [rax + rax]
cmp rdi, rax
mov rbp, rdi
mov r9, r14
mov r8d, 1
cmova rbp, rax
mov rcx, r15
mov rdx, rbp
call fcn.1400105dc
cmp rax, 1
jb 0x1400014bb
add r15, rbp
mov eax, 0x2000
sub rdi, rbp
jne 0x140001480
mov ebp, 0xffffffff
jmp 0x1400013c3
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002890
mov ebp, 0xffffffff
mov rcx, r12
call fcn.14001507c
mov rcx, r14
call fcn.14001028c
xor ebx, ebx
jmp 0x140001422
Function at 0x1400018a6
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp dword [rcx + 0x5074], 1
mov rdi, rdx
mov rbx, rcx
je 0x14000173e
lea rcx, str.pyi_arch_extract2fs_was_called_before_temporary_directory_was_initialized__n
call fcn.140002b30
mov eax, 0xffffffff
add rsp, 0x38
pop rdi
pop rbx
ret
cmp byte [rdx + 0x11], 0x6e
jne 0x140001768
call fcn.1400012b0
mov ebx, eax
test eax, eax
jns 0x14000175f
lea rdx, [rdi + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140002b30
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
add rcx, 0x3070
lea rbp, [rdx + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.140007c20
mov r12, rax
test rax, rax
jne 0x1400017b9
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.140002890
mov rbp, qword [rsp + 0x50]
lea eax, [r12 - 1]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
lea rcx, [rbx + 0x70]
mov qword [rsp + 0x20], r15
lea rdx, [0x14002b834]
call fcn.140003fe0
mov r15, rax
test rax, rax
jne 0x1400017ee
mov rdx, rbp
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002b30
lea ebx, [r15 - 1]
jmp 0x14000192f
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [rbx]
mov rcx, r15
call fcn.140010914
test eax, eax
jns 0x140001823
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002890
mov ebx, 0xffffffff
jmp 0x140001927
cmp byte [rdi + 0x10], 1
jne 0x140001841
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.140001050
mov ebx, eax
jmp 0x140001927
mov qword [rsp + 0x30], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x28], r14
mov ecx, r13d
call fcn.140015090
mov r14, rax
test rax, rax
jne 0x140001882
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.140002890
lea ebx, [r14 - 1]
jmp 0x14000191d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001915
mov qword [rsp + 0x58], rsi
nop dword [rax]
nop word [rax + rax]
cmp rdi, r13
mov rsi, rdi
mov r9, r15
mov r8d, 1
cmova rsi, r13
mov rcx, r14
mov rdx, rsi
call fcn.1400105dc
cmp rax, 1
jb 0x1400018f5
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r14
call fcn.140010d1c
cmp rax, 1
jb 0x1400018e5
sub rdi, rsi
jne 0x1400018a0
jmp 0x140001910
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
jmp 0x140001903
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov r8, rbp
call fcn.140002890
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r14
call fcn.14001507c
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov rcx, r15
call fcn.14001028c
mov rcx, r12
call fcn.14001028c
mov r15, qword [rsp + 0x20]
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
Function at 0x14000c80c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
push rax
call fcn.140089912
test rax, rax
je 0x14000c856
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000c856
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000c856
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000c856
cmp dword [rcx + 0x84], 0xe
jbe 0x14000c856
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000c858
xor al, al
add rsp, 0x28
ret

Function at 0x14001a1fc
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140019ff8
Function at 0x1400098e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140050030]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140050070]
mov edi, edx
mov esi, ecx
cmp byte [rbx + 0x4d4d], 0
jne 0x140009948
cmp byte [rbx + 0x4d4e], 0
jne 0x140009948
movsx r9d, word [rbx + 0x5eb8]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000ea80
test sil, 2
je 0x140009a80
jmp 0x1400099e1
movss xmm1, dword [rbx + 0x39bc]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x140044334]
xor eax, eax
mov edx, 0x10
mulss xmm1, dword [0x14004432c]
addss xmm0, dword [rbx + 0xe40]
addss xmm1, dword [rbx + 0xe44]
or dword [rbx + 0x4a00], 1
mov qword [rbx + 0x4a18], rax
movss dword [rbx + 0x4a10], xmm0
mov dword [rbx + 0x4a04], 1
movss dword [rbx + 0x4a14], xmm1
movss xmm0, dword [rbx + 0x3a18]
mov rax, qword [0x140050070]
mulss xmm0, dword [0x140049760]
or dword [rax + 0x4a00], 0x40
movss dword [rax + 0x4a60], xmm0
movsx r9d, word [rbx + 0x5eb8]
call fcn.14000ea80
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140009a31
lea r11, [0x1400425b0]
cmp r9b, 0x23
jne 0x140009a14
cmp byte [r8], r9b
jne 0x140009a14
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140009a01
not ecx
call fcn.14000d450
test rax, rax
je 0x140009a80
cmp byte [rax + 0xbe], 0
je 0x140009a80
mov byte [rax + 0xc3], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xc5], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xe4], 1
mov edx, 0x10
inc word [rbx + 0x5eb8]
movsx r9d, word [rbx + 0x5eb8]
call fcn.14000ea80
or edi, 0x2030347
lea rcx, [rsp + 0x20]
mov r8d, edi
xor edx, edx
call fcn.140006ea0
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14003fe90
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x14000d3b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x140050070]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x14000d413
mov qword [rsp], rbx
lea rbx, [0x1400425b0]
nop dword [rax]
cmp r9b, 0x23
jne 0x14000d3f3
cmp byte [r8], r9b
jne 0x14000d3f3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x14000d3e0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5f80]
not eax
mov r8, qword [r10 + 0x5f88]
lea rdx, [rcx + rcx*8]
lea rcx, [r8 + rdx*8]
cmp r8, rcx
je 0x14000d43f
cmp dword [r8 + 8], eax
je 0x14000d446
add r8, 0x48
cmp r8, rcx
jne 0x14000d430
xor eax, eax
add rsp, 8
ret
mov rax, r8
add rsp, 8
ret
Function at 0x14000dd10
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x100]
lea r10, [0x1400425b0]
mov rax, qword [rcx + 0x108]
mov r9, rcx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, dl
movzx r8d, bl
shr ebx, 8
xor r8, rax
movzx eax, byte [rsp + 0x39]
xor ebx, dword [r10 + r8*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3a]
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
movzx eax, byte [rsp + 0x3b]
xor ebx, dword [r10 + rcx*4]
movzx ecx, bl
xor rcx, rax
shr ebx, 8
xor ebx, dword [r10 + rcx*4]
mov rcx, qword [r9]
not ebx
cmp dword [rcx + 0x404c], ebx
jne 0x14000dd9d
xor r9d, r9d
movsxd r8, edx
mov ecx, ebx
lea edx, [r9 + 4]
call fcn.14000b470
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x14000de30
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0x108]
lea r9, [0x1400425b0]
movss xmm2, dword [rcx + 0x120]
movss xmm3, dword [rcx + 0x124]
movsxd rcx, dword [rcx + 0x100]
movss xmm0, dword [rdx]
movss xmm1, dword [rdx + 4]
subss xmm0, xmm2
subss xmm1, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
movss dword [rsp], xmm0
movzx eax, byte [rsp]
xor rcx, rax
movss xmm0, dword [rdx + 8]
movzx eax, byte [rsp + 1]
subss xmm0, xmm2
movss dword [rsp + 4], xmm1
movss xmm1, dword [rdx + 0xc]
xor r8d, dword [r9 + rcx*4]
subss xmm1, xmm3
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
movss dword [rsp + 8], xmm0
movss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret