joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b738
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
xor r8d, edx
cmp rdx, 4
jb 0x14000b76f
imul r9d, dword [rcx], 0x5bd1e995
mov eax, r9d
shr eax, 0x18
xor eax, r9d
imul eax, eax, 0x5bd1e995
imul r8d, r8d, 0x5bd1e995
xor r8d, eax
add rcx, 4
add rdx, 0xfffffffffffffffc
cmp rdx, 3
ja 0x14000b741
cmp rdx, 1
je 0x14000b795
cmp rdx, 2
je 0x14000b78b
cmp rdx, 3
jne 0x14000b7a2
movzx eax, byte [rcx + 2]
shl eax, 0x10
xor r8d, eax
movzx eax, byte [rcx + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [rcx]
xor eax, r8d
imul r8d, eax, 0x5bd1e995
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x14000bac0
Capabilities:
Clear file content

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov r14, rdx
mov rdi, rcx
lea rbx, [rbp - 0x30]
mov qword [rbx], rcx
call fcn.14019ddd0
add rax, rdi
mov qword [rbx + 8], rax
lea rdi, [rbp - 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.140010f8c
mov bl, byte [r14]
test bl, bl
je 0x14000bb98
lea rax, [r14 + 1]
xor edx, edx
push 1
pop r8
push 4
pop r9
push 3
pop r10
xor ecx, ecx
xor r15d, r15d
xor esi, esi
movsx ebx, bl
cmp ebx, 0x2b
je 0x14000bb55
cmp ebx, 0x61
je 0x14000bb5c
cmp ebx, 0x62
je 0x14000bb6a
cmp ebx, 0x78
je 0x14000bb72
cmp ebx, 0x77
je 0x14000bb77
cmp ebx, 0x72
jne 0x14000bc43
or edx, 0x80000000
mov ecx, r10d
jmp 0x14000bb8d
mov edx, 0xc0000000
jmp 0x14000bb8d
or edx, 0x40000000
or esi, 8
mov ecx, r9d
jmp 0x14000bb8d
or esi, 0x8000
jmp 0x14000bb8d
mov ecx, r8d
jmp 0x14000bb8d
or edx, 0x40000000
xor ebx, ebx
cmp ecx, 1
setne bl
lea ecx, [rbx + rbx*2]
inc ecx
mov r15b, 1
mov bl, byte [rax]
inc rax
test bl, bl
jne 0x14000bb25
jmp 0x14000bba1
xor esi, esi
xor r15d, r15d
xor ecx, ecx
xor edx, edx
cmp qword [rbp - 8], 8
jb 0x14000bbac
mov rdi, qword [rbp - 0x20]
and qword [rsp + 0x30], 0
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x28], 0x80
push 7
pop r8
mov rcx, rdi
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14000bc43
mov edx, esi
not edx
shr edx, 1
and edx, 0x4000
or edx, esi
mov rcx, rdi
call fcn.14019fd78
mov ebx, eax
cmp eax, 0xffffffff
je 0x14000bc2f
test r15b, 1
je 0x14000bc07
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x14000bc3a
lea rdx, [0x14020759e]
mov rcx, r14
call fcn.14019efc0
test eax, eax
lea rdx, [0x14020b233]
cmovne rdx, r14
mov ecx, ebx
call fcn.1401a0308
mov rsi, rax
jmp 0x14000bc45
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000bc43
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
lea rcx, [rbp - 0x20]
call fcn.140001c0a
mov rax, rsi
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x14000bc8a
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov r14, rdx
lea rdx, [0x14020b23a]
call fcn.14000bac0
test rax, rax
je 0x14000bcbe
mov rsi, rax
mov rcx, rax
call fcn.14000ba88
cmp rax, rbx
jbe 0x14000bcc2
xor ebx, ebx
jmp 0x14000bd00
xor ebx, ebx
jmp 0x14000bd08
mov rdi, rax
mov rcx, r14
mov rdx, rax
call fcn.140008c86
cmp qword [r14 + 0x18], 0x10
mov rcx, r14
jb 0x14000bcdd
mov rcx, qword [r14]
mov edx, 1
mov r8, rdi
mov r9, rsi
call fcn.14019f170
mov bl, 1
cmp rax, rdi
je 0x14000bd00
xor ebx, ebx
mov rcx, r14
xor edx, edx
call fcn.140008c86
mov rcx, rsi
call fcn.14019f424
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000bd14
Capabilities:
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2c8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x240], 0xfffffffffffffffe
mov qword [rbp + 0x230], r8
mov qword [rbp + 0x220], rdx
lea rax, [rbp - 0x40]
and qword [rax - 0x18], 0
mov qword [rax - 0x10], 0x200
mov qword [rax - 8], rax
mov dword [rbp + 0x23c], r9d
test r9b, 2
mov qword [rbp + 0x228], rcx
jne 0x14000bd82
lea rdx, [0x14020b233]
call fcn.14000bac0
jmp 0x14000be63
lea rsi, [rbp + 0x1c0]
mov qword [rsi], rcx
mov rdi, rcx
call fcn.14019ddd0
add rax, rdi
mov qword [rsi + 8], rax
lea rcx, [rbp + 0x1f0]
mov rdx, rsi
call fcn.1400101e0
lea rbx, [rbp - 0x58]
mov rdi, qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea r15, str.._x_d.tmp
lea r14, [rbp + 0x1d0]
lea r12, [rbp + 0x210]
lea r13, [0x14020759e]
xor esi, esi
cmp esi, 9
ja 0x14000be68
and qword [rbp - 0x58], 0
movups xmm0, xmmword [rbp + 0x1f0]
movaps xmmword [rbp + 0x200], xmm0
mov rcx, rbx
lea rdx, [rbp + 0x200]
call fcn.140003a38
mov rcx, rbx
mov dl, 0x2f
call fcn.1400034d4
call rdi
mov rcx, r14
mov rdx, r15
mov r8d, eax
mov r9d, esi
call fcn.14000bf81
mov qword [rbp + 0x210], r14
mov rcx, r14
call fcn.14019ddd0
add rax, rbp
add rax, 0x1d0
mov qword [rbp + 0x218], rax
mov rcx, rbx
mov rdx, r12
call fcn.140003a38
mov rcx, rbx
call fcn.140004562
mov rcx, rax
mov rdx, r13
call fcn.14000bac0
inc esi
test rax, rax
je 0x14000bdd3
mov r9, rax
jmp 0x14000be6b
xor r9d, r9d
test r9, r9
je 0x14000bf29
push 1
pop rdx
mov rcx, qword [rbp + 0x220]
mov r8, qword [rbp + 0x230]
mov rbx, r9
call fcn.14019df00
mov rsi, rax
test byte [rbp + 0x23c], 1
je 0x14000bec5
cmp rsi, qword [rbp + 0x230]
jne 0x14000bec5
mov rdi, rbx
mov rcx, rbx
call fcn.14019e1c0
mov rcx, rbx
call fcn.14019ded8
mov ecx, eax
call fcn.14019fd00
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp rsi, qword [rbp + 0x230]
jne 0x14000bee1
mov rdi, rbx
mov rcx, rbx
call fcn.1401a06c4
test eax, eax
sete sil
jmp 0x14000bee6
xor esi, esi
mov rdi, rbx
mov rcx, rdi
call fcn.14019f424
test byte [rbp + 0x23c], 2
je 0x14000bf2b
test sil, sil
je 0x14000bf18
lea rcx, [rbp - 0x58]
call fcn.140004562
mov rcx, rax
mov rdx, qword [rbp + 0x228]
call fcn.14000bfa7
mov esi, eax
jmp 0x14000bf2b
lea rcx, [rbp - 0x58]
call fcn.140004562
mov rcx, rax
call fcn.14000c0c7
xor esi, esi
lea rcx, [rbp - 0x58]
call fcn.1400115a8
mov eax, esi
add rsp, 0x2c8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x14000bfa7
Capabilities:
Move file

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
lea rbx, [rbp - 0x60]
mov qword [rbx], rdx
mov rcx, rdx
call fcn.14019ddd0
add rax, rsi
mov qword [rbx + 8], rax
lea rsi, [rbp - 0x40]
mov rcx, rsi
mov rdx, rbx
call fcn.140010f8c
mov r14, qword [rsi]
mov r15, qword [rsi + 0x18]
lea rbx, [rbp - 0x50]
mov qword [rbx], rdi
mov rcx, rdi
call fcn.14019ddd0
add rax, rdi
mov qword [rbx + 8], rax
lea rdi, [rbp - 0x20]
mov rcx, rdi
mov rdx, rbx
call fcn.140010f8c
cmp r15, 8
cmovae rsi, r14
cmp qword [rbp - 8], 8
jb 0x14000c030
mov rdi, qword [rbp - 0x20]
push 1
pop r8
mov rcx, rdi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
setne bl
lea rcx, [rbp - 0x20]
call fcn.140001c0a
lea rcx, [rbp - 0x40]
call fcn.140001c0a
mov eax, ebx
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret

Function at 0x14000c0c7
Capabilities:
Delete file

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x30]
mov qword [rdi], rcx
call fcn.14019ddd0
add rax, rsi
mov qword [rdi + 8], rax
lea rsi, [rbp - 0x20]
mov rcx, rsi
mov rdx, rdi
call fcn.140010f8c
cmp qword [rsi + 0x18], 8
jb 0x14000c10c
mov rsi, qword [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
lea rcx, [rbp - 0x20]
call fcn.140001c0a
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000cae6
Capabilities:
Create directory

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov ebx, edx
mov rsi, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x14000ab01
mov rcx, qword [rsi]
call fcn.14000cf95
test al, al
je 0x14000ab26
test bl, bl
je 0x14000ab43
cmp qword [rsi + 0x18], 0x10
jb 0x14000ab18
mov rsi, qword [rsi]
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.14000cc18
cmp qword [rsi + 0x18], 0x10
jb 0x14000ab30
mov rsi, qword [rsi]
mov rcx, rsi
mov edx, 0x1c0
add rsp, 0x28
pop rbx
pop rsi
jmp 0x14000cae6
nop
add rsp, 0x28
pop rbx
pop rsi
ret
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x30]
mov qword [rdi], rcx
call fcn.14019ddd0
add rax, rsi
mov qword [rdi + 8], rax
lea rsi, [rbp - 0x20]
mov rcx, rsi
mov rdx, rdi
call fcn.140010f8c
cmp qword [rsi + 0x18], 8
jb 0x14000cb2b
mov rsi, qword [rbp - 0x20]
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne bl
lea rcx, [rbp - 0x20]
call fcn.140001c0a
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000cb73
Capabilities:
Delete directory

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x30]
mov qword [rdi], rcx
call fcn.14019ddd0
add rax, rsi
mov qword [rdi + 8], rax
lea rsi, [rbp - 0x20]
mov rcx, rsi
mov rdx, rdi
call fcn.140010f8c
cmp qword [rsi + 0x18], 8
jb 0x14000cbb8
mov rsi, qword [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne bl
lea rcx, [rbp - 0x20]
call fcn.140001c0a
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000cbfe
Capabilities:
Delete directory

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14000cc18
mov rcx, rsi
add rsp, 0x20
pop rsi
jmp fcn.14000cb73

Function at 0x14000cde5
Capabilities:
Get common file path

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rcx + 0x18], 0xf
and qword [rcx + 0x10], 0
mov qword [rbp - 8], rcx
mov byte [rcx], 0
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov edi, eax
test eax, eax
je 0x14000ceb5
mov ecx, edi
add rcx, rcx
call fcn.14019f0c0
mov rsi, rax
mov ecx, edi
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rbp - 0x28]
mov rdx, rsi
call fcn.1400098a8
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x28]
call fcn.140010d67
lea rdi, [rbp - 0x48]
mov rbx, qword [rbp - 8]
mov rcx, rbx
mov rdx, rdi
call fcn.14000716a
mov rcx, rdi
call fcn.140001ad8
lea rcx, [rbp - 0x28]
call fcn.140001c0a
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x14000cead
mov rcx, qword [rbp - 8]
cmp qword [rcx + 0x18], 0x10
jb 0x14000ce92
mov rcx, qword [rbp - 8]
mov rcx, qword [rcx]
cmp byte [rcx + rax - 1], 0x2f
jne 0x14000cead
lea r8, [rcx + rax]
dec r8
lea rdx, [rbp - 0x48]
mov rcx, qword [rbp - 8]
call fcn.140002cf4
mov rcx, rsi
call fcn.14019ec8c
mov rax, qword [rbp - 8]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000cf0a
Capabilities:
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x30]
mov qword [rdi], rcx
call fcn.14019ddd0
add rax, rsi
mov qword [rdi + 8], rax
lea rsi, [rbp - 0x20]
mov rcx, rsi
mov rdx, rdi
call fcn.140010f8c
cmp qword [rsi + 0x18], 8
jb 0x14000cf4f
mov rsi, qword [rbp - 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test al, 0x10
sete bl
lea rcx, [rbp - 0x20]
call fcn.140001c0a
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000cf95
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rcx
lea rdi, [rbp - 0x38]
mov qword [rdi], rcx
call fcn.14019ddd0
add rax, rsi
mov qword [rdi + 8], rax
lea rsi, [rbp - 0x28]
mov rcx, rsi
mov rdx, rdi
call fcn.140010f8c
cmp qword [rsi + 0x18], 8
jb 0x14000cfd9
mov rsi, qword [rbp - 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
setne al
and esi, 0x10
shr esi, 4
and sil, al
lea rcx, [rbp - 0x28]
call fcn.140001c0a
mov eax, esi
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x14000e9d2
Capabilities:
Write file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rdi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14000eaff
mov rsi, rdx
cmp qword [rdi + 8], 0
je 0x14000ea97
xorps xmm0, xmm0
lea r14, [rsp + 0x40]
movaps xmmword [r14 + 0x10], xmm0
movaps xmmword [r14], xmm0
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
lea rdx, [rsp + 0x38]
mov qword [rdx], rax
mov qword [rsp + 0x20], r14
xor ebx, ebx
mov r8d, 8
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi]
lea r8, [rsp + 0x34]
mov rdx, r14
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14000eb01
cmp dword [rsp + 0x34], 8
jne 0x14000eb01
mov r8d, dword [rsi + 8]
mov rdx, qword [rsi]
sub r8d, edx
mov rcx, qword [rdi]
mov qword [rsp + 0x20], r14
xor ebx, ebx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rdi]
lea r8, [rsp + 0x34]
mov rdx, r14
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14000eb01
mov eax, dword [rsp + 0x34]
jmp 0x14000eaf0
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
lea rdx, [rsp + 0x40]
mov qword [rdx], rax
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor ebx, ebx
test eax, eax
je 0x14000eb01
cmp dword [rsp + 0x38], 8
jne 0x14000eb01
mov r8d, dword [rsi + 8]
mov rdx, qword [rsi]
sub r8d, edx
mov rcx, qword [rdi]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x14000eaff
mov eax, dword [rsp + 0x38]
mov rcx, qword [rsi + 8]
sub rcx, qword [rsi]
cmp rcx, rax
sete bl
jmp 0x14000eb01
xor ebx, ebx
mov eax, ebx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000eb0e
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
cmp rcx, 0xffffffffffffffff
je 0x14000eca5
mov r14, r8
mov rbx, qword [rdi + 8]
test rbx, rbx
je 0x14000ebff
cmp byte [rdi + 0x10], 0
jne 0x14000eb64
lea rdx, [rdi + 0x18]
mov qword [rsp + 0x20], rbx
mov r8d, 8
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000ec8a
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov rdx, rbx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14000ec7b
mov byte [rdi + 0x10], 0
cmp dword [rsp + 0x30], 8
jne 0x14000ec9d
mov rdx, qword [rdi + 0x18]
test rdx, rdx
je 0x14000ecb6
mov rcx, r14
call fcn.14001168a
mov r8d, dword [rdi + 0x18]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rdi]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebp, ebp
jne 0x14000ebd1
cmp eax, 0x3e5
jne 0x14000ec9d
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov rdx, rbx
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14000ec9d
mov eax, dword [rsp + 0x30]
cmp qword [rdi + 0x18], rax
je 0x14000ec63
jmp 0x14000ec9d
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
lea r9, [rsp + 0x3c]
mov r8d, 8
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000eca5
cmp dword [rsp + 0x3c], 8
jne 0x14000eca5
mov rdx, qword [rsp + 0x30]
mov rcx, r14
call fcn.14001168a
mov r8d, dword [rsp + 0x30]
mov rdx, qword [r14 + 0x10]
mov rcx, qword [rdi]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x3c]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000eca5
mov eax, dword [rsp + 0x3c]
cmp qword [rsp + 0x30], rax
jne 0x14000eca5
mov rcx, qword [r14 + 0x10]
add rax, rcx
mov byte [rsi], 1
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rcx
mov qword [rsi + 0x18], rax
jmp 0x14000eca8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e4
jne 0x14000ec9d
jmp 0x14000eca5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x3e5
jne 0x14000ec9d
mov byte [rdi + 0x10], 1
jmp 0x14000eca5
mov rcx, rdi
call fcn.14000e998
mov byte [rsi], 0
mov rax, rsi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov byte [rsi], 1
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
and qword [rsi + 0x18], 0
jmp 0x14000eca8

Function at 0x14000eee6
Capabilities:
Print debug messages

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], 0xfffffffffffffffe
test rcx, rcx
je 0x14000ef60
mov rsi, rcx
cmp byte [0x1402596d0], 0
jne 0x14000ef0f
test dl, dl
je 0x14000ef60
lea rcx, [0x1402082d3]
mov rdx, rsi
call fcn.140001a32
lea rdi, [rbp - 0x38]
mov qword [rdi], rsi
mov rcx, rsi
call fcn.14019ddd0
add rax, rsi
mov qword [rdi + 8], rax
lea rsi, [rbp - 0x28]
mov rcx, rsi
mov rdx, rdi
call fcn.140012028
cmp qword [rsi + 0x18], 8
jb 0x14000ef4e
mov rsi, qword [rbp - 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [rbp - 0x28]
call fcn.140001c0a
nop
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140011a48
Capabilities:
Check os version

Disassembly:
push rsi
sub rsp, 0x140
lea rsi, [rsp + 0x2c]
mov r8d, 0x110
mov rcx, rsi
xor edx, edx
call fcn.1401afe80
mov dword [rsi - 4], 0x114
lea rsi, [rsp + 0x28]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsi + 4], 6
setae al
add rsp, 0x140
pop rsi
ret
Function at 0x14002ae80
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
call fcn.14019ddd0
mov r8d, 7
mov rcx, rsi
mov rdx, rax
add rsp, 0x20
pop rsi
jmp fcn.14000b7bc
Function at 0x14005c9f1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
sub rsp, 0x30
mov r9, r8
mov r8, rdx
mov rsi, rcx
mov byte [rsp + 0x2c], 0
mov dword [rsp + 0x28], 0x54414449
test byte [rcx + 0x14c], 4
jne 0x14005cafd
cmp byte [rsi + 0x460], 0
jne 0x14005cafd
movzx r10d, byte [r8]
mov eax, r10d
and eax, 0xf
cmp eax, 8
jne 0x14005cb17
mov eax, r10d
and eax, 0xfffffff0
cmp eax, 0x70
ja 0x14005cb17
cmp r9, 2
jb 0x14005cafd
mov eax, dword [rsi + 0x1d8]
cmp eax, 0x3fff
ja 0x14005cafd
mov ecx, dword [rsi + 0x1d4]
cmp ecx, 0x3fff
ja 0x14005cafd
movzx edx, byte [rsi + 0x25a]
imul ecx, edx
movzx r11d, byte [rsi + 0x257]
imul r11d, ecx
add r11d, 0xf
shr r11d, 3
imul r11d, eax
mov ecx, r10d
shr ecx, 4
mov edx, 0x80
shl edx, cl
cmp r11d, edx
ja 0x14005cac6
cmp edx, 0x100
jb 0x14005cac6
mov eax, edx
dec ecx
shr eax, 1
cmp r11d, eax
ja 0x14005cac6
cmp edx, 0x1ff
mov edx, eax
ja 0x14005cab3
shl ecx, 4
or ecx, 8
movzx eax, cl
cmp eax, r10d
je 0x14005cafd
mov byte [r8], cl
movzx r10d, byte [r8 + 1]
and r10d, 0xffffffe0
shl ecx, 8
or ecx, r10d
mov r11d, 0x1f
mov eax, ecx
xor edx, edx
div r11d
or edx, r10d
xor dl, 0x1f
mov byte [r8 + 1], dl
lea rdx, [rsp + 0x28]
mov rcx, rsi
call fcn.14005c42e
or byte [rsi + 0x14c], 4
add rsp, 0x30
pop rsi
ret
lea rdx, str.Invalid_zlib_compression_method_or_flags_in_IDAT
mov rcx, rsi
call fcn.14004ff68
int3

Function at 0x14005df03
Capabilities:
Encode data using base64

Disassembly:
push rsi
sub rsp, 0x30
mov byte [rsp + 0x28], 0
mov dword [rsp + 0x24], 0x454d4974
mov sil, byte [rdx + 2]
lea eax, [rsi - 0xd]
cmp al, 0xf4
jb 0x14005df40
mov r9b, byte [rdx + 3]
lea eax, [r9 - 0x20]
cmp al, 0xe1
jb 0x14005df40
mov r10b, byte [rdx + 4]
cmp r10b, 0x17
ja 0x14005df40
mov r11b, byte [rdx + 6]
cmp r11b, 0x3d
jb 0x14005df51
lea rdx, str.Invalid_time_specified_for_tIME_chunk
add rsp, 0x30
pop rsi
jmp fcn.140050006
movzx eax, word [rdx]
mov byte [rsp + 0x29], ah
lea r8, [rsp + 0x29]
mov byte [r8 + 1], al
mov byte [r8 + 2], sil
mov byte [r8 + 3], r9b
mov byte [r8 + 4], r10b
mov al, byte [rdx + 5]
mov byte [r8 + 5], al
mov byte [r8 + 6], r11b
lea rdx, [rsp + 0x24]
mov r9d, 7
call fcn.14005c42e
nop
add rsp, 0x30
pop rsi
ret
Function at 0x14007c66e
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov edi, r9d
mov r15d, r8d
mov r12d, edx
mov rsi, rcx
mov rax, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x58]
movsxd r13, r8d
imul r13, qword [rcx + 0x28]
mov qword [rsp + 0x30], rax
lea rbx, [rax + r13]
movsxd r14, edx
add rbx, r14
mov rax, qword [rbp]
mov rcx, rbp
call qword [rax + 8]
test al, 1
je 0x14007c6db
cmp qword [rsi + 0x68], 0
jne 0x14007c6db
movsxd r8, edi
mov rcx, rbx
mov dl, 0xff
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1401afe80
mov ecx, edi
mov rdi, qword [rsi + 0x70]
mov rax, qword [rbp]
mov dword [rsp + 0x2c], ecx
mov dword [rsp + 0x20], ecx
mov rcx, rbp
mov edx, r12d
mov r8d, r15d
mov r9, rdi
call qword [rax + 0x10]
mov rcx, qword [rsi + 0x68]
test rcx, rcx
je 0x14007c71e
mov rax, qword [rcx]
and qword [rsp + 0x20], 0
mov rdx, rbx
mov r8, rdi
mov r9d, dword [rsp + 0x2c]
call qword [rax + 0x38]
jmp 0x14007c75f
mov eax, dword [rsp + 0x2c]
test eax, eax
jle 0x14007c75f
mov eax, eax
add r13, r14
mov rcx, qword [rsp + 0x30]
add rcx, r13
dec rcx
mov edx, dword [rdi + rax*4 - 4]
shr edx, 0x18
mov ebp, edx
xor ebp, 0xff
movzx ebx, byte [rcx + rax]
imul ebx, ebp
shr ebx, 8
add ebx, edx
mov byte [rcx + rax], bl
lea rdx, [rax - 1]
mov rax, rdx
test edx, edx
jg 0x14007c736
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14008111e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r15, r9
mov r12, qword [rsp + 0x90]
mov al, byte [rcx + 0x5a]
xor r9d, r9d
mov byte [rsp + 0x23], al
test al, al
setne bl
movzx eax, word [r12]
test ax, ax
jle 0x14008123e
mov r9b, bl
movsxd rbp, r8d
xor r8d, edx
test r8d, r9d
mov edi, dword [rcx + 0x58]
movzx ebx, word [rcx + 0x56]
mov r14d, ebx
cmove r14d, edi
cmove edi, ebx
imul rbp, qword [rcx + 0x28]
add rbp, qword [rcx + 0x18]
mov ecx, dword [rcx + 0x4c]
mov dword [rsp + 0x24], ecx
add edx, edx
movsxd rbx, edx
add rbx, rbp
movzx r13d, ax
movzx eax, byte [r15]
test eax, eax
je 0x140081213
cmp eax, 0xff
jne 0x1400811ba
mov esi, r9d
cmp byte [rsp + 0x23], 0
je 0x140081203
mov rcx, rbx
mov edx, edi
mov r8d, r14d
mov r9d, r13d
call fcn.14008071c
jmp 0x140081210
inc eax
shr eax, 3
mov ecx, 0x20
sub ecx, eax
imul eax, dword [rsp + 0x24]
mov edx, r13d
movzx ebp, word [rbx]
mov esi, ebp
shl esi, 0x10
or esi, ebp
and esi, 0x7e0f81f
imul esi, ecx
add esi, eax
mov ebp, esi
shr ebp, 5
shr esi, 0x15
and esi, 0xffffffe0
and ebp, 0xf81f
or ebp, esi
mov word [rbx], bp
add rbx, 2
dec edx
jne 0x1400811ce
jmp 0x140081217
mov rcx, rbx
mov edx, edi
mov r8d, r13d
call fcn.140080efc
mov r9d, esi
lea rbx, [rbx + r13*2]
lea r12, [r12 + r13*2]
add r15, r13
test r13d, r9d
mov ecx, r14d
cmove ecx, edi
cmove edi, r14d
movzx eax, word [r12]
mov r14d, edi
mov edi, ecx
test ax, ax
jg 0x14008118b
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret