joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401afe70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, qword [rcx]
mov r9d, 0x5735feb3
sub r9d, 0x1be6da55
add r9d, 0x2e1a0ac8
sub r9d, 0x37b925e1
add r9d, 0x42018981
sub r9d, 0x1539054b
sub r9d, 0x5e788b0b
mov ecx, dword [r10]
cmp ecx, r9d
jne 0x1401aff03
lea r8, [r10 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x1401afebe
mov ecx, dword [r10]
jmp 0x1401b003c
cmp ecx, 0x4e0
jb 0x1401b003c
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0x708fae11
add ebx, 0x103222a
sub ebx, 0x12b20639
xor ebx, 0x37f72734
xor ebx, 0x3a7c1eb3
xor ebx, 0x536bf366
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401aff40
lea r11, [r10 + 0xd50]
mov ebx, 0xc3d6aaf
add ebx, 0x37a976f9
xor ebx, 0x2a812254
sub ebx, 0x22b07071
sub ebx, 0xa92d607
sub ebx, 0x219625ba
sub ebx, 0x1a8e563e
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1401affb8
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
xchg rbx, r12
mov r12, qword [rsp]
xchg r12, rbx
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 3
shr ecx, 1
shr ecx, 2
shr ecx, 5
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 3
shl eax, 1
shl eax, 1
shl eax, 1
shl eax, 1
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0xf
shr eax, 2
shr eax, 1
xor eax, edx
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b0600
Capabilities:
Encode data using xor

Disassembly:
xchg r9, rbx
mov qword [rsp + 8], r9
xchg rbx, r9
nop
mov qword [rsp - 8], rdi
sub rsp, 8
sub rsp, 0x20
mov eax, dword [rcx + 0x40]
mov rdi, rdx
xchg rdi, rbx
mov rdi, rcx
xchg rbx, rdi
mov byte [rax + rcx], 3
add byte [rax + rcx], 0x55
add byte [rax + rcx], 0x1c
sub byte [rax + rcx], 0x74
add byte [rax + rcx], 0x21
xor byte [rax + rcx], 0xa1
lea r8d, [rax + 1]
cmp eax, 0x38
jae 0x1401b068d
cmp r8d, 0x38
jae 0x1401b06fe
mov ecx, r8d
mov eax, 0x381b55fa
add eax, 0x12b940b7
xor eax, 0x7e2aeaf1
xor eax, 0x4148ce38
sub eax, 0x11b79092
sub eax, 0x63ff21ae
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
jmp 0x1401b06fe
cmp r8d, 0x40
jae 0x1401b06c8
mov ecx, r8d
mov eax, 0x5d94eadb
xor eax, 0x7446fd
sub eax, 0x404e193e
add eax, 0x578855ec
sub eax, 0x1d28b516
xor eax, 0x57f233fe
sub eax, r8d
add rcx, rbx
mov r8d, eax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdx, rbx
xchg rbx, rcx
mov rbx, rcx
xchg rbx, rcx
call fcn.1401b0a50
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
xchg r11, rbx
movups xmmword [r11 + 0x10], xmm0
xchg rbx, r11
xchg rbx, rcx
movups xmmword [rcx + 0x20], xmm0
xchg rbx, rcx
xchg rbp, rax
mov qword [rbx + 0x30], rbp
xchg rbp, rax
mov edx, dword [rbx + 0x40]
xchg rcx, r13
mov r13, rbx
xchg rcx, r13
shl edx, 3
add rdx, qword [rbx + 0x48]
mov rax, rdx
mov qword [rbx + 0x48], rdx
shr rax, 8
mov byte [rbx + 0x3e], al
xchg rdx, r15
mov rax, r15
xchg rdx, r15
shr rax, 0x10
mov byte [rbx + 0x3d], al
xchg rdx, rsi
mov rax, rsi
xchg rdx, rsi
shr rax, 7
shr rax, 3
shr rax, 2
shr rax, 0xc
mov byte [rbx + 0x3c], al
mov rax, rdx
shr rax, 0x1a
shr rax, 1
shr rax, 4
shr rax, 1
mov byte [rbx + 0x3b], al
xchg r12, rax
mov r12, rdx
xchg r12, rax
shr rax, 0x27
shr rax, 1
mov byte [rbx + 0x3a], al
xchg rdx, rax
mov rdx, rax
xchg rdx, rax
mov byte [rbx + 0x3f], dl
shr rdx, 4
shr rdx, 0x15
shr rdx, 0xb
shr rdx, 0xa
shr rdx, 2
shr rdx, 4
shr rdx, 1
shr rdx, 1
shr rdx, 1
shr rdx, 1
mov byte [rbx + 0x38], dl
xchg rdx, r10
mov r10, rbx
xchg rdx, r10
shr rax, 0x1d
shr rax, 0x13
mov byte [rbx + 0x39], al
call fcn.1401b0a50
xor r8d, r8d
lea rdx, [rdi + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbx + 0x50]
lea rdx, [rdx + 1]
mov ecx, 0x1c829a34
add ecx, 0x15b493e9
sub ecx, 0x21f86365
add ecx, 0x983a2ce
xor ecx, 0x23d5c4f9
add ecx, 0x8ce7916
add ecx, 0x34205221
sub ecx, 0x7706749e
lea rdi, [rdi + 1]
sub ecx, r8d
sub r8d, 0xfffffff8
shr eax, cl
mov byte [rdi - 1], al
mov eax, dword [rbx + 0x54]
shr eax, cl
mov byte [rdx - 5], al
mov eax, dword [rbx + 0x58]
shr eax, cl
mov byte [rdx - 1], al
mov eax, dword [rbx + 0x5c]
shr eax, cl
mov byte [rdx + 3], al
mov eax, dword [rbx + 0x60]
shr eax, cl
mov byte [rdx + 7], al
cmp r8d, 0x20
jb 0x1401b07ce
xchg rbx, rdx
mov rdx, qword [rsp + 0x30]
xchg rbx, rdx
add rsp, 0x20
nop
xchg qword [rsp], rdi
add rsp, 8
nop
add rsp, 8
jmp qword [rsp - 8]
Function at 0x1401b9df0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rbx, r14
mov r14, rcx
xchg r14, rbx
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b9426
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b940b
xchg rbp, r8
mov rbp, qword [rcx - 8]
xchg r8, rbp
nop
add rdx, 0x2fda7325
sub rdx, 0x2fda72fe
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b943c
xchg rdx, r8
mov rcx, rdx
xchg r8, rdx
call fcn.1401fc804
xor eax, eax
xchg r15, rax
mov qword [rbx + 0x18], r15
xchg r15, rax
xchg r9, rax
mov qword [rbx + 0x20], r9
xchg r9, rax
mov qword [rbx + 0x28], rax
lea rcx, [rbx + 8]
add rsp, 0x20
nop
mov rbx, qword [rsp]
add rsp, 8
jmp 0x1401b9df0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov qword [rsp + 0x10], rbx
nop
sub rsp, 8
mov qword [rsp], rsi
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rsi, rcx
mov rcx, rsi
xchg rsi, rcx
mov rax, qword [rbx + 8]
mov qword [rax], 0x1afda827
add qword [rax], 0x52f3fd90
sub qword [rax], 0xf341996
sub qword [rax], 0x2d6ee8cf
sub qword [rax], 0x2e37d39f
add qword [rax], 0x5d7041b5
sub qword [rax], 0x261e4e50
sub qword [rax], 0x3a68c318
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401b9ed8
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rdx, [rbx + 0x10]
xchg rcx, rbx
mov rbx, rsi
xchg rbx, rcx
call fcn.1401b2da0
mov edx, 0x5f43ca51
sub edx, 0x425d0f85
xor edx, 0x499d0384
add edx, 0x1994c0f5
sub edx, 0x26a96fbe
xor edx, 0x49de26de
add edx, 0x4905eb09
add edx, 0x4aeddc1
xor edx, 0x4f6df53b
xchg r8, rcx
mov r8, rbx
xchg r8, rcx
call fcn.1401fc804
