joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5fba20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5fbbbb
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
xor ecx, ecx
jmp 0x5fba41
inc rcx
cmp rbx, rcx
jle 0x5fbbb1
movzx edx, byte [rax + rcx]
cmp dl, 0x80
jb 0x5fba3e
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x80], rax
call fcn.00573dc0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rdi
mov rdx, qword [0x009757c8]
test rsi, rsi
mov r8, qword [rsp + 0x88]
cmovne rbx, r8
mov r8, qword [rsp + 0x80]
cmovne rax, r8
mov r8, rax
mov rax, rdx
mov r9, rbx
mov rbx, r8
mov rcx, r9
mov edi, 1
call fcn.005f7d40
mov rdx, qword [rsp + 0x50]
test rdx, rdx
mov rdx, qword [rsp + 0x58]
mov esi, 0
cmovne rdx, rsi
mov r8, qword [rsp + 0x68]
mov r9d, 0
cmovne r8, r9
nop word [rax + rax]
test rcx, rcx
jne 0x5fbba5
test rdx, rdx
je 0x5fbb9a
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x60], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403d60
xorps xmm15, xmm15
mov r14, qword [0x009dd8a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x5fbb69
xor eax, eax
lea rbx, [0x0073e7b8]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006c5361]
mov r9d, 2
mov r10, qword [rsp + 0x68]
mov r11, qword [rsp + 0x58]
call fcn.0044fa00
jmp 0x5fbb90
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x0073e788]
mov esi, 1
mov r8, qword [rsp + 0x68]
mov r9, qword [rsp + 0x58]
call fcn.0044f940
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
mov rdi, r9
add rsp, 0x70
pop rbp
ret
mov rax, r9
mov rbx, rsi
add rsp, 0x70
pop rbp
ret
xor ecx, ecx
xor edi, edi
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004652a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005fba20
Function at 0x639c20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x639d22
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov rcx, qword [rax + 0x28]
mov rbx, qword [rax + 0x30]
nop
mov rax, rcx
call fcn.00587bc0
test rdi, rdi
jne 0x639c73
mov rbx, qword [0x00988488]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rdx]
mov rdi, qword [rdx + 8]
lea rax, [0x0067d1e0]
call fcn.00412420
mov rdi, qword [rax + 8]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x78]
call fcn.00639bc0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
nop
call fcn.00403d60
xorps xmm15, xmm15
mov r14, qword [0x009dd8a0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x639cf5
xor eax, eax
lea rbx, [0x0073e7b8]
mov ecx, 1
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
lea r8, [0x006c5361]
mov r9d, 2
mov r10, qword [rsp + 0x58]
mov r11, qword [rsp + 0x48]
call fcn.0044fa00
jmp 0x639d1c
xor eax, eax
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x50]
lea rdi, [0x0073e788]
mov esi, 1
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x48]
call fcn.0044f940
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.004652a0
mov rax, qword [rsp + 8]
jmp fcn.00639c20
Function at 0x1400179b4
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov eax, 0x5a4d
cmp word [0x140000000], ax
jne 0x140017a3d
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x1400179ff
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a4d
mov ecx, 0x20b
cmp word [rax + 0x18], cx
je 0x140017a15
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a4d
cmp dword [rax + 0x84], 0xe
ja 0x140017a29
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
jmp 0x140017a4d
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xb0], ebx
jmp 0x140017a4d
xor ebx, ebx
mov dword [rsp + 0xb0], ebx
lea rdi, [0x140000000]
mov ecx, 1
call fcn.14001c410
test eax, eax
jne 0x140017a7d
cmp dword [0x14003fbb8], 1
jne 0x140017a69
call fcn.14001b710
mov ecx, 0x1c
call fcn.14001b4e8
mov ecx, 0xff
call fcn.14001b0ac
call fcn.1400182c4
test eax, eax
jne 0x140017aa8
cmp dword [0x14003fbb8], 1
jne 0x140017a94
call fcn.14001b710
mov ecx, 0x10
call fcn.14001b4e8
mov ecx, 0xff
call fcn.14001b0ac
call fcn.14001c3a0
nop
call fcn.14001c0b0
test eax, eax
jns 0x140017ac1
mov ecx, 0x1b
call fcn.14001b040
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov qword [0x140040c70], rax
call fcn.14001befc
mov qword [0x14003fba8], rax
call fcn.14001be04
test eax, eax
jns 0x140017aed
mov ecx, 8
call fcn.14001b040
call fcn.14001bb04
test eax, eax
jns 0x140017b00
mov ecx, 9
call fcn.14001b040
mov ecx, 1
call fcn.14001b14c
test eax, eax
je 0x140017b15
mov ecx, eax
call fcn.14001b040
call fcn.14001ba88
test byte [rsp + 0x6c], 1
movzx edx, word [rsp + 0x70]
mov r9d, 0xa
cmovne r9d, edx
mov r8, rax
xor edx, edx
mov rcx, rdi
call section..text
mov edi, eax
mov dword [rsp + 0x20], eax
test ebx, ebx
jne 0x140017b4c
mov ecx, eax
call fcn.14001b388
call fcn.14001b3a0
jmp 0x140017b6d
mov eax, edi
jmp 0x140017b76
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.1400d0000
add rsp, 0x28
jmp 0x1400179b4
Function at 0x14000f078
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140019760], eax
call fcn.14000fa48
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140019760], 0
jne case.default.0x14000f0ce
mov ecx, 1
call fcn.14000fa48
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
invalid
jge 0x1400296b8
mov ecx, 0xf55a88fc
in eax, 0x52
mov bl, 0x88
mov bl, al
fsub qword [0x1753aa428]
test byte [rax + 0xd9d4fdc], 0xc5
test byte [rax + 0xd9d4fdc], 0xc5
cdq
int1
out 0x45, eax
shr byte [rdi - 0x3281a1ca], 1
cmp r9b, byte [r8 - 0x634f3e3c]
cld
jae 0x1400296d9
xor esp, dword [rbx + 0x41088487]
mov r11d, 0x1905c132
cmp dl, byte [rdx + rcx]
pop rax
mov al, 0x3a
pop rdx
fimul dword [rbp - 0x254f8c24]
outsd dx, dword [rsi]
ficomp dword [r9 + 0x5f787b41]
pop rsp
mov bh, 0xfa
leave
jp 0x14002976c
jrcxz 0x140029757
sbb dl, ah
rol ebx, 0x88
invalid
stc
add al, byte [rbp + rdi + 0xc]
mov esi, 0xef3ff04b
lodsb al, byte [rsi]
invalid
test byte [rbx], ch
cmp byte [rdi], ch
or r8, qword [rax - 0xf17c2ba]
jnp 0x1400297ee
iretd
mov edi, 0xcdd08fdc
invalid
Function at 0x140fcf058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.140fcf1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140fcf089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fcf06f
add dl, dl
jne 0x140fcf096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fcf0f6
xor eax, eax
add dl, dl
jne 0x140fcf0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140fcf1ad
add dl, dl
jne 0x140fcf0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fcf0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fcf0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fcf0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140fcf0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140fcf07e
mov eax, 1
add dl, dl
jne 0x140fcf106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140fcf113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fcf0fb
sub eax, ebx
mov ebx, 1
jne 0x140fcf14c
mov ecx, 1
add dl, dl
jne 0x140fcf12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fcf13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fcf123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fcf07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140fcf168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140fcf175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140fcf15d
cmp eax, 0x7d00
jae 0x140fcf19b
cmp eax, 0x500
jb 0x140fcf196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fcf07e
cmp eax, 0x7f
ja 0x140fcf19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140fcf07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140fcf1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140fcf07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20

Function at 0x1800010b0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, edx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
test ebx, ebx
je 0x180001116
cmp ebx, 1
jne 0x18000112a
lea rcx, section..text
call fcn.1800014d8
xor eax, eax
lea r8, [0x180001020]
mov qword [rsp + 0x28], rax
mov r9, rdi
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov rcx, rdi
mov qword [0x180003630], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [0x180003630]
mov byte [0x180003034], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x30
pop rdi
ret
Function at 0x1400064bc
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp dword [0x14005f954], 2
mov edi, r8d
mov esi, edx
mov rbx, rcx
jl 0x14000651c
movdqa xmm0, xmmword [0x140037a80]
movdqa xmm1, xmmword [0x140037a70]
movdqa xmmword [0x14004a6d0], xmm0
movdqa xmm0, xmmword [0x140037a50]
movdqa xmmword [0x14004a6e0], xmm1
movdqa xmm1, xmmword [0x140037a60]
movdqa xmmword [0x14004a6f0], xmm0
movdqa xmmword [0x14004a700], xmm1
xor edx, edx
mov r8d, 0xf0
call fcn.1400226a0
xor edx, edx
mov qword [rbx + 0x110], rdx
mov byte [rbx + 0x118], dl
mov rcx, qword [rbx + 0xf8]
lea rax, [0x140037a30]
mov eax, dword [rdx + rax]
mov dword [rdx + rcx], eax
add rdx, 4
cmp rdx, 0x20
jl 0x140006538
mov rax, qword [rbx + 0xf8]
bts edi, 0xd
shl edi, 0x10
xor dword [rax], 0x2080020
mov rax, qword [rbx + 0xf8]
xor dword [rax + 8], esi
mov rax, qword [rbx + 0xf8]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
xor dword [rax + 0xc], edi
add rsp, 0x20
pop rdi
ret

Function at 0x140007934
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x830
mov rax, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x30]
mov rcx, rax
mov r8d, 0x400
call fcn.140015f00
mov esi, 1
mov ecx, esi
call fcn.1400293e0
cmp rbx, rax
jne 0x140007979
cmp byte [0x14004b72d], 0
jne 0x14000799b
mov ebp, 2
mov ecx, ebp
call fcn.1400293e0
cmp rbx, rax
jne 0x140007a5e
cmp byte [0x14004b72e], 0
je 0x140007a5e
mov ecx, esi
call fcn.1400293e0
sub rbx, rax
neg rbx
sbb ecx, ecx
add ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbp, rax
call fcn.140004f94
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdi, [0x14004df30]
mov esi, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
mov r8d, esi
call fcn.140028cd8
mov eax, dword [0x14004b728]
mov rcx, rdi
cmp eax, 3
jne 0x140007a01
call fcn.14002689c
mov rdx, rdi
lea r8d, [rax + rax]
jmp 0x140007a45
lea rbx, [0x140050f30]
mov r8, rsi
mov rdx, rbx
cmp eax, 4
jne 0x140007a1a
call fcn.1400183d4
jmp 0x140007a1f
call fcn.14001833c
test dword [0x14004b728], 0xfffffffd
jne 0x140007a37
mov rdx, rbx
mov rcx, rbx
call qword [sym.imp.USER32.dll_CharToOemA]
mov rcx, rbx
call fcn.140028f60
mov r8, rax
mov rdx, rbx
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x850]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140007acb
call fcn.140004f94
mov qword [rsp + 0x28], rdi
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdi, [0x14004df30]
mov r8d, 0x1800
mov rdx, rdi
mov rcx, qword [rax]
call fcn.140028cd8
mov ecx, ebp
call fcn.1400293e0
xor ecx, ecx
cmp rbx, rax
setne cl
add ecx, 0xfffffff4
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rdi
mov rbx, rax
call fcn.14002689c
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x868]
mov r8, rax
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteConsoleW]
mov rbx, qword [rsp + 0x858]
add rsp, 0x830
pop rdi
pop rsi
pop rbp
ret
Function at 0x140007d2c
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x140007d52
movzx r9d, byte [rdx]
inc rdx
movzx eax, cl
xor r9, rax
shr ecx, 8
lea rax, [0x140052730]
xor ecx, dword [rax + r9*4]
sub r8, 1
jne 0x140007d31
mov eax, ecx
ret

Function at 0x140007fb8
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r14
sub rsp, 0x70
cmp dword [rcx], 2
lea rbx, [rcx + 4]
mov rsi, rdx
mov rdi, rcx
mov r14d, 0x20
jne 0x140008044
and qword [r11 - 0x38], 0
lea r9d, [r14 - 0x1c]
and qword [r11 - 0x40], 0
lea r8, [r11 + 8]
mov eax, dword [rbx]
mov edx, r14d
and qword [r11 - 0x48], 0
mov rcx, rsi
and qword [r11 - 0x50], 0
mov dword [r11 + 8], eax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x58], rax
call fcn.140008920
xor r9d, r9d
lea r10, [rsp + 0x50]
xor r8d, r8d
movzx edx, byte [r10]
mov ecx, r9d
and ecx, 3
inc r9d
shl ecx, 3
inc r10
shl edx, cl
xor edx, r8d
mov r8d, edx
cmp r9d, r14d
jb 0x140008022
mov dword [rbx], edx
cmp dword [rdi], 3
jne 0x14000808c
and qword [rsp + 0x40], 0
lea rax, [rsp + 0x50]
and qword [rsp + 0x38], 0
mov r9, r14
and qword [rsp + 0x30], 0
mov r8, rbx
and qword [rsp + 0x28], 0
mov rdx, r14
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.140008920
mov r8, r14
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140023440
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x140008580
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], r9
push rbp
push rdi
push r13
push r14
push r15
lea rbp, [rax - 0x7c8]
sub rsp, 0x8a0
mov r14d, dword [rbp + 0x800]
mov rdi, r8
mov r13b, dl
mov r15, rcx
cmp r14d, 0x18
ja 0x1400087bb
xor esi, esi
lea rbx, [rcx + 0x148]
mov rdx, rdi
mov rcx, rbx
call fcn.140014978
test al, al
je 0x1400085fb
lea rcx, [rbx + 0x20]
cmp dword [rcx + 0x30], r14d
jne 0x1400085fb
mov rdx, qword [rbp + 0x7f0]
mov r8d, 0x10
call fcn.140023340
test eax, eax
je 0x1400087d7
inc esi
add rbx, 0x98
cmp esi, 4
jb 0x1400085c8
mov rcx, qword [rbp + 0x7e8]
lea rdx, [rbp - 0x60]
mov esi, 0x800
mov r8d, esi
call fcn.1400183d4
mov ecx, r14d
mov ebx, 1
shl ebx, cl
lea rcx, [rbp - 0x60]
call fcn.140028f60
mov r8, qword [rbp + 0x7f0]
lea rcx, [rbp - 0x60]
mov rdx, rax
mov dword [rsp + 0x38], ebx
lea rax, [rsp + 0x60]
mov ebx, 0x10
mov qword [rsp + 0x30], rax
mov r9d, ebx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140008c04
mov edx, esi
lea rcx, [rbp - 0x60]
call fcn.140014c74
mov ecx, dword [r15 + 0x3a8]
mov eax, ecx
and eax, 3
imul rsi, rax, 0x98
lea eax, [rcx + 1]
add rsi, 0x148
mov dword [r15 + 0x3a8], eax
add rsi, r15
mov dword [rsi + 0x50], r14d
cmp rsi, rdi
je 0x1400086c1
mov r9b, byte [rbp + 0x800]
mov rcx, rsi
mov r8, qword [rdi + 8]
mov rdx, qword [rdi]
call fcn.140007da0
mov al, byte [rdi + 0x18]
lea rcx, [rsi + 0x20]
mov rdx, qword [rbp + 0x7f0]
mov r8, rbx
mov byte [rsi + 0x18], al
call fcn.140023440
mov edi, 0x20
lea rdx, [rsp + 0x40]
mov r8d, edi
lea rcx, [rsi + 0x30]
call fcn.140023440
lea rcx, [rsi + 0x54]
mov r8d, edi
lea rdx, [rsp + 0x60]
call fcn.140023440
lea rcx, [rsi + 0x74]
mov r8d, edi
lea rdx, [rbp - 0x80]
call fcn.140023440
xor r9d, r9d
lea rcx, [rsi + 0x30]
mov r8b, 1
mov edx, edi
call fcn.140014ab8
mov rcx, qword [rbp + 0x808]
test rcx, rcx
je 0x14000873a
mov r8, rdi
lea rdx, [rbp - 0x80]
call fcn.140023440
mov rbx, qword [rbp + 0x810]
test rbx, rbx
je 0x140008783
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 8]
call fcn.1400226a0
lea rdx, [rsp + 0x60]
xor r8d, r8d
mov r9, rdi
mov al, byte [rdx]
mov rcx, r8
and ecx, 7
inc r8
inc rdx
xor byte [rcx + rbx], al
sub r9, 1
jne 0x14000875f
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140014c74
mov rax, qword [rbp + 0x7f8]
test rax, rax
je 0x1400087ae
lea rcx, [r15 + 0x3b0]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r8, [rsp + 0x40]
mov dl, r13b
call fcn.140013f88
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140014c74
lea r11, [rsp + 0x8a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rbp
ret
mov edi, 0x20
lea rdx, [rbx + 0x30]
mov r8d, edi
lea rcx, [rsp + 0x40]
call fcn.140023440
xor r9d, r9d
lea rcx, [rsp + 0x40]
xor r8d, r8d
mov edx, edi
call fcn.140014ab8
lea rdx, [rbx + 0x54]
mov r8d, edi
lea rcx, [rsp + 0x60]
call fcn.140023440
lea rdx, [rbx + 0x74]
mov r8d, edi
lea rcx, [rbp - 0x80]
call fcn.140023440
jmp 0x140008722
Function at 0x140008c04
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x138]
sub rsp, 0x210
mov rax, r8
mov r15, rdx
mov r8d, 0x40
mov r12, rcx
cmp r9, r8
lea rcx, [rbp - 0x40]
mov rdx, rax
mov rbx, r9
cmovb r8, r9
call fcn.140023440
xor edi, edi
mov dword [rbp + rbx - 0x40], 0x1000000
mov qword [rsp + 0x40], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rdi
lea r9, [rbx + 4]
mov qword [rsp + 0x30], rdi
lea r8, [rbp - 0x40]
mov qword [rsp + 0x28], rdi
mov rdx, r15
mov rcx, r12
mov qword [rsp + 0x20], rax
call fcn.140008920
lea r13d, [rdi + 0x20]
mov r8d, r13d
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.140023440
mov eax, dword [rbp + 0x178]
lea rsi, [rbp - 0x80]
dec eax
mov byte [rbp + 0x178], dil
mov dword [rsp + 0x50], eax
lea r14d, [r13 - 0x1d]
mov rax, qword [rbp + 0x160]
mov qword [rbp - 0x80], rax
mov rax, qword [rbp + 0x168]
mov qword [rbp - 0x78], rax
mov rax, qword [rbp + 0x170]
mov byte [rbp + 0x160], dil
lea rdi, [rsp + 0x50]
mov qword [rbp - 0x70], rax
mov dword [rsp + 0x54], 0x10
mov dword [rsp + 0x58], 0x10
cmp dword [rdi], 0
jbe 0x140008d8b
mov ebx, dword [rdi]
lea rax, [rbp + 0x178]
mov r9, r13
mov qword [rsp + 0x40], rax
lea r8, [rsp + 0x60]
lea rax, [rbp + 0x30]
mov rdx, r15
mov qword [rsp + 0x38], rax
mov rcx, r12
lea rax, [rbp + 0x160]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
call fcn.140008920
mov r8, r13
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x60]
call fcn.140023440
xor eax, eax
lea ecx, [rax + 2]
movdqu xmm0, xmmword [rbp + rax - 0x68]
movdqu xmm1, xmmword [rsp + rax + 0x60]
lea rax, [rax + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbp + rax - 0x78], xmm1
sub rcx, 1
jne 0x140008d61
sub rbx, 1
jne 0x140008d02
mov rcx, qword [rsi]
lea rdx, [rbp - 0x68]
mov r8, r13
call fcn.140023440
add rdi, 4
add rsi, 8
sub r14, 1
jne 0x140008cf7
lea edx, [r14 + 0x44]
lea rcx, [rbp - 0x40]
call fcn.140014c74
mov rdx, r13
lea rcx, [rbp - 0x68]
call fcn.140014c74
mov rdx, r13
lea rcx, [rsp + 0x60]
call fcn.140014c74
mov rdx, r13
lea rcx, [rbp + 0x10]
call fcn.140014c74
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14000cdb0
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x4f88]
mov eax, 0x5070
call fcn.140021670
sub rsp, rax
mov rbx, rcx
mov r15d, 0x800
mov r8d, r15d
lea rdx, [rbp + 0x2f70]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
lea edi, [r15 - 2]
cmp eax, edi
ja 0x14000cf94
mov r8d, r15d
lea rdx, [rbp + 0x3f70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
dec eax
cmp eax, edi
ja 0x14000cf94
lea rcx, [rbp + 0x2f70]
call fcn.140011748
mov rsi, rax
lea rcx, [rbp + 0x3f70]
call fcn.140011748
mov rdi, rax
xor r14d, r14d
cmp word [rax], r14w
je 0x14000cf94
mov rdx, rax
mov rcx, rsi
call fcn.140018528
test eax, eax
je 0x14000cf94
mov rcx, rbx
call fcn.140011748
mov rcx, rax
mov rdx, rdi
call fcn.140018528
test eax, eax
jne 0x14000cf94
movzx eax, r14w
mov word [rsp + 0x20], ax
mov edi, r14d
test ax, ax
jne 0x14000cee6
mov r8, r15
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140016248
lea rcx, [rsp + 0x20]
call fcn.140011748
mov rcx, rax
mov r9d, edi
lea r8, str.rtmp_d
mov rdx, r15
call fcn.140004f9c
lea rcx, [rsp + 0x20]
call fcn.14000de7c
test al, al
je 0x14000cecd
mov eax, r14d
mov word [rsp + 0x20], ax
jmp 0x14000ced2
movzx eax, word [rsp + 0x20]
add edi, 0x7b
cmp edi, 0x2710
jl 0x14000ce81
test ax, ax
je 0x14000cf94
mov r8, r15
mov rdx, rbx
lea rcx, [rbp + 0x1f70]
call fcn.140016248
mov r8, r15
mov rdx, rsi
lea rcx, [rbp + 0x1f70]
call fcn.1400117d4
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x1f70]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14000cf94
lea rcx, [rbp + 0xf20]
call fcn.14000cfb4
nop
mov dil, r14b
mov rcx, rbx
call fcn.14000de7c
test al, al
jne 0x14000cf54
mov r8d, 0x12
mov rdx, rbx
lea rcx, [rbp + 0xf20]
call fcn.14000d0d8
mov dil, al
lea rdx, [rbp + 0x1f70]
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test dil, dil
je 0x14000cf84
lea rcx, [rbp + 0xf20]
call fcn.14000d070
lea rcx, [rbp + 0xf20]
call fcn.14000d200
nop
lea rcx, [rbp + 0xf20]
call fcn.14000cffc
mov al, 1
jmp 0x14000cf96
xor al, al
lea r11, [rsp + 0x5070]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret

Function at 0x14000d200
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [rcx + 0x14], 0
mov rbx, rcx
jne 0x14000d237
cmp qword [rcx + 8], 0xffffffffffffffff
je 0x14000d223
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call qword [0x140037440]
cmp byte [rbx + 0x21], 0
je 0x14000d237
lea rcx, [rbx + 0x3a]
add rsp, 0x20
pop rbx
jmp fcn.14000de1c
xor al, al
add rsp, 0x20
pop rbx
ret