joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009ebe0
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x24], 0xca
mov rbx, rcx
jne 0x14009ea93
call fcn.14009ed20
cmp byte [rbx + 0x58], 0
je 0x14009ea8c
mov dword [rbx + 0x24], 0xcf
mov al, 1
add rsp, 0x20
pop rbx
ret
mov dword [rbx + 0x24], 0xcb
mov eax, dword [rbx + 0x24]
cmp eax, 0xcb
jne 0x14009eb25
mov rax, qword [rbx + 0x240]
cmp byte [rax + 0x20], 0
je 0x14009eb0c
nop
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14009eabe
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x240]
mov rcx, rbx
call qword [rax]
test eax, eax
je 0x14009eb04
cmp eax, 2
je 0x14009eb0c
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009eab0
dec eax
test eax, 0xfffffffd
jne 0x14009eab0
inc dword [rcx + 8]
mov rdx, qword [rbx + 0x10]
mov r8d, dword [rdx + 0xc]
cmp dword [rcx + 8], r8d
jl 0x14009eab0
mov ecx, dword [rbx + 0x190]
add ecx, r8d
mov dword [rdx + 0xc], ecx
jmp 0x14009eab0
xor al, al
add rsp, 0x20
pop rbx
ret
mov eax, dword [rbx + 0x9c]
mov rcx, rbx
mov dword [rbx + 0xa4], eax
add rsp, 0x20
pop rbx
jmp 0x14009ebe0
cmp eax, 0xcc
je 0x14009eb47
mov rax, qword [rbx]
mov dword [rax + 0x28], reloc.WS2_32.dll_setsockopt
mov rcx, qword [rbx]
mov eax, dword [rbx + 0x24]
mov dword [rcx + 0x2c], eax
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14009ebe0
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
cmp dword [rcx + 0x24], 0xcc
mov rbx, rcx
je 0x14009ec0e
mov rax, qword [rcx + 0x220]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x220]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x14009ecbd
nop dword [rax]
mov eax, dword [rbx + 0x98]
cmp eax, dword [rbx + 0x78]
jae 0x14009ec8d
nop dword [rax + rax]
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009ec5f
mov dword [rcx + 8], eax
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rax, qword [rbx + 0x10]
mov rcx, rbx
call qword [rax]
mov rax, qword [rbx + 0x228]
mov edi, dword [rbx + 0x98]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x98]
cmp eax, edi
je 0x14009ece5
cmp eax, dword [rbx + 0x78]
jb 0x14009ec40
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rbx + 0x220]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov rax, qword [rbx + 0x220]
cmp byte [rax + 0x10], bpl
jne 0x14009ec30
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x14009ecd0
Function at 0x1400a4940
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov qword [rcx + 8], rsi
call fcn.1400b2080
mov edx, 0xa0
mov rcx, rdi
mov dword [rsp + 0x38], eax
call fcn.1400b2050
mov rbx, rax
test rax, rax
jne 0x1400a4996
mov rcx, rdi
call fcn.1400b2090
mov rcx, qword [rdi]
mov dword [rcx + 0x28], gethostname
mov rcx, qword [rdi]
mov dword [rcx + 0x2c], esi
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx]
mov dword [rbx + 0x5c], 0x3b9aca00
lea rax, [fcn.1400a44e0]
lea rcx, str.JPEGMEM
mov qword [rbx], rax
lea rax, [fcn.1400a4310]
mov qword [rbx + 8], rax
lea rax, [fcn.1400a4400]
mov qword [rbx + 0x10], rax
lea rax, [fcn.1400a4220]
mov qword [rbx + 0x18], rax
lea rax, [0x1400a4d60]
mov qword [rbx + 0x20], rax
lea rax, [0x1400a4cb0]
mov qword [rbx + 0x28], rax
lea rax, [0x1400a4ad0]
mov qword [rbx + 0x30], rax
lea rax, [0x1400a3fd0]
mov qword [rbx + 0x38], rax
lea rax, [0x1400a3d70]
mov qword [rbx + 0x40], rax
lea rax, [0x1400a47f0]
mov qword [rbx + 0x48], rax
lea rax, [0x1400a4e10]
mov qword [rbx + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x58], eax
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
mov qword [rbx + 0x90], 0xa0
mov qword [rdi + 8], rbx
call qword [sym.imp.msvcrt.dll_getenv]
test rax, rax
je 0x1400a4aa0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x38]
lea rdx, str._ld_c
mov rcx, rax
mov byte [rsp + 0x30], 0x78
call qword [sym.imp.msvcrt.dll_sscanf]
test eax, eax
jle 0x1400a4aa0
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x1400a4a93
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x1400a4a97
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1400a6110
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x30
cmp dword [rcx + 0x64], 1
mov r13, qword [rcx + 0x270]
mov rdi, rcx
jne 0x1400a613c
mov ebx, 0x1fe
mov byte [r13 + 0x38], 1
jmp 0x1400a6142
xor ebx, ebx
mov byte [r13 + 0x38], bl
mov rax, qword [rcx + 8]
mov r9d, dword [rcx + 0x7c]
lea r8d, [rbx + 0x100]
mov edx, 1
call qword [rax + reloc.WS2_32.dll_recv]
mov ebp, dword [r13 + 0x28]
xor r15d, r15d
mov qword [r13 + 0x30], rax
cmp dword [rdi + 0x7c], r15d
jle 0x1400a6292
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], r12
movsxd rcx, ebx
mov qword [rsp + 0x20], r14
lea r12, [r13 + 0x3c]
mov qword [rsp + 0x68], rcx
xor r14d, r14d
nop dword [rax]
mov esi, dword [r12]
mov eax, ebp
cdq
idiv esi
mov ebp, eax
test rcx, rcx
je 0x1400a61ac
mov rax, qword [r13 + 0x30]
add qword [rax + r14], 0xff
mov rax, qword [r13 + 0x30]
lea ecx, [rsi - 1]
xor r8d, r8d
mov rdi, qword [r14 + rax]
lea eax, [rcx + 0xff]
add ecx, ecx
cdq
xor r10d, r10d
idiv ecx
xor ebx, ebx
mov r9d, eax
nop dword [rax]
cmp r10d, r9d
jle 0x1400a6207
imul eax, r8d, 0x1fe
lea ecx, [rsi + 0xfe]
lea r11d, [rsi*2 - 2]
add ecx, eax
nop dword [rax]
add ecx, 0x1fe
inc r8d
mov eax, ecx
cdq
idiv r11d
mov r9d, eax
cmp r10d, eax
jg 0x1400a61f0
movzx eax, r8b
inc rbx
inc r10d
imul bpl
mov byte [rbx + rdi - 1], al
cmp rbx, 0xff
jle 0x1400a61d0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400a6269
mov ecx, 1
lea rdx, [rdi - 1]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdi]
inc rcx
lea rdx, [rdx - 1]
mov byte [rdx + 1], al
movzx eax, byte [rdi + 0xff]
mov byte [rdi + rcx + 0xfe], al
cmp rcx, 0xff
jle 0x1400a6240
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
inc r15d
add r12, 4
add r14, 8
cmp r15d, dword [rax + 0x7c]
jl 0x1400a6190
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400c9330
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r15
sub rsp, 0x20
mov rdi, qword [rcx + 0x70]
mov r15, rdx
mov rsi, rcx
mov eax, dword [rdi + 0x18]
cmp eax, 0xc
jle 0x1400c936c
mov dword [rcx + 0x60], reloc.WS2_32.dll_WSASetLastError
xor eax, eax
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], r14
cmp dword [rdi + 0x2c], eax
jge 0x1400c9454
nop
movzx ecx, byte [rdi + 0x50]
test cl, cl
jne 0x1400c9427
mov r9, qword [rsi + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400c93ac
lea rdx, [rdi + 0x50]
mov r8d, 1
mov rcx, rsi
call rax
cdqe
jmp 0x1400c93c2
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rdi + 0x50]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x1400c94ca
movzx eax, byte [rdi + 0x50]
test al, al
je 0x1400c94bf
mov r9, qword [rsi + 0x70]
lea r14, [rdi + 0x51]
mov r10, qword [r9 + 0x40]
test r10, r10
je 0x1400c93fa
movzx r8d, al
mov rdx, r14
mov rcx, rsi
call r10
cdqe
jmp 0x1400c9410
mov r9, qword [r9 + 0x38]
movzx r8d, al
mov edx, 1
mov rcx, r14
call qword [sym.imp.msvcrt.dll_fread]
movzx ecx, byte [rdi + 0x50]
cmp rax, rcx
jne 0x1400c94ca
movzx edx, byte [r14]
mov byte [r14], 2
jmp 0x1400c9435
movzx eax, byte [rdi + 0x51]
movzx edx, byte [rax + rdi + 0x50]
inc al
mov byte [rdi + 0x51], al
dec cl
movzx eax, dl
mov byte [rdi + 0x50], cl
mov ecx, dword [rdi + 0x2c]
shl eax, cl
or dword [rdi + 0x30], eax
lea eax, [rcx + 8]
mov dword [rdi + 0x2c], eax
cmp eax, dword [rdi + 0x18]
jl 0x1400c9380
movsxd rax, dword [rdi + 0x18]
lea rcx, [0x14014b1a8]
movzx ecx, word [rcx + rax*2]
and ecx, dword [rdi + 0x30]
mov dword [r15], ecx
mov edx, dword [rdi + 0x18]
sub dword [rdi + 0x2c], edx
mov ecx, edx
shr dword [rdi + 0x30], cl
mov ecx, dword [rdi + 0x14]
cmp ecx, 0x1001
jge 0x1400c949f
mov r8d, dword [rdi + 0x1c]
inc ecx
mov dword [rdi + 0x14], ecx
cmp ecx, r8d
jle 0x1400c949f
cmp edx, 0xc
jge 0x1400c949f
lea ecx, [r8 + r8]
mov dword [rdi + 0x1c], ecx
lea ecx, [rdx + 1]
mov dword [rdi + 0x18], ecx
mov eax, 1
mov rbx, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
mov dword [rsi + 0x60], reloc.WS2_32.dll_WSASetLastError
xor eax, eax
jmp 0x1400c94a4
mov dword [rsi + 0x60], 0x66
xor eax, eax
jmp 0x1400c94a4
Function at 0x1400c97a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x70]
mov rsi, rdx
mov rbx, rcx
mov rax, qword [rdi + 0x40]
test rax, rax
je 0x1400c97d3
lea rdx, [rsp + 0x30]
mov r8d, 1
call rax
cdqe
jmp 0x1400c97ea
mov r9, qword [rdi + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x1400c9849
movzx ecx, byte [rsp + 0x30]
test cl, cl
je 0x1400c9862
lea rax, [rdi + 0x50]
mov qword [rsi], rax
mov byte [rax], cl
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400c9824
mov rdx, qword [rsi]
movzx r8d, byte [rsp + 0x30]
mov rcx, rbx
inc rdx
call rax
cdqe
jmp 0x1400c983f
mov rcx, qword [rsi]
movzx r8d, byte [rsp + 0x30]
mov r9, qword [r9 + 0x38]
inc rcx
mov edx, 1
call qword [sym.imp.msvcrt.dll_fread]
movzx ecx, byte [rsp + 0x30]
cmp rax, rcx
je 0x1400c986d
mov dword [rbx + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov qword [rsi], rax
mov byte [rdi + 0x50], al
mov dword [rdi + 0x34], eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x1400c9940
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, qword [rcx + 0x70]
mov rdi, rdx
mov rbx, rcx
mov rax, qword [rsi + 0x40]
test rax, rax
je 0x1400c9973
lea rdx, [rsp + 0x30]
mov r8d, 1
call rax
cdqe
jmp 0x1400c998a
mov r9, qword [rsi + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jne 0x1400c99e9
movzx ecx, byte [rsp + 0x30]
test cl, cl
je 0x1400c9a02
lea rax, [rsi + 0x50]
mov qword [rdi], rax
mov byte [rax], cl
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400c99c4
mov rdx, qword [rdi]
movzx r8d, byte [rsp + 0x30]
mov rcx, rbx
inc rdx
call rax
cdqe
jmp 0x1400c99df
mov rcx, qword [rdi]
movzx r8d, byte [rsp + 0x30]
mov r9, qword [r9 + 0x38]
inc rcx
mov edx, 1
call qword [sym.imp.msvcrt.dll_fread]
movzx ecx, byte [rsp + 0x30]
cmp rax, rcx
je 0x1400c9a09
mov dword [rbx + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rdi], 0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400c9f00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x70]
mov rdi, rdx
mov rbx, rcx
test byte [r9], 8
jne 0x1400c9f2e
mov dword [rcx + 0x60], reloc.WS2_32.dll_WSAGetLastError
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400c9f48
lea rdx, [rsp + 0x30]
mov r8d, 1
call rax
cdqe
jmp 0x1400c9f5f
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
je 0x1400c9f79
mov dword [rbx + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx eax, byte [rsp + 0x30]
cmp al, 0x21
je 0x1400c9fd0
cmp al, 0x2c
je 0x1400c9fba
cmp al, 0x3b
je 0x1400c9fa4
mov dword [rdi], 0
xor eax, eax
mov dword [rbx + 0x60], WSAGetLastError
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi], 4
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov dword [rdi], 2
mov eax, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x38]
mov dword [rdi], 3
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1400c9ff0
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x70]
mov rbx, rcx
test byte [rax], 8
jne 0x1400ca011
mov dword [rcx + 0x60], reloc.WS2_32.dll_WSAGetLastError
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, rcx
call fcn.1400ca200
test eax, eax
je 0x1400ca009
lea rdx, [rbx + 4]
mov rcx, rbx
call fcn.1400ca200
test eax, eax
je 0x1400ca009
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400ca04e
lea rdx, [rsp + 0x30]
mov r8d, 3
mov rcx, rbx
call rax
cdqe
jmp 0x1400ca066
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 2]
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 3
je 0x1400ca08c
mov rcx, qword [rbx + 0x18]
mov dword [rbx + 0x60], 0x66
call fcn.1400cac70
mov qword [rbx + 0x18], 0
xor eax, eax
add rsp, 0x20
pop rbx
ret
movzx edx, byte [rsp + 0x30]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov eax, edx
mov ecx, edx
movzx edi, dl
shr eax, 4
shr dil, 3
and ecx, 7
and eax, 7
and dil, 1
inc ecx
inc eax
mov dword [rbx + 8], eax
movzx eax, byte [rsp + 0x31]
mov dword [rbx + 0xc], eax
movzx eax, byte [rsp + 0x32]
mov byte [rbx + 0x10], al
test dl, dl
jns 0x1400ca1df
mov eax, 1
xor edx, edx
shl eax, cl
mov ecx, eax
call fcn.1400cadb0
mov qword [rbx + 0x18], rax
test rax, rax
jne 0x1400ca102
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov dword [rbx + 0x60], WSAGetLastError
add rsp, 0x20
pop rbx
ret
mov byte [rax + 8], dil
mov rax, qword [rbx + 0x18]
xor esi, esi
cmp dword [rax], esi
jle 0x1400ca1e7
xor edi, edi
nop word [rax + rax]
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400ca141
lea rdx, [rsp + 0x30]
mov r8d, 3
mov rcx, rbx
call rax
cdqe
jmp 0x1400ca159
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 2]
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 3
jne 0x1400ca1b5
mov rax, qword [rbx + 0x18]
inc esi
add rdi, 3
mov rcx, qword [rax + 0x10]
movzx eax, byte [rsp + 0x30]
mov byte [rdi + rcx - 3], al
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rsp + 0x31]
mov byte [rcx + rdi - 2], al
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax + 0x10]
movzx eax, byte [rsp + 0x32]
mov byte [rcx + rdi - 1], al
mov rax, qword [rbx + 0x18]
cmp esi, dword [rax]
jl 0x1400ca120
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 0x18]
call fcn.1400cac70
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 0x18], 0
mov dword [rbx + 0x60], 0x66
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 0x18], 0
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1400ca200
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov r9, qword [rcx + 0x70]
mov rdi, rdx
mov rbx, rcx
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400ca22e
lea rdx, [rsp + 0x30]
mov r8d, 2
call rax
cdqe
jmp 0x1400ca246
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 1]
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 2
je 0x1400ca260
mov dword [rbx + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
movzx edx, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
shl edx, 8
mov eax, 1
or edx, ecx
mov dword [rdi], edx
add rsp, 0x20
pop rdi
ret

Function at 0x1400ca290
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov r14, rcx
mov ecx, 0x78
mov rbx, r8
mov rbp, rdx
call qword [sym.imp.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1400ca2d4
test rbx, rbx
je 0x1400ca2c4
mov dword [rbx], WSAGetLastError
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x40], rsi
lea r8d, [rdx + 0x78]
mov qword [rsp + 0x48], r15
call fcn.14001c91b
xor r15d, r15d
mov edx, 0x6160
lea ecx, [r15 + 1]
mov qword [rdi + 0x48], r15
mov qword [rdi + 0x18], r15
call qword [sym.imp.msvcrt.dll_calloc]
mov rsi, rax
test rax, rax
jne 0x1400ca32d
test rbx, rbx
je 0x1400ca3d5
mov rcx, rdi
mov dword [rbx], WSAGetLastError
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
jmp 0x1400ca424
xor edx, edx
mov r8d, 0x6160
mov rcx, rax
call fcn.14001c91b
mov qword [rdi + 0x70], rsi
mov qword [rsi], 8
mov qword [rsi + 0x38], r15
mov qword [rsi + 0x40], rbp
mov r9, qword [rdi + 0x70]
mov qword [rdi + 0x68], r14
mov rax, qword [r9 + 0x40]
test rax, rax
je 0x1400ca375
lea rdx, [rsp + 0x58]
mov r8d, 6
mov rcx, rdi
call rax
cdqe
jmp 0x1400ca38d
mov r9, qword [r9 + 0x38]
mov edx, 1
lea rcx, [rsp + 0x58]
lea r8d, [rdx + 5]
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 6
je 0x1400ca3a0
test rbx, rbx
je 0x1400ca3cc
mov dword [rbx], 0x66
jmp 0x1400ca3cc
lea rdx, [rsp + 0x58]
lea rcx, str.GIFVER
mov r8d, 3
mov byte [rsp + 0x5e], r15b
call qword [sym.imp.msvcrt.dll_strncmp]
test eax, eax
je 0x1400ca3e2
test rbx, rbx
je 0x1400ca3cc
mov dword [rbx], 0x67
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
xor eax, eax
jmp 0x1400ca424
mov rcx, rdi
call fcn.1400c9ff0
test eax, eax
jne 0x1400ca40f
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
je 0x1400ca40b
mov dword [rbx], 0x68
xor eax, eax
jmp 0x1400ca424
mov dword [rdi + 0x60], r15d
cmp byte [rsp + 0x5b], 0x39
sete al
mov byte [rsi + 0x6158], al
mov rax, rdi
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1400ca700
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0x70]
mov rdi, rcx
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x1400ca72b
lea rdx, [rsp + 0x30]
mov r8d, 1
call rax
cdqe
jmp 0x1400ca742
mov r9, qword [rbx + 0x38]
mov edx, 1
lea rcx, [rsp + 0x30]
mov r8d, edx
call qword [sym.imp.msvcrt.dll_fread]
cmp rax, 1
jb 0x1400ca759
movzx ecx, byte [rsp + 0x30]
cmp ecx, 8
jle 0x1400ca766
mov dword [rdi + 0x60], 0x66
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov eax, 1
mov dword [rbx + 8], ecx
mov byte [rbx + 0x50], 0
shl eax, cl
mov dword [rbx + 0x20], 0x1002
mov edx, 0x100
mov dword [rbx + 0xc], eax
inc eax
mov dword [rbx + 0x10], eax
inc eax
inc ecx
mov dword [rbx + 0x14], eax
mov eax, 1
mov dword [rbx + 0x18], ecx
shl eax, cl
lea rcx, [rbx + 0x2150]
mov dword [rbx + 0x1c], eax
xor eax, eax
mov qword [rbx + 0x28], rax
mov dword [rbx + 0x30], eax
movabs rax, 0x100200001002
nop word [rax + rax]
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
lea rcx, [rcx + 0x40]
mov qword [rcx - 0x28], rax
mov qword [rcx - 0x20], rax
mov qword [rcx - 0x18], rax
mov qword [rcx - 0x10], rax
mov qword [rcx - 8], rax
dec rdx
jne 0x1400ca7c0
lea eax, [rdx + 1]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d4b70
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
test rcx, rcx
je 0x1400d4c7d
mov rdx, rcx
lea r8, [rsp + 0x50]
mov ecx, 2
call fcn.1400f12b0
test eax, eax
jne 0x1400d4c7d
lea r8, [rsp + 0x20]
lea ecx, [rax + 0x17]
mov rdx, rbx
call fcn.1400f12b0
test eax, eax
jne 0x1400d4c7d
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
xor r14d, r14d
or rdi, 0xffffffffffffffff
mov esi, r14d
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1400d4bd2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1400f11e0
test rax, rax
je 0x1400d4c17
sub rax, rbx
mov edx, 0x2e
mov rcx, rbx
mov r8, rax
call fcn.1400f11e0
mov rsi, rax
test rax, rax
je 0x1400d4c17
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rax, [rdi + rbx]
mov edi, 0x1505
mov rbp, rax
sub rbp, rbx
cmp rbx, rax
cmova rbp, r14
mov r14, qword [rsp + 0x30]
test rbp, rbp
je 0x1400d4c64
mov rsi, rbx
neg rsi
movzx ecx, byte [rbx]
call fcn.1400e2df0
lea rbx, [rbx + 1]
imul rdi, rdi, 0x21
movsx rcx, al
lea rax, [rsi + rbx]
xor rdi, rcx
cmp rax, rbp
jb 0x1400d4c44
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
movzx eax, dil
mov rdi, qword [rsp + 0x38]
add rsp, 0x40
pop rbx
ret
xor eax, eax
add rsp, 0x40
pop rbx
ret
Function at 0x1400d7c30
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.kernel32
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1400d7c5a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov rcx, rax
mov qword [rsp + 0x48], r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14014bf08]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.msvcrt.dll_strpbrk]
test rax, rax
je 0x1400d7cbe
mov rcx, rbx
test r14, r14
je 0x1400d7ca8
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1400d7cf6
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d7cf6
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x50], r15
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1400d7db9
mov qword [rsp + 0x40], rsi
or rsi, 0xffffffffffffffff
mov rdx, rsi
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1400d7d20
lea ecx, [rax + 1]
add rcx, rdx
call qword [sub.msvcrt.dll_malloc]
mov rdi, rax
test rax, rax
je 0x1400d7dab
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1400d7dab
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1400d7d50
mov ecx, 0x5c
mov word [rax + rdi], cx
cmp byte [rdi + rsi + 1], bpl
lea rsi, [rsi + 1]
jne 0x1400d7d64
lea rcx, [rsi + rdi]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx + rbx - 1], al
test al, al
jne 0x1400d7d80
mov rcx, rdi
test r14, r14
je 0x1400d7da2
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1400d7da8
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.14001c981]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
mov rax, rbp
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret