joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fa9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x50]
cmp r12, qword [r14 + 0x10]
jbe 0x4fab03
push rbp
mov rbp, rsp
sub rsp, 0xc8
movabs rdx, 0x796e6103596f20c0
mov qword [rsp + 0x81], rdx
movabs rdx, 0x72a6a6db26182379
mov qword [rsp + 0x88], rdx
movabs rdx, 0x625766544b8fe537
mov qword [rsp + 0x90], rdx
movabs rdx, 0x20687d2a47363f1a
mov qword [rsp + 0x98], rdx
movabs rdx, 0x6e693820cb20662e
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x75006b4a48546c57
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x2f63d72b2072119a
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x8458b76b41f52078
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x29e30435386d16f1
mov qword [rsp + 0xc0], rdx
movabs rdx, 0xc0c0a370d090b41
mov qword [rsp + 0x1f], rdx
lea rdi, [rsp + 0x21]
lea rsi, [0x00559b22]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00452e4c
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4faae0
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x81]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x49]
movzx r9d, byte [rsp + rdi + 0x81]
mov byte [rsp + rdi + 0x81], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x49]
mov byte [rsp + rsi + 0x81], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x62
jl 0x4faa97
xor eax, eax
lea rbx, [rsp + 0x81]
mov ecx, 0x47
call fcn.004419a0
add rsp, 0xc8
pop rbp
ret
call fcn.004506a0
jmp fcn.004fa9a0

Function at 0x4fab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x4fac6e
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0xa56ee8d9226a6072
mov qword [rsp + 0x71], rdx
movabs rdx, 0x728563ea6f6320a5
mov qword [rsp + 0x78], rdx
movabs rdx, 0xf712ef20cdc66ecc
mov qword [rsp + 0x80], rdx
movabs rdx, 0xf3733a6fc0d33372
mov qword [rsp + 0x88], rdx
movabs rdx, 0xbecd732061c26eeb
mov qword [rsp + 0x90], rdx
movabs rdx, 0x822831bdb9701a67
mov qword [rsp + 0x98], rdx
movabs rdx, 0xc963b8f1203462af
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x9c78b301be4097ca
mov qword [rsp + 0xa8], rdx
movabs rdx, 0xf7ed1135383430c0
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x37450d052f013a00
mov qword [rsp + 0x1b], rdx
lea rdi, [rsp + 0x21]
lea rsi, [0x00558c1a]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00452e5a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4fac4e
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x71]
sub r8d, edx
add r8d, 0xfffffff0
movzx r9d, byte [rsp + rdi + 0x71]
mov byte [rsp + rdi + 0x71], r8b
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rsi + 0x71], dl
add rax, 2
cmp rax, 0x56
jl 0x4fac17
xor eax, eax
lea rbx, [rsp + 0x71]
mov ecx, 0x47
call fcn.004419a0
add rsp, 0xb8
pop rbp
ret
call fcn.004506a0
jmp fcn.004fab20
Function at 0x4fb5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb6e1
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x8fd4bdd98008fe81
mov qword [rsp + 0x48], rdx
movabs rdx, 0x655fc564656ed16c
mov qword [rsp + 0x50], rdx
movabs rdx, 0xdd63e0e1ce6f4b1a
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd9906a589df1eed0
mov qword [rsp + 0x60], rdx
movabs rdx, 0x20a0d00101e0503
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1d110e1a1e070110
mov qword [rsp + 0x22], rdx
movabs rdx, 0x51e14071e001d11
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd001d041b15051f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1c19111f1f041802
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1a1a091314061917
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fb6c4
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x48]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
movzx r9d, byte [rsp + rdi + 0x48]
mov byte [rsp + rdi + 0x48], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rsi + 0x48], dl
add rax, 2
cmp rax, 0x2e
jl 0x4fb68c
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x20
call fcn.004419a0
add rsp, 0x68
pop rbp
ret
call fcn.004506a0
jmp fcn.004fb5e0

Function at 0x4fb700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb801
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x8fd4bdd98008fe81
mov qword [rsp + 0x48], rdx
movabs rdx, 0x655fc564656ed16c
mov qword [rsp + 0x50], rdx
movabs rdx, 0xdd63e0e1ce6f4b1a
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd9906a589df1eed0
mov qword [rsp + 0x60], rdx
movabs rdx, 0x20a0d00101e0503
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1d110e1a1e070110
mov qword [rsp + 0x22], rdx
movabs rdx, 0x51e14071e001d11
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd001d041b15051f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1c19111f1f041802
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1a1a091314061917
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fb7e4
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x48]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
movzx r9d, byte [rsp + rdi + 0x48]
mov byte [rsp + rdi + 0x48], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rsi + 0x48], dl
add rax, 2
cmp rax, 0x2e
jl 0x4fb7ac
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x20
call fcn.004419a0
add rsp, 0x68
pop rbp
ret
call fcn.004506a0
jmp fcn.004fb700
Function at 0x4fb920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb9c1
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x202802a08f760269
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xa300fafb
movabs rdx, 0x606050804060103
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x9010a0a0a0b0904
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4fb9a3
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
movzx r9d, byte [rsp + rdi + 0x2c]
mov byte [rsp + rdi + 0x2c], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jl 0x4fb96b
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004419a0
add rsp, 0x38
pop rbp
nop
ret
call fcn.004506a0
jmp fcn.004fb920

Function at 0x4fc220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc2bd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc45f73fc76656493
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xae9d
movabs rdx, 0x808070009040409
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x9000406
xor eax, eax
jmp 0x4fc2a0
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3a]
movzx r9d, byte [rsp + rdi + 0x26]
mov byte [rsp + rdi + 0x26], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3a]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0xc
jl 0x4fc263
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.004419a0
add rsp, 0x30
pop rbp
ret
nop dword [rax]
call fcn.004506a0
jmp fcn.004fc220

Function at 0x4fe480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe59f
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x8ef10baefeb90826
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x7a72718ef10bae
mov qword [rsp + 0x50], rdx
movabs rdx, 0xbd69f5bfd206aa24
mov qword [rsp + 0x58], rdx
movabs rdx, 0xcefd47a4351fa067
mov qword [rsp + 0x60], rdx
movabs rdx, 0x72ff62e875870778
mov qword [rsp + 0x68], rdx
movabs rdx, 0x13161d020019151b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x190a13161d020019
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1040e1a0a210c0d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x21051e1607051707
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2210080121221806
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb030a16051b0f22
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1117190f20010c00
mov qword [rsp + 0x44], rdx
xor eax, eax
jmp 0x4fe582
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x4c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x44]
movzx r9d, byte [rsp + rdi + 0x4c]
mov byte [rsp + rdi + 0x4c], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x44]
mov byte [rsp + rsi + 0x4c], dl
add rax, 2
cmp rax, 0x32
jl 0x4fe54a
xor eax, eax
lea rbx, [rsp + 0x4c]
mov ecx, 0x24
call fcn.004419a0
add rsp, 0x70
pop rbp
ret
nop
call fcn.004506a0
jmp fcn.004fe480
Function at 0x4fe5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe6b2
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4d202a6174d03135
mov qword [rsp + 0x43], rdx
movabs rdx, 0xe76373bf18e15908
mov qword [rsp + 0x4b], rdx
movabs rdx, 0xea3a47fe6ee76373
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6e6165d6353b8592
mov qword [rsp + 0x58], rdx
movabs rdx, 0x13111208090a15
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x14070816180b0117
mov qword [rsp + 0x23], rdx
movabs rdx, 0x50a08141418090f
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x160c120509070807
mov qword [rsp + 0x33], rdx
movabs rdx, 0x19161418020c1918
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x4fe695
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x43]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x20]
movzx r9d, byte [rsp + rdi + 0x43]
mov byte [rsp + rdi + 0x43], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x20]
mov byte [rsp + rsi + 0x43], dl
add rax, 2
cmp rax, 0x28
jl 0x4fe65d
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.004419a0
add rsp, 0x60
pop rbp
ret
call fcn.004506a0
jmp fcn.004fe5c0

Function at 0x505a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505a90
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x108513724b0e9c12
mov qword [rsp + 0x28], rdx
movabs rdx, 0x600070106060307
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x2070105
xor eax, eax
jmp 0x505a73
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x28]
sub r8d, edx
add r8d, 0x68
movzx r9d, byte [rsp + rdi + 0x28]
mov byte [rsp + rdi + 0x28], r8b
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jl 0x505a3c
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.004419a0
add rsp, 0x30
pop rbp
ret
call fcn.004506a0
jmp fcn.00505a00

Function at 0x505c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505d25
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7736359f5b853130
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x387736359f5b8531
mov qword [rsp + 0x30], rdx
movabs rdx, 0x786665965e7f584b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0402070a0d0b0c
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa0203030b0a0b04
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa020d0703090a09
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x505d08
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
movzx r9d, byte [rsp + rdi + 0x2f]
mov byte [rsp + rdi + 0x2f], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jl 0x505cd0
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.004419a0
add rsp, 0x40
pop rbp
ret
call fcn.004506a0
jmp fcn.00505c60
Function at 0x507960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507a52
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6b6e61783aec6d8d
mov qword [rsp + 0x41], rdx
movabs rdx, 0xd5ef62206e1e6f6e
mov qword [rsp + 0x49], rdx
movabs rdx, 0x277402b8fee0e0d5
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1efd70de70fd09aa
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1d0e18051910101e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xe02040514181d0e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x12170215191a1818
mov qword [rsp + 0x29], rdx
movabs rdx, 0x51b1418020a1e05
mov qword [rsp + 0x31], rdx
movabs rdx, 0x131104020f190018
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x507a35
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
movzx r9d, byte [rsp + rdi + 0x41]
mov byte [rsp + rdi + 0x41], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
cmp rax, 0x26
jl 0x5079fd
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.004419a0
add rsp, 0x60
pop rbp
ret
call fcn.004506a0
jmp fcn.00507960

Function at 0x507b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507c21
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x571f015ca06c0d48
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x9bfcfdbe
movabs rdx, 0x606050804060103
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x9010a0a0a0b0904
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x507c03
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
movzx r9d, byte [rsp + rdi + 0x2c]
mov byte [rsp + rdi + 0x2c], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jl 0x507bcb
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004419a0
add rsp, 0x38
pop rbp
nop
ret
call fcn.004506a0
jmp fcn.00507b80
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.3.1
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000aab0
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002010
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.14001528c
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.140001fd0
jmp 0x14000126c
mov ecx, 0x2000
call fcn.14001528c
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.140001fd0
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.14000fa9c
cmp rax, rbx
jne 0x14000125e
mov rcx, rdi
call fcn.14000f810
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.140008f60
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.1400101dc
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14000f810
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000bff0
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002010
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000a790
mov rcx, r13
call fcn.140015278
mov rcx, rbp
call fcn.140015278
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x1050
call fcn.14000b230
sub rsp, rax
mov rax, qword [0x14003e018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rsi, rdx
mov r13, rcx
add rcx, 0x70
lea rdx, [0x14002b784]
mov ebp, 0xffffffff
call fcn.1400031b0
mov r14, rax
test rax, rax
jne 0x140001311
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002010
xor ebx, ebx
jmp 0x14000143a
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r13]
mov rcx, r14
call fcn.14000fdd4
test eax, eax
jns 0x14000134d
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001fd0
mov rcx, r14
call fcn.14000f74c
xor ebx, ebx
jmp 0x14000143a
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x1048], r12
call fcn.14001528c
mov r12, rax
mov rbx, rax
test rax, rax
jne 0x140001390
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140001fd0
mov rcx, r14
call fcn.14000f74c
jmp 0x140001432
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1040], r15
jne 0x140001463
mov r9, r12
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
jne 0x1400014d7
mov rcx, r14
add rsi, 0x12
call fcn.14000f74c
mov rdx, rsi
lea rcx, [r13 + 0x3070]
call fcn.1400069d0
test eax, eax
js 0x140001422
mov qword [rsp + 0x28], rsi
lea r9, [r13 + 0x3070]
lea r8, str._s_c_s
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.140001ef0
cmp eax, 0x1000
jge 0x140001422
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140003350
mov ebp, eax
mov rdi, qword [rsp + 0x1090]
mov r15, qword [rsp + 0x1040]
mov r12, qword [rsp + 0x1048]
mov rcx, rbx
call fcn.140015278
mov eax, ebp
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14000b290
add rsp, 0x1050
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [rsi + 0xc]
mov r15, r12
test rdi, rdi
je 0x1400013c3
mov eax, 0x2000
nop word [rax + rax]
cmp rdi, rax
mov rbp, rdi
mov r9, r14
mov r8d, 1
cmova rbp, rax
mov rcx, r15
mov rdx, rbp
call fcn.14000fa9c
cmp rax, 1
jb 0x1400014bb
add r15, rbp
mov eax, 0x2000
sub rdi, rbp
jne 0x140001480
mov ebp, 0xffffffff
jmp 0x1400013c3
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140001fd0
mov ebp, 0xffffffff
mov rcx, r12
call fcn.140015278
mov rcx, r14
call fcn.14000f74c
xor ebx, ebx
jmp 0x140001422
Function at 0x1400015a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
add rcx, 0x70
lea rdx, [0x14002b784]
xor r14d, r14d
call fcn.1400031b0
mov r15, rax
test rax, rax
jne 0x1400015f0
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002010
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [rbx]
mov rcx, r15
call fcn.14000fdd4
test eax, eax
jns 0x140001621
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001fd0
jmp 0x1400016ef
mov ecx, dword [rsi + 0xc]
call fcn.14001528c
mov r14, rax
test rax, rax
jne 0x140001651
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.140001fd0
jmp 0x1400016ef
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
jne 0x14000167d
mov r9, r14
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.140001050
test eax, eax
je 0x1400016e0
jmp 0x1400016d5
mov ebx, dword [rsi + 0xc]
mov rbp, r14
test rbx, rbx
je 0x1400016e0
mov r12d, 0x2000
nop
cmp rbx, r12
mov rdi, rbx
mov r9, r15
mov r8d, 1
cmova rdi, r12
mov rcx, rbp
mov rdx, rdi
call fcn.14000fa9c
cmp rax, 1
jb 0x1400016be
add rbp, rdi
sub rbx, rdi
jne 0x140001690
jmp 0x1400016e0
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.140001fd0
mov rcx, r14
call fcn.140015278
xor r14d, r14d
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rcx, r15
call fcn.14000f74c
mov rbx, qword [rsp + 0x58]
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x140001710
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp dword [rcx + 0x5074], 1
mov rdi, rdx
mov rbx, rcx
je 0x14000173e
lea rcx, str.pyi_arch_extract2fs_was_called_before_temporary_directory_was_initialized__n
call fcn.140002010
mov eax, 0xffffffff
add rsp, 0x38
pop rdi
pop rbx
ret
cmp byte [rdx + 0x11], 0x6e
jne 0x140001768
call fcn.1400012b0
mov ebx, eax
test eax, eax
jns 0x14000175f
lea rdx, [rdi + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140002010
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
add rcx, 0x3070
lea rbp, [rdx + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.140006e20
mov r12, rax
test rax, rax
jne 0x1400017b9
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.140001fd0
mov rbp, qword [rsp + 0x50]
lea eax, [r12 - 1]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
lea rcx, [rbx + 0x70]
mov qword [rsp + 0x20], r15
lea rdx, [0x14002b784]
call fcn.1400031b0
mov r15, rax
test rax, rax
jne 0x1400017ee
mov rdx, rbp
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002010
lea ebx, [r15 - 1]
jmp 0x14000192f
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [rbx]
mov rcx, r15
call fcn.14000fdd4
test eax, eax
jns 0x140001823
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.140001fd0
mov ebx, 0xffffffff
jmp 0x140001927
cmp byte [rdi + 0x10], 1
jne 0x140001841
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.140001050
mov ebx, eax
jmp 0x140001927
mov qword [rsp + 0x30], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x28], r14
mov ecx, r13d
call fcn.14001528c
mov r14, rax
test rax, rax
jne 0x140001882
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.140001fd0
lea ebx, [r14 - 1]
jmp 0x14000191d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001915
mov qword [rsp + 0x58], rsi
nop dword [rax]
nop word [rax + rax]
cmp rdi, r13
mov rsi, rdi
mov r9, r15
mov r8d, 1
cmova rsi, r13
mov rcx, r14
mov rdx, rsi
call fcn.14000fa9c
cmp rax, 1
jb 0x1400018f5
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r14
call fcn.1400101dc
cmp rax, 1
jb 0x1400018e5
sub rdi, rsi
jne 0x1400018a0
jmp 0x140001910
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
jmp 0x140001903
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov r8, rbp
call fcn.140001fd0
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r14
call fcn.140015278
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov rcx, r15
call fcn.14000f74c
mov rcx, r12
call fcn.14000f74c
mov r15, qword [rsp + 0x20]
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret