joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140013c50
Capabilities:
Accept command line arguments

Disassembly:
push rsi
push r14
sub rsp, 0x28
mov r14, rcx
call fcn.14000f730
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rdx, rax
movzx eax, word [rax]
test ax, ax
je 0x140013c84
cmp ax, 0x20
ja 0x140013c84
movzx eax, word [rdx + 2]
add rdx, 2
test ax, ax
jne 0x140013c71
movzx r9d, word [rdx]
movzx eax, r9w
cmp r9w, 0x22
jne 0x140013c97
movzx eax, word [rdx + 2]
mov ecx, 0x20
mov r8d, 0x22
cmovne r8w, cx
lea rcx, [rdx + 2]
cmovne rcx, rdx
cmp ax, r8w
je 0x140013cd1
movzx edx, ax
movzx eax, dx
test dx, dx
je 0x140013cd1
movzx eax, word [rcx + 2]
add rcx, 2
movzx edx, ax
cmp ax, r8w
jne 0x140013cb8
test ax, ax
lea rdx, [rcx + 2]
cmove rdx, rcx
mov rsi, rdx
cmp r9w, 0x22
jne 0x140013cf0
cmp word [rdx], 0x20
jne 0x140013cf0
lea rsi, [rdx + 2]
movzx eax, word [rsi]
test ax, ax
je 0x140013e7e
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
cmp ax, 0x22
jne 0x140013dc2
movzx eax, word [rsi + 2]
add rsi, 2
mov rdi, rsi
test ax, ax
je 0x140013d43
nop dword [rax]
cmp ax, 0x22
je 0x140013d43
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140013d30
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x140013d78
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.14006e250
mov word [rbx + rbp], r15w
jmp 0x140013d7b
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x140013d9f
mov rax, qword [rcx + 0x18]
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x140013dac
lea rdx, [rbx + 8]
call fcn.140014ca0
mov qword [rax + rbx], rbp
mov rsi, rdi
cmp word [rdi], r15w
je 0x140013e5e
lea rsi, [rdi + 2]
jmp 0x140013e5e
cmp ax, 0x20
jbe 0x140013e5a
mov rdi, rsi
nop
cmp ax, 0x22
je 0x140013de9
cmp ax, 0x20
jbe 0x140013de9
movzx eax, word [rdi + 2]
add rdi, 2
test ax, ax
jne 0x140013dd0
mov rbx, rdi
sub rbx, rsi
sar rbx, 1
test rbx, rbx
jle 0x140013e1e
mov rax, qword [r14]
add rbx, rbx
mov rcx, r14
lea rdx, [rbx + 2]
call qword [rax]
mov r8, rbx
mov rdx, rsi
mov rcx, rax
mov rbp, rax
call fcn.14006e250
mov word [rbx + rbp], r15w
jmp 0x140013e21
mov rbp, r15
mov rbx, qword [r14 + 0x30]
lea rcx, [r14 + 8]
mov rax, qword [rcx + 0x20]
sub rax, rbx
cmp rax, 8
jl 0x140013e48
mov rax, qword [rcx + 0x18]
mov rsi, rdi
mov qword [rbx + rax], rbp
add qword [rcx + 0x28], 8
jmp 0x140013e5e
lea rdx, [rbx + 8]
call fcn.140014ca0
mov rsi, rdi
mov qword [rax + rbx], rbp
jmp 0x140013e5e
add rsi, 2
movzx eax, word [rsi]
test ax, ax
jne 0x140013d13
mov r15, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rax, qword [r14 + 0x30]
shr rax, 3
add rsp, 0x28
pop r14
pop rsi
ret
Function at 0x1400174a4
Capabilities:
Get session user name
Get user security identifier

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
lea rbp, [rax - 0x3a8]
sub rsp, 0x4a0
mov rax, qword [0x14008f040]
xor rax, rsp
mov qword [rbp + 0x390], rax
mov esi, 0x103
lea rcx, [rbp + 0x171]
xor edi, edi
mov r8d, esi
xor edx, edx
mov byte [rbp + 0x170], dil
call fcn.14006de90
mov r8d, esi
mov byte [rsp + 0x50], dil
xor edx, edx
lea rcx, [rsp + 0x51]
call fcn.14006de90
lea ebx, [rsi + 1]
lea rdx, [rsp + 0x44]
mov dword [rsp + 0x44], ebx
lea rcx, [rbp + 0x170]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
mov r8d, esi
mov byte [rbp + 0x60], dil
xor edx, edx
lea rcx, [rbp + 0x61]
call fcn.14006de90
mov r8d, esi
mov byte [rbp + 0x280], dil
xor edx, edx
lea rcx, [rbp + 0x281]
call fcn.14006de90
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x40], ebx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
lea rax, [rsp + 0x48]
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x28], rax
lea r8, [rbp + 0x60]
lea rax, [rbp + 0x280]
xor ecx, ecx
lea rdx, [rbp + 0x170]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea rcx, [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetSidIdentifierAuthority]
lea r8d, [rdi + 1]
mov rbx, rax
lea rdx, str.S__lu_
lea rcx, [rsp + 0x50]
call fcn.140015c70
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x50]
movzx r8d, byte [rbx + 5]
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x1400175bd
lea rcx, [rsp + 0x50]
add rcx, rax
lea rdx, [0x1400815d0]
call fcn.140015c70
add dword [rsp + 0x40], eax
lea rcx, [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
movzx ebx, byte [rax]
test ebx, ebx
je 0x140017620
mov edx, edi
lea rcx, [rbp + 0x60]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov ecx, dword [rsp + 0x40]
lea rdx, [rsp + 0x50]
add rcx, rdx
lea rdx, str.__lu
mov r8d, dword [rax]
call fcn.140015c70
add dword [rsp + 0x40], eax
inc edi
cmp edi, ebx
jl 0x1400175ef
lea rax, [rsp + 0x50]
mov rcx, qword [rbp + 0x390]
xor rcx, rsp
call fcn.14001a0e0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x14001ad24
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001ad6e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001ad6e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001ad6e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001ad6e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001ad6e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001ad70
xor al, al
add rsp, 0x28
ret

Function at 0x140037f70
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x140024082
movzx eax, byte [rdx + rcx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x140024065
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x140024050
Function at 0x14004970c
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x250
mov rax, qword [0x14008f040]
xor rax, rsp
mov qword [rsp + 0x240], rax
lea rdx, [0x140075e78]
mov rbp, rcx
call fcn.14005d918
xor edi, edi
test rax, rax
je 0x1400497f2
mov ebx, edi
call fcn.14004bf3c
mov r14d, dword [rax]
call fcn.14004bf3c
mov r8d, 0x104
lea rcx, [rsp + 0x30]
mov rdx, rbp
mov dword [rax], edi
call fcn.14005d864
mov rsi, rax
test rax, rax
je 0x140049783
call fcn.14004bf3c
mov dword [rax], r14d
jmp 0x1400497ad
call fcn.14004bf3c
cmp dword [rax], 0x22
jne 0x1400497ea
call fcn.14004bf3c
xor r8d, r8d
mov rdx, rbp
xor ecx, ecx
mov dword [rax], r14d
call fcn.14005d864
mov rbx, rax
mov rsi, rax
test rax, rax
je 0x1400497ea
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], di
jne 0x1400497b1
cmp rax, 3
je 0x1400497cc
mov rcx, rsi
call fcn.140049668
test al, al
je 0x1400497dd
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x1400497dd
mov dil, 1
mov rcx, rbx
call fcn.1400485b0
mov al, dil
jmp 0x1400497f4
mov rcx, rbx
call fcn.1400485b0
xor al, al
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.14001a0e0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x14004bc68
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14004bad3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14004bad3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14004bad3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14004bad3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14004bad3
cmp dword [rcx + 0x84], 0xe
jbe 0x14004bad3
cmp dword [rcx + 0xf8], 0
je 0x14004bad3
mov ecx, ebx
call fcn.14004bb84
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14004b960
nop
cmp dword [rbp + 0x20], 0
je 0x14004bb21
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14004bb2c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14004ba64
Function at 0x140055360
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14006da40
sub rsp, rax
mov rax, qword [0x14008f040]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r15, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14005ce2c
xor edi, edi
movsxd r14, eax
cmp dword [rbx + 0x10], edi
jne 0x1400553af
mov rax, rbp
jmp 0x1400554b7
mov rax, qword [rbx]
mov rcx, r14
sub rax, qword [rbx + 8]
and ecx, 0x3f
cqo
mov rbx, r14
sub rax, rdx
sar rbx, 6
sar rax, 1
mov r9, r15
lea r12, [rcx + rcx*8]
mov rsi, rax
lea rax, [0x140000000]
xor r8d, r8d
mov rdx, qword [rax + rbx*8 + 0x92510]
mov ecx, r14d
mov rdx, qword [rdx + r12*8 + 0x30]
call fcn.140060d18
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rbx*8 + 0x92510]
cmp r13, qword [rcx + r12*8 + 0x30]
jne 0x1400554b3
mov rcx, qword [rcx + r12*8 + 0x28]
lea r9, [rsp + 0x30]
mov r8d, 0x1000
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1400554b3
mov r9, r15
xor r8d, r8d
mov rdx, rbp
mov ecx, r14d
call fcn.140060d18
test rax, rax
js 0x1400554b3
mov eax, dword [rsp + 0x30]
cmp rsi, rax
jg 0x1400554b3
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test rsi, rsi
je 0x1400554a5
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x1400554a5
cmp byte [rcx], 0xd
jne 0x14005548b
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14005549a
cmp byte [rcx + 1], 0xa
jne 0x14005549a
inc rcx
jmp 0x14005549a
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x8f690]
add rcx, rax
inc rdi
inc rcx
cmp rdi, rsi
jne 0x14005546d
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
jmp 0x1400554b7
or rax, 0xffffffffffffffff
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.14001a0e0
mov rbx, qword [rsp + 0x1090]
add rsp, 0x1050
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x14005d328
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x14005d33e
mov al, 1
jmp 0x14005d39e
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x14005d34f
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x14005d39c
mov ecx, dword [rcx + 0x18]
nop
call fcn.14005eb20
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14005d39c
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14005d39c
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x14005d39c
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x14005d39e
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140060f18
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r9, [0x140092510]
mov rax, r15
mov rbp, r15
and eax, 0x3f
sar rbp, 6
mov ecx, 4
xor esi, esi
mov r14, rdx
lea rdi, [rax + rax*8]
mov rax, qword [r9 + rbp*8]
lea r13d, [rcx + 6]
mov r10, qword [rax + rdi*8 + 0x28]
test r8, r8
je 0x140060f6f
cmp word [rdx], r13w
jne 0x140060f6f
or byte [rax + rdi*8 + 0x38], cl
jmp 0x140060f74
and byte [rax + rdi*8 + 0x38], 0xfb
lea r8, [rdx + r8*2]
mov rbx, r14
cmp r14, r8
jae 0x140061099
mov r11d, 0xd
lea r12d, [r11 - 0xb]
movzx ecx, word [rdx]
cmp cx, 0x1a
je 0x1400610ba
lea r9, [rdx + 2]
cmp cx, r11w
je 0x140060fad
mov rdx, r9
mov word [rbx], cx
jmp 0x140060fd4
cmp r9, r8
jae 0x140060fe4
cmp word [r9], r13w
mov rax, r12
mov ecx, 4
cmove rax, rcx
add rdx, rax
mov eax, r13d
cmp word [r9], r13w
cmovne ax, r11w
mov word [rbx], ax
mov rax, r12
add rbx, rax
cmp rdx, r8
jb 0x140060f8e
jmp 0x140061099
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], rsi
mov r8d, r12d
lea rdx, [rsp + 0x70]
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14006108e
cmp dword [rsp + 0x80], esi
je 0x14006108e
lea r8, [0x140092510]
mov rax, qword [r8 + rbp*8]
test byte [rax + rdi*8 + 0x38], 0x48
je 0x140061066
movzx eax, word [rsp + 0x70]
cmp ax, r13w
jne 0x140061036
mov word [rbx], r13w
jmp 0x140061096
mov ecx, 0xd
mov word [rsp + 0x78], ax
mov word [rbx], cx
mov rax, qword [r8 + rbp*8]
lea rcx, [rax + rdi*8]
mov al, byte [rsp + rsi + 0x78]
mov byte [rcx + rsi + 0x3a], al
inc rsi
cmp rsi, r12
jl 0x140061043
mov rax, qword [r8 + rbp*8]
mov byte [rax + rdi*8 + 0x3c], r13b
jmp 0x140061096
cmp word [rsp + 0x70], r13w
jne 0x140061073
cmp rbx, r14
je 0x140061030
mov rdx, 0xfffffffffffffffe
mov ecx, r15d
lea r8d, [rdx + 3]
call fcn.140060d20
cmp word [rsp + 0x70], r13w
je 0x140061099
mov ecx, 0xd
mov word [rbx], cx
add rbx, r12
sub rbx, r14
sar rbx, 1
lea eax, [rbx + rbx]
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r8, [0x140092510]
mov rdx, qword [r8 + rbp*8]
mov al, byte [rdx + rdi*8 + 0x38]
test al, 0x40
jne 0x140061093
or al, r12b
mov byte [rdx + rdi*8 + 0x38], al
jmp 0x140061099
Function at 0x14006472c
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x1400647b3
mov rsi, rbx
cmp word [rax], bp
je 0x140064772
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14006475c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x140064758
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14005d5d4
mov rdi, rax
test rax, rax
je 0x1400647a0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.14006e250
mov rbp, rdi
xor ecx, ecx
call fcn.14005c718
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140067808
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.14005cacc
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400678a9
cmp ebx, dword [rsp + 0x30]
je 0x1400678a2
test esi, esi
je 0x1400678a2
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x14006787d
sub r8w, 0x61
cmp r8w, 0x19
ja 0x14006788a
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x140067867
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x14006788e
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400678ab
mov eax, 1
jmp 0x1400678ab
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1400698c4
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x14008f040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp ecx, 0x1a
jbe 0x14006990e
call fcn.14004bf1c
mov dword [rax], 0xf
call fcn.14004bf3c
mov dword [rax], 0xd
call fcn.1400489b0
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001a0e0
add rsp, 0x30
pop rbx
ret
xor ebx, ebx
test ecx, ecx
jne 0x140069919
lea eax, [rbx + 1]
jmp 0x1400698fb
add cx, 0x40
mov dword [rsp + 0x22], 0x5c003a
mov word [rsp + 0x20], cx
lea rcx, [rsp + 0x20]
mov word [rsp + 0x26], bx
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
test eax, eax
je 0x1400698f9
cmp eax, 1
setne bl
mov eax, ebx
jmp 0x1400698fb
Function at 0x14006d050
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.140060d20
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.140060d20
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x14006d1a0
cmp rax, 0xffffffffffffffff
je 0x14006d1a0
xor edi, edi
test rbp, rbp
jle 0x14006d14b
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.1400609f4
mov rbx, rax
test rax, rax
jne 0x14006d0d8
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x14006d141
mov edx, 0x8000
mov ecx, r14d
call fcn.140058ee8
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.14005f7a4
cmp eax, 0xffffffff
je 0x14006d121
cdqe
sub rbp, rax
test rbp, rbp
jg 0x14006d0e8
mov edx, r15d
mov ecx, r14d
call fcn.140058ee8
jmp 0x14006d141
cmp byte [rsi + 0x38], dil
je 0x14006d138
cmp dword [rsi + 0x34], 5
jne 0x14006d138
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x14006d141
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.14005c718
jmp 0x14006d1b4
jns 0x14006d1b4
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.140060d20
cmp rax, 0xffffffffffffffff
jne 0x14006d16c
cmp byte [rsi + 0x30], dil
je 0x14006d1b4
mov edi, dword [rsi + 0x2c]
jmp 0x14006d1b4
mov ecx, r14d
call fcn.14005eb20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x14006d1b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x14006d1b4
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x14006d1ad
mov eax, dword [rsi + 0x2c]
jmp 0x14006d1b2
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.140060d20
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x14006db30
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x14006db58
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x14006db58
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x14000b91c
Capabilities:
Encode data using base64

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r15
sub rsp, 0x20
xorps xmm0, xmm0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
cvtsi2sd xmm0, rdx
test rdx, rdx
jns 0x14000b953
addsd xmm0, qword [0x140041638]
divsd xmm0, qword [0x140041620]
call fcn.14002882c
mulsd xmm0, qword [0x140041628]
xor eax, eax
movsd xmm1, qword [0x140041630]
comisd xmm0, xmm1
jb 0x14000b98f
subsd xmm0, xmm1
comisd xmm0, xmm1
jae 0x14000b98f
movabs rcx, 0x8000000000000000
mov rax, rcx
cvttsd2si rcx, xmm0
mov edx, 1
add rcx, rax
mov qword [rsi], rcx
inc rcx
call fcn.140025b10
xor r8d, r8d
mov r9, rax
test rax, rax
je 0x14000baac
lea r15, [0x140000000]
mov rcx, r8
test rbx, rbx
je 0x14000ba71
mov r10, r9
cmp rcx, rbx
jae 0x14000b9dd
lea rax, [rcx + rdi]
inc rcx
movzx edx, byte [rax]
jmp 0x14000b9e0
mov rdx, r8
cmp rcx, rbx
jae 0x14000b9f1
lea rax, [rcx + rdi]
inc rcx
movzx ebp, byte [rax]
jmp 0x14000b9f4
mov rbp, r8
cmp rcx, rbx
jae 0x14000ba06
lea rax, [rcx + rdi]
inc rcx
movzx r11d, byte [rax]
jmp 0x14000ba09
mov r11, r8
shl rdx, 8
add rdx, rbp
shl rdx, 8
add rdx, r11
mov rax, rdx
shr rax, 0x12
mov al, byte [rax + r15 + 0x5faf0]
mov byte [r10], al
mov rax, rdx
shr rax, 0xc
and eax, 0x3f
mov al, byte [rax + r15 + 0x5faf0]
mov byte [r10 + 1], al
mov rax, rdx
shr rax, 6
and edx, 0x3f
and eax, 0x3f
mov al, byte [rax + r15 + 0x5faf0]
mov byte [r10 + 2], al
mov al, byte [rdx + r15 + 0x5faf0]
mov byte [r10 + 3], al
add r10, 4
cmp rcx, rbx
jb 0x14000b9d1
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
shr rdx, 1
lea rax, [rdx + rdx*2]
sub rbx, rax
mov rcx, qword [r15 + rbx*8 + 0x5fb30]
test rcx, rcx
je 0x14000baa9
mov rax, qword [rsi]
sub rax, r8
inc r8
mov byte [rax + r9 - 1], 0x3d
cmp r8, rcx
jb 0x14000ba95
mov rax, r9
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x1400254a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400254c0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
repz ret

Function at 0x140025500
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140025520
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
repz ret