joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a16d0
Capabilities:
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x30
mov rsi, rdx
lea r15, [0x140170048]
mov rbp, rcx
xor edi, edi
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x1400a1760
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
cmp eax, 0x20
jne 0x1400a1797
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400a174e
test byte [rcx + 0x1c], 1
je 0x1400a174e
cmp byte [rcx + 0x19], 3
jb 0x1400a174e
mov rcx, qword [rcx + 0x10]
lea edx, [rax + 0x32]
mov r9, rbp
mov qword [rsp + 0x20], rsi
lea r8, [0x140150b88]
call fcn.140005cc0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 5
jb 0x1400a16f8
cmp edi, 5
jne 0x1400a17df
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400a1790
test byte [rcx + 0x1c], 1
je 0x1400a1790
cmp byte [rcx + 0x19], 2
jb 0x1400a1790
mov rcx, qword [rcx + 0x10]
lea edx, [rdi + 0x4f]
lea r8, [0x140150b88]
call fcn.140004c54
mov eax, 0x80780163
jmp 0x1400a17e1
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400a17d0
test byte [rcx + 0x1c], 1
je 0x1400a17d0
cmp byte [rcx + 0x19], 2
jb 0x1400a17d0
mov rcx, qword [rcx + 0x10]
lea r8, [0x140150b88]
mov edx, 0x53
mov dword [rsp + 0x28], ebx
mov r9, rbp
mov qword [rsp + 0x20], rsi
call fcn.140005d78
movzx eax, bx
or eax, 0x80070000
test ebx, ebx
cmovle eax, ebx
jmp 0x1400a17e1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret
Function at 0x1400a2790
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140170608]
xor rax, rsp
mov qword [rsp + 0x78], rax
and dword [rsp + 0x30], 0
mov edi, edx
mov rsi, rcx
mov ebx, 0x20
mov r8d, ebx
lea rcx, [rsp + 0x58]
xor edx, edx
call sub.msvcrt.dll_memset
mov rcx, qword [rsi + 8]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x58]
mov r8d, ebx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x1400a2840
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400a282d
test byte [rcx + 0x1c], 2
je 0x1400a282d
cmp byte [rcx + 0x19], 2
jb 0x1400a282d
mov rcx, qword [rcx + 0x10]
lea edx, [rbx + 0x43]
mov r9d, edi
lea r8, [0x140150b88]
call fcn.140004c78
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1400a28de
mov r9d, dword [rsp + 0x30]
cmp r9d, ebx
je 0x1400a2884
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400a28d4
test byte [rcx + 0x1c], 2
je 0x1400a28d4
cmp byte [rcx + 0x19], 2
jb 0x1400a28d4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140150b88]
mov edx, 0x64
mov dword [rsp + 0x20], ebx
call fcn.14000fe18
jmp 0x1400a28d4
mov rsi, qword [rsi + 0x10]
lea rcx, [rsp + 0x38]
mov r8, rbx
xor edx, edx
call sub.msvcrt.dll_memset
lea rdx, [rsp + 0x38]
mov rcx, rsi
call fcn.14008ded8
mov ebx, eax
test eax, eax
js 0x1400a28c3
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x58]
call fcn.14008e598
test al, al
mov ecx, 0x80004005
cmove ebx, ecx
lea r8, [rsi + 0x10]
lea rdx, [rsi + 8]
call fcn.14008e6ec
test ebx, ebx
jns 0x1400a28de
neg edi
sbb ebx, ebx
add ebx, 0x80780002
mov eax, ebx
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140141360
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400a2908
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x140170608]
xor rax, rsp
mov qword [rsp + 0x58], rax
and dword [rsp + 0x30], 0
xor edx, edx
mov rdi, rcx
lea rcx, [rsp + 0x38]
lea r8d, [rdx + 0x20]
call sub.msvcrt.dll_memset
mov rcx, qword [rdi + 0x10]
lea rdx, [rsp + 0x38]
call fcn.14008ded8
mov ebx, eax
test eax, eax
js 0x1400a29e3
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
and qword [rsp + 0x20], 0
lea rdx, [rsp + 0x38]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400a29c4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400a29b4
test byte [rcx + 0x1c], 2
je 0x1400a29b4
cmp byte [rcx + 0x19], 2
jb 0x1400a29b4
mov rcx, qword [rcx + 0x10]
lea r8, [0x140150b88]
mov edx, 0x65
mov r9d, edi
call fcn.140004c78
movzx ebx, di
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
jmp 0x1400a29e3
cmp dword [rsp + 0x30], 0x20
je 0x1400a29e3
lea r8, str.dwWritten__sizeof_rgChecksum_
mov edx, 0xd2f
lea rcx, [0x140150308]
call fcn.14008388c
mov eax, ebx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140141360
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400a6994
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ebp, r8d
mov rsi, r9
mov r15, rdx
mov rdi, rcx
test r9, r9
jne 0x1400a69d9
lea r8, str.pAtom___NULL
mov edx, 0x10ec
lea rcx, str.base_stor_blbcatalog_atomtbl.cpp
call fcn.14008388c
test r15, r15
jne 0x1400a69f6
lea r8, str.pbVal___NULL
mov edx, 0x10ed
lea rcx, str.base_stor_blbcatalog_atomtbl.cpp
call fcn.14008388c
or dword [rsi], 0xffffffff
xor eax, eax
test ebp, ebp
je 0x1400a6a15
mov rdx, r15
mov r8, rbp
movzx ecx, byte [rdx]
inc rdx
rol eax, 1
xor eax, ecx
sub r8, 1
jne 0x1400a6a05
xor edx, edx
div dword [rdi]
mov rax, qword [rdi + 0x10]
mov ebx, edx
mov r9d, edx
mov rdx, qword [rax + rdx*8]
test rdx, rdx
je 0x1400a6aea
mov r8, qword [rdi + 0x18]
mov ecx, ebx
shr r9, 5
and ecx, 0x1f
mov eax, dword [r8 + r9*4]
bt eax, ecx
jb 0x1400a6a90
cmp byte [rdx], 9
jne 0x1400a6aea
lea rax, [rdx + 1]
and eax, 7
lea r13, [0x140150ed8]
mov ecx, dword [r13 + rax*4]
mov eax, dword [rcx + rdx + 1]
test eax, eax
jne 0x1400a6a6d
xor ecx, ecx
jmp 0x1400a6a74
add rcx, 5
add rcx, rdx
cmp eax, ebp
jne 0x1400a6aea
mov r8, rax
mov rdx, r15
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1400a6aea
shl ebx, 0xb
mov dword [rsi], ebx
xor eax, eax
jmp 0x1400a6aef
mov r12d, dword [rdx]
lea r14, [rdx + 8]
xor edi, edi
test r12d, r12d
je 0x1400a6aea
lea r13, [0x140150ed8]
mov rcx, qword [r14]
cmp byte [rcx], 9
jne 0x1400a6adf
lea rax, [rcx + 1]
and eax, 7
mov edx, dword [r13 + rax*4]
mov eax, dword [rdx + rcx + 1]
test eax, eax
jne 0x1400a6ac5
xor ecx, ecx
jmp 0x1400a6acc
add rcx, 5
add rcx, rdx
cmp eax, ebp
jne 0x1400a6adf
mov r8, rax
mov rdx, r15
call sub.msvcrt.dll_memcmp
test eax, eax
je 0x1400a6b0c
inc edi
add r14, 8
cmp edi, r12d
jb 0x1400a6aa5
mov eax, 1
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
shl ebx, 0xb
or ebx, edi
jmp 0x1400a6a8a
Function at 0x1400b0a84
Capabilities:
Check if file exists

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x288
mov rax, qword [0x140170608]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r15, qword [rsp + 0x2f0]
mov r13b, r8b
mov r14, qword [rsp + 0x2f8]
mov r12b, dl
mov rsi, qword [rsp + 0x308]
mov dword [rsp + 0x40], r9d
mov qword [rsp + 0x48], rcx
mov r10, qword [0x140170048]
lea rbx, [0x140170048]
cmp r10, rbx
je 0x1400b0b4a
test byte [r10 + 0x1c], 4
je 0x1400b0b0f
cmp byte [r10 + 0x19], 4
jb 0x1400b0b0f
mov rcx, qword [r10 + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x60
call fcn.140004c54
mov r10, qword [0x140170048]
cmp r10, rbx
je 0x1400b0b4a
test byte [r10 + 0x1c], 4
je 0x1400b0b4a
cmp byte [r10 + 0x19], 5
jb 0x1400b0b4a
movzx eax, r13b
lea r8, [0x1401521b8]
movzx ecx, r12b
mov edx, 0x61
mov dword [rsp + 0x28], eax
mov r9, r14
mov dword [rsp + 0x20], ecx
mov rcx, qword [r10 + 0x10]
call fcn.14001056c
or rdx, 0xffffffffffffffff
mov rcx, rdx
xor eax, eax
inc rcx
cmp word [r15 + rcx*2], ax
jne 0x1400b0b53
mov rdi, rdx
inc rdi
cmp word [r14 + rdi*2], ax
jne 0x1400b0b60
lea ebp, [rdi + rcx]
lea eax, [rbp + 1]
cmp eax, 0x104
jbe 0x1400b0ba6
mov dword [rsi], 0x57
mov eax, 2
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140141360
add rsp, 0x288
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov eax, ecx
mov rdx, r15
lea rcx, [rsp + 0x60]
lea rbx, [rax + rax]
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov r8d, edi
lea rcx, [rsp + 0x60]
add r8, r8
add rcx, rbx
mov rdx, r14
call sub.msvcrt.dll_memcpy
mov eax, ebp
add rax, rax
cmp rax, 0x208
jae 0x1400b0d07
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor edx, edx
mov word [rsp + rax + 0x60], cx
mov dword [rsp + 0x28], 0x2000080
lea r8d, [rcx + 7]
mov dword [rsp + 0x20], 3
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1400b0c7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x1400b0c2e
xor eax, eax
jmp 0x1400b0b82
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsi], eax
mov rcx, qword [0x140170048]
lea rdx, [0x140170048]
cmp rcx, rdx
je 0x1400b0c73
test byte [rcx + 0x1c], 4
je 0x1400b0c73
cmp byte [rcx + 0x19], 2
jb 0x1400b0c73
mov rcx, qword [rcx + 0x10]
lea r9, [rsp + 0x60]
mov edx, 0x62
mov dword [rsp + 0x20], eax
lea r8, [0x1401521b8]
call fcn.140005c44
mov eax, 6
jmp 0x1400b0b82
mov r8, qword [rsp + 0x300]
lea r9, [0x1400afc70]
mov edx, dword [rsp + 0x40]
mov rcx, rbx
movzx eax, r12b
mov dword [rsp + 0x50], eax
movzx eax, r13b
mov dword [rsp + 0x54], eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rax
call fcn.1400afd10
mov rcx, rbx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140170048]
lea rdx, [0x140170048]
cmp rcx, rdx
je 0x1400b0d00
test byte [rcx + 0x1c], 4
je 0x1400b0d00
cmp byte [rcx + 0x19], 4
jb 0x1400b0d00
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x63
call fcn.140004c54
mov eax, edi
jmp 0x1400b0b82
call fcn.140141538
int3
Function at 0x1400bb8cc
Capabilities:
Get volume information via ioctl

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x140170608]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov r14, qword [rsp + 0x120]
xor ebp, ebp
mov r15, qword [rsp + 0x128]
mov rsi, rcx
mov r12, qword [rsp + 0x130]
mov rbx, qword [rsp + 0x138]
mov dword [rsp + 0x40], ebp
mov rcx, qword [0x140170048]
lea rax, [0x140170048]
cmp rcx, rax
je 0x1400bb954
test byte [rcx + 0x1c], 4
je 0x1400bb954
cmp byte [rcx + 0x19], 4
jb 0x1400bb954
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1f1
call fcn.140004c54
mov qword [r15], rbp
mov r8d, 3
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov qword [r12], rbp
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov rcx, rsi
mov dword [rbx], ebp
mov dword [rsp + 0x20], r8d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400bb9dc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx], eax
mov rcx, qword [0x140170048]
lea rdx, [0x140170048]
cmp rcx, rdx
je 0x1400bb9d2
test byte [rcx + 0x1c], 4
je 0x1400bb9d2
cmp byte [rcx + 0x19], 2
jb 0x1400bb9d2
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1f2
mov dword [rsp + 0x20], eax
mov r9, rsi
call fcn.140005c44
mov eax, 0xd
jmp 0x1400bbb09
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r9d, r9d
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 0x60
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, 0x90064
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x1400bba28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov dword [rbx], eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400bb9d2
mov rsi, qword [rsp + 0x98]
xor r8d, r8d
mov rdx, rsi
mov rcx, r14
call fcn.14005b00c
lea rcx, [r14 + 8]
call fcn.1400054ac
lea rcx, [rsp + 0x48]
mov bl, al
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
test bl, bl
jne 0x1400bbaa4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [0x140170048]
lea rdx, [0x140170048]
cmp rcx, rdx
je 0x1400bba9d
test byte [rcx + 0x1c], 4
je 0x1400bba9d
cmp byte [rcx + 0x19], 2
jb 0x1400bba9d
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1f3
call fcn.140004c54
mov eax, 1
jmp 0x1400bbb09
mov r8, rsi
mov rdx, rsi
mov rcx, r14
call fcn.14005b00c
lea rcx, [r14 + 8]
call fcn.1400054ac
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [r15], rsi
mov qword [r12], rsi
mov rcx, qword [0x140170048]
lea rdx, [0x140170048]
cmp rcx, rdx
je 0x1400bbb07
test byte [rcx + 0x1c], 4
je 0x1400bbb07
cmp byte [rcx + 0x19], 4
jb 0x1400bbb07
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1f4
call fcn.140004c54
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.140141360
lea r11, [rsp + 0xd0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400bbb3c
Capabilities:
Encode data using xor
Hash data with md5

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x37]
sub rsp, 0xb0
mov rax, qword [0x140170608]
xor rax, rsp
mov qword [rbp + 0x2f], rax
and dword [rbp - 0x25], 0
mov rbx, rcx
and dword [rbp - 0x29], 0
lea rcx, [rbp - 0x39]
mov rdi, r9
mov dword [rbp - 0x39], 0x67452301
mov esi, r8d
mov dword [rbp - 0x35], 0xefcdab89
mov dword [rbp - 0x31], 0x98badcfe
mov dword [rbp - 0x2d], 0x10325476
call fcn.1400cf904
mov r14d, 8
lea rdx, [rbp - 0x29]
mov r8d, r14d
lea rcx, [rbp + 0x27]
call fcn.1400cff6c
mov r9d, dword [rbp - 0x29]
lea eax, [r14 + 0x30]
shr r9d, 3
lea r8d, [r14 + 0x70]
and r9d, 0x3f
lea rdx, [0x140170a10]
sub eax, r9d
lea rcx, [rbp - 0x39]
sub r8d, r9d
cmp r9d, 0x38
cmovb r8d, eax
call fcn.1400cf904
mov r8d, r14d
lea rdx, [rbp + 0x27]
lea rcx, [rbp - 0x39]
call fcn.1400cf904
lea r9d, [r14 + 8]
mov rcx, rdi
mov r8d, r9d
lea rdx, [rbp - 0x39]
call fcn.1400cff6c
mov rcx, rdi
mov r8, rbx
sub rcx, rbx
mov al, byte [rcx + r8]
xor byte [r8], al
inc r8
sub r9, 1
jne 0x1400bbc07
mov rcx, qword [0x140170048]
lea r14, [0x140170048]
cmp rcx, r14
je 0x1400bbca6
test byte [rcx + 0x1c], 4
je 0x1400bbc69
cmp byte [rcx + 0x19], 5
jb 0x1400bbc69
mov eax, dword [rdi + 0xc]
mov edx, 0x1f5
mov rcx, qword [rcx + 0x10]
mov r9d, esi
mov dword [rsp + 0x38], eax
mov eax, dword [rdi + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rdi + 4]
mov dword [rsp + 0x28], eax
mov eax, dword [rdi]
mov dword [rsp + 0x20], eax
call fcn.1400ad874
mov rcx, qword [0x140170048]
cmp rcx, r14
je 0x1400bbca6
test byte [rcx + 0x1c], 4
je 0x1400bbca6
cmp byte [rcx + 0x19], 5
jb 0x1400bbca6
mov eax, dword [rbx + 0xc]
mov edx, 0x1f6
mov rcx, qword [rcx + 0x10]
mov r9d, esi
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 8]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 4]
mov dword [rsp + 0x28], eax
mov eax, dword [rbx]
mov dword [rsp + 0x20], eax
call fcn.1400ad874
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.140141360
add rsp, 0xb0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1400bbcc8
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r15
sub rsp, 0x40
mov rbx, r9
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x1400bbd35
test byte [rcx + 0x1c], 4
je 0x1400bbd35
cmp byte [rcx + 0x19], 5
jb 0x1400bbd35
mov eax, dword [r9 + 0x14]
mov edx, 0x1f7
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x38], eax
mov eax, dword [r9 + 0x10]
mov r9, rbp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov qword [r11 - 0x28], rsi
call fcn.1400ae250
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
test eax, eax
jne 0x1400bbdd1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
jne 0x1400bbd9c
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400bbe0f
test byte [rcx + 0x1c], 4
je 0x1400bbe0f
cmp byte [rcx + 0x19], 5
jb 0x1400bbe0f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1f8
call fcn.140004c54
jmp 0x1400bbe0f
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400bbdcc
test byte [rcx + 0x1c], 4
je 0x1400bbdcc
cmp byte [rcx + 0x19], 2
jb 0x1400bbdcc
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1f9
mov r9d, edi
call fcn.140004c78
mov qword [rbx], rdi
jmp 0x1400bbe01
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400bbdfe
test byte [rcx + 0x1c], 4
je 0x1400bbdfe
cmp byte [rcx + 0x19], 5
jb 0x1400bbdfe
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1fa
call fcn.140004c54
mov rsi, rdi
mov qword [rbx + 8], rsi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
Function at 0x1400bc118
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], rdi
push r15
sub rsp, 0x40
mov rbx, r9
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
mov rcx, qword [0x140170048]
lea r15, [0x140170048]
cmp rcx, r15
je 0x1400bc185
test byte [rcx + 0x1c], 4
je 0x1400bc185
cmp byte [rcx + 0x19], 5
jb 0x1400bc185
mov eax, dword [r9 + 0x14]
mov edx, 0x1fd
mov rcx, qword [rcx + 0x10]
mov dword [rsp + 0x38], eax
mov eax, dword [r9 + 0x10]
mov r9, rbp
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edi
mov qword [r11 - 0x28], rsi
call fcn.1400ae250
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov r8d, edi
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor esi, esi
test eax, eax
jne 0x1400bc221
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 0x3e5
jne 0x1400bc1ec
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400bc25f
test byte [rcx + 0x1c], 4
je 0x1400bc25f
cmp byte [rcx + 0x19], 5
jb 0x1400bc25f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1fe
call fcn.140004c54
jmp 0x1400bc25f
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400bc21c
test byte [rcx + 0x1c], 4
je 0x1400bc21c
cmp byte [rcx + 0x19], 2
jb 0x1400bc21c
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x1ff
mov r9d, edi
call fcn.140004c78
mov qword [rbx], rdi
jmp 0x1400bc251
mov rcx, qword [0x140170048]
cmp rcx, r15
je 0x1400bc24e
test byte [rcx + 0x1c], 4
je 0x1400bc24e
cmp byte [rcx + 0x19], 5
jb 0x1400bc24e
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0x200
call fcn.140004c54
mov rsi, rdi
mov qword [rbx + 8], rsi
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r15
ret
Function at 0x1400c1398
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x60
mov rdi, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
mov rcx, qword [0x140170048]
lea r12, [0x140170048]
cmp rcx, r12
je 0x1400c13f1
test byte [rcx + 0x1c], 4
je 0x1400c13f1
cmp byte [rcx + 0x19], 4
jb 0x1400c13f1
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0xc4
call fcn.140004c54
mov r8d, dword [rbx + 0x48]
lea rcx, [rsp + 0x40]
mov rdx, qword [rbx + 0x58]
call qword [sym.imp.ntdll.dll_RtlInitializeBitMap]
mov rax, qword [0x140170048]
cmp rax, r12
je 0x1400c1446
test byte [rax + 0x1c], 4
je 0x1400c1446
cmp byte [rax + 0x19], 4
jb 0x1400c1446
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlNumberOfSetBits]
mov rcx, qword [0x140170048]
lea r8, [0x1401521b8]
mov r9d, eax
mov edx, 0xc5
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
cmp byte [rbx + 0x10], 0
je 0x1400c1556
mov r8d, dword [rbx + 0x48]
lea rcx, [rsp + 0x50]
mov rdx, qword [rbx + 0x60]
call qword [sym.imp.ntdll.dll_RtlInitializeBitMap]
mov eax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
add rax, 0x1f
mov rdx, qword [rsp + 0x58]
shr rax, 5
test eax, eax
je 0x1400c1492
mov r8d, eax
mov eax, dword [rdx]
lea rdx, [rdx + 4]
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x1400c1480
cmp dword [rbx + 0x4c], 1
je 0x1400c14a2
cmp dword [rbx + 0x4c], 4
jne 0x1400c154f
mov rdi, qword [rsp + 0x90]
lea rax, str.pagefile.sys
mov qword [rsp + 0x38], rdi
lea rcx, [rsp + 0x40]
or qword [rsp + 0x30], 0xffffffffffffffff
mov r9d, esi
mov qword [rsp + 0x28], rax
mov r8b, 1
xor edx, edx
mov qword [rsp + 0x20], rbp
call fcn.1400b0a84
test eax, eax
jne 0x1400c15e7
mov qword [rsp + 0x38], rdi
lea rax, str.hiberfil.sys
or qword [rsp + 0x30], 0xffffffffffffffff
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rax
mov r9d, esi
mov r8b, 1
mov qword [rsp + 0x20], rbp
xor edx, edx
call fcn.1400b0a84
test eax, eax
jne 0x1400c15e7
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x40]
mov r9d, esi
mov qword [rsp + 0x20], rbp
mov r8b, 1
xor edx, edx
call fcn.1400b1280
test eax, eax
jne 0x1400c15e7
mov r8, rdi
mov edx, esi
mov rcx, rbx
call fcn.1400c2f18
test eax, eax
jne 0x1400c15e7
xor eax, eax
jmp 0x1400c15e7
mov rax, qword [rsp + 0x90]
mov r9, rdi
mov r8d, esi
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rbx
call fcn.1400c3054
mov ebx, eax
mov rcx, qword [0x140170048]
cmp rcx, r12
je 0x1400c15e5
test byte [rcx + 0x1c], 4
je 0x1400c15bf
cmp byte [rcx + 0x19], 4
jb 0x1400c15bf
lea rcx, [rsp + 0x40]
call qword [sym.imp.ntdll.dll_RtlNumberOfSetBits]
mov rcx, qword [0x140170048]
lea r8, [0x1401521b8]
mov r9d, eax
mov edx, 0xc6
mov rcx, qword [rcx + 0x10]
call fcn.140004c78
mov rcx, qword [0x140170048]
cmp rcx, r12
je 0x1400c15e5
test byte [rcx + 0x1c], 4
je 0x1400c15e5
cmp byte [rcx + 0x19], 4
jb 0x1400c15e5
mov rcx, qword [rcx + 0x10]
lea r8, [0x1401521b8]
mov edx, 0xc7
call fcn.140004c54
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret