joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b0448
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
lea rdi, [rcx + 0x138]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_AcquireSRWLockShared]
mov qword [rsp + 0x50], rdi
movabs rcx, 0xcbf29ce484222325
xor r9d, r9d
movzx eax, byte [rsp + r9 + 0x60]
xor rcx, rax
movabs rdx, 0x100000001b3
imul rcx, rdx
inc r9
cmp r9, 8
jb 0x1401b048d
mov rax, qword [rbx + 0xe0]
and rax, rcx
mov rdx, qword [rbx + 0xc8]
mov r8, rax
add r8, r8
mov r8, qword [rdx + r8*8]
lea r9, [rax + rax]
mov rcx, qword [rbx + 0xb8]
cmp qword [rdx + r9*8], rcx
jne 0x1401b04de
mov rax, rcx
jmp 0x1401b04e6
mov rax, qword [rdx + r9*8 + 8]
mov rax, qword [rax]
cmp r8, rax
je 0x1401b04f6
cmp qword [r8 + 0x10], rsi
je 0x1401b04f9
mov r8, qword [r8]
jmp 0x1401b04d3
mov r8, rcx
mov rcx, qword [rbx + 0x68]
mov rdx, rbp
cmp r8, qword [rbx + 0xb8]
je 0x1401b050f
mov r8, qword [r8 + 0x18]
jmp 0x1401b0516
mov r8, qword [rbx + 0x130]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
call qword [case.0x140245398.0]
nop
test rdi, rdi
je 0x1401b0532
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseSRWLockShared]
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401b313c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x58]
sub rsp, 0x120
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rax, rdx
mov r14, rcx
lea rdx, [rsp + 0x48]
mov rcx, qword [rax]
call fcn.14018ecec
mov r15, qword [rax]
mov rbx, qword [rax + 8]
test rbx, rbx
je 0x1401b3197
lock inc dword [rbx + 8]
mov rbx, qword [rax + 8]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], rbx
or r13d, 0xffffffff
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x1401b31e8
mov eax, r13d
lock xadd dword [rdi + 8], eax
add eax, r13d
jne 0x1401b31e8
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax]
call qword [case.0x140245398.0]
mov eax, r13d
lock xadd dword [rdi + 0xc], eax
add eax, r13d
jne 0x1401b31e8
mov rax, qword [rdi]
mov rcx, rdi
mov rax, qword [rax + 8]
call qword [case.0x140245398.0]
xor esi, esi
mov rdi, qword [r14]
mov r14, qword [r14 + 8]
jmp 0x1401b329e
mov r8, rdi
lea rdx, [rsp + 0x20]
lea rcx, [r15 + 0x78]
call fcn.140081d50
mov rax, qword [rsp + 0x20]
cmp rax, qword [r15 + 0x80]
je 0x1401b330f
cmp dword [rax + 0x74], 0
jl 0x1401b329a
mov r9, qword [rax + 0x58]
mov r8, qword [rax + 0x60]
sub r8, r9
movabs r10, 0xcbf29ce484222325
mov rcx, r10
mov edx, 0
movabs r11, 0x100000001b3
je 0x1401b325c
movzx eax, byte [rdx + r9]
xor rcx, rax
imul rcx, r11
inc rdx
cmp rdx, r8
jb 0x1401b3248
mov qword [rsp + 0x28], rcx
mov rcx, r10
xor edx, edx
movzx eax, byte [rsp + rdx + 0x28]
xor rcx, rax
imul rcx, r11
inc rdx
cmp rdx, 8
jb 0x1401b3266
mov rax, rsi
shl rax, 6
mov rdx, rsi
shr rdx, 2
add rcx, rax
mov eax, 0x9e3779b9
add rax, rdx
add rcx, rax
xor rsi, rcx
add rdi, 0x40
cmp rdi, r14
jne 0x1401b31f6
test rbx, rbx
je 0x1401b32e5
mov eax, r13d
lock xadd dword [rbx + 8], eax
add eax, r13d
jne 0x1401b32e5
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140245398.0]
mov edx, r13d
lock xadd dword [rbx + 0xc], edx
add edx, r13d
jne 0x1401b32e5
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx + 8]
call qword [case.0x140245398.0]
mov rax, rsi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0x170]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea rcx, [rsp + 0x30]
call fcn.140061754
lea rdx, [rax + 0xe8]
lea rcx, [rsp + 0x70]
call fcn.140087b3c
mov rbx, rax
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.140087b3c
nop
mov r8, rax
lea rdx, [0x140360100]
lea rcx, [rbp - 0x50]
call fcn.14008a60c
nop
lea r8, str._is_not_a_part_of_the_key_for_rule
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.1400871d0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.14008722c
nop
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1401b30e8
lea rdx, [0x14047caa8]
lea rcx, [rsp + 0x58]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x1401b5b80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x40
mov qword [rax - 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov r10, rcx
xor esi, esi
mov dword [rax + 0x10], esi
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 8
jb 0x1401b5bae
mov rdx, qword [rdx]
movabs rbx, 0xcbf29ce484222325
xor ecx, ecx
lea r9, [r8 + r8]
test r9, r9
je 0x1401b5be0
movzx eax, byte [rcx + rdx]
xor rbx, rax
movabs r11, 0x100000001b3
imul rbx, r11
inc rcx
cmp rcx, r9
jb 0x1401b5bc3
test r8, r8
je 0x1401b5c20
mov rcx, qword [r10]
mov rax, qword [rcx]
lea rdx, [rsp + 0x28]
mov rax, qword [rax + 0x58]
call qword [case.0x140245398.0]
nop
mov esi, 1
mov dword [rsp + 0x58], esi
mov rcx, qword [rax]
mov rax, qword [rcx]
mov rdx, rbx
mov rax, qword [rax + 8]
call qword [case.0x140245398.0]
test eax, eax
je 0x1401b5c20
xor dil, dil
jmp 0x1401b5c23
mov dil, 1
test sil, 1
je 0x1401b5c6b
mov rbx, qword [rsp + 0x30]
test rbx, rbx
je 0x1401b5c6b
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rbx + 8], eax
add eax, esi
jne 0x1401b5c6b
mov rax, qword [rbx]
mov rcx, rbx
mov rax, qword [rax]
call qword [case.0x140245398.0]
mov edx, esi
lock xadd dword [rbx + 0xc], edx
add edx, esi
jne 0x1401b5c6b
mov rdx, qword [rbx]
mov rcx, rbx
mov rax, qword [rdx + 8]
call qword [case.0x140245398.0]
mov al, dil
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1401c95fc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov r8, rcx
lea rsi, [rdi + 0x10]
cmp qword [rsi + 0x18], 8
mov r9, rsi
mov r10, qword [rsi + 0x10]
jb 0x1401c962f
mov r9, qword [rsi]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
add r10, r10
je 0x1401c965e
movzx eax, byte [rdx + r9]
movabs r11, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r11
cmp rdx, r10
jb 0x1401c9640
mov rdx, qword [r8 + 0x30]
and rdx, rcx
mov rcx, qword [r8 + 0x18]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rdi
jne 0x1401c9696
cmp qword [rcx + rdx*8], rdi
jne 0x1401c968b
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r8 + 0x18]
mov rax, qword [r8 + 8]
jmp 0x1401c968f
mov rax, qword [rdi + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401c96a3
cmp qword [rcx + rdx*8], rdi
jne 0x1401c96a3
mov rax, qword [rdi]
mov qword [rcx + rdx*8], rax
mov rax, qword [rdi + 8]
lea rcx, [rsi + 0x20]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [r8 + 0x10]
call fcn.14004e0f0
mov rcx, rsi
call fcn.14004e0f0
mov rcx, rdi
call fcn.1402e0278
mov rsi, qword [rsp + 0x38]
mov rax, r14
mov rdi, qword [rsp + 0x40]
mov qword [r14], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r14
ret
Function at 0x1401ce0d0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x47], rax
call fcn.14004d8a4
xor ebx, ebx
mov rcx, qword [rax + 8]
cmp dword [rcx], 4
jbe 0x1401ce136
lea rax, str.Initializing_component
mov qword [rbp + 0x2f], 0x2e
mov qword [rbp + 0x27], rax
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd2d0]
xor r8d, r8d
mov dword [rsp + 0x20], 3
call fcn.140001158
lea rcx, [rbp - 0x21]
call fcn.1401cea98
cmp qword [rbp - 9], 8
lea rcx, [rbp - 0x21]
cmovae rcx, qword [rbp - 0x21]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, 1
je 0x1401ce1ce
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x29], eax
cmp eax, 0xb7
je 0x1401ce1ce
mov byte [0x1404a3cd8], 1
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x1401ce254
lea rax, [rbp - 0x29]
mov qword [rbp + 0x2f], 4
mov qword [rbp + 0x27], rax
lea rax, str.Sample_Cache_Agent_failed_to_create_cache_directory__using_temp_directory.
mov qword [rbp + 0x37], rax
mov qword [rbp + 0x3f], reloc.OLEAUT32.dll_DllRegisterServer
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd3de]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001158
jmp 0x1401ce254
call fcn.14004d8a4
mov r10, qword [rax + 8]
cmp dword [r10], 4
jbe 0x1401ce254
cmp qword [rbp - 9], 8
lea rax, str.Using_protected_cache_directory
lea rcx, [rbp - 0x21]
mov qword [rbp + 0x27], rax
cmovae rcx, qword [rbp - 0x21]
lea rdx, [0x140344690]
mov qword [rbp + 0x2f], 0x40
mov rax, rbx
test rcx, rcx
je 0x1401ce21d
mov rdx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], bx
jne 0x1401ce214
lea eax, [rax*2 + 2]
mov qword [rbp + 0x37], rdx
mov dword [rbp + 0x3f], eax
mov dword [rbp + 0x43], ebx
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd412]
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov rcx, r10
call fcn.140001158
lea rcx, [rbp - 0x21]
call fcn.14004e0f0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0xc0]
add rsp, 0xb0
pop rbp
ret
Function at 0x1401ce694
Capabilities:
Read file on windows

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rdx, qword [r8]
xor ebx, ebx
mov rcx, qword [rcx]
mov r8d, 0x1000
mov dword [rbp - 0x19], ebx
mov rdi, r9
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401ce738
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x19], eax
cmp eax, 0x26
jne 0x1401ce6e7
mov dword [rdi], ebx
jmp 0x1401ce73b
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x1401ce738
lea rax, [rbp - 0x19]
mov qword [rbp + 0x2f], VarR8FromUI1
mov qword [rbp + 0x17], rax
mov edx, 4
lea rax, str.Failed_to_read_sample_file_content
mov qword [rbp + 0x1f], rdx
mov qword [rbp + 0x27], rax
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], edx
lea rdx, [0x1403dd3de]
call fcn.140001158
mov ebx, dword [rbp - 0x19]
mov eax, ebx
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0x90
pop rdi
pop rbx
pop rbp
ret

Function at 0x1401ce754
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov r8d, dword [r8]
lea r9, [rbp - 5]
mov rdx, qword [rdx]
mov rcx, qword [rcx]
and dword [rbp - 5], 0
and dword [rbp - 9], 0
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401ce7f5
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 9], eax
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 2
jbe 0x1401ce7f5
and dword [rbp + 0x33], 0
lea rax, [rbp - 9]
and dword [rbp + 0x43], 0
mov edx, 4
mov qword [rbp + 0x27], rax
lea rax, str.Failed_to_write_cache_file
mov qword [rbp + 0x37], rax
mov dword [rbp + 0x2f], edx
mov dword [rbp + 0x3f], 0x36
lea rax, [rbp + 7]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
mov dword [rsp + 0x20], edx
lea rdx, [0x1403dd3de]
call fcn.140001158
mov eax, dword [rbp - 9]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0x90
pop rbp
ret
Function at 0x1401cea98
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
xor esi, esi
cmp byte [0x1404a3cd8], sil
je 0x1401ceb11
mov edx, 0x104
lea rcx, [r11 - 0x50]
call fcn.1401776f4
nop
mov rdx, qword [rsp + 0x28]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rdx, qword [rsp + 0x28]
mov rcx, rbx
call fcn.14004d5c4
nop
lea rcx, [rsp + 0x28]
call fcn.14008903c
jmp 0x1401ceb8c
lea rcx, [rsp + 0x48]
call fcn.140204f68
nop
lea rdx, [0x14049f948]
cmp qword [reloc.OLEAUT32.dll_VariantInit], 8
cmovae rdx, qword [0x14049f948]
mov r8, qword [0x14049f958]
mov rcx, rax
call fcn.14005e1e8
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm1
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
lea rcx, [rsp + 0x28]
call fcn.14004e0f0
nop
lea rcx, [rsp + 0x48]
call fcn.14004e0f0
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rsi
ret

Function at 0x1401ced64
Capabilities:
Get common file path

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x90
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
movdqa xmm0, xmmword [0x14038ac40]
movdqu xmmword [rsp + 0x70], xmm0
xor edi, edi
mov word [rsp + 0x60], di
mov edx, 0x104
lea rcx, [r11 - 0x78]
call fcn.1401776f4
nop
lea rcx, [rsp + 0x40]
call fcn.1401cea98
nop
lea rcx, [rsp + 0x40]
cmp qword [rsp + 0x58], 8
cmovae rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x20]
xor r8d, r8d
lea rdx, [0x140344690]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 7
mov word [rbx], di
mov rdx, qword [rsp + 0x20]
mov rcx, rbx
call fcn.14004d5c4
nop
lea rcx, [rsp + 0x40]
call fcn.14004e0f0
nop
lea rcx, [rsp + 0x20]
call fcn.14008903c
nop
lea rcx, [rsp + 0x60]
call fcn.14004e0f0
mov rax, rbx
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x90
pop rdi
ret
Function at 0x1401cfd80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rax, r8
lea r9, [rbp - 0x25]
mov edi, edx
mov rbx, rcx
mov rcx, qword [rcx + 0x40]
xor esi, esi
mov r8d, edx
mov dword [rbp - 0x29], esi
mov rdx, qword [rax]
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1401cfe88
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x29], eax
call fcn.14004d8a4
mov r10, qword [rax + 8]
cmp dword [r10], 3
jbe 0x1401cfe73
lea rcx, [rbx + 8]
mov qword [rbp + 0xf], 0x7a
cmp qword [rcx + 0x18], 8
lea rax, str.Sample_file_compression_failed___Cannot_read_block_from_file
mov qword [rbp + 7], rax
jb 0x1401cfe0d
mov rcx, qword [rcx]
lea rdx, [0x140344690]
mov rax, rsi
test rcx, rcx
je 0x1401cfe2c
mov rdx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x1401cfe23
lea eax, [rax*2 + 2]
mov qword [rbp + 0x17], rdx
mov dword [rbp + 0x1f], eax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x23], esi
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd706]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001158
mov ecx, dword [rbp - 0x29]
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1401cff37
cmp dword [rbp - 0x25], edi
je 0x1401cff35
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x29], eax
call fcn.14004d8a4
mov r10, qword [rax + 8]
cmp dword [r10], 3
jbe 0x1401cfe73
lea rcx, [rbx + 8]
mov qword [rbp + 0xf], 0x7a
cmp qword [rcx + 0x18], 8
lea rax, str.Sample_file_compression_failed___not_all_bytes_in_block_read
mov qword [rbp + 7], rax
jb 0x1401cfeca
mov rcx, qword [rcx]
lea rdx, [0x140344690]
mov rax, rsi
test rcx, rcx
je 0x1401cfee9
mov rdx, rcx
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], si
jne 0x1401cfee0
lea eax, [rax*2 + 2]
mov qword [rbp + 0x17], rdx
mov dword [rbp + 0x1f], eax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x23], esi
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd706]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r10
call fcn.140001158
jmp 0x1401cfe73
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401d0074
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov edi, dword [r9]
mov rax, r8
and dword [rbp - 0x15], 0
lea r9, [rbp - 0x15]
and qword [rsp + 0x20], 0
mov rsi, rdx
mov rbx, rcx
add edi, 4
mov rdx, qword [rax]
mov r8d, edi
mov rcx, qword [rcx + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1401d013c
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x19], eax
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401d012a
and dword [rbp + 0x23], 0
lea rax, str.Sample_file_compression_failed___Cannot_write_compressed_block_data_to_file
and dword [rbp + 0x33], 0
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x1f], 0x98
mov dword [rbp + 0x2f], 4
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd50c]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001158
mov ecx, dword [rbp - 0x19]
movzx eax, cx
or eax, 0x80070000
test ecx, ecx
cmovle eax, ecx
jmp 0x1401d01b2
cmp dword [rbp - 0x15], edi
je 0x1401d01a6
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x19], eax
call fcn.14004d8a4
mov rcx, qword [rax + 8]
cmp dword [rcx], 3
jbe 0x1401d012a
and dword [rbp + 0x23], 0
lea rax, str.Sample_file_compression_failed___didnt_write_all_compressed_data_to_file
and dword [rbp + 0x33], 0
mov qword [rbp + 0x17], rax
lea rax, [rbp - 0x19]
mov qword [rbp + 0x27], rax
mov dword [rbp + 0x1f], DllRegisterServer
mov dword [rbp + 0x2f], 4
lea rax, [rbp - 9]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd50c]
xor r8d, r8d
mov dword [rsp + 0x20], 4
call fcn.140001158
jmp 0x1401d012a
add qword [rbx + 0x30], rsi
mov eax, edi
add qword [rbx + 0x38], rax
xor eax, eax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
mov rbx, qword [rsp + 0xb8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret

Function at 0x1401d02a4
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rcx, qword [rcx]
lea rdx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1401d0341
call fcn.14004d8a4
mov rbx, qword [rax + 8]
cmp dword [rbx], 5
jbe 0x1401d033d
and dword [rsp + 0x6c], 0
lea rax, str.Failed_to_get_file_size
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x68], 0x30
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
and dword [rsp + 0x7c], 0
mov ecx, 4
mov dword [rsp + 0x30], eax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], ecx
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd4d4]
mov dword [rsp + 0x20], ecx
xor r8d, r8d
mov rcx, rbx
call fcn.140001158
xor eax, eax
jmp 0x1401d0346
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1402dfdb0
add rsp, 0x90
pop rbx
ret
Function at 0x1401d4258
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x14049e510]
xor rax, rsp
mov qword [rbp + 0x37], rax
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rcx, rdx
jb 0x1401d4290
mov rcx, qword [rdx]
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x2000006
mov dword [rsp + 0x20], 3
lea r8d, [rdi + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
lea rcx, [rax + 1]
test rcx, 0xfffffffffffffffe
jne 0x1401d4371
call fcn.14004d8a4
mov r14, qword [rax + 8]
cmp dword [r14], 5
jbe 0x1401d442b
cmp qword [rbx + 0x18], 8
lea rax, str.Failed_to_get_a_file_handle
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x38
jb 0x1401d42fd
mov rbx, qword [rbx]
lea rcx, [0x140344690]
mov rax, rdi
test rbx, rbx
je 0x1401d431c
mov rcx, rbx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x1401d4313
lea eax, [rax*2 + 2]
mov qword [rbp + 0x17], rcx
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd89a]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r14
call fcn.140001158
jmp 0x1401d442b
lea rdx, [rbp - 0x21]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x1401d4427
call fcn.14004d8a4
mov r14, qword [rax + 8]
cmp dword [r14], 5
jbe 0x1401d442b
cmp qword [rbx + 0x18], 8
lea rax, str.Failed_to_get_file_size
mov qword [rbp + 7], rax
mov qword [rbp + 0xf], 0x30
jb 0x1401d43b6
mov rbx, qword [rbx]
lea rcx, [0x140344690]
mov rax, rdi
test rbx, rbx
je 0x1401d43d5
mov rcx, rbx
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], di
jne 0x1401d43cc
lea eax, [rax*2 + 2]
mov qword [rbp + 0x17], rcx
mov dword [rbp + 0x1f], eax
mov dword [rbp + 0x23], edi
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
mov dword [rbp - 0x29], eax
lea rax, [rbp - 0x29]
mov qword [rbp + 0x27], rax
mov qword [rbp + 0x2f], 4
lea rax, [rbp - 0x19]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rdx, [0x1403dd89a]
xor r8d, r8d
mov dword [rsp + 0x20], 5
mov rcx, r14
call fcn.140001158
jmp 0x1401d442b
mov rdi, qword [rbp - 0x21]
lea rcx, [rsi - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1401d443e
mov rcx, rsi
call qword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1402dfdb0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1401dc714
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea r9, [r8 + 0x10]
mov rdi, rdx
cmp qword [r9 + 0x18], 8
mov r10, rcx
mov rbx, qword [r9 + 0x10]
jb 0x1401dc736
mov r9, qword [r9]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rbx, rbx
je 0x1401dc765
movzx eax, byte [rcx + r9]
movabs rdx, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rdx
cmp rcx, rbx
jb 0x1401dc747
mov rdx, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and rdx, r11
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1401dc79d
cmp qword [rcx + rdx*8], r8
jne 0x1401dc792
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x1401dc796
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1401dc7aa
cmp qword [rcx + rdx*8], r8
jne 0x1401dc7aa
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.1401dc7c4
mov rbx, qword [rsp + 0x30]
mov rax, rdi
add rsp, 0x20
pop rdi
ret