joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140220510
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rbp, rcx
xor r8d, r8d
lea edx, [r8 + 0xc]
lea rcx, [rsp + 0x28]
call fcn.140225250
nop
lea rcx, [rbp + 0xe0]
xor r9d, r9d
lea r8d, [r9 + 0xc]
mov rdx, qword [rsp + 0x30]
call fcn.140226650
xor r14d, r14d
nop dword [rax]
nop word [rax + rax]
mov eax, dword [rbp + 0x2e0]
and eax, 0xfffd
or eax, 2
mov ebx, eax
xor ebx, 1
imul ebx, eax
sar ebx, 8
mov rax, qword [rsp + 0x30]
xor bl, byte [r14 + rax]
mov edi, dword [rbp + 0x2d8]
call fcn.14022afb0
movsx edx, bl
mov ecx, edi
xor rdx, rcx
movzx ecx, dl
shr edi, 8
mov eax, dword [rax + rcx*4]
xor eax, edi
mov dword [rbp + 0x2d8], eax
movzx eax, al
add eax, dword [rbp + 0x2dc]
imul edi, eax, 0x8088405
inc edi
mov dword [rbp + 0x2dc], edi
shr edi, 0x18
mov esi, dword [rbp + 0x2e0]
call fcn.14022afb0
movsx edx, dil
mov ecx, esi
xor rdx, rcx
movzx ecx, dl
shr esi, 8
mov eax, dword [rax + rcx*4]
xor eax, esi
mov dword [rbp + 0x2e0], eax
inc r14
cmp r14, 0xc
jl 0x140220570
mov rcx, qword [rbp + 0x1c0]
movzx eax, byte [rcx + 0x10]
shr al, 3
test al, 1
je 0x140220619
cmp byte [rcx + 0x15], bl
jmp 0x14022061c
cmp byte [rcx + 0x1b], bl
sete bl
lea rcx, [rsp + 0x28]
call fcn.1402252a0
movzx eax, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140220650
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13, r8
mov r12d, edx
mov rbx, rcx
call fcn.140220900
xor ecx, ecx
call fcn.1401fd1c4
mov rcx, rax
call fcn.1401fe84c
xor r15d, r15d
nop dword [rax]
call fcn.1401fe820
mov ebp, dword [rbx + 0x2e0]
mov edi, dword [rbx + 0x2d8]
mov ecx, eax
movzx eax, al
sar ecx, 6
movzx r14d, cl
test cl, cl
cmove r14d, eax
and ebp, 0xfffd
or ebp, 2
call fcn.14022afb0
mov esi, dword [rbx + 0x2e0]
mov ecx, edi
shr edi, 8
movsx edx, r14b
xor rdx, rcx
movzx ecx, dl
mov eax, dword [rax + rcx*4]
xor eax, edi
mov dword [rbx + 0x2d8], eax
movzx eax, al
add eax, dword [rbx + 0x2dc]
imul edi, eax, 0x8088405
inc edi
mov dword [rbx + 0x2dc], edi
shr edi, 0x18
call fcn.14022afb0
mov ecx, esi
shr esi, 8
movsx edx, dil
xor rdx, rcx
inc r15
movzx ecx, dl
mov eax, dword [rax + rcx*4]
mov ecx, ebp
xor ecx, 1
xor eax, esi
mov dword [rbx + 0x2e0], eax
mov rax, qword [r13 + 8]
imul ecx, ebp
sar ecx, 8
xor cl, r14b
mov byte [r15 + rax - 1], cl
cmp r15, 0xa
jl 0x140220690
mov ebp, dword [rbx + 0x2e0]
mov edi, dword [rbx + 0x2d8]
mov r14d, r12d
and ebp, 0xfffd
sar r14d, 0x10
or ebp, 2
call fcn.14022afb0
mov esi, dword [rbx + 0x2e0]
mov ecx, edi
shr edi, 8
movsx edx, r14b
xor rdx, rcx
movzx ecx, dl
mov eax, dword [rax + rcx*4]
xor eax, edi
mov dword [rbx + 0x2d8], eax
movzx eax, al
add eax, dword [rbx + 0x2dc]
imul edi, eax, 0x8088405
inc edi
mov dword [rbx + 0x2dc], edi
shr edi, 0x18
call fcn.14022afb0
mov ecx, esi
movsx edx, dil
shr esi, 8
xor rdx, rcx
sar r12d, 0x18
movzx ecx, dl
mov eax, dword [rax + rcx*4]
mov ecx, ebp
xor ecx, 1
xor eax, esi
mov dword [rbx + 0x2e0], eax
mov rax, qword [r13 + 8]
imul ecx, ebp
sar ecx, 8
xor cl, r14b
mov byte [rax + 0xa], cl
mov ebp, dword [rbx + 0x2e0]
mov edi, dword [rbx + 0x2d8]
and ebp, 0xfffd
or ebp, 2
call fcn.14022afb0
mov esi, dword [rbx + 0x2e0]
mov ecx, edi
shr edi, 8
movsx edx, r12b
xor rdx, rcx
movzx ecx, dl
mov eax, dword [rax + rcx*4]
xor eax, edi
mov dword [rbx + 0x2d8], eax
movzx eax, al
add eax, dword [rbx + 0x2dc]
imul edi, eax, 0x8088405
inc edi
mov dword [rbx + 0x2dc], edi
shr edi, 0x18
call fcn.14022afb0
mov ecx, esi
shr esi, 8
movsx edx, dil
xor rdx, rcx
movzx ecx, dl
mov eax, dword [rax + rcx*4]
mov ecx, ebp
xor eax, esi
mov rsi, qword [rsp + 0x60]
xor ecx, 1
mov dword [rbx + 0x2e0], eax
mov rax, qword [r13 + 8]
mov rbx, qword [rsp + 0x50]
imul ecx, ebp
mov rbp, qword [rsp + 0x58]
sar ecx, 8
xor cl, r12b
mov byte [rax + 0xb], cl
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140220880
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1c0]
mov rbx, rcx
test byte [rax + 0x10], 1
je 0x1402208f9
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rcx + 0xbc], ebp
jbe 0x1402208f4
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
nop
mov edi, dword [rbx + 0x2e0]
mov esi, ebp
mov rcx, rbx
add rsi, qword [rbx + 0xd0]
and edi, 0xfffd
movzx edx, byte [rsi]
or edi, 2
call fcn.1402209d0
mov eax, edi
inc ebp
xor eax, 1
imul eax, edi
sar eax, 8
xor byte [rsi], al
cmp ebp, dword [rbx + 0xbc]
jb 0x1402208b0
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x140220900
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
mov dword [rcx + 0x2d8], 0x12345678
mov dword [rcx + 0x2dc], 0x23456789
mov dword [rcx + 0x2e0], 0x34567890
cmp dword [rcx + 0x2d0], ebp
jbe 0x1402209c5
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
mov rax, qword [rbx + 0x2c8]
mov esi, dword [rbx + 0x2d8]
movsx edi, byte [rbp + rax]
call fcn.14022afb0
mov edx, edi
mov ecx, esi
shr esi, 8
xor rdx, rcx
movzx ecx, dl
mov eax, dword [rax + rcx*4]
xor eax, esi
mov esi, dword [rbx + 0x2e0]
mov dword [rbx + 0x2d8], eax
movzx eax, al
add eax, dword [rbx + 0x2dc]
imul edi, eax, 0x8088405
inc edi
mov dword [rbx + 0x2dc], edi
shr edi, 0x18
call fcn.14022afb0
mov ecx, esi
shr esi, 8
movsx edx, dil
xor rdx, rcx
inc ebp
movzx ecx, dl
mov eax, dword [rax + rcx*4]
xor eax, esi
mov dword [rbx + 0x2e0], eax
cmp ebp, dword [rbx + 0x2d0]
jb 0x140220943
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret

Function at 0x1402209d0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, dword [rcx + 0x2d8]
movsx ebx, dl
mov rsi, rcx
call fcn.14022afb0
mov r8d, ebx
mov edx, edi
xor r8, rdx
shr edi, 8
movzx edx, r8b
mov eax, dword [rax + rdx*4]
xor eax, edi
mov edi, dword [rsi + 0x2e0]
mov dword [rsi + 0x2d8], eax
movzx eax, al
add eax, dword [rsi + 0x2dc]
imul ebx, eax, 0x8088405
inc ebx
mov dword [rsi + 0x2dc], ebx
shr ebx, 0x18
call fcn.14022afb0
mov ecx, edi
movsx edx, bl
mov rbx, qword [rsp + 0x30]
xor rdx, rcx
shr edi, 8
movzx ecx, dl
mov eax, dword [rax + rcx*4]
xor eax, edi
mov dword [rsi + 0x2e0], eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140222610
Capabilities:
Get file size

Disassembly:
add rcx, 8
jmp method.CFile.virtual_104

Function at 0x14022261c
Capabilities:
Get file size

Disassembly:
sub rcx, 8
jmp method.CZipFile.virtual_40

Function at 0x140223a10
Capabilities:
Read file on windows

Disassembly:
add rcx, 8
jmp method.CFile.virtual_112

Function at 0x140223a1c
Capabilities:
Read file on windows

Disassembly:
sub rcx, 8
jmp method.CZipFile.virtual_80
Function at 0x140223a30
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [rcx + 0x260], 0xff
mov rbx, rcx
je 0x140223a4a
xor eax, eax
add rsp, 0x30
pop rbx
ret
test rdx, rdx
je 0x140223a42
test r8d, r8d
je 0x140223a42
mov eax, dword [rcx + 0xb8]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
cmp r8d, eax
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x20], r15
cmova r8d, eax
xor r15d, r15d
mov qword [rcx + 0x70], rdx
mov dword [rcx + 0x78], r8d
test r8d, r8d
jne 0x140223a93
cmp dword [rcx + 0xbc], r15d
jbe 0x140223a93
mov r12b, 1
jmp 0x140223a96
xor r12b, r12b
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x28], r14
cmp dword [rbx + 0x78], 0
ja 0x140223abc
test r12b, r12b
je 0x140223c10
cmp dword [rbx + 0xbc], 0
jbe 0x140223c10
cmp dword [rbx + 0x68], 0
jne 0x140223b5d
mov edi, dword [rbx + 0xd8]
mov eax, dword [rbx + 0xbc]
cmp eax, edi
cmovb edi, eax
test edi, edi
jne 0x140223ae2
mov edi, 1
jmp 0x140223b49
mov rdx, qword [rbx + 0xd0]
lea rcx, [rbx + 0xe0]
xor r9d, r9d
mov r8d, edi
call fcn.140226650
mov rax, qword [rbx + 0x1c0]
test byte [rax + 0x10], 1
je 0x140223b49
test edi, edi
je 0x140223b49
xor esi, esi
mov ebp, edi
mov ecx, dword [rbx + 0x2e0]
mov rdx, qword [rbx + 0xd0]
and ecx, 0xfffd
or ecx, 2
mov eax, ecx
xor eax, 1
imul eax, ecx
mov rcx, rbx
sar eax, 8
xor byte [rdx + rsi], al
movzx edx, byte [rdx + rsi]
call fcn.1402209d0
lea rsi, [rsi + 1]
dec rbp
jne 0x140223b10
mov rax, qword [rbx + 0xd0]
sub dword [rbx + 0xbc], edi
mov dword [rbx + 0x68], edi
mov qword [rbx + 0x60], rax
mov rax, qword [rbx + 0x1c0]
cmp word [rax + 0x12], 0
jne 0x140223bbe
mov esi, dword [rbx + 0x68]
mov rdx, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x70]
cmp dword [rbx + 0x78], esi
cmovb esi, dword [rbx + 0x78]
mov r8d, esi
mov edi, esi
call fcn.1401f96d0
mov rdx, qword [rbx + 0x70]
mov ecx, dword [rbx + 0xc0]
mov r8d, esi
call fcn.14022aca0
sub dword [rbx + 0xb8], esi
sub dword [rbx + 0x68], esi
sub dword [rbx + 0x78], esi
add qword [rbx + 0x70], rdi
add qword [rbx + 0x60], rdi
add dword [rbx + 0x7c], esi
mov dword [rbx + 0xc0], eax
add r15d, esi
jmp 0x140223aa0
mov edi, dword [rbx + 0x7c]
mov rsi, qword [rbx + 0x70]
lea rcx, [rbx + 0x60]
mov edx, 2
call fcn.1402295b0
mov ebp, dword [rbx + 0x7c]
mov ecx, dword [rbx + 0xc0]
sub ebp, edi
mov rdx, rsi
mov r14d, eax
mov r8d, ebp
call fcn.14022aca0
sub dword [rbx + 0xb8], ebp
add r15d, ebp
mov dword [rbx + 0xc0], eax
cmp r14d, 1
je 0x140223c10
test r14d, 0xfffffffd
je 0x140223aa0
jmp 0x140223c37
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov eax, r15d
mov r15, qword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret
mov r8b, 1
mov edx, r14d
mov rcx, rbx
call fcn.140224b50
int3

Function at 0x140224650
Capabilities:
Clear file content

Disassembly:
add rcx, 8
jmp method.CFile.virtual_96

Function at 0x14022465c
Capabilities:
Clear file content

Disassembly:
sub rcx, 8
jmp method.CZipFile.virtual_48

Function at 0x140224f30
Capabilities:
Write file on windows

Disassembly:
add rcx, 8
jmp fcn.14009e80c
Function at 0x140224f3c
Capabilities:
Write file on windows

Disassembly:
sub rcx, 8
jmp method.CZipFile.virtual_88

Function at 0x140224f50
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
push rbx
sub rsp, 0x40
cmp byte [rcx + 0x260], 1
mov rbx, rcx
je 0x140224f6a
xor al, al
add rsp, 0x40
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rdi
mov rdi, qword [rcx + 0x1c0]
mov qword [rsp + 0x38], r12
mov qword [rcx + 0x60], rdx
mov dword [rcx + 0x68], r8d
mov ecx, dword [rdi + 0x18]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.14022aca0
mov dword [rdi + 0x18], eax
cmp dword [rbx + 0x68], 0
jbe 0x140225126
xor r13d, r13d
cmp dword [rbx + 0x78], r13d
jne 0x1402250b5
mov rax, qword [rbx + 0x1c0]
test byte [rax + 0x10], 1
je 0x14022507d
mov r12d, r13d
cmp dword [rbx + 0xbc], r13d
jbe 0x14022507d
nop
mov ebp, dword [rbx + 0x2e0]
mov esi, dword [rbx + 0x2d8]
mov r14d, r12d
add r14, qword [rbx + 0xd0]
and ebp, 0xfffd
movsx edi, byte [r14]
or ebp, 2
call fcn.14022afb0
mov edx, edi
mov ecx, esi
shr esi, 8
xor rdx, rcx
movzx ecx, dl
mov eax, dword [rax + rcx*4]
xor eax, esi
mov esi, dword [rbx + 0x2e0]
mov dword [rbx + 0x2d8], eax
movzx eax, al
add eax, dword [rbx + 0x2dc]
imul edi, eax, 0x8088405
inc edi
mov dword [rbx + 0x2dc], edi
shr edi, 0x18
call fcn.14022afb0
mov ecx, esi
shr esi, 8
movsx edx, dil
xor rdx, rcx
inc r12d
movzx ecx, dl
mov eax, dword [rax + rcx*4]
xor eax, esi
mov dword [rbx + 0x2e0], eax
mov eax, ebp
xor eax, 1
imul eax, ebp
sar eax, 8
xor byte [r14], al
cmp r12d, dword [rbx + 0xbc]
jb 0x140224fe0
mov r8d, dword [rbx + 0xbc]
mov rdx, qword [rbx + 0xd0]
lea rcx, [rbx + 0xe0]
xor r9d, r9d
call fcn.140226aa0
mov eax, dword [rbx + 0xd8]
mov dword [rbx + 0xbc], r13d
mov dword [rbx + 0x78], eax
mov rax, qword [rbx + 0xd0]
mov qword [rbx + 0x70], rax
mov rax, qword [rbx + 0x1c0]
cmp word [rax + 0x12], 8
jne 0x1402250e5
mov edi, dword [rbx + 0x7c]
lea rcx, [rbx + 0x60]
xor edx, edx
call fcn.140228720
test eax, 0xfffffffd
jne 0x140225151
mov eax, dword [rbx + 0x7c]
sub eax, edi
add dword [rbx + 0xbc], eax
jmp 0x14022511c
mov eax, dword [rbx + 0x68]
mov esi, dword [rbx + 0x78]
mov rdx, qword [rbx + 0x60]
mov rcx, qword [rbx + 0x70]
cmp eax, esi
cmovb esi, eax
mov r8d, esi
mov edi, esi
call fcn.1401f96d0
sub dword [rbx + 0x68], esi
sub dword [rbx + 0x78], esi
add qword [rbx + 0x60], rdi
add qword [rbx + 0x70], rdi
add dword [rbx + 0x6c], esi
add dword [rbx + 0x7c], esi
add dword [rbx + 0xbc], esi
cmp dword [rbx + 0x68], r13d
ja 0x140224fb4
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x20]
mov al, 1
add rsp, 0x40
pop rbx
ret
mov r8b, 1
mov edx, eax
mov rcx, rbx
call fcn.140224b50
int3

Function at 0x140226e80
Capabilities:
Create directory

Disassembly:
sub rsp, 0x28
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x140226ee0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, rcx
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test eax, eax
jne 0x140226f0a
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rbx
mov eax, 2
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rdi
mul rsi
cmovo rax, rbx
mov rcx, rax
call fcn.14006dfa0
mov ecx, esi
mov bpl, 1
mov rdx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
jne 0x140226f4e
xor bpl, bpl
jmp 0x140226f78
test rdi, rdi
jne 0x140226f60
xor ebx, ebx
jmp 0x140226f6a
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x140226f60
mov r8d, ebx
mov rdx, rdi
mov rcx, r14
call fcn.14003ef00
mov rcx, rdi
call fcn.14006dfa8
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x48]
movzx eax, bpl
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop r14
ret
Function at 0x140226fc0
Capabilities:
Get disk size

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.14021e580
nop
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x48]
call fcn.1402271c0
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0xb8]
mov rbx, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x140227149
mov rsi, rbx
xor ebp, ebp
mov edi, ebp
lea r14d, [rax + 1]
cmp word [rbx], di
je 0x1402270c1
movzx edx, word [rsi]
lea rcx, [0x140269ae8]
call fcn.1401fefb8
test rax, rax
je 0x14022705f
test rdi, rdi
jne 0x140227062
mov rdi, rsi
jmp 0x140227062
mov rdi, rbp
add rsi, 2
cmp word [rsi], bp
jne 0x140227041
test rdi, rdi
je 0x1402270c1
sub rdi, rbx
sar rdi, 1
test edi, edi
jns 0x140227085
mov ecx, 0x80070057
call fcn.140024c70
int3
mov ecx, r14d
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x1402270a5
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.14003b770
mov rbx, qword [rsp + 0x38]
cmp edi, dword [rbx - 0xc]
jg 0x1402270b6
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], bp
jmp 0x1402270c1
mov ecx, 0x80070057
call fcn.140024c70
int3
mov esi, dword [rbx - 0x10]
lea edi, [rsi + 1]
test edi, edi
jns 0x1402270d6
mov ecx, 0x80070057
call fcn.140024c70
int3
sub r14d, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, r14d
jge 0x1402270f5
mov edx, edi
lea rcx, [rsp + 0x38]
call fcn.14003b770
mov rbx, qword [rsp + 0x38]
mov ecx, 0x5c
mov word [rbx + rsi*2], cx
cmp edi, dword [rbx - 0xc]
jg 0x14022713e
mov dword [rbx - 0x10], edi
movsxd rax, edi
mov word [rbx + rax*2], bp
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0xc8]
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0xb8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
jne 0x140227149
jmp 0x140227160
mov ecx, 0x80070057
call fcn.140024c70
int3
mov ebp, dword [rsp + 0xb8]
imul ebp, dword [rsp + 0xc0]
imul ebp, dword [rsp + 0xc8]
lea rdx, [rbx - 0x18]
lock add dword [rdx + 0x10], 0xffffffff
jg 0x140227176
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0x48]
call fcn.14022e9b0
mov eax, ebp
add rsp, 0x80
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x140227190
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x1402271ac
xor al, al
add rsp, 0x20
pop rbx
ret
mov dword [rbx], eax
mov al, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140227250
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor eax, eax
mov rsi, rdx
xor r9d, r9d
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], eax
lea r8d, [rax + 1]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
test rax, rax
jne 0x140227295
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp ebx, 0xffffffff
jne 0x1402272c7
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rsi], ebx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov al, 1
add rsp, 0x40
pop rdi
ret
Function at 0x1402275a0
Capabilities:
Get disk information

Disassembly:
push rbx
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.14021e580
nop
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x28]
call fcn.1402271c0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
sete bl
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
lock add dword [rdx + 0x10], 0xffffffff
jg 0x1402275f6
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
nop
lea rcx, [rsp + 0x28]
call fcn.14022e9b0
movzx eax, bl
add rsp, 0x60
pop rbx
ret

Function at 0x140227610
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edi, dl
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14022763a
test dil, dil
jne 0x140227647
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov ecx, WSAStartup
call fcn.140224af0
int3

Function at 0x140227660
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edi, r8b
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x14022768b
test dil, dil
jne 0x140227698
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
mov ecx, reloc.OLEAUT32.dll_VarBstrFromDisp
call fcn.140224af0
int3

Function at 0x1402276b0
Capabilities:
Set file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x1402290b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebx, dword [rcx + 0x38]
mov rdi, rcx
mov qword [rsp + 0x30], rbp
nop word [rax + rax]
mov edx, dword [rdi + 0x8c]
mov esi, dword [rdi + 0x50]
mov ecx, dword [rdi + 0x38]
sub esi, dword [rdi + 0x94]
add ecx, 0xfffffefa
add ecx, ebx
sub esi, edx
cmp edx, ecx
jb 0x14022915f
mov rcx, qword [rdi + 0x48]
mov r8, rbx
lea rdx, [rcx + rbx]
call fcn.1401f96d0
mov r8d, dword [rdi + 0x6c]
mov rax, qword [rdi + 0x60]
sub dword [rdi + 0x90], ebx
sub dword [rdi + 0x8c], ebx
sub dword [rdi + 0x7c], ebx
lea rdx, [rax + r8*2]
nop dword [rax + rax]
movzx eax, word [rdx - 2]
lea rdx, [rdx - 2]
cmp eax, ebx
jb 0x140229130
sub eax, ebx
jmp 0x140229132
xor eax, eax
mov word [rdx], ax
dec r8d
jne 0x140229120
mov rax, qword [rdi + 0x58]
mov edx, ebx
lea rcx, [rax + rbx*2]
movzx eax, word [rcx - 2]
lea rcx, [rcx - 2]
cmp eax, ebx
jb 0x140229154
sub eax, ebx
jmp 0x140229156
xor eax, eax
mov word [rcx], ax
dec edx
jne 0x140229144
add esi, ebx
mov rcx, qword [rdi]
cmp dword [rcx + 8], 0
je 0x1402291d6
mov edx, dword [rdi + 0x94]
mov eax, dword [rdi + 0x8c]
mov r8d, esi
add rdx, rax
add rdx, qword [rdi + 0x48]
call fcn.140229510
add dword [rdi + 0x94], eax
mov r9d, dword [rdi + 0x94]
cmp r9d, 3
jb 0x1402291c0
mov eax, dword [rdi + 0x8c]
mov rdx, qword [rdi + 0x48]
mov ecx, dword [rdi + 0x78]
movzx r8d, byte [rax + rdx]
mov dword [rdi + 0x68], r8d
shl r8d, cl
inc eax
movzx eax, byte [rax + rdx]
xor r8d, eax
and r8d, dword [rdi + 0x74]
mov dword [rdi + 0x68], r8d
cmp r9d, 0x106
jae 0x1402291d6
mov rax, qword [rdi]
cmp dword [rax + 8], 0
jne 0x1402290d0
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14022f280
Capabilities:
Compute adler32 checksum

Disassembly:
movzx r9d, cx
shr ecx, 0x10
mov r11d, r8d
mov r10, rdx
test rdx, rdx
jne 0x14022f296
lea eax, [rdx + 1]
ret
test r8d, r8d
je 0x14022f3d0
nop
mov edx, 0x15b0
cmp r11d, edx
cmovb edx, r11d
sub r11d, edx
cmp edx, 0x10
jl 0x14022f38c
mov r8d, edx
shr r8, 4
mov eax, r8d
neg eax
shl eax, 4
add edx, eax
nop dword [rax]
movzx eax, byte [r10]
add r10, 0x10
add r9d, eax
movzx eax, byte [r10 - 0xf]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xe]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xd]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xc]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xb]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 0xa]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 9]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 8]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 7]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 - 1]
add ecx, r9d
add r9d, eax
add ecx, r9d
dec r8
jne 0x14022f2d0
test edx, edx
je 0x14022f3a1
movzx eax, byte [r10]
inc r10
add r9d, eax
add ecx, r9d
dec edx
jne 0x14022f390
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
test r11d, r11d
jne 0x14022f2a0
shl ecx, 0x10
or ecx, r9d
mov eax, ecx
ret