joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001ee54
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
xor ebx, ebx
mov rdi, r9
and dword [rax - 0x28], ebx
mov ebp, r8d
mov r14, rdx
mov rsi, rcx
cmp dword [rsp + 0x80], ebx
je 0x14001ee98
mov qword [rax - 0x38], r9
lea r9, [rax - 0x28]
call fcn.14001ed14
jmp 0x14001ef21
cmp dword [0x14007ba38], ebx
je 0x14001ef02
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
and dword [rsp + 0x80], ebx
lea rdx, [rsp + 0x80]
mov rcx, rsi
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetHandleInformation]
nop dword [rax + rax]
test eax, eax
jne 0x14001ef02
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rax, qword [0x14007ba20]
lea r9, [rsp + 0x30]
mov r8d, ebp
mov qword [rsp + 0x20], rdi
mov rdx, r14
mov rcx, rsi
call qword [0x14006c9d0]
jmp 0x14001ef21
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rdi
mov r8d, ebp
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
nop dword [rax + rax]
test eax, eax
jne 0x14001efa2
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r14d, 0x80070000
mov r15d, 0x80004005
mov ecx, eax
movzx eax, ax
or eax, r14d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14001ef67
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
jmp 0x14001ef6a
mov ebx, r15d
test rdi, rdi
je 0x14001f023
cmp ebx, 0x800703e5
jne 0x14001f023
mov r9d, 1
lea r8, [rsp + 0x30]
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
nop dword [rax + rax]
test eax, eax
je 0x14001efde
xor ebx, ebx
cmp ebp, dword [rsp + 0x30]
je 0x14001efc2
mov ebx, 0x8007000d
mov r8d, 0x174
mov r9d, ebx
lea rcx, str.ReadWriteDataInternal
call fcn.1400064e0
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
movzx eax, ax
or eax, r14d
test ecx, ecx
cmovle eax, ecx
test eax, eax
jns 0x14001f014
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, r14d
test eax, eax
cmovle ebx, eax
jmp 0x14001f017
mov ebx, r15d
test ebx, ebx
jns 0x14001efa2
mov r8d, 0x164
jmp 0x14001efb3
test ebx, ebx
jns 0x14001efa2
mov r8d, 0x16b
jmp 0x14001efb3
Function at 0x14002004c
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x60
mov r12, rcx
xor esi, esi
call fcn.140007518
xor edi, edi
mov rbx, rax
test rax, rax
je 0x14002020e
mov rcx, rbx
call fcn.140007880
and al, 3
cmp al, 2
jne 0x140020209
lea r8, [rsp + 0x98]
mov edx, 1
mov rcx, rbx
call fcn.1400230c4
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140020205
lea rdx, [rbx + 0x18]
lea rcx, [rbx + 0x10]
call fcn.14002b220
mov esi, eax
test eax, eax
je 0x1400201a6
mov r9, qword [rbx + 0x20]
mov rcx, rbp
mov r8, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x1f0]
call fcn.14002b3a8
mov esi, eax
test eax, eax
je 0x1400201a6
and qword [rsp + 0xa0], rdi
lea rdx, [rsp + 0xa0]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
mov rcx, rbx
call fcn.140007880
mov rcx, rbx
mov r15d, eax
call 0x140008404
mov rdx, qword [rsp + 0x98]
add rax, 0x30
mov qword [rsp + 0x40], rax
mov r9d, 2
and dword [rsp + 0x28], edi
mov r8, rbp
mov rcx, r12
call fcn.1400248f0
mov esi, eax
test eax, eax
je 0x14002015f
mov rcx, rbx
call fcn.140007880
test al, 2
je 0x14002016d
test r15b, 2
jne 0x14002016d
mov edx, 2
mov rcx, rbx
call fcn.140007998
jmp 0x14002016d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov r8, qword [0x14007b998]
xor edx, edx
mov rcx, rbx
call 0x14000828c
mov rcx, rbx
mov r8, rax
call fcn.140007a00
mov rcx, rax
mov rdx, r8
call fcn.14000da44
mov rcx, rbx
call fcn.140007a00
mov rcx, rax
call fcn.14000db70
jmp 0x1400201b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
cmp qword [rsp + 0x98], 0
je 0x1400201f3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, qword [rsp + 0x98]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
test edi, edi
je 0x140020205
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, esi
jmp 0x14002020e
mov eax, 1
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400206f4
Capabilities:
Get file size

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x50
and qword [rbp + 0x40], 0
xorps xmm0, xmm0
xor edi, edi
mov r14, rcx
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea esi, [rdi + 1]
call fcn.140007a00
cmp dword [0x14007ba38], edi
lea rdx, [rbp + 0x40]
mov rcx, rax
je 0x140020735
call fcn.14000d9b8
jmp 0x140020741
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
je 0x1400207e5
mov rax, qword [rbp + 0x40]
cmp rax, 4
jbe 0x1400207e5
mov ebx, 0x100000
sub rax, 4
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x40], rax
cmp rbx, rax
jge 0x1400207d3
mov eax, dword [rbp + 0x4c]
mov rcx, r14
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
and qword [rbp - 8], 0
mov dword [rbp - 0xc], eax
mov dword [rbp - 0x10], ebx
call fcn.140007a00
and dword [rsp + 0x20], 0
lea rdx, [rbp + 0x38]
mov rcx, rax
lea r9, [rbp - 0x20]
mov r8d, 4
call fcn.14001f03c
test eax, eax
je 0x1400207b9
add rbx, 0x100000
mov qword [rbp + 0x48], rbx
jmp 0x1400207c9
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
xor esi, esi
test esi, esi
je 0x1400207d3
mov rax, qword [rbp + 0x40]
jmp 0x140020768
test edi, edi
je 0x1400207e5
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov eax, esi
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400231bc
Capabilities:
Clear file content
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, r8
mov r14, rdx
mov rbx, rcx
xor esi, esi
lea rax, [rdx + 1]
test rax, 0xfffffffffffffffe
jne 0x1400231f5
test r8, r8
je 0x1400233d4
test rdi, rdi
je 0x14002339a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov rcx, rax
mov edx, 8
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
nop dword [rax + rax]
mov rsi, rax
or r15d, 0xffffffff
mov eax, r15d
test rbx, rbx
je 0x140023233
mov eax, dword [rbx]
mov r12d, 0xfeedf002
cmp eax, r12d
jne 0x14002339a
test rsi, rsi
je 0x14002339a
mov rcx, rdi
call fcn.140018d88
mov qword [rsi], rax
test rax, rax
je 0x14002339a
lea rax, [r14 + 1]
test rax, 0xfffffffffffffffe
jne 0x1400232a9
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 7]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
nop dword [rax + rax]
cmp rax, 0xffffffffffffffff
je 0x14002339a
mov r14, rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
nop dword [rax + rax]
test eax, eax
je 0x14002339a
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
nop dword [rax + rax]
test eax, eax
je 0x14002339a
mov rdi, rbx
mov eax, r15d
test rbx, rbx
je 0x1400232ec
mov eax, dword [rbx]
cmp eax, r12d
je 0x1400232f5
xor edi, edi
jmp 0x14002330e
mov rax, qword [rbx + 0x40]
jmp 0x140023302
mov rdi, rax
mov rax, qword [rax + 0x40]
test rax, rax
jne 0x1400232fb
add rdi, 0x208
mov qword [rsp + 0x68], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
nop
mov rax, rbx
mov ecx, r15d
test rbx, rbx
je 0x140023330
mov ecx, dword [rbx]
cmp ecx, r12d
je 0x140023339
xor eax, eax
jmp 0x14002334e
mov rcx, qword [rax + 0x40]
test rcx, rcx
je 0x140023347
mov rax, rcx
jmp 0x140023339
mov rax, qword [rax + 0xe8]
mov qword [rsi + 8], rax
test rbx, rbx
je 0x14002335a
mov r15d, dword [rbx]
cmp r15d, r12d
jne 0x140023374
mov rax, qword [rbx + 0x40]
test rax, rax
je 0x14002336d
mov rbx, rax
jmp 0x14002335f
mov qword [rbx + 0xe8], rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or r14, 0xffffffffffffffff
xor edi, edi
xor esi, esi
lea rax, [r14 - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400233b3
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test rdi, rdi
je 0x1400233c7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test rsi, rsi
je 0x1400233d4
mov rcx, rsi
call fcn.1400233f8
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x1400233f8
Capabilities:
Delete file

Disassembly:
test rcx, rcx
je 0x140023485
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rdi, qword [rbx]
mov rsi, qword [rbx + 8]
test rdi, rdi
je 0x14002344e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
nop dword [rax + rax]
mov r8, rbx
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax + rax]
mov rbx, rsi
test rsi, rsi
jne 0x140023413
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14002c168
Capabilities:
Delete file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
or qword [rax - 0x38], 0xffffffffffffffff
mov r12, r9
and qword [rax + 8], 0
mov rbx, r8
mov r13, rdx
mov r15, rcx
test rcx, rcx
je 0x14002c2b8
test rdx, rdx
jne 0x14002c1b1
test r9, r9
je 0x14002c2b8
mov r14, qword [rsp + 0xa8]
test r14, r14
je 0x14002c2b8
mov rbp, qword [rsp + 0xa0]
test rbx, rbx
je 0x14002c1ef
test byte [r8 + 0xf], 0x10
je 0x14002c1e9
mov rax, qword [r8 + 8]
movabs rcx, 0xffffffffffffff
and rax, rcx
jmp 0x14002c1f8
mov rax, qword [r8 + 0x18]
jmp 0x14002c1f8
test rbp, rbp
je 0x14002c214
mov rax, qword [rbp + 8]
mov qword [rsp + 0x80], rax
test rbx, rbx
jne 0x14002c20a
test rbp, rbp
je 0x14002c214
lea rax, [rsp + 0x80]
jmp 0x14002c216
xor eax, eax
mov r8, qword [rsp + 0xb0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov r9d, 0x4a200000
mov rcx, r15
mov qword [rsp + 0x28], rax
mov rdx, r14
call fcn.140020f78
mov rdi, qword [rsp + 0x40]
mov esi, eax
test eax, eax
je 0x14002c28c
mov eax, dword [rsp + 0xc0]
mov r9, r12
mov dword [rsp + 0x38], eax
mov r8, rbx
mov qword [rsp + 0x30], r14
mov rdx, r13
mov qword [rsp + 0x28], rdi
mov rcx, r15
mov qword [rsp + 0x20], rbp
call fcn.14002c098
mov esi, eax
test eax, eax
je 0x14002c28c
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x14002c28c
mov qword [rax], rdi
jmp 0x14002c2b4
cmp rdi, 0xffffffffffffffff
je 0x14002c2b4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
test esi, esi
jne 0x14002c2b4
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
mov eax, esi
jmp 0x14002c2cb
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140031664
Capabilities:
Hash data via bcrypt

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov r14, qword [rbp + 0x60]
xor r13d, r13d
mov rdi, r9
mov rbx, r8
mov r10, rcx
mov r12d, 1
test r14, r14
je 0x1400316b1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov dword [r14 + 0x10], eax
test rbx, rbx
je 0x140031885
mov qword [rbp - 0x30], r9
test r14, r14
je 0x140031722
call fcn.14002aeb8
lea rdx, [rbp + 0x60]
mov rcx, rax
mov rsi, rax
call fcn.14002af34
mov r15, qword [rbp + 0x60]
mov rcx, rsi
and dword [rsp + 0x30], r13d
mov rdx, r15
and dword [rsp + 0x28], r13d
and qword [rsp + 0x20], r13
mov r9d, dword [r15 + 0x10]
mov r8, qword [r15 + 8]
call qword [sym.imp.bcrypt.dll_BCryptCreateHash]
nop dword [rax + rax]
test eax, eax
jns 0x14003170f
mov ecx, 7
int 0x29
mov r10, qword [rbp + 0x40]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [r14], xmm0
mov dword [r14 + 0x10], eax
jmp 0x140031726
mov r15, qword [rbp + 0x60]
test rbx, rbx
je 0x14003182a
cmp dword [rbp + 0x54], 0
mov esi, dword [rbp + 0x70]
jne 0x14003173d
cmp esi, ebx
cmova esi, ebx
test rdi, rdi
je 0x140031796
movabs rax, 0x6666666666666667
imul rdi
sar rdx, 0x16
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rcx, [rdx + rdx*4]
shl rcx, 0x15
cmp rdi, rcx
jne 0x140031796
xor r9d, r9d
xor r8d, r8d
mov edx, 0x948e
mov rcx, r10
call fcn.140019380
cmp eax, 0xffffffff
jne 0x140031796
mov ecx, 0x4d3
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor r12d, r12d
test r12d, r12d
je 0x14003180b
mov eax, dword [rbp - 0x2c]
lea r9, [rbp - 0x28]
mov rdx, qword [rbp + 0x68]
mov r8d, esi
mov rcx, qword [rbp + 0x48]
and qword [rbp - 0x28], 0
and qword [rbp - 0x20], 0
and qword [rbp - 0x10], 0
and dword [rsp + 0x20], 0
mov dword [rbp - 0x14], eax
mov dword [rbp - 0x18], edi
call fcn.14001f03c
test eax, eax
je 0x14003180b
mov eax, esi
add rdi, rax
sub rbx, rax
mov qword [rbp - 0x30], rdi
mov qword [rbp + 0x50], rbx
test r14, r14
je 0x14003181d
mov rdx, qword [rbp + 0x68]
xor r9d, r9d
mov rcx, qword [r15]
mov r8d, esi
call qword [sym.imp.bcrypt.dll_BCryptHashData]
nop dword [rax + rax]
test eax, eax
jns 0x14003181d
mov ecx, 7
int 0x29
jmp 0x14003181d
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov r13d, eax
xor r12d, r12d
mov r10, qword [rbp + 0x40]
test r12d, r12d
jne 0x140031726
test r14, r14
je 0x140031871
mov rcx, qword [r15]
xor r9d, r9d
mov rdx, r14
lea r8d, [r9 + 0x14]
call qword [sym.imp.bcrypt.dll_BCryptFinishHash]
nop dword [rax + rax]
test eax, eax
jns 0x140031853
mov ecx, 7
int 0x29
mov rcx, qword [r15]
call qword [sym.imp.bcrypt.dll_BCryptDestroyHash]
nop dword [rax + rax]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LocalFree]
nop dword [rax + rax]
test r13d, r13d
je 0x140031885
mov ecx, r13d
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
mov rbx, qword [rsp + 0xc8]
mov eax, r12d
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400318b0
Capabilities:
Get file size

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14007b108]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor edi, edi
xor eax, eax
mov dword [rbp - 0x18], eax
xorps xmm0, xmm0
mov qword [rbp - 0x38], rdi
mov rbx, r9
mov qword [rbp - 0x30], rdi
mov r14, r8
mov dword [rbp - 0x40], edi
mov r15, rdx
mov r12, rcx
movups xmmword [rbp - 0x28], xmm0
test rcx, rcx
je 0x140031a50
cmp rdx, 0xffffffffffffffff
je 0x140031a50
test r8, r8
je 0x140031a50
cmp word [r8], di
je 0x140031a50
mov rsi, qword [rbp + 0x60]
test rsi, rsi
je 0x140031a50
lea rdx, [rbp - 0x38]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
nop dword [rax + rax]
test eax, eax
je 0x140031a05
cmp qword [rbp - 0x38], rbx
jne 0x140031a05
mov rax, qword [rsi]
cmp rax, qword [0x14007b9d0]
jne 0x14003197e
mov rax, qword [rsi + 8]
cmp rax, qword [0x14007b9d8]
jne 0x14003197e
mov eax, dword [rsi + 0x10]
cmp eax, dword [0x14007b9e0]
jne 0x14003197e
cmp qword [rbp - 0x38], rdi
je 0x140031a4c
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, [rbp - 0x40]
mov rcx, r12
lea rdx, [rbp - 0x30]
call fcn.140007b84
test eax, eax
je 0x1400319e8
mov eax, dword [rbp - 0x40]
mov rdx, r15
mov r9, qword [0x14007b998]
mov rcx, r12
mov r8, qword [rbp - 0x38]
mov dword [rsp + 0x30], eax
mov rax, qword [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
call fcn.140031664
test eax, eax
je 0x1400319e8
mov rax, qword [rsi]
cmp rax, qword [rbp - 0x28]
jne 0x1400319e8
mov rax, qword [rsi + 8]
cmp rax, qword [rbp - 0x20]
jne 0x1400319e8
mov eax, dword [rsi + 0x10]
cmp eax, dword [rbp - 0x18]
je 0x140031a4c
mov r9d, 0x80070241
lea rcx, str.VerifyFileByHandle
mov r8d, 0xf4
mov edi, r9d
call fcn.1400064e0
jmp 0x140031a4c
mov esi, 0x8007000d
lea rbx, str.VerifyFileByHandle
mov r9d, esi
mov rcx, rbx
mov r8d, 0xd5
mov edi, esi
call fcn.1400064e0
mov dword [rsp + 0x30], 0xd6
lea r9, str.Incorrect_filesize._Could_be_corrupted
mov qword [rsp + 0x28], rbx
mov r8, r14
mov rdx, r12
mov dword [rsp + 0x20], esi
mov ecx, 1
call fcn.14000b4d0
mov eax, edi
jmp 0x140031a55
mov eax, 0x80070057
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140068870
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140031a7c
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
xor ebx, ebx
lea rax, [rcx - 1]
mov rsi, r8
mov rdi, rdx
cmp rax, 0xfffffffffffffffd
ja 0x140031b35
test rdx, rdx
je 0x140031b35
lea r9d, [rbx + 8]
mov dword [rsp + 0x20], 0x43
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
nop dword [rax + rax]
test eax, eax
js 0x140031aed
cmp dword [rsi], 1
jne 0x140031ad8
mov dword [rdi], 1
jmp 0x140031b3a
cmp dword [rsi], 2
jne 0x140031ae5
mov dword [rdi], 2
jmp 0x140031b3a
cmp dword [rsi], ebx
jne 0x140031b3a
mov dword [rdi], ebx
jmp 0x140031b3a
cmp eax, 0xc0000003
jne 0x140031b2d
xor edx, edx
mov dword [rsp + 0x30], 0x50
lea rax, str.GetFileStorageTierClass
mov dword [0x14007b1c8], ebx
mov qword [rsp + 0x28], rax
lea r9, str.StorageTiering_not_supported
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea ecx, [rdx + 2]
call fcn.14000b4d0
mov ebx, 1
jmp 0x140031b3a
bts eax, 0x1c
mov ebx, eax
jmp 0x140031b3a
mov ebx, 0x80070057
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140031b54
Capabilities:
Set file attributes

Disassembly:
push rbx
sub rsp, 0x50
xor ebx, ebx
cmp dword [0x14007b1c8], ebx
jne 0x140031b6e
mov ebx, 1
jmp 0x140031c2f
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140031c2a
cmp edx, 3
jae 0x140031c2a
mov qword [rsp + 0x70], rbx
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
cmp edx, 1
jne 0x140031b9d
mov dword [rsp + 0x70], edx
jmp 0x140031baa
cmp edx, 2
jne 0x140031c2f
mov dword [rsp + 0x70], edx
mov r9d, 8
mov dword [rsp + 0x20], 0x43
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
nop dword [rax + rax]
mov ecx, 0x80000000
mov edx, eax
add eax, ecx
test ecx, eax
jne 0x140031c2f
cmp edx, 0xc000000d
je 0x140031c2f
cmp edx, 0xc0000003
jne 0x140031c22
xor edx, edx
mov dword [rsp + 0x30], 0xa1
lea rax, str.SetFileStorageTierClass
mov dword [0x14007b1c8], ebx
mov qword [rsp + 0x28], rax
lea r9, str.StorageTiering_not_supported
xor r8d, r8d
mov dword [rsp + 0x20], ebx
lea ecx, [rdx + 2]
call fcn.14000b4d0
jmp 0x140031b64
bts edx, 0x1c
mov ebx, edx
jmp 0x140031c2f
mov ebx, 0x80070057
mov eax, ebx
add rsp, 0x50
pop rbx
ret

Function at 0x1400327fc
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
mov r8d, dword [rcx + 8]
mov rbx, rcx
mov eax, 1
test r8d, r8d
je 0x14003285e
and dword [rsp + 0x40], 0
lea rdx, [rcx + 0x18]
mov rcx, qword [rcx]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x14003285e
mov ecx, dword [rbx + 8]
cmp dword [rsp + 0x40], ecx
je 0x140032856
mov ecx, 0xea
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
test eax, eax
je 0x14003285e
and dword [rbx + 8], 0
add rsp, 0x30
pop rbx
ret
Function at 0x140032910
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov eax, dword [rcx + 8]
mov rdi, rcx
mov rcx, qword [rcx + 0x10]
mov r14, r8
mov ebx, r9d
sub rcx, rax
mov rsi, rdx
lea rbp, [rdx + rbx]
cmp rdx, qword [rdi + 0x10]
ja 0x140032a2d
cmp rbp, qword [rdi + 0x10]
ja 0x140032a2d
cmp rcx, rdx
mov rax, rcx
cmovbe rax, rsi
cmova rdx, rcx
cmp rax, rbp
jae 0x140032982
sub ebp, edx
mov rdx, rax
sub rax, rcx
mov r8d, ebp
sub rdx, rsi
lea rcx, [rdi + 0x18]
add rdx, r14
add rcx, rax
call sub.msvcrt.dll_memcpy
sub ebx, ebp
xor ebp, ebp
test ebx, ebx
je 0x140032a26
mov rdx, qword [0x14007b998]
lea r9d, [rbp + 1]
mov rcx, qword [rdi]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x50], rbp
mov dword [rsp + 0x68], ebp
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
nop dword [rax + rax]
test eax, eax
je 0x140032a3e
mov rcx, qword [rdi]
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
nop dword [rax + rax]
test eax, eax
je 0x140032a3e
mov rcx, qword [rdi]
lea r9, [rsp + 0x68]
mov r8d, ebx
mov qword [rsp + 0x20], rbp
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x140032a3e
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
mov rcx, qword [rdi]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
nop dword [rax + rax]
test eax, eax
je 0x140032a3e
cmp dword [rsp + 0x68], ebx
je 0x140032a26
mov ecx, 0xea
jmp 0x140032a32
mov eax, 1
jmp 0x140032a40
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
nop dword [rax + rax]
xor eax, eax
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x14003d5ac
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
cmp dword [0x14007ba4c], 0
jne 0x14003d64b
mov edx, 0x13579bdf
lea r8, [0x14007bb80]
mov r9d, 0x87654321
xor r10d, r10d
mov r11d, r9d
mov ebx, edx
lea edi, [r10 + 0x20]
sub r10d, 0x61c88647
mov ecx, r9d
sar ecx, 5
add r11d, r10d
add ebx, r10d
add ecx, ebx
lea eax, [r11 + r9*8]
xor ecx, eax
lea eax, [r10 + r9]
xor ecx, eax
add edx, ecx
mov eax, edx
sar eax, 5
add eax, r11d
lea ecx, [rbx + rdx*8]
xor ecx, eax
lea eax, [r10 + rdx]
xor ecx, eax
add r9d, ecx
sub edi, 1
jne 0x14003d5e1
add edx, r9d
mov ecx, 0x7fff
movzx eax, dx
and ax, cx
mov word [r8], ax
add r8, 2
lea rax, [0x14007c180]
cmp r8, rax
jb 0x14003d5d5
mov dword [0x14007ba4c], 1
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret

Function at 0x14003d660
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r9, qword [rcx - 0x20]
xor esi, esi
mov r10, qword [rcx - 0x28]
mov rbx, rcx
mov r11d, esi
lea rdi, [r9 - 2]
cmp r10, rdi
jae 0x14003d6e2
lea rbp, [0x14007bb80]
movzx eax, byte [r10 + 2]
lea r8, [r10 + 1]
movzx edx, word [rbp + rax*2 + 0x400]
movzx eax, byte [r8]
movzx eax, word [rbp + rax*2 + 0x200]
xor rdx, rax
movzx eax, byte [r10]
mov r10, r8
movzx ecx, word [rbp + rax*2]
xor rdx, rcx
movsxd rcx, r11d
movzx eax, word [rbx + rdx*2 - 0x18288]
mov word [rbx + rcx*2], ax
mov word [rbx + rdx*2 - 0x18288], r11w
inc r11d
cmp r8, rdi
jb 0x14003d693
cmp r10, r9
jae 0x14003d6fa
sub r9, r10
movsxd rax, r11d
inc r11d
mov word [rbx + rax*2], si
sub r9, 1
jne 0x14003d6ea
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret