joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401198f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x14011995e
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14011995e
lea rcx, [rsp + 0x58]
call fcn.14011a340
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rax]
mov qword [rbx + 0x20], rdx
mov qword [rax], rcx
lea rax, [0x140592ec8]
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
cmp rcx, rax
je 0x14011995e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14011995e
call fcn.1400c9d7c
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret

Function at 0x140119e60
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x140119ef9
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140119ef9
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140119ed5
cmp eax, 0xffffffff
je 0x140119ed5
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne cl
movzx eax, cl
add rsp, 0x20
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne cl
movzx eax, cl
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140119f20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x140119f9e
mov rdx, rcx
lea rcx, [rsp + 0x38]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140119f9e
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov edx, 0x40000000
mov rcx, rbx
call fcn.14011a1b0
test al, al
je 0x14011a023
cmp edi, 0xffffffff
je 0x140119f91
and dil, 0x11
cmp dil, 1
je 0x14011a023
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x140119fbe
cmp eax, 0xffffffff
jne 0x14011a023
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.140018050
shr eax, 0x1f
xor al, 1
je 0x14011a023
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140144ff0
nop
mov rcx, rax
call fcn.140119f20
movzx ebx, al
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff0
lea rax, [0x140592ec8]
cmp rcx, rax
je 0x14011a015
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x14011a015
call fcn.1400c9d7c
movzx eax, bl
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14011a580
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov qword [rsp + 0x30], rax
add rax, 0xfffffffffffffff0
lea rdi, [0x140592ec8]
cmp rax, rdi
je 0x14011a5a5
lock inc dword [rax]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14011a610
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
je 0x14011a5f2
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x14011a5f2
call fcn.1400c9d7c
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140120980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov ebx, dword [rcx + 0x44]
lea r15, [rcx + 0x50]
mov qword [rsp + 0x50], rdi
mov rsi, rcx
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r13
nop word [rax + rax]
mov edx, dword [rsi + 0x94]
mov ebp, dword [rsi + 0x58]
sub ebp, dword [rsi + 0x9c]
mov ecx, dword [rsi + 0x44]
sub ebp, edx
add ecx, 0xfffffefa
add ecx, ebx
cmp edx, ecx
jb 0x140120a54
mov rcx, qword [r15]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.140279770
mov r9d, dword [rsi + 0x74]
mov rax, qword [rsi + 0x68]
sub dword [rsi + 0x98], ebx
sub dword [rsi + 0x94], ebx
sub dword [rsi + 0x84], ebx
lea r8, [rax + r9*2]
movzx ecx, word [r8 - 2]
lea r8, [r8 - 2]
xor eax, eax
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
cmovae eax, edx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x140120a01
mov rax, qword [rsi + 0x60]
mov r9d, ebx
lea r8, [rax + rbx*2]
nop word [rax + rax]
movzx ecx, word [r8 - 2]
lea r8, [r8 - 2]
xor eax, eax
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
cmovae eax, edx
mov word [r8], ax
add r9d, 0xffffffff
jne 0x140120a30
add ebp, ebx
lea r15, [rsi + 0x50]
mov r14, qword [rsi]
mov eax, dword [r14 + 8]
test eax, eax
je 0x140120b4a
mov r10d, dword [rsi + 0x94]
mov r13d, dword [rsi + 0x9c]
add r13, r10
add r13, qword [r15]
cmp eax, ebp
cmovbe ebp, eax
test ebp, ebp
jne 0x140120a85
mov r12, r15
jmp 0x140120af1
sub eax, ebp
mov dword [r14 + 8], eax
mov rax, qword [r14 + 0x28]
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x140120aab
mov rdx, qword [r14]
mov r8d, ebp
mov ecx, dword [r14 + 0x4c]
call fcn.1401226c0
mov r12, r15
jmp 0x140120acf
mov r12, r15
cmp ecx, 2
jne 0x140120ad3
mov rdx, qword [r14]
test rdx, rdx
jne 0x140120abf
xor eax, eax
jmp 0x140120acb
mov ecx, dword [r14 + 0x4c]
mov r8d, ebp
call fcn.140122350
lea r12, [rsi + 0x50]
mov dword [r14 + 0x4c], eax
mov rdx, qword [r14]
mov rcx, r13
mov r8d, ebp
mov edi, ebp
call fcn.140279770
add qword [r14], rdi
add dword [r14 + 0xc], ebp
mov r10d, dword [rsi + 0x94]
mov r9d, dword [rsi + 0x9c]
add r9d, ebp
mov dword [rsi + 0x9c], r9d
cmp r9d, 3
jb 0x140120b34
mov rdx, qword [r12]
mov ecx, dword [rsi + 0x80]
mov eax, r10d
movzx r8d, byte [rax + rdx]
lea eax, [r10 + 1]
mov dword [rsi + 0x70], r8d
movzx eax, byte [rax + rdx]
shl r8d, cl
xor r8d, eax
and r8d, dword [rsi + 0x7c]
mov dword [rsi + 0x70], r8d
cmp r9d, 0x106
jae 0x140120b4a
mov rax, qword [rsi]
cmp dword [rax + 8], 0
jne 0x1401209b0
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012ad20
Capabilities:
Print debug messages

Disassembly:
mov rcx, qword [0x1405a77c8]
test rcx, rcx
je 0x14012ad33
mov rax, qword [rcx]
jmp qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, rdx
jmp fcn.140117790

Function at 0x14012d660
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
lea rsi, [rcx + 0x60]
mov qword [rsp + 0x40], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x14012d75b
mov eax, 1
xchg byte [rbx + 0x1ed], al
lea rcx, [rbx + 0x1f0]
call fcn.14001a8d0
lea rcx, [rbx + 0x138]
call fcn.140115190
test edi, edi
je 0x14012d6c6
mov edx, edi
mov rcx, rbx
call fcn.14012d780
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x14012d75b
lea rdx, str.___killing_thread_by_force___
lea rcx, [rsp + 0x30]
call fcn.140018a20
nop
mov rcx, qword [0x1405a77c8]
test rcx, rcx
je 0x14012d6ff
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x14012d70a
lea rcx, [rsp + 0x30]
call fcn.140117790
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff0
lea rax, [0x140592ec8]
cmp rcx, rax
je 0x14012d734
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14012d734
call fcn.1400c9d7c
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x14012d74b
mov rcx, qword [rbx + 0x10]
nop
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
mov eax, ecx
xchg qword [rbx + 0x10], rax
xchg qword [rbx + 0x18], rcx
xor bl, bl
jmp 0x14012d75d
mov bl, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14012d930
Capabilities:
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea r8, [0x140116100]
mov esi, edx
xor edi, edi
mov eax, edi
mov r9, rbx
xchg byte [rcx + 0x1ed], al
mov edx, dword [rbx + 0x1e0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call fcn.1400da88c
xchg qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x14012d9f8
mov eax, dword [rsp + 0x40]
mov r8d, esi
xchg qword [rbx + 0x18], rax
mov rdx, qword [rbx + 0x10]
nop
movzx ecx, byte [rbx + 0x58]
call fcn.140116080
test al, al
je 0x14012d9cb
mov rcx, qword [rbx + 0x10]
nop
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [rbx + 0x90]
call fcn.140115190
mov al, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x14012d9e2
mov rcx, qword [rbx + 0x10]
xor edx, edx
nop
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
xchg qword [rbx + 0x18], rax
xchg qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x48]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14012e380
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp byte [rdx], 0
mov rbx, rdx
mov r14, rcx
je 0x14012e4e3
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
movzx ecx, byte [rbx]
inc rbx
mov eax, ecx
test cl, cl
jns 0x14012e412
mov ecx, 0x40
xor r8d, r8d
mov edx, 0x7f
test cl, al
je 0x14012e3e0
cmp ecx, 8
jbe 0x14012e3e0
shr edx, 1
inc r8d
shr ecx, 1
test eax, ecx
jne 0x14012e3d0
and eax, edx
sub r8d, 1
js 0x14012e412
nop dword [rax + rax]
movzx edx, byte [rbx]
mov ecx, edx
and cl, 0xc0
cmp cl, 0x80
jne 0x14012e412
mov ecx, eax
and edx, 0x3f
shl ecx, 6
mov eax, edx
or eax, ecx
inc rbx
sub r8d, 1
jns 0x14012e3f0
lea ecx, [rax - 0x41]
cmp ecx, 0x19
ja 0x14012e41e
mov eax, ecx
jmp 0x14012e468
lea ecx, [rax - 0x61]
cmp ecx, 0x19
ja 0x14012e42b
add eax, 0xffffffb9
jmp 0x14012e468
lea ecx, [rax - 0x30]
cmp ecx, 9
ja 0x14012e438
add eax, 4
jmp 0x14012e468
cmp eax, 0x2b
jne 0x14012e444
mov eax, 0x3e
jmp 0x14012e468
cmp eax, 0x2f
jne 0x14012e450
mov eax, 0x3f
jmp 0x14012e468
cmp eax, 0x3d
jne 0x14012e4fb
mov eax, 0x40
cmp r9, 1
jle 0x14012e4fb
mov byte [rsp + r9 + 0x38], al
inc r9
cmp r9, 4
jl 0x14012e3b3
movzx eax, byte [rsp + 0x38]
mov rcx, r14
movzx esi, byte [rsp + 0x39]
mov r8, qword [r14]
movzx edx, sil
shr dl, 4
shl al, 2
or dl, al
call qword [r8 + 0x28]
movzx edi, byte [rsp + 0x3a]
cmp dil, 0x40
jae 0x14012e4da
mov rax, qword [r14]
movzx edx, dil
shr dl, 2
mov rcx, r14
shl sil, 4
or dl, sil
call qword [rax + 0x28]
movzx ecx, byte [rsp + 0x3b]
cmp cl, 0x40
jae 0x14012e4da
mov rax, qword [r14]
shl dil, 6
or dil, cl
mov rcx, r14
movzx edx, dil
call qword [rax + 0x28]
cmp byte [rbx], 0
jne 0x14012e3b0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x14012e4e5
Function at 0x14013bbb0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x1405921c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
movzx eax, byte [rcx + 0x20]
nop
test al, al
je 0x14013bce1
movzx eax, byte [rcx + 0x21]
nop
test al, al
je 0x14013bce1
mov dword [rsp + 0x20], 0x80
movsxd rcx, dword [rcx + 0x1c]
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
test eax, eax
js 0x14013bce1
movzx ecx, byte [rdi + 0x20]
nop
test cl, cl
je 0x14013bce1
mov ecx, 0x58
call fcn.1400c9d40
mov rbx, rax
mov qword [rsp + 0x30], rax
mov ebp, dword [rdi + 0x18]
nop
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140018a20
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov rax, qword [rsp + 0x28]
mov qword [rbx + 0x10], rax
lea rdi, [rax - 0x10]
lea r14, [0x140592ec8]
cmp rdi, r14
je 0x14013bc78
lock inc dword [rdi]
mov dword [rbx + 0x18], ebp
mov dword [rbx + 0x1c], esi
mov word [rbx + 0x20], 1
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp byte [0x1405a7d3c], 0
jne 0x14013bcb3
mov ecx, 0x101
lea rdx, [rsp + 0xc0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete byte [0x1405a7d3c]
movsxd rcx, esi
mov r9, rbx
call fcn.14013c500
nop
cmp rdi, r14
je 0x14013bcdc
mov eax, 0xffffffff
lock xadd dword [rdi], eax
dec eax
cmp eax, 0xffffffff
jne 0x14013bcdc
mov rcx, rdi
call fcn.1400c9d7c
mov rax, rbx
jmp 0x14013bce3
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400c9d20
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14013bfe0
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x20], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1405921c0]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor esi, esi
mov dword [rsp + 0x38], 2
mov rdi, rdx
mov dword [rsp + 0x5c], esi
xorps xmm0, xmm0
mov dword [rsp + 0x34], esi
xorps xmm1, xmm1
mov qword [r11 - 0x78], rsi
mov edx, r8d
mov dword [rsp + 0x30], 8
lea rcx, [r11 - 0x18]
movdqu xmmword [rsp + 0x3c], xmm0
movdqu xmmword [rsp + 0x4c], xmm1
call fcn.140136690
lea r8, [rsp + 0x7f]
mov rdx, rax
sub r8, rax
lea rcx, [rsp + 0x28]
call fcn.14000ffd0
mov rbx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
lea rcx, [rbx - 0x10]
lea rax, [0x140592ec8]
cmp rcx, rax
je 0x14013c09b
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x14013c09b
call fcn.1400c9d7c
test edi, edi
cmove rsi, qword [rsp + 0x20]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400c9d20
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14013c150
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1405921c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov esi, r9d
mov rcx, rdx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x14013c24e
movsxd rcx, dword [rbx]
mov eax, 0x10624dd3
imul esi
nop
xor r9d, r9d
sar edx, 6
xor r8d, r8d
mov eax, edx
mov qword [rsp + 0x48], rcx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x40], 1
imul eax, edx, 0x3e8
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x40]
sub esi, eax
imul eax, esi, 0x3e8
mov rsi, rcx
inc ecx
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x14013c245
movsxd rax, dword [rbx]
nop
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x14013c245
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 4
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x14013c245
cmp dword [rsp + 0x34], 0
jne 0x14013c245
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
xor ebx, ebx
mov rcx, rdi
test eax, eax
setne bl
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x14013c253
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400c9d20
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x14013c500
Capabilities:
Set socket configuration

Disassembly:
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [r9]
lea rax, [rsp + 0x70]
mov rbp, r9
mov qword [rsp + 0x60], rbx
mov rdi, r14
mov dword [rsp + 0x70], 4
lea r9, [rsp + 0x68]
shr rdi, 0x20
mov edx, 0xffff
mov qword [rsp + 0x20], rax
mov r8d, 0x1002
mov rsi, rcx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14013c56c
cmp dword [rsp + 0x70], 4
jne 0x14013c56c
mov eax, dword [rsp + 0x68]
mov ebx, 0x10000
cmp eax, ebx
cmovl eax, ebx
jmp 0x14013c573
mov ebx, 0x10000
mov eax, ebx
mov rbp, qword [rbp + 8]
lea r9, [rsp + 0x68]
test dil, dil
mov dword [rsp + 0x70], 4
mov r15, rbp
mov edx, 0xffff
cmove r14d, eax
mov r8d, 0x1001
lea rax, [rsp + 0x70]
shr r15, 0x20
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x14013c5c6
cmp dword [rsp + 0x70], 4
jne 0x14013c5c6
mov edi, dword [rsp + 0x68]
cmp edi, ebx
cmovl edi, ebx
jmp 0x14013c5c8
mov edi, ebx
mov rbx, qword [rsp + 0x60]
cmp rsi, 0xffffffffffffffff
je 0x14013c667
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], r14d
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14013c667
test r15b, r15b
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x70]
mov edx, 0xffff
cmove ebp, edi
mov r8d, 0x1001
mov rcx, rsi
mov dword [rsp + 0x70], ebp
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14013c667
lea r9, [rsp + 0x70]
mov dword [rsp + 0x70], 1
lea edx, [rax + 6]
mov dword [rsp + 0x20], 4
lea r8d, [rax + 1]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x14013c667
mov al, 1
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
xor al, al
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401414a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x14014159a
mov rdx, rcx
lea rcx, [rsp + 0x60]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x14014159a
mov ebp, 4
xor r14d, r14d
mov rdi, qword [rbx + 8]
cmp rdi, qword [rbx]
je 0x140141569
mov rdx, qword [rbx]
mov rcx, rdi
call fcn.140019fc0
test eax, eax
je 0x140141569
cmp byte [rdi], 0
je 0x140141576
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x60]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x140141576
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140016140
mov rdi, qword [rax]
lea rdx, [rbx + 8]
lea rcx, [rsp + 0x70]
call fcn.140016140
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
mov r9d, 6
xor r8d, r8d
mov rdx, rdi
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReplaceFileW]
test eax, eax
je 0x140141586
mov rcx, rbx
call fcn.140119e60
mov al, 1
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rdx, [rbx + 8]
mov rcx, rbx
call fcn.1401456b0
test al, al
jne 0x140141569
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
sub ebp, 1
jns 0x1401414e2
xor al, al
add rsp, 0x30
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1401415b0
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, 4
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x1401415fa
cmp eax, 0xffffffff
je 0x1401415fa
mov rcx, rbx
call fcn.140145790
jmp 0x140141602
mov rcx, rbx
call fcn.140119e60
test al, al
jne 0x140141616
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
sub edi, 1
jns 0x1401415d0
mov rcx, qword [rbx + 8]
sub rcx, 0x10
lea rsi, [0x140592ec8]
mov edi, 0xffffffff
cmp rcx, rsi
je 0x140141640
mov eax, edi
lock xadd dword [rcx], eax
dec eax
cmp eax, edi
jne 0x140141640
call fcn.1400c9d7c
mov rcx, qword [rbx]
sub rcx, 0x10
cmp rcx, rsi
je 0x14014165d
lock xadd dword [rcx], edi
dec edi
cmp edi, 0xffffffff
jne 0x14014165d
call fcn.1400c9d7c
nop
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140142130
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
xor eax, eax
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1401421a2
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14014219e
lea rcx, [rsp + 0x58]
call fcn.14011a340
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rax]
mov qword [rbx + 0x20], rdx
mov qword [rax], rcx
lea rax, [0x140592ec8]
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
cmp rcx, rax
je 0x14014219e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x14014219e
call fcn.1400c9d7c
mov eax, dword [rsp + 0x40]
add qword [rbx + 0x18], rax
add rsp, 0x30
pop rbx
ret
Function at 0x1401432e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x1401434ef
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.140016140
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x1401434ef
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140144ff0
mov r14, rax
mov edx, 0x2e
mov rcx, rdi
call fcn.140134dd0
mov ebx, eax
mov edx, 0x5c
mov rcx, rdi
call fcn.140134dd0
lea rbp, [0x140592ec8]
lea r15, [0x140592ed8]
cmp ebx, eax
jle 0x1401433c2
mov rdx, qword [rdi]
test ebx, ebx
jg 0x14014337d
mov qword [rsp + 0x98], rdx
add rdx, 0xfffffffffffffff0
cmp rdx, rbp
je 0x1401433ca
lock inc dword [rdx]
jmp 0x1401433ca
lea r8d, [rbx - 1]
test r8d, r8d
js 0x1401433b3
movzx ecx, byte [rdx]
test cl, cl
je 0x1401433c2
inc rdx
test cl, cl
jns 0x1401433ad
mov al, 0x40
test al, cl
je 0x1401433ad
nop word [rax + rax]
cmp al, 8
jbe 0x1401433ad
inc rdx
shr al, 1
test al, cl
jne 0x1401433a0
sub r8d, 1
jns 0x140143386
lea rcx, [rsp + 0x98]
call fcn.140018f60
jmp 0x1401433ca
mov qword [rsp + 0x98], r15
mov edx, 0x5c
mov rcx, rdi
call fcn.140134dd0
lea ebx, [rax + 1]
mov edx, 0x2e
mov rcx, rdi
call fcn.140134dd0
cmp eax, ebx
jle 0x140143403
mov r9d, eax
mov r8d, ebx
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.1401332a0
jmp 0x140143462
mov rdx, qword [rdi]
test ebx, ebx
jg 0x140143420
mov qword [rsp + 0x80], rdx
add rdx, 0xfffffffffffffff0
cmp rdx, rbp
je 0x140143462
lock inc dword [rdx]
jmp 0x140143462
lea r8d, [rbx - 1]
movzx ecx, byte [rdx]
test cl, cl
je 0x14014345a
inc rdx
test cl, cl
jns 0x140143445
mov al, 0x40
test al, cl
je 0x140143445
cmp al, 8
jbe 0x140143445
inc rdx
shr al, 1
test al, cl
jne 0x140143438
sub r8d, 1
jns 0x140143424
lea rcx, [rsp + 0x80]
call fcn.140018f60
jmp 0x140143462
mov qword [rsp + 0x80], r15
mov byte [rsp + 0x20], 1
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x80]
mov rdx, rsi
mov rcx, r14
call fcn.140143530
nop
mov rcx, qword [rsp + 0x80]
add rcx, 0xfffffffffffffff0
mov ebx, 0xffffffff
cmp rcx, rbp
je 0x1401434ab
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x1401434ab
call fcn.1400c9d7c
nop
mov rcx, qword [rsp + 0x98]
add rcx, 0xfffffffffffffff0
cmp rcx, rbp
je 0x1401434cf
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1401434cf
call fcn.1400c9d7c
nop
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rbp
je 0x140143508
lock xadd dword [rcx], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x140143508
call fcn.1400c9d7c
jmp 0x140143508
mov rax, qword [rdi]
mov qword [rsi], rax
add rax, 0xfffffffffffffff0
lea rbp, [0x140592ec8]
cmp rax, rbp
je 0x140143508
lock inc dword [rax]
mov rax, rsi
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret