joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a1d30
Capabilities:
Move file

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x70
mov rbx, rdx
lea rbp, [rsp + 0x40]
mov r12, rcx
mov dword [rsp + 0x40], 0
call method.std::_V2.system_category__
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x48], rax
mov rdi, rax
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov rsi, rax
cmp al, 0xff
je 0x1400a1da8
mov ecx, dword [rsp + 0x40]
test ecx, ecx
jne 0x1400a1e0e
test al, al
jne 0x1400a1dc0
mov rdx, qword [rbx]
mov rcx, qword [r12]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400a1e78
add rsp, 0x70
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x48], rdi
jmp 0x1400a1d7c
mov rdx, rbp
mov rcx, r12
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov edx, dword [rsp + 0x40]
test edx, edx
jne 0x1400a1e0e
cmp sil, 2
je 0x1400a1df8
cmp al, 2
jne 0x1400a1d7c
call method.std::_V2.generic_category__
mov dword [rsp + 0x40], 0x14
mov qword [rsp + 0x48], rax
jmp 0x1400a1e0e
cmp al, 2
je 0x1400a1d7c
call method.std::_V2.generic_category__
mov dword [rsp + 0x40], 0x15
mov qword [rsp + 0x48], rax
mov ecx, 0x30
lea rdi, [rsp + 0x50]
call sym.__cxa_allocate_exception
lea rdx, str.cannot_rename
mov rcx, rdi
mov rsi, rax
call fcn.1400e7bb0
lea rax, [rsp + 0x30]
mov r9, rbx
mov r8, r12
mov rdx, rdi
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [rsp + 0x40]
mov rcx, rsi
movaps xmmword [rsp + 0x30], xmm0
call sym._ZNSt10filesystem7__cxx1116filesystem_errorC2ERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS0_4pathESC_St10error_c
mov rcx, rdi
call method.std::__cxx11::basic_string_char__std::char_traits_char___std::allocator_char___._M_dispose__
lea r8, [method.std::filesystem::__cxx11::filesystem_error.filesystem_error__]
lea rdx, [0x140110500]
mov rcx, rsi
call sym.__cxa_throw
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x1400a1eb8
call rdi
mov dword [rax], 5
call method.std::_V2.generic_category__
mov rsi, rax
call rdi
mov qword [rsp + 0x48], rsi
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x1400a1e0e
jmp 0x1400a1d97
call rdi
mov dword [rax], 0xd
jmp 0x1400a1e92
Function at 0x1400a1ef0
Capabilities:
Move file

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
mov rbx, r8
mov rcx, rsi
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov rdi, rax
cmp al, 0xff
je 0x1400a1f50
mov ecx, dword [rbx]
test ecx, ecx
jne 0x1400a1f43
test al, al
jne 0x1400a1f68
mov rdx, qword [rsi]
mov rcx, qword [rbp]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
je 0x1400a1fb0
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call method.std::_V2.system_category__
mov dword [rbx], 0
mov qword [rbx + 8], rax
jmp 0x1400a1f1d
mov rdx, rbx
mov rcx, rbp
call method.std::filesystem.status_std::filesystem::__cxx11::path_const__std::error_code_
mov edx, dword [rbx]
test edx, edx
jne 0x1400a1f43
cmp dil, 2
je 0x1400a1f98
cmp al, 2
jne 0x1400a1f1d
call method.std::_V2.generic_category__
mov dword [rbx], 0x14
mov qword [rbx + 8], rax
jmp 0x1400a1f43
cmp al, 2
je 0x1400a1f1d
call method.std::_V2.generic_category__
mov dword [rbx], 0x15
mov qword [rbx + 8], rax
jmp 0x1400a1f43
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [sym.imp.msvcrt.dll__errno]
cmp eax, 5
je 0x1400a1fe5
call rdi
mov dword [rax], 5
call method.std::_V2.generic_category__
mov rsi, rax
call rdi
mov eax, dword [rax]
mov qword [rbx + 8], rsi
mov dword [rbx], eax
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
call rdi
mov dword [rax], 0xd
jmp 0x1400a1fca

