joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140094a90
Capabilities:
Check os version

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
xor ebp, ebp
mov r15, r9
mov esi, r8d
mov rdi, rdx
cmp dword [rcx + 0x68], ebp
jne 0x140094abd
xor eax, eax
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
cmp r8d, 4
jb 0x140094b88
mov r8d, dword [0x1402b84f8]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
mov r12d, 0x4453
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0x60]
nop dword [rax + rax]
movzx eax, byte [rdi + 2]
movzx ebx, byte [rdi + 3]
shl ebx, 8
or ebx, eax
lea eax, [rsi - 4]
cmp ebx, eax
ja 0x140094b79
movzx ecx, byte [rdi + 1]
movzx eax, byte [rdi]
shl cx, 8
or cx, ax
cmp cx, r12w
jne 0x140094b61
cmp r8d, 0xffffffff
jne 0x140094b46
call qword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x140094b3a
mov r8d, 1
mov dword [0x1402b84f8], r8d
jmp 0x140094b4b
xor r8d, r8d
mov dword [0x1402b84f8], r8d
jmp 0x140094b61
test r8d, r8d
je 0x140094b61
cmp ebx, 5
jb 0x140094b61
cmp byte [rdi + 8], 0
ja 0x140094b61
mov qword [r15], rdi
mov ebp, 1
mov dword [r14], ebx
mov ecx, 0xfffffffc
lea edx, [rbx + 4]
sub ecx, ebx
add rdi, rdx
add esi, ecx
cmp esi, 4
jae 0x140094af0
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x1400954d0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x290
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rdx
mov rsi, rcx
mov rcx, rbx
lea rdx, [0x14019c91c]
mov r8d, 2
call fcn.14012b3c0
test eax, eax
je 0x140095527
mov r8d, 2
lea rdx, [0x14019c920]
mov rcx, rbx
call fcn.14012b3c0
test eax, eax
jne 0x140095537
movzx eax, byte [rbx + 2]
test al, al
je 0x140095537
cmp al, 0x2f
je 0x140095537
cmp al, 0x5c
jne 0x140095568
movzx ecx, byte [rbx]
call fcn.140131f28
test eax, eax
je 0x140095549
cmp byte [rbx + 1], 0x3a
je 0x140095577
lea r9, [rsp + 0x48]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x14009556f
xor eax, eax
jmp 0x140095690
lea rbx, [rsp + 0x170]
mov r8d, 2
mov qword [rsp + 0x2b0], rdi
mov rdx, rbx
mov qword [rsp + 0x48], rbx
lea rcx, [rsi + 0x10e4c]
call fcn.14012b3c0
test eax, eax
je 0x140095683
mov rdx, qword [rsp + 0x48]
lea rcx, [rsi + 0x10e4c]
mov r8d, 2
call fcn.140134120
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
mov word [rsi + 0x10e4e], 0x2f
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8d, 0x104
lea rcx, [rsi + 0x10e4c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x140095613
mov byte [rsi + 0x10e4c], al
jmp 0x140095688
xor ebx, ebx
lea rcx, [rsp + 0x60]
cmp dword [rsp + 0x40], 0xc
mov eax, ebx
setbe al
mov dword [rsi + 0x10e50], eax
call fcn.140133830
mov rcx, rax
lea r8d, [rbx + 4]
lea rdx, str.VFAT
call fcn.14012b3c0
test eax, eax
je 0x140095678
lea r8d, [rbx + 4]
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call fcn.14012b3c0
test eax, eax
je 0x140095678
lea r8d, [rbx + 3]
lea rdx, [0x14019c934]
lea rcx, [rsp + 0x60]
call fcn.14012b3c0
test eax, eax
jne 0x14009567d
mov ebx, 1
mov dword [rsi + 0x10e54], ebx
mov eax, 1
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14011b0c0
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x290
pop rsi
ret
Function at 0x1400985a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov ebp, r8d
test r8d, r8d
je 0x140098670
mov ecx, dword [rcx + 0x10b28]
test ecx, ecx
jg 0x140098617
mov rdx, qword [rbx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rbx + 0x10b50]
call fcn.140132b18
mov dword [rbx + 0x10b28], eax
mov ecx, eax
test eax, eax
je 0x14009866e
js 0x14009864e
mov rax, qword [rbx + 0x10b18]
add dword [rbx + 0x10b58], 0x2000
mov qword [rbx + 0x10b20], rax
mov rdx, qword [rbx + 0x10b20]
cmp esi, ecx
mov eax, esi
cmovae eax, ecx
mov rcx, r14
mov r8d, eax
mov edi, eax
call fcn.14011fbe0
sub dword [rbx + 0x10b28], edi
add r14, rdi
add qword [rbx + 0x10b20], rdi
mov ecx, dword [rbx + 0x10b28]
sub esi, edi
jne 0x1400985d5
jmp 0x140098670
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
xor eax, eax
jmp 0x140098672
sub ebp, esi
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140098690
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10c00], 0
mov rbx, rcx
jne 0x1400986bc
mov eax, dword [rcx + 0xa0]
test eax, eax
jg 0x1400986c7
dec eax
mov dword [rcx + 0xa0], eax
xor ecx, ecx
mov dword [rbx + 0x10b28], ecx
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov r9d, dword [rcx + 0x10b28]
test r9d, r9d
jg 0x140098760
mov rdx, qword [rcx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rcx + 0x10b50]
call fcn.140132b18
mov dword [rbx + 0x10b28], eax
mov edx, eax
test eax, eax
je 0x1400986b4
test eax, eax
js 0x140098844
add dword [rbx + 0x10b58], 0x2000
mov r8, qword [rbx + 0x10b18]
mov ecx, dword [rbx + 0xa0]
mov qword [rbx + 0x10b20], r8
cmp eax, ecx
jle 0x140098748
test ecx, ecx
jns 0x140098731
xor ecx, ecx
mov dword [rbx + 0xa0], ecx
movsxd rax, ecx
add rax, r8
mov dword [rbx + 0x10b28], ecx
mov qword [rbx + 0x10e28], rax
sub edx, ecx
jmp 0x14009874c
xor ecx, ecx
mov edx, ecx
mov dword [rbx + 0x10e20], edx
mov r9d, dword [rbx + 0x10b28]
sub dword [rbx + 0xa0], r9d
mov rax, qword [rbx + 0xb00]
mov ecx, r9d
test byte [rax + 0x18], 1
je 0x14009881f
mov r10, qword [rbx + 0x10b20]
test r9d, r9d
je 0x14009881f
nop dword [rax]
nop dword [rax + rax]
mov ecx, dword [rbx + 0x10d74]
lea r10, [r10 + 1]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [r10 - 1], al
movzx eax, byte [r10 - 1]
mov edx, dword [rbx + 0x10d6c]
xor rax, rdx
mov r8, qword [rbx + 0x10b08]
movzx eax, al
shr edx, 8
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
add eax, dword [rbx + 0x10d70]
imul eax, eax, 0x8088405
mov dword [rbx + 0x10d6c], ecx
mov ecx, dword [rbx + 0x10d74]
inc eax
mov dword [rbx + 0x10d70], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
mov eax, dword [r8 + rax*4]
xor eax, ecx
mov dword [rbx + 0x10d74], eax
sub r9d, 1
jne 0x140098790
mov ecx, dword [rbx + 0x10b28]
lea eax, [rcx - 1]
mov dword [rbx + 0x10b28], eax
mov rax, qword [rbx + 0x10b20]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0x10b20], rax
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
mov edx, 1
lea rcx, [0x1402bf790]
call fcn.140120258
int3
Function at 0x140098880
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x10b5c]
add ecx, edx
mov ebx, ecx
and ebx, 0x80001fff
jge 0x1400988a9
dec ebx
or ebx, 0xffffe000
inc ebx
mov edx, ecx
sub edx, ebx
test ecx, ecx
jns 0x1400988fb
mov r8, qword [rdi + 0x10b48]
lea r9, str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
lea rdx, str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
lea rcx, [rdi + 0xb08]
call fcn.140092700
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, 3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edx, dword [rdi + 0x10b58]
je 0x140098957
mov ecx, dword [rdi + 0x10b50]
xor r8d, r8d
call fcn.1401335d0
mov rdx, qword [rdi + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rdi + 0x10b50]
mov dword [rdi + 0x10b58], eax
call fcn.140132b18
mov dword [rdi + 0x10b28], eax
test eax, eax
jg 0x140098949
mov eax, gethostbyname
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movsxd rcx, ebx
add rcx, qword [rdi + 0x10b18]
sub eax, ebx
jmp 0x140098975
mov eax, dword [rdi + 0x10b20]
sub eax, dword [rdi + 0x10b18]
movsxd rcx, ebx
sub eax, ebx
add rcx, qword [rdi + 0x10b18]
add eax, dword [rdi + 0x10b28]
mov dword [rdi + 0x10b28], eax
xor eax, eax
mov qword [rdi + 0x10b20], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14009d440
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x14009d4a7
lea r11, [0x1402c0c90]
xor r8d, r8d
mov r10, r11
nop word [rax + rax]
mov eax, r8d
mov r9d, 8
nop dword [rax]
mov edx, eax
mov ecx, eax
shr edx, 1
mov eax, edx
xor eax, 0xedb88320
and cl, 1
cmove eax, edx
sub r9d, 1
jne 0x14009d470
mov dword [r10], eax
inc r8d
add r10, 4
cmp r8d, 0x100
jl 0x14009d460
mov dword [reloc.WS2_32.dll_accept], r9d
mov rax, r11
ret
lea rax, [0x1402c0c90]
ret
Function at 0x1400a2430
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [0x1402bf894], 0
je 0x1400a2466
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x50
pop rbx
ret
mov ebx, 1
mov qword [rsp + 0x60], rsi
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x1400a25e6
xchg dword [0x1402bf898], eax
mov qword [rsp + 0x68], rdi
movsxd rdi, eax
test eax, eax
je 0x1400a24ce
mov eax, edi
mov rcx, rsi
xchg dword [0x1402bf898], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x1402bf894]
jmp 0x1400a25e1
lea rcx, [0x14030e060]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
lea rcx, [0x1402db680]
mov r8d, 0x120
call fcn.14011fff0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400a25d0
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x38], ebx
lea rdx, str.SeRestorePrivilege
mov dword [rsp + 0x44], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
xor edi, edi
test eax, eax
je 0x1400a256b
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400a256b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400a256b
mov dword [0x1402bf890], ebx
jmp 0x1400a25c5
cmp dword [0x1402bf890], edi
jne 0x1400a25c5
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeSecurityPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400a25c5
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400a25c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1402bb588]
test eax, eax
cmove ecx, ebx
mov dword [0x1402bb588], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov dword [0x1402bf894], ebx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x50
pop rbx
ret
Function at 0x1400a3320
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
test rdx, rdx
jne 0x1400a334e
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.14009d440
mov r9, rax
not ebx
cmp rsi, 8
jb 0x1400a3431
mov r10, rsi
shr r10, 3
imul rcx, r10, 0xfffffffffffffff8
add rsi, rcx
movzx ecx, byte [rdi]
mov eax, ebx
xor rcx, rax
shr ebx, 8
movzx eax, cl
movzx ecx, byte [rdi + 1]
mov edx, dword [r9 + rax*4]
xor edx, ebx
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 2]
mov r8d, dword [r9 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 3]
mov edx, dword [r9 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 4]
mov r8d, dword [r9 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 5]
mov edx, dword [r9 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 6]
mov r8d, dword [r9 + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 7]
add rdi, 8
mov edx, dword [r9 + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ebx, dword [r9 + rax*4]
xor ebx, edx
sub r10, 1
jne 0x1400a3370
test rsi, rsi
je 0x1400a3460
nop word [rax + rax]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
mov eax, ebx
xor rcx, rax
movzx eax, cl
mov ecx, ebx
shr ecx, 8
mov ebx, dword [r9 + rax*4]
xor ebx, ecx
sub rsi, 1
jne 0x1400a3440
mov rsi, qword [rsp + 0x38]
not ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400aa7c0
Capabilities:
Move file
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [0x1402c1090]
lea rdx, [rsp + 0x20]
mov rbp, rcx
call fcn.1400ab100
test eax, eax
jne 0x1400aa80e
cmp word [rsp + 0x28], 1
jg 0x1400aa82b
mov rcx, rbp
call fcn.140134aac
test eax, eax
jne 0x1400aa883
mov rdx, rbp
mov rcx, r14
call fcn.140136c84
test eax, eax
je 0x1400aa958
call fcn.14012e518
cmp dword [rax], 0x12
jne 0x1400aa883
lea rdx, [0x14019d770]
mov rcx, r14
call fcn.14012e84c
mov rsi, rax
test rax, rax
jne 0x1400aa864
lea ecx, [rax + 2]
call fcn.14012d310
mov rcx, rax
lea rdx, str._replace:_cant_open__s_n
mov r8, r14
call fcn.1400698b0
lea eax, [rsi + 0xa]
jmp 0x1400aa95a
lea rdx, [0x14019d708]
mov rcx, rbp
call fcn.14012e84c
mov r15, rax
test rax, rax
jne 0x1400aa88d
mov rcx, rsi
call fcn.14012d7b8
mov eax, InitCommonControls
jmp 0x1400aa95a
mov ecx, 0x4000
call fcn.14012d1e8
mov rbx, rax
test rax, rax
jne 0x1400aa8a7
lea ebx, [rax + 4]
jmp 0x1400aa938
mov qword [rsp + 0x88], rdi
nop
mov r9, rsi
mov edx, 1
mov r8d, 0x4000
mov rcx, rbx
call fcn.140137328
mov rdi, rax
test rax, rax
je 0x1400aa90e
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbx
call fcn.140137014
cmp rax, rdi
je 0x1400aa8b0
mov rcx, rbx
call fcn.140122088
mov ecx, 2
call fcn.14012d310
mov rcx, rax
lea rdx, str._fcopy:_write_error_n
call fcn.1400698b0
mov ebx, 0xa
jmp 0x1400aa930
mov rcx, rsi
call fcn.140136668
mov rcx, rbx
test eax, eax
je 0x1400aa929
call fcn.140122088
mov ebx, reloc.WS2_32.dll_inet_addr
jmp 0x1400aa930
call fcn.140122088
xor ebx, ebx
mov rdi, qword [rsp + 0x88]
mov rcx, rsi
call fcn.14012d7b8
mov rcx, r15
call fcn.14012d7b8
test eax, eax
jne 0x1400aa97d
test ebx, ebx
jne 0x1400aa97d
mov rcx, r14
call fcn.140134aac
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14011b0c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rsi
ret
mov rcx, rbp
call fcn.140134aac
test ebx, ebx
je 0x1400aa998
mov eax, reloc.WS2_32.dll_ntohl
cmp ebx, 0xa
cmove ebx, eax
mov eax, ebx
jmp 0x1400aa95a
mov ebx, reloc.WS2_32.dll_ntohl
mov eax, ebx
jmp 0x1400aa95a
Function at 0x1400aa9b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov esi, r8d
mov ecx, 0x4000
mov r15, rdx
call fcn.14012d1e8
mov rbp, rax
test rax, rax
jne 0x1400aa9eb
lea eax, [rbp + 4]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rdi
cmp esi, 0xffffffff
je 0x1400aaa12
cmp ebx, esi
jae 0x1400aaa8f
mov eax, esi
sub eax, ebx
mov r8d, eax
cmp eax, 0x4000
jb 0x1400aaa18
mov r8d, 0x4000
mov r9, r14
mov edx, 1
mov rcx, rbp
call fcn.140137328
mov rdi, rax
test rax, rax
je 0x1400aaa74
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbp
call fcn.140137014
cmp rax, rdi
jne 0x1400aaa4c
add ebx, edi
jmp 0x1400aa9f7
mov rcx, rbp
call fcn.140122088
mov ecx, 2
call fcn.14012d310
mov rcx, rax
lea rdx, str._fcopy:_write_error_n
call fcn.1400698b0
mov eax, 0xa
jmp 0x1400aaa99
mov rcx, r14
call fcn.140136668
test eax, eax
je 0x1400aaa8f
mov rcx, rbp
call fcn.140122088
mov eax, reloc.WS2_32.dll_inet_addr
jmp 0x1400aaa99
mov rcx, rbp
call fcn.140122088
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret

Function at 0x1400aafd0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1401b5030]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
movzx ecx, byte [rcx]
call fcn.140131f28
test eax, eax
je 0x1400ab000
cmp byte [rbx + 1], 0x3a
je 0x1400ab023
lea r9, [rsp + 0x50]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rbx, [rsp + 0x170]
mov r8d, 3
mov qword [rsp + 0x50], rbx
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140134120
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x44]
mov byte [rsp + 0x43], 0
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x48]
mov r8d, 0x104
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rsp + 0x60]
call fcn.140133830
mov rcx, rax
lea rdx, [0x14019c934]
mov r8d, 3
call fcn.14012b3c0
test eax, eax
je 0x1400ab0e1
mov r8d, 4
lea rdx, str.VFAT
lea rcx, [rsp + 0x60]
call fcn.14012b3c0
test eax, eax
je 0x1400ab0e1
mov r8d, 4
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call fcn.14012b3c0
test eax, eax
je 0x1400ab0e1
xor eax, eax
jmp 0x1400ab0e6
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14011b0c0
add rsp, 0x290
pop rbx
ret
Function at 0x1400abcc0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x1402bf9cc]
mov rbx, rcx
mov ecx, dword [0x1402c1510]
test eax, eax
jne 0x1400abd0e
mov r8d, edx
mov rdx, rbx
call fcn.140132b18
mov edi, eax
lea ecx, [rax + 1]
test ecx, 0xfffffffe
jne 0x1400abddd
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp eax, 1
jne 0x1400abd67
shr edx, 1
mov esi, edx
mov r8d, edx
add rsi, rbx
mov rdx, rsi
call fcn.140132b18
mov edi, eax
mov ecx, eax
dec eax
cmp eax, 0xfffffffd
ja 0x1400abe06
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
mov byte [rbx], al
inc rbx
cmp al, 0xa
jne 0x1400abd5b
mov word [rbx - 1], 0xa0d
inc rbx
inc edi
add ecx, 0xffffffff
jne 0x1400abd40
mov eax, edi
sub rbx, rax
jmp 0x1400abddd
lea r8d, [rdx - 1]
mov rsi, rbx
mov rdx, rbx
call fcn.140132b18
mov edi, eax
mov ecx, eax
lea eax, [rdi - 1]
cmp eax, 0xfffffffd
ja 0x1400abe06
mov byte [rdi + rbx], 0xa
nop word [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
mov byte [rbx], al
mov rdx, rbx
inc rbx
cmp al, 0xd
jne 0x1400abdad
cmp byte [rsi], 0xa
jne 0x1400abdad
mov rbx, rdx
dec edi
add ecx, 0xffffffff
jne 0x1400abd90
test edi, edi
jne 0x1400abdce
mov ecx, dword [0x1402c1510]
mov edi, 1
mov r8d, edi
mov rdx, rbx
call fcn.140132b18
jmp 0x1400abddd
mov eax, edi
lea ecx, [rdi - 1]
sub rbx, rax
cmp byte [rcx + rbx], 0x1a
cmove edi, ecx
mov ecx, dword [0x1402c1108]
mov r8d, edi
mov rdx, rbx
call fcn.1400a3320
mov dword [0x1402c1108], eax
mov eax, dword [0x1402c1514]
add eax, edi
mov dword [0x1402c1514], eax
cmp eax, edi
jb 0x1400abe18
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, str.file_exceeds_Zips_4GB_uncompressed_size_limit
mov ecx, 6
call fcn.1400a68e0
int3
Function at 0x1400ac530
Capabilities:
Get disk information
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
cmp dword [0x1402bf9d4], 1
mov rbx, rcx
jne 0x1400ac65b
xor esi, esi
mov dword [0x1402bf9d4], 2
test rcx, rcx
je 0x1400ac573
movzx eax, byte [rcx]
cmp al, 0x80
jae 0x1400ac573
cmp byte [rcx + 1], 0x3a
jne 0x1400ac573
lea rcx, [0x14030b940]
movzx edi, byte [rax + rcx]
jmp 0x1400ac575
mov edi, esi
xor ecx, ecx
mov dword [0x1402c1524], 0x28
mov dword [0x1402c1528], 0x210000
call fcn.14012a5f8
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.14012f4a8
mov rcx, rax
mov dword [rax + 0x20], 0xffffffff
mov qword [rax], rsi
mov dword [rax + 8], esi
mov qword [rax + 0xc], 1
mov dword [rax + 0x14], 0x50
call fcn.140133ca8
mov qword [0x1402c1530], rax
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x80]
test edi, edi
mov dword [rsp + 0x78], 0x5c3a78
mov byte [rsp + 0x78], dil
lea rdi, [0x1402c10f0]
cmove rcx, rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x88]
mov rdx, rdi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0xd]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1400ac634
xor r8d, r8d
mov qword [0x1402bf8a8], rdi
mov rcx, rdi
call fcn.1400aa230
jmp 0x1400ac63b
mov qword [0x1402bf8a8], rsi
test rbx, rbx
je 0x1400ac651
cmp byte [rbx], 0x80
jae 0x1400ac65b
cmp byte [rbx + 1], 0x3a
jne 0x1400ac65b
cmp byte [rbx + 2], sil
jne 0x1400ac65b
xor eax, eax
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbx], 0x2d
jne 0x1400ac678
cmp byte [rbx + 1], 0
jne 0x1400ac678
xor r8d, r8d
mov rcx, rbx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
jmp fcn.1400aa230
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400ac680
add rcx, 2
call fcn.14012d1e8
mov rdi, rax
test rax, rax
jne 0x1400ac6a5
lea eax, [rdi + 4]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov rcx, rdi
sub rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400ac6b0
movzx eax, byte [rdi]
mov rbx, rdi
test al, al
je 0x1400ac6ef
cmp al, 0x5c
jne 0x1400ac6cf
mov byte [rbx], 0x2f
call fcn.1401342e8
movsxd rdx, eax
mov rcx, rbx
call fcn.1401340ec
movsxd rcx, eax
add rbx, rcx
movzx eax, byte [rbx]
test al, al
jne 0x1400ac6c8
movzx eax, byte [rdi]
mov rbx, rdi
test al, al
je 0x1400ac717
cmp al, 0x3a
je 0x1400ac739
call fcn.1401342e8
movsxd rdx, eax
mov rcx, rbx
call fcn.1401340ec
movsxd rcx, eax
add rbx, rcx
movzx eax, byte [rbx]
test al, al
jne 0x1400ac6f6
mov rsi, rdi
mov rdx, rsi
mov rcx, rdi
call fcn.1400ac150
mov rcx, rdi
mov ebx, eax
call fcn.140122088
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [rbx + 1]
lea rsi, [rbx + 1]
mov rbx, rsi
test al, al
je 0x1400ac769
cmp al, 0x3a
je 0x1400ac77d
call fcn.1401342e8
movsxd rdx, eax
mov rcx, rbx
call fcn.1401340ec
movsxd rcx, eax
add rbx, rcx
movzx eax, byte [rbx]
test al, al
jne 0x1400ac748
cmp rsi, rdi
jbe 0x1400ac71a
cmp byte [rsi], 0
jne 0x1400ac71a
mov eax, 0x2e
mov word [rsi], ax
jmp 0x1400ac71a
mov eax, 0xffffffff
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret