joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140024cb0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x20], rcx
mov rsi, r8
mov dword [rsp + 0x28], edx
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x28]
call fcn.140024b70
movsxd rdi, dword [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov rdx, qword [rsp + 0x20]
mov r8, rdi
call fcn.140145200
lea ecx, [rdi + 1]
mov byte [rsp + rdi + 0x30], 1
mov eax, 0x88
xor edx, edx
sub eax, ecx
movsxd r8, eax
movsxd rax, ecx
lea rcx, [rsp + 0x30]
add rcx, rax
call fcn.140145ba0
or byte [rsp + 0xb7], 0x80
lea rcx, [rsp + 0xb0]
lea rax, [rsi + 0x80]
cmp rsi, rcx
ja 0x140024d4f
xor edx, edx
lea rcx, [rsp + 0x30]
cmp rax, rcx
jae 0x140024dce
lea rcx, [rsp + 0x30]
mov r8d, 2
sub rcx, rsi
lea rdx, [rsp + 0x40]
sub rdx, rsi
lea rax, [rsi + 0x20]
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rcx + rax - 0x20]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x60], xmm1
movdqu xmm0, xmmword [rax - 0x50]
movdqu xmm1, xmmword [rdx + rax - 0x60]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x40]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
sub r8, 1
jne 0x140024d70
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x30]
mov r8d, reloc.WS2_32.dll_recvfrom
sub rcx, rsi
lea rax, [rsi + rdx*8]
sub r8, rdx
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rax + rcx]
xor qword [rax], rdx
lea rax, [rax + 8]
sub r8, 1
jne 0x140024df0
mov rcx, rsi
call fcn.1400244c0
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140140c60
add rsp, 0xd0
pop rdi
pop rsi
pop rbx
ret

Function at 0x140026c70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov r8d, dword [rcx]
lea ebx, [r8 + 1]
mov rax, qword [rcx + 8]
mov byte [rax + 1], bl
mov edx, ebx
shr edx, 8
mov rax, qword [rcx + 8]
mov byte [rax + 2], dl
movsxd rdx, dword [rcx]
mov rax, qword [rcx + 8]
mov byte [rdx + rax], 0xa
mov rdi, qword [rcx + 8]
mov eax, dword [0x140466f88]
nop
sub eax, dword [0x140466f8c]
cmp eax, 0x7fc000
jbe 0x140026cec
cmp ebx, 3
jbe 0x140026d2e
mov ecx, 2
call fcn.14014b850
mov r9, rax
lea r8d, [rbx - 3]
lea rcx, [rdi + 3]
mov edx, 1
call fcn.140150630
jmp 0x140026d2e
mov ebx, 0x400
lock xadd dword [0x140466f88], ebx
and ebx, 0x7fffff
add rbx, qword [0x140466f70]
lea rdx, [rdi + 1]
lea rcx, [rbx + 1]
call fcn.140145200
nop
lock inc dword [rsp + 0x20]
nop
movzx eax, byte [rdi]
inc al
mov byte [rbx], al
lea rcx, [0x140466f90]
call sub.KERNEL32.dll_WakeConditionVariable
nop
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140140c60
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140027490
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov r14, r8
mov rbp, rdx
mov rdi, rcx
mov rbx, r8
je 0x140027531
test r8, r8
jle 0x140027529
mov rcx, rdi
call fcn.140028ec0
test rax, rax
jle 0x140027500
mov rcx, qword [rdi + 0x40]
cmp rbx, rax
mov rsi, rbx
mov rdx, rbp
cmovge rsi, rax
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140145200
mov rax, qword [rdi + 0x58]
sub rbx, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
jmp 0x140027521
mov rax, qword [rdi]
mov rcx, rdi
movzx edx, byte [rbp]
mov rax, qword [rax + 0x18]
call qword [case.0x1400aefbc.0]
cmp eax, 0xffffffff
je 0x140027529
dec rbx
mov esi, 1
add rbp, rsi
test rbx, rbx
jg 0x1400274c2
sub r14, rbx
mov rax, r14
jmp 0x1400275a5
mov rax, qword [rcx + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x140027545
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140027547
xor ecx, ecx
movsxd rsi, ecx
test r14, r14
jle 0x14002759f
test ecx, ecx
jle 0x140027580
cmp r14, rsi
mov rcx, r9
cmovl rsi, r14
mov r8, rsi
call fcn.140145200
mov rax, qword [rdi + 0x58]
sub r14, rsi
add rbp, rsi
sub dword [rax], esi
mov rcx, qword [rdi + 0x40]
movsxd rax, esi
add qword [rcx], rax
test r14, r14
jle 0x14002759f
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14002759f
mov r8, r14
mov edx, 1
mov rcx, rbp
call fcn.140150630
sub r14, rax
sub rbx, r14
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400275c0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400275e2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x140027663
mov rdi, r14
mov rcx, rbx
call fcn.140028ee0
test rax, rax
jle 0x140027634
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140145200
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140027653
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax + 0x38]
call qword [case.0x1400aefbc.0]
cmp eax, 0xffffffff
je 0x14002765b
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400275f6
sub r14, rdi
jmp 0x140027758
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x14002767a
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14002767c
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400276b1
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140145200
mov rax, qword [rbx + 0x50]
sub rbp, rdi
add rsi, rdi
mov r8, rbp
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140027755
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r9], rax
jne 0x1400276ec
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140027730
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140150e00
sub rbp, rax
add rsi, rax
mov rdi, rbp
cmp rax, 0xfff
jne 0x14002776e
cmp rbp, rax
ja 0x140027700
mov r8, rdi
test rdi, rdi
je 0x140027755
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140150e00
mov r8, rdi
sub r8, rax
sub r14, r8
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
sub r14, rbp
jmp 0x140027758
Function at 0x140027ba0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x90
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140027bd0
xor eax, eax
jmp 0x140027d20
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140027c0a
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140027c0a
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140027d20
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xb0], rsi
je 0x140027d13
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140027c4d
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140027c5c
movsx ecx, dil
jmp 0x140027cba
lea r8, [rsp + 0x50]
mov byte [rsp + 0x60], dil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rsp + 0x61]
lea r8, [rsp + 0x88]
mov qword [rsp + 0x30], r8
lea r8, [rsp + 0x68]
mov rax, qword [rax + 0x38]
mov qword [rsp + 0x28], r8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x60]
call qword [case.0x1400aefbc.0]
test eax, eax
je 0x140027cd4
sub eax, 1
je 0x140027cd4
cmp eax, 2
jne 0x140027d13
movsx ecx, byte [rsp + 0x60]
mov rdx, qword [rbx + 0x80]
call fcn.14014b280
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140027d18
mov rsi, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
sub rsi, rax
je 0x140027d01
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x68]
mov r8, rsi
mov edx, 1
call fcn.140150630
cmp rsi, rax
jne 0x140027d13
lea rax, [rsp + 0x60]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x58], rax
mov eax, edi
jne 0x140027d18
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.140140c60
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
ret
Function at 0x140028a10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140028af0
cmp byte [rcx + 0x71], 0
je 0x140028af0
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
mov rax, qword [rax + 0x18]
call qword [case.0x1400aefbc.0]
cmp eax, 0xffffffff
je 0x140028aec
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
mov rax, qword [rax + 0x40]
call qword [case.0x1400aefbc.0]
test eax, eax
je 0x140028ab2
sub eax, 1
je 0x140028ab6
cmp eax, 2
jne 0x140028aec
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140140c60
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140028ae3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.140150630
cmp rdi, rax
jne 0x140028aec
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140028a9a
xor al, al
jmp 0x140028a9a
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140140c60
add rsp, 0x60
pop rbx
ret
Function at 0x14002a8f0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r8
mov rdi, rdx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x48], rsi
lea ecx, [rsi + 0x18]
call fcn.140140c80
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movsd xmm1, qword [rbx + 0x10]
movsd qword [rax + 0x10], xmm1
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rax
mov ecx, 1
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
and ecx, 0xfffffffe
mov dword [rsp + 0x30], ecx
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002aba0]
xor edx, edx
xor ecx, ecx
call fcn.140151410
mov qword [rdi], rax
test rax, rax
je 0x14002a9ad
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140140c60
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov dword [rbx], esi
mov ecx, 6
call fcn.140142f7c
int3
Function at 0x140057e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
lea rbp, [rcx + 0x68]
mov qword [rsp + 0x20], rbp
mov rcx, rbp
call sub.KERNEL32.dll_AcquireSRWLockShared
nop
mov edx, 0x20
mov rcx, rdi
call fcn.1400098d0
imul rax, qword [rbx + 0xe0]
mov rcx, rax
shr rcx, 0x21
xor rax, rcx
mov r11d, dword [rbx + 0x110]
mov rdx, rax
and edx, 0x1f
mov ecx, dword [rbx + 0x114]
shr rdx, cl
add edx, r11d
shr rax, 5
and rax, qword [rbx + 0x100]
mov r9, qword [rbx + 0xf0]
mov r10, qword [rbx + 0xe8]
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140057f2b
mov r8, qword [r10 + rax*8]
mov rcx, qword [r8]
cmp qword [rdi], rcx
jne 0x140057f2b
mov rcx, qword [r8 + 8]
cmp qword [rdi + 8], rcx
jne 0x140057f2b
mov rcx, qword [r8 + 0x10]
cmp qword [rdi + 0x10], rcx
jne 0x140057f2b
mov rcx, qword [r8 + 0x18]
cmp qword [rdi + 0x18], rcx
je 0x140057f8b
inc rax
add edx, r11d
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jne 0x140057f64
mov r8, qword [r10 + rax*8]
mov rcx, qword [r8]
cmp qword [rdi], rcx
jne 0x140057f64
mov rcx, qword [r8 + 8]
cmp qword [rdi + 8], rcx
jne 0x140057f64
mov rcx, qword [r8 + 0x10]
cmp qword [rdi + 0x10], rcx
jne 0x140057f64
mov rcx, qword [r8 + 0x18]
cmp qword [rdi + 0x18], rcx
je 0x140057f8b
inc rax
add edx, r11d
movzx ecx, byte [r9 + rax]
cmp edx, ecx
jbe 0x140057eff
cmp qword [rbx + 0x100], 0
jne 0x140057f81
xor eax, eax
jmp 0x140057f8b
mov rax, r9
sub rax, r10
sar rax, 3
lea rax, [r10 + rax*8]
cmp rax, r9
jne 0x140057f98
xor bl, bl
jmp 0x140057fc6
mov rax, qword [rax]
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rsi + 0x10], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rsi + 0x20], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rsi + 0x30], xmm1
movsd xmm0, qword [rax + 0x60]
movsd qword [rsi + 0x40], xmm0
mov bl, 1
mov rcx, rbp
call sub.KERNEL32.dll_ReleaseSRWLockShared
movzx eax, bl
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140079910
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r8
mov rdi, rdx
xor esi, esi
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x48], rsi
lea ecx, [rsi + 0x10]
call fcn.140140c80
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rax
mov ecx, 1
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rax
and ecx, 0xfffffffe
mov dword [rsp + 0x30], ecx
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x140079b50]
xor edx, edx
xor ecx, ecx
call fcn.140151410
mov qword [rdi], rax
test rax, rax
je 0x1400799c3
mov qword [rsp + 0x48], rsi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140140c60
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
mov dword [rbx], esi
mov ecx, 6
call fcn.140142f7c
int3
Function at 0x1400922b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, r9
mov rdi, r8
mov rsi, rdx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov qword [rsp + 0x48], rbp
lea ecx, [rbp + 0x10]
call fcn.140140c80
mov rcx, qword [rbx]
mov qword [rax], rcx
mov rcx, qword [rdi]
mov qword [rax + 8], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rax
mov ecx, 1
mov dword [rsp + 0x30], ecx
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rax
and ecx, 0xfffffffe
mov dword [rsp + 0x30], ecx
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x1400950f0]
xor edx, edx
xor ecx, ecx
call fcn.140151410
mov qword [rsi], rax
test rax, rax
je 0x140092375
mov qword [rsp + 0x48], rbp
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140140c60
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
mov dword [rbx], ebp
mov ecx, 6
call fcn.140142f7c
int3
Function at 0x1400b0d90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
mov rcx, rdi
mov edx, reloc.WS2_32.dll_recv
call fcn.1400098d0
imul rax, qword [rbx + 0x18]
mov ecx, dword [rbx + 0x4c]
mov r10, qword [rbx + 0x28]
mov r8, rax
mov r9d, dword [rbx + 0x48]
shr r8, 0x21
xor rax, r8
mov r8, rax
shr rax, 5
and rax, qword [rbx + 0x38]
and r8d, 0x1f
shr r8, cl
add r8d, r9d
movzx ecx, byte [r10 + rax]
cmp r8d, ecx
jne 0x1400b0e00
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rcx + rax*8]
mov rcx, qword [rdx]
cmp qword [rdi], rcx
jne 0x1400b0e00
mov rcx, qword [rdx + 8]
cmp qword [rdi + 8], rcx
je 0x1400b0e1e
movzx ecx, byte [r10 + rax + 1]
inc rax
add r8d, r9d
cmp r8d, ecx
jbe 0x1400b0de4
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 8]
mov qword [rdx], rcx
mov qword [rbx + 8], rdx
mov r8, qword [rbx + 0x28]
mov ecx, dword [rbx + 0x48]
add ecx, ecx
movzx edx, byte [r8 + rax + 1]
cmp edx, ecx
jb 0x1400b0e74
nop dword [rax]
mov rdx, qword [rbx + 0x28]
movzx ecx, byte [rdx + rax + 1]
sub cl, byte [rbx + 0x48]
mov byte [rdx + rax], cl
mov rcx, qword [rbx + 0x20]
lea rdx, [rcx + rax*8]
inc rax
mov rcx, qword [rdx + 8]
mov qword [rdx], rcx
mov r8, qword [rbx + 0x28]
mov ecx, dword [rbx + 0x48]
add ecx, ecx
movzx edx, byte [r8 + rax + 1]
cmp edx, ecx
jae 0x1400b0e40
mov byte [r8 + rax], 0
mov eax, 1
dec qword [rbx + 0x30]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400b1d20
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rbp + 0x340], rax
call fcn.14010bbc0
mov ebx, eax
test eax, eax
je 0x1400b1eda
cmp dword [reloc.WS2_32.dll_closesocket], 1
jl 0x1400b1f4c
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1400269f0
nop
movsxd rcx, dword [rsp + 0x20]
lea r8d, [rcx + 7]
mov edx, dword [rsp + 0x30]
cmp r8d, edx
jle 0x1400b1d91
mov eax, dword [rsp + 0x34]
add eax, 7
mov dword [rsp + 0x34], eax
jmp 0x1400b1dc6
mov rdx, rcx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.e_0_90m]
mov dword [rdx], eax
movzx eax, word [0x1401a8b6c]
mov word [rdx + 4], ax
movzx eax, byte [0x1401a8b6e]
mov byte [rdx + 6], al
mov dword [rsp + 0x20], r8d
mov ecx, r8d
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
lea r8d, [rcx + 5]
cmp r8d, edx
jle 0x1400b1dd8
add eax, 5
mov dword [rsp + 0x34], eax
jmp 0x1400b1e02
movsxd rdx, ecx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.Util]
mov dword [rdx], eax
movzx eax, byte [0x1401a43fc]
mov byte [rdx + 4], al
mov dword [rsp + 0x20], r8d
mov ecx, r8d
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
lea r8d, [rcx + 7]
cmp r8d, edx
jle 0x1400b1e14
add eax, 7
mov dword [rsp + 0x34], eax
jmp 0x1400b1e3e
movsxd rdx, ecx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.e_0_31m]
mov dword [rdx], eax
movzx eax, word [0x1401a8b64]
mov word [rdx + 4], ax
movzx eax, byte [0x1401a8b66]
mov byte [rdx + 6], al
mov dword [rsp + 0x20], r8d
mov ecx, ebx
call fcn.14010c5b8
mov r9, rax
movsxd rdx, dword [rsp + 0x20]
lea r10d, [rdx + 0x2d]
mov r8d, dword [rsp + 0x30]
cmp r10d, r8d
jle 0x1400b1e68
mov ecx, dword [rsp + 0x34]
add ecx, 0x2d
mov dword [rsp + 0x34], ecx
jmp 0x1400b1eb3
add rdx, qword [rsp + 0x28]
movups xmm0, xmmword [str.failed_to_create_conditional_variable__error]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [0x1401b2710]
movups xmmword [rdx + 0x10], xmm1
movsd xmm0, qword [0x1401b2720]
movsd qword [rdx + 0x20], xmm0
mov eax, dword [0x1401b2728]
mov dword [rdx + 0x28], eax
movzx eax, byte [0x1401b272c]
mov byte [rdx + 0x2c], al
mov dword [rsp + 0x20], r10d
mov edx, r10d
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x1400b1ec0
lea ebx, [rdx + rax]
cmp ebx, r8d
jle 0x1400b1efa
add ecx, eax
mov dword [rsp + 0x34], ecx
jmp 0x1400b1f1c
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140140c60
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rbp
ret
movsxd r8, eax
movsxd rcx, edx
add rcx, qword [rsp + 0x28]
mov rdx, r9
call fcn.140145200
mov dword [rsp + 0x20], ebx
mov edx, ebx
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
lea r9d, [rdx + 4]
cmp r9d, r8d
jle 0x1400b1f2e
add ecx, 4
mov dword [rsp + 0x34], ecx
jmp 0x1400b1f42
movsxd rcx, edx
mov rax, qword [rsp + 0x28]
mov dword [rcx + rax], 0x6d305b1b
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x20]
call fcn.140026c70
lea rcx, str.D:_ap2poolp2pool_srcutil.cpp:293
call fcn.1400b18e0
int3
Function at 0x1400b1f60
Capabilities:
Reference absolute stream path on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x350]
sub rsp, 0x450
mov rax, qword [0x1401d4770]
xor rax, rsp
mov qword [rbp + 0x340], rax
call fcn.14010bc40
mov ebx, eax
test eax, eax
je 0x1400b210a
cmp dword [reloc.WS2_32.dll_closesocket], 1
jl 0x1400b217c
mov edx, 2
lea rcx, [rsp + 0x20]
call fcn.1400269f0
nop
movsxd rcx, dword [rsp + 0x20]
lea r8d, [rcx + 7]
mov edx, dword [rsp + 0x30]
cmp r8d, edx
jle 0x1400b1fd1
mov eax, dword [rsp + 0x34]
add eax, 7
mov dword [rsp + 0x34], eax
jmp 0x1400b2006
mov rdx, rcx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.e_0_90m]
mov dword [rdx], eax
movzx eax, word [0x1401a8b6c]
mov word [rdx + 4], ax
movzx eax, byte [0x1401a8b6e]
mov byte [rdx + 6], al
mov dword [rsp + 0x20], r8d
mov ecx, r8d
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
lea r8d, [rcx + 5]
cmp r8d, edx
jle 0x1400b2018
add eax, 5
mov dword [rsp + 0x34], eax
jmp 0x1400b2042
movsxd rdx, ecx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.Util]
mov dword [rdx], eax
movzx eax, byte [0x1401a43fc]
mov byte [rdx + 4], al
mov dword [rsp + 0x20], r8d
mov ecx, r8d
mov eax, dword [rsp + 0x34]
mov edx, dword [rsp + 0x30]
lea r8d, [rcx + 7]
cmp r8d, edx
jle 0x1400b2054
add eax, 7
mov dword [rsp + 0x34], eax
jmp 0x1400b207e
movsxd rdx, ecx
add rdx, qword [rsp + 0x28]
mov eax, dword [str.e_0_31m]
mov dword [rdx], eax
movzx eax, word [0x1401a8b64]
mov word [rdx + 4], ax
movzx eax, byte [0x1401a8b66]
mov byte [rdx + 6], al
mov dword [rsp + 0x20], r8d
mov ecx, ebx
call fcn.14010c5b8
mov r9, rax
movsxd rdx, dword [rsp + 0x20]
lea r10d, [rdx + 0x1e]
mov r8d, dword [rsp + 0x30]
cmp r10d, r8d
jle 0x1400b20a8
mov ecx, dword [rsp + 0x34]
add ecx, 0x1e
mov dword [rsp + 0x34], ecx
jmp 0x1400b20e9
add rdx, qword [rsp + 0x28]
movups xmm0, xmmword [str.failed_to_create_mutex__error]
movups xmmword [rdx], xmm0
movsd xmm1, qword [0x1401b2768]
movsd qword [rdx + 0x10], xmm1
mov eax, dword [0x1401b2770]
mov dword [rdx + 0x18], eax
movzx eax, word [0x1401b2774]
mov word [rdx + 0x1c], ax
mov dword [rsp + 0x20], r10d
mov edx, r10d
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r9 + rax], 0
jne 0x1400b20f0
lea ebx, [rdx + rax]
cmp ebx, r8d
jle 0x1400b212a
add ecx, eax
mov dword [rsp + 0x34], ecx
jmp 0x1400b214c
mov rcx, qword [rbp + 0x340]
xor rcx, rsp
call fcn.140140c60
mov rbx, qword [rsp + 0x468]
add rsp, 0x450
pop rbp
ret
movsxd r8, eax
movsxd rcx, edx
add rcx, qword [rsp + 0x28]
mov rdx, r9
call fcn.140145200
mov dword [rsp + 0x20], ebx
mov edx, ebx
mov ecx, dword [rsp + 0x34]
mov r8d, dword [rsp + 0x30]
lea r9d, [rdx + 4]
cmp r9d, r8d
jle 0x1400b215e
add ecx, 4
mov dword [rsp + 0x34], ecx
jmp 0x1400b2172
movsxd rcx, edx
mov rax, qword [rsp + 0x28]
mov dword [rcx + rax], 0x6d305b1b
mov dword [rsp + 0x20], r9d
lea rcx, [rsp + 0x20]
call fcn.140026c70
lea rcx, str.D:_ap2poolp2pool_srcutil.cpp:302
call fcn.1400b18e0
int3