joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b670
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov ebx, edx
mov edx, 1
mov r8d, 0x400
call qword [rax]
shl ebx, 9
lea r11, [0x14018db60]
add ebx, 0xfffffe00
mov r10, rax
xor ecx, ecx
lea r9, [rax + 8]
movzx edx, byte [rcx + r11]
mov eax, 0xfe01
imul r8d, edx, 0x1fe
sub eax, r8d
cdq
idiv ebx
mov dword [r9 - 8], eax
movzx eax, byte [rcx + r11 + 1]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 4], eax
movzx eax, byte [rcx + r11 + 2]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9], eax
movzx eax, byte [rcx + r11 + 3]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 4], eax
movzx eax, byte [rcx + r11 + 4]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 8], eax
movzx eax, byte [rcx + r11 + 5]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0xc], eax
movzx eax, byte [rcx + r11 + 6]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x10], eax
movzx eax, byte [rcx + r11 + 7]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x14], eax
movzx eax, byte [rcx + r11 + 8]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x18], eax
movzx eax, byte [rcx + r11 + 9]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x1c], eax
movzx eax, byte [rcx + r11 + 0xa]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x20], eax
movzx eax, byte [rcx + r11 + 0xb]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
lea r9, [r9 + 0x40]
idiv ebx
mov dword [r9 - 0x1c], eax
movzx eax, byte [rcx + r11 + 0xc]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x18], eax
movzx eax, byte [rcx + r11 + 0xd]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x14], eax
movzx eax, byte [rcx + r11 + 0xe]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x10], eax
movzx eax, byte [rcx + r11 + 0xf]
add rcx, 0x10
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0xc], eax
cmp rcx, 0x100
jl 0x14007b6a2
mov rax, r10
add rsp, 0x20
pop rbx
ret
Function at 0x140092ee0
Capabilities:
Get socket status

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x260
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x250], rax
movsxd r9, edx
mov eax, 0x10624dd3
imul r8d
mov rbp, r9
lea r14d, [r9 + 1]
mov edi, edx
sar edi, 6
mov eax, edi
shr eax, 0x1f
add edi, eax
imul eax, edi, 0x3e8
sub r8d, eax
imul esi, r8d, 0x3e8
nop word [rax + rax]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], edi
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0x34], esi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x48], rbp
mov ecx, r14d
mov dword [rsp + 0x40], 1
call qword [sym.imp.WS2_32.dll_select]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140092fa0
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 4
jne 0x140092f9e
lea ecx, [rbx + 3]
call fcn.14012f8d4
mov rcx, rax
lea rdx, str.select_returned_EINTR_n
call fcn.14006bf80
jmp 0x140092f40
mov eax, ebx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14011c340
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140095ce0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rbp - 8], rax
mov edx, dword [rcx + 0x10b28]
lea r14, [rbp - 0x28]
mov r15d, 0x1a
mov qword [rsp + 0x78], rdi
mov esi, r15d
mov rbx, rcx
nop
test edx, edx
jg 0x140095d6a
mov rdx, qword [rbx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rbx + 0x10b50]
call fcn.140135c54
mov dword [rbx + 0x10b28], eax
mov edx, eax
test eax, eax
je 0x140095f23
js 0x140095f00
mov rcx, qword [rbx + 0x10b18]
add dword [rbx + 0x10b58], 0x2000
mov qword [rbx + 0x10b20], rcx
cmp esi, edx
mov eax, esi
mov rcx, r14
cmovae eax, edx
mov rdx, qword [rbx + 0x10b20]
mov r8d, eax
mov edi, eax
call fcn.140121290
sub dword [rbx + 0x10b28], edi
add r14, rdi
add qword [rbx + 0x10b20], rdi
mov edx, dword [rbx + 0x10b28]
sub esi, edi
jne 0x140095d20
movzx eax, byte [rbp - 0x28]
movzx ecx, byte [rbp - 0x23]
movzx edx, byte [rbp - 0x25]
movzx r8d, byte [rbp - 0x17]
shl cx, 8
mov byte [rbx + 0x10b80], al
movzx eax, byte [rbp - 0x27]
mov byte [rbx + 0x10b81], al
movzx eax, byte [rbp - 0x26]
shl r8d, 8
shl dx, 8
or dx, ax
movzx eax, byte [rbp - 0x24]
or cx, ax
mov word [rbx + 0x10b82], dx
movzx eax, byte [rbp - 0x20]
mov word [rbx + 0x10b84], cx
movzx ecx, byte [rbp - 0x1f]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x21]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x22]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1c]
mov dword [rbx + 0x10b78], ecx
movzx ecx, byte [rbp - 0x1b]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1d]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x1e]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x18]
mov dword [rbx + 0x10b7c], ecx
add r8d, eax
movzx eax, byte [rbp - 0x19]
movzx ecx, byte [rbp - 0x13]
shl ecx, 8
shl r8d, 8
add r8d, eax
movzx eax, byte [rbp - 0x1a]
shl r8d, 8
add r8d, eax
movzx eax, byte [rbp - 0x14]
add ecx, eax
mov dword [rbx + 0x10b70], r8d
movzx eax, byte [rbp - 0x15]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x16]
shl ecx, 8
add ecx, eax
movzx eax, byte [rbp - 0x12]
mov dword [rbx + 0x10b74], ecx
movzx ecx, byte [rbp - 0x11]
shl cx, 8
or cx, ax
movzx eax, byte [rbp - 0x10]
mov word [rbx + 0x10b86], cx
movzx ecx, byte [rbp - 0xf]
shl cx, 8
or cx, ax
mov word [rbx + 0x10b88], cx
test dl, 8
je 0x140095ed0
mov rcx, qword [rbx + 0xb00]
mov eax, dword [rcx + 0xc]
mov dword [rbx + 0x10b7c], eax
mov r8d, dword [rcx + 4]
mov dword [rbx + 0x10b70], r8d
mov eax, dword [rcx + 8]
mov dword [rbx + 0x10b74], eax
mov dword [rbx + 0xa0], r8d
xor eax, eax
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14011c340
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
mov eax, gethostbyname
jmp 0x140095ed9
sub r15d, esi
jne 0x140095d9f
lea eax, [r15 + 0x33]
jmp 0x140095ed9
Function at 0x140096670
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
xor ebp, ebp
mov r15, r9
mov esi, r8d
mov rdi, rdx
cmp dword [rcx + 0x68], ebp
jne 0x14009669d
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
cmp r8d, 4
jb 0x140096768
mov r8d, dword [0x1401b7f48]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
mov r12d, 0x4453
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0x60]
nop dword [rax + rax]
movzx eax, byte [rdi + 2]
movzx ebx, byte [rdi + 3]
shl ebx, 8
or ebx, eax
lea eax, [rsi - 4]
cmp ebx, eax
ja 0x140096759
movzx ecx, byte [rdi + 1]
movzx eax, byte [rdi]
shl cx, 8
or cx, ax
cmp cx, r12w
jne 0x140096741
cmp r8d, 0xffffffff
jne 0x140096726
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x14009671a
mov r8d, 1
mov dword [0x1401b7f48], r8d
jmp 0x14009672b
xor r8d, r8d
mov dword [0x1401b7f48], r8d
jmp 0x140096741
test r8d, r8d
je 0x140096741
cmp ebx, 5
jb 0x140096741
cmp byte [rdi + 8], 0
ja 0x140096741
mov qword [r15], rdi
mov ebp, 1
mov dword [r14], ebx
mov ecx, 0xfffffffc
lea edx, [rbx + 4]
sub ecx, ebx
add rdi, rdx
add esi, ecx
cmp esi, 4
jae 0x1400966d0
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x1400970b0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x290
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rdx
mov rsi, rcx
mov rcx, rbx
lea rdx, [0x1401a09ac]
mov r8d, 2
call fcn.14012e560
test eax, eax
je 0x140097107
mov r8d, 2
lea rdx, [0x1401a09b0]
mov rcx, rbx
call fcn.14012e560
test eax, eax
jne 0x140097117
movzx eax, byte [rbx + 2]
test al, al
je 0x140097117
cmp al, 0x2f
je 0x140097117
cmp al, 0x5c
jne 0x140097148
movzx ecx, byte [rbx]
call fcn.140134f80
test eax, eax
je 0x140097129
cmp byte [rbx + 1], 0x3a
je 0x140097157
lea r9, [rsp + 0x48]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x14009714f
xor eax, eax
jmp 0x140097270
lea rbx, [rsp + 0x170]
mov r8d, 2
mov qword [rsp + 0x2b0], rdi
mov rdx, rbx
mov qword [rsp + 0x48], rbx
lea rcx, [rsi + 0x10e4c]
call fcn.14012e560
test eax, eax
je 0x140097263
mov rdx, qword [rsp + 0x48]
lea rcx, [rsi + 0x10e4c]
mov r8d, 2
call fcn.1401322d0
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
mov word [rsi + 0x10e4e], 0x2f
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8d, 0x104
lea rcx, [rsi + 0x10e4c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x1400971f3
mov byte [rsi + 0x10e4c], al
jmp 0x140097268
xor ebx, ebx
lea rcx, [rsp + 0x60]
cmp dword [rsp + 0x40], 0xc
mov eax, ebx
setbe al
mov dword [rsi + 0x10e50], eax
call fcn.14013696c
mov rcx, rax
lea r8d, [rbx + 4]
lea rdx, str.VFAT
call fcn.14012e560
test eax, eax
je 0x140097258
lea r8d, [rbx + 4]
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call fcn.14012e560
test eax, eax
je 0x140097258
lea r8d, [rbx + 3]
lea rdx, [0x1401a09c4]
lea rcx, [rsp + 0x60]
call fcn.14012e560
test eax, eax
jne 0x14009725d
mov ebx, 1
mov dword [rsi + 0x10e54], ebx
mov eax, 1
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14011c340
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x290
pop rsi
ret
Function at 0x14009a130
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov ebp, r8d
test r8d, r8d
je 0x14009a200
mov ecx, dword [rcx + 0x10b28]
test ecx, ecx
jg 0x14009a1a7
mov rdx, qword [rbx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rbx + 0x10b50]
call fcn.140135c54
mov dword [rbx + 0x10b28], eax
mov ecx, eax
test eax, eax
je 0x14009a1fe
js 0x14009a1de
mov rax, qword [rbx + 0x10b18]
add dword [rbx + 0x10b58], 0x2000
mov qword [rbx + 0x10b20], rax
mov rdx, qword [rbx + 0x10b20]
cmp esi, ecx
mov eax, esi
cmovae eax, ecx
mov rcx, r14
mov r8d, eax
mov edi, eax
call fcn.140121290
sub dword [rbx + 0x10b28], edi
add r14, rdi
add qword [rbx + 0x10b20], rdi
mov ecx, dword [rbx + 0x10b28]
sub esi, edi
jne 0x14009a165
jmp 0x14009a200
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
xor eax, eax
jmp 0x14009a202
sub ebp, esi
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x14009a220
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10c00], 0
mov rbx, rcx
jne 0x14009a24e
mov eax, dword [rcx + 0xa0]
test eax, eax
jg 0x14009a259
dec eax
xor r9d, r9d
mov dword [rcx + 0xa0], eax
mov dword [rcx + 0x10b28], r9d
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov r9d, dword [rcx + 0x10b28]
test r9d, r9d
jg 0x14009a30f
mov rdx, qword [rcx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rcx + 0x10b50]
call fcn.140135c54
mov dword [rbx + 0x10b28], eax
mov ecx, eax
test eax, eax
jne 0x14009a2a0
xor r9d, r9d
lea eax, [rcx - 1]
mov dword [rbx + 0x10b28], r9d
add rsp, 0x20
pop rbx
ret
test ecx, ecx
js 0x14009a3f4
mov r9d, dword [rbx + 0xa0]
mov edx, r9d
add dword [rbx + 0x10b58], 0x2000
mov r8, qword [rbx + 0x10b18]
mov qword [rbx + 0x10b20], r8
cmp ecx, r9d
jle 0x14009a2f3
test r9d, r9d
jns 0x14009a2da
xor r9d, r9d
mov edx, r9d
mov eax, r9d
add rax, r8
mov dword [rbx + 0x10b28], r9d
mov qword [rbx + 0x10e28], rax
sub ecx, r9d
jmp 0x14009a300
xor r9d, r9d
mov ecx, r9d
mov r9d, dword [rbx + 0x10b28]
sub edx, r9d
mov dword [rbx + 0x10e20], ecx
mov dword [rbx + 0xa0], edx
mov rax, qword [rbx + 0xb00]
mov ecx, r9d
test byte [rax + 0x18], 1
je 0x14009a3cf
mov r10, qword [rbx + 0x10b20]
test r9d, r9d
je 0x14009a3cf
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rbx + 0x10d74]
lea r10, [r10 + 1]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [r10 - 1], al
movzx eax, byte [r10 - 1]
mov edx, dword [rbx + 0x10d6c]
xor rax, rdx
mov r8, qword [rbx + 0x10b08]
movzx eax, al
shr edx, 8
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
add eax, dword [rbx + 0x10d70]
imul eax, eax, 0x8088405
mov dword [rbx + 0x10d6c], ecx
mov ecx, dword [rbx + 0x10d74]
inc eax
mov dword [rbx + 0x10d70], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
mov eax, dword [r8 + rax*4]
xor eax, ecx
mov dword [rbx + 0x10d74], eax
sub r9d, 1
jne 0x14009a340
mov ecx, dword [rbx + 0x10b28]
lea eax, [rcx - 1]
mov dword [rbx + 0x10b28], eax
mov rax, qword [rbx + 0x10b20]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0x10b20], rax
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
mov edx, 1
lea rcx, [0x1401be990]
call fcn.140121908
int3
Function at 0x14009a430
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x10b5c]
add ecx, edx
mov ebx, ecx
and ebx, 0x80001fff
jge 0x14009a459
dec ebx
or ebx, 0xffffe000
inc ebx
mov edx, ecx
sub edx, ebx
test ecx, ecx
jns 0x14009a4ab
mov r8, qword [rdi + 0x10b48]
lea r9, str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
lea rdx, str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
lea rcx, [rdi + 0xb08]
call fcn.140094280
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, 3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edx, dword [rdi + 0x10b58]
je 0x14009a507
mov ecx, dword [rdi + 0x10b50]
xor r8d, r8d
call fcn.14013670c
mov rdx, qword [rdi + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rdi + 0x10b50]
mov dword [rdi + 0x10b58], eax
call fcn.140135c54
mov dword [rdi + 0x10b28], eax
test eax, eax
jg 0x14009a4f9
mov eax, gethostbyname
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movsxd rcx, ebx
add rcx, qword [rdi + 0x10b18]
sub eax, ebx
jmp 0x14009a525
mov eax, dword [rdi + 0x10b20]
sub eax, dword [rdi + 0x10b18]
movsxd rcx, ebx
sub eax, ebx
add rcx, qword [rdi + 0x10b18]
add eax, dword [rdi + 0x10b28]
mov dword [rdi + 0x10b28], eax
xor eax, eax
mov qword [rdi + 0x10b20], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14009efa0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x14009f007
lea r11, [0x1401bfe80]
xor r8d, r8d
mov r10, r11
nop word [rax + rax]
mov eax, r8d
mov r9d, 8
nop dword [rax]
mov edx, eax
mov ecx, eax
shr edx, 1
mov eax, edx
xor eax, 0xedb88320
and cl, 1
cmove eax, edx
sub r9d, 1
jne 0x14009efd0
mov dword [r10], eax
inc r8d
add r10, 4
cmp r8d, 0x100
jl 0x14009efc0
mov dword [reloc.WS2_32.dll_accept], r9d
mov rax, r11
ret
lea rax, [0x1401bfe80]
ret
Function at 0x1400a3f00
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [0x1401be98c], 0
je 0x1400a3f36
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x50
pop rbx
ret
mov ebx, 1
mov qword [rsp + 0x60], rsi
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x1400a40b6
xchg dword [0x1401bea90], eax
mov qword [rsp + 0x68], rdi
movsxd rdi, eax
test eax, eax
je 0x1400a3f9e
mov eax, edi
mov rcx, rsi
xchg dword [0x1401bea90], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x1401be98c]
jmp 0x1400a40b1
lea rcx, [0x14020d260]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
lea rcx, [0x1401da860]
mov r8d, 0x120
call fcn.1401216a0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400a40a0
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x38], ebx
lea rdx, str.SeRestorePrivilege
mov dword [rsp + 0x44], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
xor edi, edi
test eax, eax
je 0x1400a403b
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400a403b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a403b
mov dword [0x1401be988], ebx
jmp 0x1400a4095
cmp dword [0x1401be988], edi
jne 0x1400a4095
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeSecurityPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400a4095
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400a4095
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1401be984]
test eax, eax
cmove ecx, ebx
mov dword [0x1401be984], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov dword [0x1401be98c], ebx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011c340
add rsp, 0x50
pop rbx
ret
Function at 0x1400a4de0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
test rdx, rdx
jne 0x1400a4e0e
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14009efa0
mov r9, rax
not ebx
cmp rsi, 8
jb 0x1400a4ef1
mov r10, rsi
shr r10, 3
imul rcx, r10, 0xfffffffffffffff8
add rsi, rcx
movzx ecx, byte [rdi]
mov eax, ebx
xor rcx, rax
shr ebx, 8
movzx eax, cl
movzx ecx, byte [rdi + 1]
mov edx, dword [r9 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 2]
mov r8d, dword [r9 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 3]
mov edx, dword [r9 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 4]
mov r8d, dword [r9 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 5]
mov edx, dword [r9 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 6]
mov r8d, dword [r9 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 7]
add rdi, 8
mov edx, dword [r9 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r9 + rax*4]
xor ebx, edx
sub r10, 1
jne 0x1400a4e30
test rsi, rsi
je 0x1400a4f20
nop word [rax + rax]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
mov eax, ebx
xor rcx, rax
movzx eax, cl
mov ecx, ebx
shr ecx, 8
mov ebx, dword [r9 + rax*4]
xor ebx, ecx
sub rsi, 1
jne 0x1400a4f00
mov rsi, qword [rsp + 0x38]
not ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400ac230
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401b7030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [0x1401bfe78]
lea rdx, [rsp + 0x20]
mov rbp, rcx
call fcn.1400acbb0
test eax, eax
jne 0x1400ac27e
cmp word [rsp + 0x28], 1
jg 0x1400ac29b
mov rcx, rbp
call fcn.140137a68
test eax, eax
jne 0x1400ac2f3
mov rdx, rbp
mov rcx, r14
call fcn.14013a0a4
test eax, eax
je 0x1400ac3c8
call fcn.1401389c8
cmp dword [rax], 0x12
jne 0x1400ac2f3
lea rdx, [0x1401a17c4]
mov rcx, r14
call fcn.1401319ac
mov rsi, rax
test rax, rax
jne 0x1400ac2d4
lea ecx, [rax + 2]
call fcn.14012f8d4
mov rcx, rax
lea rdx, str._replace:_cant_open__s_n
mov r8, r14
call fcn.14006bf80
lea eax, [rsi + 0xa]
jmp 0x1400ac3ca
lea rdx, [0x1401a1774]
mov rcx, rbp
call fcn.1401319ac
mov r15, rax
test rax, rax
jne 0x1400ac2fd
mov rcx, rsi
call fcn.14012fd7c
mov eax, InitCommonControls
jmp 0x1400ac3ca
mov ecx, 0x4000
call fcn.1401313c0
mov rbx, rax
test rax, rax
jne 0x1400ac317
lea ebx, [rax + 4]
jmp 0x1400ac3a8
mov qword [rsp + 0x88], rdi
nop
mov r9, rsi
mov edx, 1
mov r8d, 0x4000
mov rcx, rbx
call fcn.14013a718
mov rdi, rax
test rax, rax
je 0x1400ac37e
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbx
call fcn.14013a434
cmp rax, rdi
je 0x1400ac320
mov rcx, rbx
call fcn.140125238
mov ecx, 2
call fcn.14012f8d4
mov rcx, rax
lea rdx, str._fcopy:_write_error_n
call fcn.14006bf80
mov ebx, 0xa
jmp 0x1400ac3a0
mov rcx, rsi
call fcn.140139a98
mov rcx, rbx
test eax, eax
je 0x1400ac399
call fcn.140125238
mov ebx, reloc.WS2_32.dll_inet_addr
jmp 0x1400ac3a0
call fcn.140125238
xor ebx, ebx
mov rdi, qword [rsp + 0x88]
mov rcx, rsi
call fcn.14012fd7c
mov rcx, r15
call fcn.14012fd7c
test eax, eax
jne 0x1400ac3ed
test ebx, ebx
jne 0x1400ac3ed
mov rcx, r14
call fcn.140137a68
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14011c340
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rsi
ret
mov rcx, rbp
call fcn.140137a68
test ebx, ebx
je 0x1400ac408
mov eax, reloc.WS2_32.dll_ntohl
cmp ebx, 0xa
cmove ebx, eax
mov eax, ebx
jmp 0x1400ac3ca
mov ebx, reloc.WS2_32.dll_ntohl
mov eax, ebx
jmp 0x1400ac3ca