joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002c10
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140022020]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov edx, 0x104
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
dec eax
cmp eax, 0x102
ja 0x140002e18
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r14d, r14d
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r14
lea rax, [rbp - 0x80]
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], r14w
jne 0x140002c81
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140002e5a
mov qword [rsp + 0x78], 7
cmp rbx, 8
jae 0x140002cce
mov qword [rsp + 0x70], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140012ec0
mov word [rsp + rbx + 0x60], r14w
jmp 0x140002d20
mov rax, rbx
or rax, 7
cmp rax, rsi
ja 0x140002ce9
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rsp + 0x60]
call fcn.140006000
mov rdi, rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x80]
mov rcx, rax
call fcn.140012ec0
mov word [rbx + rdi], r14w
lea rdx, str.WindowsShell.Manifest
lea rcx, [rsp + 0x60]
call fcn.140008280
mov qword [rsp + 0x28], 0x38
lea rax, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rax, qword [rsp + 0x60]
mov qword [rsp + 0x30], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CreateActCtxW]
cmp rax, 0xffffffffffffffff
jne 0x140002da2
lea rbx, [rsp + 0x60]
cmp qword [rsp + 0x78], 8
cmovae rbx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, eax
mov rdx, rbx
lea rcx, str.CreateActCtxW_failed_using_manifest__s._Error_code:__d
call fcn.140007a80
xor bl, bl
jmp 0x140002dce
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ActivateActCtx]
test eax, eax
jne 0x140002dcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.ActivateActCtx_failed._Error_code:__d
call fcn.140007a80
xor bl, bl
jmp 0x140002dce
mov bl, 1
mov rdx, qword [rsp + 0x78]
cmp rdx, 8
jb 0x140002e13
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011600
movzx eax, bl
jmp 0x140002e2e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str.GetWindowsDirectory_failed._Error_code:__d
call fcn.140007a80
xor al, al
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.1400115e0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.140001460
int3
Function at 0x140008700
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140022020]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], r14
mov word [rsp + 0x30], r14w
xor r8d, r8d
xor edx, edx
lea rcx, str.DOTNET_RUNTIME_ID
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
je 0x140008799
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.1400118cc
mov rbp, rax
mov r8d, edi
mov rdx, rax
lea rcx, str.DOTNET_RUNTIME_ID
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
jne 0x140008840
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x1400087c8
test eax, eax
jle 0x1400087b2
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str.DOTNET_RUNTIME_ID
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140007e70
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], r14
mov r8d, 7
lea rdx, str.win_x64
mov rcx, rsi
call fcn.140006450
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1400088aa
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008830
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008830
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011600
jmp 0x1400088aa
inc rbx
cmp word [rbp + rbx*2], 0
jne 0x140008840
mov rax, qword [rsp + 0x48]
cmp rbx, rax
ja 0x140008881
lea rdi, [rsp + 0x30]
cmp rax, 8
cmovae rdi, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.140012ec0
mov word [rbx + rdi], r14w
jmp 0x140008891
mov r9, rbp
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140006990
mov rcx, rbp
call fcn.140011600
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsi + 0x10], xmm1
mov rax, rsi
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400115e0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1400088d0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140022020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rdx
mov r14, rcx
lea r15, [rdx + 0x10]
xor r12d, r12d
mov qword [r15], r12
mov rax, rdx
cmp qword [rdx + 0x18], 8
jb 0x140008912
mov rax, qword [rdx]
mov word [rax], r12w
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], r12
mov word [rsp + 0x20], r12w
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x140008977
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x140008a95
test eax, eax
jle 0x140008960
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
mov rdx, r14
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140007e70
jmp 0x140008a95
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.1400118cc
mov rbp, rax
mov r8d, edi
mov rdx, rax
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x140008943
nop dword [rax + rax]
inc rbx
cmp word [rbp + rbx*2], 0
jne 0x1400089b0
mov rax, qword [rsp + 0x38]
cmp rbx, rax
ja 0x1400089f1
lea rdi, [rsp + 0x20]
cmp rax, 8
cmovae rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rbp
mov rcx, rdi
call fcn.140012ec0
mov word [rbx + rdi], r12w
jmp 0x140008a01
mov r9, rbp
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140006990
mov rcx, rbp
call fcn.140011600
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.14000d200
test al, al
je 0x140008a75
lea rax, [rsp + 0x20]
cmp rsi, rax
je 0x140008a71
lea r9, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r9, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rax, qword [rsi + 0x18]
cmp rbx, rax
ja 0x140008a66
cmp rax, 8
jb 0x140008a4b
mov rsi, qword [rsi]
mov qword [r15], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rsi
call fcn.140012ec0
mov word [rsi + rbx*2], r12w
mov bl, 1
jmp 0x140008a97
mov rdx, rbx
mov rcx, rsi
call fcn.140006990
mov bl, 1
jmp 0x140008a97
lea r8, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r8, qword [rsp + 0x20]
mov rdx, r14
lea rcx, str.Did_not_find___s__directory___s_
call fcn.140007a80
xor bl, bl
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x140008adc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008ad7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008ad7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140011600
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400115e0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14000cac0
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov rax, qword [0x140022020]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebp, ebp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 7
mov word [rsp + 0x20], bp
movzx eax, byte [str.d38cc827_e34f_4453_9df4_1e796e9f1d07]
cmp al, 0x65
jne 0x14000cb61
mov qword [rsp + 0x30], rbp
mov word [rsp + 0x20], bp
xor r8d, r8d
xor edx, edx
lea rcx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov edi, eax
test eax, eax
jne 0x14000cbbd
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xcb
je 0x14000cb61
test eax, eax
jle 0x14000cb4b
movzx eax, ax
or eax, 0x80070000
mov r8d, eax
lea rdx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
lea rcx, str.Failed_to_read_environment_variable___s___HRESULT:_0x_X
call fcn.140007e70
mov rdx, r14
mov ecx, 7
call fcn.14000cce0
movzx ebx, al
mov rdx, qword [rsp + 0x38]
cmp rdx, 8
jb 0x14000ccb7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ccb2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ccb2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov eax, 2
mul rdi
mov rbx, 0xffffffffffffffff
cmovo rax, rbx
mov rcx, rax
call fcn.1400118cc
mov rsi, rax
mov r8d, edi
mov rdx, rax
lea rcx, str._DOTNET_TEST_GLOBALLY_REGISTERED_PATH
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14000cb32
inc rbx
cmp word [rsi + rbx*2], 0
jne 0x14000cbf6
mov rax, qword [rsp + 0x38]
cmp rbx, rax
ja 0x14000cc35
lea rdi, [rsp + 0x20]
cmp rax, 8
cmovae rdi, qword [rsp + 0x20]
mov qword [rsp + 0x30], rbx
add rbx, rbx
mov r8, rbx
mov rdx, rsi
mov rcx, rdi
call fcn.140012ec0
mov word [rbx + rdi], bp
jmp 0x14000cc45
mov r9, rsi
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140006990
mov rcx, rsi
call fcn.140011600
lea rax, [rsp + 0x20]
cmp r14, rax
je 0x14000ccab
lea r9, [rsp + 0x20]
cmp qword [rsp + 0x38], 8
cmovae r9, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
mov rax, qword [r14 + 0x18]
cmp rbx, rax
ja 0x14000cca0
mov rdi, r14
cmp rax, 8
jb 0x14000cc82
mov rdi, qword [r14]
mov qword [r14 + 0x10], rbx
lea r8, [rbx + rbx]
mov rdx, r9
mov rcx, rdi
call fcn.140012ec0
mov word [rdi + rbx*2], bp
mov bl, 1
jmp 0x14000cb71
mov rdx, rbx
mov rcx, r14
call fcn.140006990
mov bl, 1
jmp 0x14000cb71
call fcn.140011600
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400115e0
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x140012160
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400121aa
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400121aa
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400121aa
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400121aa
cmp dword [rcx + 0x84], 0xe
jbe 0x1400121aa
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400121ac
xor al, al
add rsp, 0x28
ret
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call fcn.100a5000
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10007c10
add rsp, 0x28
jmp 0x10007510
Function at 0x140006a7c
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140057690], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x140006adc
movdqa xmm0, xmmword [0x14003cb00]
movdqa xmm1, xmmword [0x14003caf0]
movdqa xmmword [0x14004e430], xmm0
movdqa xmm0, xmmword [0x14003cad0]
movdqa xmmword [0x14004e440], xmm1
movdqa xmm1, xmmword [0x14003cae0]
movdqa xmmword [0x14004e450], xmm0
movdqa xmmword [0x14004e460], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140027ac0
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x14003cab0]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x140006af8
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x1400073c8
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1400073ee
movzx r9d, byte [rdx]
inc rdx
movzx eax, cl
xor r9, rax
shr ecx, 8
lea rax, [0x14004e470]
xor ecx, dword [rax + r9*4]
sub r8, 1
jne 0x1400073cd
mov eax, ecx
ret

Function at 0x140007658
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x80
mov rax, qword [0x14004d9a8]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp dword [rcx], 2
lea rbx, [rcx + 4]
mov rsi, rdx
mov rdi, rcx
mov r14d, 0x20
jne 0x1400076f0
and qword [r11 - 0x58], 0
lea r9d, [r14 - 0x1c]
and qword [r11 - 0x60], 0
lea r8, [r11 - 0x48]
mov eax, dword [rbx]
mov edx, r14d
and qword [r11 - 0x68], 0
mov rcx, rsi
and qword [r11 - 0x70], 0
mov dword [rsp + 0x50], eax
lea rax, [r11 - 0x40]
mov qword [r11 - 0x78], rax
call fcn.14000803c
xor r9d, r9d
lea r10, [rsp + 0x58]
xor r8d, r8d
movzx edx, byte [r10]
mov ecx, r9d
and ecx, 3
inc r9d
shl ecx, 3
inc r10
shl edx, cl
xor edx, r8d
mov r8d, edx
cmp r9d, r14d
jb 0x1400076ce
mov dword [rbx], edx
cmp dword [rdi], 3
jne 0x140007738
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x58]
and qword [rsp + 0x38], 0
mov r9, r14
and qword [rsp + 0x30], 0
mov r8, rbx
and qword [rsp + 0x28], 0
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.14000803c
mov r8, r14
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140028950
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140026760
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop r14
pop rdi
pop rsi
ret
Function at 0x140008358
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14004d9a8]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, qword [rbp + 0x190]
mov rax, r8
mov rsi, qword [rbp + 0x198]
mov r8d, 0x40
mov r14, qword [rbp + 0x1a0]
cmp r9, r8
mov r12, rdx
mov r15, rcx
cmovb r8, r9
lea rcx, [rbp + 0xb0]
mov rdx, rax
mov rbx, r9
call fcn.140028950
cmp rbx, 0x44
jae 0x1400085ad
lea rax, [rbx + 1]
mov byte [rbp + rbx + 0xb0], 0
cmp rax, 0x44
jae 0x1400085ad
mov byte [rbp + rax + 0xb0], 0
lea rax, [rbx + 2]
cmp rax, 0x44
jae 0x1400085ad
and qword [rsp + 0x40], 0
lea r9, [rbx + 4]
and qword [rsp + 0x38], 0
lea r8, [rbp + 0xb0]
and qword [rsp + 0x30], 0
mov rdx, r12
and qword [rsp + 0x28], 0
mov rcx, r15
mov byte [rbp + rax + 0xb0], 0
lea rax, [rbp + 0x68]
mov qword [rsp + 0x20], rax
mov byte [rbp + rbx + 0xb3], 1
call fcn.14000803c
mov ebx, 0x20
lea rdx, [rbp + 0x68]
mov r8d, ebx
lea rcx, [rbp + 0x88]
call fcn.140028950
mov eax, dword [rbp + 0x1a8]
dec eax
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rsi
lea rdi, [rbp + 0x40]
mov qword [rbp + 0x60], r14
lea rsi, [rbp + 0x50]
mov dword [rbp + 0x40], eax
lea r14d, [rbx - 0x1d]
mov dword [rbp + 0x44], 0x10
mov dword [rbp + 0x48], 0x10
mov byte [rsp + 0x51], 0
mov byte [rsp + 0x50], 0
cmp dword [rdi], 0
jbe 0x14000852e
mov ebx, dword [rdi]
lea rax, [rsp + 0x50]
mov r9d, 0x20
mov qword [rsp + 0x40], rax
lea r8, [rbp + 0x68]
lea rax, [rsp + 0x60]
mov rdx, r12
mov qword [rsp + 0x38], rax
mov rcx, r15
lea rax, [rsp + 0x51]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x100]
mov qword [rsp + 0x20], rax
call fcn.14000803c
mov r8d, 0x20
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x68]
call fcn.140028950
xor eax, eax
lea ecx, [rax + 2]
movdqu xmm0, xmmword [rbp + rax + 0x88]
movdqu xmm1, xmmword [rbp + rax + 0x68]
lea rax, [rax + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax + 0x78], xmm1
sub rcx, 1
jne 0x1400084fe
sub rbx, 1
jne 0x14000849b
lea ebx, [rcx + 0x20]
mov rcx, qword [rsi]
lea rdx, [rbp + 0x88]
mov r8, rbx
call fcn.140028950
add rdi, 4
add rsi, 8
sub r14, 1
jne 0x140008490
lea edx, [r14 + 0x44]
lea rcx, [rbp + 0xb0]
call fcn.1400139a4
mov rdx, rbx
lea rcx, [rbp + 0x88]
call fcn.1400139a4
mov rdx, rbx
lea rcx, [rbp + 0x68]
call fcn.1400139a4
mov rdx, rbx
lea rcx, [rbp + 0x100]
call fcn.1400139a4
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140026760
add rsp, 0x230
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400269a4
int3
Function at 0x14000c338
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x4f98]
mov eax, 0x5080
call fcn.140026bd0
sub rsp, rax
mov rax, qword [0x14004d9a8]
xor rax, rsp
mov qword [rbp + 0x4f70], rax
mov rbx, rcx
mov r15d, 0x800
mov r8d, r15d
lea rdx, [rbp + 0x2f70]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
lea edi, [r15 - 2]
cmp eax, edi
ja 0x14000c533
mov r8d, r15d
lea rdx, [rbp + 0x3f70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
dec eax
cmp eax, edi
ja 0x14000c533
lea rcx, [rbp + 0x2f70]
call fcn.14000ff38
mov rsi, rax
lea rcx, [rbp + 0x3f70]
call fcn.14000ff38
mov rdi, rax
xor r14d, r14d
cmp word [rax], r14w
je 0x14000c533
mov rdx, rax
mov rcx, rsi
call fcn.140016b34
test eax, eax
je 0x14000c533
mov rcx, rbx
call fcn.14000ff38
mov rcx, rax
mov rdx, rdi
call fcn.140016b34
test eax, eax
jne 0x14000c533
movzx eax, r14w
mov word [rbp + 0xf70], ax
mov edi, r14d
test ax, ax
jne 0x14000c48b
mov r8, r15
mov rdx, rbx
lea rcx, [rbp + 0xf70]
call fcn.140014ce8
lea rcx, [rbp + 0xf70]
call fcn.14000ff38
mov rcx, rax
mov r9d, edi
lea r8, str.rtmp_d
mov rdx, r15
call fcn.14000552c
lea rcx, [rbp + 0xf70]
call fcn.14000d48c
test al, al
je 0x14000c470
mov eax, r14d
mov word [rbp + 0xf70], ax
jmp 0x14000c477
movzx eax, word [rbp + 0xf70]
add edi, 0x7b
cmp edi, 0x2710
jl 0x14000c41c
test ax, ax
je 0x14000c533
mov r8, r15
mov rdx, rbx
lea rcx, [rbp + 0x1f70]
call fcn.140014ce8
mov r8, r15
mov rdx, rsi
lea rcx, [rbp + 0x1f70]
call fcn.14000ffc4
lea rdx, [rbp + 0xf70]
lea rcx, [rbp + 0x1f70]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000c533
lea rcx, [rsp + 0x20]
call fcn.14000c564
nop
mov dil, r14b
mov rcx, rbx
call fcn.14000d48c
test al, al
jne 0x14000c4f7
mov r8d, 0x12
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.14000c688
mov dil, al
lea rdx, [rbp + 0x1f70]
lea rcx, [rbp + 0xf70]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test dil, dil
je 0x14000c525
lea rcx, [rsp + 0x20]
call fcn.14000c620
lea rcx, [rsp + 0x20]
call fcn.14000c7b4
nop
lea rcx, [rsp + 0x20]
call fcn.14000c5ac
mov al, 1
jmp 0x14000c535
xor al, al
mov rcx, qword [rbp + 0x4f70]
xor rcx, rsp
call fcn.140026760
lea r11, [rsp + 0x5080]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000c7b4
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rcx
jne 0x14000c7eb
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x14000c7d7
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x14003c508]
cmp byte [rbx + 0x21], 0
je 0x14000c7eb
lea rcx, [rbx + 0x3a]
add rsp, 0x20
pop rbx
jmp fcn.14000d408
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x14000c7f4
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
jne 0x14000c826
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
lea r9, [rsp + 0x40]
and qword [rsp + 0x20], 0
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000c8a3
mov rcx, rbx
call fcn.14000c95c
test al, al
je 0x14000c869
mov r8d, 0x4e20
cmp rsi, r8
jbe 0x14000c869
mov rdx, rbp
mov rcx, rbx
call fcn.14000c7f4
jmp 0x14000c8a7
cmp dword [rbx + 0x14], 1
jne 0x14000c87e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x14000c87e
xor eax, eax
jmp 0x14000c8a7
cmp dword [rbx + 0x14], 0
jne 0x14000c89e
mov edi, 0x8000
cmp rsi, rdi
jbe 0x14000c89e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x14000c89e
mov r8d, edi
jmp 0x14000c85c
or eax, 0xffffffff
jmp 0x14000c8a7
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14000cb58
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
call fcn.14000cb94
test al, al
je 0x14000cb8c
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov rax, qword [rbx]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov rax, qword [rax + 0x20]
call qword [0x14003c508]
add rsp, 0x20
pop rbx
ret

Function at 0x14000d070
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sete al
add rsp, 0x28
ret