xchg rcx, rdi
mov rbx, rcx
xchg rdi, rcx
test rdi, rdi
jne 0x1401b9e63
xchg rdi, r13
mov r13, qword [rsp + 0x30]
xchg rdi, r13
mov rcx, qword [rsi]
mov edx, 0x2abb6a63
xor edx, 0x6d206c7d
add edx, 0x23106ba9
xor edx, 0x3094f671
sub edx, 0x60c88c3
xor edx, 0x1410432b
xor edx, 0x34cea72c
sub edx, 0x5d252f43
xor edx, 0x17c6ebe1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
nop
xchg qword [rsp], rsi
add rsp, 8
jmp fcn.1401fc804
Function at 0x1401b9f30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
xchg rcx, rdi
mov rbx, rdi
xchg rcx, rdi
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1401b94d2
mov rdx, qword [rbx + 0x28]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
cmp rdx, 0x1000
jb 0x1401b94b7
xchg r11, r8
mov r11, qword [rcx - 8]
xchg r11, r8
nop
add rdx, 0x16c2b17f
sub rdx, 0x16c2b158
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1401b94ed
xchg r10, r8
mov rcx, r10
xchg r8, r10
call fcn.1401fc804
xor eax, eax
xchg rbp, rax
mov qword [rbx + 0x18], rbp
xchg rbp, rax
mov qword [rbx + 0x20], rax
xchg r13, rax
mov qword [rbx + 0x28], r13
xchg r13, rax
lea rcx, [rbx + 8]
add rsp, 0x20
push rcx
push rcx
push rcx
push rax
push rdx
xchg qword [rsp + 0x28], rbx
add rsp, 0x30
jmp 0x1401b9f30
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
xchg rbx, rdx
mov qword [rsp + 0x10], rdx
xchg rdx, rbx
push rsi
sub rsp, 0x20
mov rbx, qword [rcx]
xchg rcx, rsi
mov rcx, rsi
xchg rcx, rsi
xchg r8, rax
mov r8, qword [rbx + 8]
xchg r8, rax
mov qword [rax], 0x4ad71507
xor qword [rax], 0x4d89570a
xor qword [rax], 0x40182c80
sub qword [rax], 0x12389a0
add qword [rax], 0x24b51891
add qword [rax], 0xab3492c
xor qword [rax], 0x3fd8be2b
sub qword [rax], 0x2e6f3ba0
sub qword [rax], 0x1be4bce1
mov rbx, qword [rbx]
test rbx, rbx
je 0x1401ba012
mov qword [rsp + 0x30], rdi
nop dword [rax + rax]
mov rdi, qword [rbx]
lea rcx, [rbx + 0x10]
call fcn.1401ba070
mov edx, 0x5a4dd790
sub edx, 0x39f8fb7c
add edx, 0x2c98dfce
add edx, 0xe54a5
xor edx, 0x5c130038
xor edx, 0x31b42320
xor edx, 0x4dedfe74
xor edx, 0x6cb6cdab
xchg rbx, rcx
mov rbx, rcx
xchg rcx, rbx
call fcn.1401fc804
xchg r11, rbx
mov r11, rdi
xchg r11, rbx
test rdi, rdi
jne 0x1401b9fac
xchg r8, rdi
mov r8, qword [rsp + 0x30]
xchg rdi, r8
xchg rcx, rdi
mov rdi, qword [rsi]
xchg rcx, rdi
mov edx, 0x2d9d9182
add edx, 0x2291e694
add edx, 0x12925504
sub edx, 0x1a6846ca
add edx, 0x29c0ab0b
sub edx, 0x24887f6e
xor edx, 0x779e95b8
xor edx, 0x3a0f2415
xchg rbp, rbx
mov rbp, qword [rsp + 0x38]
xchg rbx, rbp
add rsp, 0x20
nop
add rsp, 8
mov rsi, qword [rsp - 8]
jmp fcn.1401fc804
Function at 0x1401fd1d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1401fd21a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1401fd21a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1401fd21a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1401fd21a
cmp dword [rcx + 0x84], 0xe
jbe 0x1401fd21a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1401fd21c
xor al, al
add rsp, 0x28
ret

Function at 0x14022c570
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x50
mov r12, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
test r8, r8
jne 0x14022c59d
xor al, al
jmp 0x14022c6ff
mov rax, qword [0x14024b6c0]
lea rcx, [rsp]
xor r11d, r11d
mov qword [rcx], rax
mov rax, qword [0x14024b6c8]
mov qword [rsp + 0x60], rbp
mov qword [rcx + 8], rax
mov rax, qword [0x14024b6d0]
mov rdx, r11
mov qword [rcx + 0x10], rax
mov rax, qword [0x14024b6d8]
mov qword [rcx + 0x18], rax
mov rax, qword [0x14024b6e0]
mov qword [rcx + 0x20], rax
mov rax, qword [0x14024b6e8]
mov qword [rcx + 0x28], rax
mov rax, qword [0x14024b6f0]
mov qword [rcx + 0x30], rax
mov rax, qword [0x14024b6f8]
mov qword [rcx + 0x38], rax
movzx eax, byte [0x14024b700]
mov byte [rcx + 0x40], al
mov rax, qword [r9]
mov rcx, r8
lea rbp, [r8 + rax]
test rbx, rbx
je 0x14022c6f1
add r8, 4
nop word [rax + rax]
movzx r9d, byte [rdx + rdi]
inc rdx
shl r9d, 0x10
cmp rdx, rbx
jne 0x14022c649
mov r11d, 2
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
inc rdx
shl eax, 8
or r9d, eax
cmp rdx, rbx
jne 0x14022c663
mov r11d, 1
jmp 0x14022c66d
movzx eax, byte [rdx + rdi]
or r9d, eax
inc rdx
mov r10d, r9d
and r9d, 0x3f
cmp r8, rbp
ja 0x14022c715
mov rax, r10
shr rax, 0x12
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx], al
mov rax, r10
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rsp + rax]
mov byte [rcx + 1], al
cmp r11, 1
jbe 0x14022c6b2
mov byte [rcx + 2], 0x3d
add rcx, 3
add r8, 3
jmp 0x14022c6ca
shr r10, 6
add rcx, 3
and r10d, 0x3f
add r8, 3
movzx eax, byte [rsp + r10]
mov byte [rcx - 1], al
test r11, r11
je 0x14022c6da
mov byte [rcx], 0x3d
inc rcx
inc r8
jmp 0x14022c6e8
movzx eax, byte [rsp + r9]
inc rcx
inc r8
mov byte [rcx - 1], al
cmp rdx, rbx
jb 0x14022c630
sub rcx, rsi
mov al, 1
mov qword [r12], rcx
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r12
ret
xor al, al
jmp 0x14022c6fa
Function at 0x1405e106a
Capabilities:
Execute syscall

Disassembly:
syscall
ret
mov r10, rcx
jmp 0x1402ab599
Function at 0x140001050
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x88
xor eax, eax
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov qword [rsp + 0x58], rax
lea rdx, str.1.2.13
mov qword [rsp + 0x60], rax
lea r8d, [rax + 0x58]
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rsi, r9
mov ebp, eax
call fcn.14000b4f0
mov r15d, eax
test eax, eax
je 0x1400010d3
lea rdx, [rbx + 0x12]
mov r8d, eax
lea rcx, str.Failed_to_extract__s:_inflateInit___failed_with_return_code__d__n
call fcn.140002a80
lea eax, [rbp - 1]
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ecx, 0x2000
mov qword [rsp + 0x80], r13
call fcn.140014e30
mov r13, rax
test rax, rax
jne 0x140001109
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_input_buffer__n
lea rcx, str.malloc
call fcn.1400027e0
jmp 0x14000126c
mov ecx, 0x2000
call fcn.140014e30
mov rbp, rax
test rax, rax
jne 0x140001137
lea r8, [rbx + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_output_buffer__n
lea rcx, str.malloc
call fcn.1400027e0
jmp 0x14000126c
mov qword [rsp + 0xd0], r12
mov r12d, dword [rbx + 8]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x2000
mov rbx, r12
cmp r12, rax
mov r9, rdi
mov edx, 1
mov rcx, r13
cmova rbx, rax
mov r8, rbx
call fcn.1400104e8
cmp rax, rbx
jne 0x14000125e
mov rcx, rdi
call fcn.14001025c
test eax, eax
jne 0x14000125e
sub r12, rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r13
nop word [rax + rax]
mov ebx, 0x2000
mov qword [rsp + 0x30], rbp
xor edx, edx
mov dword [rsp + 0x38], ebx
lea rcx, [rsp + 0x20]
call fcn.1400099a0
mov edi, eax
mov r15d, 0xffffffff
lea ecx, [rax + 4]
cmp ecx, 2
jbe 0x140001241
cmp eax, 2
je 0x14000123c
mov ecx, dword [rsp + 0x38]
sub rbx, rcx
test r14, r14
je 0x140001203
mov r9, r14
lea edx, [r15 + 2]
mov r8, rbx
mov rcx, rbp
call fcn.140010bf4
cmp rax, rbx
jne 0x1400011fe
mov rcx, r14
call fcn.14001025c
test eax, eax
je 0x140001219
mov edi, r15d
jmp 0x140001241
test rsi, rsi
je 0x140001219
mov r8, rbx
mov rdx, rbp
mov rcx, rsi
call fcn.14000ca50
add rsi, rbx
cmp dword [rsp + 0x38], 0
je 0x1400011a0
cmp edi, 1
je 0x140001237
test r12, r12
je 0x140001241
mov rdi, qword [rsp + 0xc0]
jmp 0x140001150
xor r15d, r15d
jmp 0x140001264
mov edi, 0xfffffffd
mov rdx, qword [rsp + 0xc8]
lea rcx, str.Failed_to_extract__s:_decompression_resulted_in_return_code__d__n
add rdx, 0x12
mov r8d, edi
call fcn.140002a80
jmp 0x140001264
mov r15d, 0xffffffff
mov r12, qword [rsp + 0xd0]
lea rcx, [rsp + 0x20]
call fcn.14000b1d0
mov rcx, r13
call fcn.140014e1c
mov rcx, rbp
call fcn.140014e1c
mov r13, qword [rsp + 0x80]
mov eax, r15d
add rsp, 0x88
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400012b0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
push r13
push r14
mov eax, 0x1050
call fcn.14000bc70
sub rsp, rax
mov rax, qword [0x14003e018]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov rsi, rdx
mov r13, rcx
add rcx, 0x70
lea rdx, [0x14002b834]
mov ebp, 0xffffffff
call fcn.140003fe0
mov r14, rax
test rax, rax
jne 0x140001311
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002a80
xor ebx, ebx
jmp 0x14000143a
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [r13]
mov rcx, r14
call fcn.140010800
test eax, eax
jns 0x14000134d
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.1400027e0
mov rcx, r14
call fcn.140010198
xor ebx, ebx
jmp 0x14000143a
mov ecx, dword [rsi + 0xc]
mov qword [rsp + 0x1048], r12
call fcn.140014e30
mov r12, rax
mov rbx, rax
test rax, rax
jne 0x140001390
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.1400027e0
mov rcx, r14
call fcn.140010198
jmp 0x140001432
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x1090], rdi
mov qword [rsp + 0x1040], r15
jne 0x140001463
mov r9, r12
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.140001050
test eax, eax
jne 0x1400014d7
mov rcx, r14
add rsi, 0x12
call fcn.140010198
mov rdx, rsi
lea rcx, [r13 + 0x3070]
call fcn.1400077d0
test eax, eax
js 0x140001422
mov qword [rsp + 0x28], rsi
lea r9, [r13 + 0x3070]
lea r8, str._s_c_s
mov dword [rsp + 0x20], 0x5c
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call fcn.140001e40
cmp eax, 0x1000
jge 0x140001422
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.140004180
mov ebp, eax
mov rdi, qword [rsp + 0x1090]
mov r15, qword [rsp + 0x1040]
mov r12, qword [rsp + 0x1048]
mov rcx, rbx
call fcn.140014e1c
mov eax, ebp
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14000bcd0
add rsp, 0x1050
pop r14
pop r13
pop rsi
pop rbp
pop rbx
ret
mov edi, dword [rsi + 0xc]
mov r15, r12
test rdi, rdi
je 0x1400013c3
mov eax, 0x2000
nop word [rax + rax]
cmp rdi, rax
mov rbp, rdi
mov r9, r14
mov r8d, 1
cmova rbp, rax
mov rcx, r15
mov rdx, rbp
call fcn.1400104e8
cmp rax, 1
jb 0x1400014bb
add r15, rbp
mov eax, 0x2000
sub rdi, rbp
jne 0x140001480
mov ebp, 0xffffffff
jmp 0x1400013c3
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.1400027e0
mov ebp, 0xffffffff
mov rcx, r12
call fcn.140014e1c
mov rcx, r14
call fcn.140010198
xor ebx, ebx
jmp 0x140001422
Function at 0x1400015a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push r14
push r15
sub rsp, 0x20
mov rsi, rdx
mov rbx, rcx
add rcx, 0x70
lea rdx, [0x14002b834]
xor r14d, r14d
call fcn.140003fe0
mov r15, rax
test rax, rax
jne 0x1400015f0
lea rdx, [rsi + 0x12]
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002a80
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov edx, dword [rsi + 4]
xor r8d, r8d
add rdx, qword [rbx]
mov rcx, r15
call fcn.140010800
test eax, eax
jns 0x140001621
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.1400027e0
jmp 0x1400016ef
mov ecx, dword [rsi + 0xc]
call fcn.140014e30
mov r14, rax
test rax, rax
jne 0x140001651
mov r9d, dword [rsi + 0xc]
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_data_buffer___u_bytes___n
lea rcx, str.malloc
call fcn.1400027e0
jmp 0x1400016ef
cmp byte [rsi + 0x10], 1
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
jne 0x14000167d
mov r9, r14
xor r8d, r8d
mov rdx, rsi
mov rcx, r15
call fcn.140001050
test eax, eax
je 0x1400016e0
jmp 0x1400016d5
mov ebx, dword [rsi + 0xc]
mov rbp, r14
test rbx, rbx
je 0x1400016e0
mov r12d, 0x2000
nop
cmp rbx, r12
mov rdi, rbx
mov r9, r15
mov r8d, 1
cmova rdi, r12
mov rcx, rbp
mov rdx, rdi
call fcn.1400104e8
cmp rax, 1
jb 0x1400016be
add rbp, rdi
sub rbx, rdi
jne 0x140001690
jmp 0x1400016e0
lea r8, [rsi + 0x12]
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
call fcn.1400027e0
mov rcx, r14
call fcn.140014e1c
xor r14d, r14d
mov rdi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rcx, r15
call fcn.140010198
mov rbx, qword [rsp + 0x58]
mov rax, r14
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x140001710
Capabilities:
Read file on windows

Disassembly:
push rbx
push rdi
sub rsp, 0x38
cmp dword [rcx + 0x5070], 1
mov rdi, rdx
mov rbx, rcx
je 0x14000173e
lea rcx, str.pyi_arch_extract2fs_was_called_before_temporary_directory_was_initialized__n
call fcn.140002a80
mov eax, 0xffffffff
add rsp, 0x38
pop rdi
pop rbx
ret
cmp byte [rdx + 0x11], 0x6e
jne 0x140001768
call fcn.1400012b0
mov ebx, eax
test eax, eax
jns 0x14000175f
lea rdx, [rdi + 0x12]
lea rcx, str.Failed_to_create_symbolic_link__s__n
call fcn.140002a80
mov eax, ebx
add rsp, 0x38
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
add rcx, 0x3070
lea rbp, [rdx + 0x12]
mov qword [rsp + 0x60], r12
mov rdx, rbp
call fcn.140007c20
mov r12, rax
test rax, rax
jne 0x1400017b9
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_open_target_file__n
lea rcx, str.fopen
call fcn.1400027e0
mov rbp, qword [rsp + 0x50]
lea eax, [r12 - 1]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret
lea rcx, [rbx + 0x70]
mov qword [rsp + 0x20], r15
lea rdx, [0x14002b834]
call fcn.140003fe0
mov r15, rax
test rax, rax
jne 0x1400017ee
mov rdx, rbp
lea rcx, str.Failed_to_extract__s:_failed_to_open_archive_file__n
call fcn.140002a80
lea ebx, [r15 - 1]
jmp 0x14000192f
mov edx, dword [rdi + 4]
xor r8d, r8d
add rdx, qword [rbx]
mov rcx, r15
call fcn.140010800
test eax, eax
jns 0x140001823
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_seek_to_the_entrys_data__n
lea rcx, str.fseek
call fcn.1400027e0
mov ebx, 0xffffffff
jmp 0x140001927
cmp byte [rdi + 0x10], 1
jne 0x140001841
xor r9d, r9d
mov r8, r12
mov rdx, rdi
mov rcx, r15
call fcn.140001050
mov ebx, eax
jmp 0x140001927
mov qword [rsp + 0x30], r13
xor ebx, ebx
mov r13d, 0x2000
mov qword [rsp + 0x28], r14
mov ecx, r13d
call fcn.140014e30
mov r14, rax
test rax, rax
jne 0x140001882
mov r8, rbp
lea rdx, str.Failed_to_extract__s:_failed_to_allocate_temporary_buffer__n
lea rcx, str.malloc
call fcn.1400027e0
lea ebx, [r14 - 1]
jmp 0x14000191d
mov edi, dword [rdi + 0xc]
test rdi, rdi
je 0x140001915
mov qword [rsp + 0x58], rsi
nop dword [rax]
nop word [rax + rax]
cmp rdi, r13
mov rsi, rdi
mov r9, r15
mov r8d, 1
cmova rsi, r13
mov rcx, r14
mov rdx, rsi
call fcn.1400104e8
cmp rax, 1
jb 0x1400018f5
mov r9, r12
mov r8d, 1
mov rdx, rsi
mov rcx, r14
call fcn.140010bf4
cmp rax, 1
jb 0x1400018e5
sub rdi, rsi
jne 0x1400018a0
jmp 0x140001910
lea rdx, str.Failed_to_extract__s:_failed_to_write_data_chunk__n
lea rcx, str.fwrite
jmp 0x140001903
lea rdx, str.Failed_to_extract__s:_failed_to_read_data_chunk__n
lea rcx, str.fread
mov r8, rbp
call fcn.1400027e0
mov ebx, 0xffffffff
mov rsi, qword [rsp + 0x58]
mov rcx, r14
call fcn.140014e1c
mov r13, qword [rsp + 0x30]
mov r14, qword [rsp + 0x28]
mov rcx, r15
call fcn.140010198
mov rcx, r12
call fcn.140010198
mov r15, qword [rsp + 0x20]
mov eax, ebx
mov rbp, qword [rsp + 0x50]
mov r12, qword [rsp + 0x60]
add rsp, 0x38
pop rdi
pop rbx
ret