joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400af100
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x290
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rdx
mov rsi, rcx
mov rcx, rbx
lea rdx, [0x1401d2ea4]
mov r8d, 2
call fcn.140144b40
test eax, eax
je 0x1400af157
mov r8d, 2
lea rdx, [0x1401d2ea0]
mov rcx, rbx
call fcn.140144b40
test eax, eax
jne 0x1400af167
movzx eax, byte [rbx + 2]
test al, al
je 0x1400af167
cmp al, 0x2f
je 0x1400af167
cmp al, 0x5c
jne 0x1400af198
movzx ecx, byte [rbx]
call fcn.14014cf10
test eax, eax
je 0x1400af179
cmp byte [rbx + 1], 0x3a
je 0x1400af1a7
lea r9, [rsp + 0x48]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x1400af19f
xor eax, eax
jmp 0x1400af2c0
lea rbx, [rsp + 0x170]
mov r8d, 2
mov qword [rsp + 0x2b0], rdi
mov rdx, rbx
mov qword [rsp + 0x48], rbx
lea rcx, [rsi + 0x10e4c]
call fcn.140144b40
test eax, eax
je 0x1400af2b3
mov rdx, qword [rsp + 0x48]
lea rcx, [rsi + 0x10e4c]
mov r8d, 2
call fcn.1401519a0
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x54]
lea rax, [rsp + 0x50]
mov word [rsi + 0x10e4e], 0x2f
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x40]
mov r8d, 0x104
lea rcx, [rsi + 0x10e4c]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x1400af243
mov byte [rsi + 0x10e4c], al
jmp 0x1400af2b8
xor ebx, ebx
lea rcx, [rsp + 0x60]
cmp dword [rsp + 0x40], 0xc
mov eax, ebx
setbe al
mov dword [rsi + 0x10e50], eax
call fcn.14014606c
mov rcx, rax
lea r8d, [rbx + 4]
lea rdx, str.VFAT
call fcn.140144b40
test eax, eax
je 0x1400af2a8
lea r8d, [rbx + 4]
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call fcn.140144b40
test eax, eax
je 0x1400af2a8
lea r8d, [rbx + 3]
lea rdx, [0x1401d2ee4]
lea rcx, [rsp + 0x60]
call fcn.140144b40
test eax, eax
jne 0x1400af2ad
mov ebx, 1
mov dword [rsi + 0x10e54], ebx
mov eax, 1
mov rdi, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140132620
mov rbx, qword [rsp + 0x2b8]
add rsp, 0x290
pop rsi
ret
Function at 0x1400b2180
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, r8d
mov r14, rdx
mov rbx, rcx
mov ebp, r8d
test r8d, r8d
je 0x1400b2250
mov ecx, dword [rcx + 0x10b28]
test ecx, ecx
jg 0x1400b21f7
mov rdx, qword [rbx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rbx + 0x10b50]
call fcn.14014fd40
mov dword [rbx + 0x10b28], eax
mov ecx, eax
test eax, eax
je 0x1400b224e
js 0x1400b222e
mov rax, qword [rbx + 0x10b18]
add dword [rbx + 0x10b58], 0x2000
mov qword [rbx + 0x10b20], rax
mov rdx, qword [rbx + 0x10b20]
cmp esi, ecx
mov eax, esi
cmovae eax, ecx
mov rcx, r14
mov r8d, eax
mov edi, eax
call fcn.140134960
sub dword [rbx + 0x10b28], edi
add r14, rdi
add qword [rbx + 0x10b20], rdi
mov ecx, dword [rbx + 0x10b28]
sub esi, edi
jne 0x1400b21b5
jmp 0x1400b2250
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
xor eax, eax
jmp 0x1400b2252
sub ebp, esi
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400b2270
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x10c00], 0
mov rbx, rcx
jne 0x1400b229e
mov eax, dword [rcx + 0xa0]
test eax, eax
jg 0x1400b22a9
dec eax
xor r8d, r8d
mov dword [rcx + 0xa0], eax
mov dword [rcx + 0x10b28], r8d
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov r8d, dword [rcx + 0x10b28]
test r8d, r8d
jg 0x1400b235f
mov rdx, qword [rcx + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rcx + 0x10b50]
call fcn.14014fd40
mov dword [rbx + 0x10b28], eax
mov ecx, eax
test eax, eax
jne 0x1400b22f0
xor r8d, r8d
lea eax, [rcx - 1]
mov dword [rbx + 0x10b28], r8d
add rsp, 0x20
pop rbx
ret
test ecx, ecx
js 0x1400b243a
mov r8d, dword [rbx + 0xa0]
mov edx, r8d
add dword [rbx + 0x10b58], 0x2000
mov r9, qword [rbx + 0x10b18]
mov qword [rbx + 0x10b20], r9
cmp ecx, r8d
jle 0x1400b2343
test r8d, r8d
jns 0x1400b232a
xor r8d, r8d
mov edx, r8d
mov eax, r8d
add rax, r9
mov dword [rbx + 0x10b28], r8d
mov qword [rbx + 0x10e28], rax
sub ecx, r8d
jmp 0x1400b2350
xor r8d, r8d
mov ecx, r8d
mov r8d, dword [rbx + 0x10b28]
sub edx, r8d
mov dword [rbx + 0x10e20], ecx
mov dword [rbx + 0xa0], edx
mov rax, qword [rbx + 0xb00]
mov ecx, r8d
test byte [rax + 0x18], 1
je 0x1400b2415
mov r9, qword [rbx + 0x10b20]
test r8d, r8d
je 0x1400b2415
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rbx + 0x10d74]
lea r9, [r9 + 1]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
shr eax, 8
xor byte [r9 - 1], al
movzx eax, byte [r9 - 1]
mov ecx, dword [rbx + 0x10d6c]
xor rax, rcx
mov rdx, qword [rbx + 0x10b08]
movzx eax, al
shr ecx, 8
xor ecx, dword [rdx + rax*4]
movzx eax, cl
add eax, dword [rbx + 0x10d70]
imul eax, eax, 0x8088405
mov dword [rbx + 0x10d6c], ecx
mov ecx, dword [rbx + 0x10d74]
inc eax
mov dword [rbx + 0x10d70], eax
shr rax, 0x18
xor rax, rcx
shr ecx, 8
movzx eax, al
xor ecx, dword [rdx + rax*4]
mov dword [rbx + 0x10d74], ecx
sub r8d, 1
jne 0x1400b2390
mov ecx, dword [rbx + 0x10b28]
lea eax, [rcx - 1]
mov dword [rbx + 0x10b28], eax
mov rax, qword [rbx + 0x10b20]
movzx ecx, byte [rax]
inc rax
mov qword [rbx + 0x10b20], rax
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov r9d, 0x401
lea rdx, str.error:__zipfile_read_error_n
mov r8d, 0x1b
mov rcx, rbx
call qword [rbx + 0x10df0]
mov edx, 1
lea rcx, [0x1401fcd20]
call fcn.140135278
int3
Function at 0x1400b2470
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, dword [rcx + 0x10b5c]
add ecx, edx
mov ebx, ecx
and ebx, 0x80001fff
jge 0x1400b2499
dec ebx
or ebx, 0xffffe000
inc ebx
mov edx, ecx
sub edx, ebx
test ecx, ecx
jns 0x1400b24eb
mov r8, qword [rdi + 0x10b48]
lea r9, str.___please_check_that_you_have_transferred_or_created_the_zipfile_in_the_n__appropriate_BINARY_mode_and_that_you_have_compiled_UnZip_properly__n
lea rdx, str.error___s_:__attempt_to_seek_before_beginning_of_zipfile_n_s
lea rcx, [rdi + 0xb08]
call fcn.1400ac6e0
mov r8d, eax
lea rdx, [rdi + 0xb08]
mov r9d, 1
mov rcx, rdi
call qword [rdi + 0x10df0]
mov eax, 3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp edx, dword [rdi + 0x10b58]
je 0x1400b2547
mov ecx, dword [rdi + 0x10b50]
xor r8d, r8d
call fcn.1401509dc
mov rdx, qword [rdi + 0x10b18]
mov r8d, 0x2000
mov ecx, dword [rdi + 0x10b50]
mov dword [rdi + 0x10b58], eax
call fcn.14014fd40
mov dword [rdi + 0x10b28], eax
test eax, eax
jg 0x1400b2539
mov eax, gethostbyname
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movsxd rcx, ebx
add rcx, qword [rdi + 0x10b18]
sub eax, ebx
jmp 0x1400b2565
mov eax, dword [rdi + 0x10b20]
sub eax, dword [rdi + 0x10b18]
movsxd rcx, ebx
sub eax, ebx
add rcx, qword [rdi + 0x10b18]
add eax, dword [rdi + 0x10b28]
mov dword [rdi + 0x10b28], eax
xor eax, eax
mov qword [rdi + 0x10b20], rcx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400b7000
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [reloc.WS2_32.dll_accept], 0
je 0x1400b7067
lea r11, [0x14023e530]
xor r8d, r8d
mov r10, r11
nop word [rax + rax]
mov eax, r8d
mov r9d, 8
nop dword [rax]
mov edx, eax
mov ecx, eax
shr edx, 1
mov eax, edx
xor eax, 0xedb88320
and cl, 1
cmove eax, edx
sub r9d, 1
jne 0x1400b7030
mov dword [r10], eax
inc r8d
add r10, 4
cmp r8d, 0x100
jl 0x1400b7020
mov dword [reloc.WS2_32.dll_accept], r9d
mov rax, r11
ret
lea rax, [0x14023e530]
ret
Function at 0x1400bc0c0
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp dword [0x1401fbe4c], 0
je 0x1400bc0f6
mov eax, 1
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140132620
add rsp, 0x50
pop rbx
ret
mov ebx, 1
mov qword [rsp + 0x60], rsi
mov edx, ebx
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rax, rax
je 0x1400bc276
xchg dword [0x1401fc098], eax
mov qword [rsp + 0x68], rdi
movsxd rdi, eax
test eax, eax
je 0x1400bc15e
mov eax, edi
mov rcx, rsi
xchg dword [0x1401fc098], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [0x1401fbe4c]
jmp 0x1400bc271
lea rcx, [0x14028c020]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor edx, edx
lea rcx, [0x140259600]
mov r8d, 0x120
call fcn.140135010
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x1400bc260
lea r8, [rsp + 0x3c]
mov dword [rsp + 0x38], ebx
lea rdx, str.SeRestorePrivilege
mov dword [rsp + 0x44], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
xor edi, edi
test eax, eax
je 0x1400bc1fb
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400bc1fb
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1400bc1fb
mov dword [0x1401fbe48], ebx
jmp 0x1400bc255
cmp dword [0x1401fbe48], edi
jne 0x1400bc255
lea r8, [rsp + 0x3c]
xor ecx, ecx
lea rdx, str.SeSecurityPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x1400bc255
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400bc255
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [0x1401fbc3c]
test eax, eax
cmove ecx, ebx
mov dword [0x1401fbc3c], ecx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov dword [0x1401fbe4c], ebx
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140132620
add rsp, 0x50
pop rbx
ret
Function at 0x1400bcf90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov ebx, ecx
test rdx, rdx
jne 0x1400bcfbe
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call fcn.1400b7000
mov rdx, rax
not ebx
cmp rsi, 8
jb 0x1400bd07d
mov r8, rsi
shr r8, 3
imul rcx, r8, 0xfffffffffffffff8
add rsi, rcx
movzx ecx, byte [rdi]
mov eax, ebx
xor rcx, rax
shr ebx, 8
movzx eax, cl
movzx ecx, byte [rdi + 1]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 2]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 3]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 4]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 5]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 6]
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [rdi + 7]
add rdi, 8
xor ebx, dword [rdx + rax*4]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
xor ebx, dword [rdx + rax*4]
sub r8, 1
jne 0x1400bcfe0
test rsi, rsi
je 0x1400bd0ab
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rdi]
lea rdi, [rdi + 1]
mov eax, ebx
shr ebx, 8
xor rcx, rax
movzx eax, cl
xor ebx, dword [rdx + rax*4]
sub rsi, 1
jne 0x1400bd090
mov rsi, qword [rsp + 0x38]
not ebx
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400c4410
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r14
push r15
sub rsp, 0x60
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [0x14023e528]
lea rdx, [rsp + 0x20]
mov rbp, rcx
call fcn.1400c4e90
test eax, eax
jne 0x1400c445e
cmp word [rsp + 0x28], 1
jg 0x1400c447b
mov rcx, rbp
call fcn.140152bf8
test eax, eax
jne 0x1400c44d3
mov rdx, rbp
mov rcx, r14
call fcn.140155b90
test eax, eax
je 0x1400c45a8
call fcn.140153b6c
cmp dword [rax], 0x12
jne 0x1400c44d3
lea rdx, [0x1401c8158]
mov rcx, r14
call fcn.140145c84
mov rsi, rax
test rax, rax
jne 0x1400c44b4
lea ecx, [rax + 2]
call fcn.140146238
mov rcx, rax
lea rdx, str._replace:_cant_open__s_n
mov r8, r14
call fcn.140056760
lea eax, [rsi + 0xa]
jmp 0x1400c45aa
lea rdx, [0x1401d3c80]
mov rcx, rbp
call fcn.140145c84
mov r15, rax
test rax, rax
jne 0x1400c44dd
mov rcx, rsi
call fcn.140145db0
mov eax, recv
jmp 0x1400c45aa
mov ecx, 0x4000
call fcn.14013b328
mov rbx, rax
test rax, rax
jne 0x1400c44f7
lea ebx, [rax + 4]
jmp 0x1400c4588
mov qword [rsp + 0x88], rdi
nop
mov r9, rsi
mov edx, 1
mov r8d, 0x4000
mov rcx, rbx
call fcn.14015632c
mov rdi, rax
test rax, rax
je 0x1400c455e
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbx
call fcn.140156028
cmp rax, rdi
je 0x1400c4500
mov rcx, rbx
call fcn.140139270
mov ecx, 2
call fcn.140146238
mov rcx, rax
lea rdx, str._fcopy:_write_error_n
call fcn.140056760
mov ebx, 0xa
jmp 0x1400c4580
mov rcx, rsi
call fcn.140155358
mov rcx, rbx
test eax, eax
je 0x1400c4579
call fcn.140139270
mov ebx, reloc.WS2_32.dll_inet_addr
jmp 0x1400c4580
call fcn.140139270
xor ebx, ebx
mov rdi, qword [rsp + 0x88]
mov rcx, rsi
call fcn.140145db0
mov rcx, r15
call fcn.140145db0
test eax, eax
jne 0x1400c45cd
test ebx, ebx
jne 0x1400c45cd
mov rcx, r14
call fcn.140152bf8
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140132620
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rsi
ret
mov rcx, rbp
call fcn.140152bf8
test ebx, ebx
je 0x1400c45e8
mov eax, recv
cmp ebx, 0xa
cmove ebx, eax
mov eax, ebx
jmp 0x1400c45aa
mov ebx, recv
mov eax, ebx
jmp 0x1400c45aa
Function at 0x1400c4600
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov esi, r8d
mov ecx, 0x4000
mov r15, rdx
call fcn.14013b328
mov rbp, rax
test rax, rax
jne 0x1400c463b
lea eax, [rbp + 4]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov qword [rsp + 0x40], rbx
xor ebx, ebx
mov qword [rsp + 0x48], rdi
cmp esi, 0xffffffff
je 0x1400c4662
cmp ebx, esi
jae 0x1400c46df
mov eax, esi
sub eax, ebx
mov r8d, eax
cmp eax, 0x4000
jb 0x1400c4668
mov r8d, 0x4000
mov r9, r14
mov edx, 1
mov rcx, rbp
call fcn.14015632c
mov rdi, rax
test rax, rax
je 0x1400c46c4
mov r9, r15
mov r8, rax
mov edx, 1
mov rcx, rbp
call fcn.140156028
cmp rax, rdi
jne 0x1400c469c
add ebx, edi
jmp 0x1400c4647
mov rcx, rbp
call fcn.140139270
mov ecx, 2
call fcn.140146238
mov rcx, rax
lea rdx, str._fcopy:_write_error_n
call fcn.140056760
mov eax, 0xa
jmp 0x1400c46e9
mov rcx, r14
call fcn.140155358
test eax, eax
je 0x1400c46df
mov rcx, rbp
call fcn.140139270
mov eax, reloc.WS2_32.dll_inet_addr
jmp 0x1400c46e9
mov rcx, rbp
call fcn.140139270
xor eax, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret

Function at 0x1400c4c60
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x290
mov rax, qword [0x1401ef010]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rbx, rcx
movzx ecx, byte [rcx]
call fcn.14014cf10
test eax, eax
je 0x1400c4c90
cmp byte [rbx + 1], 0x3a
je 0x1400c4cb3
lea r9, [rsp + 0x50]
mov edx, 0x104
lea r8, [rsp + 0x170]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
lea rbx, [rsp + 0x170]
mov r8d, 3
mov qword [rsp + 0x50], rbx
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.1401519a0
mov dword [rsp + 0x38], 0x104
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x4c]
lea rax, [rsp + 0x44]
mov byte [rsp + 0x43], 0
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x170]
lea rax, [rsp + 0x48]
mov r8d, 0x104
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rsp + 0x60]
call fcn.14014606c
mov rcx, rax
lea rdx, [0x1401d2ee4]
mov r8d, 3
call fcn.140144b40
test eax, eax
je 0x1400c4d71
mov r8d, 4
lea rdx, str.VFAT
lea rcx, [rsp + 0x60]
call fcn.140144b40
test eax, eax
je 0x1400c4d71
mov r8d, 4
lea rdx, str.HPFS
lea rcx, [rsp + 0x60]
call fcn.140144b40
test eax, eax
je 0x1400c4d71
xor eax, eax
jmp 0x1400c4d76
mov eax, 1
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140132620
add rsp, 0x290
pop rbx
ret
Function at 0x1400c5a50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov eax, dword [0x1401fcf4c]
mov rbx, rcx
mov ecx, dword [0x14023e9a8]
test eax, eax
jne 0x1400c5a9e
mov r8d, edx
mov rdx, rbx
call fcn.14014fd40
mov edi, eax
lea ecx, [rax + 1]
test ecx, 0xfffffffe
jne 0x1400c5b6d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp eax, 1
jne 0x1400c5af7
shr edx, 1
mov esi, edx
mov r8d, edx
add rsi, rbx
mov rdx, rsi
call fcn.14014fd40
mov edi, eax
mov ecx, eax
dec eax
cmp eax, 0xfffffffd
ja 0x1400c5b96
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
mov byte [rbx], al
inc rbx
cmp al, 0xa
jne 0x1400c5aeb
mov word [rbx - 1], 0xa0d
inc rbx
inc edi
add ecx, 0xffffffff
jne 0x1400c5ad0
mov eax, edi
sub rbx, rax
jmp 0x1400c5b6d
lea r8d, [rdx - 1]
mov rsi, rbx
mov rdx, rbx
call fcn.14014fd40
mov edi, eax
mov ecx, eax
lea eax, [rdi - 1]
cmp eax, 0xfffffffd
ja 0x1400c5b96
mov byte [rdi + rbx], 0xa
nop word [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
mov byte [rbx], al
mov rdx, rbx
inc rbx
cmp al, 0xd
jne 0x1400c5b3d
cmp byte [rsi], 0xa
jne 0x1400c5b3d
mov rbx, rdx
dec edi
add ecx, 0xffffffff
jne 0x1400c5b20
test edi, edi
jne 0x1400c5b5e
mov ecx, dword [0x14023e9a8]
mov edi, 1
mov r8d, edi
mov rdx, rbx
call fcn.14014fd40
jmp 0x1400c5b6d
mov eax, edi
lea ecx, [rdi - 1]
sub rbx, rax
cmp byte [rcx + rbx], 0x1a
cmove edi, ecx
mov ecx, dword [0x14023e9a0]
mov r8d, edi
mov rdx, rbx
call fcn.1400bcf90
mov dword [0x14023e9a0], eax
mov eax, dword [0x14023edb8]
add eax, edi
mov dword [0x14023edb8], eax
cmp eax, edi
jb 0x1400c5ba8
mov rbx, qword [rsp + 0x30]
mov eax, edi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
lea rdx, str.file_exceeds_Zips_4GB_uncompressed_size_limit
mov ecx, 6
call fcn.1400c0560
int3
Function at 0x1400c62d0
Capabilities:
Get disk information
Resolve function by parsing pe exports

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
cmp dword [0x1401fcf58], 1
mov rbx, rcx
jne 0x1400c63fb
xor esi, esi
mov dword [0x1401fcf58], 2
test rcx, rcx
je 0x1400c6313
movzx eax, byte [rcx]
cmp al, 0x80
jae 0x1400c6313
cmp byte [rcx + 1], 0x3a
jne 0x1400c6313
lea rcx, [0x1402898e0]
movzx edi, byte [rax + rcx]
jmp 0x1400c6315
mov edi, esi
xor ecx, ecx
mov dword [0x14023edc0], 0x28
mov dword [0x14023edc4], 0x210000
call fcn.14013b450
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call fcn.1401524c4
mov rcx, rax
mov dword [rax + 0x20], 0xffffffff
mov qword [rax], rsi
mov dword [rax + 8], esi
mov qword [rax + 0xc], 1
mov dword [rax + 0x14], 0x50
call fcn.1401514b8
mov qword [0x14023edc8], rax
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x38], esi
lea rax, [rsp + 0x80]
test edi, edi
mov dword [rsp + 0x78], 0x5c3a78
mov byte [rsp + 0x78], dil
lea rdi, [0x14023e988]
cmove rcx, rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x88]
mov rdx, rdi
mov qword [rsp + 0x20], rax
lea r8d, [r9 + 0xd]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x1400c63d4
xor r8d, r8d
mov qword [0x1401fce28], rdi
mov rcx, rdi
call fcn.1400c3e70
jmp 0x1400c63db
mov qword [0x1401fce28], rsi
test rbx, rbx
je 0x1400c63f1
cmp byte [rbx], 0x80
jae 0x1400c63fb
cmp byte [rbx + 1], 0x3a
jne 0x1400c63fb
cmp byte [rbx + 2], sil
jne 0x1400c63fb
xor eax, eax
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
cmp byte [rbx], 0x2d
jne 0x1400c6418
cmp byte [rbx + 1], 0
jne 0x1400c6418
xor r8d, r8d
mov rcx, rbx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
jmp fcn.1400c3e70
mov rcx, 0xffffffffffffffff
nop
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1400c6420
add rcx, 2
call fcn.14013b328
mov rdi, rax
test rax, rax
jne 0x1400c6445
lea eax, [rdi + 4]
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
mov rcx, rdi
sub rcx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400c6450
movzx eax, byte [rdi]
mov rbx, rdi
test al, al
je 0x1400c648f
cmp al, 0x5c
jne 0x1400c646f
mov byte [rbx], 0x2f
call fcn.140151b34
movsxd rdx, eax
mov rcx, rbx
call fcn.1401518f8
movsxd rcx, eax
add rbx, rcx
movzx eax, byte [rbx]
test al, al
jne 0x1400c6468
movzx eax, byte [rdi]
mov rbx, rdi
test al, al
je 0x1400c64b7
cmp al, 0x3a
je 0x1400c64d9
call fcn.140151b34
movsxd rdx, eax
mov rcx, rbx
call fcn.1401518f8
movsxd rcx, eax
add rbx, rcx
movzx eax, byte [rbx]
test al, al
jne 0x1400c6496
mov rsi, rdi
mov rdx, rsi
mov rcx, rdi
call fcn.1400c5ee0
mov rcx, rdi
mov ebx, eax
call fcn.140139270
mov eax, ebx
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
movzx eax, byte [rbx + 1]
lea rsi, [rbx + 1]
mov rbx, rsi
test al, al
je 0x1400c6509
cmp al, 0x3a
je 0x1400c651d
call fcn.140151b34
movsxd rdx, eax
mov rcx, rbx
call fcn.1401518f8
movsxd rcx, eax
add rbx, rcx
movzx eax, byte [rbx]
test al, al
jne 0x1400c64e8
cmp rsi, rdi
jbe 0x1400c64ba
cmp byte [rsi], 0
jne 0x1400c64ba
mov eax, 0x2e
mov word [rsi], ax
jmp 0x1400c64ba
mov eax, 0xffffffff
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1400ca970
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov r10, rcx
mov eax, 0x12345678
movzx ecx, byte [rcx]
mov r9d, 0x23456789
mov dword [0x14023ede8], eax
mov r8d, 0x34567890
mov dword [0x14023edec], r9d
mov dword [0x14023edf0], r8d
test cl, cl
je 0x1400caa0a
mov r11, qword [0x140289e90]
nop word [rax + rax]
xor rcx, qword [0x14023ede8]
lea r10, [r10 + 1]
movzx edx, cl
shr eax, 8
shr r8d, 8
xor eax, dword [r11 + rdx*4]
movzx ecx, al
add ecx, r9d
mov dword [0x14023ede8], eax
imul r9d, ecx, 0x8088405
inc r9d
mov ecx, r9d
mov dword [0x14023edec], r9d
shr rcx, 0x18
xor rcx, qword [0x14023edf0]
movzx ecx, cl
xor r8d, dword [r11 + rcx*4]
movzx ecx, byte [r10]
mov dword [0x14023edf0], r8d
test cl, cl
jne 0x1400ca9b0
ret
Function at 0x1400cad00
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
cmp qword [0x1401fcf88], 0
mov r15, r9
mov rdi, r8
mov rsi, rcx
je 0x1400cadec
mov qword [rsp + 0x40], rbx
mov rbx, rcx
mov r11d, edi
test edi, edi
je 0x1400cade7
mov r9d, dword [0x14023edf0]
mov r10d, dword [0x14023ede8]
mov qword [rsp + 0x48], rbp
mov ebp, dword [0x14023edec]
mov qword [rsp + 0x50], r14
mov r14, qword [0x140289e90]
nop dword [rax + rax]
movsx rdx, byte [rbx]
lea rbx, [rbx + 1]
mov r8d, r9d
shr r10d, 8
and r8d, 0xfffd
shr r9d, 8
or r8d, 2
mov rax, rdx
xor rax, qword [0x14023ede8]
movzx ecx, al
xor r10d, dword [r14 + rcx*4]
movzx eax, r10b
add eax, ebp
mov dword [0x14023ede8], r10d
imul ebp, eax, 0x8088405
inc ebp
mov eax, ebp
mov dword [0x14023edec], ebp
shr rax, 0x18
xor rax, qword [0x14023edf0]
movzx eax, al
xor r9d, dword [r14 + rax*4]
mov eax, r8d
xor eax, 1
mov dword [0x14023edf0], r9d
imul eax, r8d
shr eax, 8
xor al, dl
mov byte [rbx - 1], al
add r11d, 0xffffffff
jne 0x1400cad60
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r9, r15
mov r8, rdi
mov edx, 1
mov rcx, rsi
add rsp, 0x20
pop r15
pop rdi
pop rsi
jmp fcn.140156028