joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001c150
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov eax, dword [rcx + 0x14]
mov edi, r8d
mov rbx, qword [rsp + 0x70]
add eax, edx
xor edx, edx
mov rsi, rcx
div dword [rcx + 4]
cmp byte [rbx + 0x1c], 0
mov r10d, edx
je 0x14001c219
movzx r8d, byte [rbx + 0x5a]
xor edx, edx
mov eax, dword [rsp + 0x80]
div r8d
mov qword [rsp + 0x50], rbp
cmp edi, eax
cmova edi, eax
mov rax, qword [rsp + 0x88]
mov dword [r9], edi
mov r9, rbx
movzx ecx, byte [rbx + 0x5a]
imul ecx, edi
mov dword [rax], ecx
movzx ecx, byte [rsi + 0x10]
mov rax, qword [rsi + 8]
mov ebp, dword [rsi + 4]
sub ebp, r10d
cmp ebp, edi
cmova ebp, edi
imul ecx, r10d
mov r8d, ebp
lea rdx, [rax + rcx*4]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rbx]
call qword [case.0x140035d81.0]
cmp edi, ebp
jbe 0x14001c204
movzx ecx, byte [rbx + 0x5a]
sub edi, ebp
mov rdx, qword [rsi + 8]
mov r9, rbx
mov rax, qword [rbx]
mov r8d, edi
imul ecx, ebp
add rcx, qword [rsp + 0x78]
call qword [case.0x140035d81.0]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
jmp 0x14001eff0
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1070
call fcn.140001130
sub rsp, rax
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r15, qword [rsp + 0x10e8]
xor eax, eax
mov rdi, qword [rsp + 0x10d0]
mov r14, r9
mov r12, qword [rsp + 0x10d8]
mov ebp, r8d
mov dword [r9], eax
mov ebx, edx
mov dword [r15], eax
mov r13, rcx
test r8d, r8d
je 0x14001f124
mov qword [rsp + 0x1068], rsi
mov esi, dword [rsp + 0x10e0]
nop
movzx ecx, byte [rdi + 0x5a]
cmp esi, ecx
jb 0x14001f11c
mov r9d, dword [r13 + 4]
lea r10, [rdi + 8]
sub r9d, ebx
mov qword [rsp + 0x28], r10
cmp r9d, ebp
mov eax, esi
cmova r9d, ebp
xor edx, edx
div ecx
movzx ecx, byte [rdi + 0x58]
xor edx, edx
mov r11d, eax
mov eax, 0x400
div rcx
movzx edx, byte [r13 + 0x10]
mov rcx, qword [r13 + 8]
imul edx, ebx
cmp rax, r11
mov dword [rsp + 0x40], r9d
cmova eax, r11d
lea r8, [rcx + rdx*4]
mov edx, eax
mov rax, qword [rdi + 0x50]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x50]
call qword [case.0x140035d81.0]
mov ecx, dword [rsp + 0x40]
xor edx, edx
add dword [r14], ecx
mov r8d, eax
sub ebp, ecx
mov r9, rdi
lea eax, [rbx + rcx]
movzx ebx, byte [rdi + 0x5a]
div dword [r13 + 4]
mov rax, qword [rdi]
mov rcx, r12
mov dword [rsp + 0x44], edx
lea rdx, [rsp + 0x50]
imul ebx, r8d
call qword [case.0x140035d81.0]
add dword [r15], ebx
sub esi, ebx
mov eax, ebx
mov ebx, dword [rsp + 0x44]
add r12, rax
test ebp, ebp
jne 0x14001f060
mov rsi, qword [rsp + 0x1068]
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.140001270
add rsp, 0x1070
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1400365a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rcx + 0x10], 2
mov r11, rcx
mov r8, qword [rdx]
movabs rax, 0x112e0be826d694b3
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
lea r9, [rdx - 1]
sub r8d, eax
cmovns r9, rdx
test r8d, r8d
lea eax, [r8 + 0x3b9aca00]
cmovns eax, r8d
mov dword [rcx + 0xc], eax
movabs rax, 0x8888888888888889
imul r9
add rdx, r9
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3c
lea r8d, [rdx - 1]
sub r9d, eax
lea eax, [r9 + 0x3c]
movzx ecx, al
movzx eax, r9b
cmovns ecx, eax
test r9d, r9d
mov byte [r11 + 0xb], cl
mov eax, 0x88888889
cmovns r8d, edx
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
lea r9d, [rdx - 1]
sub r8d, eax
cmovns r9d, edx
test r8d, r8d
lea eax, [r8 + 0x3c]
movzx ecx, al
movzx eax, r8b
cmovns ecx, eax
mov eax, 0x2aaaaaab
imul r9d
mov byte [r11 + 0xa], cl
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [rdx - 1]
shl eax, 3
sub r9d, eax
cmovns ecx, edx
test r9d, r9d
lea eax, [r9 + 0x18]
movzx edx, al
movzx eax, r9b
cmovns edx, eax
mov eax, 0x92492493
mov byte [r11 + 9], dl
imul ecx
mov eax, 0x92492493
add edx, ecx
sar edx, 2
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
mov r8d, ecx
imul edx, edx, 7
sub r8d, edx
add r8d, 0xa
imul r8d
add edx, r8d
lea r10, [0x1400b2cf0]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub r8d, eax
mov eax, 0xb38cf9b1
mov byte [r11 + 5], r8b
imul ecx
add edx, ecx
sar edx, 8
mov r8d, edx
add edx, 0x12c
shr r8d, 0x1f
add r8d, edx
lea edx, [r8 + 1]
cmp dword [r10 + rdx*4], ecx
jg 0x14003671c
nop dword [rax + rax]
inc r8d
lea edx, [rdx + 1]
cmp dword [r10 + rdx*4], ecx
jle 0x140036710
cmp dword [r10 + r8*4], ecx
jle 0x14003672b
dec r8d
cmp dword [r10 + r8*4], ecx
jg 0x140036722
sub ecx, dword [r10 + r8*4]
lea r9d, [r8 + 0x686]
mov dword [r11], r9d
lea eax, [rcx + 1]
mov word [r11 + 6], ax
mov eax, r9d
and eax, 0x80000003
jge 0x140036752
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140036795
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul r8d, edx, 0x64
cmp r9d, r8d
jne 0x140036791
mov eax, 0x51eb851f
imul r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x190
cmp r9d, eax
jne 0x140036795
mov al, 1
jmp 0x140036797
xor al, al
test al, al
lea rdx, [0x1400b2cb0]
movzx eax, al
lea r10, [0x1400b2cd0]
cmove r10, rdx
xor eax, 1
inc eax
shl eax, 6
or eax, 2
mov dword [r11 + 0x10], eax
mov eax, ecx
cdq
inc ecx
and edx, 0x1f
add eax, edx
sar eax, 5
movsxd r9, eax
movzx r8d, word [r10 + r9*2 + 2]
cmp r8d, ecx
jg 0x1400367f1
nop dword [rax + rax]
movsxd rdx, r9d
inc r9d
movzx r8d, word [r10 + rdx*2 + 4]
cmp r8d, ecx
jle 0x1400367e0
lea eax, [r9 + 1]
mov byte [r11 + 4], al
movsxd rax, r9d
sub cl, byte [r10 + rax*2]
mov rax, r11
inc cl
mov dword [r11 + 0x14], 0
mov byte [r11 + 8], cl
ret
Function at 0x140036d60
Capabilities:
Create directory
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, edx
mov edi, r8d
mov rdx, rcx
mov rbx, rcx
mov ecx, eax
mov r9d, 0x4000
xor r8d, r8d
call fcn.14005e640
mov ecx, eax
call fcn.14005e610
test al, al
je 0x140036e33
xor r8d, r8d
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.14005d980
test eax, eax
js 0x140036e38
mov rcx, qword [rsp + 0x48]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x140036dc1
xor ebx, ebx
jmp 0x140036dd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov ebx, eax
test eax, eax
js 0x140036e1c
test dil, 2
jne 0x140036e1c
mov rcx, qword [rsp + 0x48]
mov edx, 0x2000
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140036e1a
test dil, 4
jne 0x140036e1a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov rcx, qword [rsp + 0x48]
mov ebx, eax
call fcn.14005d970
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor ebx, ebx
mov rcx, qword [rsp + 0x48]
call fcn.14005d970
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, 0xffffffeb
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140036e50
Capabilities:
Delete directory

Disassembly:
sub rsp, 0x28
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.14005d980
test eax, eax
js 0x140036ea0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x140036e80
xor ebx, ebx
jmp 0x140036e8f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call fcn.14005d970
mov eax, ebx
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x140036f30
Capabilities:
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1120]
mov eax, 0x1220
call fcn.140001130
sub rsp, rax
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rbp + 0x1110], rax
mov r15, rdx
mov r12, rcx
xor r14d, r14d
mov r13d, 0x80000000
nop dword [rax]
mov qword [rbp + 0xf60], r12
lea rbx, [rbp + 0xf70]
mov qword [rbp + 0x1038], r15
xor esi, esi
nop word [rax + rax]
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 0x48]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [rbx - 0x10]
lea rdx, [rsp + 0x30]
xor eax, eax
mov dword [rsp + 0x30], 0xc0000365
mov r8, rbx
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x38], 0xffffffffffffffd5
mov dword [rsp + 0x20], 0x1d
lea r9d, [rax + 0x48]
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
xor edx, edx
lea rcx, [rbx + 0x48]
mov dword [rbx - 8], eax
lea r8d, [rdx + 0x68]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [rbx - 0x10]
lea r8, [rbx + 0x48]
mov r9d, 0x68
mov dword [rsp + 0x30], 0xc0000365
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], 0xffffffffffffffd5
mov dword [rsp + 0x20], 0x12
call qword [sym.imp.ntdll.dll_NtQueryInformationFile]
lea ecx, [rax + r13]
test r13d, ecx
jne 0x14003703b
cmp eax, 0x80000005
jne 0x140037147
xor edx, edx
lea rcx, [rsp + 0x40]
lea r8d, [rdx + 0x18]
call sym.vkat.exe_nocrt_memset
mov rcx, qword [rbx - 0x10]
lea r8, [rsp + 0x40]
mov r9d, 0x1018
mov dword [rsp + 0x30], 0xc0000365
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x38], 0xffffffffffffffd5
mov dword [rsp + 0x20], 1
call qword [sym.imp.ntdll.dll_NtQueryVolumeInformationFile]
test eax, eax
js 0x14003709e
movaps xmm0, xmmword [rsp + 0x40]
movsd xmm1, qword [rsp + 0x50]
movups xmmword [rbx + 0xb0], xmm0
movsd qword [rbx + 0xc0], xmm1
jmp 0x1400370b0
xor edx, edx
lea rcx, [rbx + 0xb0]
lea r8d, [rdx + 0x18]
call sym.vkat.exe_nocrt_memset
inc rsi
add rbx, 0xd8
cmp rsi, 2
jb 0x140036fa0
movzx eax, byte [rbp + 0x10cd]
cmp byte [rbp + 0xff5], al
jne 0x140037147
mov eax, dword [rbp + 0x10b0]
xor eax, dword [rbp + 0xfd8]
test eax, 0x450
jne 0x140037147
mov eax, dword [rbp + 0x1100]
cmp dword [rbp + 0x1028], eax
jne 0x140037147
mov rax, qword [rbp + 0x10d0]
cmp qword [rbp + 0xff8], rax
jne 0x140037147
cmp dword [rbp + 0xf68], 0
jl 0x14003712a
mov r8d, 0x18
lea rdx, [rbp + 0x1048]
lea rcx, [rbp + 0xf70]
call sym.vkat.exe_nocrt_memcmp
test eax, eax
jne 0x14003713a
mov rax, qword [rbp + 0x1090]
cmp qword [rbp + 0xfb8], rax
je 0x140037179
inc r14d
cmp r14d, 3
jb 0x140036f80
xor al, al
mov rcx, qword [rbp + 0x1110]
xor rcx, rsp
call fcn.140001270
lea r11, [rsp + 0x1220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov al, 1
jmp 0x140037149
Function at 0x140037280
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, rcx
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.14005d980
mov ebx, eax
test eax, eax
js 0x1400372c6
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x1400372ba
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov ebx, eax
mov rcx, qword [rsp + 0x38]
call fcn.14005d970
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140037380
Capabilities:
Clear file content

Disassembly:
mov rax, r8
mov r10, rdx
mov r8, rcx
mov rdx, rax
mov rcx, r10
xor r9d, r9d
jmp fcn.1400373d0

Function at 0x1400373a0
Capabilities:
Clear file content

Disassembly:
lea rax, [rdx - 1]
cmp rax, 2
jbe 0x1400373b0
mov eax, 0xfffffffe
ret
mov r8, rcx
or rdx, 0x780
lea rcx, [0x1400b36d8]
xor r9d, r9d
jmp fcn.1400373d0
Function at 0x140037a30
Capabilities:
Get disk size
Get file size

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, 0xffffffffffffffff
mov rdi, rcx
cmp rcx, rax
mov rbx, rdx
lea rdx, [rsp + 0x44]
cmove rdi, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x40], eax
cmp eax, 0xffffffff
je 0x140037a86
mov rax, qword [rsp + 0x40]
mov qword [rbx], rax
xor eax, eax
jmp 0x140037b56
mov qword [rsp + 0xa0], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
mov esi, eax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x30], rax
xor r8d, r8d
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], 0x18
mov edx, 0x70000
mov qword [rsp + 0x20], rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140037b4c
mov eax, dword [rsp + 0x60]
add eax, 0xfffffff5
cmp eax, 1
ja 0x140037b4c
mov eax, dword [rsp + 0x68]
xor r9d, r9d
mov ecx, dword [rsp + 0x6c]
xor r8d, r8d
imul rcx, rax
mov eax, dword [rsp + 0x64]
mov edx, 0x7405c
imul rcx, rax
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x4c]
imul rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x50]
mov qword [rbx], rcx
mov rcx, rdi
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140037b48
mov rax, qword [rsp + 0x50]
mov qword [rbx], rax
xor eax, eax
jmp 0x140037b4e
mov eax, esi
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001270
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140037b80
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov r14, r9
mov rdi, r8
mov r15, rdx
mov rbp, rcx
test r8, r8
jne 0x140037bbe
test r9, r9
je 0x140037d1f
xor esi, esi
mov qword [r9], rsi
xor eax, eax
jmp 0x140037d28
mov eax, edi
cmp rax, rdi
jne 0x140037d23
xor esi, esi
lea r9, [rsp + 0x70]
mov rax, 0xffffffffffffffff
mov dword [rsp + 0x70], esi
cmp rbp, rax
mov qword [rsp + 0x20], rsi
cmove rbp, rax
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140037c79
test r14, r14
je 0x140037c0b
mov eax, dword [rsp + 0x70]
mov qword [r14], rax
xor eax, eax
jmp 0x140037d28
mov eax, dword [rsp + 0x70]
cmp edi, eax
jbe 0x140037d1f
nop word [rax + rax]
mov r8d, edi
mov edx, eax
sub r8d, eax
mov dword [rsp + 0x30], esi
add rdx, r15
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140037c67
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x140037d13
mov eax, dword [rsp + 0x70]
add eax, ecx
mov dword [rsp + 0x70], eax
cmp edi, eax
ja 0x140037c20
xor eax, eax
jmp 0x140037d28
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
jmp 0x140037d28
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140037c6d
mov eax, edi
mov ebx, 0x4000
shr eax, 1
cmp eax, ebx
ja 0x140037c9d
lea ebx, [rax + 0xff]
and ebx, 0xffffff00
mov ecx, esi
mov dword [rsp + 0x70], ecx
test edi, edi
je 0x140037d1f
nop word [rax + rax]
mov edx, ecx
lea r9, [rsp + 0x30]
mov eax, edi
mov dword [rsp + 0x30], esi
sub eax, ecx
mov qword [rsp + 0x20], rsi
add rdx, r15
mov r8d, ebx
cmp ebx, eax
mov rcx, rbp
cmova r8d, eax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140037cf4
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x140037c6d
cmp ebx, eax
jbe 0x140037c6d
mov ecx, dword [rsp + 0x70]
shr ebx, 1
jmp 0x140037d0b
mov ecx, dword [rsp + 0x70]
mov edx, dword [rsp + 0x30]
add ecx, edx
mov dword [rsp + 0x70], ecx
test r14, r14
jne 0x140037d1a
test edx, edx
je 0x140037d13
cmp edi, ecx
ja 0x140037cb0
xor eax, eax
jmp 0x140037d28
mov eax, 0xffffff92
jmp 0x140037d28
mov eax, ecx
mov qword [r14], rax
xor eax, eax
jmp 0x140037d28
mov eax, 0xffffffc9
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140037d50
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov eax, r9d
mov rbx, r9
mov rbp, r8
mov rdi, rdx
mov rsi, rcx
cmp rax, r9
jne 0x140037eba
mov dword [rsp + 0x48], edi
lea r9, [r11 + 0x20]
mov rax, rdx
mov qword [r11 + 8], r14
sar rax, 0x20
xor r14d, r14d
mov dword [rsp + 0x4c], eax
mov r8d, ebx
mov rax, 0xffffffffffffffff
mov qword [r11 - 0x28], r14
cmp rcx, rax
mov qword [r11 - 0x40], r14
mov rdx, rbp
mov qword [r11 - 0x38], r14
cmove rsi, rax
mov dword [r11 + 0x20], r14d
lea rax, [r11 - 0x40]
mov rcx, rsi
mov qword [r11 - 0x58], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140037e9b
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140037deb
mov eax, dword [rsp + 0x98]
mov qword [rcx], rax
xor eax, eax
jmp 0x140037e74
mov edx, dword [rsp + 0x98]
cmp ebx, edx
jbe 0x140037eb6
nop word [rax + rax]
mov ecx, edx
lea eax, [rdi + rdx]
mov dword [rsp + 0x48], eax
lea r9, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x50], r14
sub r8d, edx
mov qword [rsp + 0x38], r14
lea rax, [rcx + rdi]
mov qword [rsp + 0x40], r14
sar rax, 0x20
lea rdx, [rcx + rbp]
mov dword [rsp + 0x4c], eax
mov rcx, rsi
lea rax, [rsp + 0x38]
mov dword [rsp + 0x30], r14d
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140037e8c
mov eax, dword [rsp + 0x30]
test eax, eax
je 0x140037e6f
mov edx, dword [rsp + 0x98]
add edx, eax
mov dword [rsp + 0x98], edx
cmp ebx, edx
ja 0x140037e00
xor eax, eax
jmp 0x140037e74
mov eax, 0xffffff92
mov r14, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
jmp 0x140037e74
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x140037e92
cmp eax, 0x26
jne 0x140037e92
mov qword [rcx], r14
xor eax, eax
jmp 0x140037e74
mov rbx, qword [rsp + 0x88]
mov eax, 0xffffffc9
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x140038010
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x1400f54e0]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov r14, 0xffffffffffffffff
mov qword [rsp + 0x60], rdx
cmp rcx, r14
mov dword [rsp + 0x78], 0xc0000365
mov rdi, rcx
mov qword [rbp - 0x80], 0xffffffffffffffd5
cmove rdi, r14
mov dword [rsp + 0x20], 0x14
xor eax, eax
lea r9d, [r14 + 9]
mov r12, rdx
mov dword [rsp + 0x7c], eax
mov rcx, rdi
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov r15d, eax
cmp eax, 0xc0000022
jne 0x140038226
xorps xmm0, xmm0
lea r9d, [r14 + 0x39]
xor eax, eax
lea r8, [rbp - 0x28]
mov qword [rbp + 8], rax
xor r13d, r13d
lea rax, [rsp + 0x70]
mov dword [rsp + 0x70], r13d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rcx, rdi
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm0
movups xmmword [rbp - 8], xmm0
call qword [sym.imp.ntdll.dll_NtQueryObject]
test eax, eax
js 0x1400381c0
mov eax, dword [rbp - 0x24]
and al, 6
cmp al, 4
jne 0x1400381c0
mov esi, r13d
nop dword [rax + rax]
xor r8d, r8d
lea rcx, [rbp - 0x68]
mov rdx, rdi
call fcn.14005fd70
test eax, eax
js 0x1400381c0
mov edx, dword [rbp - 0x24]
lea r9, [rbp - 0x78]
mov dword [rsp + 0x50], r13d
lea r8, [rbp - 0x58]
xor eax, eax
mov qword [rsp + 0x48], r13
mov dword [rbp - 0x74], eax
lea rcx, [rsp + 0x68]
mov eax, dword [rbp - 0x28]
xorps xmm0, xmm0
mov dword [rsp + 0x40], 0x4000
and eax, 0xfffffffd
mov dword [rsp + 0x38], 1
or edx, 2
mov dword [rbp - 0x40], eax
lea rax, [rbp - 0x68]
mov dword [rsp + 0x30], 7
mov dword [rsp + 0x28], 0x80
mov qword [rbp - 0x48], rax
mov qword [rsp + 0x68], r14
mov dword [rbp - 0x78], 0xc0000365
mov qword [rbp - 0x70], 0xffffffffffffffd5
mov dword [rbp - 0x58], 0x30
mov qword [rbp - 0x50], r13
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rsp + 0x20], r13
call sub.ntdll.dll_NtCreateFile
mov rcx, qword [rbp - 0x60]
mov ebx, eax
call fcn.140041e90
test ebx, ebx
js 0x1400381b5
mov rdx, qword [rsp + 0x68]
mov rcx, rdi
call fcn.140036f30
test al, al
jne 0x1400381ef
mov rcx, qword [rsp + 0x68]
call sub.ntdll.dll_NtClose
inc esi
cmp esi, 0x10
jb 0x1400380f0
mov ecx, r15d
call fcn.140060810
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.140001270
mov rbx, qword [rsp + 0x170]
add rsp, 0x120
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r14, qword [rsp + 0x68]
mov rdi, r14
cmp r14, 0xffffffffffffffff
je 0x1400381c0
mov r9d, 8
mov qword [rsp + 0x60], r12
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 0x14
lea rdx, [rsp + 0x78]
mov rcx, r14
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov r15d, eax
test r15d, r15d
js 0x140038254
mov r9d, 8
mov qword [rsp + 0x60], r12
lea r8, [rsp + 0x60]
mov dword [rsp + 0x20], 0x13
lea rdx, [rsp + 0x78]
mov rcx, rdi
call qword [sym.imp.ntdll.dll_NtSetInformationFile]
mov r15d, eax
cmp r14, 0xffffffffffffffff
je 0x140038262
mov rcx, r14
call sub.ntdll.dll_NtClose
test r15d, r15d
js 0x1400381c0
xor eax, eax
jmp 0x1400381c8
Function at 0x1400383c0
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, r9
mov rbx, r8
mov r12, rdx
mov r14, rcx
test r8, r8
je 0x140038442
mov edi, ebx
cmp rdi, rbx
jne 0x14003860a
xor r13d, r13d
lea r9, [r11 + 0x18]
mov rax, 0xffffffffffffffff
mov dword [r11 + 0x18], r13d
cmp rcx, rax
mov qword [r11 - 0x48], r13
mov r15, rcx
cmove r15, rax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400384f4
test rsi, rsi
je 0x140038464
cmp dword [rsp + 0x80], ebx
cmovbe ebx, dword [rsp + 0x80]
mov eax, ebx
mov qword [rsi], rax
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, dword [rsp + 0x80]
cmp eax, ebx
jae 0x140038442
nop
mov r8d, ebx
mov edx, eax
sub r8d, eax
mov dword [rsp + 0x30], r13d
add rdx, r12
mov qword [rsp + 0x20], r13
lea r9, [rsp + 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1400384b9
mov ecx, dword [rsp + 0x30]
test ecx, ecx
je 0x1400385cb
mov eax, dword [rsp + 0x80]
add eax, ecx
mov dword [rsp + 0x80], eax
cmp eax, ebx
jb 0x140038470
jmp 0x140038442
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14005db40
cmp eax, 0xffffff68
jne 0x140038444
mov rcx, r14
call fcn.140045370
mov ecx, dword [rsp + 0x80]
sub rdi, rcx
mov rcx, r14
lea rdx, [rdi + rax]
call fcn.140037180
jmp 0x140038444
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x1400385df
mov eax, ebx
mov edi, 0x8000
shr eax, 1
cmp eax, edi
ja 0x14003851c
lea edi, [rax + 0xff]
and edi, 0xffffff00
mov ecx, r13d
mov dword [rsp + 0x80], ecx
test ebx, ebx
je 0x140038442
nop
mov edx, ecx
lea r9, [rsp + 0x30]
mov eax, ebx
mov dword [rsp + 0x30], r13d
sub eax, ecx
mov qword [rsp + 0x20], r13
cmp edi, eax
mov ebp, edi
mov rcx, r15
cmova ebp, eax
add rdx, r12
mov r8d, ebp
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x140038579
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 8
jne 0x14003859f
cmp edi, eax
jbe 0x14003859f
mov ecx, dword [rsp + 0x80]
shr edi, 1
jmp 0x140038596
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x30]
add ecx, edx
mov dword [rsp + 0x80], ecx
test rsi, rsi
jne 0x1400385d5
test edx, edx
je 0x1400385cb
cmp ecx, ebx
jb 0x140038530
jmp 0x140038442
mov ecx, eax
call fcn.14005db40
cmp eax, 0xffffff68
jne 0x140038444
mov rcx, r14
call fcn.140045370
mov edx, ebp
mov rcx, r14
add rdx, rax
call fcn.140037180
jmp 0x140038444
mov eax, 0xffffff90
jmp 0x140038444
cmp ecx, ebx
cmovbe ebx, ecx
jmp 0x14003843d
mov ecx, eax
call fcn.14005db40
cmp eax, 0xffffff68
jne 0x140038444
mov rcx, r14
call fcn.140045370
mov rcx, r14
lea rdx, [rdi + rax]
call fcn.140037180
jmp 0x140038444
mov eax, 0xffffffc9
jmp 0x140038444