joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ee841
Capabilities:
Terminate process

Disassembly:
jmp 0x1402c3570
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x1400eee31
Capabilities:
Write file on windows

Disassembly:
jmp 0x14015a3b0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14037ead8]
call fcn.1400f085d
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fwrite]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret

Function at 0x1400eee9a
Capabilities:
Get geographical location

Disassembly:
jmp 0x140295010
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14029504d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.1400f082b
add rsp, 0x58
ret

Function at 0x1400ef089
Capabilities:
Read file on windows

Disassembly:
jmp 0x14015a330
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0xe8
lea rbp, [rsp + 0x20]
lea rcx, [0x14037ead8]
call fcn.1400f085d
nop
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe8]
mov rcx, qword [rbp + 0xe0]
call qword [sym.imp.ucrtbased.dll_fread]
lea rsp, [rbp + 0xc8]
pop rdi
pop rbp
ret
Function at 0x1400ef0a7
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14015c390
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x198
lea rbp, [rsp + 0x20]
lea rcx, [0x14037ead8]
call fcn.1400f085d
nop
mov eax, dword [rbp + 0x1a0]
not eax
mov dword [rbp + 0x1a0], eax
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x190]
mov qword [rbp + 0x28], rax
lea rax, [0x1402de2d0]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x198], 0
je 0x14015c4d6
mov rax, qword [rbp + 0x198]
mov qword [rbp + 0x158], rax
mov rax, qword [rbp + 0x198]
dec rax
mov qword [rbp + 0x198], rax
cmp qword [rbp + 0x158], 0
je 0x14015c42a
mov dword [rbp + 0x160], 1
jmp 0x14015c434
mov dword [rbp + 0x160], 0
cmp dword [rbp + 0x160], 0
je 0x14015c4d1
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x64], al
movzx eax, byte [rbp + 0x64]
cmp eax, 0x23
jne 0x14015c4ab
cmp qword [rbp + 0x198], 2
jb 0x14015c4ab
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14015c4ab
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14015c4ab
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x64]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14015c3f5
jmp 0x14015c570
mov rax, qword [rbp + 0x28]
movzx eax, byte [rax]
mov byte [rbp + 0x154], al
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
movzx eax, byte [rbp + 0x154]
mov byte [rbp + 0x84], al
movzx eax, byte [rbp + 0x84]
test eax, eax
je 0x14015c570
movzx eax, byte [rbp + 0x84]
cmp eax, 0x23
jne 0x14015c547
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14015c547
mov eax, 1
imul rax, rax, 1
mov rcx, qword [rbp + 0x28]
movzx eax, byte [rcx + rax]
cmp eax, 0x23
jne 0x14015c547
mov eax, dword [rbp + 0x1a0]
mov dword [rbp + 4], eax
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
movzx edx, byte [rbp + 0x84]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
jmp 0x14015c4d6
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400ef264
Capabilities:
Parse pe header

Disassembly:
jmp 0x1402c4e00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1402c4e20
xor al, al
jmp 0x1402c4ea1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1402c4e33
xor al, al
jmp 0x1402c4ea1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1402c4e5d
xor al, al
jmp 0x1402c4ea1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1402c4e71
xor al, al
jmp 0x1402c4ea1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1402c4e83
xor al, al
jmp 0x1402c4ea1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1402c4e9f
xor al, al
jmp 0x1402c4ea1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400efe03
Capabilities:
Create directory

Disassembly:
jmp 0x140296650
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x140358e40]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14029668d
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x140296702
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x1402966f0
mov edx, 1
mov ecx, 2
call fcn.1400ec29e
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.1400ed469
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x1402966f0
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.1400ec8c5
movzx eax, al
test eax, eax
jne 0x1402966f0
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ee2c4
add rsp, 0x68
ret
Function at 0x1400f02db
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x14015c270
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x20]
lea rcx, [0x14037ead8]
call fcn.1400f085d
nop
mov eax, dword [rbp + 0x160]
not eax
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x28], rax
lea rax, [0x1402de2d0]
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x158]
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x158]
dec rax
mov qword [rbp + 0x158], rax
cmp qword [rbp + 0x118], 0
je 0x14015c2f0
mov dword [rbp + 0x120], 1
jmp 0x14015c2fa
mov dword [rbp + 0x120], 0
cmp dword [rbp + 0x120], 0
je 0x14015c343
mov eax, dword [rbp + 4]
shr eax, 8
mov ecx, dword [rbp + 4]
and ecx, 0xff
mov rdx, qword [rbp + 0x28]
movzx edx, byte [rdx]
xor ecx, edx
mov ecx, ecx
mov rdx, qword [rbp + 0x48]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 0x114], eax
mov rax, qword [rbp + 0x28]
inc rax
mov qword [rbp + 0x28], rax
mov eax, dword [rbp + 0x114]
mov dword [rbp + 4], eax
jmp 0x14015c2bb
mov eax, dword [rbp + 4]
not eax
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x1400f0367
Capabilities:
Enumerate process modules

Disassembly:
jmp 0x140121960
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x7f8
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0x166
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x818]
mov rax, qword [0x140358e40]
xor rax, rbp
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x508], 0
lea rcx, [0x14037e58c]
call fcn.1400f085d
nop
mov dword [rbp + 0x10], 0x438
mov rax, qword [rbp + 0x7f0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call fcn.1400ee21a
mov qword [rbp + 0x468], rax
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400eecce
nop
mov dword [rbp + 0x484], 0
call fcn.1400efdb3
mov dword [rbp + 0x4a4], eax
mov qword [rbp + 0x4c8], 0
mov qword [rbp + 0x4e8], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400ec69a
mov qword [rbp + 0x798], rax
lea rax, [rbp + 0x40]
mov qword [rbp + 0x4c8], rax
cmp qword [rbp + 0x4c8], 0
jne 0x140121a50
mov qword [rbp + 0x7a0], 0
jmp 0x140121b3b
mov rcx, qword [rbp + 0x4c8]
call qword [sym.imp.ucrtbased.dll_wcslen]
inc eax
mov dword [rbp + 0x484], eax
cmp dword [rbp + 0x484], 0x3fffffff
jle 0x140121a81
mov qword [rbp + 0x7a8], 0
jmp 0x140121b2d
movsxd rax, dword [rbp + 0x484]
shl rax, 1
mov qword [rbp + 0x7b0], rax
movsxd rcx, dword [rbp + 0x484]
shl rcx, 1
add rcx, 0x24
mov qword [rbp + 0x7b8], rcx
mov rcx, qword [rbp + 0x7b8]
add rcx, 0xf
cmp rcx, qword [rbp + 0x7b8]
ja 0x140121ac5
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400eccfd
sub rsp, rax
lea rax, [rsp + 0x20]
mov qword [rbp + 0x7c0], rax
lea r8, [rbp + 0x508]
mov rdx, qword [rbp + 0x7b8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400f0efc
add qword [rbp + 0x7c0], 0x20
mov r9d, dword [rbp + 0x4a4]
mov rax, qword [rbp + 0x7b0]
mov r8d, eax
mov rdx, qword [rbp + 0x4c8]
mov rcx, qword [rbp + 0x7c0]
call fcn.1400ed93c
mov qword [rbp + 0x7a8], rax
mov rax, qword [rbp + 0x7a8]
mov qword [rbp + 0x7a0], rax
mov rdx, qword [rbp + 0x798]
mov rcx, qword [rbp + 0x7a0]
call fcn.1400f0f5b
test eax, eax
jne 0x140121b80
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, qword [rbp + 0x38]
mov qword [rbp + 0x768], rax
mov rcx, qword [rbp + 0x7f8]
call fcn.1400ecd34
mov rax, qword [rbp + 0x768]
jmp 0x140121bc4
lea rdx, [rbp + 0x10]
mov rcx, qword [rbp + 0x468]
call fcn.1400ecaaa
test eax, eax
jne 0x140121a18
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov qword [rbp + 0x788], 0
mov rcx, qword [rbp + 0x7f8]
call fcn.1400ecd34
mov rax, qword [rbp + 0x788]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x1402dc610]
mov r8, qword [rbp + 0x508]
call fcn.1400eeee5
mov rax, rdi
mov rcx, qword [rbp + 0x7c8]
xor rcx, rbp
call fcn.1400ee2c4
lea rsp, [rbp + 0x7d8]
pop rdi
pop rbp
ret
Function at 0x1400f0772
Capabilities:
Write file on windows

Disassembly:
jmp 0x14028a420
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x140358e40]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x14037f674]
call fcn.1400f085d
nop
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x14028a487
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14028a48e
mov al, 1
jmp 0x14028a5fe
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.1400ed383
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.1400ed383
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.1400ef93a
movzx eax, al
test eax, eax
je 0x14028a4f1
xor al, al
jmp 0x14028a5fe
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x14028a564
cmp dword [rbp + 0x160], 1
je 0x14028a56f
cmp dword [rbp + 0x160], 3
je 0x14028a5ed
jmp 0x14028a5fc
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14028a5bf
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14028a5bf
xor al, al
jmp 0x14028a5fe
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14028a5da
mov dword [rbp + 0x154], 1
jmp 0x14028a5e4
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14028a5fe
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14028a5fe
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x14032e5f0]
call fcn.1400efc28
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.1400ee2c4
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1402c3c20
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400f0af6
movzx eax, al
test eax, eax
jne 0x1402c3c40
mov ecx, 7
call fcn.1400efc9b
nop
mov byte [rsp + 0x20], 0
call fcn.1400efdc7
mov byte [rsp + 0x21], al
cmp dword [0x140363450], 1
jne 0x1402c3c64
mov ecx, 7
call fcn.1400efc9b
nop
jmp 0x1402c3cbc
cmp dword [0x140363450], 0
jne 0x1402c3cb7
mov dword [0x140363450], 1
lea rdx, [0x1402d6d68]
lea rcx, [0x1402d6a38]
call fcn.1400ee1fc
test eax, eax
je 0x1402c3c98
mov eax, 0xff
jmp 0x1402c3dc1
lea rdx, [0x1402d6928]
lea rcx, [section..rdata]
call fcn.1400efd90
mov dword [0x140363450], 2
jmp 0x1402c3cbc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.1400efbc4
call fcn.1400ef45d
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1402c3d19
mov rcx, qword [rsp + 0x30]
call fcn.1400edba3
movzx eax, al
test eax, eax
je 0x1402c3d19
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140381020]
nop
call fcn.1400ef764
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x1402c3d4d
mov rcx, qword [rsp + 0x38]
call fcn.1400edba3
movzx eax, al
test eax, eax
je 0x1402c3d4d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.1400f062d
nop
call fcn.1402c3e30
mov dword [rsp + 0x28], eax
call fcn.1400ef264
movzx eax, al
test eax, eax
jne 0x1402c3d6c
mov ecx, dword [rsp + 0x28]
call fcn.1400ec54b
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1402c3d7b
call fcn.1400f06f5
nop
xor edx, edx
mov cl, 1
call fcn.1400eda04
mov eax, dword [rsp + 0x28]
jmp 0x1402c3dc1
add rsp, 0x68
ret
Function at 0x14012ad30
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x14012ad3d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x14012ad4d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x14012ad35
lea eax, [rcx + 1]
jmp 0x14012ad5b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x14012ad6e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x14012ad54
sub eax, 3
jb 0x14012ad8e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x14012addd
sar eax, 1
movsxd rbp, eax
jb 0x14012adc4
jmp 0x14012ad9c
add ebx, ebx
jne 0x14012ad9a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14012adc4
inc ecx
add ebx, ebx
jne 0x14012adaa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x14012adc4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x14012adbd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x14012adac
add ecx, 2
jmp 0x14012adc9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.14012acf2
jmp 0x14012ad3d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
mov rdi, rsi
push rsi
mov rdi, rsi
mov rsi, 0xd6400
mov dl, 0x1b
push rbx
push rdi
lea rcx, [rdi + rsi - 3]
pop rsi
push rsi
pop rbx
jmp 0x14012ae2d
cmp rsi, rcx
jae 0x14012ae35
push rsi
pop rsi
lodsb al, byte [rsi]
cmp al, 0x80
jb 0x14012ae14
cmp al, 0x8f
ja 0x14012ae14
cmp byte [rsi - 2], 0xf
je 0x14012ae1a
sub al, 0xe8
cmp al, 1
ja 0x14012adfe
cmp rsi, rcx
jae 0x14012ae35
push rsi
lodsd eax, dword [rsi]
sub al, dl
jne 0x14012ae04
pop rdi
bswap eax
sub eax, edi
add eax, ebx
stosd dword [rdi], eax
cmp rsi, rcx
jae 0x14012ae35
lodsb al, byte [rsi]
jmp 0x14012ae14
pop rbx
pop rsi
sub rsp, 0x28
lea rdi, [rsi + 0x127000]
mov eax, dword [rdi]
or eax, eax
je 0x14012ae92
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x12a000]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x14012ae42
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x14012ae8c
mov qword [rbx], rax
add rbx, 8
jmp 0x14012ae62
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x14012aecc
cmp al, 0xef
ja 0x14012aebe
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x14012ae9e
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
jmp 0x14012aead
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.14012af4b], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.14012af4b
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x14012af3b
sub rsp, 0xffffffffffffff80
jmp 0x1400013f0
Function at 0x140001130
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov dword [rsp + 0x38], 0
mov rcx, qword [rcx]
xor r8d, r8d
xor edx, edx
call fcn.14000abfc
mov r9, qword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 1
lea r8d, [rdx + 1]
call fcn.14000a8c0
cmp byte [rsp + 0x30], 0x4d
jne 0x140001220
cmp byte [rsp + 0x31], 0x5a
jne 0x140001220
mov rcx, qword [rbx]
xor r8d, r8d
lea edx, [r8 + 0x3c]
call fcn.14000abfc
mov r9, qword [rbx]
lea rcx, [rsp + 0x38]
mov edx, 4
lea r8d, [rdx - 3]
call fcn.14000a8c0
mov edx, dword [rsp + 0x38]
xor r8d, r8d
mov rcx, qword [rbx]
add edx, 0x18
call fcn.14000abfc
mov r9, qword [rbx]
lea rcx, [rsp + 0x30]
mov edx, 2
lea r8d, [rdx - 1]
call fcn.14000a8c0
cmp byte [rsp + 0x30], 0xb
jne 0x140001220
movzx eax, byte [rsp + 0x31]
cmp al, 1
jne 0x1400011de
mov ecx, 0x98
jmp 0x1400011e7
cmp al, 2
jne 0x140001220
mov ecx, 0xa8
mov edx, dword [rsp + 0x38]
xor r8d, r8d
add edx, ecx
mov rcx, qword [rbx]
call fcn.14000abfc
mov r9, qword [rbx]
lea rcx, [rsp + 0x38]
mov edx, 4
lea r8d, [rdx - 3]
call fcn.14000a8c0
mov eax, dword [rsp + 0x38]
or ecx, 0xffffffff
test eax, eax
cmove eax, ecx
add rsp, 0x20
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x140001230
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbp, rdx
mov rdi, rcx
jne 0x140001277
add rcx, 0x78
lea rdx, [0x140022400]
call fcn.1400029d0
mov qword [rdi], rax
test rax, rax
jne 0x140001277
lea rcx, str.Cannot_open_archive_file_n
call fcn.1400019f0
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbp + 4]
mov qword [rsp + 0x38], rsi
call sub.WS2_32.dll_ntohl
add eax, dword [rdi + 8]
xor r8d, r8d
mov rcx, qword [rdi]
mov edx, eax
call fcn.14000abfc
mov ecx, dword [rbp + 8]
call sub.WS2_32.dll_ntohl
mov ecx, eax
call fcn.14000a4f0
mov rsi, rax
test rax, rax
jne 0x1400012c9
lea rcx, str.Could_not_allocate_read_buffer_n
call fcn.1400019f0
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov ecx, dword [rbp + 8]
call sub.WS2_32.dll_ntohl
mov r9, qword [rdi]
mov r8d, 1
mov edx, eax
mov rcx, rsi
call fcn.14000a8c0
cmp rax, 1
jae 0x140001310
lea rcx, str.Could_not_read_from_file_n
call fcn.1400019f0
mov rcx, rsi
call fcn.14000a4e8
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
cmp byte [rbp + 0x10], 1
jne 0x140001360
mov rdx, rbp
mov qword [rsp + 0x30], rbx
mov rcx, rsi
call fcn.140001040
mov rcx, rsi
mov rbx, rax
call fcn.14000a4e8
test rbx, rbx
mov rsi, rbx
mov rbx, qword [rsp + 0x30]
jne 0x140001360
lea rdx, [rbp + 0x12]
lea rcx, str.Error_decompressing__s_n
call fcn.1400019f0
mov rsi, qword [rsp + 0x38]
xor eax, eax
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rdi]
test rcx, rcx
je 0x140001374
call fcn.14000a57c
mov qword [rdi], 0
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140001390
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rdi, rcx
call fcn.140001230
mov rcx, rdi
mov rbp, rax
call fcn.1400040f0
cmp eax, 0xffffffff
jne 0x1400013cc
or eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
lea rcx, [rdi + 0x2078]
lea rbx, [rsi + 0x12]
mov rdx, rbx
call fcn.140004410
mov ecx, dword [rsi + 0xc]
mov rdi, rax
call sub.WS2_32.dll_ntohl
mov esi, eax
test rdi, rdi
jne 0x140001411
mov r8, rbx
lea rdx, str._s_could_not_be_extracted__n
lea rcx, str.fopen
call fcn.1400019b0
or eax, 0xffffffff
jmp 0x14000145d
mov r9, rdi
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call fcn.14000b328
cmp rax, 1
je 0x14000144b
test rsi, rsi
je 0x14000144b
mov r8, rbx
lea rdx, str.Failed_to_write_all_bytes_for__s_n
lea rcx, str.fwrite
call fcn.1400019b0
or eax, 0xffffffff
jmp 0x14000145d
mov rcx, rdi
call fcn.14000a57c
mov rcx, rbp
call fcn.14000a4e8
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140001480
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x140032010]
xor rax, rsp
mov qword [rsp + 0x80], rax
lea esi, [rdx - 0x60]
mov rdi, rcx
mov rcx, qword [rcx]
lea rbx, [rsp + 0x28]
mov edx, esi
xor r8d, r8d
call fcn.14000abfc
test eax, eax
jne 0x140001506
mov r9, qword [rdi]
lea edx, [rax + 0x60]
lea r8d, [rax + 1]
lea rcx, [rsp + 0x20]
call fcn.14000a8c0
cmp rax, 1
jb 0x140001506
nop word [rax + rax]
mov r8d, 8
lea rcx, str.MEI_f_v_n_v
mov rdx, rbx
call fcn.14000a460
test eax, eax
je 0x14000150b
dec rbx
lea rax, [rsp + 0x20]
cmp rbx, rax
jae 0x1400014e0
or eax, 0xffffffff
jmp 0x140001561
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rdi + 0x20], xmm0
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rdi + 0x30], xmm1
movups xmm1, xmmword [rbx + 0x30]
movups xmmword [rdi + 0x40], xmm0
movups xmm0, xmmword [rbx + 0x40]
movups xmmword [rdi + 0x50], xmm1
movsd xmm1, qword [rbx + 0x50]
movups xmmword [rdi + 0x60], xmm0
movsd qword [rdi + 0x70], xmm1
mov ecx, dword [rdi + 0x28]
call sub.WS2_32.dll_ntohl
mov eax, eax
movsxd rcx, esi
sub rcx, rax
lea rax, [rsp + 0x20]
sub rcx, rax
lea rax, [rcx + 0x58]
add rax, rbx
mov qword [rdi + 8], rax
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140008620
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret