joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140135d00
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
jle 0x140135d30
lea r10, [0x140333060]
nop dword [rax]
movzx r8d, byte [rcx]
dec edx
inc rcx
movzx r9d, byte [r8 + r10]
lea r8d, [rax*8]
xor r9d, r8d
xor eax, r9d
test edx, edx
jg 0x140135d10
repz ret

Function at 0x140139c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140139d5e
test rdx, rdx
je 0x140139d5e
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x140139ccb
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x140139ccb
xor cl, dl
test cl, 0x10
jne 0x140139ccb
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x140139ccb
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.140139c00
test eax, eax
jne 0x140139ccb
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.140139c00
test eax, eax
jne 0x140139ccb
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.140132cf0
test eax, eax
jne 0x140139ccb
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x140139ccb
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x140139ccb
movzx r10d, word [rdi + 2]
mov edx, 0x400
movzx eax, r10w
and ax, dx
cmp ax, dx
jne 0x140139cdb
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x140139ccb
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x140139d17
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0x98
je 0x140139d17
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x140139d17
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x140139ccb
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140139ccb
call fcn.140136710
test eax, eax
je 0x140139d17
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x140139d3d
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r10w, r10w
je 0x140139d51
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x140139ccb
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140141a10
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x140141a2f
cmp byte [rdx], 0
je 0x140141a28
inc rax
cmp byte [rax], 0
jne 0x140141a20
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x78]
mov r8d, eax
add rcx, 0x50
jmp fcn.140140d90

Function at 0x140141c90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rsi, r8
mov rbp, rdx
mov rdi, rdx
test rdx, rdx
jne 0x140141cb8
mov edi, r9d
jmp 0x140141cd0
cmp byte [rdx], r9b
je 0x140141cc8
nop dword [rax]
inc rdi
cmp byte [rdi], r9b
jne 0x140141cc0
sub edi, edx
and edi, 0x3fffffff
mov r13d, dword [rcx + 8]
mov ebx, r9d
test r13d, r13d
jle 0x140141d93
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x48], r14
lea r14, [0x140333060]
mov eax, ebx
cmp ebx, 2
jge 0x140141cff
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rsi, rsi
je 0x140141d55
movzx ecx, byte [rsi]
mov r8, qword [r8 + r12]
mov rdx, rsi
test cl, cl
je 0x140141d40
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x140141d40
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x140141d20
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x140141d6c
lea rcx, [r10 + 0x20]
mov r8d, edi
mov rdx, rbp
call fcn.140140d90
mov r9, rax
test rax, rax
jne 0x140141d76
inc ebx
cmp ebx, r13d
jl 0x140141cf5
mov rax, r9
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x140141d80
Function at 0x140141da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rsi, r8
mov r12, rdx
mov r13, rcx
mov rdi, rdx
test rdx, rdx
jne 0x140141dd1
mov edi, r10d
jmp 0x140141de6
cmp byte [rdx], r10b
je 0x140141dde
inc rdi
cmp byte [rdi], r10b
jne 0x140141dd6
sub edi, edx
and edi, 0x3fffffff
mov ebp, dword [rcx + 8]
mov ebx, r10d
test ebp, ebp
jle 0x140141eb7
mov qword [rsp + 0x40], r14
lea r14, [0x140333060]
mov r9d, ebx
cmp ebx, 2
jge 0x140141e0c
xor r9d, 1
test rsi, rsi
je 0x140141e65
mov rax, qword [r13 + 0x10]
movsxd rcx, r9d
mov rdx, rsi
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rsi]
test cl, cl
je 0x140141e50
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x140141e50
movzx ecx, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x140141e30
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x140141e8c
mov rax, qword [r13 + 0x10]
movsxd rcx, r9d
mov r8d, edi
shl rcx, 5
mov rdx, r12
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.140140d90
mov r10, rax
test rax, rax
jne 0x140141e99
inc ebx
cmp ebx, ebp
jl 0x140141e00
mov rax, r10
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x140141e9e
Function at 0x140145090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x1401450c4
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x14048a978]
test rax, rax
je 0x1401450d2
call rax
shl ebx, 4
mov ecx, ebx
call fcn.140143ba0
mov rcx, qword [0x14048a980]
mov rbx, rax
test rcx, rcx
je 0x1401450ed
call rcx
test rbx, rbx
je 0x1401450b7
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.14013d030
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x140470ea8]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call fcn.1400c7360
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x140145203
mov qword [rsp + 0x30], rbp
lea rbp, [0x140333060]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x14014517e
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x140145160
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x1401451d6
mov eax, dword [r9]
test eax, eax
je 0x14014519e
mov rcx, qword [r9 + 8]
jmp 0x1401451a1
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x1401451d6
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x1401451cc
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x1401451f2
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x1401451f2
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x1401451ea
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x140145150
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x1401472e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push r12
push r13
sub rsp, 0x20
mov r13d, r8d
mov r8d, dword [rcx]
mov rsi, r9
mov r12, rdx
mov rbx, rcx
test r8d, r8d
je 0x140147348
xor eax, eax
mov r9d, r13d
mov r10, rdx
test r13d, r13d
jle 0x14014733f
lea r11, [0x140333060]
nop dword [rax + rax]
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + r11]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x140147320
xor edx, edx
div r8d
mov ebp, edx
jmp 0x14014734a
xor ebp, ebp
mov r9d, ebp
mov r8d, r13d
mov rdx, r12
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.14013c9a0
test rax, rax
je 0x140147394
mov rdi, qword [rax + 0x10]
test rsi, rsi
jne 0x140147384
mov r8d, ebp
mov rdx, rax
mov rcx, rbx
call fcn.140143990
mov rax, rdi
jmp 0x140147433
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], r12
mov rax, rdi
jmp 0x140147433
test rsi, rsi
je 0x140147431
mov ecx, 0x28
call fcn.140143ba0
mov rdi, rax
test rax, rax
jne 0x1401473b4
mov rax, rsi
jmp 0x140147433
mov qword [rax + 0x18], r12
mov dword [rax + 0x20], r13d
mov qword [rax + 0x10], rsi
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x1401473f2
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x1401473f2
add edx, edx
mov rcx, rbx
call fcn.140145090
test eax, eax
je 0x1401473f2
mov edx, r13d
mov rcx, r12
call fcn.140135d00
xor edx, edx
div dword [rbx]
mov ebp, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140147411
mov edx, ebp
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.140135c90
jmp 0x140147431
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140147425
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rsi
ret
Function at 0x140148010
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
movsxd r9, edx
xor esi, esi
shl r9, 5
mov r10, r8
mov rdi, rcx
mov rbp, qword [r9 + rax + 0x18]
test r8, r8
jne 0x140148041
mov r8d, esi
jmp 0x140148058
cmp byte [r10], sil
je 0x14014804e
inc r8
cmp byte [r8], sil
jne 0x140148046
sub r8d, r10d
and r8d, 0x3fffffff
mov r11d, dword [rbp + 0x20]
mov qword [rsp + 0x30], rbx
test r11d, r11d
je 0x1401480a5
mov edx, r8d
mov r9, r10
test r8d, r8d
jle 0x14014809c
lea rbx, [0x140333060]
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + rbx]
lea eax, [rsi*8]
xor ecx, eax
xor esi, ecx
test edx, edx
jg 0x140148080
mov eax, esi
xor edx, edx
div r11d
mov esi, edx
lea rcx, [rbp + 0x20]
mov r9d, esi
mov rdx, r10
call fcn.14013c9a0
test rax, rax
je 0x140148122
mov rbx, qword [rax + 0x10]
lea rcx, [rbp + 0x20]
mov r8d, esi
mov rdx, rax
call fcn.140143990
test rbx, rbx
je 0x140148122
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdx + 0x18]
cmp rcx, rbx
jne 0x1401480e8
mov rax, qword [rbx + 0x38]
mov qword [rdx + 0x18], rax
jmp 0x14014810b
test rcx, rcx
je 0x14014810b
nop dword [rax]
mov rax, qword [rcx + 0x38]
cmp rax, rbx
je 0x140148103
mov rcx, rax
test rax, rax
jne 0x1401480f0
jmp 0x14014810b
mov rax, qword [rbx + 0x38]
mov qword [rcx + 0x38], rax
mov rdx, qword [rbx + 0x30]
mov rcx, rdi
call fcn.140140fa0
mov rdx, rbx
mov rcx, rdi
call fcn.140140fa0
or dword [rdi + 0x18], 0x200
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14014cc50
Capabilities:
Encode data using xor

Disassembly:
test rdx, rdx
je 0x14014ce11
push rbx
push r12
sub rsp, 0x28
mov r12, rdx
mov rbx, rcx
test rcx, rcx
je 0x14014cc75
cmp qword [rcx + 0x338], 0
jne 0x14014cc84
mov eax, 0xffff
add word [rdx + 0x30], ax
jne 0x14014ce0a
mov qword [rsp + 0x50], rdi
mov rdi, qword [rdx + 0x18]
test rdi, rdi
je 0x14014cd93
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
lea r14, [0x140333060]
mov r13, qword [rdi + 0x38]
test rbx, rbx
je 0x14014ccc8
cmp qword [rbx + 0x338], 0
jne 0x14014cd5c
mov r10, qword [rdi]
mov r8, r10
test r10, r10
je 0x14014ccf3
cmp byte [r10], 0
je 0x14014cce9
nop dword [rax]
inc r8
cmp byte [r8], 0
jne 0x14014cce0
sub r8d, r10d
and r8d, 0x3fffffff
mov rbp, qword [rdi + 0x40]
mov esi, dword [rbp + 0x20]
test esi, esi
je 0x14014cd37
xor eax, eax
mov r9d, r8d
mov r11, r10
test r8d, r8d
jle 0x14014cd2f
nop dword [rax + rax]
movzx ecx, byte [r11]
dec r9d
inc r11
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x14014cd10
xor edx, edx
div esi
mov esi, edx
jmp 0x14014cd39
xor esi, esi
lea rcx, [rbp + 0x20]
mov r9d, esi
mov rdx, r10
call fcn.14013c9a0
test rax, rax
je 0x14014cd5c
lea rcx, [rbp + 0x20]
mov r8d, esi
mov rdx, rax
call fcn.140143990
mov rdx, qword [rdi + 0x30]
mov rcx, rbx
call fcn.140140fa0
mov rdx, rdi
mov rcx, rbx
call fcn.140140fa0
mov rdi, r13
test r13, r13
jne 0x14014ccb1
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rdx, r12
mov rcx, rbx
call fcn.14014c540
mov rdx, r12
mov rcx, rbx
call fcn.14014a870
mov rdx, qword [r12]
mov rcx, rbx
call fcn.140140fa0
mov rdx, qword [r12 + 0x40]
mov rcx, rbx
call fcn.140140fa0
mov rdi, qword [r12 + 0x28]
test rdi, rdi
je 0x14014cde2
mov rdx, rdi
mov rcx, rbx
call fcn.140145980
mov rdx, rdi
mov rcx, rbx
call fcn.140140fa0
mov rdx, qword [r12 + 0x48]
mov rcx, rbx
call fcn.140148630
mov rdx, r12
mov rcx, rbx
call fcn.1401415d0
mov rdx, r12
mov rcx, rbx
call fcn.140140fa0
mov rdi, qword [rsp + 0x50]
add rsp, 0x28
pop r12
pop rbx
repz ret
Function at 0x14014f2c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
movsxd r9, edx
xor edi, edi
shl r9, 5
mov r10, r8
mov r12, rcx
mov rbp, qword [r9 + rax + 0x18]
test r8, r8
jne 0x14014f2fc
mov r8d, edi
jmp 0x14014f313
cmp byte [r10], dil
je 0x14014f309
inc r8
cmp byte [r8], dil
jne 0x14014f301
sub r8d, r10d
and r8d, 0x3fffffff
mov ebx, dword [rbp + 0x38]
test ebx, ebx
je 0x14014f356
mov r9d, r8d
mov r11, r10
mov eax, edi
test r8d, r8d
jle 0x14014f34e
lea rsi, [0x140333060]
nop
movzx ecx, byte [r11]
dec r9d
inc r11
movzx edx, byte [rcx + rsi]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x14014f330
xor edx, edx
div ebx
mov esi, edx
jmp 0x14014f358
mov esi, edi
lea rcx, [rbp + 0x38]
mov r9d, esi
mov rdx, r10
call fcn.14013c9a0
test rax, rax
je 0x14014f438
mov rbx, qword [rax + 0x10]
lea rcx, [rbp + 0x38]
mov r8d, esi
mov rdx, rax
call fcn.140143990
test rbx, rbx
je 0x14014f438
mov rcx, qword [rbx + 0x30]
cmp qword [rbx + 0x28], rcx
jne 0x14014f3e9
mov rdx, qword [rbx + 8]
mov rax, rdx
test rdx, rdx
je 0x14014f3b9
cmp byte [rdx], dil
je 0x14014f3af
inc rax
cmp byte [rax], dil
jne 0x14014f3a7
mov edi, eax
sub edi, edx
and edi, 0x3fffffff
add rcx, 8
mov r8d, edi
call fcn.140140d90
mov rcx, qword [rax + 0x70]
lea r11, [rax + 0x70]
cmp rcx, rbx
je 0x14014f3df
lea r11, [rcx + 0x40]
mov rcx, qword [rcx + 0x40]
cmp rcx, rbx
jne 0x14014f3d2
mov rax, qword [r11]
mov rcx, qword [rax + 0x40]
mov qword [r11], rcx
mov rdx, qword [rbx + 0x38]
mov rcx, r12
call fcn.14014a250
mov rdx, qword [rbx]
mov rcx, r12
call fcn.140140fa0
mov rdx, qword [rbx + 8]
mov rcx, r12
call fcn.140140fa0
mov rdx, qword [rbx + 0x18]
mov rcx, r12
call fcn.140148630
mov rdx, qword [rbx + 0x20]
mov rcx, r12
call fcn.140141a50
mov rdx, rbx
mov rcx, r12
call fcn.140140fa0
or dword [r12 + 0x18], 0x200
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x14014f9d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
movsxd rdi, edx
xor ebx, ebx
mov r10, r8
shl rdi, 5
mov rbp, rcx
add rdi, qword [rcx + 0x10]
test r8, r8
jne 0x14014fa01
mov r8d, ebx
jmp 0x14014fa18
cmp byte [r10], bl
je 0x14014fa0e
inc r8
cmp byte [r8], bl
jne 0x14014fa06
sub r8d, r10d
and r8d, 0x3fffffff
mov rdi, qword [rdi + 0x18]
mov esi, dword [rdi + 8]
test esi, esi
je 0x14014fa6c
mov r9d, r8d
mov r11, r10
mov eax, ebx
test r8d, r8d
jle 0x14014fa64
mov qword [rsp + 0x30], r12
lea r12, [0x140333060]
nop dword [rax]
movzx ecx, byte [r11]
dec r9d
inc r11
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x14014fa40
mov r12, qword [rsp + 0x30]
xor edx, edx
div esi
mov esi, edx
jmp 0x14014fa6e
mov esi, ebx
lea rcx, [rdi + 8]
mov r9d, esi
mov rdx, r10
call fcn.14013c9a0
test rax, rax
je 0x14014fa95
mov rbx, qword [rax + 0x10]
lea rcx, [rdi + 8]
mov r8d, esi
mov rdx, rax
call fcn.140143990
mov rdx, rbx
mov rcx, rbp
call fcn.14014cc50
or dword [rbp + 0x18], 0x200
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x14015edc0
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x14045cbf0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov r8d, 0x104
mov dword [rsp + 0x34], 0x200
call fcn.14015a9c0
test eax, eax
jne 0x14015ef15
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x160], rdi
call fcn.140135bf0
lea rcx, [rsp + 0x40]
test eax, eax
je 0x14015ee21
call fcn.140135b40
mov rbx, rax
jmp 0x14015ee45
call fcn.140135b40
mov rdi, rax
test rax, rax
je 0x14015ef0e
mov rcx, rax
call fcn.140135920
mov rcx, rdi
mov rbx, rax
call fcn.1400be914
test rbx, rbx
je 0x14015ef0e
call fcn.140135bf0
test eax, eax
mov rax, rbx
je 0x14015ee9b
cmp word [rbx], 0
je 0x14015ee77
cmp word [rax], 0x5c
je 0x14015ee72
add rax, 2
cmp word [rax], 0
jne 0x14015ee60
jmp 0x14015ee77
xor ecx, ecx
mov word [rax], cx
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x14015eed4
cmp byte [rbx], 0
je 0x14015eeb2
cmp byte [rax], 0x5c
je 0x14015eeaf
inc rax
cmp byte [rax], 0
jne 0x14015eea0
jmp 0x14015eeb2
mov byte [rax], 0
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov rcx, rbx
mov edi, eax
call fcn.1400be914
test edi, edi
je 0x14015ef0e
mov eax, dword [rsp + 0x34]
mov rbx, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400be110
add rsp, 0x168
ret
mov eax, 0x200
jmp 0x14015eee6
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400be110
add rsp, 0x168
ret
Function at 0x1401655d0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
sub rsp, 0x20
xor r12d, r12d
mov rcx, rdx
mov r13, rdx
mov ebx, r12d
mov edi, r12d
call fcn.140140cc0
mov rbp, rax
test rax, rax
jne 0x140165607
lea eax, [rbp + 7]
jmp 0x1401656c1
mov qword [rsp + 0x40], rsi
call fcn.140135bf0
test eax, eax
je 0x140165650
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14016563b
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x14016568a
inc ebx
cmp ebx, 5
jge 0x14016568a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140165615
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x140165676
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x14016568a
inc ebx
cmp ebx, 5
jge 0x14016568a
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140165650
mov rcx, rbp
call fcn.1400be914
cmp esi, 0xffffffff
mov rsi, qword [rsp + 0x40]
jne 0x1401656a1
cmp edi, 2
je 0x1401656be
lea rdx, str.winDelete
mov r9d, 0x83f7
mov r8, r13
mov ecx, 0xa0a
call fcn.14015ef40
mov r12d, eax
mov eax, r12d
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret

Function at 0x140168710
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor eax, eax
lea rcx, [0x14048df00]
mov qword [0x14048df00], rax
mov qword [0x14048df08], rax
mov qword [0x14048df10], rax
mov qword [0x14048df18], rax
mov qword [0x14048df20], rax
mov qword [0x14048df28], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.1401734c0
test eax, eax
jne 0x140168805
cmp dword [0x140470e74], eax
mov qword [rsp + 0x20], rbx
jne 0x14016876b
xor ebx, ebx
jmp 0x140168787
mov ecx, 2
call qword [0x140470ee0]
mov rbx, rax
test rax, rax
je 0x140168787
mov rcx, rax
call qword [0x140470ef0]
mov rcx, qword [0x14048a970]
lea r9, [0x140471270]
cmp rcx, r9
jne 0x1401687a3
mov rcx, qword [0x140471280]
jmp 0x1401687dd
test rcx, rcx
je 0x1401687dd
cmp qword [rcx + 0x10], 0
lea rax, [rcx + 0x10]
mov rdx, rcx
je 0x1401687cc
mov r8, qword [rax]
cmp r8, r9
je 0x1401687cc
cmp qword [r8 + 0x10], 0
lea rax, [r8 + 0x10]
mov rdx, r8
jne 0x1401687b6
cmp qword [rdx + 0x10], r9
jne 0x1401687dd
mov rax, qword [0x140471280]
mov qword [rdx + 0x10], rax
mov qword [0x140471280], rcx
mov qword [0x14048a970], r9
test rbx, rbx
je 0x1401687f9
mov rcx, rbx
call qword [0x140470f00]
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
sub rsp, 0x28
call fcn.1401734c0
test eax, eax
jne 0x140168e9b
lea ecx, [rax + 0xa]
call fcn.140143ba0
test rax, rax
je 0x140168e9b
mov rcx, rax
call fcn.14013d030
add rsp, 0x28
jmp 0x140168710
mov eax, 7
add rsp, 0x28
ret
Function at 0x140168c30
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
movsxd rcx, dword [rcx + 0x38]
mov rax, rdx
test ecx, ecx
je 0x140168c52
lea rax, [rcx + rdx - 1]
cqo
idiv rcx
imul rax, rcx
mov rdx, rax
mov rcx, rbx
call fcn.140165b40
test eax, eax
je 0x140168c81
mov r8, qword [rbx + 0x30]
lea rdx, str.winTruncate1
mov r9d, 0x7e4b
mov ecx, 0x60a
add rsp, 0x20
pop rbx
jmp fcn.14015ef40
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x140168cb8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rbx + 0x30]
lea rdx, str.winTruncate2
mov r9d, 0x7e4e
mov ecx, 0x60a
mov dword [rbx + 0x1c], eax
add rsp, 0x20
pop rbx
jmp fcn.14015ef40
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x140168e70
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor eax, eax
lea rcx, [0x14048df00]
mov qword [0x14048df00], rax
mov qword [0x14048df08], rax
mov qword [0x14048df10], rax
mov qword [0x14048df18], rax
mov qword [0x14048df20], rax
mov qword [0x14048df28], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.1401734c0
test eax, eax
jne 0x140168805
cmp dword [0x140470e74], eax
mov qword [rsp + 0x20], rbx
jne 0x14016876b
xor ebx, ebx
jmp 0x140168787
mov ecx, 2
call qword [0x140470ee0]
mov rbx, rax
test rax, rax
je 0x140168787
mov rcx, rax
call qword [0x140470ef0]
mov rcx, qword [0x14048a970]
lea r9, [0x140471270]
cmp rcx, r9
jne 0x1401687a3
mov rcx, qword [0x140471280]
jmp 0x1401687dd
test rcx, rcx
je 0x1401687dd
cmp qword [rcx + 0x10], 0
lea rax, [rcx + 0x10]
mov rdx, rcx
je 0x1401687cc
mov r8, qword [rax]
cmp r8, r9
je 0x1401687cc
cmp qword [r8 + 0x10], 0
lea rax, [r8 + 0x10]
mov rdx, r8
jne 0x1401687b6
cmp qword [rdx + 0x10], r9
jne 0x1401687dd
mov rax, qword [0x140471280]
mov qword [rdx + 0x10], rax
mov qword [0x140471280], rcx
mov qword [0x14048a970], r9
test rbx, rbx
je 0x1401687f9
mov rcx, rbx
call qword [0x140470f00]
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
sub rsp, 0x28
call fcn.1401734c0
test eax, eax
jne 0x140168e9b
lea ecx, [rax + 0xa]
call fcn.140143ba0
test rax, rax
je 0x140168e9b
mov rcx, rax
call fcn.14013d030
add rsp, 0x28
jmp 0x140168710
mov eax, 7
add rsp, 0x28
ret