joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001d90
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov qword [rsp + 0x38], 0
mov rax, qword [rsp + 0x60]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x20], 0
jmp 0x140001df1
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x20], eax
jge 0x140001e8f
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x40]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x45474150
je 0x140001e4b
lfence
mov rax, qword [rsp + 0x28]
mov r8d, 5
lea rdx, [0x1400029f0]
mov rcx, rax
call fcn.1400021c0
test eax, eax
jne 0x140001e8a
lfence
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x60]
add rcx, rax
mov rax, rcx
mov r9, qword [rsp + 0x70]
mov r8, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx + 8]
mov rcx, rax
call fcn.140001cd0
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140001e8a
jmp 0x140001e8f
jmp 0x140001de7
mov rax, qword [rsp + 0x38]
add rsp, 0x58
ret

Function at 0x140001ea0
Capabilities:
Get system information on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x188
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
xor r8d, r8d
lea rdx, [rsp + 0x20]
mov ecx, 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0xc0000004
je 0x140001efd
xor eax, eax
jmp 0x140001fca
mov eax, dword [rsp + 0x20]
mov r8d, 0x6f616d4c
mov edx, eax
xor ecx, ecx
call qword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
jne 0x140001f25
xor eax, eax
jmp 0x140001fca
xor r9d, r9d
mov r8d, dword [rsp + 0x20]
mov rdx, qword [rsp + 0x30]
mov ecx, 0xb
call sub.ntoskrnl.exe_ZwQuerySystemInformation
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
jge 0x140001f4b
jmp 0x140001fb8
mov dword [rsp + 0x24], 0
jmp 0x140001f5f
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
movsxd rax, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x30]
cmp rax, qword [rcx]
jae 0x140001fb8
movsxd rax, dword [rsp + 0x24]
imul rax, rax, 0x128
lea rcx, [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rdi, rcx
lea rsi, [rdx + rax + 8]
mov ecx, 0x128
rep movsb byte [rdi], byte [rsi]
mov rdx, qword [rsp + 0x1a0]
lea rcx, [rsp + 0x68]
call sub.ntoskrnl.exe_strstr
test rax, rax
je 0x140001fb6
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
jmp 0x140001fb8
jmp 0x140001f55
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.1400020e0
add rsp, 0x188
pop rdi
pop rsi
ret
Function at 0x2fc4dd770
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4de172
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc502108]
test eax, eax
je 0x2fc4de20a
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc502110]
mov qword [rbp - 8], rax
jmp 0x2fc4de1ee
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4de1e2
cmp qword [rbp - 0x10], 0
je 0x2fc4de1e2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4de1a8
lea rax, [0x2fc5020e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4de20b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4de310
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4de338
mov eax, 0
jmp 0x2fc4de386
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4de361
mov eax, 0
jmp 0x2fc4de386
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4de381
mov eax, 0
jmp 0x2fc4de386
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4de38c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4de40a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4de401
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4de401
mov rax, qword [rbp - 8]
jmp 0x2fc4de41f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4de3d4
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140011168
Capabilities:
Execute command

Disassembly:
jmp 0x140011980
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a6]
call fcn.1400113ac
lea rcx, [0x14001ae64]
call qword [sym.imp.ucrtbased.dll_system]
mov dword [rbp + 4], 0x12
mov dword [rbp + 0x24], 8
mov edx, dword [rbp + 0x24]
mov ecx, dword [rbp + 4]
call fcn.14001139d
lea rcx, str.
call fcn.1400111bd
mov eax, dword [rbp + 0x24]
inc eax
mov edx, eax
mov ecx, dword [rbp + 4]
call fcn.14001139d
lea rcx, str._G_A_M_E_O_V_E_R
call fcn.1400111bd
mov eax, dword [rbp + 0x24]
add eax, 2
mov edx, eax
mov ecx, dword [rbp + 4]
call fcn.14001139d
lea rcx, str.
call fcn.1400111bd
mov eax, dword [rbp + 0x24]
add eax, 5
mov edx, eax
mov ecx, dword [rbp + 4]
call fcn.14001139d
mov edx, dword [rbp + 0x120]
lea rcx, str.SCORE:__d
call fcn.1400111bd
lea rcx, str._n_n_n_n_n_n_n_n_n
call fcn.1400111bd
lea rcx, str.pause
call qword [sym.imp.ucrtbased.dll_system]
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140011217
Capabilities:
Terminate process

Disassembly:
jmp 0x140013510
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x140011294
Capabilities:
Execute command

Disassembly:
jmp 0x140011e20
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x20]
lea rcx, [0x1400230a6]
call fcn.1400113ac
call fcn.14001130c
mov byte [rbp + 4], 0
mov byte [rbp + 0x24], 1
mov dword [rbp + 0x44], 3
mov dword [rbp + 0x64], 0xc
mov dword [rbp + 0x84], 0x2d
mov dword [rbp + 0xa4], 0
call qword [sym.imp.ucrtbased.dll_clock]
mov dword [rbp + 0xc4], eax
xor eax, eax
cmp eax, 1
je 0x140011f9f
mov edx, dword [rbp + 0x64]
mov ecx, dword [rbp + 0x84]
call fcn.1400110c8
movzx eax, al
test eax, eax
je 0x140011e9b
jmp 0x140011f9f
call fcn.140011384
cmp eax, 0x7a
jne 0x140011eb5
movzx eax, byte [rbp + 0x24]
test eax, eax
je 0x140011eb5
mov byte [rbp + 4], 1
mov byte [rbp + 0x24], 0
movzx eax, byte [rbp + 4]
test eax, eax
je 0x140011ec8
mov eax, dword [rbp + 0x64]
sub eax, 3
mov dword [rbp + 0x64], eax
jmp 0x140011ed1
mov eax, dword [rbp + 0x64]
add eax, 3
mov dword [rbp + 0x64], eax
cmp dword [rbp + 0x64], 0xc
jl 0x140011ee2
mov dword [rbp + 0x64], 0xc
mov byte [rbp + 0x24], 1
cmp dword [rbp + 0x64], 3
jg 0x140011eec
mov byte [rbp + 4], 0
mov eax, dword [rbp + 0x84]
sub eax, 2
mov dword [rbp + 0x84], eax
cmp dword [rbp + 0x84], 0
jg 0x140011f0e
mov dword [rbp + 0x84], 0x2d
mov ecx, dword [rbp + 0x64]
call fcn.140011334
mov ecx, dword [rbp + 0x84]
call fcn.1400113bb
call qword [sym.imp.ucrtbased.dll_clock]
mov dword [rbp + 0xe4], eax
mov eax, dword [rbp + 0xc4]
mov ecx, dword [rbp + 0xe4]
sub ecx, eax
mov eax, ecx
cdq
mov ecx, 0x3e8
idiv ecx
cmp eax, 1
jl 0x140011f64
mov eax, dword [rbp + 0xa4]
inc eax
mov dword [rbp + 0xa4], eax
call qword [sym.imp.ucrtbased.dll_clock]
mov dword [rbp + 0xc4], eax
mov ecx, 0x3c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14001ae64]
call qword [sym.imp.ucrtbased.dll_system]
xor edx, edx
mov ecx, 0x16
call fcn.14001139d
mov edx, dword [rbp + 0xa4]
lea rcx, str.Score:__d
call fcn.1400111bd
jmp 0x140011e76
mov ecx, dword [rbp + 0xa4]
call fcn.140011168
xor eax, eax
lea rsp, [rbp + 0x1c8]
pop rdi
pop rbp
ret

Function at 0x1400112a3
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014860
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014880
xor al, al
jmp 0x140014901
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014893
xor al, al
jmp 0x140014901
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400148bd
xor al, al
jmp 0x140014901
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400148d1
xor al, al
jmp 0x140014901
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400148e3
xor al, al
jmp 0x140014901
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400148ff
xor al, al
jmp 0x140014901
mov al, 1
add rsp, 0x38
ret
Function at 0x14001139d
Capabilities:
Manipulate console buffer

Disassembly:
jmp 0x140011bc0
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x128]
lea rcx, [0x1400230a6]
call fcn.1400113ac
mov eax, dword [rbp + 0x100]
shl eax, 1
mov word [rbp + 4], ax
movzx eax, word [rbp + 0x108]
mov word [rbp + 6], ax
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov edx, dword [rbp + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorPosition]
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.14001133e
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140005470
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x140054f44], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x1400054d0
movdqa xmm0, xmmword [0x140032980]
movdqa xmm1, xmmword [0x140032970]
movdqa xmmword [0x140041c30], xmm0
movdqa xmm0, xmmword [0x140032950]
movdqa xmmword [0x140041c40], xmm1
movdqa xmm1, xmmword [0x140032960]
movdqa xmmword [0x140041c50], xmm0
movdqa xmmword [0x140041c60], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.140020a30
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x140032930]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x1400054ec
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x14000678c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x830
mov rax, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r8d, 0x400
call fcn.140012568
mov esi, 1
mov ecx, esi
call fcn.140023cc0
cmp rbx, rax
jne 0x1400067d1
cmp byte [0x140042c8c], 0
jne 0x1400067f3
mov ebp, 2
mov ecx, ebp
call fcn.140023cc0
cmp rbx, rax
jne 0x1400068b6
cmp byte [0x140042c8d], 0
je 0x1400068b6
mov ecx, esi
call fcn.140023cc0
sub rbx, rax
neg rbx
sbb ecx, ecx
add ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
call fcn.140003f5c
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdi, [0x140045490]
mov esi, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
mov r8d, esi
call fcn.14002366c
mov eax, dword [0x140042c88]
mov rcx, rdi
cmp eax, 3
jne 0x140006859
call fcn.14002217c
mov rdx, rdi
lea r8d, [rax + rax]
jmp 0x14000689d
lea rbx, [0x140048490]
mov r8, rsi
mov rdx, rbx
cmp eax, 4
jne 0x140006872
call fcn.1400148d8
jmp 0x140006877
call fcn.140014854
test dword [0x140042c88], 0xfffffffd
jne 0x14000688f
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharToOemA]
mov rcx, rbx
call fcn.1400221e0
mov r8, rax
mov rdx, rbx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x850]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140006923
call fcn.140003f5c
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdi, [0x140045490]
mov r8d, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
call fcn.14002366c
mov ecx, ebp
call fcn.140023cc0
xor ecx, ecx
cmp rbx, rax
setne cl
add ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rdi
mov rbx, rax
call fcn.14002217c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x868]
mov r8, rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rbx, qword [rsp + 0x858]
add rsp, 0x830
pop rdi
pop rsi
pop rbp
ret
Function at 0x140006bc8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [0x140049c90]
mov r10, r8
mov rbx, rdx
mov r11d, ecx
test r8, r8
je 0x140006c11
test bl, 7
je 0x140006c11
movzx ecx, byte [rbx]
inc rbx
movzx eax, r11b
xor rcx, rax
mov eax, r11d
shr eax, 8
mov r11d, dword [rsi + rcx*4]
xor r11d, eax
sub r10, 1
jne 0x140006bec
cmp r10, 8
jb 0x140006cbb
mov rdi, r10
shr rdi, 3
imul rax, rdi, 0xfffffffffffffff8
add r10, rax
xor r11d, dword [rbx]
mov r9d, dword [rbx + 4]
add rbx, 8
mov eax, r9d
shr eax, 0x18
movzx edx, al
mov eax, r9d
shr eax, 0x10
movzx ecx, al
mov eax, r9d
shr eax, 8
mov r8d, dword [rsi + rdx*4]
xor r8d, dword [rsi + rcx*4 + 0x400]
movzx ecx, al
mov eax, r11d
shr eax, 0x18
xor r8d, dword [rsi + rcx*4 + 0x800]
movzx ecx, al
mov eax, r11d
shr eax, 0x10
xor r8d, dword [rsi + rcx*4 + 0x1000]
movzx ecx, al
mov eax, r11d
shr eax, 8
xor r8d, dword [rsi + rcx*4 + 0x1400]
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rsi + rcx*4 + 0x1800]
xor r8d, dword [rsi + rax*4 + 0xc00]
movzx eax, r11b
mov r11d, r8d
xor r11d, dword [rsi + rax*4 + 0x1c00]
sub rdi, 1
jne 0x140006c29
test r10, r10
je 0x140006ce0
movzx ecx, byte [rbx]
inc rbx
movzx eax, r11b
xor rcx, rax
mov eax, r11d
shr eax, 8
mov r11d, dword [rsi + rcx*4]
xor r11d, eax
sub r10, 1
jne 0x140006cc0
mov rbx, qword [rsp + 8]
mov eax, r11d
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret

Function at 0x140006cf4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x140006d3b
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x140006d09
mov dword [r8], r10d
inc r9d
add r8, 4
cmp r9d, 0x100
jb 0x140006d00
ret

Function at 0x140006ea4
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
push rdi
sub rsp, 0x70
cmp dword [rcx], 2
mov rdi, rdx
mov rbx, rcx
mov ebp, 0x20
jne 0x140006f26
and qword [r11 - 0x38], 0
lea r9d, [rbp - 0x1c]
mov eax, dword [rcx + 4]
lea r8, [r11 + 8]
and qword [r11 - 0x40], 0
mov edx, ebp
and qword [r11 - 0x48], 0
mov rcx, rdi
and qword [r11 - 0x50], 0
mov dword [r11 + 8], eax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x58], rax
call fcn.1400077ac
and dword [rbx + 4], 0
lea r9, [rsp + 0x50]
xor r8d, r8d
xor edx, edx
movzx eax, byte [r9]
mov ecx, r8d
and ecx, 3
inc r8d
shl ecx, 3
inc r9
shl eax, cl
xor edx, eax
cmp r8d, ebp
jb 0x140006f07
mov dword [rbx + 4], edx
cmp dword [rbx], 3
jne 0x140006f70
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x38], 0
lea r8, [rbx + 4]
and qword [rsp + 0x30], 0
mov r9, rbp
and qword [rsp + 0x28], 0
mov rdx, rbp
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400077ac
mov r8, rbp
lea rdx, [rsp + 0x50]
lea rcx, [rbx + 4]
call fcn.1400205e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140007a94
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x138]
sub rsp, 0x210
mov rax, r8
mov r15, rdx
mov r8d, 0x40
mov r12, rcx
cmp r9, r8
lea rcx, [rbp - 0x40]
mov rdx, rax
mov rbx, r9
cmovb r8, r9
call fcn.1400205e0
xor edi, edi
mov dword [rbp + rbx - 0x40], 0x1000000
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rdi
lea r9, [rbx + 4]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x40]
mov qword [rsp + 0x28], rdi
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.1400077ac
lea r13d, [rdi + 0x20]
mov r8d, r13d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.1400205e0
mov eax, dword [rbp + 0x178]
lea rsi, [rbp - 0x80]
dec eax
mov byte [rbp + 0x178], dil
mov dword [rsp + 0x50], eax
lea r14d, [r13 - 0x1d]
mov rax, qword [rbp + 0x160]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x170]
mov byte [rbp + 0x160], dil
lea rdi, [rsp + 0x50]
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x54], 0x10
mov dword [rsp + 0x58], 0x10
cmp dword [rdi], 0
jbe 0x140007c1b
mov ebx, dword [rdi]
lea rax, [rbp + 0x178]
mov r9, r13
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x60]
lea rax, [rbp + 0x30]
mov rdx, r15
mov qword [rsp + 0x38], rax
mov rcx, r12
lea rax, [rbp + 0x160]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
call fcn.1400077ac
mov r8, r13
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.1400205e0
xor eax, eax
lea ecx, [rax + 2]
movdqu xmm0, xmmword [rbp + rax - 0x68]
movdqu xmm1, xmmword [rsp + rax + 0x60]
lea rax, [rax + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x78], xmm1
sub rcx, 1
jne 0x140007bf1
sub rbx, 1
jne 0x140007b92
mov rcx, qword [rsi]
lea rdx, [rbp - 0x68]
mov r8, r13
call fcn.1400205e0
add rdi, 4
add rsi, 8
sub r14, 1
jne 0x140007b87
lea edx, [r14 + 0x44]
lea rcx, [rbp - 0x40]
call fcn.140011378
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.140011378
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.140011378
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.140011378
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000ab4c
Capabilities:
Move file

Disassembly:
push rbp
push r14
push r15
lea rbp, [rsp - 0x4f60]
mov eax, 0x5060
call fcn.14001e3f0
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x5080], rbx
mov qword [rsp + 0x5088], rsi
mov qword [rsp + 0x5090], rdi
mov rbx, rcx
mov r15d, 0x800
mov r8d, r15d
lea rdx, [rbp + 0x2f60]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
lea edi, [r15 - 2]
cmp eax, edi
ja 0x14000ad44
mov r8d, r15d
lea rdx, [rbp + 0x3f60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
dec eax
cmp eax, edi
ja 0x14000ad44
lea rcx, [rbp + 0x2f60]
call fcn.14000e8d4
mov rsi, rax
lea rcx, [rbp + 0x3f60]
call fcn.14000e8d4
mov rdi, rax
xor r14d, r14d
cmp word [rax], r14w
je 0x14000ad44
mov rdx, rax
mov rcx, rsi
call fcn.140014a2c
test eax, eax
je 0x14000ad44
mov rcx, rbx
call fcn.14000e8d4
mov rcx, rax
mov rdx, rdi
call fcn.140014a2c
test eax, eax
jne 0x14000ad44
movzx eax, r14w
mov word [rsp + 0x30], ax
mov edi, r14d
test ax, ax
jne 0x14000ac96
mov r8, r15
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14001284c
lea rcx, [rsp + 0x30]
call fcn.14000e8d4
mov rcx, rax
mov r9d, edi
lea r8, str.rtmp_d
mov rdx, r15
call fcn.140003f64
lea rcx, [rsp + 0x30]
call fcn.14000b9a8
test al, al
je 0x14000ac7d
mov eax, r14d
mov word [rsp + 0x30], ax
jmp 0x14000ac82
movzx eax, word [rsp + 0x30]
add edi, 0x7b
cmp edi, 0x2710
jl 0x14000ac31
test ax, ax
je 0x14000ad44
mov r8, r15
mov rdx, rbx
lea rcx, [rbp + 0x1f60]
call fcn.14001284c
mov r8, r15
mov rdx, rsi
lea rcx, [rbp + 0x1f60]
call fcn.14000e960
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x1f60]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000ad44
lea rcx, [rbp + 0xf30]
call fcn.14000ad64
nop
mov dil, r14b
mov rcx, rbx
call fcn.14000b9a8
test al, al
jne 0x14000ad04
mov r8d, 0x12
mov rdx, rbx
lea rcx, [rbp + 0xf30]
call fcn.14000ae7c
mov dil, al
lea rdx, [rbp + 0x1f60]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test dil, dil
je 0x14000ad34
lea rcx, [rbp + 0xf30]
call fcn.14000ae14
lea rcx, [rbp + 0xf30]
call fcn.14000af9c
nop
lea rcx, [rbp + 0xf30]
call fcn.14000ada0
mov al, 1
jmp 0x14000ad46
xor al, al
lea r11, [rsp + 0x5060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000af9c
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rcx
je 0x14000afb3
xor al, al
add rsp, 0x20
pop rbx
ret
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x14000afbf
call fcn.14000ae14
cmp byte [rbx + 0x1b], 0
je 0x14000afab
lea rcx, [rbx + 0x26]
add rsp, 0x20
pop rbx
jmp fcn.14000b948