joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001de70
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdx, rcx
lea rcx, [rsp + 0x78]
call fcn.140021ab0
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14001da90
mov edx, 1
lea ecx, [rdx + 9]
call fcn.1402deebc
mov edx, 1
lea rdi, [rax + 8]
lea ecx, [rdx + 9]
mov qword [rsp + 0x78], rdi
call fcn.1402deebc
xor r12d, r12d
mov qword [rsp + 0x20], rax
mov ebp, 4
lea rdx, [rsp + 0x88]
mov r8d, ebp
lea rcx, [rsp + 0x80]
lea rsi, [rax + 8]
mov r14d, r12d
call fcn.14001e7d0
mov ecx, r12d
lea r8, [0x140471628]
mov rdx, qword [rax]
nop dword [rax]
movzx ebx, word [rdx + rcx*2]
inc rcx
movzx eax, word [r8 + rcx*2 - 2]
sub ebx, eax
jne 0x14001df17
cmp rcx, 5
jne 0x14001df00
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14001df2d
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
test ebx, ebx
mov rbx, qword [rsp + 0x80]
cmovne ebp, r12d
mov ecx, ebp
nop dword [rax]
mov r13d, r14d
mov r9d, r14d
test ecx, ecx
js 0x14001df82
mov edx, dword [rbx - 8]
cmp ecx, edx
jg 0x14001df82
mov r8d, 0xffffffff
cmp edx, 1
jl 0x14001df82
cmp ecx, edx
jge 0x14001df75
movsxd rax, ecx
cmp word [rbx + rax*2], 0x5c
je 0x14001df72
inc ecx
cmp ecx, edx
jl 0x14001df60
jmp 0x14001df75
mov r8d, ecx
inc r14d
lea ecx, [r8 + 1]
cmp r8d, 0xffffffff
jne 0x14001df40
test r9d, r9d
js 0x14001e07c
nop dword [rax + rax]
test ebp, ebp
js 0x14001e028
mov ecx, dword [rbx - 8]
cmp ebp, ecx
jg 0x14001e028
mov edx, 0xffffffff
cmp ecx, 1
jl 0x14001e028
cmp ebp, ecx
jge 0x14001dfc5
movsxd rax, ebp
cmp word [rbx + rax*2], 0x5c
je 0x14001dfc3
inc ebp
cmp ebp, ecx
jl 0x14001dfb1
jmp 0x14001dfc5
mov edx, ebp
lea ebp, [rdx + 1]
cmp edx, 0xffffffff
je 0x14001e02b
mov r8d, ebp
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x80]
call fcn.14001e7d0
lea rcx, [rsp + 0x78]
mov rdi, rax
mov rdx, qword [rax]
mov edx, dword [rdx - 8]
call fcn.14001e440
mov rdx, qword [rdi]
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
mov eax, dword [rdx - 8]
add eax, eax
movsxd r8, eax
call fcn.1402d15b0
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x14001e055
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
jmp 0x14001e055
mov ebp, r12d
mov edx, dword [rbx - 8]
lea rcx, [rsp + 0x78]
call fcn.14001e440
mov eax, dword [rbx - 8]
mov rdx, rbx
mov rdi, qword [rsp + 0x78]
mov rcx, rdi
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.1402d15b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14001e072
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14001e082
sub r13d, 1
jns 0x14001df90
mov r12d, 1
test rsi, rsi
je 0x14001e091
mov rcx, qword [rsp + 0x20]
call fcn.1402d83b4
test rdi, rdi
je 0x14001e09f
lea rcx, [rdi - 8]
call fcn.1402d83b4
test rbx, rbx
je 0x14001e0ad
lea rcx, [rbx - 8]
call fcn.1402d83b4
mov rbx, qword [rsp + 0x70]
mov eax, r12d
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14001f530
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov qword [rsp + 0x30], rbp
xor ebp, ebp
mov qword [rcx], rbp
lea edx, [rbp + 1]
lea ecx, [rbp + 0xa]
call fcn.1402deebc
lea rcx, [rax + 8]
mov qword [rbx], rcx
cmp dword [rax], 0x105
jge 0x14001f5db
mov qword [rsp + 0x38], rsi
lea edx, [rbp + 1]
mov ecx, 0x214
mov qword [rsp + 0x40], rdi
call fcn.1402deebc
mov rdx, qword [rbx]
lea rsi, [rax + 8]
mov edi, dword [rdx - 8]
test edi, edi
jle 0x14001f594
lea eax, [rdi*2 + 2]
mov rcx, rsi
movsxd r8, eax
call fcn.1402d15b0
mov rcx, qword [rbx]
sub rcx, 8
call fcn.1402d83b4
mov qword [rbx], rsi
test edi, edi
mov dword [rsi - 4], 0x214
mov ecx, ebp
mov rdx, qword [rbx]
cmovns ecx, edi
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
lea eax, [rcx*2 + 2]
cmp eax, dword [rdx - 4]
jge 0x14001f5cd
mov dword [rdx - 8], ecx
mov rcx, qword [rbx]
movsxd rax, dword [rcx - 8]
mov word [rcx + rax*2], bp
mov rcx, qword [rbx]
cmp dword [rcx - 4], 0x20c
jle 0x14001f5eb
mov dword [rcx - 8], 0x105
mov rcx, qword [rbx]
movsxd rax, dword [rcx - 8]
mov word [rcx + rax*2], bp
mov ecx, 0x104
mov rdx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rcx, qword [rbx]
mov rax, 0xffffffffffffffff
mov rbp, qword [rsp + 0x30]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001f613
mov dword [rcx - 8], eax
lea rdx, [0x140471530]
mov rcx, rbx
call fcn.14001eb10
mov rax, rbx
add rsp, 0x20
pop rbx
ret
Function at 0x14001fbe0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xa0
mov rax, qword [0x1404b0028]
xor rax, rsp
mov qword [rbp + 7], rax
mov ebx, dword [rbp + 0x7f]
mov eax, r9d
mov rdi, qword [rbp + 0x77]
mov r14d, r9d
imul eax, r8d
mov esi, r8d
mov qword [rbp - 0x51], rdx
mov word [rbp - 0x31], 0x4d42
mov dword [rbp - 0x2b], 0
mov dword [rbp - 0x27], 0x36
imul eax, ebx
mov dword [rbp - 0x23], 0x28
mov word [rbp - 0x17], 1
mov word [rbp - 0x11], 0
mov dword [rbp - 0xb], 0xb12
cdq
mov qword [rbp - 7], 0xb12
and edx, 7
mov dword [rbp + 1], 0
add eax, edx
mov edx, 1
sar eax, 3
mov r13d, eax
lea ecx, [rdx + 9]
lea r12d, [rax + 0x36]
lea rax, vtable.SFile.0
mov r15d, r12d
and r15d, 0xfffffffc
mov qword [rbp - 0x49], rax
add r15d, 4
test r12b, 3
cmove r15d, r12d
call fcn.1402deebc
add rax, 8
mov qword [rbp - 0x41], 0
mov qword [rbp - 0x39], rax
lea rcx, [rbp - 0x49]
lea eax, [r15 - 0x36]
mov dword [rbp - 0x1f], esi
neg r14d
mov dword [rbp - 0xf], eax
mov r8d, 0x1001
mov dword [rbp - 0x1b], r14d
mov rdx, rdi
mov dword [rbp - 0x2f], r15d
mov dword [rbp - 0x15], ebx
call fcn.14001e170
mov rbx, qword [rbp - 0x41]
lea r9, [rbp - 0x59]
xor edi, edi
lea rdx, [rbp - 0x31]
mov rcx, rbx
mov qword [rsp + 0x20], rdi
lea r8d, [rdi + 0x36]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test r13d, r13d
je 0x14001fd15
mov rdx, qword [rbp - 0x51]
lea r9, [rbp - 0x59]
mov r8d, r13d
mov qword [rsp + 0x20], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp r15d, r12d
jbe 0x14001fd3b
sub r15d, r12d
je 0x14001fd3b
lea r9, [rbp - 0x59]
mov qword [rsp + 0x20], rdi
mov r8d, r15d
lea rdx, [0x140471e1c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rbx, rbx
je 0x14001fd49
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x39]
test rcx, rcx
je 0x14001fd5b
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140048b40
mov rbx, qword [rsp + 0xe0]
add rsp, 0xa0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020400
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x60
mov rsi, rdx
lea rcx, [rsp + 0x70]
mov rdx, qword [rsp + 0x90]
mov ebx, r9d
mov edi, r8d
call fcn.140021ec0
mov r9d, ebx
mov r8d, edi
mov rdx, rsi
mov rcx, qword [rax]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call fcn.140020530
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x14002046f
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
mov edx, 1
lea rax, vtable.SFile.0
mov qword [rsp + 0x48], rax
lea ecx, [rdx + 9]
call fcn.1402deebc
mov rdx, qword [rsp + 0x90]
lea rcx, [rsp + 0x48]
add rax, 8
xor esi, esi
mov r8d, 0x1001
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], rsi
call fcn.14001e170
mov r8d, dword [rsp + 0x98]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
test r8d, r8d
je 0x1400204e0
lea r9, [rsp + 0x98]
mov qword [rsp + 0x20], rsi
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
test rbx, rbx
je 0x1400204f1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rsi
mov rcx, rdi
call fcn.1402d83b4
test rbx, rbx
je 0x140020507
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x14002051a
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
mov rbx, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140020830
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rbx, rdx
lea rax, vtable.SFile.0
mov edx, 1
mov qword [rsp + 0x48], rax
mov r14, r9
mov r15, r8
lea ecx, [rdx + 9]
call fcn.1402deebc
xor r12d, r12d
add rax, 8
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x50], r12
lea edx, [r12 + 1]
lea ecx, [rdx + 9]
call fcn.1402deebc
add rax, 8
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x90], rax
nop
inc rdx
cmp word [rbx + rdx*2], r12w
jne 0x1400208a0
lea rcx, [rsp + 0x90]
call fcn.14001e440
mov rcx, qword [rsp + 0x90]
mov rdx, rbx
mov eax, dword [rcx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.1402d15b0
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x40]
call fcn.14001da90
lea rcx, [rsp + 0x58]
mov rbx, rax
mov rdx, qword [rax]
mov edx, dword [rdx - 8]
call fcn.14001e440
mov rdx, qword [rbx]
mov rsi, qword [rsp + 0x58]
mov rcx, rsi
mov eax, dword [rdx - 8]
add eax, eax
movsxd r8, eax
call fcn.1402d15b0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140020924
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
mov qword [rsp + 0x30], r12
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14002095f
mov rbx, r12
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0x90]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov edx, 1
mov edi, eax
call fcn.1402deebc
mov dword [rsp + 0x90], r12d
mov rbp, rax
test edi, edi
je 0x1400209a9
lea r9, [rsp + 0x90]
mov qword [rsp + 0x20], r12
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rbx, rbx
je 0x1400209ba
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r12
mov rax, qword [rsp + 0xb0]
mov r9, r15
mov qword [rsp + 0x28], rax
mov r8d, edi
mov rdx, rbp
mov qword [rsp + 0x20], r14
call fcn.140020a20
mov rcx, rbp
mov edi, eax
call fcn.1402d83b4
test rbx, rbx
je 0x1400209f2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x140020a00
lea rcx, [rsi - 8]
call fcn.1402d83b4
lea r11, [rsp + 0x60]
mov eax, edi
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400213b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1404b0028]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov edx, 1
mov rsi, rcx
lea ecx, [rdx + 9]
call fcn.1402deebc
xor edx, edx
lea rbx, [rax + 8]
lea ecx, [rdx + 2]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140021496
xor edx, edx
mov dword [rsp + 0x30], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call fcn.1402d1c50
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140021496
lea rax, [rsp + 0x5c]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140021440
lea rcx, [rsp + 0x20]
call fcn.14001e440
mov rbx, qword [rsp + 0x20]
lea rdx, [rsp + 0x5c]
mov rcx, rbx
mov eax, dword [rbx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.1402d15b0
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.14001ebe0
mov rcx, rdi
test eax, eax
je 0x1400214cd
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140021431
xor edi, edi
test rbx, rbx
je 0x1400214a6
lea rcx, [rbx - 8]
call fcn.1402d83b4
mov eax, edi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140048b40
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x4c], 0
je 0x140021496
mov edi, dword [rsp + 0x38]
jmp 0x140021498

Function at 0x1400214e0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov edx, 1
mov rbx, rcx
lea ecx, [rdx + 9]
call fcn.1402deebc
add rax, 8
mov rdx, 0xffffffffffffffff
mov qword [rsp + 0x38], rax
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140021506
lea rcx, [rsp + 0x38]
call fcn.14001e440
mov rcx, qword [rsp + 0x38]
mov rdx, rbx
mov eax, dword [rcx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.1402d15b0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x40]
call fcn.14001da90
mov rbx, qword [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0x3e
mov rcx, rbx
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test rbx, rbx
je 0x140021572
lea rcx, [rbx - 8]
add rsp, 0x20
pop rbx
jmp fcn.1402d83b4
add rsp, 0x20
pop rbx
ret
Function at 0x140025280
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rdi, rdx
mov r15, rcx
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140025467
lea rax, vtable.SFile.0
mov qword [rsp + 0x48], rax
mov edx, 1
lea ecx, [rdx + 9]
call fcn.1402deebc
add rax, 8
mov qword [rsp + 0x58], rax
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov rbx, qword [rdi]
lea edx, [r12 + 1]
lea ecx, [rdx + 9]
call fcn.1402deebc
add rax, 8
mov qword [rsp + 0xb8], rax
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140025300
lea rcx, [rsp + 0xb8]
call fcn.14001e440
mov rcx, qword [rsp + 0xb8]
mov eax, dword [rcx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
mov rdx, rbx
call fcn.1402d15b0
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x40]
call fcn.14001da90
mov rbx, rax
mov rcx, qword [rax]
mov edx, dword [rcx - 8]
lea rcx, [rsp + 0x58]
call fcn.14001e440
mov rdx, qword [rbx]
mov eax, dword [rdx - 8]
add eax, eax
movsxd r8, eax
mov rbp, qword [rsp + 0x58]
mov rcx, rbp
call fcn.1402d15b0
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140025384
lea rcx, [rax - 8]
call fcn.1402d83b4
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x1400253c9
mov rbx, r12
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [rsp + 0xb0]
shl rsi, 0x20
mov eax, eax
add rsi, rax
lea ecx, [rsi + 0x100]
call fcn.1402d83ac
mov r14, rax
mov dword [rsp + 0xb0], r12d
test esi, esi
je 0x140025420
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
mov r8d, esi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rbx, rbx
je 0x140025436
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r12
mov qword [rsp + 0x50], rbx
mov eax, 0xfeff
cmp word [r14], ax
je 0x140025489
mov rcx, r14
call fcn.1402d83b4
nop
test rbx, rbx
je 0x140025458
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x140025467
lea rcx, [rbp - 8]
call fcn.1402d83b4
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x140025478
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
xor eax, eax
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r8d, esi
mov rdx, r14
mov rcx, r15
call fcn.1400254f0
mov rcx, r14
call fcn.1402d83b4
nop
test rbx, rbx
je 0x1400254ae
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbp, rbp
je 0x1400254bd
lea rcx, [rbp - 8]
call fcn.1402d83b4
nop
mov rcx, qword [rdi]
test rcx, rcx
je 0x1400254ce
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
mov eax, 1
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140025d90
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x60
mov rsi, rdx
mov r15, rcx
mov rcx, qword [rdx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x140025dde
mov rcx, qword [rsi]
test rcx, rcx
je 0x140025dcd
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
xor eax, eax
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rax, vtable.SFile.0
mov qword [rsp + 0x48], rax
mov edx, 1
lea ecx, [rdx + 9]
call fcn.1402deebc
add rax, 8
mov qword [rsp + 0x58], rax
xor r12d, r12d
mov qword [rsp + 0x50], r12
mov rbx, qword [rsi]
lea edx, [r12 + 1]
lea ecx, [rdx + 9]
call fcn.1402deebc
add rax, 8
mov qword [rsp + 0xb8], rax
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], 0
jne 0x140025e30
lea rcx, [rsp + 0xb8]
call fcn.14001e440
mov rcx, qword [rsp + 0xb8]
mov eax, dword [rcx - 8]
lea eax, [rax*2 + 2]
movsxd r8, eax
mov rdx, rbx
call fcn.1402d15b0
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x40]
call fcn.14001da90
mov rbx, rax
mov rcx, qword [rax]
mov edx, dword [rcx - 8]
lea rcx, [rsp + 0x58]
call fcn.14001e440
mov rdx, qword [rbx]
mov eax, dword [rdx - 8]
add eax, eax
movsxd r8, eax
mov r14, qword [rsp + 0x58]
mov rcx, r14
call fcn.1402d15b0
mov rax, qword [rsp + 0x40]
test rax, rax
je 0x140025eb4
lea rcx, [rax - 8]
call fcn.1402d83b4
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x140025ef9
mov rbx, r12
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, dword [rsp + 0xb0]
shl rdi, 0x20
mov eax, eax
add rdi, rax
lea ecx, [rdi + 0x100]
mov edx, 1
call fcn.1402deebc
mov rbp, rax
mov dword [rsp + 0xb0], r12d
test edi, edi
je 0x140025f55
mov qword [rsp + 0x20], r12
lea r9, [rsp + 0xb0]
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test rbx, rbx
je 0x140025f6b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, r12
mov qword [rsp + 0x50], rbx
mov r8d, edi
mov rdx, rbp
mov rcx, r15
call fcn.140025fd0
mov rcx, rbp
call fcn.1402d83b4
nop
test rbx, rbx
je 0x140025f90
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14, r14
je 0x140025f9f
lea rcx, [r14 - 8]
call fcn.1402d83b4
nop
mov rcx, qword [rsi]
test rcx, rcx
je 0x140025fb0
add rcx, 0xfffffffffffffff8
call fcn.1402d83b4
mov eax, 1
add rsp, 0x60
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140029d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov rsi, rcx
xor r11d, r11d
mov r9d, r11d
lea rdi, [rdi + 8]
shr r9d, 2
mov r10d, r11d
shr r10d, 1
mov ecx, r9d
neg ecx
add r11d, 2
shr rcx, 4
and ecx, 0x7f
lea eax, [r9 + 2]
movzx r8d, word [rsi + rax*2]
mov eax, r10d
and eax, 1
shr r8, 4
neg eax
shr rax, 4
and eax, 0x7f
xor r8, rax
movzx eax, word [rsi + 2]
shr rax, 4
xor rcx, rax
lea eax, [r10 + 4]
mov r8d, dword [rbx + r8*4]
movzx edx, word [rsi + rax*2]
add r8d, dword [rbx + rcx*4]
mov eax, edx
add r8d, ebp
shr rax, 4
xor rdx, 0x7f0
shr rdx, 4
mov ecx, dword [rbx + rax*4]
add ecx, r8d
mov dword [rdi - 8], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r8d
mov dword [rdi - 4], ecx
cmp r11d, 8
jb 0x140029d72
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14002c360
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x70
lea rdx, [rcx + 0x318]
xor r14d, r14d
mov qword [rdx + 0x480], 0xffffffffffffffff
lea r9, [rdx + 0x78]
mov qword [rcx + 0xa0], r14
mov r8d, r14d
mov qword [rcx + 0x98], r14
mov rbp, rcx
mov qword [rdx], r14
mov qword [rdx + 0x40], r14
mov word [rdx + 0x22], r14w
mov qword [rdx + 0x48], r14
mov qword [rdx + 0x28], r14
mov dword [rdx + 0x3c], 0x20
mov byte [rdx + 0x21], 1
mov dword [rdx + 0x5c], 4
mov word [rdx + 0x70], 2
nop dword [rax]
nop word [rax + rax]
mov ecx, r8d
lea r9, [r9 + 4]
and ecx, 1
mov eax, r8d
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc r8d
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r9 - 4], eax
cmp r8d, 0x100
jb 0x14002c3e0
lea rcx, [rbp + 0x290]
mov qword [rbp + 0x310], rdx
mov qword [rbp + 0x248], r14
call fcn.1400300f0
lea rcx, [rbp + 0x150]
call fcn.1400300f0
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], 5
mov rcx, rbp
mov qword [rsp + 0x44], r14
mov qword [rsp + 0x58], 0xffffffffffffffff
mov dword [rsp + 0x50], 0xffffffff
mov qword [rsp + 0x3c], 0xffffffffffffffff
mov qword [rsp + 0x34], 0xffffffffffffffff
mov qword [rsp + 0x2c], 0xffffffffffffffff
mov dword [rsp + 0x28], 0xffffffff
mov dword [rsp + 0x4c], r14d
mov qword [rsp + 0x60], r14
call fcn.140029810
lea rsi, [rbp + 0x2d70]
mov edi, 2
mov word [rsi], 0x100
add rsi, 2
nop dword [rax]
nop dword [rax + rax]
mov ecx, edi
mov ebx, 1
shr ecx, 1
movzx edx, dil
dec ecx
shl rbx, cl
mov rcx, rsi
mov r8, rbx
call fcn.1402d1c50
add rsi, rbx
inc edi
cmp edi, 0x1c
jb 0x14002c520
mov r8d, 8
lea r9, [rbp + 0x820]
nop dword [rax]
nop dword [rax + rax]
mov eax, r8d
mov ecx, r14d
mov edx, 4
nop dword [rax + rax]
imul eax, eax
add ecx, ecx
cmp eax, 0x10000
jb 0x14002c58b
nop dword [rax]
shr eax, 1
inc ecx
cmp eax, 0x10000
jae 0x14002c580
sub rdx, 1
jne 0x14002c570
mov eax, 0xa1
add r8d, 0x10
sub eax, ecx
mov dword [r9], eax
add r9, 4
cmp r8d, 0x808
jb 0x14002c560
lea r11, [rsp + 0x70]
mov qword [rbp + 0x68], r14
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov qword [rbp + 0x1f578], r14
mov rbp, qword [r11 + 0x18]
mov rsp, r11
pop r14
ret