joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006720
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x2a0
mov esi, dword [rsp + 0x300]
mov r13, r8
mov r15b, dl
mov r12, rcx
cmp esi, 0x18
ja 0x140006970
xor ebx, ebx
mov rdi, rcx
cmp dword [rdi + 0x114], esi
jne 0x140006795
mov rdx, r13
mov rcx, rdi
call fcn.14000f4e0
test al, al
je 0x140006795
mov rdx, qword [rsp + 0x2f0]
lea rcx, [rdi + 0x102]
mov r8d, 0x10
call fcn.140020c50
test eax, eax
je 0x14000698c
inc ebx
add rdi, 0x178
cmp ebx, 4
jb 0x14000675c
mov rcx, qword [rsp + 0x2e8]
mov edi, 0x200
lea rdx, [rsp + 0xa0]
mov r8, rdi
call fcn.140014f58
mov ecx, esi
mov ebx, 1
shl ebx, cl
lea rcx, [rsp + 0xa0]
call fcn.140020840
mov r8, qword [rsp + 0x2f0]
mov dword [rsp + 0x38], ebx
mov rdx, rax
lea rax, [rsp + 0x60]
mov ebx, 0x10
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
lea rcx, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x20], rax
call fcn.140006558
lea rcx, [rsp + 0xa0]
mov rdx, rdi
call fcn.14000f3c4
mov eax, dword [r12 + 0x5e0]
mov rdx, r13
mov rdi, rax
mov r8d, 0x102
and edi, 3
imul rdi, rdi, 0x178
add rdi, r12
inc eax
mov dword [r12 + 0x5e0], eax
mov rcx, rdi
mov dword [rdi + 0x114], esi
call fcn.140020900
mov rdx, qword [rsp + 0x2f0]
lea rcx, [rdi + 0x102]
mov r8, rbx
call fcn.140020900
lea esi, [rbx + 0x10]
lea rdx, [rsp + 0x40]
lea rcx, [rdi + 0x118]
mov r8, rsi
call fcn.140020900
lea rcx, [rdi + 0x138]
lea rdx, [rsp + 0x60]
mov r8, rsi
call fcn.140020900
lea rcx, [rdi + 0x158]
lea rdx, [rsp + 0x80]
mov r8, rsi
call fcn.140020900
lea rcx, [rdi + 0x118]
mov r8b, 1
mov rdx, rsi
call fcn.14000f284
mov rcx, qword [rsp + 0x308]
test rcx, rcx
je 0x1400068ec
lea rdx, [rsp + 0x80]
mov r8, rsi
call fcn.140020900
mov rbx, qword [rsp + 0x310]
test rbx, rbx
je 0x140006936
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 8]
call fcn.140020540
xor r11d, r11d
lea rdx, [rsp + 0x60]
mov r8, rsi
mov al, byte [rdx]
mov rcx, r11
inc r11
and ecx, 7
inc rdx
xor byte [rcx + rbx], al
sub r8, 1
jne 0x140006912
lea rcx, [rsp + 0x60]
mov rdx, rsi
call fcn.14000f3c4
mov rax, qword [rsp + 0x2f8]
test rax, rax
je 0x140006963
lea rcx, [r12 + 0x5e8]
lea r8, [rsp + 0x40]
mov r9d, 0x100
mov dl, r15b
mov qword [rsp + 0x20], rax
call fcn.14000f07c
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.14000f3c4
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
xor r8d, r8d
lea rcx, [rdi + 0x118]
lea esi, [r8 + 0x20]
mov rdx, rsi
call fcn.14000f284
lea rdx, [rdi + 0x118]
lea rcx, [rsp + 0x40]
mov r8, rsi
call fcn.140020900
lea rcx, [rdi + 0x118]
mov r8b, 1
mov rdx, rsi
call fcn.14000f284
lea rdx, [rdi + 0x138]
lea rcx, [rsp + 0x60]
mov r8, rsi
call fcn.140020900
lea rdx, [rdi + 0x158]
lea rcx, [rsp + 0x80]
mov r8, rsi
call fcn.140020900
jmp 0x1400068cf
Function at 0x140006a80
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
cmp dword [rcx], 2
mov rdi, rdx
mov rbx, rcx
mov esi, 0x20
jne 0x140006b0d
mov r8d, dword [rcx + 4]
lea r9d, [rsi - 0x1c]
mov rdx, rsi
mov eax, r8d
mov byte [r11 + 8], r8b
mov rcx, rdi
shr eax, 8
mov byte [rsp + 0x61], al
mov eax, r8d
shr r8d, 0x18
shr eax, 0x10
mov byte [rsp + 0x62], al
mov byte [r11 + 0xb], r8b
lea rax, [r11 - 0x28]
lea r8, [r11 + 8]
mov qword [r11 - 0x38], rax
call fcn.1400063b8
xor r11d, r11d
lea r8, [rsp + 0x30]
mov dword [rbx + 4], r11d
mov edx, r11d
movzx eax, byte [r8]
mov ecx, r11d
inc r11d
and ecx, 3
inc r8
shl ecx, 3
shl eax, cl
xor edx, eax
cmp r11d, esi
jb 0x140006aee
mov dword [rbx + 4], edx
cmp dword [rbx], 3
jne 0x140006b3f
lea rax, [rsp + 0x30]
lea r8, [rbx + 4]
mov r9, rsi
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call fcn.1400063b8
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 4]
mov r8, rsi
call fcn.140020900
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x140006f70
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.14002ac70
sub rsp, rax
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x140006feb
mov rcx, rdi
call fcn.1400204bc
mov rcx, rdi
mov rbx, rax
call fcn.14000c34c
test al, al
jne 0x140006fc7
lea rdx, [rsp + 0x20]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea rcx, [rsp + 0x20]
call fcn.1400204bc
lea rbx, [rbx + rax + 1]
mov edi, 0x104
cmp rbx, rdi
jbe 0x140006feb
lea ecx, [rdi - 0x41]
call fcn.14000e52c
lea rcx, [0x14002cc28]
mov r8d, edi
mov rdx, rax
call fcn.140010eac
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x140007294
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x78
mov rsi, r8
mov rbx, rdx
call fcn.14000e52c
mov r8, rsi
mov rdx, rax
mov rcx, rbx
call fcn.140010eac
mov rdx, rsi
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140006f70

Function at 0x140007390
Capabilities:
Get common file path

Disassembly:
mov r8, rdx
xor edx, edx
jmp fcn.140007294
Function at 0x1400099f4
Capabilities:
Move file

Disassembly:
push r12
mov eax, 0x5060
call fcn.14002ac70
sub rsp, rax
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x5070], rbx
mov qword [rsp + 0x5078], rbp
mov qword [rsp + 0x5080], rsi
mov qword [rsp + 0x5088], rdi
mov rbx, rcx
mov r12d, 0x800
mov r8d, r12d
lea rdx, [rsp + 0x4060]
call qword [sym.imp.KERNEL32.dll_GetLongPathNameW]
xor ebp, ebp
cmp eax, ebp
je 0x140009c0e
cmp eax, r12d
jae 0x140009c0e
mov r8d, r12d
lea rdx, [rsp + 0x3060]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x140009c0a
cmp eax, r12d
jae 0x140009c0a
lea rcx, [rsp + 0x4060]
call fcn.14000be04
mov rsi, rax
lea rcx, [rsp + 0x3060]
call fcn.14000be04
mov rdi, rax
cmp word [rax], bp
je 0x140009c06
mov rdx, rax
mov rcx, rsi
call fcn.1400151f0
cmp eax, ebp
je 0x140009c06
mov rcx, rbx
call fcn.14000be04
mov rcx, rax
mov rdx, rdi
call fcn.1400151f0
cmp eax, ebp
jne 0x140009c06
mov ax, bp
mov word [rsp + 0x30], ax
mov edi, ebp
cmp ax, bp
jne 0x140009b47
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400141cc
lea rcx, [rsp + 0x30]
call fcn.14000be04
mov rcx, rax
mov r9d, edi
lea r8, str.rtmp_d
mov rdx, r12
call fcn.140010004
lea rcx, [rsp + 0x30]
call fcn.14000ac0c
cmp al, bpl
je 0x140009b2b
mov eax, ebp
mov word [rsp + 0x30], ax
jmp 0x140009b30
mov ax, word [rsp + 0x30]
add edi, 0x7b
cmp edi, 0x2710
jl 0x140009adf
cmp ax, bp
jne 0x140009b47
xor al, al
jmp 0x140009c10
mov r8, r12
mov rdx, rbx
lea rcx, [rsp + 0x2060]
call fcn.1400141cc
mov r8, r12
mov rdx, rsi
lea rcx, [rsp + 0x2060]
call fcn.14000bfb8
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2060]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebp
jne 0x140009b8b
xor al, al
jmp 0x140009c10
lea rcx, [rsp + 0x1030]
call fcn.140009e8c
nop
mov dil, bpl
mov rcx, rbx
call fcn.14000ac0c
cmp al, bpl
jne 0x140009bc2
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x1030]
call fcn.14000a064
mov dil, al
lea rdx, [rsp + 0x2060]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp dil, bpl
je 0x140009bf5
lea rcx, [rsp + 0x1030]
call fcn.14000a1b0
lea rcx, [rsp + 0x1030]
call fcn.14000a218
nop
lea rcx, [rsp + 0x1030]
call fcn.14000a498
mov al, 1
jmp 0x140009c10
xor al, al
jmp 0x140009c10
xor al, al
jmp 0x140009c10
xor al, al
lea r11, [rsp + 0x5060]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x14000a24c
Capabilities:
Write file on windows

Disassembly:
test r8, r8
je 0x14000a396
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r13
sub rsp, 0x30
mov rdi, rcx
mov ecx, dword [rcx + 0x14]
mov rsi, r8
mov rbp, rdx
test ecx, ecx
je 0x14000a297
sub ecx, 1
je 0x14000a288
cmp ecx, 1
jne 0x14000a297
mov ecx, 0xfffffff4
jmp 0x14000a28d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rdi + 8], rax
mov r13d, 0x4000
and dword [rsp + 0x60], 0
cmp dword [rdi + 0x14], 0
je 0x14000a2f0
xor ebx, ebx
test rsi, rsi
je 0x14000a315
mov eax, esi
mov r8d, r13d
mov rcx, rsi
sub rcx, rbx
sub eax, ebx
lea rdx, [rbx + rbp]
cmp rcx, r13
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x60]
cmovb r8d, eax
and qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x14000a315
add rbx, r13
cmp rbx, rsi
jb 0x14000a2af
jmp 0x14000a311
mov rcx, qword [rdi + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x60]
mov r8d, esi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x14000a380
cmp byte [rdi + 0x1c], 0
je 0x14000a380
cmp dword [rdi + 0x14], 0
jne 0x14000a380
lea rdx, [rdi + 0x26]
lea rcx, [0x140037d88]
xor r8d, r8d
call fcn.140007124
test al, al
je 0x14000a36e
mov ecx, dword [rsp + 0x60]
cmp rcx, rsi
jae 0x14000a29d
test ecx, ecx
je 0x14000a29d
mov rbx, qword [rdi]
mov rcx, rdi
call qword [rbx + 0x18]
mov ecx, dword [rsp + 0x60]
xor r8d, r8d
sub rax, rcx
mov rcx, rdi
mov rdx, rax
call qword [rbx + 0x10]
jmp 0x14000a29d
lea r8, [rdi + 0x26]
lea rcx, [0x140037d88]
xor edx, edx
call fcn.140007350
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov byte [rdi + 0x10], 1
add rsp, 0x30
pop r13
pop rdi
pop rsi
ret

Function at 0x14000a448
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp eax, 1
sete al
add rsp, 0x28
ret

Function at 0x14000a4cc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp dword [rcx + 0x14], 1
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov ebp, 0x4e20
jne 0x14000a50a
cmp r8, rbp
mov ecx, 0xfffffff6
cmova rdi, rbp
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx + 8], rax
mov rcx, qword [rbx + 8]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14000a57f
mov rcx, rbx
call fcn.14000a468
test al, al
je 0x14000a54a
cmp rdi, rbp
jbe 0x14000a54a
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.14000a4cc
jmp 0x14000a583
cmp dword [rbx + 0x14], 1
jne 0x14000a55f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6d
jne 0x14000a55f
xor eax, eax
jmp 0x14000a583
cmp dword [rbx + 0x14], 0
jne 0x14000a57a
mov ebp, 0x8000
cmp rdi, rbp
jbe 0x14000a57a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x21
je 0x14000a53a
or eax, 0xffffffff
jmp 0x14000a583
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x14000a898
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
call fcn.14000a81c
test al, al
je 0x14000a8c6
mov rcx, qword [rbx + 8]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov r11, qword [rbx]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [r11 + 0x10]
add rsp, 0x20
pop rbx
ret

Function at 0x14000a91c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.14002ac70
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14000a963
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rdi
call fcn.14000c45c
test al, al
je 0x14000a963
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x14000a978
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1020
call fcn.14002ac70
sub rsp, rax
mov edi, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
test bl, bl
jne 0x14000a9cd
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rsi
call fcn.14000c45c
test al, al
je 0x14000a9cd
lea rcx, [rsp + 0x20]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne bl
lea r11, [rsp + 0x1020]
mov al, bl
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14000a9e4
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x1020
call fcn.14002ac70
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
test bl, bl
jne 0x14000aa30
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rdi
call fcn.14000c45c
test al, al
je 0x14000aa30
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne bl
mov al, bl
mov rbx, qword [rsp + 0x1030]
add rsp, 0x1020
pop rdi
ret

Function at 0x14000ac28
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x1020
call fcn.14002ac70
sub rsp, rax
mov dil, dl
xor edx, edx
mov esi, r8d
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000aca8
mov rcx, rbx
call fcn.14000a91c
cmp eax, 0xffffffff
jne 0x14000ac8a
lea rdx, [rsp + 0x20]
mov r8d, 0x800
mov rcx, rbx
call fcn.14000c45c
test al, al
je 0x14000ac8a
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14000aca8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000aca1
cmp eax, 3
je 0x14000aca1
mov eax, 1
jmp 0x14000acb9
mov eax, 2
jmp 0x14000acb9
test dil, dil
je 0x14000acb7
mov edx, esi
mov rcx, rbx
call fcn.14000a978
xor eax, eax
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14000ae28
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r12
mov eax, 0x1270
call fcn.14002ac70
sub rsp, rax
mov rsi, rdx
mov rdi, r8
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov r12d, 0x800
cmp rcx, 0xffffffffffffffff
jne 0x14000aed2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000aefc
lea rdx, [rsp + 0x270]
mov r8, r12
mov rcx, rsi
call fcn.14000c45c
test al, al
je 0x14000aea9
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x270]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000aefc
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x14000aec5
cmp eax, 3
je 0x14000aec5
cmp eax, 0x12
je 0x14000aec5
mov eax, 1
jmp 0x14000aec7
xor eax, eax
mov byte [rdi + 0x1044], al
jmp 0x14000af92
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14000aef2
or rbx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
setne al
mov byte [rdi + 0x1044], al
cmp rbx, 0xffffffffffffffff
je 0x14000af92
mov r8, r12
mov rdx, rsi
mov rcx, rdi
call fcn.1400141cc
lea rdx, [rsp + 0x4c]
mov r8, r12
mov rcx, rdi
call fcn.14000bfb8
mov eax, dword [rsp + 0x40]
mov r11d, dword [rsp + 0x3c]
shl r11, 0x20
lea rcx, [rdi + 0x1010]
lea rdx, [rsp + 0x34]
add r11, rax
mov eax, dword [rsp + 0x20]
mov dword [rdi + 0x1008], eax
mov rax, qword [rsp + 0x24]
mov qword [rdi + 0x1000], r11
mov qword [rdi + 0x1028], rax
mov rax, qword [rsp + 0x2c]
mov qword [rdi + 0x1030], rax
mov rax, qword [rsp + 0x34]
mov qword [rdi + 0x1038], rax
call fcn.140014b08
lea rcx, [rdi + 0x1018]
lea rdx, [rsp + 0x24]
call fcn.140014b08
lea rcx, [rdi + 0x1020]
lea rdx, [rsp + 0x2c]
call fcn.140014b08
and dword [rdi + 0x1040], 0
lea r11, [rsp + 0x1270]
mov rax, rbx
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r12
ret
Function at 0x14000c45c
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1020
call fcn.14002ac70
sub rsp, rax
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
call fcn.14000bd10
mov rcx, rbx
call fcn.1400204bc
mov rcx, rbx
mov rsi, rax
call fcn.14000c34c
test al, al
je 0x14000c537
mov rcx, rbx
call fcn.14000bd10
test al, al
je 0x14000c4e3
lea rax, [rsi + 4]
cmp rdi, rax
jbe 0x14000c5ff
lea rdx, [0x14002d000]
mov r8d, 4
mov rcx, rbp
call fcn.1400210f0
lea rcx, [rbp + 8]
mov rdx, rbx
call fcn.140020504
mov al, 1
jmp 0x14000c601
mov eax, 0x5c
cmp word [rbx], ax
jne 0x14000c5ff
cmp word [rbx + 2], ax
jne 0x14000c5ff
lea rax, [rsi + 6]
cmp rdi, rax
jbe 0x14000c5ff
lea rdx, [0x14002d000]
mov r8d, 4
mov rcx, rbp
call fcn.1400210f0
lea rcx, [rbp + 8]
lea rdx, [0x14002cff8]
call fcn.140020504
lea rcx, [rbp + 0xe]
lea rdx, [rbx + 2]
jmp 0x14000c4d7
lea rdx, [rsp + 0x20]
mov ecx, 0x7ff
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
test eax, eax
je 0x14000c5ff
cmp eax, 0x7ff
ja 0x14000c5ff
movzx ecx, word [rbx]
mov eax, 0x5c
cmp ecx, eax
je 0x14000c5c4
cmp ecx, 0x2f
je 0x14000c5c4
lea rcx, [rsp + 0x20]
mov edx, 0x800
call fcn.14000ba5c
lea rcx, [rsp + 0x20]
call fcn.1400204bc
lea rcx, [rax + rsi + 4]
cmp rdi, rcx
jbe 0x14000c5ff
lea rdx, [0x14002d000]
mov r8d, 4
mov rcx, rbp
call fcn.1400210f0
lea rcx, [rbp + 8]
lea rdx, [rsp + 0x20]
call fcn.140020504
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call fcn.140014208
jmp 0x14000c4dc
lea rax, [rsi + 6]
cmp rdi, rax
jbe 0x14000c5ff
lea rdx, [0x14002d000]
mov r8d, 4
mov rcx, rbp
call fcn.1400210f0
lea rcx, [rbp + 8]
lea rdx, [rsp + 0x20]
mov r8d, 2
call fcn.1400210f0
lea rcx, [rbp + 0xc]
jmp 0x14000c4d4
xor al, al
lea r11, [rsp + 0x1020]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14000c954
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
and dword [rcx + 4], 0
and dword [rcx], 0
mov eax, 0x8000
cmp r8d, eax
mov r12, rcx
mov rcx, qword [rcx + 0x10]
cmovb eax, r8d
mov ebp, r8d
mov rbx, r9
mov r8d, eax
mov rsi, rdx
call fcn.140020900
xor dil, dil
cmp ebp, 1
jbe 0x14000c9b3
lea rcx, [rsi + 1]
lea edx, [rbp - 1]
xor dil, byte [rcx]
inc rcx
sub rdx, 1
jne 0x14000c9a7
mov edx, 8
mov rcx, r12
call fcn.14000b1ac
and dword [rbx + 0x28], 0
cmp dil, byte [rsi]
jne 0x14000ca25
mov r8d, ebp
mov rdx, rsi
mov rcx, r12
call fcn.14000c868
mov edi, eax
test eax, eax
je 0x14000ca25
mov edx, 1
mov rcx, rbx
call fcn.14000c8b4
movsxd rcx, dword [rbx + 0x28]
mov rdx, rcx
inc ecx
mov dword [rbx + 0x28], ecx
imul rdx, rdx, 0x38
add rdx, qword [rbx]
lea rax, [rdx + 0xc]
mov dword [rdx], 0x28
mov dword [rax], edi
mov qword [rdx + 0x18], rax
lea rax, [rdx + 0x24]
mov qword [rdx + 0x30], rax
mov eax, 3
mov dword [rdx + 0x20], eax
mov dword [rdx + 8], eax
jmp 0x14000caa5
mov edx, 1
mov rcx, rbx
call fcn.14000c8b4
movsxd rax, dword [rbx + 0x28]
xor r8d, r8d
mov rcx, rax
inc eax
mov dword [rbx + 0x28], eax
imul rcx, rcx, 0x38
add rcx, qword [rbx]
lea rax, [rcx + 0xc]
mov dword [rcx], 0x16
mov qword [rcx + 0x18], rax
lea rax, [rcx + 0x24]
mov qword [rcx + 0x30], rax
mov eax, 3
mov dword [rcx + 0x20], eax
mov dword [rcx + 8], eax
cmp dword [rbx + 0x28], r8d
jle 0x14000caa5
xor ecx, ecx
mov rdx, qword [rbx]
cmp qword [rcx + rdx + 0x18], 0
jne 0x14000ca86
lea rax, [rcx + rdx + 0xc]
mov qword [rcx + rdx + 0x18], rax
cmp qword [rcx + rdx + 0x30], 0
jne 0x14000ca98
lea rax, [rcx + rdx + 0x24]
mov qword [rcx + rdx + 0x30], rax
inc r8d
add rcx, 0x38
cmp r8d, dword [rbx + 0x28]
jl 0x14000ca71
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x14000e5e4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x40
mov ebp, dword [rcx]
mov rsi, rcx
lea rcx, [rax - 0x38]
mov r8d, 0x20
sub ebp, 6
call fcn.140020900
xor edi, edi
xor r9d, r9d
xor edx, edx
xor r8d, r8d
movsxd r10, ebp
lea r14d, [rdi + 4]
test ebp, ebp
jle 0x14000e673
xor r11d, r11d
cmp edi, dword [rsi]
jg 0x14000e673
cmp rdx, r10
jge 0x14000e65e
lea rbx, [rsp + rdx*4 + 0x20]
cmp r8, r14
jge 0x14000e661
mov eax, dword [rbx]
lea rcx, [r11 + r8]
inc rdx
add rbx, r14
inc r9d
inc r8
cmp rdx, r10
mov dword [rsi + rcx*4 + 0x14], eax
jl 0x14000e63e
cmp r8, r14
jne 0x14000e66e
inc edi
add r11, r14
xor r9d, r9d
xor r8d, r8d
cmp rdx, r10
jl 0x14000e630
cmp edi, dword [rsi]
movsxd rbx, edi
movsxd r11, r9d
jg 0x14000e7d2
lea r12, [0x14003cdd0]
lea r15, [0x14003cef0]
movzx ecx, byte [rsp + r10*4 + 0x1d]
mov al, byte [rsp + 0x20]
xor al, byte [rcx + r15]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + r10*4 + 0x1e]
mov al, byte [rax + r15]
xor byte [rsp + 0x21], al
movzx eax, byte [rsp + r10*4 + 0x1f]
mov al, byte [rax + r15]
xor byte [rsp + 0x22], al
movzx eax, byte [rsp + r10*4 + 0x1c]
mov al, byte [rax + r15]
xor byte [rsp + 0x23], al
mov al, byte [r12]
inc r12
xor byte [rsp + 0x20], al
cmp ebp, 8
je 0x14000e70a
cmp r10, 1
jle 0x14000e786
lea rdx, [rsp + 0x24]
lea r8, [r10 - 1]
xor ecx, ecx
mov al, byte [rdx + rcx - 4]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, r14
jl 0x14000e6f0
add rdx, r14
sub r8, 1
jne 0x14000e6ee
jmp 0x14000e786
lea rcx, [rsp + 0x24]
mov r8d, 3
mov rdx, r14
mov al, byte [rcx - 4]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000e718
sub r8, 1
jne 0x14000e715
movzx eax, byte [rsp + 0x2c]
mov al, byte [rax + r15]
xor byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x2d]
mov al, byte [rax + r15]
xor byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x2e]
mov al, byte [rax + r15]
xor byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x2f]
mov al, byte [rax + r15]
xor byte [rsp + 0x33], al
cmp r10, 5
jle 0x14000e786
lea rcx, [rsp + 0x34]
lea r8, [r10 - 5]
mov rdx, r14
mov al, byte [rcx - 4]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14000e772
sub r8, 1
jne 0x14000e76f
xor edx, edx
test ebp, ebp
jle 0x14000e7ca
cmp edi, dword [rsi]
jg 0x14000e7d2
cmp rdx, r10
jge 0x14000e7b8
lea r8, [rsp + rdx*4 + 0x20]
cmp r11, r14
jge 0x14000e7bb
mov eax, dword [r8]
lea rcx, [r11 + rbx*4]
inc rdx
add r8, r14
inc r11
cmp rdx, r10
mov dword [rsi + rcx*4 + 0x14], eax
jl 0x14000e79a
cmp r11, r14
jne 0x14000e7c5
inc edi
inc rbx
xor r11d, r11d
cmp rdx, r10
jl 0x14000e78c
cmp edi, dword [rsi]
jle 0x14000e68f
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop r12
ret
Function at 0x14000e7f4
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x30
mov edi, 1
mov rbx, rcx
cmp dword [rcx], edi
jle 0x14000e8bc
lea rsi, [rcx + 0x26]
lea r13, [0x140000000]
xor r9d, r9d
lea r11, [rsp + r9 + 0x20]
mov r10, rsi
mov ebp, 4
movzx eax, byte [r10 + 1]
lea rdx, [r9 + rax*4]
movzx eax, byte [r10 - 1]
mov r8b, byte [rdx + r13 + 0x39dd0]
lea rcx, [r9 + rax*4]
movzx eax, byte [r10 - 2]
xor r8b, byte [rcx + r13 + 0x3a5d0]
lea rcx, [r9 + rax*4]
movzx eax, byte [r10]
xor r8b, byte [rcx + r13 + 0x3a9d0]
lea rcx, [r9 + rax*4]
add r10, 4
xor r8b, byte [rcx + r13 + 0x3a1d0]
mov byte [r11], r8b
add r11, 4
sub rbp, 1
jne 0x14000e838
inc r9
cmp r9, 4
jl 0x14000e82b
movsxd rax, edi
lea r8d, [rbp + 0x10]
lea rdx, [rsp + 0x20]
add rax, rax
lea rcx, [rbx + rax*8 + 0x14]
call fcn.140020900
inc edi
add rsi, 0x10
cmp edi, dword [rbx]
jl 0x14000e828
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r13
ret