joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a228
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x30
mov rsi, r8
mov r12, rdx
mov rdi, rcx
test r8, r8
jne 0x14000a255
mov al, 1
jmp 0x14000a364
cmp dword [rcx + 0x14], 1
jne 0x14000a26a
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rdi + 8], rax
mov r14d, 0x4000
and dword [rsp + 0x60], 0
xor bpl, bpl
cmp dword [rdi + 0x14], 0
je 0x14000a2c8
xor ebx, ebx
test rsi, rsi
je 0x14000a2ef
mov eax, esi
mov r8d, r14d
mov rcx, rsi
sub rcx, rbx
sub eax, ebx
lea rdx, [rbx + r12]
cmp rcx, r14
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x60]
cmovb r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bpl
test bpl, bpl
je 0x14000a2ef
add rbx, r14
cmp rbx, rsi
jb 0x14000a285
jmp 0x14000a2ea
mov rcx, qword [rdi + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, esi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete bpl
test bpl, bpl
jne 0x14000a35d
cmp byte [rdi + 0x1c], 0
je 0x14000a35d
cmp dword [rdi + 0x14], 0
jne 0x14000a35d
lea rdx, [rdi + 0x26]
lea rcx, [0x14003bb98]
xor r8d, r8d
call fcn.140007100
test al, al
je 0x14000a34b
mov ecx, dword [rsp + 0x60]
mov rax, rcx
cmp rcx, rsi
jae 0x14000a270
test ecx, ecx
je 0x14000a270
mov rbx, qword [rdi]
mov rcx, rdi
call qword [rbx + 0x20]
mov ecx, dword [rsp + 0x60]
xor r8d, r8d
sub rax, rcx
mov rcx, rdi
mov rdx, rax
call qword [rbx + 0x18]
jmp 0x14000a270
lea r8, [rdi + 0x26]
lea rcx, [0x14003bb98]
xor edx, edx
call fcn.1400072f0
mov byte [rdi + 0x10], 1
mov al, bpl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret

Function at 0x14000a430
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x14000a4b0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
jne 0x14000a4dd
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000a55c
mov rcx, rbx
call fcn.14000a44c
test al, al
je 0x14000a520
mov r8d, 0x4e20
cmp rdi, r8
jbe 0x14000a520
mov rdx, rsi
mov rcx, rbx
call fcn.14000a4b0
jmp 0x14000a560
cmp dword [rbx + 0x14], 1
jne 0x14000a535
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x14000a535
xor eax, eax
jmp 0x14000a560
cmp dword [rbx + 0x14], 0
jne 0x14000a557
cmp rdi, 0x8000
jbe 0x14000a557
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
jne 0x14000a557
mov r8d, 0x8000
jmp 0x14000a513
or eax, 0xffffffff
jmp 0x14000a560
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x14000a870
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
call fcn.14000a7f4
test al, al
je 0x14000a89e
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov r11, qword [rbx]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [r11 + 0x18]
add rsp, 0x20
pop rbx
ret

Function at 0x14000a8f4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.14002ea50
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000a93b
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rdi
call fcn.14000c690
test al, al
je 0x14000a93b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x14000a950
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1020
call fcn.14002ea50
sub rsp, rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x14000a9a5
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rsi
call fcn.14000c690
test al, al
je 0x14000a9a5
lea rcx, [rsp + 0x20]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
lea r11, [rsp + 0x1020]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14000a9bc
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.14002ea50
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x14000aa08
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rdi
call fcn.14000c690
test al, al
je 0x14000aa08
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x14000ac00
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1020
call fcn.14002ea50
sub rsp, rax
mov esi, r8d
mov dil, dl
mov rbx, rcx
call fcn.14000bc38
cmp word [rax], 0x2e
je 0x14000ac41
cmp word [rax], 0x20
je 0x14000ac41
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000ac76
mov rcx, rbx
call fcn.14000a8f4
cmp eax, 0xffffffff
jne 0x14000ac89
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rbx
call fcn.14000c690
test al, al
je 0x14000ac89
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000ac89
test dil, dil
je 0x14000ac85
mov edx, esi
mov rcx, rbx
call fcn.14000a950
xor eax, eax
jmp 0x14000aca3
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000ac9e
cmp eax, 3
mov eax, 1
jne 0x14000aca3
mov eax, 2
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000ae18
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
mov eax, 0x1270
call fcn.14002ea50
sub rsp, rax
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov r12d, 0x800
cmp rcx, 0xffffffffffffffff
jne 0x14000aec2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000aeec
lea rdx, [rsp + 0x270]
mov r8, r12
mov rcx, rsi
call fcn.14000c690
test al, al
je 0x14000ae99
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000aeec
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000aeb5
cmp eax, 3
je 0x14000aeb5
cmp eax, 0x12
je 0x14000aeb5
mov eax, 1
jmp 0x14000aeb7
xor eax, eax
mov byte [rdi + 0x1044], al
jmp 0x14000af82
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000aee2
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [rdi + 0x1044], al
cmp rbx, 0xffffffffffffffff
je 0x14000af82
mov r8, r12
mov rdx, rsi
mov rcx, rdi
call fcn.140014338
lea rdx, [rsp + 0x4c]
mov r8, r12
mov rcx, rdi
call fcn.14000c1bc
mov eax, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x3c]
shl r11, 0x20
lea rcx, [rdi + 0x1010]
lea rdx, [rsp + 0x34]
add r11, rax
mov eax, dword [rsp + 0x20]
mov dword [rdi + 0x1008], eax
mov rax, qword [rsp + 0x24]
mov qword [rdi + 0x1000], r11
mov qword [rdi + 0x1028], rax
mov rax, qword [rsp + 0x2c]
mov qword [rdi + 0x1030], rax
mov rax, qword [rsp + 0x34]
mov qword [rdi + 0x1038], rax
call fcn.140014cf8
lea rcx, [rdi + 0x1018]
lea rdx, [rsp + 0x24]
call fcn.140014cf8
lea rcx, [rdi + 0x1020]
lea rdx, [rsp + 0x2c]
call fcn.140014cf8
and dword [rdi + 0x1040], 0
lea r11, [rsp + 0x1270]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x14000c690
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov eax, 0x1020
call fcn.14002ea50
sub rsp, rax
xor edi, edi
mov rsi, r8
mov r12, rdx
mov rbx, rcx
cmp word [rcx], di
je 0x14000c860
call fcn.14000bf14
mov rcx, rbx
call fcn.140020c58
mov rcx, rbx
mov rbp, rax
call fcn.14000c550
cmp al, dil
je 0x14000c77c
mov rcx, rbx
call fcn.14000bf14
cmp al, dil
je 0x14000c728
lea rax, [rbp + 4]
cmp rsi, rax
jbe 0x14000c860
lea r8d, [rdi + 4]
lea rdx, [0x140030f20]
mov rcx, r12
call fcn.14002177c
lea rcx, [r12 + 8]
mov rdx, rbx
call fcn.140020ca0
mov al, 1
jmp 0x14000c862
mov edi, 0x5c
cmp word [rbx], di
jne 0x14000c860
cmp word [rbx + 2], di
jne 0x14000c860
lea rax, [rbp + 6]
cmp rsi, rax
jbe 0x14000c860
lea r8d, [rdi - 0x58]
lea rdx, [0x140030f20]
mov rcx, r12
call fcn.14002177c
lea rcx, [r12 + 8]
lea rdx, [0x140030f18]
call fcn.140020ca0
lea rcx, [r12 + 0xe]
lea rdx, [rbx + 2]
jmp 0x14000c71c
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, edi
je 0x14000c860
cmp eax, 0x7ff
ja 0x14000c860
movzx eax, word [rbx]
mov edi, 0x5c
cmp eax, edi
je 0x14000c823
cmp eax, 0x2f
je 0x14000c823
lea rcx, [rsp + 0x20]
mov edx, 0x800
call fcn.14000bca0
lea rcx, [rsp + 0x20]
call fcn.140020c58
lea rcx, [rax + rbp + 4]
cmp rsi, rcx
jbe 0x14000c860
lea r8d, [rdi - 0x58]
lea rdx, [0x140030f20]
mov rcx, r12
call fcn.14002177c
lea rcx, [r12 + 8]
lea rdx, [rsp + 0x20]
call fcn.140020ca0
cmp word [rbx], 0x2e
jne 0x14000c810
movzx eax, word [rbx + 2]
cmp eax, edi
je 0x14000c80c
cmp eax, 0x2f
jne 0x14000c810
add rbx, 4
mov r8, rsi
mov rdx, rbx
mov rcx, r12
call fcn.140014374
jmp 0x14000c721
lea rax, [rbp + 6]
cmp rsi, rax
jbe 0x14000c860
lea rdx, [0x140030f20]
mov r8d, 4
mov rcx, r12
call fcn.14002177c
lea rcx, [r12 + 8]
lea rdx, [rsp + 0x20]
mov r8d, 2
call fcn.14002177c
lea rcx, [r12 + 0xc]
jmp 0x14000c719
xor al, al
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14000cc10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
and dword [rcx + 4], 0
and dword [rcx], 0
mov eax, 0x8000
cmp r8d, eax
mov r12, rcx
mov rcx, qword [rcx + 0x10]
cmovb eax, r8d
mov ebp, r8d
mov rbx, r9
mov r8d, eax
mov rsi, rdx
call fcn.1400210c0
xor dil, dil
cmp ebp, 1
jbe 0x14000cc6f
lea rcx, [rsi + 1]
lea edx, [rbp - 1]
xor dil, byte [rcx]
inc rcx
sub rdx, 1
jne 0x14000cc63
mov edx, 8
mov rcx, r12
call fcn.14000b19c
and dword [rbx + 0x28], 0
cmp dil, byte [rsi]
jne 0x14000cce1
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
call fcn.14000cacc
mov edi, eax
test eax, eax
je 0x14000cce1
mov edx, 1
mov rcx, rbx
call fcn.14000cb70
movsxd rcx, dword [rbx + 0x28]
mov rdx, rcx
inc ecx
mov dword [rbx + 0x28], ecx
imul rdx, rdx, 0x38
add rdx, qword [rbx]
lea rax, [rdx + 0xc]
mov dword [rdx], 0x28
mov dword [rax], edi
mov qword [rdx + 0x18], rax
lea rax, [rdx + 0x24]
mov qword [rdx + 0x30], rax
mov eax, 3
mov dword [rdx + 0x20], eax
mov dword [rdx + 8], eax
jmp 0x14000cd61
mov edx, 1
mov rcx, rbx
call fcn.14000cb70
movsxd rax, dword [rbx + 0x28]
xor r8d, r8d
mov rcx, rax
inc eax
mov dword [rbx + 0x28], eax
imul rcx, rcx, 0x38
add rcx, qword [rbx]
lea rax, [rcx + 0xc]
mov dword [rcx], 0x16
mov qword [rcx + 0x18], rax
lea rax, [rcx + 0x24]
mov qword [rcx + 0x30], rax
mov eax, 3
mov dword [rcx + 0x20], eax
mov dword [rcx + 8], eax
cmp dword [rbx + 0x28], r8d
jle 0x14000cd61
xor ecx, ecx
mov rdx, qword [rbx]
cmp qword [rcx + rdx + 0x18], 0
jne 0x14000cd42
lea rax, [rcx + rdx + 0xc]
mov qword [rcx + rdx + 0x18], rax
cmp qword [rcx + rdx + 0x30], 0
jne 0x14000cd54
lea rax, [rcx + rdx + 0x24]
mov qword [rcx + rdx + 0x30], rax
inc r8d
add rcx, 0x38
cmp r8d, dword [rbx + 0x28]
jl 0x14000cd2d
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x14000e8f4
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movdqu xmm2, xmmword [rcx + 8]
mov r10, rcx
lea r11, [rcx + 0x18]
test r8, r8
je 0x14000e971
movsxd rcx, dword [r10 + 4]
mov rax, rdx
add rdx, 0x10
movdqu xmm3, xmmword [rax]
mov rax, rcx
add rax, rax
dec ecx
movdqu xmm1, xmmword [r11 + rax*8]
pxor xmm1, xmm3
test ecx, ecx
jle 0x14000e947
movsxd rax, ecx
shl rax, 4
add rax, r11
movdqu xmm0, xmmword [rax]
dec ecx
sub rax, 0x10
aesdec xmm1, xmm0
test ecx, ecx
jg 0x14000e934
cmp byte [r10 + 1], 0
movdqu xmm0, xmmword [r11]
aesdeclast xmm1, xmm0
je 0x14000e95c
pxor xmm1, xmm2
mov rax, r9
add r9, 0x10
sub r8, 1
movdqa xmm2, xmm3
movdqu xmmword [rax], xmm1
jne 0x14000e905
movdqu xmmword [r10 + 8], xmm2
ret
Function at 0x14000e978
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov ebp, dword [rcx + 4]
mov rsi, rcx
lea rcx, [rax - 0x38]
mov r8d, 0x20
sub ebp, 6
call fcn.1400210c0
xor edi, edi
xor r9d, r9d
xor edx, edx
xor r8d, r8d
movsxd r10, ebp
lea r14d, [rdi + 4]
test ebp, ebp
jle 0x14000ea09
xor r11d, r11d
cmp edi, dword [rsi + 4]
jg 0x14000ea09
cmp rdx, r10
jge 0x14000e9f4
lea rbx, [rsp + rdx*4 + 0x20]
cmp r8, r14
jge 0x14000e9f7
mov eax, dword [rbx]
lea rcx, [r11 + r8]
inc rdx
add rbx, r14
inc r9d
inc r8
cmp rdx, r10
mov dword [rsi + rcx*4 + 0x18], eax
jl 0x14000e9d4
cmp r8, r14
jne 0x14000ea04
inc edi
add r11, r14
xor r9d, r9d
xor r8d, r8d
cmp rdx, r10
jl 0x14000e9c5
cmp edi, dword [rsi + 4]
movsxd rbx, edi
movsxd r11, r9d
jg 0x14000eb6b
lea r12, [0x140040be0]
lea r15, [0x140040d00]
movzx ecx, byte [rsp + r10*4 + 0x1d]
mov al, byte [rsp + 0x20]
xor al, byte [rcx + r15]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + r10*4 + 0x1e]
mov al, byte [rax + r15]
xor byte [rsp + 0x21], al
movzx eax, byte [rsp + r10*4 + 0x1f]
mov al, byte [rax + r15]
xor byte [rsp + 0x22], al
movzx eax, byte [rsp + r10*4 + 0x1c]
mov al, byte [rax + r15]
xor byte [rsp + 0x23], al
mov al, byte [r12]
inc r12
xor byte [rsp + 0x20], al
cmp ebp, 8
je 0x14000eaa1
cmp r10, 1
jle 0x14000eb1d
lea rdx, [rsp + 0x24]
lea r8, [r10 - 1]
xor ecx, ecx
mov al, byte [rdx + rcx - 4]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, r14
jl 0x14000ea87
add rdx, r14
sub r8, 1
jne 0x14000ea85
jmp 0x14000eb1d
lea rcx, [rsp + 0x24]
mov r8d, 3
mov rdx, r14
mov al, byte [rcx - 4]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000eaaf
sub r8, 1
jne 0x14000eaac
movzx eax, byte [rsp + 0x2c]
mov al, byte [rax + r15]
xor byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x2d]
mov al, byte [rax + r15]
xor byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x2e]
mov al, byte [rax + r15]
xor byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x2f]
mov al, byte [rax + r15]
xor byte [rsp + 0x33], al
cmp r10, 5
jle 0x14000eb1d
lea rcx, [rsp + 0x34]
lea r8, [r10 - 5]
mov rdx, r14
mov al, byte [rcx - 4]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000eb09
sub r8, 1
jne 0x14000eb06
xor edx, edx
test ebp, ebp
jle 0x14000eb62
cmp edi, dword [rsi + 4]
jg 0x14000eb6b
cmp rdx, r10
jge 0x14000eb50
lea r8, [rsp + rdx*4 + 0x20]
cmp r11, r14
jge 0x14000eb53
mov eax, dword [r8]
lea rcx, [r11 + rbx*4]
inc rdx
add r8, r14
inc r11
cmp rdx, r10
mov dword [rsi + rcx*4 + 0x18], eax
jl 0x14000eb32
cmp r11, r14
jne 0x14000eb5d
inc edi
inc rbx
xor r11d, r11d
cmp rdx, r10
jl 0x14000eb23
cmp edi, dword [rsi + 4]
jle 0x14000ea26
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14000eb8c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x30
mov edi, 1
mov rbx, rcx
cmp dword [rcx + 4], edi
jle 0x14000ec56
lea rsi, [rcx + 0x2a]
lea r13, [0x140000000]
xor r9d, r9d
lea r11, [rsp + r9 + 0x20]
mov r10, rsi
mov ebp, 4
movzx eax, byte [r10 + 1]
lea rdx, [r9 + rax*4]
movzx eax, byte [r10 - 1]
mov r8b, byte [rdx + r13 + 0x3dbe0]
lea rcx, [r9 + rax*4]
movzx eax, byte [r10 - 2]
xor r8b, byte [rcx + r13 + 0x3e3e0]
lea rcx, [r9 + rax*4]
movzx eax, byte [r10]
xor r8b, byte [rcx + r13 + 0x3e7e0]
lea rcx, [r9 + rax*4]
add r10, 4
xor r8b, byte [rcx + r13 + 0x3dfe0]
mov byte [r11], r8b
add r11, 4
sub rbp, 1
jne 0x14000ebd1
inc r9
cmp r9, 4
jl 0x14000ebc4
movsxd rax, edi
lea r8d, [rbp + 0x10]
lea rdx, [rsp + 0x20]
add rax, rax
lea rcx, [rbx + rax*8 + 0x18]
call fcn.1400210c0
inc edi
add rsi, 0x10
cmp edi, dword [rbx + 4]
jl 0x14000ebc1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret
Function at 0x14000f804
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, qword [rsp + 0x50]
mov rax, r8
mov rdi, rcx
cmp rax, rbx
mov r8, rbx
mov rcx, r9
cmovb r8, rax
mov rsi, r9
add r8, r8
call fcn.1400210c0
mov r9b, byte [rdi + 0x101]
mov r8b, byte [rsp + 0x58]
lea rdx, [rbx + rbx]
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14000f698

Function at 0x14000fa2c
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x170
xor ebp, ebp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp qword [0x1400380f8], rbp
jne 0x14000fa96
lea r9d, [rbp + 0x64]
lea r8, [rax - 0xd8]
lea edx, [rbp + 0xf]
mov ecx, 0x400
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
movzx r11d, word [rsp + 0xa0]
lea rax, [0x140055764]
mov word [0x140055764], r11w
mov word [0x140055766], bp
mov qword [0x1400380f8], rax
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400143bc
lea r9, [0x1400380e0]
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, 0x400
mov dword [rsp + 0x28], edi
mov word [rbx], bp
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetNumberFormatW]
lea r11, [rsp + 0x170]
mov word [rbx + rdi*2 - 2], bp
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14000fb18
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, [rsp + 0x48]
mov ebx, edx
call qword [sym.imp.SHELL32.dll_SHGetMalloc]
lea r8, [rsp + 0x40]
mov edx, ebx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov rcx, qword [rsp + 0x40]
mov rdx, rdi
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400100dc
Capabilities:
Set environment variable

Disassembly:
push rbx
sub rsp, 0x820
mov rbx, rcx
mov rdx, rcx
lea rcx, str.sfxcmd
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
lea rdx, [rsp + 0x20]
mov r8d, 0x400
mov rcx, rbx
call fcn.14001443c
mov rbx, rax
test rax, rax
je 0x140010138
movzx ecx, word [rax]
jmp 0x14001011f
add rbx, 2
movzx ecx, word [rbx]
call fcn.14001431c
test al, al
jne 0x140010118
lea rcx, str.sfxpar
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x820
pop rbx
ret
Function at 0x14001026c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
mov eax, 0x2020
call fcn.14002ea50
sub rsp, rax
xor r12d, r12d
mov rsi, r8
mov rbx, rcx
cmp r9, r12
je 0x14001029f
mov byte [r9], r12b
mov rcx, qword [rsp + 0x2050]
cmp rcx, r12
je 0x1400102af
mov byte [rcx], r12b
cmp rbx, r12
je 0x140010366
movzx eax, word [rbx]
cmp ax, r12w
je 0x140010366
movsxd rbp, dword [rsp + 0x2058]
mov rdi, r12
mov r8d, r12d
add rbx, 2
cmp ax, 0x3d
jne 0x1400102f5
cmp rsi, r12
je 0x140010301
cmp rdi, r12
jne 0x140010301
cmp r9, r12
je 0x1400102f0
mov byte [r9], 1
mov rdi, rdx
jmp 0x140010310
cmp ax, 0xd
je 0x140010323
cmp ax, 0xa
je 0x140010327
mov word [rdx], ax
lea eax, [rbp - 2]
add rdx, 2
cmp r8d, eax
jge 0x14001031e
mov ax, word [rbx]
inc r8d
cmp ax, r12w
jne 0x1400102d3
jmp 0x140010327
mov byte [rcx], 1
jmp 0x140010327
add rbx, 2
mov word [rdx], r12w
cmp rsi, r12
je 0x140010361
mov word [rsi], r12w
cmp rdi, r12
je 0x140010361
lea rdx, [rsp + 0x20]
mov r8d, 0x1000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, [rsp + 0x20]
mov r8, rbp
mov rcx, rsi
call fcn.140014338
mov word [rdi], r12w
mov rax, rbx
jmp 0x140010368
xor eax, eax
lea r11, [rsp + 0x2020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret

Function at 0x140010388
Capabilities:
Delete file

Disassembly:
push rbx
mov eax, 0x1060
call fcn.14002ea50
sub rsp, rax
lea rcx, [rsp + 0x60]
mov edx, 0x800
call fcn.14001fe88
xor ebx, ebx
cmp byte [0x140049e79], bl
jne 0x140010421
lea rcx, [rsp + 0x60]
call fcn.14000c008
mov rdx, qword [str.RarSFX]
lea r8d, [rbx + 6]
mov rcx, rax
call fcn.140015990
cmp eax, ebx
jne 0x140010421
lea rcx, [0x140030e60]
call fcn.14001fe70
lea rcx, [rsp + 0x60]
call fcn.140020c58
lea r8d, [rbx + 0x38]
lea rcx, [rsp + 0x20]
xor edx, edx
mov word [rsp + rax*2 + 0x62], bx
call fcn.140020cd0
lea eax, [rbx + 0x14]
lea rcx, [rsp + 0x20]
mov word [rsp + 0x40], ax
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
add rsp, 0x1060
pop rbx
ret

Function at 0x140010548
Capabilities:
Hide graphical window

Disassembly:
push rbx
sub rsp, 0x20
and dword [0x140049e58], 0
mov edx, 1
mov rbx, rcx
mov byte [0x140049e47], 1
mov byte [0x140049e46], 1
call qword [sym.imp.USER32.dll_ShowWindow]
xor r8d, r8d
mov rcx, rbx
lea edx, [r8 + 2]
call fcn.140006e14
cmp qword [0x140049e98], 0
jne 0x140010593
cmp byte [0x140049e78], 0
je 0x14001059c
cmp dword [0x140049e5c], 0
jne 0x1400105b1
xor r9d, r9d
mov edx, 0x111
mov rcx, rbx
lea r8d, [r9 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
add rsp, 0x20
pop rbx
ret