joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007b1f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov esi, r14d
mov ebp, r14d
mov rdi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl esi, cl
add esi, esi
nop word [rax + rax]
mov r10, qword [rdi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14007b294
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14007b250
mov ecx, dword [r10]
jmp 0x14007b377
cmp ecx, 0x4e0
jb 0x14007b377
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007b2b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007b300
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov ecx, edx
shr ecx, 0x12
xor ecx, edx
cmp ecx, dword [rdi + 0x10]
ja 0x14007b230
mov rax, qword [rdi + 8]
or esi, ecx
add rbp, rax
cmp rbp, 0x20
jb 0x14007b220
mov rbx, qword [rsp + 0x10]
mov eax, esi
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x28]
pop r14
ret
Function at 0x14007b3f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
mov rax, qword [rcx + 8]
xor r14d, r14d
mov edi, r14d
mov ebp, r14d
mov rsi, rcx
nop word [rax + rax]
lea ecx, [rax + 0xff]
shl rdi, cl
add rdi, rdi
nop dword [rax]
mov r10, qword [rsi]
mov ecx, dword [r10]
cmp ecx, 0x270
jne 0x14007b494
lea rax, [r10 + 8]
mov r9d, ecx
nop word [rax + rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r9, 1
jne 0x14007b450
mov ecx, dword [r10]
jmp 0x14007b577
cmp ecx, 0x4e0
jb 0x14007b577
lea r11, [r10 + 0x9c4]
mov ebx, 0xe3
mov eax, dword [r11]
nop
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007b4b0
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop word [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x14007b500
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov ecx, r14d
mov dword [r10], r14d
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r10], eax
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rdx, rcx
shr rdx, 0x12
xor rdx, rcx
cmp rdx, qword [rsi + 0x10]
ja 0x14007b430
mov rax, qword [rsi + 8]
or rdi, rdx
add rbp, rax
cmp rbp, 0x40
jb 0x14007b420
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop r14
ret
Function at 0x140082f90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r11, qword [r8 + 0x18]
mov r14, r8
mov rbp, qword [r8 + 0x10]
mov r12, rdx
mov rdi, rcx
mov r10, r8
cmp r11, 0x10
jb 0x140082fc4
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test rbp, rbp
je 0x140082ff4
movabs rcx, 0x100000001b3
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, rbp
jb 0x140082fe0
mov rax, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x30]
mov rdi, qword [rdi + 8]
and rcx, r9
add rcx, rcx
mov qword [rsp + 0x50], rsi
mov r15, qword [rax + rcx*8]
lea r13, [rax + rcx*8]
mov rbx, r15
cmp r15, rdi
jne 0x140083020
mov rax, rdi
jmp 0x140083027
mov rax, qword [r13 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400830c3
lea rcx, [rbx + 0x10]
mov rdx, r14
cmp r11, 0x10
jb 0x140083040
mov rdx, qword [r14]
cmp qword [rcx + 0x18], 0x10
mov r8, qword [rcx + 0x10]
jb 0x14008304e
mov rcx, qword [rcx]
cmp r8, rbp
jne 0x140083060
call fcn.140187a30
test eax, eax
je 0x140083065
mov r11, qword [r14 + 0x18]
mov rbx, qword [rbx]
jmp 0x140083016
mov rsi, rbx
cmp r15, rdi
jne 0x140083072
mov rax, rdi
jmp 0x140083079
mov rax, qword [r13 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1400830b3
cmp qword [rbx + 0x28], 0x10
lea rdx, [rbx + 0x10]
mov rax, qword [rdx + 0x10]
jb 0x140083090
mov rdx, qword [rdx]
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
jb 0x14008309d
mov rcx, qword [r14]
cmp rbp, rax
jne 0x1400830b3
mov r8, rbp
call fcn.140187a30
test eax, eax
jne 0x1400830b3
mov rbx, qword [rbx]
jmp 0x140083068
cmp rsi, rbx
je 0x1400830c3
mov qword [r12], rsi
mov qword [r12 + 8], rbx
jmp 0x1400830cc
mov qword [r12], rdi
mov qword [r12 + 8], rdi
mov rsi, qword [rsp + 0x50]
mov rax, r12
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140083190
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r11, [r8 + 0x10]
mov rbx, qword [r11 + 0x10]
mov rsi, rdx
mov rdi, rcx
jb 0x1400831b7
mov r11, qword [r11]
xor r9d, r9d
movabs r10, 0xcbf29ce484222325
test rbx, rbx
je 0x1400831f4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + r11]
inc r9
xor r10, rax
imul r10, rcx
cmp r9, rbx
jb 0x1400831e0
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x18]
and rdx, r10
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x140083234
cmp rax, r8
jne 0x14008322a
mov rax, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x14008323f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x14008323f
cmp rax, r8
jne 0x14008323f
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
lea rcx, [rdi + 8]
mov rbx, qword [r8]
mov qword [rax], rbx
mov rdx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rdx + 8], rax
mov rdx, r8
dec qword [rcx + 8]
call fcn.14007b180
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140084920
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, byte [r8]
mov r10, rcx
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r9, rax
mov rbx, rdx
movzx eax, byte [r8 + 1]
mov r11, r8
mov rdx, qword [r10 + 0x30]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 2]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 3]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 4]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 5]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 6]
imul r9, rcx
xor r9, rax
movzx eax, byte [r8 + 7]
mov r8, qword [r10 + 8]
imul r9, rcx
xor r9, rax
mov rax, qword [r10 + 0x18]
imul r9, rcx
and rdx, r9
add rdx, rdx
mov r9, qword [rax + rdx*8]
lea r10, [rax + rdx*8]
mov rcx, r9
nop
cmp r9, r8
jne 0x1400849ca
mov rax, r8
jmp 0x1400849d1
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x1400849f0
mov rax, qword [r11]
cmp qword [rcx + 0x10], rax
je 0x1400849e4
mov rcx, qword [rcx]
jmp 0x1400849c0
mov qword [rbx], rcx
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
mov qword [rbx], r8
mov rax, rbx
mov rbx, qword [rsp + 8]
ret
Function at 0x1400884c0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x1d0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rbx, rdx
mov rdi, rcx
add rcx, 0xffffffffffffffe0
call fcn.140092070
lea rcx, [rdi - 0x20]
call fcn.140092110
lea rsi, [rdi + 0x200]
lea rax, [rsi + 0x60]
mov ecx, 0x78
test rsi, rsi
cmove rax, rcx
cmp qword [rax], rbx
jbe 0x1400886c8
movzx ecx, bl
movabs rax, 0xcbf29ce484222325
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
movzx eax, byte [rsp + 0x1f9]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x1fa]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x1fb]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x1fc]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x1fd]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x1fe]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rsp + 0x1ff]
xor rcx, rax
imul rcx, rdx
mov rdx, qword [rdi + 0x2b0]
and rdx, rcx
add rdx, rdx
mov rcx, qword [rdi + 0x298]
mov r9, qword [rcx + rdx*8]
mov rax, r9
mov r8, qword [rdi + 0x288]
lea r10, [rcx + rdx*8]
cmp r9, r8
jne 0x1400885d2
mov rcx, r8
jmp 0x1400885d9
mov rcx, qword [r10 + 8]
mov rcx, qword [rcx]
cmp rax, rcx
je 0x1400885e9
cmp qword [rax + 0x10], rbx
je 0x1400885ec
mov rax, qword [rax]
jmp 0x1400885c8
mov rax, r8
cmp rax, r8
je 0x1400885fa
movzx eax, byte [rax + 0x18]
jmp 0x1400886a3
mov rax, qword [rdi + 0x258]
mov r8, qword [rax + rbx*8]
lea rdx, [r8 - 0xa8]
xor eax, eax
test r8, r8
cmove rdx, rax
lea rcx, [rdi - 0x20]
call fcn.140088060
mov byte [rsp + 0x1f0], al
lea rsi, [rdi + 0x280]
mov rax, qword [rsi + 8]
mov rdi, qword [rax]
mov r14, qword [rdi + 8]
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x1f8]
mov r8, r14
mov rdx, rdi
lea rcx, [rsi + 8]
call fcn.140068000
mov rdx, rax
mov rax, qword [rsi + 0x10]
movabs rcx, 0x7fffffffffffffe
sub rcx, rax
cmp rcx, 1
jb 0x1400886bb
inc rax
mov qword [rsi + 0x10], rax
mov qword [rdi + 8], rdx
mov qword [r14], rdx
mov r9, qword [rsi + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call fcn.14006aed0
movzx eax, byte [rsp + 0x1f0]
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
lea rcx, str.list_T__too_long
call fcn.140149b70
int3
lea rcx, [rdi + 0x20]
lea r9, [0x1402b37d0]
mov r8d, 1
lea rdx, [rsp + 0x88]
call fcn.14011cd40
nop
lea rdx, str.Failed_to_check_transaction:_invalid_index
mov rcx, rax
call fcn.140067a10
mov rcx, rax
lea rdx, [rsp + 0x1f8]
call fcn.140067cd0
mov rcx, rax
lea rdx, str.._Number_of_transactions:
call fcn.140067a10
mov rbx, rax
mov rcx, rsi
call fcn.140091660
mov qword [rsp + 0x1f8], rax
lea rdx, [rsp + 0x1f8]
mov rcx, rbx
call fcn.140067cd0
nop
lea rcx, [rsp + 0x88]
call fcn.1400788b0
mov edx, reloc.WS2_32.dll_send
lea rcx, [rsp + 0x50]
call fcn.140066d20
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14002b110
lea rdx, [0x1402aaeb0]
lea rcx, [rsp + 0x60]
call fcn.140187364
int3
Function at 0x1400f5940
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r10, [r8 + 0x10]
mov r11, qword [r8 + 0x20]
mov rdi, r8
mov r15, rdx
mov rsi, rcx
jb 0x1400f5976
mov r10, qword [r8 + 0x10]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x1400f59b4
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x1400f59a0
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x1400f59f4
cmp rax, rdi
jne 0x1400f59ea
mov rax, qword [rsi + 8]
mov qword [rcx], rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x1400f59ff
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x1400f59ff
cmp rax, rdi
jne 0x1400f59ff
mov rax, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [rsi + 0x10]
call fcn.1400fa6f0
mov edx, 0x78
mov rcx, rdi
call fcn.140169b20
mov rsi, qword [rsp + 0x38]
mov rax, r15
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov qword [r15], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r15
ret

Function at 0x140101920
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
cmp qword [rdx + 0x18], 0x10
mov r9, qword [rdx + 0x10]
jb 0x14010192e
mov rdx, qword [rdx]
xor r8d, r8d
movabs rax, 0xcbf29ce484222325
test r9, r9
je 0x140101964
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
inc r8
xor rax, rcx
imul rax, r10
cmp r8, r9
jb 0x140101950
ret

Function at 0x140111560
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov dword [rsp + 0x20], 0
mov rdi, rcx
call fcn.14010d830
cmp qword [rdi + 0x18], 8
mov rcx, rdi
mov qword [rsp + 0x28], rax
jb 0x140111599
mov rcx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1401115c0
lea r8, [rsp + 0x20]
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140111430
mov esi, dword [rsp + 0x20]
mov ebx, dword [rax]
jmp 0x1401115fb
xor esi, esi
call fcn.14010d830
bt ebx, 0xa
jae 0x1401115f2
mov rcx, rdi
call fcn.1401111f0
test al, al
je 0x1401115eb
test bl, 0x10
mov eax, reloc.WS2_32.dll_inet_addr
mov ebx, 4
cmovne ebx, eax
jmp 0x1401115fb
mov ebx, 9
jmp 0x1401115ff
and ebx, 0x10
or ebx, 0x20
shr ebx, 4
test ebx, ebx
je 0x140111601
xor esi, esi
lea r9, str.boost::filesystem::remove
mov r8, rbp
mov rdx, rdi
mov ecx, esi
call fcn.140111120
test al, al
je 0x14011161d
xor al, al
jmp 0x14011162a
mov r8, rbp
mov edx, ebx
mov rcx, rdi
call fcn.140111640
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140111640
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
cmp edx, 1
jne 0x140111679
test r8, r8
je 0x14011172d
xor eax, eax
mov dword [r8], eax
call fcn.14010d830
mov qword [rdi + 8], rax
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea eax, [rdx - 3]
test eax, 0xfffffff7
je 0x1401116cb
cmp qword [rcx + 0x18], 8
jb 0x14011168d
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140111713
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x1401116b2
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140111713
cmp eax, 0x7b
je 0x140111713
cmp eax, 0x57
je 0x140111713
cmp eax, 0xa1
je 0x140111713
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140111715
cmp qword [rcx + 0x18], 8
jb 0x1401116d5
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140111713
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x35
ja 0x1401116fa
movabs rdx, 0x2000000020800c
bt rdx, rax
jb 0x140111713
cmp eax, 0x7b
je 0x140111713
cmp eax, 0x57
je 0x140111713
cmp eax, 0xa1
je 0x140111713
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140111715
xor eax, eax
lea r9, str.boost::filesystem::remove
mov r8, rdi
mov rdx, rbx
mov ecx, eax
call fcn.140111120
test al, al
je 0x14011173a
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140111750
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
jb 0x140111772
mov rdx, qword [rdx]
cmp qword [rcx + 0x18], 8
jb 0x14011177c
mov rcx, qword [rcx]
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x140111794
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140111796
xor eax, eax
lea rcx, str.boost::filesystem::rename
mov r9, rsi
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov ecx, eax
mov rdx, rbx
call fcn.140111030
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140111850
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0xc8], rbx
mov rax, qword [0x1402b4298]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, r8
mov rdi, rdx
mov rsi, rcx
mov rcx, rdx
cmp qword [rdx + 0x18], 8
jb 0x140111895
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov r15d, eax
cmp eax, 0xffffffff
jne 0x1401118b6
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140111430
jmp 0x1401119dd
xor ebp, ebp
bt r15d, 0xa
jae 0x14011199a
mov rdx, rdi
cmp qword [rdi + 0x18], 8
jb 0x1401118d0
mov rdx, qword [rdi]
movdqa xmm0, xmmword [0x1401ebaf0]
movdqu xmmword [rsp + 0x60], xmm0
mov word [rsp + 0x50], bp
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], bp
jne 0x1401118f0
lea rcx, [rsp + 0x50]
call fcn.14010edb0
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x2000000
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x50]
call fcn.14007c840
nop
cmp rbx, 0xffffffffffffffff
jne 0x140111964
mov r8, r14
mov rdx, rdi
mov rcx, rsi
call fcn.140111430
nop
jmp 0x1401119dd
mov rcx, rdi
call fcn.1401111f0
test al, al
jne 0x140111990
mov edx, r15d
mov rcx, rdi
call fcn.1401112d0
mov dword [rsi], 9
mov dword [rsi + 4], eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x1401119dd
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test r14, r14
je 0x1401119ab
mov dword [r14], ebp
call fcn.14010d830
mov qword [r14 + 8], rax
mov ebx, r15d
mov edx, r15d
mov rcx, rdi
call fcn.1401112d0
and ebx, 0x10
je 0x1401119c4
mov ecx, dword [rsp + 0x40]
jmp 0x1401119ca
mov ecx, eax
mov eax, dword [rsp + 0x40]
test ebx, ebx
setne bpl
add ebp, 2
mov dword [rsi], ebp
test ebx, ebx
cmove eax, ecx
mov dword [rsi + 4], eax
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14016a510
mov rbx, qword [rsp + 0xc8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140125480
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movdqu xmm3, xmmword [rcx + 0x10]
movdqu xmm1, xmmword [rcx]
movdqu xmmword [rdx + 0x10], xmm3
movdqa xmm2, xmm1
movdqu xmmword [rdx], xmm1
pslldq xmm2, 4
movdqa xmm0, xmm2
pslldq xmm2, 4
pxor xmm0, xmm1
movdqa xmm4, xmm2
pxor xmm4, xmm0
pslldq xmm2, 4
pxor xmm4, xmm2
aeskeygenassist xmm0, xmm3, 1
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x20], xmm4
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x30], xmm2
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 2
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x40], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x50], xmm2
pslldq xmm1, 4
pxor xmm0, xmm3
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm2, 4
pshufd xmm1, xmm0, 0xff
pxor xmm3, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x60], xmm3
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm2, xmm1
movdqa xmm1, xmm3
movdqu xmmword [rdx + 0x70], xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
pslldq xmm1, 4
movdqa xmm4, xmm1
pxor xmm0, xmm3
pslldq xmm1, 4
pxor xmm4, xmm0
pxor xmm4, xmm1
aeskeygenassist xmm0, xmm2, 8
pshufd xmm1, xmm0, 0xff
pxor xmm4, xmm1
movdqa xmm1, xmm2
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x80], xmm4
pxor xmm0, xmm2
pslldq xmm1, 4
movdqa xmm3, xmm1
pslldq xmm1, 4
pxor xmm3, xmm0
pxor xmm3, xmm1
aeskeygenassist xmm0, xmm4, 0
pshufd xmm1, xmm0, 0xaa
pxor xmm3, xmm1
movdqa xmm1, xmm4
pslldq xmm1, 4
movdqa xmm0, xmm1
movdqu xmmword [rdx + 0x90], xmm3
pslldq xmm1, 4
pxor xmm0, xmm4
movdqa xmm2, xmm1
pslldq xmm1, 4
pxor xmm2, xmm0
pxor xmm2, xmm1
aeskeygenassist xmm0, xmm3, 0x10
pshufd xmm1, xmm0, 0xff
pxor xmm2, xmm1
movdqu xmmword [rdx + 0xa0], xmm2
ret