joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f35f9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401f37ea
push rbx
mov eax, Ordinal_211
call fcn.140215a20
sub rsp, rax
mov rax, qword [0x140320c20]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call fcn.1401a3440
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.1401a3190
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call fcn.1401d1d30
mov rcx, r15
call fcn.1401a3440
lea rdx, [rsp + 0x30]
mov rcx, r15
call fcn.1401a3190
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.1401d1d30
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x1401f3660
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140215090
add rsp, 0xd0
pop rbx
ret
Function at 0x1401fba10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140215a20
sub rsp, rax
mov r9d, dword [rdx + 8]
mov rsi, rdx
cmp r9d, dword [r8 + 8]
mov rdi, r8
mov rbx, rcx
cmovge rdi, rdx
cmovge rsi, r8
mov edx, dword [rdi + 8]
cmp edx, dword [rcx + 0xc]
jg 0x1401fba4e
mov rax, rcx
jmp 0x1401fba53
call fcn.140123590
test rax, rax
jne 0x1401fba68
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor eax, eax
cmp dword [rsi + 8], eax
jle 0x1401fba95
xor r9d, r9d
mov rcx, qword [rsi]
lea r9, [r9 + 8]
mov rdx, qword [rdi]
inc eax
mov r8, qword [r9 + rdx - 8]
xor r8, qword [r9 + rcx - 8]
mov rcx, qword [rbx]
mov qword [r9 + rcx - 8], r8
cmp eax, dword [rsi + 8]
jl 0x1401fba72
cmp eax, dword [rdi + 8]
jge 0x1401fbacb
movsxd rcx, eax
lea r8, [rcx*8]
nop word [rax + rax]
mov rcx, qword [rdi]
lea r8, [r8 + 8]
mov rdx, qword [rbx]
inc eax
mov rcx, qword [r8 + rcx - 8]
mov qword [r8 + rdx - 8], rcx
cmp eax, dword [rdi + 8]
jl 0x1401fbab0
mov edx, dword [rdi + 8]
mov dword [rbx + 8], edx
test edx, edx
jle 0x1401fbaf7
lea eax, [rdx - 1]
movsxd rcx, eax
mov rax, qword [rbx]
lea r8, [rax + rcx*8]
mov rax, qword [r8]
lea r8, [r8 - 8]
test rax, rax
jne 0x1401fbaf4
dec edx
test edx, edx
jg 0x1401fbae2
mov dword [rbx + 8], edx
cmp dword [rbx + 8], 0
jne 0x1401fbb04
mov dword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140205980
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
mov eax, 0x48
call fcn.140215a20
sub rsp, rax
mov rax, qword [0x140320c20]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rdx]
mov rdi, r8
mov qword [rsp + 0x20], rax
mov rbp, rcx
mov eax, dword [rsp + 0x80]
test eax, eax
jle 0x140205a92
mov qword [rsp + 0x70], rbx
sub rdi, r9
mov qword [rsp + 0x40], rsi
lea rbx, [r9 + 2]
mov esi, eax
nop
lea r8, [rsp + 0x28]
mov rcx, rbp
lea rdx, [rsp + 0x20]
call fcn.140205d70
movzx ecx, byte [rdi + rbx - 2]
lea rbx, [rbx + 8]
movzx eax, byte [rsp + 0x28]
xor ecx, eax
movzx eax, byte [rsp + 0x29]
mov byte [rbx - 0xa], cl
mov byte [rsp + 0x20], cl
movzx ecx, byte [rdi + rbx - 9]
xor ecx, eax
movzx eax, byte [rsp + 0x2a]
mov byte [rbx - 9], cl
mov byte [rsp + 0x21], cl
movzx ecx, byte [rdi + rbx - 8]
xor ecx, eax
movzx eax, byte [rsp + 0x2b]
mov byte [rbx - 8], cl
mov byte [rsp + 0x22], cl
movzx ecx, byte [rdi + rbx - 7]
xor ecx, eax
movzx eax, byte [rsp + 0x2c]
mov byte [rbx - 7], cl
mov byte [rsp + 0x23], cl
movzx ecx, byte [rdi + rbx - 6]
xor ecx, eax
movzx eax, byte [rsp + 0x2d]
mov byte [rbx - 6], cl
mov byte [rsp + 0x24], cl
movzx ecx, byte [rdi + rbx - 5]
xor ecx, eax
movzx eax, byte [rsp + 0x2e]
mov byte [rbx - 5], cl
mov byte [rsp + 0x25], cl
movzx ecx, byte [rdi + rbx - 4]
xor ecx, eax
movzx eax, byte [rsp + 0x2f]
mov byte [rbx - 4], cl
mov byte [rsp + 0x26], cl
movzx ecx, byte [rdi + rbx - 3]
xor ecx, eax
mov byte [rbx - 3], cl
mov byte [rsp + 0x27], cl
sub rsi, 1
jne 0x1402059d0
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140215090
add rsp, 0x48
pop rdi
pop rbp
ret
Function at 0x14022ec84
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x14022ea58
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14022ea58
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14022ea58
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14022ea58
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14022ea58
cmp dword [rcx + 0x84], 0xe
jbe 0x14022ea58
cmp dword [rcx + 0xf8], esi
je 0x14022ea58
mov ecx, r14d
call fcn.14022eba0
mov ecx, 2
call fcn.140232a34
nop
cmp byte [0x14032ec30], 0
jne 0x14022eb22
mov r15d, 1
mov eax, r15d
xchg dword [0x14032ec20], eax
test ebx, ebx
jne 0x14022eacb
mov rdi, qword [0x140320c20]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x14032ec28]
cmp rcx, rax
je 0x14022eac2
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.1400046e0]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x14032ee70]
jmp 0x14022ead7
cmp ebx, r15d
jne 0x14022eadd
lea rcx, [0x14032ee88]
call fcn.14022fb80
nop
test ebx, ebx
jne 0x14022eaf4
lea rdx, [0x140247aa8]
lea rcx, [0x140247a78]
call fcn.14022ff14
lea rdx, [0x140247ab8]
lea rcx, [0x140247ab0]
call fcn.14022ff14
movzx eax, byte [0x14032ec30]
test esi, esi
cmove eax, r15d
mov byte [0x14032ec30], al
jmp 0x14022eb22
mov ecx, 2
call fcn.140232a88
test esi, esi
jne 0x14022eb39
mov ecx, r14d
call fcn.14022eb54
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x14022e9e8
Function at 0x140238f58
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x140238df8
call fcn.14022383c
mov dword [rax], reloc.WS2_32.dll_shutdown
call fcn.14022268c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x140238de0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x140238de0
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x140238e2a
lock or dword [rax + 0x14], 0x10
jmp 0x140238de0
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x140238e47
mov rcx, qword [rbp + 0x10]
call fcn.140239c58
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14022cc30
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.140231928
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x140238e9e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x140238de0
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x140238f0a
mov rcx, qword [rbp + 0x10]
call fcn.14022cc30
cmp eax, 0xffffffff
je 0x140238ef1
mov rcx, qword [rbp + 0x10]
call fcn.14022cc30
cmp eax, 0xfffffffe
je 0x140238ef1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14022cc30
movsxd rdi, eax
lea rsi, [0x14032f110]
mov rcx, rbx
sar rdi, 6
call fcn.14022cc30
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x140238ef8
lea rax, [0x140321120]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x140238f0a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x140238f40
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x140238f3c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x140238f3c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x140238de3
jmp 0x140238db0
Function at 0x140434688
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov eax, dword [r8]
clc
add r8, 4
cmp r8b, r10b
cmp r8d, 0x74ab21f2
xor eax, r10d
clc
not eax
jmp 0x140422803
jmp rbx
push rax
cdqe
jmp 0x14041fff7
inc eax
rol eax, 2
inc eax
push r10
inc r10b
sub r10b, dl
rcl r10, cl
xor dword [rsp], eax
or r10, 0x39db3291
shr r10w, cl
rcl r10b, cl
pop r10
movsxd rax, eax
cmp r12w, r12w
add rbx, rax
jmp 0x1403c8d9c
push rbp
movsx ax, r14b
movzx ax, r12b
lahf
push rdx
mov dx, r8w
cwd
cqo
pushfq
push r9
rcr dx, 0xef
movzx rax, dx
push r13
xadd r9b, r9b
test cx, sp
push r12
rdtsc
xadd dh, dh
push r8
sbb r9, 0x6d02eb9
cmp rax, 0x728c6f54
bsr r9d, eax
push r10
btc r8, r13
push r15
push rsi
bts dx, r9w
push r11
bt eax, r9d
movzx r8, si
