joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008b150
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov edi, r8d
mov rbp, rdx
mov rsi, rcx
cmp qword [rcx + 0x10], 0xffffffffffffffff
je 0x14008b2ae
test r8d, r8d
je 0x14008b31a
cmp byte [rcx + 0x30], 0
je 0x14008b321
mov rcx, qword [rcx + 0x20]
cmp byte [rcx + 0x39], 0
je 0x14008b321
mov r14, qword [rsi + 0x28]
test r14, r14
sete al
lea r15, [rcx + 0x10]
mov qword [rsp + 0x20], r15
mov byte [rsp + 0x28], al
mov rcx, r14
test r14, r14
jne 0x14008b1c7
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi + 0x28]
mov dword [rsp + 0x60], 0
test rcx, rcx
je 0x14008b1e6
mov rax, qword [rcx]
lea r9, [rsp + 0x60]
mov r8d, edi
xor edx, edx
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14008b200
mov rbx, qword [rsi + 0x20]
lea r8, [rsp + 0x60]
mov edx, edi
xor ecx, ecx
call qword [rbx + 0x2e0]
mov qword [rbx + 0x318], rax
mov rdi, rax
test rax, rax
jne 0x14008b211
lea r8, str.VSocket::ReadExact_:_WriteExact:_DSMPlugin_RestoreBuffer_Alloc_Error_n
jmp 0x14008b26b
mov eax, dword [rsp + 0x60]
mov r12d, eax
test eax, eax
jle 0x14008b2c7
mov rcx, qword [rsi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14008b251
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rdx, eax
test eax, eax
jle 0x14008b24f
add rdi, rdx
mov eax, dword [rsp + 0x60]
sub eax, edx
mov dword [rsp + 0x60], eax
jmp 0x14008b218
je 0x14008b264
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14008b27e
mov eax, dword [rsp + 0x60]
jmp 0x14008b218
lea r8, str.VSocket::ReadExact_:_zero_bytes_read1_n
mov edx, 4
lea rcx, vtable.VNCLog.0
call fcn.140018d00
jmp 0x14008b2a0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r9d, eax
lea r8, str.VSocket::ReadExact_:_socket_error_1:__d_n
mov edx, 4
lea rcx, vtable.VNCLog.0
call fcn.140018d00
nop
test r14, r14
jne 0x14008b2ae
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x60], r12d
mov rcx, qword [rsi + 0x28]
test rcx, rcx
je 0x14008b2f0
mov rax, qword [rcx]
lea r9, [rsp + 0x78]
mov r8d, r12d
mov rdx, rbp
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x14008b30c
mov rbx, qword [rsi + 0x20]
lea r8, [rsp + 0x78]
mov edx, r12d
mov rcx, rbp
call qword [rbx + 0x2e0]
mov qword [rbx + 0x318], rax
test r14, r14
jne 0x14008b31a
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xffffffff
jmp 0x14008b2b0
mov rcx, qword [rsi + 0x10]
cmp rcx, 0xffffffffffffffff
je 0x14008b34a
xor r9d, r9d
mov r8d, edi
mov rdx, rbp
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x14008b348
movsxd rcx, eax
add rbp, rcx
sub edi, eax
jmp 0x14008b35b
je 0x14008b361
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
jne 0x14008b2ae
test edi, edi
je 0x14008b31a
jmp 0x14008b321
lea r8, str.VSocket::ReadExact_:_zero_bytes_read2_n
mov edx, 4
lea rcx, vtable.VNCLog.0
call fcn.140018d00
jmp 0x14008b2ae
Function at 0x14008b380
Capabilities:
Get socket status
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor r13d, r13d
mov r15d, r8d
mov r12, rdx
mov rsi, rcx
mov ebp, r13d
mov edi, r13d
test r8d, r8d
je 0x14008b468
mov qword [rsp + 0x30], 1
mov ebx, r13d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x48], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], 1
xor edx, edx
lea ecx, [rsi + 1]
call qword [sym.imp.WS2_32.dll_select]
mov ecx, eax
inc ebx
movzx eax, byte [0x14021fa63]
test ecx, ecx
jne 0x14008b419
test al, al
jne 0x14008b419
cmp ebx, 0x258
jl 0x14008b3d0
xor al, al
jmp 0x14008b46a
cmp ebx, 0x258
jge 0x14008b415
test al, al
jne 0x14008b415
cmp ecx, 1
ja 0x14008b415
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x14008b455
mov r8d, r15d
mov edx, edi
sub r8d, edi
add rdx, r12
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_send]
mov ebp, eax
lea ecx, [rbp + 1]
cmp ecx, 1
jbe 0x14008b415
add edi, ebp
cmp edi, r15d
jb 0x14008b3c4
mov al, 1
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140147af0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x260
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140093530
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x10], rdx
push r13
push r14
sub rsp, 0x48
mov r8d, dword [0x14021bfd8]
mov r13, rdx
mov r14, rcx
cmp r8d, 0xffffffff
jne 0x14009363f
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x140093622
mov r8d, 1
mov dword [0x14021bfd8], r8d
mov qword [rsp + 0x60], rbx
mov rbx, qword [r14 + 0x10b60]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r15
test rbx, rbx
je 0x1400936a9
xor r12d, r12d
cmp dword [r14 + 0x68], r12d
je 0x1400936a9
movzx ebp, word [r14 + 0x10b88]
cmp ebp, 4
jb 0x1400936a9
mov esi, dword [rsp + 0x70]
mov r13d, 0x4453
mov r15, qword [rsp + 0x70]
nop dword [rax]
movzx eax, byte [rbx + 2]
movzx edi, byte [rbx + 3]
shl edi, 8
or edi, eax
lea eax, [rbp - 4]
cmp edi, eax
ja 0x14009369a
movzx ecx, byte [rbx + 1]
movzx eax, byte [rbx]
shl cx, 8
or cx, ax
cmp cx, r13w
jne 0x140093682
cmp r8d, 0xffffffff
jne 0x140093667
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x14009365b
mov r8d, 1
mov dword [0x14021bfd8], r8d
jmp 0x14009366c
mov dword [0x14021bfd8], 0
xor eax, eax
mov qword [r13], 0
add rsp, 0x48
pop r14
pop r13
ret
test r8d, r8d
jne 0x140093572
mov qword [r13], 0
xor eax, eax
add rsp, 0x48
pop r14
pop r13
ret
xor r8d, r8d
mov dword [0x14021bfd8], r8d
jmp 0x140093682
test r8d, r8d
je 0x140093682
cmp edi, 5
jb 0x140093682
cmp byte [rbx + 8], 0
ja 0x140093682
mov r15, rbx
mov esi, edi
mov r12d, 1
mov eax, 0xfffffffc
lea ecx, [rdi + 4]
sub eax, edi
add rbx, rcx
add ebp, eax
cmp ebp, 4
jae 0x1400935d0
mov r13, qword [rsp + 0x68]
test r12d, r12d
je 0x1400936ae
add esi, 4
jmp 0x1400936b0
mov r15, qword [rsp + 0x70]
xor esi, esi
mov r12, qword [rsp + 0x28]
lea rbx, [r14 + 0x10c5c]
mov ebp, esi
mov rax, 0xffffffffffffffff
cmp byte [rbx + rax + 1], 0
lea rax, [rax + 1]
jne 0x1400936c5
lea rcx, [rax + 0x38]
add rcx, rbp
call fcn.1401507f8
mov qword [r13], rax
mov rdi, rax
test rax, rax
jne 0x1400936ed
lea eax, [rdi + 4]
jmp 0x140093745
test esi, esi
je 0x140093700
lea rcx, [rax + 0x34]
mov r8, rbp
mov rdx, r15
call fcn.140149f10
lea rcx, [rsi + 0x34]
mov dword [rdi + 0x30], esi
add rcx, rdi
mov qword [rdi + 8], rcx
sub rcx, rbx
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140093711
mov rax, qword [r14 + 0xb00]
lea r9, [rdi + 0x20]
lea r8, [rdi + 0x18]
lea rdx, [rdi + 0x10]
mov ecx, dword [rax + 0x14]
mov dword [rdi + 0x2c], ecx
mov rcx, r14
call fcn.140093010
mov dword [rdi + 0x28], eax
xor eax, eax
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x60]
mov r15, qword [rsp + 0x20]
add rsp, 0x48
pop r14
pop r13
ret
Function at 0x140093a50
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x290
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rdx
mov rsi, rcx
mov rcx, rbx
lea rdx, [0x1401fe038]
mov r8d, 2
call fcn.14015a010
test eax, eax
je 0x140093aa7
mov r8d, 2
lea rdx, [0x1401fe074]
mov rcx, rbx
call fcn.14015a010
test eax, eax
jne 0x140093ab7
movzx eax, byte [rbx + 2]
test al, al
je 0x140093ab7
cmp al, 0x2f
je 0x140093ab7
cmp al, 0x5c
jne 0x140093ae8
movzx ecx, byte [rbx]
call fcn.140162620
test eax, eax
je 0x140093ac9
cmp byte [rbx + 1], 0x3a
je 0x140093af7
lea r9, [rsp + 0x48]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x140093aef
xor eax, eax
jmp 0x140093c10
lea rbx, [rsp + 0x170]
mov r8d, 2
mov qword [rsp + 0x2b0], rdi
mov rdx, rbx
mov qword [rsp + 0x48], rbx
lea rcx, [rsi + 0x10e4c]
call fcn.14015a010
test eax, eax
je 0x140093c03
mov rdx, qword [rsp + 0x48]
lea rcx, [rsi + 0x10e4c]
mov r8d, 2
call fcn.1401670b0
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
mov word [rsi + 0x10e4e], 0x2f
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8d, 0x104
lea rcx, [rsi + 0x10e4c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x140093b93
mov byte [rsi + 0x10e4c], al
jmp 0x140093c08
xor ebx, ebx
lea rcx, [rsp + 0x60]
cmp dword [rsp + 0x40], 0xc
mov eax, ebx
setbe al
mov dword [rsi + 0x10e50], eax
call fcn.14015b780
mov rcx, rax
lea r8d, [rbx + 4]
lea rdx, str.VFAT
call fcn.14015a010
test eax, eax
je 0x140093bf8
lea r8d, [rbx + 4]
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call fcn.14015a010
test eax, eax
je 0x140093bf8
lea r8d, [rbx + 3]
lea rdx, [0x1401fe078]
lea rcx, [rsp + 0x60]
call fcn.14015a010
test eax, eax
jne 0x140093bfd
mov ebx, 1
mov dword [rsi + 0x10e54], ebx
mov eax, 1
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140147af0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x290
pop rsi
ret
Function at 0x140096b00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov ebp, r8d
test r8d, r8d
je 0x140096bd0
mov ecx, dword [rcx + 0x10b28]
test ecx, ecx
jg 0x140096b77
mov rdx, qword [rbx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rbx + 0x10b50]
call fcn.140165450
mov dword [rbx + 0x10b28], eax
mov ecx, eax
test eax, eax
je 0x140096bce
js 0x140096bae
mov rax, qword [rbx + 0x10b18]
add dword [rbx + 0x10b58], 0x2000
mov qword [rbx + 0x10b20], rax
mov rdx, qword [rbx + 0x10b20]
cmp esi, ecx
mov eax, esi
cmovae eax, ecx
mov rcx, r14
mov r8d, eax
mov edi, eax
call fcn.140149f10
sub dword [rbx + 0x10b28], edi
add r14, rdi
add qword [rbx + 0x10b20], rdi
mov ecx, dword [rbx + 0x10b28]
sub esi, edi
jne 0x140096b35
jmp 0x140096bd0
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
xor eax, eax
jmp 0x140096bd2
sub ebp, esi
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140096bf0
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10c00], 0
mov rbx, rcx
jne 0x140096c1e
mov eax, dword [rcx + 0xa0]
test eax, eax
jg 0x140096c29
dec eax
xor r8d, r8d
mov dword [rcx + 0xa0], eax
mov dword [rcx + 0x10b28], r8d
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov r8d, dword [rcx + 0x10b28]
test r8d, r8d
jg 0x140096cdf
mov rdx, qword [rcx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rcx + 0x10b50]
call fcn.140165450
mov dword [rbx + 0x10b28], eax
mov ecx, eax
test eax, eax
jne 0x140096c70
xor r8d, r8d
lea eax, [rcx - 1]
mov dword [rbx + 0x10b28], r8d
add rsp, 0x20
pop rbx
ret
test ecx, ecx
js 0x140096dba
mov r8d, dword [rbx + 0xa0]
mov edx, r8d
add dword [rbx + 0x10b58], 0x2000
mov r9, qword [rbx + 0x10b18]
mov qword [rbx + 0x10b20], r9
cmp ecx, r8d
jle 0x140096cc3
test r8d, r8d
jns 0x140096caa
xor r8d, r8d
mov edx, r8d
mov eax, r8d
add rax, r9
mov dword [rbx + 0x10b28], r8d
mov qword [rbx + 0x10e28], rax
sub ecx, r8d
jmp 0x140096cd0
xor r8d, r8d
mov ecx, r8d
mov r8d, dword [rbx + 0x10b28]
sub edx, r8d
mov dword [rbx + 0x10e20], ecx
mov dword [rbx + 0xa0], edx
mov rax, qword [rbx + 0xb00]
mov ecx, r8d
test byte [rax + 0x18], 1
je 0x140096d95
mov r9, qword [rbx + 0x10b20]
test r8d, r8d
je 0x140096d95
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rbx + 0x10d74]
lea r9, [r9 + 1]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [r9 - 1], al
movzx eax, byte [r9 - 1]
mov ecx, dword [rbx + 0x10d6c]
xor rax, rcx
mov rdx, qword [rbx + 0x10b08]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
movzx eax, cl
add eax, dword [rbx + 0x10d70]
imul eax, eax, 0x8088405
mov dword [rbx + 0x10d6c], ecx
mov ecx, dword [rbx + 0x10d74]
inc eax
mov dword [rbx + 0x10d70], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov dword [rbx + 0x10d74], ecx
sub r8d, 1
jne 0x140096d10
mov ecx, dword [rbx + 0x10b28]
lea eax, [rcx - 1]
mov dword [rbx + 0x10b28], eax
mov rax, qword [rbx + 0x10b20]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0x10b20], rax
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
mov edx, 1
lea rcx, [0x1402294b0]
call fcn.14014a750
int3
Function at 0x140096df0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x10b5c]
add ecx, edx
mov ebx, ecx
and ebx, 0x80001fff
jge 0x140096e19
dec ebx
or ebx, 0xffffe000
inc ebx
mov edx, ecx
sub edx, ebx
test ecx, ecx
jns 0x140096e6b
mov r8, qword [rdi + 0x10b48]
lea r9, str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
lea rdx, str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
lea rcx, [rdi + 0xb08]
call fcn.1400352e0
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, 3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edx, dword [rdi + 0x10b58]
je 0x140096ec7
mov ecx, dword [rdi + 0x10b50]
xor r8d, r8d
call fcn.1401660ec
mov rdx, qword [rdi + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rdi + 0x10b50]
mov dword [rdi + 0x10b58], eax
call fcn.140165450
mov dword [rdi + 0x10b28], eax
test eax, eax
jg 0x140096eb9
mov eax, gethostbyname
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movsxd rcx, ebx
add rcx, qword [rdi + 0x10b18]
sub eax, ebx
jmp 0x140096ee5
mov eax, dword [rdi + 0x10b20]
sub eax, dword [rdi + 0x10b18]
movsxd rcx, ebx
sub eax, ebx
add rcx, qword [rdi + 0x10b18]
add eax, dword [rdi + 0x10b28]
mov dword [rdi + 0x10b28], eax
xor eax, eax
mov qword [rdi + 0x10b20], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14009b970
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x14009b9d7
lea r11, [0x14026acc0]
xor r8d, r8d
mov r10, r11
nop word [rax + rax]
mov eax, r8d
mov r9d, 8
nop dword [rax]
mov edx, eax
mov ecx, eax
shr edx, 1
mov eax, edx
xor eax, 0xedb88320
and cl, 1
cmove eax, edx
sub r9d, 1
jne 0x14009b9a0
mov dword [r10], eax
inc r8d
add r10, 4
cmp r8d, 0x100
jl 0x14009b990
mov dword [reloc.WS2_32.dll_accept], r9d
mov rax, r11
ret
lea rax, [0x14026acc0]
ret
Function at 0x1400a0930
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [0x140228bf8], 0
je 0x1400a0966
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x50
pop rbx
ret
mov ebx, 1
mov qword [rsp + 0x60], rsi
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x1400a0ae6
xchg dword [0x1402289a8], eax
mov qword [rsp + 0x68], rdi
movsxd rdi, eax
test eax, eax
je 0x1400a09ce
mov eax, edi
mov rcx, rsi
xchg dword [0x1402289a8], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x140228bf8]
jmp 0x1400a0ae1
lea rcx, [0x1402b8760]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
lea rcx, [0x140285d80]
mov r8d, pe_nt_image_headers64
call fcn.14014a5c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400a0ad0
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x38], ebx
lea rdx, str.SeRestorePrivilege
mov dword [rsp + 0x44], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
xor edi, edi
test eax, eax
je 0x1400a0a6b
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400a0a6b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a0a6b
mov dword [0x140228798], ebx
jmp 0x1400a0ac5
cmp dword [0x140228798], edi
jne 0x1400a0ac5
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeSecurityPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400a0ac5
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400a0ac5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x140228688]
test eax, eax
cmove ecx, ebx
mov dword [0x140228688], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov dword [0x140228bf8], ebx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x50
pop rbx
ret
Function at 0x1400a1800
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
test rdx, rdx
jne 0x1400a182e
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14009b970
mov rdx, rax
not ebx
cmp rsi, 8
jb 0x1400a18ed
mov r8, rsi
shr r8, 3
imul rcx, r8, 0xfffffffffffffff8
add rsi, rcx
movzx ecx, byte [rdi]
mov eax, ebx
xor rcx, rax
shr ebx, 8
movzx eax, cl
movzx ecx, byte [rdi + 1]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 2]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 3]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 4]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 5]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 6]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 7]
add rdi, 8
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
xor ebx, dword [rdx + rax*4]
sub r8, 1
jne 0x1400a1850
test rsi, rsi
je 0x1400a191b
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
xor ebx, dword [rdx + rax*4]
sub rsi, 1
jne 0x1400a1900
mov rsi, qword [rsp + 0x38]
not ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a8c80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [0x14026acb8]
lea rdx, [rsp + 0x20]
mov rbp, rcx
call fcn.1400a9700
test eax, eax
jne 0x1400a8cce
cmp word [rsp + 0x28], 1
jg 0x1400a8ceb
mov rcx, rbp
call fcn.140168308
test eax, eax
jne 0x1400a8d43
mov rdx, rbp
mov rcx, r14
call fcn.14016b2a0
test eax, eax
je 0x1400a8e18
call fcn.14016927c
cmp dword [rax], 0x12
jne 0x1400a8d43
lea rdx, [0x1401f45e8]
mov rcx, r14
call fcn.14015b398
mov rsi, rax
test rax, rax
jne 0x1400a8d24
lea ecx, [rax + 2]
call fcn.14015b94c
mov rcx, rax
lea rdx, str._replace:_cant_open__s_n
mov r8, r14
call fcn.140057c10
lea eax, [rsi + 0xa]
jmp 0x1400a8e1a
lea rdx, [0x1401fee44]
mov rcx, rbp
call fcn.14015b398
mov r15, rax
test rax, rax
jne 0x1400a8d4d
mov rcx, rsi
call fcn.14015b4c4
mov eax, recvfrom
jmp 0x1400a8e1a
mov ecx, 0x4000
call fcn.1401507f8
mov rbx, rax
test rax, rax
jne 0x1400a8d67
lea ebx, [rax + 4]
jmp 0x1400a8df8
mov qword [rsp + 0x88], rdi
nop
mov r9, rsi
mov edx, 1
mov r8d, 0x4000
mov rcx, rbx
call fcn.14016ba3c
mov rdi, rax
test rax, rax
je 0x1400a8dce
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbx
call fcn.14016b738
cmp rax, rdi
je 0x1400a8d70
mov rcx, rbx
call fcn.14014e740
mov ecx, 2
call fcn.14015b94c
mov rcx, rax
lea rdx, str._fcopy:_write_error_n
call fcn.140057c10
mov ebx, 0xa
jmp 0x1400a8df0
mov rcx, rsi
call fcn.14016aa68
mov rcx, rbx
test eax, eax
je 0x1400a8de9
call fcn.14014e740
mov ebx, reloc.WS2_32.dll_inet_addr
jmp 0x1400a8df0
call fcn.14014e740
xor ebx, ebx
mov rdi, qword [rsp + 0x88]
mov rcx, rsi
call fcn.14015b4c4
mov rcx, r15
call fcn.14015b4c4
test eax, eax
jne 0x1400a8e3d
test ebx, ebx
jne 0x1400a8e3d
mov rcx, r14
call fcn.140168308
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140147af0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rsi
ret
mov rcx, rbp
call fcn.140168308
test ebx, ebx
je 0x1400a8e58
mov eax, recvfrom
cmp ebx, 0xa
cmove ebx, eax
mov eax, ebx
jmp 0x1400a8e1a
mov ebx, recvfrom
mov eax, ebx
jmp 0x1400a8e1a
Function at 0x1400a8e70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov esi, r8d
mov ecx, 0x4000
mov r15, rdx
call fcn.1401507f8
mov rbp, rax
test rax, rax
jne 0x1400a8eab
lea eax, [rbp + 4]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rdi
cmp esi, 0xffffffff
je 0x1400a8ed2
cmp ebx, esi
jae 0x1400a8f4f
mov eax, esi
sub eax, ebx
mov r8d, eax
cmp eax, 0x4000
jb 0x1400a8ed8
mov r8d, 0x4000
mov r9, r14
mov edx, 1
mov rcx, rbp
call fcn.14016ba3c
mov rdi, rax
test rax, rax
je 0x1400a8f34
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbp
call fcn.14016b738
cmp rax, rdi
jne 0x1400a8f0c
add ebx, edi
jmp 0x1400a8eb7
mov rcx, rbp
call fcn.14014e740
mov ecx, 2
call fcn.14015b94c
mov rcx, rax
lea rdx, str._fcopy:_write_error_n
call fcn.140057c10
mov eax, 0xa
jmp 0x1400a8f59
mov rcx, r14
call fcn.14016aa68
test eax, eax
je 0x1400a8f4f
mov rcx, rbp
call fcn.14014e740
mov eax, reloc.WS2_32.dll_inet_addr
jmp 0x1400a8f59
mov rcx, rbp
call fcn.14014e740
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret

Function at 0x1400a94d0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x14021b0e0]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
movzx ecx, byte [rcx]
call fcn.140162620
test eax, eax
je 0x1400a9500
cmp byte [rbx + 1], 0x3a
je 0x1400a9523
lea r9, [rsp + 0x50]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rbx, [rsp + 0x170]
mov r8d, 3
mov qword [rsp + 0x50], rbx
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1401670b0
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x44]
mov byte [rsp + 0x43], 0
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x48]
mov r8d, 0x104
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rsp + 0x60]
call fcn.14015b780
mov rcx, rax
lea rdx, [0x1401fe078]
mov r8d, 3
call fcn.14015a010
test eax, eax
je 0x1400a95e1
mov r8d, 4
lea rdx, str.VFAT
lea rcx, [rsp + 0x60]
call fcn.14015a010
test eax, eax
je 0x1400a95e1
mov r8d, 4
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call fcn.14015a010
test eax, eax
je 0x1400a95e1
xor eax, eax
jmp 0x1400a95e6
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140147af0
add rsp, 0x290
pop rbx
ret