joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012980
Capabilities:
Create directory

Disassembly:
jmp 0x140012980
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x14015dda8]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor r9d, r9d
mov qword [rsp + 0x30], 0
movzx esi, dl
mov dword [rsp + 0x28], 0x2000080
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rbx, rcx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
setne dil
je 0x1400129ea
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140012a65
test sil, sil
je 0x140012a65
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edi, eax
test al, al
jne 0x140012a69
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x140012a65
lea rcx, [rsp + 0x40]
sub rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x140012a20
mov edx, 0x2f
lea rcx, [rsp + 0x40]
call fcn.1400072d4
test rax, rax
jne 0x140012a54
lea edx, [rax + 0x5c]
lea rcx, [rsp + 0x40]
call fcn.1400072d4
test rax, rax
je 0x140012a65
movzx edx, sil
mov byte [rax], 0
lea rcx, [rsp + 0x40]
call fcn.140003d82
movzx eax, dil
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140003b70
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140012cc0
Capabilities:
Check mutex on windows

Disassembly:
jmp 0x140012cc0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
mov rdi, rdx
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140012ce4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
xor esi, esi
test rcx, rcx
je 0x140012d08
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
xor r9d, r9d
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x10000080
mov edx, 0xc0000000
mov rcx, rdi
mov qword [rbx + 8], rsi
mov dword [rsp + 0x20], 1
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x140012d46
mov qword [rbx + 8], rsi
jmp 0x140012d79
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x140012d68
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rsi
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 8], rsi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
setne al
add rsp, 0x40
pop rdi
ret
Function at 0x140012dd0
Capabilities:
Check mutex on windows

Disassembly:
jmp 0x140012dd0
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x140012dfc
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
test rax, rax
mov qword [rbx], rax
setne al
add rsp, 0x20
pop rbx
ret

Function at 0x140012e30
Capabilities:
Create thread

Disassembly:
jmp 0x140012e30
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx], 0
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x140012ef6
cmp byte [rcx + 0x30], 0
jne 0x140012ef6
cmp dword [rcx + 0x24], 0
je 0x140012ef6
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x140012e7d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x140012ef6
mov qword [rbx + 8], rsi
mov byte [rbx + 0x30], 0
cmp edi, 0xfffffff1
jge 0x140012eaa
mov edi, 0xfffffff1
jmp 0x140012eb4
mov eax, 0xf
cmp edi, eax
cmovg edi, eax
lea rax, [rsp + 0x40]
mov dword [rbx + 0x34], edi
mov qword [rsp + 0x28], rax
lea r8, [0x140005439]
mov r9, rbx
mov dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
mov qword [rbx], rax
setne al
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x48]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140013170
Capabilities:
Print debug messages
Terminate thread

Disassembly:
jmp 0x140013170
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov byte [rcx + 0x30], 1
cmp qword [rcx], 0
je 0x140013268
cmp dword [rcx + 0x24], 0
jle 0x1400131a7
mov rax, qword [rcx + 0x28]
inc dword [rax + 0x10]
mov rcx, qword [rcx + 0x10]
test rcx, rcx
je 0x1400131a7
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov edx, 0x3a98
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test eax, eax
je 0x140013258
lea rcx, [rsp + 0x30]
call fcn.140005a15
nop
cmp edi, 0x102
jne 0x1400131e0
lea rdx, str.Thread__p_does_not_exit_within__u_seconds.
mov edi, 0xf
jmp 0x1400131e7
lea rdx, str.Cant_wait_for_the_thread__p:_WaitForSingleObject_returned__08X.
mov r9d, edi
mov r8, qword [rbx]
lea rcx, [rsp + 0x30]
call fcn.14000192e
lea rdx, str._This_thread_will_be_terminated._n
lea rcx, [rsp + 0x30]
call fcn.140002455
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, 0xffffffff
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
test eax, eax
jne 0x14001324e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rbx]
lea rdx, str.Cannot_terminate_the_thread__p:_error__u__n
lea rcx, [rsp + 0x30]
call fcn.14000192e
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
nop
lea rcx, [rsp + 0x30]
call fcn.140003080
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400133f0
Capabilities:
Check mutex on windows
Read file on windows

Disassembly:
jmp 0x1400133f0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
xor ebp, ebp
mov rax, rdx
xorps xmm0, xmm0
mov qword [rsp + 0x30], rbp
mov rdi, rcx
mov dword [rsp + 0x28], 0x10000080
movups xmmword [rcx], xmm0
lea r8d, [rbp + 3]
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
mov rcx, rax
mov esi, ebp
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14001348f
mov ebx, ebp
xor dil, dil
test rbx, rbx
je 0x14001345a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140013476
mov edx, 0xffffffff
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
movzx eax, dil
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rsi, rax
test rbx, rbx
je 0x140013449
xor r9d, r9d
lea r8, [rsp + 0x60]
mov rcx, rbx
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400134c5
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x140013449
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ebp
mov r8d, 4
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013449
cmp dword [rsp + 0x60], 4
jne 0x140013449
lea rdx, [rdi + 4]
mov dword [rsp + 0x60], ebp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013449
cmp dword [rsp + 0x60], 4
jne 0x140013449
lea rdx, [rdi + 8]
mov dword [rsp + 0x60], ebp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013449
cmp dword [rsp + 0x60], 4
jne 0x140013449
lea rdx, [rdi + 0xc]
mov dword [rsp + 0x60], ebp
lea r9, [rsp + 0x60]
mov qword [rsp + 0x20], rbp
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013449
cmp dword [rsp + 0x60], 4
jne 0x140013449
mov dil, 1
jmp 0x14001344c
Function at 0x140013670
Capabilities:
Check mutex on windows

Disassembly:
jmp 0x140013670
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rbx, rcx
movzx edi, r8b
mov rcx, qword [rcx + 8]
mov rsi, rdx
test rcx, rcx
je 0x14001369d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
xor ebp, ebp
test rcx, rcx
je 0x1400136c1
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rbp
mov edx, 0xc0000000
mov qword [rsp + 0x30], rbp
mov eax, 0x80000000
mov dword [rsp + 0x28], 0x10000080
test dil, dil
mov qword [rbx + 8], rbp
mov rcx, rsi
mov dword [rsp + 0x20], 3
cmove edx, eax
xor r9d, r9d
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbx + 8], rax
cmp rax, 0xffffffffffffffff
jne 0x14001370a
mov qword [rbx + 8], rbp
jmp 0x14001373d
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14001372c
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], rbp
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov qword [rbx + 0x10], rax
cmp qword [rbx + 8], rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
setne al
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1400137f0
Capabilities:
Read file on windows

Disassembly:
jmp 0x1400137f0
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14001382d
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 2]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001382d
cmp dword [rsp + 0x40], 2
jne 0x14001382d
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x140013890
Capabilities:
Read file on windows

Disassembly:
jmp 0x140013890
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x1400138cd
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400138cd
cmp dword [rsp + 0x40], 4
jne 0x1400138cd
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x140013930
Capabilities:
Read file on windows

Disassembly:
jmp 0x140013930
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x14001396d
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14001396d
cmp dword [rsp + 0x40], 8
jne 0x14001396d
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret
Function at 0x140013990
Capabilities:
Read file on windows

Disassembly:
jmp 0x140013990
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
mov ebx, r8d
test rcx, rcx
je 0x1400139ca
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400139ca
cmp dword [rsp + 0x40], ebx
jne 0x1400139ca
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140013a70
Capabilities:
Read file on windows

Disassembly:
jmp 0x140013a70
push rbx
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov ebx, r8d
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140013aae
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013aae
cmp dword [rsp + 0x40], ebx
jne 0x140013aae
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140013c10
Capabilities:
Read file on windows

Disassembly:
jmp 0x140013c10
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x140013c4d
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013c4d
cmp dword [rsp + 0x40], 1
jne 0x140013c4d
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x140013ed0
Capabilities:
Read file on windows

Disassembly:
jmp 0x140013ed0
push rbx
push rbp
push rsi
sub rsp, 0x30
mov rsi, qword [rcx + 8]
mov rbx, rdx
mov byte [rdx], 0
mov rcx, qword [rsi + 8]
test rcx, rcx
je 0x140013f7d
xor ebp, ebp
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013f7d
cmp dword [rsp + 0x58], 1
jne 0x140013f7d
movzx eax, byte [rsp + 0x50]
mov qword [rsp + 0x68], rdi
test al, al
je 0x140013f5f
mov rcx, qword [rsi + 8]
mov edi, eax
test rcx, rcx
je 0x140013f6e
lea r9, [rsp + 0x60]
mov dword [rsp + 0x60], ebp
mov r8d, eax
mov qword [rsp + 0x20], rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140013f6e
cmp dword [rsp + 0x60], edi
jne 0x140013f6e
movzx eax, byte [rsp + 0x50]
mov byte [rax + rbx], bpl
mov rdi, qword [rsp + 0x68]
mov al, 1
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret
xor al, al
add rsp, 0x30
pop rsi
pop rbp
pop rbx
ret

Function at 0x140014380
Capabilities:
Clear file content

Disassembly:
jmp 0x140014380
sub rsp, 0x28
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x14001439e
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14001439e
mov al, 1
add rsp, 0x28
ret
xor al, al
add rsp, 0x28
ret
Function at 0x1400147e0
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400147e0
sub rsp, 0x38
mov rcx, qword [rcx + 8]
test rcx, rcx
je 0x140014819
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r8d, [rax + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140014819
cmp dword [rsp + 0x40], 4
jne 0x140014819
mov al, 1
add rsp, 0x38
ret
xor al, al
add rsp, 0x38
ret

Function at 0x140014830
Capabilities:
Write file on windows

Disassembly:
jmp 0x140014830
push rbx
sub rsp, 0x30
mov rcx, qword [rcx + 8]
mov ebx, r8d
test rcx, rcx
je 0x14001486a
xor eax, eax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14001486a
cmp dword [rsp + 0x40], ebx
jne 0x14001486a
mov al, 1
add rsp, 0x30
pop rbx
ret
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x140014890
Capabilities:
Write file on windows

Disassembly:
jmp 0x140014890
push rbx
push rsi
sub rsp, 0x38
mov rbx, rdx
mov rsi, rcx
test rdx, rdx
je 0x1400148bb
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rdx + rax], 0
jne 0x1400148b0
jmp 0x1400148bd
xor al, al
mov rcx, qword [rcx + 8]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x30], rdi
mov byte [rsp + 0x50], al
test rcx, rcx
je 0x140014949
xor ebp, ebp
lea r9, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x58], ebp
mov qword [rsp + 0x20], rbp
lea r8d, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140014949
cmp dword [rsp + 0x58], 1
jne 0x140014949
movzx eax, byte [rsp + 0x50]
test al, al
je 0x140014936
mov rcx, qword [rsi + 8]
mov edi, eax
test rcx, rcx
je 0x140014949
lea r9, [rsp + 0x58]
mov dword [rsp + 0x58], ebp
mov r8d, eax
mov qword [rsp + 0x20], rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140014949
cmp dword [rsp + 0x58], edi
jne 0x140014949
mov al, 1
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop rsi
pop rbx
ret
mov rdi, qword [rsp + 0x30]
xor al, al
mov rbp, qword [rsp + 0x60]
add rsp, 0x38
pop rsi
pop rbx
ret
Function at 0x140014cc0
Capabilities:
Write file on windows

Disassembly:
jmp 0x140014cc0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rdx
lea r8, [rsp + 0x48]
xor r9d, r9d
mov rdi, rcx
mov rcx, qword [rbx + 8]
lea edx, [r9 + 4]
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140014d07
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140014cf5
xor esi, esi
lea r9, [rsp + 0x48]
mov rdx, rdi
mov dword [rsp + 0x48], esi
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140014cf5
cmp dword [rsp + 0x48], 4
jne 0x140014cf5
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140014cf5
lea rdx, [rdi + 4]
mov dword [rsp + 0x48], esi
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140014cf5
cmp dword [rsp + 0x48], 4
jne 0x140014cf5
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140014cf5
lea rdx, [rdi + 8]
mov dword [rsp + 0x48], esi
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rsi
lea r8d, [rsi + 4]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140014cf5
cmp dword [rsp + 0x48], 4
jne 0x140014cf5
lea rdx, [rdi + 0xc]
mov rcx, rbx
call fcn.14000438b
test al, al
je 0x140014cf5
mov rbx, qword [rsp + 0x40]
mov al, 1
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1400198e0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1400198e0
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov dword [rcx + 0x374], 0xffffffff
add rcx, 0x1c
xor edx, edx
mov r8d, 0x100
xor edi, edi
call fcn.1400052ae
cmp dword [rbx + 0x374], 0xdbb8c
jge 0x140019b6a
lea r11, section..data
cmp edi, 0x101
je 0x140019b6a
cmp byte [rbx + 0x7a4], 0
je 0x140019946
mov r9d, dword [rbx + 0x7a0]
mov byte [rbx + 0x7a4], 0
jmp 0x140019961
movsxd rdx, dword [rbx + 0x18]
cmp edx, dword [rbx + 0x14]
jge 0x140019b55
mov rax, qword [rbx]
movzx r9d, byte [rdx + rax]
lea eax, [rdx + 1]
mov dword [rbx + 0x18], eax
cmp r9d, 0xffffffff
je 0x140019b55
xor edx, edx
nop dword [rax]
cmp byte [rbx + 0x7a4], 0
je 0x140019988
mov ecx, dword [rbx + 0x7a0]
mov byte [rbx + 0x7a4], 0
jmp 0x1400199a1
movsxd r8, dword [rbx + 0x18]
cmp r8d, dword [rbx + 0x14]
jge 0x1400199c4
mov rax, qword [rbx]
movzx ecx, byte [r8 + rax]
lea eax, [r8 + 1]
mov dword [rbx + 0x18], eax
inc edx
cmp r9d, ecx
jne 0x1400199b0
cmp edx, 0xff
jl 0x140019970
cmp ecx, 0xffffffff
je 0x1400199c6
mov byte [rbx + 0x7a4], 1
mov dword [rbx + 0x7a0], ecx
jmp 0x1400199c6
inc edx
cmp edx, 1
jne 0x1400199f4
mov edx, dword [rbx + 0x370]
mov ecx, edx
movzx eax, r9b
shr rcx, 0x18
xor rcx, rax
shl edx, 8
xor edx, dword [r11 + rcx*4]
mov dword [rbx + 0x370], edx
or r9d, 0x10000
jmp 0x140019a32
jl 0x140019a2c
mov ecx, dword [rbx + 0x370]
movzx r10d, r9b
mov r8d, edx
nop dword [rax]
nop word [rax + rax]
mov eax, ecx
shr rax, 0x18
xor rax, r10
shl ecx, 8
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140019a10
mov dword [rbx + 0x370], ecx
shl edx, 0x10
or r9d, edx
mov edx, r9d
movzx edi, r9w
shr edx, 0x10
cmp edi, 0x101
je 0x140019b5a
mov ecx, edx
mov byte [rdi + rbx + 0x1c], 1
sub ecx, 1
je 0x140019b37
sub ecx, 1
je 0x140019b1b
cmp ecx, 1
je 0x140019aff
mov byte [rdx + rbx + 0x18], 1
sub dl, 4
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dl
jmp 0x140019b5a
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
movsxd rcx, dword [rbx + 0x374]
lea eax, [rcx + 1]
mov dword [rbx + 0x374], eax
mov rax, qword [rbx + 0x350]
mov byte [rcx + rax + 1], dil
jmp 0x140019b5a
mov edi, 0x101
cmp dword [rbx + 0x374], 0xdbb8c
jl 0x140019921
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001dc50
Capabilities:
Delete file

Disassembly:
jmp 0x14001dc50
push rbx
push rdi
push r14
sub rsp, 0x170
mov rax, qword [0x14015dda8]
xor rax, rsp
mov qword [rsp + 0x150], rax
cmp dword [rcx + 0x398], 0
movzx r14d, r8b
mov edi, edx
mov rbx, rcx
je 0x14001dc8a
mov eax, 3
jmp 0x14001de3d
mov eax, dword [rcx]
test eax, eax
jne 0x14001de3d
lea eax, [rdx - 0xac44]
cmp eax, 0x241bc
ja 0x14001de38
cmp r9d, 7
ja 0x14001de38
mov rcx, qword [rcx + 0x20]
test rcx, rcx
je 0x14001de31
mov r8, qword [rbx + 0x28]
test r8, r8
je 0x14001de31
mov qword [rsp + 0x1a8], rbp
lea rdx, str._s_c_s__05X.ml_c
mov dword [rbx + 0x58], r9d
test r14b, r14b
mov qword [rsp + 0x168], rsi
mov ebp, 0x6e
mov qword [rsp + 0x160], r15
mov r15d, 0x72
mov eax, r15d
mov dword [rbx + 0x5c], edi
cmovne eax, ebp
mov byte [rbx + 0x60], r14b
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
lea r9d, [r15 - 0x43]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
call fcn.1400062cb
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.1400038a0
test al, al
jne 0x14001dd3e
lea rcx, [rsp + 0x40]
call fcn.140002563
mov rax, qword [rbx + 0x20]
lea rdx, str._s_c_s__05X.ml_c
mov r8, qword [rbx + 0x28]
lea rcx, [rsp + 0x40]
test r14b, r14b
mov r9d, 0x2f
cmovne ebp, r15d
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call fcn.1400062cb
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.1400038a0
mov r15, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x1a8]
test al, al
jne 0x14001dd9d
lea rcx, [rsp + 0x40]
call fcn.140002563
lea rdx, [rsp + 0x40]
lea rcx, [rbx + 0x68]
call fcn.1400038a0
mov rsi, qword [rsp + 0x168]
test al, al
jne 0x14001de2d
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x14001ddcd
call fcn.140002ffe
mov qword [rbx + 0x30], 0
lea rcx, [rsp + 0x40]
call fcn.140002a59
mov qword [rbx + 0x30], rax
test rax, rax
jne 0x14001dde7
mov eax, 4
jmp 0x14001de3d
mov rcx, qword [rbx + 0x28]
call fcn.140005786
lea rcx, [rbx + 0x1e0]
mov r8d, 0x55454752
lea rdx, [rsp + 0x40]
call fcn.140003b43
test al, al
jne 0x14001de12
mov eax, 8
jmp 0x14001de3d
lea rcx, [rbx + 0x358]
mov dword [rbx + 0x398], 2
mov edx, 1
call fcn.140006622
xor eax, eax
jmp 0x14001de3d
mov eax, 1
jmp 0x14001de3d
mov eax, 6
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140003b70
add rsp, 0x170
pop r14
pop rdi
pop rbx
ret