push rdi
neg r10w
bt si, si
push r14
push rbx
movsx r10, r10w
movabs r9, 0
rol ebx, 0x8f
seto r10b
clc
push r9
xor esi, 0x642268b2
mov r8, qword [rsp + 0x90]
add r8d, 0x394a0818
mov edx, 0x7f31693f
ror r8d, 1
bts si, r15w
adc r10w, 0x55a2
not r8d
rol sil, 0x8c
mov r10b, listen
and r10b, sil
add r8d, 0x2b89114c
lea r8, [r8 + r9]
neg r10w
test r15b, 0xd1
rdtsc
movabs rdx, 0x100000000
mov bh, reloc.WS2_32.dll___WSAFDIsSet
xor r10b, 0x8c
and r10b, 0x83
lea r8, [r8 + rdx]
mov rsi, rsp
bts r10w, ax
btc bx, 0x28
adc dl, r8b
sub rsp, 0x180
cqo
cmc
and rsp, 0xfffffffffffffff0
mov r10, r8
cwd
not edx
movabs rdx, 0
movsxd rax, r14d
rcl ah, 0xe2
xor ax, cx
sub r10, rdx
stc
lea rbx, [0x140420119]
jmp 0x1403a58a1
sub eax, 0x204a2d14
bswap eax
jmp 0x140418d0d
push rcx
jmp 0x1403da400
Function at 0x140001448
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1080
call fcn.14000b620
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
je 0x140001501
mov ecx, eax
call fcn.140004d80
xor esi, esi
test al, al
je 0x140001501
mov ecx, ebx
call fcn.140004d94
test al, al
jne 0x140001501
mov r8d, 0x800
lea rcx, [rsp + 0x60]
mov rdx, rdi
call fcn.140007c08
lea rcx, [rsp + 0x60]
call fcn.14000f238
lea rax, [rax*2 + 2]
cmp rax, 0x1002
jae 0x140001526
xor edx, edx
mov word [rsp + rax + 0x60], si
lea r8d, [rsi + 0x38]
lea rcx, [rsp + 0x20]
call fcn.14000c360
lea eax, [rsi + 0x14]
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.14000b690
lea r11, [rsp + 0x1080]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.14000b380
int3

Function at 0x140001580
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor ebx, ebx
mov eax, r8d
mov rdi, rdx
mov rsi, rcx
cmp rdx, 0x104
jb 0x1400015c0
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov edx, eax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x1400015c0
mov bl, 1
jmp 0x1400015d2
mov r8, rdi
lea rdx, str.unknown_folder
mov rcx, rsi
call fcn.140007c08
mov rsi, qword [rsp + 0x48]
mov al, bl
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140001958
Capabilities:
Enumerate pe sections
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdi, [0x1400227c8]
mov rbx, rcx
mov rdx, rdi
lea rcx, str.Setup.rar
call fcn.1400097a0
movzx r8d, byte [rbx + 1]
lea rcx, str.Setup.zip
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 2]
lea rcx, str.Setup.cab
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 3]
lea rcx, str.Setup.arj
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 4]
lea rcx, str.Setup.lz
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 5]
lea rcx, str.Setup.lzh
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 6]
lea rcx, str.Setup.7z
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 7]
lea rcx, str.Setup.tar
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 8]
lea rcx, str.Setup.gz
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 9]
lea rcx, str.Setup.uue
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0xa]
lea rcx, str.Setup.bz2
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0xb]
lea rcx, str.Setup.jar
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0xc]
lea rcx, str.Setup.iso
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0xd]
lea rcx, str.Setup.z
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0xe]
lea rcx, str.Setup.xz
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0xf]
lea rcx, str.Setup.zipx
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0x10]
lea rcx, str.Setup.001
mov rdx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0x14]
lea rdi, str.SetupLinks
mov rcx, rdi
lea rdx, str.Desktop
call fcn.1400097a0
movzx r8d, byte [rbx + 0x15]
lea rdx, str.StartMenu
mov rcx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0x16]
lea rdx, str.Programs
mov rcx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0x17]
lea rdi, str.Setup
mov rcx, rdi
lea rdx, str.ShellExt
call fcn.1400097a0
movzx r8d, byte [rbx + 0x18]
lea rdx, str.CascadedMenu
mov rcx, rdi
call fcn.1400097a0
movzx r8d, byte [rbx + 0x19]
lea rdx, str.MenuIcons
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400097a0
Function at 0x140003b24
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [0x140032410]
mov r10, r8
mov rbx, rdx
mov r11d, ecx
test r8, r8
je 0x140003b6d
test bl, 7
je 0x140003b6d
movzx ecx, byte [rbx]
inc rbx
movzx eax, r11b
xor rcx, rax
mov eax, r11d
shr eax, 8
mov r11d, dword [rsi + rcx*4]
xor r11d, eax
sub r10, 1
jne 0x140003b48
cmp r10, 8
jb 0x140003c17
mov rdi, r10
shr rdi, 3
imul rax, rdi, 0xfffffffffffffff8
add r10, rax
xor r11d, dword [rbx]
mov r9d, dword [rbx + 4]
add rbx, 8
mov eax, r9d
shr eax, 0x18
movzx edx, al
mov eax, r9d
shr eax, 0x10
movzx ecx, al
mov eax, r9d
shr eax, 8
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r11d
shr eax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
movzx ecx, al
mov eax, r11d
shr eax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1000]
movzx ecx, al
mov eax, r11d
shr eax, 8
xor r8d, dword [rsi + rcx*4 + 0x1400]
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rsi + rcx*4 + 0x1800]
xor r8d, dword [rsi + rax*4 + 0xc00]
movzx eax, r11b
mov r11d, r8d
xor r11d, dword [rsi + rax*4 + 0x1c00]
sub rdi, 1
jne 0x140003b85
test r10, r10
je 0x140003c3c
movzx ecx, byte [rbx]
inc rbx
movzx eax, r11b
xor rcx, rax
mov eax, r11d
shr eax, 8
mov r11d, dword [rsi + rcx*4]
xor r11d, eax
sub r10, 1
jne 0x140003c1c
mov rbx, qword [rsp + 8]
mov eax, r11d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140003c50
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x140003c97
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140003c65
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x140003c5c
ret

Function at 0x140004434
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rcx
je 0x14000444b
xor al, al
add rsp, 0x20
pop rbx
ret
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x140004458
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rbx + 0x1b], 0
je 0x140004443
lea rcx, [rbx + 0x26]
add rsp, 0x20
pop rbx
jmp fcn.140004bd4
Function at 0x14000446c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x140004499
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140004518
mov rcx, rbx
call fcn.1400045a8
test al, al
je 0x1400044dc
mov r8d, 0x4e20
cmp rdi, r8
jbe 0x1400044dc
mov rdx, rsi
mov rcx, rbx
call fcn.14000446c
jmp 0x14000451c
cmp dword [rbx + 0x14], 1
jne 0x1400044f1
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x1400044f1
xor eax, eax
jmp 0x14000451c
cmp dword [rbx + 0x14], 0
jne 0x140004513
cmp rdi, 0x8000
jbe 0x140004513
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x140004513
mov r8d, 0x8000
jmp 0x1400044cf
or eax, 0xffffffff
jmp 0x14000451c
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140004a14
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor edi, edi
mov rbp, r8
mov r13, rdx
mov rsi, rcx
test r8, r8
jne 0x140004a47
mov al, 1
jmp 0x140004bb7
cmp dword [rcx + 0x14], 1
jne 0x140004a5c
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rsi + 8], rax
mov r14b, dil
mov dword [rsp + 0x70], edi
cmp dword [rsi + 0x14], edi
je 0x140004ab9
mov rbx, rdi
test rbp, rbp
je 0x140004ae3
mov r8d, 0x4000
mov qword [rsp + 0x20], rdi
mov eax, ebp
lea rdx, [rbx + r13]
sub eax, ebx
lea r9, [rsp + 0x70]
mov rcx, rbp
sub rcx, rbx
cmp rcx, r8
mov rcx, qword [rsi + 8]
cmovb r8d, eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete r14b
test r14b, r14b
je 0x140004ae3
add rbx, 0x4000
cmp rbx, rbp
jb 0x140004a70
jmp 0x140004ada
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x70]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete r14b
test r14b, r14b
jne 0x140004bb0
cmp byte [rsi + 0x1c], dil
je 0x140004bb0
cmp dword [rsi + 0x14], edi
jne 0x140004bb0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [rsi]
mov rcx, rsi
mov edi, eax
call qword [rdx + 0x28]
lea r12, [rsi + 0x26]
mov r15, rax
mov rcx, r12
call fcn.140004ce8
mov ecx, edi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rbx, rbp
jbe 0x140004b4e
mov rcx, r15
mov ebx, 0xffffffff
sub rcx, rbp
cmp rcx, rbx
ja 0x140004b4e
lea rax, [r15 + rbp]
cmp rax, rbx
jbe 0x140004b4e
mov rdx, r12
lea rcx, [0x1400344d8]
call fcn.140003fc8
xor r8d, r8d
lea rcx, [0x1400344d8]
mov rdx, r12
call fcn.140003df8
xor edi, edi
test al, al
je 0x140004b9e
mov ecx, dword [rsp + 0x70]
mov eax, ecx
cmp rcx, rbp
jae 0x140004a5c
test ecx, ecx
je 0x140004a5c
mov rbx, qword [rsi]
mov rcx, rsi
call qword [rbx + 0x28]
mov ecx, dword [rsp + 0x70]
xor r8d, r8d
sub rax, rcx
mov rcx, rsi
mov rdx, rax
call qword [rbx + 0x20]
jmp 0x140004a5c
lea r8, [rsi + 0x26]
xor edx, edx
lea rcx, [0x1400344d8]
call fcn.140007eec
mov byte [rsi + 0x10], 1
mov al, r14b
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x140004bd4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.14000b620
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x140004c32
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140005dbc
test al, al
je 0x140004c32
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000b690
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret
Function at 0x140004c6c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1030
call fcn.14000b620
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x140004cc5
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140005dbc
test al, al
je 0x140004cc5
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000b690
mov rbx, qword [rsp + 0x1048]
add rsp, 0x1030
pop rdi
ret

Function at 0x140004ce8
Capabilities:
Get disk size

Disassembly:
mov eax, 0x1058
call fcn.14000b620
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r8d, 0x800
lea rdx, [rsp + 0x40]
call fcn.140005c88
movzx eax, word [rsp + 0x40]
lea r9, [rsp + 0x28]
and dword [rsp + 0x24], 0
lea r8, [rsp + 0x30]
and dword [rsp + 0x20], 0
lea rdx, [rsp + 0x20]
neg ax
lea rax, [rsp + 0x40]
sbb rcx, rcx
and rcx, rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x140004d64
mov eax, dword [rsp + 0x24]
cmp eax, dword [rsp + 0x2c]
ja 0x140004d64
mov ecx, dword [rsp + 0x20]
shl rax, 0x20
add rax, rcx
jmp 0x140004d66
xor eax, eax
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14000b690
add rsp, 0x1058
ret

Function at 0x140004da0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
mov eax, 0x1030
call fcn.14000b620
sub rsp, rax
mov rax, qword [0x1400318e0]
xor rax, rsp
mov qword [rsp + 0x1020], rax
mov ebp, r8d
mov sil, dl
mov rdi, rcx
call fcn.1400060f4
xor ebx, ebx
cmp word [rax], 0x20
je 0x140004df2
cmp word [rax], 0x2e
je 0x140004df2
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140004e27
mov rcx, rdi
call fcn.140004c6c
cmp eax, 0xffffffff
jne 0x140004e3a
mov r8d, 0x800
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.140005dbc
test al, al
je 0x140004e3a
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140004e3a
test sil, sil
je 0x140004e36
mov edx, ebp
mov rcx, rdi
call fcn.140004e70
xor eax, eax
jmp 0x140004e4c
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
cmp eax, 1
setbe bl
lea eax, [rbx + 1]
mov rcx, qword [rsp + 0x1020]
xor rcx, rsp
call fcn.14000b690
mov rbx, qword [rsp + 0x1058]
add rsp, 0x1030
pop rdi
pop rsi
pop rbp
ret