Function at 0x1400ad400
Capabilities:
Get disk size

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
mov rbx, qword [rsp + 0x90]
mov rdi, rdx
mov rbp, r8
mov rsi, r9
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0x28]
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], 0
lea r8, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x1400ad498
mov rax, qword [rsp + 0x30]
test rax, rax
je 0x1400ad45a
mov qword [rdi], rax
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x1400ad468
mov qword [rbp], rax
mov rax, qword [rsp + 0x28]
test rax, rax
jne 0x1400ad490
call method.std::_V2.system_category__
xor esi, esi
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov qword [rsi], rax
jmp 0x1400ad472
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call method.std::_V2.system_category__
mov dword [rbx], esi
mov qword [rbx + 8], rax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x1400b2aa0
Capabilities:
Read file on windows

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, qword [sym.imp.msvcrt.dll__errno]
mov rdi, rcx
mov rsi, rdx
mov ebx, r8d
mov rcx, qword [rdi]
call sym.fileno
mov ecx, eax
mov r8d, ebx
mov rdx, rsi
call sym.read
movsxd rbp, eax
cmp eax, 0xffffffff
je 0x1400b2ae8
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
call r12
cmp dword [rax], 4
je 0x1400b2aba
mov rax, rbp
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x1400ca670
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400ca698
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400ca6e0
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400ca6b0
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400ca6ec
call rbp
cmp dword [rax], 4
je 0x1400ca6b0
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400caa10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rdi, rcx
test rax, rax
je 0x1400caa38
mov rcx, qword [rcx]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
mov rbp, qword [sym.imp.msvcrt.dll__errno]
mov ebx, 4
lea rsi, [rsp + 0x2c]
nop dword [rax]
mov ecx, dword [rdi + 0x10]
mov r8d, ebx
mov rdx, rsi
call sym.read
test eax, eax
jle 0x1400caa80
cdqe
add rsi, rax
sub rbx, rax
jne 0x1400caa50
mov eax, dword [rsp + 0x2c]
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
cmp eax, 0xffffffff
jne 0x1400caa8c
call rbp
cmp dword [rax], 4
je 0x1400caa50
lea rcx, str.random_device_could_not_be_read
call method.std.__throw_runtime_error_char_const_
nop
nop
nop
nop
nop
nop
nop
nop

Function at 0x1400f9240
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov rax, rcx
mov r10, rdx
and r11, 0xfffffffffffffff8
add r11, rcx
movabs rcx, 0xc6a4a7935bd1e995
imul r10, rcx
xor r10, r8
cmp rax, r11
je 0x1400f9298
nop word cs:[rax + rax]
mov r9, qword [rax]
add rax, 8
imul r9, rcx
mov r8, r9
shr r8, 0x2f
xor r8, r9
imul r8, rcx
xor r8, r10
mov r10, r8
imul r10, rcx
cmp r11, rax
jne 0x1400f9270
and edx, 7
je 0x1400f9342
lea eax, [rdx - 1]
mov ecx, edx
cdqe
movzx eax, byte [r11 + rax]
sub ecx, 2
js 0x1400f9331
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 3]
cmp rdx, 2
je 0x1400f9331
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 4]
cmp rdx, 3
je 0x1400f9331
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 5]
cmp rdx, 4
je 0x1400f9331
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
lea ecx, [rdx - 6]
cmp rdx, 5
je 0x1400f9331
movsxd rcx, ecx
shl rax, 8
movzx ecx, byte [r11 + rcx]
add rax, rcx
cmp edx, 6
je 0x1400f9331
movzx edx, byte [r11]
shl rax, 8
add rax, rdx
xor rax, r10
movabs r10, 0xc6a4a7935bd1e995
imul r10, rax
movabs rax, 0xc6a4a7935bd1e995
mov rdx, r10
shr rdx, 0x2f
xor rdx, r10
imul rdx, rax
mov rax, rdx
shr rax, 0x2f
xor rax, rdx
ret

Function at 0x1400fa880
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, r8
test rdx, rdx
je 0x1400fa8ac
movabs r9, 0x100000001b3
add rdx, rcx
nop dword [rax]
movsx r8, byte [rcx]
add rcx, 1
xor rax, r8
imul rax, r9
cmp rcx, rdx
jne 0x1400fa898
ret
Function at 0x140104920
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x68
xor edx, edx
lea rcx, [0x140106780]
lea rbp, str.obj_count
movabs rsi, 0x2e78786362696c67
movabs rdi, 0x6c6f6f705f68652e
call sym.pthread_mutex_init
pxor xmm0, xmm0
lea rcx, str.GLIBCXX_TUNABLES
mov qword [0x140106798], 0
movups xmmword [0x140106788], xmm0
call sym.getenv
mov dword [rsp + 0x40], 0
mov rbx, rax
lea rax, str.obj_size
mov qword [rsp + 0x30], 8
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], 9
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], 0x100
test rbx, rbx
jne 0x1401049d5
jmp 0x140104a87
mov rcx, rbx
mov edx, 0x3a
call sym.strchr
mov rbx, rax
test rax, rax
je 0x140104a38
xor eax, eax
cmp byte [rbx], 0x3a
sete al
add rbx, rax
cmp qword [rbx], rsi
jne 0x1401049c0
cmp qword [rbx + 7], rdi
jne 0x1401049c0
cmp byte [rbx + 0xf], 0x2e
jne 0x1401049c0
movabs rax, 0x657a69735f6a626f
lea r12, [rbx + 0x10]
cmp qword [rbx + 0x10], rax
jne 0x140104a0f
cmp byte [rbx + 0x18], 0x3d
je 0x140104abd
mov r8d, 9
mov rdx, r12
mov rcx, rbp
call sym.memcmp
test eax, eax
jne 0x140104a2e
cmp byte [rbx + 0x19], 0x3d
je 0x140104aff
mov rbx, r12
jmp 0x1401049c0
mov eax, dword [rsp + 0x58]
mov edx, 0x1000
mov ecx, 6
cmp eax, edx
cmovle edx, eax
mov eax, dword [rsp + 0x40]
test eax, eax
cmove eax, ecx
movsxd rbx, eax
movsxd rax, edx
add rbx, 0x26
imul rbx, rax
shl rbx, 3
mov qword [0x140106798], rbx
jne 0x140104a97
lea rcx, [sym.__tcf_0]
add rsp, 0x68
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp sym.atexit
mov qword [0x140106798], 0x16000
mov ebx, 0x16000
mov rcx, rbx
call sym.malloc
mov qword [0x140106790], rax
test rax, rax
je 0x140104b0b
xor edx, edx
mov qword [0x140106788], rax
mov qword [rax], rbx
mov qword [rax + 8], rdx
jmp 0x140104a6f
mov eax, 8
lea r13, [rsp + 0x30]
lea rdx, [rsp + 0x28]
lea rcx, [r12 + rax + 1]
xor r8d, r8d
call sym.strtoul
mov rbx, qword [rsp + 0x28]
movzx edx, byte [rbx]
cmp dl, 0x3a
je 0x140104aee
test dl, dl
jne 0x1401049c0
test eax, eax
js 0x1401049c0
mov dword [r13 + 0x10], eax
jmp 0x1401049c0
mov eax, 9
lea r13, [rsp + 0x48]
jmp 0x140104ac7
xor ecx, ecx
mov qword [0x140106798], rcx
jmp 0x140104a6f
Function at 0x140001490
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
pxor xmm0, xmm0
lea r14, [rsp + 0x40]
mov r13, rcx
mov r12, rdx
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x100], r8
lea rdx, section..rdata
mov r8d, 0x58
mov rcx, r14
mov qword [rsp + 0x108], r9
mov qword [rsp + 0x80], 0
mov dword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
call fcn.14000a820
test eax, eax
mov ebx, eax
jne 0x1400016d3
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x140001710
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rbp, rax
je 0x1400016f1
mov r15d, dword [r12 + 8]
mov ebx, 0x2000
mov r9, r13
mov edx, 1
cmp r15, rbx
mov rcx, rdi
cmovbe rbx, r15
mov r8, rbx
call sub.msvcrt.dll_fread
cmp rax, rbx
jne 0x1400015bf
mov rcx, r13
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x1400015bf
mov dword [rsp + 0x48], ebx
mov esi, eax
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x28], rbx
xor edx, edx
mov rcx, r14
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x58], 0x2000
call fcn.14000a8f0
cmp eax, 0xffffffff
mov ebx, eax
jge 0x1400015a0
cmp eax, 0xfffffffc
jl 0x1400015f8
mov r10d, eax
jmp 0x1400015ab
cmp eax, 2
jne 0x1400015f8
mov r10d, 0xfffffffd
lea rdx, [r12 + 0x12]
mov r8d, r10d
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
call fcn.140002b00
mov ebx, 0xffffffff
mov rcx, r14
call fcn.14000c6a0
mov rcx, rdi
call sub.msvcrt.dll_free
mov rcx, rbp
call sub.msvcrt.dll_free
mov eax, ebx
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov eax, dword [rsp + 0x58]
mov r8d, 0x2000
sub r8, rax
mov r9, rax
cmp qword [rsp + 0x100], 0
je 0x140001690
mov r9, qword [rsp + 0x100]
mov edx, 1
mov rcx, rbp
mov qword [rsp + 0x30], r8
call sub.msvcrt.dll_fwrite
mov r8, qword [rsp + 0x30]
cmp rax, r8
jne 0x1400016c8
mov rcx, qword [rsp + 0x100]
call sub.msvcrt.dll_ferror
test eax, eax
jne 0x1400016c8
mov r9d, dword [rsp + 0x58]
test r9d, r9d
je 0x140001574
mov eax, esi
mov esi, ebx
mov rbx, qword [rsp + 0x28]
sub r15, rbx
cmp esi, 1
je 0x14000172f
test r15, r15
jne 0x140001534
cmp esi, 1
mov r10d, esi
mov ebx, eax
je 0x1400015c4
jmp 0x1400015ab
cmp qword [rsp + 0x108], 0
je 0x140001651
mov rcx, qword [rsp + 0x108]
mov rdx, rbp
mov qword [rsp + 0x30], r8
mov dword [rsp + 0x3c], eax
call sub.msvcrt.dll_memcpy
mov r8, qword [rsp + 0x30]
mov r9d, dword [rsp + 0x3c]
add qword [rsp + 0x108], r8
jmp 0x140001651
mov r10d, 0xffffffff
jmp 0x1400015ab
lea rdx, [r12 + 0x12]
mov r8d, eax
mov ebx, 0xffffffff
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002b00
jmp 0x1400015dc
lea r8, [r12 + 0x12]
xor ebp, ebp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140002c80
jmp 0x1400015c4
lea r8, [r12 + 0x12]
xor ebp, ebp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140002c80
jmp 0x1400015c4
mov ebx, eax
jmp 0x1400015c4
Function at 0x140001780
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov r12, rdx
lea rcx, [rcx + 0x70]
lea rdx, [0x140019129]
call fcn.1400042a0
test rax, rax
mov rbp, rax
je 0x1400018b0
mov edx, dword [r12 + 4]
xor r8d, r8d
mov rcx, rax
add edx, dword [rbx]
call fcn.14000f470
test eax, eax
js 0x140001890
mov esi, dword [r12 + 0xc]
mov rcx, rsi
call sub.msvcrt.dll_malloc
test rax, rax
mov r13, rax
je 0x1400018c6
cmp byte [r12 + 0x10], 1
je 0x140001870
test rsi, rsi
mov rdi, rax
jne 0x140001808
jmp 0x140001850
add rdi, rbx
sub rsi, rbx
je 0x140001850
mov ebx, 0x2000
mov r9, rbp
mov r8d, 1
cmp rsi, rbx
mov rcx, rdi
cmovbe rbx, rsi
mov rdx, rbx
call sub.msvcrt.dll_fread
test rax, rax
jne 0x140001800
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140002c80
mov rcx, r13
call sub.msvcrt.dll_free
xor r13d, r13d
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov rax, r13
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r8d, r8d
mov r9, rax
mov rdx, r12
mov rcx, rbp
call fcn.140001490
test eax, eax
je 0x140001850
jmp 0x140001845
lea r8, [r12 + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140002c80
jmp 0x14000184d
lea rdx, [r12 + 0x12]
xor r13d, r13d
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002b00
jmp 0x140001858
lea r8, [r12 + 0x12]
mov r9d, esi
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140002c80
jmp 0x14000184d
Function at 0x140001990
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
cmp dword [rcx + 0x5074], 1
mov rsi, rcx
mov rbx, rdx
jne 0x140001b90
cmp byte [rdx + 0x11], 0x6e
je 0x140001ab0
lea r13, [rdx + 0x12]
lea rcx, [rcx + 0x3070]
mov rdx, r13
call fcn.140008210
test rax, rax
mov r12, rax
je 0x140001ba6
lea rcx, [rsi + 0x70]
lea rdx, [0x140019129]
call fcn.1400042a0
test rax, rax
mov rbp, rax
je 0x140001b20
mov edx, dword [rbx + 4]
xor r8d, r8d
mov rcx, rax
add edx, dword [rsi]
call fcn.14000f470
test eax, eax
js 0x140001b70
cmp byte [rbx + 0x10], 1
je 0x140001ad0
mov ecx, 0x2000
call sub.msvcrt.dll_malloc
test rax, rax
mov rdi, rax
je 0x140001bbe
mov esi, dword [rbx + 0xc]
test rsi, rsi
jne 0x140001a66
jmp 0x140001b40
mov r9, r12
mov r8d, 1
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_fwrite
test rax, rax
je 0x140001b50
sub rsi, rbx
je 0x140001b40
mov ebx, 0x2000
mov r9, rbp
mov r8d, 1
cmp rsi, rbx
mov rcx, rdi
cmovbe rbx, rsi
mov rdx, rbx
call sub.msvcrt.dll_fread
test rax, rax
jne 0x140001a40
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
mov r8, r13
lea rcx, str.fread
call fcn.140002c80
mov esi, 0xffffffff
mov rcx, rdi
call sub.msvcrt.dll_free
jmp 0x140001ae3
call fcn.1400018f0
test eax, eax
mov esi, eax
js 0x140001b08
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
xor r9d, r9d
mov r8, r12
mov rdx, rbx
mov rcx, rbp
call fcn.140001490
mov esi, eax
mov rcx, rbp
call sub.msvcrt.dll_fclose
mov rcx, r12
call sub.msvcrt.dll_fclose
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [rbx + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140002b00
jmp 0x140001abb
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
mov rdx, r13
mov esi, 0xffffffff
call fcn.140002b00
jmp 0x140001aeb
xor esi, esi
jmp 0x140001aa6
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
mov r8, r13
lea rcx, str.fwrite
call fcn.140002c80
jmp 0x140001aa1
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
mov r8, r13
lea rcx, str.fseek
call fcn.140002c80
mov esi, 0xffffffff
jmp 0x140001ae3
lea rcx, str.pyi_arch_extract2fs_was_called_before_temporary_directory_was_initialized__n
call fcn.140002b00
mov esi, 0xffffffff
jmp 0x140001abb
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
mov r8, r13
lea rcx, str.fopen
call fcn.140002c80
jmp 0x140001b9c
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
mov r8, r13
lea rcx, str.malloc
call fcn.140002c80
jmp 0x140001b86
Function at 0x140001be0
Capabilities:
Read file on windows

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
lea rdx, [0x140019129]
mov rsi, rcx
lea rcx, [rcx + 0x70]
call fcn.1400042a0
test rax, rax
mov rbx, rax
je 0x140001e01
mov rax, qword [0x14001f3c0]
lea rdx, [rsp + 0x28]
mov r8d, 8
mov rcx, rbx
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
shr rax, 0x18
add eax, 0xc
mov byte [rsp + 0x2b], al
call fcn.140008830
test rax, rax
mov rdi, rax
jne 0x140001c58
mov edi, 0xffffffff
mov rcx, rbx
call sub.msvcrt.dll_fclose
mov eax, edi
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
xor r8d, r8d
mov edx, eax
mov rcx, rbx
call fcn.14000f470
test eax, eax
js 0x140001db0
lea rcx, [rsi + 0x18]
mov r9, rbx
mov r8d, 1
mov edx, 0x58
call sub.msvcrt.dll_fread
test rax, rax
je 0x140001dd0
mov eax, dword [rsi + 0x20]
add rdi, 0x58
mov dword [rsi + 0x5078], 0
mov edx, dword [rsi + 0x24]
mov ecx, dword [rsi + 0x28]
mov r8d, dword [rsi + 0x2c]
bswap eax
movd xmm0, eax
mov eax, eax
bswap edx
movd xmm2, edx
sub rdi, rax
punpckldq xmm0, xmm2
bswap ecx
movq qword [rsi + 0x20], xmm0
movd xmm0, ecx
bswap r8d
movd xmm3, r8d
add edx, edi
mov qword [rsi], rdi
punpckldq xmm0, xmm3
mov dword [0x140023040], r8d
mov rcx, rbx
xor r8d, r8d
movq qword [rsi + 0x28], xmm0
call fcn.14000f470
movsxd rdi, dword [rsi + 0x28]
mov rcx, rdi
call sub.msvcrt.dll_malloc
test rax, rax
mov rcx, rax
mov qword [rsi + 8], rax
je 0x140001e0b
mov r9, rbx
mov r8d, 1
mov rdx, rdi
call sub.msvcrt.dll_fread
test rax, rax
je 0x140001d98
movsxd rax, dword [rsi + 0x28]
mov rcx, rbx
add rax, qword [rsi + 8]
mov qword [rsi + 0x10], rax
call sub.msvcrt.dll_ferror
test eax, eax
mov edi, eax
jne 0x140001df0
mov rax, qword [rsi + 8]
mov r9, qword [rsi + 0x10]
cmp rax, r9
jae 0x140001c40
nop dword [rax]
mov ecx, dword [rax + 4]
mov edx, dword [rax]
mov r8d, dword [rax + 8]
bswap ecx
movd xmm0, ecx
mov ecx, dword [rax + 0xc]
bswap edx
mov dword [rax], edx
movsxd rdx, edx
bswap r8d
movd xmm1, r8d
punpckldq xmm0, xmm1
movq qword [rax + 4], xmm0
bswap ecx
mov dword [rax + 0xc], ecx
add rax, rdx
cmp rax, r9
jb 0x140001d58
jmp 0x140001c40
lea rdx, str.Could_not_read_full_TOC__n
lea rcx, str.fread
call fcn.140002c80
jmp 0x140001c3b
lea rdx, str.Failed_to_seek_to_cookie_position__n
lea rcx, str.fseek
call fcn.140002c80
jmp 0x140001c3b
lea rdx, str.Failed_to_read_cookie__n
lea rcx, str.fread
call fcn.140002c80
jmp 0x140001c3b
lea rcx, str.Error_on_file._n
call fcn.140002b00
jmp 0x140001c3b
mov edi, 0xffffffff
jmp 0x140001c48
lea rdx, str.Could_not_allocate_buffer_for_TOC__n
lea rcx, str.malloc
call fcn.140002c80
jmp 0x140001c3b
Function at 0x140007ad0
Capabilities:
Query environment variable

Disassembly:
push rbx
mov eax, 0x4020
call fcn.14000e930
sub rsp, rax
xor r8d, r8d
lea rbx, [rsp + 0x20]
mov rdx, rcx
xor ecx, ecx
call fcn.140008e30
mov r8d, 0x2000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140007b18
xor eax, eax
add rsp, 0x4020
pop rbx
ret
lea rdx, [rsp + 0x2020]
mov r8d, 0x2000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor ecx, ecx
xor r8d, r8d
mov rdx, rbx
call fcn.140008c60
test rax, rax
mov rcx, rax
je 0x140007b06
cmp byte [rax], 0
je 0x140007b06
call sub.msvcrt.dll__strdup
add rsp, 0x4020
pop rbx
ret

Function at 0x140007bc0
Capabilities:
Set environment variable

Disassembly:
push rsi
push rbx
sub rsp, 0x28
xor r8d, r8d
mov rdx, rcx
xor ecx, ecx
call fcn.140008e30
xor edx, edx
mov rbx, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov rcx, rbx
mov esi, eax
call sub.msvcrt.dll_free
mov eax, esi
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x140007f10
Capabilities:
Delete directory

Disassembly:
push r13
mov eax, 0x44a8
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.14000e930
sub rsp, rax
mov r8d, 0x1000
lea r13, [rsp + 0x2490]
mov rdx, rcx
lea rsi, [rsp + 0x480]
mov rcx, r13
call fcn.140008e30
mov rdx, r13
mov rcx, rsi
call sub.msvcrt.dll_wcscpy
mov rcx, rsi
call sub.msvcrt.dll_wcslen
mov rbp, rax
movzx eax, word [rsp + rax*2 + 0x47e]
cmp ax, 0x2f
je 0x140007f70
cmp ax, 0x5c
jne 0x140007fb8
lea rdx, [0x14001b4ca]
mov rcx, rsi
call sub.msvcrt.dll_wcscat
lea rbx, [rsp + 0x250]
mov rcx, rsi
mov rdx, rbx
call fcn.14000f170
cmp rax, 0xffffffffffffffff
mov r12, rax
jne 0x140007fd0
mov rcx, r13
call qword [sym.imp.msvcrt.dll__wrmdir]
nop
add rsp, 0x44a8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
lea rdx, [0x14001b4c6]
mov rcx, rsi
add rbp, 1
call sub.msvcrt.dll_wcscat
jmp 0x140007f70
lea rdi, [rsp + 0x20]
nop dword [rax]
mov r8d, 0x230
mov rdx, rbx
mov rcx, rdi
call sub.msvcrt.dll_memcpy
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.140008020
mov rdx, rbx
mov rcx, r12
call fcn.14000f1f0
test eax, eax
je 0x140007fd8
mov rcx, r12
call qword [sym.imp.msvcrt.dll__findclose]
jmp 0x140007f9b

Function at 0x140008020
Capabilities:
Delete directory
Delete file

Disassembly:
push rbp
mov eax, 0x1038
push rdi
push rsi
push rbx
call fcn.14000e930
sub rsp, rax
lea rsi, [r8 + 0x24]
mov rbp, rcx
mov rdi, rdx
lea rdx, [0x14001b4ce]
mov rcx, rsi
mov rbx, r8
call sub.msvcrt.dll_wcscmp
test eax, eax
jne 0x140008060
add rsp, 0x1038
pop rbx
pop rsi
pop rdi
pop rbp
ret
lea rdx, [0x14001b4d2]
mov rcx, rsi
call sub.msvcrt.dll_wcscmp
test eax, eax
je 0x140008051
xor eax, eax
mov rcx, rbp
mov rdx, rsi
mov word [rbp + rdi*2], ax
call sub.msvcrt.dll_wcscat
test byte [rbx], 0x10
mov rcx, rbp
je 0x1400080c0
call fcn.140009110
test eax, eax
jne 0x1400080e8
lea rbx, [rsp + 0x20]
mov r8d, 0x1000
mov rdx, rbp
mov rcx, rbx
call fcn.140008c60
mov rcx, rbx
call fcn.140007f10
jmp 0x140008051
mov rbx, qword [sym.imp.msvcrt.dll__wremove]
call rbx
test eax, eax
je 0x140008051
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbp
call rbx
jmp 0x140008051
mov rcx, rbp
call qword [sym.imp.msvcrt.dll__wrmdir]
jmp 0x140008051