joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14003a700
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
lea rax, [rsp + 0x30]
mov edx, ecx
mov qword [rsp + 0x20], rax
mov edi, ecx
xor ebp, ebp
xor ecx, ecx
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
xor sil, sil
call qword [sym.imp.SHELL32.dll_SHGetFolderLocation]
test eax, eax
js 0x14003a7df
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x14003a7cf
lea rax, [rsp + 0x40]
mov rdx, 0xffffffffffffffff
inc rdx
cmp word [rax + rdx*2], bp
jne 0x14003a772
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x14003a7bf
mov rsi, rbx
cmp rax, 8
jb 0x14003a790
mov rsi, qword [rbx]
lea rdi, [rdx + rdx]
mov qword [rbx + 0x10], rdx
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14007c470
mov word [rdi + rsi], bp
mov sil, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14003a85c
lea r9, [rsp + 0x40]
mov rcx, rbx
call fcn.140003380
mov sil, 1
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
jmp 0x14003a85c
lea rax, [rsp + 0x40]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov edx, edi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14003a85c
lea rax, [rsp + 0x40]
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp word [rax + rdx*2], bp
jne 0x14003a810
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x14003a84c
mov rsi, rbx
cmp rax, 8
jb 0x14003a82e
mov rsi, qword [rbx]
lea rdi, [rdx + rdx]
mov qword [rbx + 0x10], rdx
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.14007c470
mov word [rdi + rsi], bp
jmp 0x14003a859
lea r9, [rsp + 0x40]
mov rcx, rbx
call fcn.140003380
mov sil, 1
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003a8ea
mov rdi, qword [rbx + 0x18]
mov rax, rbx
cmp rdi, 8
jb 0x14003a879
mov rax, qword [rbx]
cmp word [rax + rcx*2 - 2], 0x5c
jne 0x14003a8ea
lea rdx, [rcx - 1]
cmp rdx, rcx
ja 0x14003a89d
mov qword [rbx + 0x10], rdx
cmp rdi, 8
jb 0x14003a897
mov rbx, qword [rbx]
mov word [rbx + rdx*2], bp
jmp 0x14003a8ea
mov rax, rdi
sub rax, rcx
cmp rax, 0xffffffffffffffff
jb 0x14003a8d0
mov qword [rbx + 0x10], rdx
cmp rdi, 8
jb 0x14003a8b6
mov rbx, qword [rbx]
lea rdi, [rbx + rcx*2]
movzx eax, bp
movabs rcx, 0x7fffffffffffffff
rep stosw word [rdi], ax
mov word [rbx + rdx*2], bp
jmp 0x14003a8ea
mov r9, 0xffffffffffffffff
mov word [rsp + 0x20], bp
mov rdx, r9
xor r8d, r8d
mov rcx, rbx
call fcn.14003c210
movzx eax, sil
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140079b50
mov rbx, qword [rsp + 0x290]
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret
Function at 0x14003a920
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
xor r9d, r9d
lea r8d, [r9 + 0x2b]
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14003a9d3
lea rax, [rsp + 0x20]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14003a970
mov rax, qword [rdi + 0x18]
cmp rdx, rax
ja 0x14003a9af
mov rsi, rdi
cmp rax, 8
jb 0x14003a98f
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14007c470
xor eax, eax
mov word [rbx + rsi], ax
jmp 0x14003a9bc
lea r9, [rsp + 0x20]
mov rcx, rdi
call fcn.140003380
mov r8d, 6
lea rdx, str.Adobe
mov rcx, rdi
call fcn.140003670
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140079b50
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14003aa00
Capabilities:
Get common file path
Get program files directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rdi, rcx
xor r9d, r9d
lea r8d, [r9 + 0x26]
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x14003aab3
lea rax, [rsp + 0x20]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x14003aa50
mov rax, qword [rdi + 0x18]
cmp rdx, rax
ja 0x14003aa8f
mov rsi, rdi
cmp rax, 8
jb 0x14003aa6f
mov rsi, qword [rdi]
mov qword [rdi + 0x10], rdx
lea rbx, [rdx + rdx]
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.14007c470
xor eax, eax
mov word [rbx + rsi], ax
jmp 0x14003aa9c
lea r9, [rsp + 0x20]
mov rcx, rdi
call fcn.140003380
mov r8d, 0x1b
lea rdx, str.AdobeAdobe_Creative_Cloud
mov rcx, rdi
call fcn.140003670
mov al, 1
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140079b50
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14003abd0
Capabilities:
Check if file exists
Create directory

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rcx + 0x18], 8
mov rbx, rcx
jb 0x14003abe3
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov rcx, qword [rbx + 0x18]
test eax, eax
je 0x14003ac0e
cmp rcx, 8
jb 0x14003abfa
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
setne al
add rsp, 0x40
pop rbx
ret
cmp rcx, 8
jb 0x14003ac17
mov rbx, qword [rbx]
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov ebx, eax
test eax, eax
je 0x14003acba
mov rax, qword [0x1400ed810]
test rax, rax
je 0x14003ac7e
lea r8, [0x1400c3148]
mov dword [rsp + 0x30], ebx
lea rdx, str.SHCreateDirectoryEx_failed._Error:__d
mov r9, r8
mov qword [rsp + 0x28], rdx
mov ecx, PathResolve
mov qword [rsp + 0x20], r8
lea rdx, str.OOBEUtils
lea r8, str.FileUtils
call qword [case.0x140049d6d.0]
test ebx, ebx
sete al
add rsp, 0x40
pop rbx
ret
mov rcx, qword [0x1400ed818]
test rcx, rcx
je 0x14003acba
mov rax, qword [rcx]
lea rdx, str.SHCreateDirectoryEx_failed._Error:__d
mov dword [rsp + 0x28], ebx
lea r9, str.FileUtils
mov qword [rsp + 0x20], rdx
lea r8, [0x1400c3148]
mov edx, PathResolve
mov rax, qword [rax + 0x68]
call qword [case.0x140049d6d.0]
test ebx, ebx
sete al
add rsp, 0x40
pop rbx
ret
Function at 0x14003bc90
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x280
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov r14, rdx
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor bpl, bpl
xor r15d, r15d
mov dword [rsp + 0x50], r15d
mov dword [rsp + 0x54], r15d
mov qword [rsp + 0x40], r15
cmp qword [rcx + 0x18], 8
jb 0x14003bcdf
mov rcx, qword [rcx]
lea rdx, [rsp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call fcn.14007cb40
test esi, esi
je 0x14003bdb1
mov ecx, esi
call fcn.140079f1c
mov rdi, rax
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14003bd1d
mov rcx, qword [rbx]
mov r9, rdi
mov r8d, esi
mov edx, dword [rsp + 0x50]
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x14003bda8
lea r9, [rsp + 0x54]
lea r8, [rsp + 0x40]
lea rdx, [0x1400c61c8]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x14003bda8
cmp dword [rsp + 0x54], r15d
je 0x14003bda8
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0xfeef04bd
jne 0x14003bda8
movzx r9d, word [rax + 0xa]
movzx r8d, word [rax + 8]
movzx edx, word [rax + 0xe]
movzx eax, word [rax + 0xc]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], r8d
lea r8, str._d._d._d._d
mov edx, 0x104
lea rcx, [rsp + 0x60]
call fcn.14002d720
lea rdx, [rsp + 0x60]
mov rcx, r14
call fcn.140002cb0
mov bpl, 1
mov rcx, rdi
call fcn.140079b70
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x14003bdec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14003bde7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003be27
mov rcx, r8
call fcn.140079b70
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 7
mov word [rbx], r15w
movzx eax, bpl
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140079b50
mov rbx, qword [rsp + 0x2c0]
add rsp, 0x280
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140080d34
int3
Function at 0x1400440d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
xor edi, edi
xor edx, edx
lea ecx, [rdi + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rsp + 0x20], 0x238
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004415e
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x14004412e
mov rdx, qword [rbx]
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x14004414c
mov ecx, dword [rsp + 0x28]
call fcn.140043950
test al, al
je 0x14004414c
inc edi
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140044121
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140079b50
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140044610
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14004466c
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, [0x1400c61d0]
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x30]
test eax, eax
jne 0x140044680
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x68
ret
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x44], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x140044666
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x68
ret
Function at 0x140045710
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
push rsi
mov eax, 0x2068
call fcn.14007aa20
sub rsp, rax
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x2050], rax
mov rsi, rcx
mov r8b, 1
mov rcx, rdx
mov rbx, rdx
call fcn.140042b20
test eax, eax
je 0x140045762
cmp eax, 1
jne 0x14004575b
movzx edx, al
mov rcx, rbx
call fcn.14003b560
test al, al
jne 0x140045762
xor al, al
jmp 0x14004587a
mov qword [rsp + 0x2090], rbp
xor ebp, ebp
cmp qword [rsi + 0x18], 8
mov qword [rsp + 0x2060], rdi
mov edi, ebp
jb 0x140045780
mov rsi, qword [rsi]
xor r9d, r9d
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], 0x80
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp qword [rbx + 0x18], 8
mov rsi, rax
jb 0x1400457b7
mov rbx, qword [rbx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x200080
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140045800
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14004586a
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rbp
mov r8d, 0x1000
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140045841
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x44]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x140045849
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp dword [rsp + 0x40], 0x1000
je 0x140045800
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
sete al
mov rbp, qword [rsp + 0x2090]
mov rdi, qword [rsp + 0x2060]
mov rcx, qword [rsp + 0x2050]
xor rcx, rsp
call fcn.140079b50
add rsp, 0x2068
pop rsi
pop rbx
ret
Function at 0x14004d660
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x40
cmp dword [rcx], 0
lea r14, [rcx + 0x10]
mov r15, rdx
lea rsi, [rcx + 8]
jne 0x14004d7f9
mov rcx, qword [r14]
sub rcx, qword [rsi]
sar rcx, 4
cmp rcx, 2
jle 0x14004d7f9
movups xmm0, xmmword [rdx]
mov qword [rsp + 0x60], rbx
mov rdx, rcx
shr rdx, 1
mov ebx, 1
add rdx, rcx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rdi
movups xmmword [rsp + 0x28], xmm0
cmp rbx, rdx
jae 0x14004d6c8
nop dword [rax]
add rbx, rbx
cmp rbx, rdx
jb 0x14004d6c0
lea rbp, [rbx*8]
mov rcx, r15
mov rdx, rbp
call fcn.14004c400
mov rdi, rax
test rax, rax
jne 0x14004d725
mov rcx, qword [r15]
mov rdi, qword [rsp + 0x28]
cmp rcx, rdi
je 0x14004d700
mov rbx, qword [rcx]
call fcn.140080e14
mov rcx, rbx
cmp rbx, rdi
jne 0x14004d6f0
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov qword [r15], rdi
mov rdi, qword [rsp + 0x70]
mov qword [r15 + 8], rax
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
mov r8, rbp
xor edx, edx
mov rcx, rdi
call fcn.14007cb40
mov rsi, qword [rsi]
mov r11, rsi
cmp rsi, qword [r14]
je 0x14004d7d0
mov rax, qword [r11 + 8]
test rax, rax
je 0x14004d74f
xor r8d, r8d
jmp 0x14004d752
mov r8, qword [r11]
test rax, rax
cmovne r8, rax
test r8, r8
je 0x14004d7c3
mov eax, r8d
lea r10, [rbx - 1]
shr eax, 0x10
xor eax, r8d
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul eax, eax, 0xc2b2ae35
mov ecx, eax
shr rax, 0x10
xor rax, rcx
and rax, r10
xor ecx, ecx
nop dword [rax]
mov rdx, qword [rdi + rax*8]
lea r9, [rdi + rax*8]
test rdx, rdx
je 0x14004d7b5
cmp rdx, r8
je 0x14004d7c3
inc rax
add rax, rcx
inc rcx
and rax, r10
cmp rcx, r10
jbe 0x14004d790
jmp 0x14004d7c3
mov qword [r9], r8
movups xmm0, xmmword [r11]
movups xmmword [rsi], xmm0
add rsi, 0x10
add r11, 0x10
cmp r11, qword [r14]
jne 0x14004d741
mov rdi, qword [rsp + 0x28]
mov qword [r14], rsi
mov rcx, qword [r15]
cmp rcx, rdi
je 0x14004d700
mov rbx, qword [rcx]
call fcn.140080e14
mov rcx, rbx
cmp rbx, rdi
jne 0x14004d7e4
jmp 0x14004d700
mov r11, qword [r14]
mov rcx, qword [rsi]
mov rdx, r11
sub rdx, rcx
mov rax, rdx
and rax, 0xfffffffffffffff0
cmp rax, 0x10
jle 0x14004d840
mov r10, qword [rcx]
mov r9, qword [rcx + 0x10]
cmp r10, r9
jne 0x14004d828
mov rax, qword [rcx + 0x18]
cmp qword [rcx + 8], rax
je 0x14004d840
sub rdx, 0x10
add rcx, 0x10
mov rax, rdx
mov r10, r9
and rax, 0xfffffffffffffff0
cmp rax, 0x10
jg 0x14004d815
cmp rcx, r11
je 0x14004d886
mov rdx, rcx
add rcx, 0x10
cmp rcx, r11
je 0x14004d882
mov rax, qword [rdx]
cmp qword [rcx], rax
jne 0x14004d86c
mov rax, qword [rdx + 8]
cmp qword [rcx + 8], rax
jne 0x14004d86c
add rcx, 0x10
mov rax, rcx
jmp 0x14004d87d
movups xmm0, xmmword [rcx]
add rdx, 0x10
lea rax, [rcx + 0x10]
mov rcx, rax
movups xmmword [rdx], xmm0
cmp rax, r11
jne 0x14004d851
lea rcx, [rdx + 0x10]
mov qword [r14], rcx
add rsp, 0x40
pop r15
pop r14
pop rsi
ret
Function at 0x140053670
Capabilities:
Encode data using xor

Disassembly:
movzx eax, word [rdx]
xor r8d, r8d
mov r11, rdx
mov r10, rcx
mov r9, rdx
test ax, ax
je 0x1400536a7
movzx eax, ax
lea r9, [r9 + 2]
add eax, r8d
imul r8d, eax, 0x401
mov eax, r8d
shr eax, 6
xor r8d, eax
movzx eax, word [r9]
test ax, ax
jne 0x140053684
lea eax, [r8 + r8*8]
mov ecx, eax
shr rax, 0xb
xor rax, rcx
and eax, 0x3f
mov r8, qword [r10 + rax*8]
test r8, r8
je 0x140053712
mov ecx, dword [r8]
sub ecx, 1
je 0x1400536e7
sub ecx, 1
je 0x1400536e1
sub ecx, 1
je 0x1400536e1
cmp ecx, 1
je 0x1400536db
xor eax, eax
jmp 0x1400536eb
lea rax, [r8 + 0x12]
jmp 0x1400536eb
lea rax, [r8 + 0x18]
jmp 0x1400536eb
lea rax, [r8 + 0x38]
mov r9, r11
sub r9, rax
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x140053705
add rax, 2
test ecx, ecx
jne 0x1400536f1
test edx, edx
je 0x140053715
mov r8, qword [r8 + 8]
test r8, r8
jne 0x1400536c0
xor eax, eax
ret
mov rax, r8
ret
Function at 0x14005c3a0
Capabilities:
Create directory
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x1400e9070]
xor rax, rsp
mov qword [rsp + 0x48], rax
cmp byte [0x1400ed7fd], 0
jne 0x14005c5bd
mov ecx, 0xb8
call fcn.140079b80
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0xb8
mov rcx, rax
call fcn.14007cb40
mov rcx, rbx
call fcn.140037f80
nop
mov qword [0x1400ed828], rbx
mov ecx, 0x180
call fcn.140079b80
mov rbx, rax
mov qword [rsp + 0x20], rax
xor edx, edx
mov r8d, 0x180
mov rcx, rax
call fcn.14007cb40
mov rcx, rbx
call fcn.1400315a0
nop
mov rcx, qword [0x1400ed828]
mov qword [rcx + 0xb0], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], ax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, eax
test eax, eax
je 0x14005c4a8
lea ecx, [rax + 1]
movsxd rdx, ecx
mov eax, 2
mul rdx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140080e28
mov rbx, rax
test rax, rax
je 0x14005c4a8
mov rdx, rax
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x14005c4a0
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.140002cb0
mov rcx, rbx
call fcn.140080e14
mov r8d, 0x11
lea rdx, str.CreativeCloudACC
lea rcx, [rsp + 0x28]
call fcn.140003670
mov r8d, 1
lea rdx, [0x1400c61c8]
lea rcx, [rsp + 0x28]
call fcn.140003670
mov r8d, 0xd
lea rdx, str.AdobeDownload
lea rcx, [rsp + 0x28]
call fcn.140003670
lea rdx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rdx, qword [rsp + 0x28]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x14005c51f
cmp eax, 0xb7
je 0x14005c51f
cmp eax, 0x50
je 0x14005c51f
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae r8, qword [rsp + 0x28]
lea rdx, [0x1400cecd8]
mov rcx, qword [0x1400ed828]
mov rcx, qword [rcx + 0xb0]
call fcn.1400374c0
mov rcx, qword [0x1400ed828]
mov rcx, qword [rcx + 0xb0]
call fcn.140036e40
call fcn.14002c740
mov rdx, qword [0x1400ed828]
mov rdx, qword [rdx + 0xb0]
mov rcx, rax
call fcn.14002c7e0
mov byte [0x1400ed7fd], 1
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x14005c5bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005c5b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005c5d5
call fcn.140079b70
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140079b50
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
call fcn.140080d34
int3
Function at 0x14005ed90
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
lea rax, vtable.WorkerThread.0
mov qword [rcx], rax
mov rcx, qword [rcx + 0x40]
test rcx, rcx
je 0x14005ee1b
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, eax
test eax, eax
je 0x14005ee09
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x14005edd6
cmp byte [0x1400ed7fd], 0
jne 0x14005ede2
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
mov r9d, edi
mov r8d, dword [rbx + 0x64]
lea rdx, str.Forcing_the_thread___d__to_terminate_forcibly._Thread_seem_to_get_hanged._Error____d
mov rax, qword [rax + 0x28]
call qword [case.0x140049d6d.0]
xor edx, edx
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x40], 0
lea rcx, [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
nop
mov edx, 0x68
mov rcx, rbx
call fcn.140079b70
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140060ef0
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
mov qword [rax - 0x18], 0
xor r9d, r9d
mov r14, r8
mov dword [rax - 0x20], 0x80
mov rbx, rdx
mov dword [rax - 0x28], 3
mov edx, 0x40000000
mov rbp, rcx
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140060f9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [0x1400ed828]
mov dword [rbx], eax
test rdi, rdi
je 0x140060f60
cmp byte [0x1400ed7fd], 0
jne 0x140060f6c
call fcn.14005c3a0
mov rdi, qword [0x1400ed828]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
mov r9, rbp
mov rax, qword [rbx + 0x48]
lea r8, str.Failed_to_open_the_file_handle_at__s._Error___d_
lea rdx, [0x1400c3148]
mov rcx, rdi
call qword [case.0x140049d6d.0]
xor al, al
jmp 0x14006109d
mov rcx, qword [0x1400ed828]
test rcx, rcx
je 0x140060fb3
cmp byte [0x1400ed7fd], 0
jne 0x140060fbf
call fcn.14005c3a0
mov rcx, qword [0x1400ed828]
mov rax, qword [rcx]
lea rdx, str.file_size_to_which_we_have_to_extend_is__llu
mov r8, r14
mov rax, qword [rax + 8]
call qword [case.0x140049d6d.0]
xor r9d, r9d
xor r8d, r8d
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x14006103b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
je 0x140061000
mov bl, 1
jmp 0x140061091
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [0x1400ed828]
mov dword [rbx], eax
test rdi, rdi
je 0x14006101d
cmp byte [0x1400ed7fd], 0
jne 0x140061029
call fcn.14005c3a0
mov rdi, qword [0x1400ed828]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_set_the_end_of_the_file_to_size__llu._Error____d
jmp 0x140061074
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdi, qword [0x1400ed828]
mov dword [rbx], eax
test rdi, rdi
je 0x140061058
cmp byte [0x1400ed7fd], 0
jne 0x140061064
call fcn.14005c3a0
mov rdi, qword [0x1400ed828]
mov rbx, qword [rdi]
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_resize_the_file_to_size__ld._Error____d
mov dword [rsp + 0x20], eax
lea rdx, [0x1400c3148]
mov rax, qword [rbx + 0x48]
mov r9, r14
mov rcx, rdi
call qword [case.0x140049d6d.0]
xor bl, bl
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret