joyce8/EMBER2024-capa huggingface dataset:
Function at 0x63d200
Capabilities:
Query environment variable

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [0x009f7220]
test eax, eax
je 0x63d230
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov dword [0x009f7220], 1
mov r8d, 0x30
lea rdx, [0x009f71c0]
lea rcx, str.OPENSSL_ia32cap
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
sub eax, 1
cmp eax, 0x2e
ja 0x63d420
movzx ebp, word [0x009f71c0]
xor edx, edx
mov esi, 0xa
lea rax, [0x009f71c0]
cmp bp, 0x7e
sete dl
lea rbx, [rax + rdx*2]
cmp word [rbx], 0x30
je 0x63d488
xor r13d, r13d
mov edi, esi
jmp 0x63d2a8
sub r12d, 0x30
cmp esi, r12d
jbe 0x63d2d6
imul r13, rdi
add r13, r12
movzx r12d, word [rbx]
mov edx, 4
add rbx, 2
mov ecx, r12d
call fcn.0053b7e0
test eax, eax
jne 0x63d298
mov edx, 0x10
mov ecx, r12d
call fcn.0053b7e0
test eax, eax
jne 0x63d3d8
cmp bp, 0x7e
je 0x63d440
movzx r14d, word [0x009f71c0]
cmp r14w, 0x3a
je 0x63d4d0
test r14w, r14w
je 0x63d408
lea rax, [0x009f71c0]
jmp 0x63d31e
add rax, 2
test r14w, r14w
je 0x63d408
mov edx, r14d
movzx r14d, word [rax + 2]
cmp dx, 0x3a
jne 0x63d310
xor edx, edx
cmp r14w, 0x7e
sete dl
lea rbx, [rax + rdx*2 + 2]
cmp word [rbx], 0x30
je 0x63d510
mov esi, 0xa
xor ebp, ebp
mov edi, esi
jmp 0x63d360
sub r12d, 0x30
cmp esi, r12d
jbe 0x63d38a
imul rbp, rdi
add rbp, r12
movzx r12d, word [rbx]
mov edx, 4
add rbx, 2
mov ecx, r12d
call fcn.0053b7e0
test eax, eax
jne 0x63d350
mov edx, 0x10
mov ecx, r12d
call fcn.0053b7e0
test eax, eax
jne 0x63d3f0
mov rax, rbp
shr rax, 0x20
cmp r14w, 0x7e
je 0x63d4a8
mov rdx, qword [0x00967f00]
movd xmm0, ebp
movd xmm2, eax
punpckldq xmm0, xmm2
movq qword [rdx + 8], xmm0
mov eax, r13d
shr r13, 0x20
or ah, 4
mov dword [rdx + 4], r13d
mov dword [rdx], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov ecx, r12d
call fcn.0053b800
lea r12d, [rax - 0x57]
jmp 0x63d29c
mov ecx, r12d
call fcn.0053b800
lea r12d, [rax - 0x57]
jmp 0x63d354
mov rdx, qword [0x00967f00]
mov qword [rdx + 8], 0
jmp 0x63d3b4
mov rcx, qword [0x00967f00]
call fcn.005fdbe0
mov rdx, qword [0x00967f00]
mov r13, rax
jmp 0x63d3b4
mov rcx, qword [0x00967f00]
call fcn.005fdbe0
mov r8, rax
mov rax, r13
not rax
and rax, r8
test r13d, 0x1000000
je 0x63d4f0
movabs r12, 0xedfff7fdffffffff
movzx r14d, word [0x009f71c0]
and rax, r12
mov r13, rax
jmp 0x63d2f3
movzx ecx, word [rbx + 2]
call fcn.0053b800
cmp eax, 0x78
je 0x63d500
add rbx, 2
mov esi, 8
jmp 0x63d28a
mov rdx, qword [0x00967f00]
movd xmm0, ebp
movd xmm3, eax
punpckldq xmm0, xmm3
movq xmm1, qword [rdx + 8]
pandn xmm0, xmm1
movq qword [rdx + 8], xmm0
jmp 0x63d3b4
mov rcx, qword [0x00967f00]
call fcn.005fdbe0
movzx r14d, word [0x009f71c0]
mov r13, rax
jmp 0x63d2f3
movzx r14d, word [0x009f71c0]
mov r13, rax
jmp 0x63d2f3
add rbx, 4
mov esi, 0x10
jmp 0x63d28a
movzx ecx, word [rbx + 2]
call fcn.0053b800
cmp eax, 0x78
je 0x63d52c
add rbx, 2
mov esi, 8
jmp 0x63d34a
add rbx, 4
mov esi, 0x10
jmp 0x63d34a
Function at 0x64e7d0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r14
push r13
push r12
push rsi
push rbx
sub rsp, 0x1b0
lea r12, [rsp + 0xd0]
mov rbx, rcx
mov rcx, rdx
mov edx, 0x20
mov r8, r12
lea rsi, [rsp + 0x40]
lea r13, [rsp + 0x70]
call fcn.005ce320
movzx eax, byte [rsp + 0xef]
mov rdx, r12
lea r14, [rsp + 0x110]
mov rcx, r14
and byte [rsp + 0xd0], 0xf8
and eax, 0x3f
or eax, 0x40
mov byte [rsp + 0xef], al
call fcn.0064aa50
lea rdx, [rsp + 0x160]
mov rcx, rsi
call fcn.006476f0
mov r8, rsi
mov rdx, r14
mov rcx, r13
call fcn.006469d0
lea r14, [rsp + 0xa0]
mov r8, rsi
lea rdx, [rsp + 0x138]
mov rcx, r14
call fcn.006469d0
mov rdx, r14
mov rcx, rbx
call fcn.00646740
lea rcx, [rsp + 0x20]
mov rdx, r13
call fcn.00646740
movzx eax, byte [rsp + 0x20]
mov edx, 0x40
mov rcx, r12
shl eax, 7
xor byte [rbx + 0x1f], al
call fcn.005fddf0
nop
add rsp, 0x1b0
pop rbx
pop rsi
pop r12
pop r13
pop r14
ret

Function at 0x64e8f0
Capabilities:
Encrypt data using curve25519

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x178
movdqu xmm4, xmmword [rdx + 0x10]
movdqu xmm3, xmmword [rdx]
movaps xmmword [rsp + 0x30], xmm4
movzx eax, byte [rsp + 0x3f]
mov r12, rcx
lea r14, [rsp + 0x20]
lea rcx, [rsp + 0xd0]
mov rdx, r14
movaps xmmword [rsp + 0x20], xmm3
lea rbx, [rsp + 0xa0]
and eax, 0x7f
and byte [rsp + 0x20], 0xf8
lea r13, [rsp + 0x40]
or eax, 0x40
mov byte [rsp + 0x3f], al
call fcn.0064aa50
lea rdx, [rsp + 0x70]
mov rcx, rbx
movdqu xmm0, xmmword [rsp + 0xf8]
paddd xmm0, xmmword [rsp + 0x120]
movq xmm2, qword [rsp + 0x118]
movdqu xmm5, xmmword [rsp + 0xf8]
movdqu xmm3, xmmword [rsp + 0x108]
movaps xmmword [rsp + 0x40], xmm0
movdqu xmm0, xmmword [rsp + 0x108]
paddd xmm0, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x50], xmm0
movq xmm0, qword [rsp + 0x140]
movdqa xmm1, xmm0
psubd xmm0, xmm2
paddd xmm1, xmm2
movq qword [rsp + 0x90], xmm0
movq qword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [rsp + 0x120]
psubd xmm1, xmm5
movaps xmmword [rsp + 0x70], xmm1
movdqa xmm1, xmmword [rsp + 0x130]
psubd xmm1, xmm3
movaps xmmword [rsp + 0x80], xmm1
call fcn.006476f0
mov r8, rbx
mov rdx, r13
mov rcx, r13
call fcn.006469d0
mov rdx, r13
mov rcx, r12
call fcn.00646740
mov edx, 0x20
mov rcx, r14
call fcn.005fddf0
nop
add rsp, 0x178
pop rbx
pop r12
pop r13
pop r14
ret
Function at 0x68ce80
Capabilities:
Encode data using base64

Disassembly:
push rbx
lea r10, [0x0093bb80]
mov rax, rcx
mov rcx, rdx
test rax, rax
je 0x68cea2
test byte [rax + 0x5c], 2
lea rax, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
cmovne r10, rax
xor r11d, r11d
test r9d, r9d
jg 0x68cf01
jmp 0x68cf43
movzx eax, byte [r8 + 1]
add r8, 3
shl eax, 8
or eax, edx
movzx edx, byte [r8 - 1]
mov ebx, eax
shr ebx, 0x12
or edx, eax
shr eax, 0xc
movzx ebx, byte [r10 + rbx]
and eax, 0x3f
mov byte [rcx - 4], bl
movzx eax, byte [r10 + rax]
mov byte [rcx - 3], al
mov eax, edx
and edx, 0x3f
shr eax, 6
and eax, 0x3f
movzx eax, byte [r10 + rax]
mov byte [rcx - 2], al
movzx eax, byte [r10 + rdx]
mov byte [rcx - 1], al
sub r9d, 3
je 0x68cf43
movzx eax, byte [r8]
mov rbx, rcx
add r11d, 4
add rcx, 4
shl eax, 0x10
mov edx, eax
cmp r9d, 2
jg 0x68ceb0
je 0x68cf50
shr eax, 0x12
movzx eax, byte [r10 + rax]
mov byte [rbx], al
mov eax, edx
shr eax, 0xc
and eax, 0x30
movzx eax, byte [r10 + rax]
mov byte [rbx + 1], al
mov eax, 0x3d
mov byte [rbx + 2], al
mov byte [rbx + 3], 0x3d
mov eax, r11d
mov byte [rcx], 0
pop rbx
ret
movzx r8d, byte [r8 + 1]
shl r8d, 8
or r8d, eax
shr eax, 0x12
movzx eax, byte [r10 + rax]
mov byte [rbx], al
mov eax, r8d
shr r8d, 6
shr eax, 0xc
and r8d, 0x3c
and eax, 0x3f
movzx eax, byte [r10 + rax]
mov byte [rbx + 1], al
movzx eax, byte [r10 + r8]
jmp 0x68cf3c

Function at 0x68d470
Capabilities:
Encode data using base64

Disassembly:
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
jmp fcn.0068ce80
Function at 0x691f50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xc8
mov qword [rsp + 0x120], r8
mov rbx, rcx
mov r13, rdx
test r8, r8
je 0x692064
movzx edx, byte [rcx + 0xc]
movzx eax, byte [rcx + 0x14]
lea r12, [rcx + 0xc]
lea rbp, [rcx + 0x14]
xor esi, esi
lea rdi, [rsp + 0x40]
lea r15, [rsp + 0x30]
lea r14, [rsp + 0x38]
nop dword [rax + rax]
and edx, 0xffffff9f
and eax, 0xffffff9f
mov r9d, dword [r13 + rsi]
mov r10d, dword [r13 + rsi + 4]
or eax, 0x20
or edx, 0x40
mov rcx, qword [r13 + rsi]
add rsi, 8
mov byte [rbx + 0x14], al
mov byte [rbx + 0xc], dl
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
mov rcx, r12
mov dword [rsp + 0x2c], r9d
mov dword [rsp + 0x28], r10d
call fcn.00642b30
mov rdx, rdi
mov rcx, r12
call fcn.00642d20
mov r8d, 1
mov rdx, rdi
mov rcx, r15
call fcn.0063f420
mov rcx, rbp
call fcn.00642b30
mov rdx, rdi
mov rcx, rbp
call fcn.00642d20
mov rdx, rdi
mov rcx, r14
mov r8d, 1
call fcn.0063f420
mov r9d, dword [rsp + 0x2c]
mov r10d, dword [rsp + 0x28]
mov ecx, dword [rsp + 0x38]
mov eax, dword [rsp + 0x3c]
xor ecx, r9d
xor eax, r10d
xor r9d, dword [rsp + 0x30]
xor r10d, dword [rsp + 0x34]
mov dword [rbx + 0x10], eax
mov edx, r9d
mov eax, ecx
mov dword [rbx + 0xc], r9d
mov dword [rbx + 0x14], ecx
mov dword [rbx + 0x18], r10d
cmp qword [rsp + 0x120], rsi
ja 0x691fa0
add rsp, 0xc8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x69c360
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
push rbx
push rbp
push r12
push r13
push r14
push r15
lea rdi, [rdi + 0x64]
sub rsp, 0xe8
mov r9, rsi
lea rsi, [rsp + 0x64]
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
lea r15, [0x0069c540]
mov qword [rsi + 0x74], rcx
cmp rdx, rcx
jb 0x69c400
shr rcx, 3
lea r8, [rdi - 0x64]
mov rax, qword [r9]
lea r9, [r9 + 8]
xor rax, qword [r8]
lea r8, [r8 + 8]
sub rdx, 8
mov qword [r8 - 8], rax
sub rcx, 1
jne 0x69c3c6
mov qword [rsi + 0x64], r9
mov qword [rsi + 0x6c], rdx
call fcn.0069c000
mov r9, qword [rsi + 0x64]
mov rdx, qword [rsi + 0x6c]
mov rcx, qword [rsi + 0x74]
jmp 0x69c3b9
mov rax, rdx
not qword [rdi - 0x5c]
not qword [rdi - 0x54]
not qword [rdi - 0x24]
not qword [rdi - 4]
not qword [rdi + 0x24]
not qword [rdi + 0x3c]
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x6a1b50
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov eax, dword [rcx + 0x28]
add qword [rcx], r8
mov rdi, qword [rcx + 8]
mov rsi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov r13, rdx
mov r14, r8
test eax, eax
je 0x6a1bfa
mov r15d, 8
lea rcx, [rcx + rax + 0x38]
sub r15d, eax
cmp r8, r15
jb 0x6a1cca
mov r8, r15
sub r14, r15
add r13, r15
call sub.msvcrt.dll_memcpy
mov rcx, qword [r12 + 0x38]
mov edx, dword [r12 + 0x30]
xor rbx, rcx
test edx, edx
jle 0x6a1bf7
xor eax, eax
nop dword [rax + rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp eax, edx
jne 0x6a1bc0
xor rdi, rcx
mov r9d, r14d
and r14, 0xfffffffffffffff8
lea r8, [r13 + r14]
and r9d, 7
cmp r13, r8
je 0x6a1c6b
mov edx, dword [r12 + 0x30]
nop dword [rax]
mov rcx, qword [r13]
xor rbx, rcx
test edx, edx
jle 0x6a1c5f
xor eax, eax
nop dword [rax]
add rdi, rsi
add rbp, rbx
rol rsi, 0xd
add eax, 1
rol rbx, 0x10
xor rsi, rdi
rol rdi, 0x20
xor rbx, rbp
add rbp, rsi
rol rsi, 0x11
add rdi, rbx
rol rbx, 0x15
xor rsi, rbp
xor rbx, rdi
rol rbp, 0x20
cmp edx, eax
jne 0x6a1c28
add r13, 8
xor rdi, rcx
cmp r8, r13
jne 0x6a1c18
test r9d, r9d
jne 0x6a1cae
movq xmm0, rdi
movq xmm1, rsi
movq xmm2, rbx
mov dword [r12 + 0x28], r9d
punpcklqdq xmm0, xmm1
movups xmmword [r12 + 8], xmm0
movq xmm0, rbp
punpcklqdq xmm0, xmm2
movups xmmword [r12 + 0x18], xmm0
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
lea r10, [r12 + 0x38]
xor eax, eax
mov edx, eax
add eax, 1
movzx ecx, byte [r8 + rdx]
mov byte [r10 + rdx], cl
cmp eax, r9d
jb 0x6a1cb5
jmp 0x6a1c70
call sub.msvcrt.dll_memcpy
add dword [r12 + 0x28], r14d
jmp 0x6a1c9d
Function at 0x6b5230
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rax, qword [0x0094af40]
lea rsi, [0x0094af40]
mov r11d, 0x48
mov qword [rcx], rax
mov rax, qword [0x0094bf80]
lea rdi, [rcx + 8]
mov rbp, rcx
and rdi, 0xfffffffffffffff8
lea rbx, [rbp + 0x48]
mov r10, rbp
mov qword [rcx + 0x1040], rax
mov rax, rcx
sub rax, rdi
sub rsi, rax
add eax, 0x1048
shr eax, 3
cmp edx, 0x48
mov ecx, eax
cmovle r11d, edx
mov rax, r8
rep movsq qword [rdi], qword [rsi]
movsxd r11, r11d
add r11, r8
nop dword [rax]
lea rcx, [rax + 1]
movzx eax, byte [rax]
cmp r11, rcx
cmovbe rcx, r8
shl eax, 8
movzx edx, byte [rcx]
lea r9, [rcx + 1]
or edx, eax
cmp r11, r9
cmovbe r9, r8
mov eax, edx
shl eax, 8
movzx edx, byte [r9]
lea rcx, [r9 + 1]
or edx, eax
cmp r11, rcx
cmovbe rcx, r8
shl edx, 8
lea rax, [rcx + 1]
movzx ecx, byte [rcx]
or edx, ecx
cmp r11, rax
cmovbe rax, r8
xor dword [r10], edx
add r10, 4
cmp rbx, r10
jne 0x6b5298
mov qword [rsp + 0x28], 0
mov rdi, rbp
lea rsi, [rsp + 0x28]
nop
mov rdx, rbp
mov rcx, rsi
add rdi, 8
call fcn.006b4470
mov rax, qword [rsp + 0x28]
mov qword [rdi - 8], rax
cmp rbx, rdi
jne 0x6b5300
lea rdi, [rbp + 0x1048]
nop dword [rax]
mov rdx, rbp
mov rcx, rsi
add rbx, 8
call fcn.006b4470
mov rax, qword [rsp + 0x28]
mov qword [rbx - 8], rax
cmp rbx, rdi
jne 0x6b5328
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6b54a0
Capabilities:
Encode data using xor

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov eax, dword [r8 + 8]
mov rbx, rdx
mov edx, dword [rdx + 8]
mov r12, rcx
mov rsi, r8
cmp edx, eax
jge 0x6b54c7
mov edx, eax
mov rax, rbx
mov rbx, r8
mov rsi, rax
mov rcx, r12
call fcn.0052e860
test rax, rax
je 0x6b5608
mov eax, dword [rsi + 8]
test eax, eax
jle 0x6b5640
mov rcx, qword [rbx]
mov r8, qword [r12]
mov r9, qword [rsi]
lea rdx, [rcx + 8]
cmp r8, rdx
lea rdx, [r9 + 8]
setne r10b
cmp r8, rdx
setne dl
test r10b, dl
je 0x6b5618
lea edx, [rax - 1]
cmp edx, 2
jbe 0x6b5618
mov r10d, eax
xor edx, edx
shr r10d, 1
shl r10, 4
nop dword [rax + rax]
movdqu xmm0, xmmword [rcx + rdx]
movdqu xmm1, xmmword [r9 + rdx]
pxor xmm0, xmm1
movups xmmword [r8 + rdx], xmm0
add rdx, 0x10
cmp rdx, r10
jne 0x6b5528
mov edx, eax
and edx, 0xfffffffe
test al, 1
je 0x6b555a
mov rcx, qword [rcx + rdx*8]
xor rcx, qword [r9 + rdx*8]
mov qword [r8 + rdx*8], rcx
mov r10d, dword [rbx + 8]
cmp eax, r10d
jge 0x6b55d0
mov rcx, qword [rbx]
mov r11, qword [r12]
movsxd rdx, eax
lea r8, [rdx*8]
lea rbx, [r11 + r8]
lea r9, [rcx + r8 + 8]
cmp rbx, r9
je 0x6b55f0
lea r9d, [r10 - 1]
sub r9d, eax
cmp r9d, 3
jbe 0x6b55f0
mov esi, r10d
add r8, rcx
xor edx, edx
sub esi, eax
mov r9d, esi
shr r9d, 1
shl r9, 4
nop dword [rax]
movdqu xmm2, xmmword [r8 + rdx]
movups xmmword [rbx + rdx], xmm2
add rdx, 0x10
cmp rdx, r9
jne 0x6b55a8
mov edx, esi
and edx, 0xfffffffe
add eax, edx
cmp esi, edx
je 0x6b55d0
cdqe
mov rdx, qword [rcx + rax*8]
mov qword [r11 + rax*8], rdx
mov dword [r12 + 8], r10d
mov rcx, r12
call fcn.0052e9f0
mov eax, 1
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov rax, qword [rcx + rdx*8]
mov qword [r11 + rdx*8], rax
add rdx, 1
cmp r10d, edx
jg 0x6b55f0
jmp 0x6b55d0
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
mov r11d, eax
xor edx, edx
nop dword [rax]
mov r10, qword [rcx + rdx*8]
xor r10, qword [r9 + rdx*8]
mov qword [r8 + rdx*8], r10
add rdx, 1
cmp r11, rdx
jne 0x6b5620
jmp 0x6b555a
xor eax, eax
jmp 0x6b555a
Function at 0x6bd2d0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov rsi, rdx
mov r12, r8
test r8, r8
je 0x6bd379
test rcx, rcx
je 0x6bd3a0
mov rcx, qword [rcx + 0x10]
lea r13, [rsp + 0x20]
test rdx, rdx
je 0x6bd35b
movq xmm0, rdx
movq xmm1, r8
lea r13, [rsp + 0x20]
punpcklqdq xmm0, xmm1
mov rdx, r13
movaps xmmword [rsp + 0x20], xmm0
call fcn.0057fea0
test rax, rax
je 0x6bd340
mov rax, qword [rax + 0x10]
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov ecx, 4
lea rdi, [0x009505b7]
repe cmpsb byte [rsi], byte [rdi]
seta al
sbb al, 0
test al, al
je 0x6bd390
mov rcx, qword [rbx + 0x10]
lea rax, [0x009505bb]
mov rdx, r13
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rax
call fcn.0057fea0
test rax, rax
jne 0x6bd329
xor eax, eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
mov rcx, r12
call fcn.0057a7d0
test rax, rax
jne 0x6bd32d
jmp 0x6bd357
mov rcx, r8
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
jmp fcn.0057a7d0
Function at 0x6cfc20
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov r12, rcx
mov r13, rdx
mov rbp, r8
call sub.msvcrt.dll_wcslen
mov rdi, rax
mov rbx, rax
jmp 0x6cfc60
lea rsi, [rbx - 1]
movzx eax, word [r12 + rsi*2]
cmp ax, 0x2f
je 0x6cfcd0
cmp ax, 0x5c
je 0x6cfcd0
mov rbx, rsi
test rbx, rbx
jne 0x6cfc48
test r13, r13
je 0x6cfca9
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor edx, edx
xor ecx, ecx
call rbx
mov r14d, eax
test eax, eax
je 0x6cfd4e
mov ecx, eax
add rcx, rcx
call fcn.006cb300
mov qword [r13], rax
mov rdx, rax
test rax, rax
je 0x6cfd6d
mov ecx, r14d
call rbx
test eax, eax
je 0x6cfd55
mov rcx, r12
call sub.msvcrt.dll__wcsdup
mov qword [rbp], rax
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
test rsi, rsi
je 0x6cfc65
test r13, r13
je 0x6cfd0a
lea r14, [rbx + rbx + 2]
mov rcx, r14
call fcn.006cb300
mov qword [r13], rax
mov rcx, rax
test rax, rax
je 0x6cfd6d
mov r8, rbx
mov rdx, r12
call sub.msvcrt.dll_wcsncpy
mov rax, qword [r13]
xor ecx, ecx
mov word [rax + r14 - 2], cx
sub rdi, rsi
lea rsi, [rdi + rdi]
mov rcx, rsi
call fcn.006cb300
mov qword [rbp], rax
mov rcx, rax
test rax, rax
je 0x6cfd6d
lea rdx, [r12 + rbx*2]
lea r8, [rdi - 1]
call sub.msvcrt.dll_wcsncpy
mov rax, qword [rbp]
xor edx, edx
mov word [rax + rsi - 2], dx
xor eax, eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov eax, 0xffffffff
jmp 0x6cfd3f
mov rcx, qword [r13]
call fcn.006cb320
mov qword [r13], 0
mov eax, 0xffffffff
jmp 0x6cfd3f
lea rdx, [0x00958320]
mov ecx, 0xe
call fcn.006cf7a0
nop
nop
Function at 0x6d1730
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [rsp + 0x48]
lea rcx, [0x00c807a0]
mov dword [0x009f7780], eax
call fcn.006e6d20
test eax, eax
jne 0x6d1790
lea rax, [0x009f87a0]
lea rdx, [0x009f77a0]
lea rcx, [rax + 0x288000]
nop
mov qword [rdx + 8], rax
add rax, 0x2880
add rdx, 0x10
mov qword [rdx - 0x10], 0
cmp rax, rcx
jne 0x6d1770
add rsp, 0x58
ret
lea rdx, str.uv_mutex_init
mov ecx, eax
call fcn.006cf7a0
nop
nop
Function at 0x6d96c0
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x20
mov r8, qword [rcx + 0x48]
mov rdx, qword [rcx + 0x40]
mov rbx, rcx
mov qword [rcx + 0x48], 0
mov rcx, qword [rcx + 0x38]
lea r9, [rbx + 0x48]
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
cmp eax, 0x273f
je 0x6d97b0
jle 0x6d9720
cmp eax, 0x2afa
je 0x6d9790
jle 0x6d9740
cmp eax, 0x2afb
jne 0x6d97a0
mov eax, 0xfffff444
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x2726
je 0x6d9780
jle 0x6d9760
cmp eax, 0x273c
jne 0x6d97a0
mov eax, 0xfffff43d
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
cmp eax, 0x277d
je 0x6d9770
cmp eax, 0x2af9
jne 0x6d97a0
mov eax, 0xfffff440
mov dword [rbx + 0x58], eax
add rsp, 0x20
pop rbx
ret
test eax, eax
je 0x6d9710
cmp eax, 8
jne 0x6d97a0
mov eax, 0xfffff442
jmp 0x6d9710
mov eax, 0xfffff43e
jmp 0x6d9710
mov eax, 0xfffff446
jmp 0x6d9710
mov eax, 0xfffff447
jmp 0x6d9710
mov ecx, eax
call fcn.006cf860
jmp 0x6d9710
mov eax, 0xfffff443
jmp 0x6d9710

Function at 0x6da9c0
Capabilities:
Create pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp qword [r8 + 0x70], 0xffffffffffffffff
mov rbp, rcx
mov rsi, rdx
mov rbx, r8
mov edi, r9d
je 0x6da9f5
mov r8d, 0x14c
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle__INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
cmp edi, 1
mov rcx, qword [rsi + 0x120]
mov qword [rsp + 0x38], 0
mov r9d, 0xff
sbb edx, edx
mov dword [rsp + 0x30], 0
xor r8d, r8d
and edx, 0xfff80000
mov dword [rsp + 0x28], 0x10000
mov dword [rsp + 0x20], 0x10000
add edx, 0x400c0003
call qword [sym.imp.KERNEL32.dll_CreateNamedPipeW]
mov qword [rbx + 0x70], rax
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x6daa80
xor r9d, r9d
mov rdx, qword [rbp + 0x38]
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
je 0x6daa8b
mov rax, qword [rbx + 0x70]
mov qword [rsi + 0x118], rax
mov eax, 1
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
xor eax, eax
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.CreateIoCompletionPort
mov ecx, eax
call fcn.006cf7a0
nop
Function at 0x6dacb0
Capabilities:
Connect pipe

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbp, rcx
mov rdi, rdx
mov rbx, r8
mov esi, r9d
test byte [rdx + 0x58], 0x40
je 0x6dad20
test esi, esi
je 0x6dad3e
cmp qword [rbx + 0x70], 0xffffffffffffffff
je 0x6dadd8
lea rdx, [rbx + 0x40]
mov qword [rbx + 0x40], 0
mov qword [rbx + 0x48], 0
mov qword [rdx + 0x10], 0
mov qword [rdx + 0x18], 0
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
test eax, eax
je 0x6dad80
add dword [rdi + 0x78], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x34c
lea rdx, str.src_win_pipe.c
lea rcx, [0x00958ab8]
call qword [sym.imp.msvcrt.dll__assert]
test esi, esi
jne 0x6dacce
xor r9d, r9d
mov r8, rbx
mov rdx, rdi
mov rcx, rbp
call fcn.006da9c0
test eax, eax
jne 0x6dacce
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
test eax, eax
jle 0x6dae2c
call rsi
movzx eax, ax
or eax, 0x80070000
cdqe
mov qword [rbx + 0x40], rax
jmp 0x6dada5
mov rsi, qword [sym.imp.KERNEL32.dll_GetLastError]
call rsi
cmp eax, 0x3e5
je 0x6dad0b
call rsi
cmp eax, 0x217
jne 0x6dae10
mov qword [rbx + 0x40], 0
mov rax, qword [rbp + 0x48]
mov qword [rbx + 0x68], 0
test rax, rax
je 0x6dae00
mov rdx, qword [rax + 0x68]
mov qword [rbx + 0x68], rdx
mov qword [rax + 0x68], rbx
mov qword [rbp + 0x48], rbx
add dword [rdi + 0x78], 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov r8d, 0x355
lea rdx, str.src_win_pipe.c
lea rcx, str.req__pipeHandle___INVALID_HANDLE_VALUE
call qword [sym.imp.msvcrt.dll__assert]
jmp 0x6dacd9
mov qword [rbx + 0x68], rbx
mov qword [rbp + 0x48], rbx
jmp 0x6dad0b
mov rcx, qword [rbx + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x70], 0xffffffffffffffff
call rsi
test eax, eax
jg 0x6dad68
call rsi
cdqe
jmp 0x6dad74

Function at 0x6db490
Capabilities:
Read file on windows

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x58
mov r12, qword [sym.imp.KERNEL32.dll_ReadFile]
xor ebx, ebx
mov rbp, rcx
mov rdi, rdx
lea r13, [rsp + 0x4c]
mov esi, r8d
nop dword [rax + rax]
mov edx, ebx
mov r8d, esi
mov r9, r13
mov rcx, rbp
mov qword [rsp + 0x20], 0
add rdx, rdi
sub r8d, ebx
call r12
test eax, eax
je 0x6db530
add ebx, dword [rsp + 0x4c]
cmp esi, ebx
ja 0x6db4b8
mov eax, 0
jne 0x6db4f8
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
mov dword [rsp + 0x3c], eax
mov r8d, 0x686
lea rdx, str.src_win_pipe.c
lea rcx, str.bytes_read__count
call qword [sym.imp.msvcrt.dll__assert]
mov eax, dword [rsp + 0x3c]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret