joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400306df
Capabilities:
Write file on windows

Disassembly:
jmp 0x140056c30
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400bd04e]
call fcn.140030a04
lea rdx, [0x14009c304]
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.ucrtbased.dll_fopen]
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0
jne 0x140056c7f
mov eax, 0x4f
jmp 0x140056ca8
mov r9, qword [rbp + 8]
mov r8, qword [rbp + 0x108]
mov edx, 1
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 8]
call qword [sym.imp.ucrtbased.dll_fclose]
xor eax, eax
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140030996
Capabilities:
Write file on windows

Disassembly:
jmp 0x140077ed0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1400b0080]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x1400bd22d]
call fcn.140030a04
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x140077f36
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140077f3d
mov al, 1
jmp 0x1400780ad
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14002f735
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14002f735
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.1400303fb
movzx eax, al
test eax, eax
je 0x140077fa0
xor al, al
jmp 0x1400780ad
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x140078013
cmp dword [rbp + 0x160], 1
je 0x14007801e
cmp dword [rbp + 0x160], 3
je 0x14007809c
jmp 0x1400780ab
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14007806e
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14007806e
xor al, al
jmp 0x1400780ad
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x140078089
mov dword [rbp + 0x154], 1
jmp 0x140078093
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x1400780ad
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400780ad
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400a0080]
call fcn.140030504
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.14002fc8f
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140030b71
Capabilities:
Hash data with crc32

Disassembly:
jmp 0x1400508b0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x1400bd04e]
call fcn.140030a04
mov dword [rbp + 4], 0xffffffff
cmp qword [rbp + 0x108], 8
jb 0x140050a4a
mov eax, 1
imul rax, rax, 0
mov rcx, qword [rbp + 0x100]
movzx eax, byte [rcx + rax]
mov ecx, dword [rbp + 4]
and ecx, 0xff
xor eax, ecx
mov eax, eax
lea rcx, [0x140096d10]
mov edx, 1
imul rdx, rdx, 1
mov r8, qword [rbp + 0x100]
movzx edx, byte [r8 + rdx]
mov r8d, dword [rbp + 4]
shr r8d, 8
and r8d, 0xff
xor edx, r8d
mov edx, edx
lea r8, [0x140096910]
mov edx, dword [r8 + rdx*4]
mov eax, dword [rcx + rax*4]
xor eax, edx
mov ecx, 1
imul rcx, rcx, 2
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
mov edx, dword [rbp + 4]
shr edx, 0x10
and edx, 0xff
xor ecx, edx
mov ecx, ecx
lea rdx, [0x140096510]
xor eax, dword [rdx + rcx*4]
mov ecx, 1
imul rcx, rcx, 3
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
mov edx, dword [rbp + 4]
shr edx, 0x18
and edx, 0xff
xor ecx, edx
mov ecx, ecx
lea rdx, [0x140096110]
xor eax, dword [rdx + rcx*4]
mov ecx, 1
imul rcx, rcx, 4
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
lea rdx, [0x140095d10]
xor eax, dword [rdx + rcx*4]
mov ecx, 1
imul rcx, rcx, 5
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
lea rdx, [0x140095910]
xor eax, dword [rdx + rcx*4]
mov ecx, 1
imul rcx, rcx, 6
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
lea rdx, [0x140095510]
xor eax, dword [rdx + rcx*4]
mov ecx, 1
imul rcx, rcx, 7
mov rdx, qword [rbp + 0x100]
movzx ecx, byte [rdx + rcx]
lea rdx, [0x140095110]
xor eax, dword [rdx + rcx*4]
mov dword [rbp + 4], eax
mov rax, qword [rbp + 0x100]
add rax, 8
mov qword [rbp + 0x100], rax
mov rax, qword [rbp + 0x108]
sub rax, 8
mov qword [rbp + 0x108], rax
jmp 0x1400508db
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xd8], rax
mov rax, qword [rbp + 0x108]
dec rax
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0xd8], 0
je 0x140050abf
mov rax, qword [rbp + 0x100]
movzx eax, byte [rax]
mov ecx, dword [rbp + 4]
xor ecx, eax
mov eax, ecx
and eax, 0xff
mov eax, eax
lea rcx, [0x140095110]
mov edx, dword [rbp + 4]
shr edx, 8
mov eax, dword [rcx + rax*4]
xor eax, edx
mov dword [rbp + 0xd4], eax
mov rax, qword [rbp + 0x100]
inc rax
mov qword [rbp + 0x100], rax
mov eax, dword [rbp + 0xd4]
mov dword [rbp + 4], eax
jmp 0x140050a4a
mov eax, dword [rbp + 4]
xor eax, 0xffffffff
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x45ce40
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [0x0045e1f0]
nop
cmp word [0x00400000], 0x5a4d
je 0x45ce7d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x00400000]
jmp 0x45cf0b
movsxd rax, dword [0x0040003c]
lea rdi, [0x00400000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x45cea1
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x45cf0b
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x45cee8
cmp ecx, 0x20b
je 0x45cec0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x45cf0b
cmp dword [rax + 0x84], 0xe
ja 0x45ced4
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x45cf0b
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x45cf0b
cmp dword [rax + 0x74], 0xe
ja 0x45cef9
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x45cf0b
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [0x0045e628]
mov qword [0x004831c8], 0xffffffffffffffff
mov qword [0x004831d0], 0xffffffffffffffff
mov rcx, qword [0x0045e620]
mov eax, dword [0x00480c3c]
mov dword [rcx], eax
mov rcx, qword [0x0045e618]
mov eax, dword [0x00480c38]
mov dword [rcx], eax
call fcn.0045d0f0
cmp dword [0x00480640], 0
jne 0x45cf65
lea rcx, [fcn.0045d0f0]
call qword [0x0045e610]
lea rdx, [0x0045e6d0]
lea rcx, [0x0045e6c8]
call fcn.0045d0e4
mov r11d, dword [0x00480c34]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x00480c30]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [0x0045e600]
lea rdx, [0x0045e6c0]
lea rcx, [0x0045e668]
call fcn.0045d0e4
mov r11, qword [0x0045e5e0]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x45d006
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x45cff6
cmp al, 0x22
je 0x45cff6
jmp 0x45cfe0
cmp byte [r8], 0x22
jne 0x45d016
inc r8
mov qword [rsp + 0x30], r8
jmp 0x45d016
cmp byte [r8], 0x20
jbe 0x45d016
inc r8
mov qword [rsp + 0x30], r8
jmp 0x45d006
movzx eax, byte [r8]
test al, al
je 0x45d02c
cmp al, 0x20
ja 0x45d02c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x45d016
test byte [rsp + 0x8c], 1
je 0x45d041
movzx r9d, word [rsp + 0x90]
jmp 0x45d047
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call 0x520000
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x45d063
mov ecx, eax
call qword [0x0045e5d8]
call qword [0x0045e5d0]
jmp 0x45d087
mov eax, edi
jmp 0x45d090
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x140011212
Capabilities:
Terminate process

Disassembly:
jmp 0x140013310
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x1400112a8
Capabilities:
Parse pe header

Disassembly:
jmp 0x140014660
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140014680
xor al, al
jmp 0x140014701
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140014693
xor al, al
jmp 0x140014701
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400146bd
xor al, al
jmp 0x140014701
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1400146d1
xor al, al
jmp 0x140014701
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1400146e3
xor al, al
jmp 0x140014701
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1400146ff
xor al, al
jmp 0x140014701
mov al, 1
add rsp, 0x38
ret
Function at 0x1400011c0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [rcx + 8]
mov rdi, rcx
mov r14d, dword [rdx + 0x10]
mov rsi, rdx
mov rdx, qword [rcx]
mov rcx, rbp
sub rcx, rdx
cmp rcx, 0x100
jbe 0x1400011fb
lea rax, [rdx + 0x100]
jmp 0x14000122f
jae 0x140001233
mov rax, qword [rdi + 0x10]
sub rax, rdx
cmp rax, 0x100
jae 0x140001216
mov rcx, rdi
call fcn.140002570
jmp 0x140001233
mov ebx, 0x100
xor edx, edx
sub rbx, rcx
mov rcx, rbp
mov r8, rbx
call sub.VCRUNTIME140.dll_memset
lea rax, [rbx + rbp]
mov qword [rdi + 8], rax
mov rdx, qword [rdi]
xor ebp, ebp
movdqa xmm3, xmmword [0x1400048d0]
mov ecx, ebp
lea rax, [rdx + 0xff]
cmp rdx, rdi
ja 0x14000127a
cmp rax, rdi
jb 0x14000127a
mov edx, ebp
nop word [rax + rax]
mov rax, qword [rdi]
lea rdx, [rdx + 1]
mov byte [rdx + rax - 1], cl
inc ecx
cmp ecx, 0x100
jl 0x140001260
jmp 0x14000132a
movdqa xmm2, xmmword [0x1400048e0]
mov ecx, 8
mov r8d, ecx
nop word [rax + rax]
lea eax, [rcx - 8]
movd xmm0, eax
lea r8, [r8 + 0x10]
pshufd xmm0, xmm0, 0
lea eax, [rcx - 4]
paddd xmm0, xmm3
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea eax, [rcx + 4]
paddd xmm1, xmm3
andps xmm0, xmm2
andps xmm1, xmm2
packuswb xmm0, xmm0
packuswb xmm1, xmm1
packuswb xmm0, xmm0
movd dword [rdx + r8 - 0x18], xmm0
packuswb xmm1, xmm1
movd dword [rdx + r8 - 0x14], xmm1
movd xmm0, ecx
add ecx, 0x10
pshufd xmm0, xmm0, 0
paddd xmm0, xmm3
movd xmm1, eax
pshufd xmm1, xmm1, 0
andps xmm0, xmm2
paddd xmm1, xmm3
packuswb xmm0, xmm0
andps xmm1, xmm2
packuswb xmm0, xmm0
movd dword [rdx + r8 - 0x10], xmm0
lea eax, [rcx - 8]
packuswb xmm1, xmm1
packuswb xmm1, xmm1
movd dword [rdx + r8 - 0xc], xmm1
cmp eax, 0x100
jl 0x140001290
mov ecx, ebp
mov r9d, ebp
mov r10, rbp
cmp qword [rsi + 0x18], 0xf
mov r8, rsi
mov r11, qword [rdi]
jbe 0x140001342
mov r8, qword [rsi]
movzx ebx, byte [r11 + r10]
mov eax, r9d
cdq
idiv r14d
movsxd rax, edx
movsx edx, byte [rax + r8]
add ecx, edx
add ecx, ebx
and ecx, 0x800000ff
jge 0x14000136c
dec ecx
or ecx, 0xffffff00
inc ecx
movsxd rdx, ecx
inc r9d
movzx eax, byte [rdx + r11]
mov byte [r11 + r10], al
inc r10
mov byte [rdx + r11], bl
cmp r9d, 0x100
jl 0x140001332
mov rbx, qword [rsp + 0x50]
mov qword [rdi + 0x18], rbp
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400031d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000321a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000321a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000321a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000321a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000321a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000321c
xor al, al
add rsp, 0x28
ret
Function at 0x140001498
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [rcx + 4], 0
mov r8, rcx
jne 0x1400014df
xor r9d, r9d
mov r10d, r9d
mov r11d, 8
mov edx, r10d
mov ecx, r10d
shr edx, 1
mov eax, edx
mov r10d, edx
xor eax, 0xedb88320
and cl, 1
cmovne r10d, eax
sub r11, 1
jne 0x1400014ad
inc r9d
mov dword [r8], r10d
add r8, 4
cmp r9d, 0x100
jb 0x1400014a4
repz ret

Function at 0x140001558
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10, r8
mov rbx, rdx
mov r11d, ecx
lea rsi, [0x140024700]
test r8, r8
je 0x1400015a1
test bl, 7
je 0x1400015a1
movzx ecx, byte [rbx]
movzx eax, r11b
inc rbx
xor rcx, rax
mov eax, r11d
mov r11d, dword [rsi + rcx*4]
shr eax, 8
xor r11d, eax
sub r10, 1
jne 0x14000157c
cmp r10, 8
jb 0x14000164e
mov rdi, r10
shr rdi, 3
mov rax, rdi
imul rax, rax, 0xfffffffffffffff8
add r10, rax
xor r11d, dword [rbx]
mov r9d, dword [rbx + 4]
add rbx, 8
mov eax, r9d
shr eax, 0x10
movzx edx, al
mov eax, r9d
mov r8d, dword [rsi + rdx*4 + 0x400]
shr eax, 0x18
movzx ecx, al
mov eax, r9d
xor r8d, dword [rsi + rcx*4]
shr eax, 8
movzx ecx, al
mov eax, r11d
xor r8d, dword [rsi + rcx*4 + 0x800]
shr eax, 0x18
movzx ecx, al
mov eax, r11d
xor r8d, dword [rsi + rcx*4 + 0x1000]
shr eax, 0x10
movzx ecx, al
mov eax, r11d
xor r8d, dword [rsi + rcx*4 + 0x1400]
shr eax, 8
movzx ecx, al
movzx eax, r9b
xor r8d, dword [rsi + rcx*4 + 0x1800]
xor r8d, dword [rsi + rax*4 + 0xc00]
movzx eax, r11b
mov r11d, r8d
xor r11d, dword [rsi + rax*4 + 0x1c00]
sub rdi, 1
jne 0x1400015bc
test r10, r10
je 0x140001673
movzx ecx, byte [rbx]
movzx eax, r11b
inc rbx
xor rcx, rax
mov eax, r11d
mov r11d, dword [rsi + rcx*4]
shr eax, 8
xor r11d, eax
sub r10, 1
jne 0x140001653
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov eax, r11d
ret

Function at 0x14000173c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.14001af20
sub rsp, rax
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x1400017b7
mov rcx, rdi
call fcn.14001020c
mov rcx, rdi
mov rbx, rax
call fcn.140007684
test al, al
jne 0x140001793
lea rdx, [rsp + 0x20]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x20]
call fcn.14001020c
lea rbx, [rbx + rax + 1]
mov edi, 0x104
cmp rbx, rdi
jbe 0x1400017b7
lea ecx, [rdi - 0x41]
call fcn.14000991c
lea rcx, [0x14001c768]
mov r8d, edi
mov rdx, rax
call fcn.14000b5f4
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x140001a68
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x78
mov rsi, r8
mov rbx, rdx
call fcn.14000991c
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call fcn.14000b5f4
mov rdx, rsi
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14000173c
Function at 0x140003ca4
Capabilities:
Write file on windows

Disassembly:
test r8, r8
je 0x140003ddc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r13
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
jne 0x140003cdd
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rdi + 8], rax
mov r13d, 0x4000
and dword [rsp + 0x60], 0
cmp dword [rdi + 0x14], 0
je 0x140003d36
xor ebx, ebx
test rsi, rsi
je 0x140003d5b
mov eax, esi
mov r8d, r13d
mov rcx, rsi
sub rcx, rbx
sub eax, ebx
lea rdx, [rbx + rbp]
cmp rcx, r13
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x60]
cmovb r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x140003d5b
add rbx, r13
cmp rbx, rsi
jb 0x140003cf5
jmp 0x140003d57
mov rcx, qword [rdi + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x140003dc6
cmp byte [rdi + 0x1c], 0
je 0x140003dc6
cmp dword [rdi + 0x14], 0
jne 0x140003dc6
lea rdx, [rdi + 0x26]
lea rcx, [0x140045dd0]
xor r8d, r8d
call fcn.1400018fc
test al, al
je 0x140003db4
mov ecx, dword [rsp + 0x60]
cmp rcx, rsi
jae 0x140003ce3
test ecx, ecx
je 0x140003ce3
mov rbx, qword [rdi]
mov rcx, rdi
call qword [rbx + 0x18]
mov ecx, dword [rsp + 0x60]
xor r8d, r8d
sub rax, rcx
mov rcx, rdi
mov rdx, rax
call qword [rbx + 0x10]
jmp 0x140003ce3
lea r8, [rdi + 0x26]
lea rcx, [0x140045dd0]
xor edx, edx
call fcn.140001b24
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov byte [rdi + 0x10], 1
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret

Function at 0x140003e6c
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x140003f00
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov ebp, 0x4e20
jne 0x140003f3e
cmp r8, rbp
mov ecx, 0xfffffff6
cmova rdi, rbp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140003fb3
mov rcx, rbx
call fcn.140003e88
test al, al
je 0x140003f7e
cmp rdi, rbp
jbe 0x140003f7e
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.140003f00
jmp 0x140003fb7
cmp dword [rbx + 0x14], 1
jne 0x140003f93
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x140003f93
xor eax, eax
jmp 0x140003fb7
cmp dword [rbx + 0x14], 0
jne 0x140003fae
mov ebp, 0x8000
cmp rdi, rbp
jbe 0x140003fae
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x140003f6e
or eax, 0xffffffff
jmp 0x140003fb7
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140004324
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.14001af20
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000436b
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rdi
call fcn.140007794
test al, al
je 0x14000436b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x140004380
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1020
call fcn.14001af20
sub rsp, rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x1400043d5
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rsi
call fcn.140007794
test al, al
je 0x1400043d5
lea rcx, [rsp + 0x20]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
lea r11, [rsp + 0x1020]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400043ec
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.14001af20
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x140004438
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rdi
call fcn.140007794
test al, al
je 0x140004438
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x140004630
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1020
call fcn.14001af20
sub rsp, rax
mov dil, dl
xor edx, edx
mov esi, r8d
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400046b0
mov rcx, rbx
call fcn.140004324
cmp eax, 0xffffffff
jne 0x140004692
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rbx
call fcn.140007794
test al, al
je 0x140004692
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400046b0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x1400046a9
cmp eax, 3
je 0x1400046a9
mov eax, 1
jmp 0x1400046c1
mov eax, 2
jmp 0x1400046c1
test dil, dil
je 0x1400046bf
mov edx, esi
mov rcx, rbx
call fcn.140004380
xor eax, eax
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140004b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp dword [0x140037aa0], 0
je 0x140004b9b
or eax, 0xffffffff
jmp 0x140004c6d
mov rax, qword [0x140026750]
test rax, rax
jg 0x140004bbb
dec rax
mov qword [0x140026750], rax
and qword [0x1400379a0], 0
jmp 0x140004b93
mov rbx, qword [0x1400379a0]
test rbx, rbx
jg 0x140004c17
mov rcx, qword [0x140037990]
mov ebx, 0x2000
mov edx, ebx
call fcn.14000491c
movsxd rcx, eax
mov qword [0x1400379a0], rcx
test eax, eax
je 0x140004c78
cmp rcx, 0xffffffffffffffff
je 0x140004c82
mov rax, qword [0x140037990]
add qword [0x1400379e0], rbx
mov qword [0x140037998], rax
call fcn.1400048bc
mov rbx, qword [0x1400379a0]
mov rax, qword [0x140027978]
mov rdi, qword [0x140037998]
test byte [rax + 0x40], 1
je 0x140004c56
test rbx, rbx
je 0x140004c56
call fcn.14000e178
xor byte [rdi], al
movzx ecx, byte [rdi]
call fcn.14000e198
inc rdi
sub rbx, 1
jne 0x140004c30
mov rbx, qword [0x1400379a0]
mov rdi, qword [0x140037998]
dec rbx
mov qword [0x1400379a0], rbx
movzx eax, byte [rdi]
inc rdi
mov qword [0x140037998], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp rcx, 0xffffffffffffffff
jne 0x140004bb1
lea rdx, [0x14004e0ea]
lea rcx, [0x140045dd0]
call fcn.140001b64
jmp 0x140004bb1