joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000a8e0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
lea r8, [0x14002c080]
nop dword [rax]
mov ecx, edx
mov eax, edx
inc edx
shr eax, 1
and ecx, 1
lea r8, [r8 + 4]
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
dec eax
not eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x14000a8f0
ret

Function at 0x14000aac0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rax, qword [rdx + 8]
mov rbx, rcx
mov rdi, rdx
mov qword [rcx + 0x10], rax
mov rax, qword [rdx + 0x20]
mov qword [rcx + 0x18], rax
mov rcx, qword [rcx + 0x4b8]
call fcn.14000c620
mov rcx, qword [rdi + 8]
mov rdx, qword [rbx + 0x18]
sub rcx, qword [rbx + 0x10]
mov rsi, qword [rbx + 0x30]
mov r14d, eax
add qword [rbx + 0x48], rcx
mov rcx, qword [rdi + 0x20]
sub rcx, rdx
add qword [rbx + 0x50], rcx
cmp qword [rbx + 0x48], rsi
ja 0x14000ac1c
mov r10, qword [rbx + 0x38]
cmp qword [rbx + 0x50], r10
ja 0x14000ac1c
mov r11d, dword [rbx + 0x24]
mov qword [rsp + 0x30], r15
lea r15, [0x14002c080]
cmp r11d, 1
jne 0x14000ab83
mov r8, qword [rdi + 0x18]
mov r9, qword [rdi + 0x20]
lea r8, [rdx + r8]
sub r9, rdx
mov edx, dword [rbx + 0x20]
not edx
je 0x14000ab7e
nop dword [rax]
movzx eax, byte [r8]
movzx ecx, dl
lea r8, [r8 + 1]
xor rcx, rax
mov eax, edx
mov edx, dword [r15 + rcx*4]
shr eax, 8
xor edx, eax
dec r9
jne 0x14000ab60
not edx
mov dword [rbx + 0x20], edx
cmp r14d, 1
jne 0x14000ac17
cmp rsi, 0xffffffffffffffff
je 0x14000ab99
cmp rsi, qword [rbx + 0x48]
jne 0x14000aba5
cmp r10, 0xffffffffffffffff
je 0x14000abc5
cmp r10, qword [rbx + 0x50]
je 0x14000abc5
mov eax, 7
mov r15, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, dword [rbx + 0x40]
lea r8, [rbx + 0x60]
add rax, qword [rbx + 0x48]
add qword [r8], rax
cmp r11d, 1
jne 0x14000abdd
add qword [r8], 4
mov rax, qword [rbx + 0x50]
mov r9d, 0x18
add qword [rbx + 0x68], rax
mov eax, dword [rbx + 0x70]
not eax
movzx ecx, byte [r8]
movzx edx, al
lea r8, [r8 + 1]
xor rdx, rcx
mov ecx, eax
mov eax, dword [r15 + rdx*4]
shr ecx, 8
xor eax, ecx
dec r9
jne 0x14000abf0
inc qword [rbx + 0x58]
not eax
mov dword [rbx + 0x70], eax
mov eax, r14d
jmp 0x14000abaa
mov eax, 7
jmp 0x14000abaf
Function at 0x14000ac30
Capabilities:
Encode data using xor

Disassembly:
mov r10, qword [rdx + 8]
mov eax, dword [rcx + 0x20]
mov r11, rcx
sub r10, qword [rcx + 0x10]
not eax
add qword [rcx + 0x80], r10
mov r9, qword [rdx]
add r9, qword [rcx + 0x10]
test r10, r10
je 0x14000ac7e
lea r8, [0x14002c080]
nop word [rax + rax]
movzx ecx, byte [r9]
movzx edx, al
lea r9, [r9 + 1]
xor rdx, rcx
mov ecx, eax
mov eax, dword [r8 + rdx*4]
shr ecx, 8
xor eax, ecx
dec r10
jne 0x14000ac60
not eax
mov dword [r11 + 0x20], eax
ret

Function at 0x14000ac90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r9, rdx
mov rax, rcx
xor ebx, ebx
lea rdi, [0x14002c080]
nop dword [rax]
mov r10, qword [r9 + 0x10]
mov r11, qword [r9]
cmp dword [rax + 4], ebx
jne 0x14000acc0
mov qword [rax + 8], rbx
cmp qword [r9 + 8], r10
jae 0x14000ad0b
nop word [rax + rax]
mov rcx, qword [r9 + 8]
inc rcx
movzx r8d, byte [rcx + r11 - 1]
mov qword [r9 + 8], rcx
mov ecx, dword [rax + 4]
mov edx, r8d
and edx, 0x7f
shl rdx, cl
or qword [rax + 8], rdx
test r8b, r8b
jns 0x14000ad65
add ecx, 7
mov dword [rax + 4], ecx
cmp ecx, 0x3f
je 0x14000ae2d
cmp qword [r9 + 8], r10
jb 0x14000acd0
mov r10, qword [r9 + 8]
mov r8d, dword [rax + 0x20]
sub r10, qword [rax + 0x10]
not r8d
add qword [rax + 0x80], r10
mov r9, qword [r9]
add r9, qword [rax + 0x10]
test r10, r10
je 0x14000ad51
nop dword [rax]
movzx ecx, byte [r9]
movzx edx, r8b
lea r9, [r9 + 1]
xor rdx, rcx
mov ecx, r8d
mov r8d, dword [rdi + rdx*4]
shr ecx, 8
xor r8d, ecx
dec r10
jne 0x14000ad30
not r8d
mov dword [rax + 0x20], r8d
mov eax, ebx
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
jne 0x14000ad6f
cmp ecx, ebx
jne 0x14000ae2d
mov edx, dword [rax + 0x78]
mov dword [rax + 4], ebx
test edx, edx
je 0x14000adf8
dec edx
je 0x14000ade4
dec edx
jne 0x14000ae10
mov rcx, qword [rax + 8]
mov r8d, dword [rax + 0xa0]
lea r11d, [rdx + 0x18]
add qword [rax + 0x98], rcx
not r8d
lea r10, [rax + 0x90]
nop word [rax + rax]
movzx ecx, byte [r10]
movzx edx, r8b
lea r10, [r10 + 1]
xor rdx, rcx
mov ecx, r8d
mov r8d, dword [rdi + rdx*4]
shr ecx, 8
xor r8d, ecx
dec r11
jne 0x14000adb0
dec qword [rax + 0x88]
not r8d
mov dword [rax + 0xa0], r8d
jmp 0x14000ae09
mov rcx, qword [rax + 8]
mov dword [rax + 0x78], 2
add qword [rax + 0x90], rcx
jmp 0x14000ae10
mov rcx, qword [rax + 8]
mov qword [rax + 0x88], rcx
cmp rcx, qword [rax + 0x58]
jne 0x14000ae37
mov dword [rax + 0x78], 1
cmp qword [rax + 0x88], rbx
ja 0x14000acb0
mov eax, 1
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov ebx, 7
jmp 0x14000ad0b
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov eax, 7
ret
Function at 0x14000aea0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov eax, dword [rcx + 0xb8]
mov r8, rcx
cmp eax, dword [0x140024e98]
jne 0x14000af81
movzx eax, word [rcx + 0xbc]
cmp ax, word [0x140024e9c]
jne 0x14000af81
mov qword [rsp], rbx
mov r10d, 2
lea r9, [rcx + 0xbe]
lea rbx, [0x14002c080]
or edx, 0xffffffff
nop dword [rax + rax]
movzx eax, byte [r9]
movzx ecx, dl
lea r9, [r9 + 1]
xor rcx, rax
mov eax, edx
mov edx, dword [rbx + rcx*4]
shr eax, 8
xor edx, eax
dec r10
jne 0x14000aef0
movzx eax, byte [r8 + 0xc2]
movzx ecx, byte [r8 + 0xc3]
mov rbx, qword [rsp]
shl ecx, 8
not edx
or ecx, eax
movzx eax, byte [r8 + 0xc1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xc0]
shl ecx, 8
or ecx, eax
cmp edx, ecx
je 0x14000af4f
lea eax, [r10 + 7]
add rsp, 8
ret
cmp byte [r8 + 0xbe], 0
je 0x14000af63
mov eax, 6
add rsp, 8
ret
movzx ecx, byte [r8 + 0xbf]
xor eax, eax
mov edx, 6
cmp ecx, 1
mov dword [r8 + 0x24], ecx
cmovg eax, edx
add rsp, 8
ret
mov eax, 5
add rsp, 8
ret

Function at 0x14000af90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
movzx eax, word [rcx + 0xc2]
mov r8, rcx
cmp ax, word [0x140024ea0]
jne 0x14000b081
mov qword [rsp], rbx
mov r10d, 6
lea r9, [rcx + 0xbc]
lea rbx, [0x14002c080]
or edx, 0xffffffff
nop word [rax + rax]
movzx eax, byte [r9]
movzx ecx, dl
lea r9, [r9 + 1]
xor rcx, rax
mov eax, edx
mov edx, dword [rbx + rcx*4]
shr eax, 8
xor edx, eax
dec r10
jne 0x14000afd0
movzx eax, byte [r8 + 0xba]
movzx ecx, byte [r8 + 0xbb]
mov rbx, qword [rsp]
shl ecx, 8
not edx
or ecx, eax
movzx eax, byte [r8 + 0xb9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xb8]
shl ecx, 8
or ecx, eax
cmp edx, ecx
jne 0x14000b081
movzx eax, byte [r8 + 0xbe]
movzx ecx, byte [r8 + 0xbf]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xbd]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 0xbc]
shl ecx, 8
or rcx, rax
mov rax, qword [r8 + 0x80]
shr rax, 2
cmp rax, rcx
jne 0x14000b081
cmp byte [r8 + 0xc0], r10b
jne 0x14000b081
movzx eax, byte [r8 + 0xc1]
cmp eax, dword [r8 + 0x24]
lea eax, [r10 + 1]
je 0x14000b086
mov eax, 7
add rsp, 8
ret
Function at 0x14000b090
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
add qword [rcx + 0xb0], 0xfffffffffffffffc
mov r10, qword [rcx + 0xb0]
or edx, 0xffffffff
mov rbx, rcx
lea r8, [rcx + 0xb8]
mov r9, r10
test r10, r10
je 0x14000b0ee
lea r11, [0x14002c080]
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, dl
lea r8, [r8 + 1]
xor rcx, rax
mov eax, edx
mov edx, dword [r11 + rcx*4]
shr eax, 8
xor edx, eax
dec r9
jne 0x14000b0d0
movzx eax, byte [r10 + rbx + 0xba]
movzx ecx, byte [r10 + rbx + 0xbb]
not edx
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + rbx + 0xb9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r10 + rbx + 0xb8]
shl ecx, 8
or ecx, eax
cmp edx, ecx
je 0x14000b137
mov eax, 7
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rdi
lea rdi, [rbx + 0xa8]
mov qword [rdi], 2
movzx eax, byte [rbx + 0xb9]
test al, 0x3f
jne 0x14000b297
test al, 0x40
je 0x14000b185
lea rdx, [rbx + 0xb8]
mov r9, r10
mov r8, rdi
mov rcx, rbx
call fcn.14000aa40
cmp eax, 1
jne 0x14000b213
mov rax, qword [rbx + 8]
mov qword [rbx + 0x30], rax
jmp 0x14000b18d
mov qword [rbx + 0x30], 0xffffffffffffffff
test byte [rbx + 0xb9], 0x80
je 0x14000b1be
mov r9, qword [rbx + 0xb0]
lea rdx, [rbx + 0xb8]
mov r8, rdi
mov rcx, rbx
call fcn.14000aa40
cmp eax, 1
jne 0x14000b213
mov rax, qword [rbx + 8]
mov qword [rbx + 0x38], rax
jmp 0x14000b1c6
mov qword [rbx + 0x38], 0xffffffffffffffff
mov rcx, qword [rbx + 0xb0]
mov rdx, qword [rdi]
mov rax, rcx
sub rax, rdx
cmp rax, 2
jb 0x14000b213
movzx eax, byte [rdx + rbx + 0xb8]
lea r8, [rdx + 1]
mov qword [rdi], r8
cmp al, 0x21
jne 0x14000b297
movzx eax, byte [r8 + rbx + 0xb8]
inc r8
mov qword [rdi], r8
cmp al, 1
jne 0x14000b297
sub rcx, r8
cmp rcx, 1
jae 0x14000b228
mov eax, 7
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
movzx edx, byte [r8 + rbx + 0xb8]
mov rcx, qword [rbx + 0x4b8]
lea rax, [r8 + 1]
mov qword [rdi], rax
call fcn.14000ca30
test eax, eax
jne 0x14000b287
mov rdx, qword [rbx + 0xb0]
cmp qword [rdi], rdx
jae 0x14000b27a
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rdi]
inc rax
movzx ecx, byte [rax + rbx + 0xb7]
mov qword [rdi], rax
test cl, cl
jne 0x14000b297
cmp rax, rdx
jb 0x14000b260
xor eax, eax
mov qword [rdi], rax
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x50], rax
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov eax, 6
add rsp, 0x20
pop rsi
ret

Function at 0x1400105e8
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.140010450
Function at 0x140005970
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rax, qword [0x140160188]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
lea rdx, [rcx + 0x4f0]
call fcn.140005130
test al, al
jne 0x140005ac9
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14012f590]
movdqu xmmword [rsp + 0x38], xmm1
xor esi, esi
mov word [rsp + 0x28], si
xor r8d, r8d
lea rdx, [0x140125f54]
lea rcx, [rsp + 0x28]
call fcn.140003470
nop
lea rdx, [rsp + 0x28]
lea rcx, [rdi + 0x58]
call fcn.140008db0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140005a33
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005a2e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005ae8
call fcn.1400cea54
movdqa xmm0, xmmword [0x14012f590]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], si
cmp byte [rdi + 0x308], 0
jne 0x140005ab7
lea rcx, [rdi + 0x58]
call fcn.140012910
lea r8, [rdi + 0x58]
cmp qword [rdi + 0x70], 8
jb 0x140005a67
mov r8, qword [rdi + 0x58]
cmp qword [rdi + 0x68], 7
jne 0x140005a9f
mov edx, 7
lea rcx, [0x140125f90]
sub r8, rcx
nop dword [rax]
movzx eax, word [rcx]
cmp word [r8 + rcx], ax
jne 0x140005a9f
add rcx, 2
sub rdx, 1
jne 0x140005a80
lea rcx, [rdi + 0x58]
call fcn.140009050
jmp 0x140005aa8
lea rcx, [rdi + 0x58]
call fcn.140009000
test al, al
jne 0x140005ac9
lea rcx, [rdi + 0x58]
call fcn.1400136e0
jmp 0x140005ac9
mov edx, 0x17ec
lea rcx, [0x140009d00]
call qword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce670
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call fcn.1400d3cc4
int3

Function at 0x140005ba0
Capabilities:
Enumerate gui resources

Disassembly:
push rbx
sub rsp, 0x20
lea rdx, [rcx + 0x4f0]
mov rbx, rcx
call fcn.140005130
test al, al
jne 0x140005bd4
lea rcx, [rbx + 0x58]
call fcn.140009150
mov edx, 0x18b4
lea rcx, [0x140009d00]
call qword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x140005eb0
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov rax, qword [0x140160188]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rcx
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x38], xmm0
movdqa xmm1, xmmword [0x14012f590]
movdqu xmmword [rsp + 0x38], xmm1
xor edi, edi
mov word [rsp + 0x28], di
xor r8d, r8d
lea rdx, [0x140125f54]
lea rcx, [rsp + 0x28]
call fcn.140003470
nop
lea rcx, [rbx + 0x58]
lea rdx, [rsp + 0x28]
call fcn.140008db0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 8
jb 0x140005f56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005f95
call fcn.1400cea54
movdqa xmm0, xmmword [0x14012f590]
movdqu xmmword [rsp + 0x38], xmm0
mov word [rsp + 0x28], di
mov edx, 0x1788
lea rcx, [0x140009d00]
call qword [sym.imp.USER32.dll_EnumWindows]
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400ce670
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
call fcn.1400d3cc4
int3
Function at 0x140019900
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov qword [rcx], 0
mov rbx, rcx
mov word [rcx + 8], 0
cmp qword [rdx + 0x10], 0
je 0x140019929
cmp qword [rdx + 0x18], 8
jb 0x14001992b
mov rdx, qword [rdx]
jmp 0x14001992b
xor edx, edx
mov r8, rdx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x14001995a
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
mov rax, rbx
jne 0x14001995d
mov byte [rbx + 9], 1
add rsp, 0x20
pop rbx
ret
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x1400199b0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x140160188]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x1400199ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
mov qword [rsp + 0x28], rbp
lea rcx, [rsp + 0x28]
call fcn.140020ba0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x140019a14
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x140019a27
cmp qword [rsi + 0x18], 8
jb 0x140019a2a
mov rsi, qword [rsi]
jmp 0x140019a2a
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x140019a4e
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140019a4e
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x140019a75
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140019a88
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov edx, 0x58
mov rcx, rbx
call fcn.1400cea54
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ce670
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140019ac0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rax, qword [0x140160188]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x140019b05
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r14
mov word [rdi + 8], r14w
mov qword [rsp + 0x28], r14
lea rcx, [rsp + 0x28]
call fcn.140020cc0
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rbp, [rbx + 0x10]
jne 0x140019b2c
mov rbp, r14
cmp qword [rsi + 0x10], 0
je 0x140019b42
mov r8, rsi
cmp qword [rsi + 0x18], 8
jb 0x140019b45
mov r8, qword [rsi]
jmp 0x140019b45
mov r8, r14
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
jne 0x140019b93
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x140019b93
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsi + 0x10], 0
je 0x140019b7f
cmp qword [rsi + 0x18], 8
jb 0x140019b82
mov rsi, qword [rsi]
jmp 0x140019b82
mov rsi, r14
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
mov rax, qword [rdi]
test rax, rax
je 0x140019bba
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x140019bac
mov byte [rdi + 9], 1
mov rcx, qword [rdi]
call fcn.14001f340
mov rax, qword [rdi]
test rax, rax
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x140019bdd
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140019bf0
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov edx, 0x58
mov rcx, rbx
call fcn.1400cea54
mov qword [rsp + 0x28], r14
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ce670
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x14001d430
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x170
mov rax, qword [0x140160188]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbx, rcx
xor edx, edx
lea rcx, [rsp + 0x44]
mov r8d, 0x110
call fcn.1400d1170
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x14001d4b7
cmp dword [rsp + 0x44], 6
jb 0x14001d4b7
lea rax, [rsp + 0x34]
mov dword [rsp + 0x34], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
lea r8, str.Progid
mov rcx, 0xffffffff80000001
lea rdx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
call fcn.14001d260
test al, al
je 0x14001d4b7
cmp word [rbx], 0
jne 0x14001d521
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.http_shellopencommand
mov rcx, 0xffffffff80000000
call fcn.14001d260
test al, al
je 0x14001d4ec
cmp word [rbx], 0
jne 0x14001d521
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x207
mov r9, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, str.SoftwareClasses.html
mov rcx, 0xffffffff80000001
call fcn.14001d260
test al, al
je 0x14001d525
cmp word [rbx], 0
je 0x14001d525
mov al, 1
jmp 0x14001d527
xor al, al
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400ce670
add rsp, 0x170
pop rbx
ret
Function at 0x14001ded0
Capabilities:
Check os version

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x140160188]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rbx, rcx
mov ecx, 1
call fcn.1400ce694
mov qword [rbx], rax
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x118
mov byte [rax], 0
call fcn.1400d1170
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov rax, rbx
je 0x14001df37
cmp dword [rsp + 0x24], 6
mov rcx, qword [rbx]
setae dl
mov byte [rcx], dl
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1400ce670
add rsp, 0x150
pop rbx
ret
Function at 0x140021d60
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 8]
mov rbx, r9
mov edi, r8d
test rax, rax
je 0x140021db2
mov rax, qword [rax]
test rax, rax
je 0x140021db2
test rdx, rdx
je 0x140021db2
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x140021db2
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140021db2
cmp edi, dword [rbx]
sete al
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor al, al
add rsp, 0x30
pop rdi
ret
Function at 0x1400251a0
Capabilities:
Read file on windows

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov qword [r11 - 0x60], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rax, qword [0x140160188]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r13, r8
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rdx]
test rcx, rcx
je 0x14002538a
cmp qword [rcx], 0xffffffffffffffff
je 0x14002538a
mov qword [r11 - 0x50], 0xffffffffffff8000
mov ebx, 2
mov r9d, ebx
lea r8, [r11 - 0x4c]
mov edx, 0xffff8000
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x48], eax
cmp eax, 0xffffffff
jne 0x140025225
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14002538a
mov ecx, 0x10000
call fcn.1400cf2d8
mov r15, rax
xor ebp, ebp
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x50], rax
xor edx, edx
mov r8d, 0x10000
mov rcx, rax
call fcn.1400d1170
mov dword [rsp + 0x40], ebp
mov rcx, qword [rsi]
test rcx, rcx
je 0x140025368
test r15, r15
je 0x140025368
cmp qword [rcx], 0xffffffffffffffff
je 0x140025368
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
mov r8d, 0x8000
mov rdx, r15
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140025368
xor ecx, ecx
mov ebp, ecx
mov esi, ecx
mov r14d, 0x8000
lea r12, [r15 + 0x8000]
nop dword [rax + rax]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x140025379
mov dword [rsp + 0x34], ecx
mov dword [rsp + 0x30], ecx
mov edx, esi
add rdx, r12
lea rax, [rsp + 0x34]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x30]
mov r8d, r14d
mov rcx, r13
call fcn.14003d2a0
test al, al
je 0x14002535d
mov eax, dword [rsp + 0x30]
test eax, eax
jne 0x14002531c
mov rcx, qword [rdi + 0x110]
test rcx, rcx
je 0x140025309
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
movzx eax, byte [rdi + 0xd8]
test al, al
jne 0x140025379
inc ebp
mov eax, dword [rsp + 0x30]
jmp 0x140025326
add esi, eax
cmp esi, 0x8000
je 0x140025337
cmp ebp, 0xf
ja 0x140025356
sub r14d, eax
je 0x140025337
xor ecx, ecx
jmp 0x1400252b0
mov r8d, 0x8000
mov rdx, r12
mov rcx, r15
call fcn.1400d1500
xor ebp, ebp
mov ebx, ebp
test eax, eax
setne bl
add ebx, 4
jmp 0x140025379
mov ebx, 3
jmp 0x140025379
mov eax, dword [rsp + 0x34]
mov ebx, 3
jmp 0x140025373
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 1
mov dword [rdi + 0x100], eax
test r15, r15
je 0x140025386
mov rcx, r15
call fcn.1400cea54
mov eax, ebx
jmp 0x14002538f
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400ce670
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret