joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011b808
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
lea rdi, [0x140491ce8]
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov edx, 0x104
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
jne 0x14011b8bb
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jle 0x14011b875
movzx ebx, ax
or ebx, 0x80070000
call fcn.1400a4e1c
cmp dword [rax], 2
jbe 0x14011b8b2
lea rcx, str.DataCollection_adapter_failed_to_read_Windows_Directory
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rcx
lea rdx, [0x1403f65f8]
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rcx
mov rcx, rax
call fcn.140007558
lea rdx, [0x140361390]
jmp 0x14011b8c0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1400aeef0
mov rax, rdi
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140123570
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret

Function at 0x14011b8f4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], 7
mov word [rcx], di
mov dword [rsp + 0x20], 1
mov edx, 0x103
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
nop dword [rax + rax]
test eax, eax
je 0x14011b978
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x30]
call fcn.1400aeef0
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.140243dc4
lea rcx, [rsp + 0x30]
call fcn.14007a7c0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140123570
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret

Function at 0x14011bb08
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov byte [rcx], 0
mov ecx, 0x202
lea rdx, [rsp + 0xc0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
nop dword [rax + rax]
test eax, eax
je 0x14011bb63
mov rcx, qword [rsp + 0x278]
lea r8, str.amcorewcd_sourcemachinestatecollectionmachineinfoWinsockApiHelper.h
mov r9d, eax
mov edx, MsiGetActiveDatabase
call fcn.14022255c
int3
movzx ecx, word [rsp + 0xc0]
cmp cl, 2
jne 0x14011bb99
shr cx, 8
cmp cl, 2
jne 0x14011bb99
mov byte [rbx], 1
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140123570
add rsp, 0x270
pop rbx
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
nop dword [rax + rax]
and dword [rsp + 0x30], 0
lea rax, str.Could_not_find_a_usable_version_of_Winsock.dll
mov ecx, 0xc8
mov qword [rsp + 0x40], rax
call fcn.140123b7c
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.14012a134
lea rdx, [0x140448880]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
Function at 0x14011cf24
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
cmp rdx, 0x400
jbe 0x14011cf6c
lea rbx, [rdx - 0x401]
shr rbx, 0xa
inc rbx
imul rax, rbx, 0xfffffffffffffc00
add rdi, rax
mov r8d, 0x400
lea rdx, [0x140361e00]
call fcn.1400dfc90
mov ecx, eax
sub rbx, 1
jne 0x14011cf52
mov r8, rdi
lea rdx, [0x140361e00]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1400dfc90
Function at 0x1401267d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
mov rcx, r9
mov r8, qword [rsp + 0x80]
mov r9, qword [rsp + 0x88]
mov r13, rsi
mov rsi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xd0]
mov qword [rsp], r8
mov r8d, dword [rsp + 0x98]
mov r14, rdx
mov r15, rcx
xor eax, eax
mov esi, dword [rsi]
mov ebx, dword [rbx]
mov qword [rsp + 8], rax
jmp 0x140126838
add eax, 1
add esi, 1
mov dword [rsp + 8], eax
cmp esi, dword [rsp + 0xa0]
jge 0x140126969
cmp eax, dword [rsp + 0xa8]
jge 0x140126969
movzx eax, byte [rsi + rdi + 2]
shl ebx, 5
xor ebx, eax
mov r11, rsi
and ebx, r8d
movsxd rbp, dword [r9 + rbx*4]
mov dword [r9 + rbx*4], esi
mov r12, rdi
sub r11, rbp
cmp r11d, dword [rsp + 0x90]
jge 0x140126939
cmp ebp, dword [rsp + 0xb0]
jge 0x14012688b
mov r12, qword [rsp]
movzx eax, word [rsi + rdi]
lea r10, [rsi + rdi]
movzx ecx, word [rbp + r12]
lea r12, [rbp + r12]
cmp eax, ecx
jne 0x140126939
xor ecx, ecx
mov rax, qword [rcx + r10]
mov rdx, qword [rcx + r12]
xor rax, rdx
jne 0x1401268d3
add ecx, 8
cmp ecx, 0x100
jl 0x1401268a8
movzx eax, word [rcx + r10]
movzx edx, word [rcx + r12]
xor eax, edx
jne 0x1401268d3
add ecx, 2
jmp 0x1401268dd
bsf rax, rax
shr rax, 3
add ecx, eax
cmp ecx, 3
jl 0x140126939
lea rbp, [rsi + 1]
lea rsi, [rcx + rsi - 1]
lea rdx, [rcx - 3]
movzx ecx, byte [rbp + rdi + 2]
shl ebx, 5
xor ebx, ecx
and ebx, r8d
mov dword [r9 + rbx*4], ebp
add ebp, 1
cmp ebp, esi
jle 0x1401268ef
lea rcx, [r11 - 1]
cmp r11, 0x101
jl 0x14012691d
shr ecx, 7
add ecx, 0x100
movzx ecx, byte [rcx + r13 + 0x100]
add word [r15 + rcx*4], 1
movzx ebp, byte [rdx + r13]
add ebp, 0x101
jmp 0x140126942
xor r11, r11
movzx edx, byte [rsi + rdi]
mov ebp, edx
add word [r14 + rbp*4], 1
mov eax, dword [rsp + 8]
mov rcx, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov word [rcx + rax*2], r11w
mov byte [rax + rbp], dl
jmp 0x14012682e
mov rdi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
mov dword [rdi], esi
mov dword [rcx], ebx
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rbp
pop rbx
pop rdi
pop rsi
ret

Function at 0x14015bc2c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
sub r9, r8
mov rax, rdx
sub rax, rcx
mov r15, r8
xor rax, r9
mov rbp, rdx
mov r14, rcx
test rax, 0xfffffffffffffffe
jne 0x14015bca8
mov rbx, qword [rsp + 0x60]
sub r15, rcx
cmp r14, rbp
je 0x14015bcac
movzx edx, word [r15 + r14]
mov rcx, qword [rbx + 8]
movzx esi, word [r14]
call qword [sym.imp.msvcp_win.dll_public:_wchar_t___cdecl_std::ctype_wchar_t_::tolower_wchar_t_const___ptr64]
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
movzx edx, si
movzx edi, ax
call qword [sym.imp.msvcp_win.dll_public:_wchar_t___cdecl_std::ctype_wchar_t_::tolower_wchar_t_const___ptr64]
nop dword [rax + rax]
cmp ax, di
jne 0x14015bca8
add r14, 2
jmp 0x14015bc69
xor al, al
jmp 0x14015bcae
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x140238b30
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov r14, rcx
mov edx, 0x105
lea rcx, [rbp - 0x48]
call fcn.140094660
nop
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140238b73
mov rcx, qword [rdi]
lea r9, [rbp - 0x50]
mov r8d, 0x104
mov rdx, qword [rbp - 0x48]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
xor r15d, r15d
test eax, eax
jne 0x140238c33
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0xea
jne 0x140238c33
mov esi, dword [rbp - 0x50]
inc esi
mov r8d, esi
mov r9, qword [rbp - 0x40]
mov rcx, r9
mov rdx, qword [rbp - 0x48]
sub rcx, rdx
sar rcx, 1
cmp r8, rcx
jae 0x140238bd7
lea rax, [rdx + rsi*2]
mov qword [rbp - 0x40], rax
jmp 0x140238c12
jbe 0x140238c12
mov rax, qword [rbp - 0x38]
sub rax, rdx
sar rax, 1
cmp r8, rax
jbe 0x140238bf6
mov rdx, r8
lea rcx, [rbp - 0x48]
call fcn.1401eae20
jmp 0x140238c0e
sub r8, rcx
add r8, r8
lea rbx, [r8 + r9]
xor edx, edx
mov rcx, r9
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
mov qword [rbp - 0x40], rbx
mov rdx, qword [rbp - 0x48]
cmp qword [rdi + 0x18], 8
jb 0x140238c1c
mov rdi, qword [rdi]
lea r8d, [rsi - 1]
lea r9, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetVolumePathNamesForVolumeNameW]
nop dword [rax + rax]
mov rbx, qword [rbp - 0x48]
cmp word [rbx], r15w
je 0x140238cc3
or rdi, 0xffffffffffffffff
mov rax, rdi
inc rax
cmp word [rbx + rax*2], r15w
jne 0x140238c48
cmp rax, 3
jne 0x140238ca8
movzx ecx, word [rbx]
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o_isalpha]
nop dword [rax + rax]
test eax, eax
je 0x140238ca8
cmp word [rbx + 2], 0x3a
jne 0x140238ca8
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.1400aeef0
mov rdx, rax
mov rcx, r14
call fcn.14006dfe4
lea rcx, [rbp - 0x30]
call fcn.14007a7c0
mov rcx, r14
call fcn.1402394a0
cmp word [rax], 0x5c
jne 0x140238ca8
mov rcx, r14
call fcn.140239554
mov rax, rdi
inc rax
cmp word [rbx + rax*2], r15w
jne 0x140238cab
lea rbx, [rbx + rax*2]
add rbx, 2
cmp word [rbx], r15w
jne 0x140238c45
lea rcx, [rbp - 0x48]
call fcn.140106354
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140123570
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x140238cf4
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x60]
mov r8d, 0x20a
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140238d3d
mov rcx, qword [rbx]
add rcx, 8
lea rdx, [rsp + 0x60]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
nop dword [rax + rax]
test eax, eax
jne 0x140238dd0
call fcn.1400a4e1c
mov rdi, rax
cmp dword [rax], 3
jbe 0x140238dd0
cmp qword [rbx + 0x18], 8
jb 0x140238d73
mov rbx, qword [rbx]
mov qword [rsp + 0x48], rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140238d90
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x40], eax
lea rdx, [0x1403f1e66]
lea rax, str.QueryDosDeviceW_for_volume_without_a_drive_letter_failed
xor r8d, r8d
mov qword [rsp + 0x50], rax
mov rcx, rdi
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call fcn.14000e40c
lea rcx, [rsi + 0x20]
lea rdx, [rsp + 0x60]
call fcn.14007db10
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140123570
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140239104
Capabilities:
Get disk information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x40
cmp qword [rdx + 0x18], 8
mov rdi, rcx
mov rcx, rdx
mov rbx, rdx
jb 0x14023911f
mov rcx, qword [rdx]
and dword [rsp + 0x38], 0
lea rax, [rdi + 0x64]
and qword [rsp + 0x30], 0
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
and qword [rsp + 0x20], 0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
jne 0x1402391c8
call fcn.1400a4e1c
mov rsi, rax
cmp dword [rax], 3
jbe 0x1402391c8
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14023916b
mov rcx, qword [rbx]
mov qword [rsp + 0x68], rcx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
test eax, eax
jle 0x140239188
movzx eax, ax
or eax, 0x80070000
mov dword [rsp + 0x60], eax
lea rdx, [0x1403f1e66]
lea rax, str.GetVolumeInformation_failed
xor r8d, r8d
mov qword [rsp + 0x70], rax
mov rcx, rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
call fcn.14000e40c
mov rdx, rbx
mov rcx, rdi
call fcn.140238e0c
cmp qword [rbx + 0x18], 8
jb 0x1402391dd
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
nop dword [rax + rax]
cmp al, 2
mov byte [rdi + 0x60], al
sete al
or byte [rdi + 0xf0], al
add rsp, 0x40
pop rdi
pop rsi
pop rbx
ret
Function at 0x140239798
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rsi, r9
movzx r14d, dl
mov r15, rcx
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
and qword [rbp - 0x30], 0
xor ebx, ebx
mov qword [rbp - 0x50], rbx
test r8b, r8b
je 0x1402398a3
lea rcx, [rbp - 0x48]
call fcn.140246684
mov rdi, rax
lea rax, [rbp - 0x50]
cmp rax, rdi
je 0x140239804
mov rdx, qword [rdi]
lea rcx, [rbp - 0x50]
call fcn.140239ad8
and qword [rdi], rbx
mov rbx, qword [rbp - 0x50]
lea rcx, [rbp - 0x48]
call fcn.140239610
test rbx, rbx
jne 0x140239890
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.1400a4e1c
cmp dword [rax], 2
jbe 0x140239859
lea rcx, str.Failed_to_create_sense_sid
mov qword [rbp - 0x48], rcx
mov dword [rbp + 0x30], ebx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1403f1e37]
mov rcx, rax
call fcn.140007558
test ebx, ebx
jle 0x140239866
movzx ebx, bx
or ebx, 0x80070000
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rax, vtable.sense::Common::SafeCreateProcessException.0
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x10], ebx
and dword [rbp - 0xc], 0
lea rdx, [0x140448780]
lea rcx, [rbp - 0x28]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
int3
mov qword [rbp - 0x48], rbx
lea r8, [rbp - 0x48]
xor edx, edx
lea rcx, [rbp - 0x40]
call fcn.14014e5a4
mov edx, r14d
lea rcx, [rbp - 0x48]
test rsi, rsi
je 0x1402398c0
lea r9, [rbp - 0x40]
mov r8d, edx
mov rdx, r15
call fcn.14024654c
jmp 0x1402398c9
lea r8, [rbp - 0x40]
call fcn.14010ab50
mov rbx, qword [rbp + 0x40]
mov rdx, rax
mov rcx, rbx
call fcn.14012c764
lea rcx, [rbp - 0x48]
call fcn.1400fffac
mov rax, qword [rbx]
inc rax
test rax, 0xfffffffffffffffe
jne 0x14023996d
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.1400a4e1c
cmp dword [rax], 2
jbe 0x140239936
lea rcx, [0x140396a60]
mov qword [rbp - 0x48], rcx
mov dword [rbp + 0x30], ebx
lea rcx, [rbp - 0x48]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1403f1e37]
mov rcx, rax
call fcn.140007558
test ebx, ebx
jle 0x140239943
movzx ebx, bx
or ebx, 0x80070000
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rax, vtable.sense::Common::SafeCreateProcessException.0
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x10], ebx
and dword [rbp - 0xc], 0
lea rdx, [0x140448780]
lea rcx, [rbp - 0x28]
call sub.api_ms_win_crt_private_l1_1_0.dll__CxxThrowException
nop
lea rcx, [rbp - 0x50]
call fcn.140239610
nop
lea rcx, [rbp - 0x40]
call fcn.140097558
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x14023d2ec
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
xor edi, edi
mov rbx, rcx
cmp qword [rcx + 0x18], 8
jb 0x14023d305
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop dword [rax + rax]
cmp eax, 0xffffffff
je 0x14023d335
test al, 0x10
je 0x14023d335
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14023d327
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
nop dword [rax + rax]
jmp 0x14023d34e
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x14023d342
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop dword [rax + rax]
test eax, eax
jne 0x14023d399
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
lea edx, [rax - 2]
cmp edx, 1
jbe 0x14023d399
cmp qword [rbx + 0x18], 8
jb 0x14023d372
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop dword [rax + rax]
test eax, eax
jne 0x14023d399
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov edi, eax
mov rbx, qword [rsp + 0x30]
mov eax, edi
add rsp, 0x20
pop rdi
ret
Function at 0x140244fac
Capabilities:
Accept command line arguments

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xf0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, r8
mov r14, rdx
mov rdi, rcx
cmp qword [rcx + 0x10], 0
jne 0x140244fff
lea rdi, [0x140361390]
mov rdx, rdi
mov rcx, r14
call fcn.14007db10
mov rdx, rdi
mov rcx, rsi
call fcn.14007db10
jmp 0x1402451d5
and dword [rbp - 0x79], 0
cmp qword [rcx + 0x18], 8
jb 0x14024500d
mov rcx, qword [rcx]
lea rdx, [rbp - 0x79]
call qword [sym.imp.api_ms_win_shcore_obsolete_l1_1_0.dll_CommandLineToArgvW]
nop dword [rax + rax]
mov rbx, rax
mov qword [rbp - 0x61], rax
test rax, rax
je 0x14024514f
cmp dword [rbp - 0x79], 1
jl 0x14024514f
mov rdx, qword [rax]
mov rcx, r14
call fcn.14007db10
cmp dword [rbp - 0x79], 1
jle 0x14024504e
mov rdi, qword [rbx + 8]
jmp 0x140245055
lea rdi, [0x140361390]
mov rdx, rdi
mov rcx, rsi
call fcn.14007db10
mov edi, 2
cmp dword [rbp - 0x79], edi
jle 0x1402451cc
add rbx, 0x10
mov rdx, qword [rbx]
lea rcx, [rbp - 0x59]
call fcn.1400aeef0
nop
xor r8d, r8d
lea rdx, [0x14039851c]
lea rcx, [rbp - 0x59]
call fcn.1400cf670
mov rdx, rsi
cmp rax, 0xffffffffffffffff
jne 0x1402450d7
lea r8, [0x14039851c]
lea rcx, [rbp - 0x19]
call fcn.140064ca0
nop
lea r8, [rbp - 0x59]
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140100c18
mov rdx, rax
mov rcx, rsi
call fcn.14006dfe4
lea rcx, [rbp - 0x39]
call fcn.14007a7c0
nop
lea rcx, [rbp - 0x19]
jmp 0x14024512f
lea r8, [0x140398514]
lea rcx, [rbp + 7]
call fcn.140064ca0
nop
lea r8, [rbp - 0x59]
mov rdx, rax
lea rcx, [rbp - 0x39]
call fcn.140100c18
nop
lea r8, [0x140398520]
mov rdx, rax
lea rcx, [rbp - 0x19]
call fcn.14006d288
mov rdx, rax
mov rcx, rsi
call fcn.14006dfe4
lea rcx, [rbp - 0x19]
call fcn.14007a7c0
nop
lea rcx, [rbp - 0x39]
call fcn.14007a7c0
nop
lea rcx, [rbp + 7]
call fcn.14007a7c0
nop
lea rcx, [rbp - 0x59]
call fcn.14007a7c0
inc edi
add rbx, 8
cmp edi, dword [rbp - 0x79]
jl 0x140245072
jmp 0x1402451cc
call fcn.1400a4e1c
mov rbx, rax
cmp dword [rax], 3
jbe 0x1402451b1
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov dword [rbp - 0x75], eax
mov rcx, rdi
cmp qword [rdi + 0x18], 8
jb 0x140245178
mov rcx, qword [rdi]
mov qword [rbp - 0x71], rcx
lea rax, str.The_call_to_CommandLineToArgv_has_failed
mov qword [rbp - 0x69], rax
lea rax, [rbp - 0x75]
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x71]
mov qword [rsp + 0x28], rax
lea rax, [rbp - 0x69]
mov qword [rsp + 0x20], rax
lea rdx, [0x1403f2d5b]
mov rcx, rbx
call fcn.140005c2c
mov rdx, rdi
mov rcx, r14
call fcn.14007da00
lea rdx, [0x140361390]
mov rcx, rsi
call fcn.14007db10
nop
lea rcx, [rbp - 0x61]
call fcn.140102f84
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.140123570
add rsp, 0xf0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140276c50
Capabilities:
Check if file exists
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x140477ad0]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov rdi, rdx
mov rbx, rcx
mov edx, 0x80
mov rax, qword gs:[0x58]
mov rcx, qword [rax]
mov eax, dword [rdx + rcx]
cmp dword [0x14049ca64], eax
jle 0x140276cd5
lea rcx, [0x14049ca64]
call fcn.1401297d0
cmp dword [0x14049ca64], 0xffffffff
jne 0x140276cd5
lea rdx, [0x14039cb70]
lea rcx, [0x14049ca68]
call fcn.1400aeef0
lea rcx, [0x14033a9a0]
call fcn.140123b20
nop
lea rcx, [0x14049ca64]
call fcn.140129768
mov edx, 0x104
lea rcx, [rbp - 0x19]
call fcn.140094660
nop
movdqa xmm0, xmmword [0x1403600d0]
movdqu xmmword [rbp + 0xf], xmm0
xor esi, esi
mov word [rbp - 1], si
mov rax, qword [rbp - 0x11]
mov rcx, qword [rbp - 0x19]
sub rax, rcx
sar rax, 1
cmp qword [rbx + 0x18], 8
jb 0x140276d0f
mov rbx, qword [rbx]
mov dword [rsp + 0x38], eax
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
nop dword [rax + rax]
test eax, eax
je 0x140276d64
mov rdx, qword [rbp - 0x19]
lea rcx, [rbp + 0x1f]
call fcn.1400aeef0
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.14006dfe4
lea rcx, [rbp + 0x1f]
call fcn.14007a7c0
jmp 0x140276def
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
call fcn.1400a4e1c
cmp dword [rax], 2
jbe 0x140276dab
lea rcx, str.GetVolumeInformation_failed
mov qword [rbp - 0x21], rcx
mov dword [rbp - 0x29], ebx
lea rcx, [rbp - 0x21]
mov qword [rsp + 0x28], rcx
lea rcx, [rbp - 0x29]
mov qword [rsp + 0x20], rcx
lea rdx, [0x1403f1e37]
mov rcx, rax
call fcn.140007558
cmp ebx, 0x3ed
je 0x140276ddf
cmp ebx, 0x80310000
je 0x140276ddf
cmp ebx, 3
je 0x140276ddf
cmp ebx, 0x80070005
je 0x140276ddf
cmp ebx, 0x45d
je 0x140276ddf
test ebx, ebx
jle 0x140276e06
movzx ebx, bx
or ebx, 0x80070000
jmp 0x140276e06
lea rdx, [0x140361390]
lea rcx, [rbp - 1]
call fcn.14007db10
xor r8d, r8d
lea rdx, [0x14049ca68]
lea rcx, [rbp - 1]
call fcn.1400d0280
mov byte [rdi], al
mov ebx, esi
lea rcx, [rbp - 1]
call fcn.14007a7c0
nop
lea rcx, [rbp - 0x19]
call fcn.140106354
mov eax, ebx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140123570
mov rbx, qword [rsp + 0xe0]
add rsp, 0xb0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402def98
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov r10d, dword [r8]
mov rsi, r8
lea r14, [0x140000000]
not r10d
mov r11d, edx
mov rbx, rcx
cmp edx, 0xf
jl 0x1402df0a5
mov r9d, ecx
and r9d, 7
je 0x1402df000
neg r9d
and r9d, 7
sub r11d, r9d
movzx ecx, byte [rbx]
mov eax, r10d
xor rcx, rax
inc rbx
shr eax, 8
movzx edx, cl
mov r10d, dword [r14 + rdx*4 + 0x360c00]
xor r10d, eax
sub r9d, 1
jne 0x1402defdd
mov edi, r11d
sar edi, 3
and r11d, 7
mov r8, qword [rbx]
mov r9d, dword [rbx]
add rbx, 8
mov eax, r10d
xor r9, rax
shr r8, 0x20
mov rax, r8
shr rax, 0x10
movzx edx, al
mov rax, r8
shr rax, 8
movzx ecx, al
mov rax, r9
shr rax, 0x10
mov r10d, dword [r14 + rdx*4 + 0x39dcb0]
xor r10d, dword [r14 + rcx*4 + 0x39d4b0]
movzx ecx, al
mov rax, r9
shr rax, 8
xor r10d, dword [r14 + rcx*4 + 0x39d0b0]
movzx ecx, al
mov rax, r8
shr rax, 0x18
xor r10d, dword [r14 + rcx*4 + 0x39e4b0]
xor r10d, dword [r14 + rax*4 + 0x360c00]
mov rax, r9
shr rax, 0x18
xor r10d, dword [r14 + rax*4 + 0x39d8b0]
movzx eax, r8b
xor r10d, dword [r14 + rax*4 + 0x39e0b0]
movzx eax, r9b
xor r10d, dword [r14 + rax*4 + 0x39e8b0]
sub edi, 1
jne 0x1402df00a
test r11d, r11d
je 0x1402df0cd
movzx ecx, byte [rbx]
mov eax, r10d
xor rcx, rax
inc rbx
shr eax, 8
movzx edx, cl
mov r10d, dword [r14 + rdx*4 + 0x360c00]
xor r10d, eax
sub r11d, 1
jne 0x1402df0aa
mov rbx, qword [rsp + 8]
not r10d
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
mov dword [rsi], r10d
mov rsi, qword [rsp + 0x10]
ret
Function at 0x1402f573c
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
and qword [rsp + 0x40], 0
mov rbx, rcx
mov ecx, dword [rcx]
mov rsi, rdx
mov r14d, 0x40
lea rdi, [rbx + 0x60]
mov byte [rcx + rbx + 0x20], 0x80
inc ecx
cmp ecx, 0x38
jbe 0x1402f579b
mov eax, ecx
mov edx, r14d
sub edx, ecx
lea rcx, [rbx + 0x20]
add rcx, rax
call fcn.140129ed0
lea r9, [rsp + 0x40]
mov r8d, r14d
lea rdx, [rbx + 0x20]
mov rcx, rdi
call fcn.1402f4018
xor ecx, ecx
mov eax, ecx
mov edx, r14d
sub edx, ecx
lea rcx, [rbx + 0x20]
add rcx, rax
call fcn.140129ed0
mov rax, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
shl rax, 3
lea rdx, [rbx + 0x20]
bswap rax
mov r8, r14
mov qword [rbx + 0x58], rax
mov rcx, rdi
call fcn.1402f4018
mov rcx, rdi
mov r8d, 4
mov rax, qword [rcx]
lea rcx, [rcx + 8]
rol rax, 0x20
bswap rax
mov qword [rsi], rax
lea rsi, [rsi + 8]
sub r8, 1
jne 0x1402f57da
mov edx, 0x80
mov rcx, rbx
call fcn.140129ed0
movups xmm0, xmmword [0x1403b8478]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x1403b8488]
movups xmmword [rdi + 0x10], xmm1
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret