joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000aa30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x18000abc4
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x18000abc4
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x18000aacb
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x18000abeb
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x18000aae2
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x18000aae2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x18000aaf5
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x18000ab42
mov r8d, eax
cmp eax, 0x800
jae 0x18000ab0f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x18000ab42
cmp eax, 0x10000
jae 0x18000ab29
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x18000ab42
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x18000abc4
add qword [r14], 2
test sil, sil
jne 0x18000ab63
cmp r10d, 3
jae 0x18000ab6f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x18000aba1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x18000ab80
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x18000aa7f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x18000abd2
Function at 0x18000cfb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x190
mov rax, qword [0x180023048]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov rbx, rcx
mov dword [rsp + 0x50], 0x11c
xor edi, edi
lea rcx, [rsp + 0x64]
xor edx, edx
mov qword [rsp + 0x5c], rdi
mov r8d, 0x100
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov word [rsp + 0x166], di
mov r8b, 3
mov dword [rsp + 0x168], eax
lea edx, [rdi + 2]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rdi + 1]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
lea edx, [rdi + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea edx, [rdi + 0x23]
mov dword [rsp + 0x54], 6
mov r8, rax
mov dword [rsp + 0x58], 2
lea rcx, [rsp + 0x50]
mov word [rsp + 0x164], di
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x18000d06e
mov rax, qword [0x180023008]
mov rcx, rbx
call rax
jmp 0x18000d0fd
movaps xmmword [rsp + 0x180], xmm6
lea r8, [rsp + 0x38]
movsd xmm6, qword [0x18001a1a0]
lea rdx, str.Control_PanelDesktopWindowMetrics
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x18000d0e5
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x34]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.AppliedDPI
mov dword [rsp + 0x34], 4
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000d0e5
mov eax, dword [rsp + 0x30]
xorps xmm6, xmm6
cvtsi2sd xmm6, rax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cvttsd2si rax, xmm6
movaps xmm6, xmmword [rsp + 0x180]
mov eax, eax
xorps xmm0, xmm0
cvtsi2sd xmm0, rax
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.180016470
mov rbx, qword [rsp + 0x1a8]
add rsp, 0x190
pop rdi
ret
Function at 0x18000e530
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180023048]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rsi, rcx
mov qword [rsp + 0x20], rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov r13, rax
xor edi, edi
test rax, rax
jne 0x18000e58b
mov qword [rsi], rdi
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
jmp 0x18000e683
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov r15, rdi
mov qword [rsp + 0x38], rdi
mov ebp, 1
mov rbx, qword [rsp + 0x30]
cmp dword [rsp + 0x20], ebp
jle 0x18000e66a
lea r14, [rax + 8]
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r14]
lea rcx, [rsp + 0x40]
call sym.multi_window_windows_plugin.dll_class_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char_____cdecl_Utf8FromUtf16_wchar_t_const____ptr64_
nop
cmp rbx, r15
je 0x18000e606
mov qword [rbx], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
add rbx, 0x20
mov qword [rsp + 0x30], rbx
jmp 0x18000e620
mov r8, rax
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000e090
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x18000e65a
lea rdx, [rax + 1]
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000e655
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000e6ac
call fcn.180015d34
inc ebp
add r14, 8
cmp ebp, dword [rsp + 0x20]
jl 0x18000e5c0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rax, qword [rsp + 0x28]
mov qword [rsi], rax
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], r15
mov rax, rsi
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180016470
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
int3

Function at 0x18000f260
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub rsp, 0x58
xor eax, eax
mov qword [rsp + 0x48], 7
lea rdx, str.TraderMasterFloater
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rax
lea r8d, [rax + 0x13]
call fcn.18000a5b0
lea rax, [rsp + 0x60]
mov r9d, 0xf003f
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x18000f2e0
cmp qword [rsp + 0x48], 8
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x60]
cmovae rdx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x30]
call fcn.18000a170
add rsp, 0x58
ret
Function at 0x18000f310
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x180023048]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor edx, edx
mov r8d, 0x21c
lea rcx, [rbp - 0x60]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x10e
lea rdx, [rbp - 0x60]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rax, [rbp - 0x60]
sub rax, 2
lea rax, [rax + 2]
cmp word [rax], 0
jne 0x18000f361
movups xmm0, xmmword [str.__minQuote]
movups xmmword [rax], xmm0
mov ecx, dword [0x18001a2f0]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x18001a2f4]
mov word [rax + 0x14], cx
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 7
lea rax, [rbp - 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], bx
jne 0x18000f3b3
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x58]
call fcn.18000a5b0
nop
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x70], 7
mov r8d, 0x13
lea rdx, str.TraderMasterFloater
lea rcx, [rsp + 0x78]
call fcn.18000a5b0
nop
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18000f437
xor bl, bl
jmp 0x18000f491
mov eax, dword [rsp + 0x68]
lea eax, [rax*2 + 2]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 8
cmovae rdx, qword [rsp + 0x78]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x18000f433
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov bl, 1
lea rcx, [rsp + 0x78]
call fcn.18000a170
lea rcx, [rsp + 0x58]
call fcn.18000a170
movzx eax, bl
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.180016470
mov rbx, qword [rsp + 0x2e0]
add rsp, 0x2d0
pop rbp
ret
Function at 0x18000f970
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, r8
cmp byte [0x180024b8c], 0
je 0x18000f98a
xor al, al
add rsp, 0x50
pop rbx
ret
lea rcx, [0x180023010]
cmp rcx, rdx
je 0x18000f9a9
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x18000f9a4
mov rdx, qword [rdx]
call fcn.18000a450
mov ecx, 0x18
call fcn.180015cf8
test rax, rax
je 0x18000f9ca
mov byte [rax], 0
mov qword [rax + 8], rbx
lea rcx, [0x18000f5c0]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18000f570]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000fa2f
cmp dword [rsp + 0x38], 0
je 0x18000fa42
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x18000fa27
mov al, 1
add rsp, 0x50
pop rbx
ret
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3

Function at 0x18000fa50
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x50
mov rbx, r8
cmp byte [0x180024b8c], 0
je 0x18000fa6a
xor al, al
add rsp, 0x50
pop rbx
ret
lea rcx, [0x180023010]
cmp rcx, rdx
je 0x18000fa89
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x18000fa84
mov rdx, qword [rdx]
call fcn.18000a450
mov ecx, 0x18
call fcn.180015cf8
test rax, rax
je 0x18000faaa
mov byte [rax], 1
mov qword [rax + 8], rbx
lea rcx, [0x18000f5c0]
mov qword [rax + 0x10], rcx
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18000f570]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000fb0f
cmp dword [rsp + 0x38], 0
je 0x18000fb22
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x18000fb07
mov al, 1
add rsp, 0x50
pop rbx
ret
mov ecx, eax
call sub.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.13
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000a9e0
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140001fb0
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.14001501c
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140001f70
jmp 0x14000126c
mov ecx, 0x2000
call fcn.14001501c
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140001f70
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000f9a8
cmp rax, rbx
jne 0x14000125e
mov rcx, rdi
call fcn.14000f71c
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140008e30
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.1400100b4
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000f71c
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000bf10
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140001fb0
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000a6c0
mov rcx, r13
call fcn.140015008
mov rcx, rbp
call fcn.140015008
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x1050
call fcn.14000b150
sub rsp, rax
mov rax, qword [0x14003e018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rsi, rdx
mov r13, rcx
add rcx, 0x70
lea rdx, [0x14002b784]
mov ebp, 0xffffffff
call fcn.140003140
mov r14, rax
test rax, rax
jne 0x140001311
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140001fb0
xor ebx, ebx
jmp 0x14000143a
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r13]
mov rcx, r14
call fcn.14000fcc0
test eax, eax
jns 0x14000134d
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001f70
mov rcx, r14
call fcn.14000f658
xor ebx, ebx
jmp 0x14000143a
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x1048], r12
call fcn.14001501c
mov r12, rax
mov rbx, rax
test rax, rax
jne 0x140001390
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140001f70
mov rcx, r14
call fcn.14000f658
jmp 0x140001432
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1040], r15
jne 0x140001463
mov r9, r12
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
jne 0x1400014d7
mov rcx, r14
add rsi, 0x12
call fcn.14000f658
mov rdx, rsi
lea rcx, [r13 + 0x3070]
call fcn.140006990
test eax, eax
js 0x140001422
mov qword [rsp + 0x28], rsi
lea r9, [r13 + 0x3070]
lea r8, str._s_c_s
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.140001e90
cmp eax, 0x1000
jge 0x140001422
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.1400032e0
mov ebp, eax
mov rdi, qword [rsp + 0x1090]
mov r15, qword [rsp + 0x1040]
mov r12, qword [rsp + 0x1048]
mov rcx, rbx
call fcn.140015008
mov eax, ebp
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14000b1b0
add rsp, 0x1050
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [rsi + 0xc]
mov r15, r12
test rdi, rdi
je 0x1400013c3
mov eax, 0x2000
nop word [rax + rax]
cmp rdi, rax
mov rbp, rdi
mov r9, r14
mov r8d, 1
cmova rbp, rax
mov rcx, r15
mov rdx, rbp
call fcn.14000f9a8
cmp rax, 1
jb 0x1400014bb
add r15, rbp
mov eax, 0x2000
sub rdi, rbp
jne 0x140001480
mov ebp, 0xffffffff
jmp 0x1400013c3
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140001f70
mov ebp, 0xffffffff
mov rcx, r12
call fcn.140015008
mov rcx, r14
call fcn.14000f658
xor ebx, ebx
jmp 0x140001422
Function at 0x1400015a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
add rcx, 0x70
lea rdx, [0x14002b784]
xor r14d, r14d
call fcn.140003140
mov r15, rax
test rax, rax
jne 0x1400015f0
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140001fb0
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [rbx]
mov rcx, r15
call fcn.14000fcc0
test eax, eax
jns 0x140001621
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001f70
jmp 0x1400016ef
mov ecx, dword [rsi + 0xc]
call fcn.14001501c
mov r14, rax
test rax, rax
jne 0x140001651
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140001f70
jmp 0x1400016ef
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
jne 0x14000167d
mov r9, r14
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.140001050
test eax, eax
je 0x1400016e0
jmp 0x1400016d5
mov ebx, dword [rsi + 0xc]
mov rbp, r14
test rbx, rbx
je 0x1400016e0
mov r12d, 0x2000
nop
cmp rbx, r12
mov rdi, rbx
mov r9, r15
mov r8d, 1
cmova rdi, r12
mov rcx, rbp
mov rdx, rdi
call fcn.14000f9a8
cmp rax, 1
jb 0x1400016be
add rbp, rdi
sub rbx, rdi
jne 0x140001690
jmp 0x1400016e0
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140001f70
mov rcx, r14
call fcn.140015008
xor r14d, r14d
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rcx, r15
call fcn.14000f658
mov rbx, qword [rsp + 0x58]
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x140001710
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp dword [rcx + 0x5074], 1
mov rdi, rdx
mov rbx, rcx
je 0x14000173e
lea rcx, str.pyi_arch_extract2fs_was_called_before_temporary_directory_was_initialized__n
call fcn.140001fb0
mov eax, 0xffffffff
add rsp, 0x38
pop rdi
pop rbx
ret
cmp byte [rdx + 0x11], 0x6e
jne 0x140001768
call fcn.1400012b0
mov ebx, eax
test eax, eax
jns 0x14000175f
lea rdx, [rdi + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140001fb0
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
add rcx, 0x3070
lea rbp, [rdx + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.140006de0
mov r12, rax
test rax, rax
jne 0x1400017b9
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.140001f70
mov rbp, qword [rsp + 0x50]
lea eax, [r12 - 1]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
lea rcx, [rbx + 0x70]
mov qword [rsp + 0x20], r15
lea rdx, [0x14002b784]
call fcn.140003140
mov r15, rax
test rax, rax
jne 0x1400017ee
mov rdx, rbp
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140001fb0
lea ebx, [r15 - 1]
jmp 0x14000192f
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [rbx]
mov rcx, r15
call fcn.14000fcc0
test eax, eax
jns 0x140001823
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001f70
mov ebx, 0xffffffff
jmp 0x140001927
cmp byte [rdi + 0x10], 1
jne 0x140001841
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.140001050
mov ebx, eax
jmp 0x140001927
mov qword [rsp + 0x30], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x28], r14
mov ecx, r13d
call fcn.14001501c
mov r14, rax
test rax, rax
jne 0x140001882
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.140001f70
lea ebx, [r14 - 1]
jmp 0x14000191d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001915
mov qword [rsp + 0x58], rsi
nop dword [rax]
nop word [rax + rax]
cmp rdi, r13
mov rsi, rdi
mov r9, r15
mov r8d, 1
cmova rsi, r13
mov rcx, r14
mov rdx, rsi
call fcn.14000f9a8
cmp rax, 1
jb 0x1400018f5
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r14
call fcn.1400100b4
cmp rax, 1
jb 0x1400018e5
sub rdi, rsi
jne 0x1400018a0
jmp 0x140001910
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
jmp 0x140001903
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov r8, rbp
call fcn.140001f70
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r14
call fcn.140015008
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov rcx, r15
call fcn.14000f658
mov rcx, r12
call fcn.14000f658
mov r15, qword [rsp + 0x20]
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret