joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1015770
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x0101c100]
jne 0x101578b
rol rcx, 0x10
test cx, 0xffff
jne 0x1015787
ret 0
ror rcx, 0x10
jmp 0x1015e3c
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x010201e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x010202d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x1015ec1
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x010201e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x1015ee3
mov rax, qword [rsp + 0x88]
mov qword [0x010202d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x01020278], rax
mov rax, qword [0x010202d8]
mov qword [0x01020150], rax
mov rax, qword [rsp + 0x90]
mov qword [0x01020260], rax
mov dword [0x01020140], 0xc0000409
mov dword [0x01020144], 1
mov rax, qword [0x0101c100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x0101c108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x01001438]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1015798
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x540
mov rax, qword [0x0101c100]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1015815
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x1015835
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, [0x01001400]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.01015770
add rsp, 0x540
pop rbx
ret

Function at 0x1015cd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
test rcx, rcx
je 0x1015d25
cmp rcx, 0xffffffffffffffff
je 0x1015d25
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1015d1d
cmp dword [rcx + 0x3c], edx
jl 0x1015d1d
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1015d1d
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1015d25
mov rax, rdx
add rsp, 0x18
ret
Function at 0x1018344
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
test rcx, rcx
jne 0x1018382
call qword [sym.imp.msvcrt.dll__errno]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [rax], 0x16
call fcn.01015864
jmp 0x101848f
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x101848f
test al, 0x40
jne 0x101848f
test al, 2
je 0x10183a4
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x101848f
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
je 0x101835d
mov rbx, qword [rcx + 0x10]
mov qword [rcx], rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov r8d, dword [rsi + 0x24]
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__read]
mov dword [rsi + 8], eax
test eax, eax
je 0x101847f
cmp eax, 0xffffffff
je 0x101847f
test byte [rsi + 0x18], 0x82
jne 0x101844a
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xffffffff
je 0x1018434
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xfffffffe
je 0x1018434
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
mov rbx, qword [sym.imp.msvcrt.dll___pioinfo]
mov rcx, rsi
movsxd rdi, eax
sar rdi, 5
call qword [sym.imp.msvcrt.dll__fileno]
mov r11d, eax
and r11d, 0x1f
imul r11, r11, 0x38
add r11, qword [rbx + rdi*8]
jmp 0x101843b
mov r11, qword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [r11 + 8]
and al, 0x82
cmp al, 0x82
jne 0x101844a
bts dword [rsi + 0x18], 0xd
cmp dword [rsi + 0x24], 0x200
jne 0x101846e
test byte [rsi + 0x18], 8
je 0x101846e
mov eax, dword [rsi + 0x24]
test dword [rsi + 0x18], 0x400
mov ecx, 0x1000
cmove eax, ecx
mov dword [rsi + 0x24], eax
mov rcx, qword [rsi]
dec dword [rsi + 8]
movzx eax, byte [rcx]
inc rcx
mov qword [rsi], rcx
jmp 0x1018492
neg eax
mov dword [rsi + 8], edi
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rsi + 0x18], eax
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x101a078
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
test rcx, rcx
jne 0x101a0b6
call qword [sym.imp.msvcrt.dll__errno]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
mov dword [rax], 0x16
call fcn.01015864
jmp 0x101a1ce
mov eax, dword [rcx + 0x18]
test al, 0x83
je 0x101a1ce
test al, 0x40
jne 0x101a1ce
test al, 2
je 0x101a0d8
or eax, 0x20
mov dword [rcx + 0x18], eax
jmp 0x101a1ce
or eax, 1
mov dword [rcx + 0x18], eax
test eax, 0x10c
je 0x101a091
mov rbx, qword [rcx + 0x10]
mov qword [rcx], rbx
call qword [sym.imp.msvcrt.dll__fileno]
mov r8d, dword [rsi + 0x24]
mov ecx, eax
mov rdx, rbx
call qword [sym.imp.msvcrt.dll__read]
mov dword [rsi + 8], eax
test eax, eax
je 0x101a1be
cmp eax, 1
je 0x101a1be
cmp eax, 0xffffffff
je 0x101a1be
test byte [rsi + 0x18], 0x82
jne 0x101a187
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xffffffff
je 0x101a171
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
cmp eax, 0xfffffffe
je 0x101a171
mov rcx, rsi
call qword [sym.imp.msvcrt.dll__fileno]
mov rbx, qword [sym.imp.msvcrt.dll___pioinfo]
mov rcx, rsi
movsxd rdi, eax
sar rdi, 5
call qword [sym.imp.msvcrt.dll__fileno]
mov r11d, eax
and r11d, 0x1f
imul r11, r11, 0x38
add r11, qword [rbx + rdi*8]
jmp 0x101a178
mov r11, qword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [r11 + 8]
and al, 0x82
cmp al, 0x82
jne 0x101a187
bts dword [rsi + 0x18], 0xd
cmp dword [rsi + 0x24], 0x200
jne 0x101a1ab
test byte [rsi + 0x18], 8
je 0x101a1ab
mov eax, dword [rsi + 0x24]
test dword [rsi + 0x18], 0x400
mov ecx, 0x1000
cmove eax, ecx
mov dword [rsi + 0x24], eax
mov rcx, qword [rsi]
add dword [rsi + 8], 0xfffffffe
movzx eax, word [rcx]
add rcx, 2
mov qword [rsi], rcx
jmp 0x101a1d3
neg eax
mov dword [rsi + 8], edi
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [rsi + 0x18], eax
mov eax, 0xffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1401025c0
Capabilities:
Create shortcut via ishelllink

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov rbx, rdx
lea rdi, [rcx + 8]
mov rcx, qword [rdi]
xor esi, esi
test rcx, rcx
je 0x1401025f3
mov qword [rdi], rsi
mov rax, qword [rcx]
call qword [rax + 0x10]
mov qword [rsp + 0x20], rdi
lea r9, [0x140149648]
xor edx, edx
lea r8d, [rdx + 1]
lea rcx, [0x140149668]
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov rcx, qword [rdi]
mov qword [rsp + 0x50], rsi
test rcx, rcx
je 0x140102640
mov rax, qword [rcx]
lea r8, [rsp + 0x50]
lea rdx, [0x1401496c8]
call qword [rax]
mov rcx, qword [rsp + 0x50]
test eax, eax
cmovs rcx, rsi
mov qword [rsp + 0x50], rcx
mov rcx, qword [rsp + 0x50]
test rcx, rcx
jne 0x140102651
mov ebx, 0x80004002
jmp 0x140102669
cmp qword [rbx + 0x18], 8
jb 0x14010265b
mov rbx, qword [rbx]
mov rax, qword [rcx]
xor r8d, r8d
mov rdx, rbx
call qword [rax + 0x28]
mov ebx, eax
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140102679
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x140688c00
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword gs:[0x60]
movabs r11, 0x688c70
movabs r10, 0x688c74
mov r9, qword [rax + 0x10]
xor eax, eax
movsxd rcx, dword [r9 + 0x3c]
movsxd r11, dword [r9 + r11]
add rcx, r9
mov r10d, dword [r9 + r10]
movzx r8d, word [rcx + 0x14]
add r8, rcx
cmp dword [r8 + 0x20], eax
jbe 0x140688c66
mov edx, eax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 0x24]
inc eax
add rcx, rdx
inc rdx
xor byte [rcx + r9], r10b
cmp eax, dword [r8 + 0x20]
jb 0x140688c50
lea rax, [r9 + r11]
jmp rax
Function at 0x140037540
Capabilities:
Create process on windows
Create process suspended
Inject apc
Resume thread
Self delete
Terminate process
Use process replacement

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
xor edi, edi
mov r14, rdx
mov dword [rsp + 0x68], edi
mov rbx, rcx
mov esi, edi
cmp r8d, 0x104
jb 0x140037578
xor al, al
jmp 0x14003776c
xor edx, edx
mov dword [rsp + 0x70], 0x68
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x60]
call fcn.140113400
xor eax, eax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov r15d, 4
mov qword [rsp + 0x60], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x48], rax
mov rdx, r14
lea rax, [rsp + 0x70]
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov r14d, eax
test eax, eax
je 0x140037766
mov eax, dword [rbx + 0x10]
xor edx, edx
mov rcx, qword [rsp + 0x50]
mov r9d, 0x1000
mov dword [rsp + 0x20], r15d
lea r8d, [rax*2 + 2]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r15, rax
test rax, rax
je 0x1400376ef
cmp qword [rbx + 0x18], 8
mov r9, qword [rbx + 0x10]
mov qword [rsp + 0x68], rdi
jb 0x14003762c
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x68]
lea r9, [r9*2 + 2]
mov qword [rsp + 0x20], rax
mov r8, rbx
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, [0x14014c55c]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14014c550]
mov rcx, rbx
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x14014c578]
mov rcx, rbx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test r12, r12
je 0x1400376ea
test rsi, rsi
je 0x1400376ea
test rax, rax
je 0x1400376ea
mov rdx, qword [rsp + 0x58]
mov r8d, 0x2710
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rdx, qword [rsp + 0x58]
mov r8, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rdx, qword [rsp + 0x58]
xor r8d, r8d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140037750
mov r14d, edi
jmp 0x140037750
cmp dword [0x14017c080], 2
jg 0x140037733
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, 2
lea rdx, str..._.._chrome_installer_setup_setup_util.cc
lea rcx, [rbp - 0x20]
mov dword [rsp + 0x20], eax
mov r8d, 0x1b0
call fcn.140068d00
lea rdx, [0x14014c568]
lea rcx, [rax + 0x10]
call fcn.14002bcb4
mov esi, 1
test sil, 1
je 0x140037742
lea rcx, [rbp - 0x20]
call fcn.140068d80
mov rcx, qword [rsp + 0x50]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r14d, r14d
setne al
add rsp, 0x1f0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14003feb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rbp + 0x4f], rax
mov rax, qword [0x14017c010]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx + 0x10]
lea rcx, [rbp + 0x2f]
mov rdx, qword [rdx + 0x28]
call fcn.140049374
mov rax, qword [0x14017c010]
lea r8, [rbp + 0x2f]
mov r9d, 0x101
mov rcx, qword [rax + 8]
mov al, byte [rcx + 0x38]
lea rcx, [rbp - 9]
neg al
sbb rdx, rdx
xor ebx, ebx
neg rdx
mov qword [rbp - 9], rbx
add rdx, 0xffffffff80000001
mov dword [rbp - 1], ebx
cmp qword [rbp + 0x47], 8
mov qword [rbp + 7], rbx
cmovae r8, qword [rbp + 0x2f]
call fcn.14005d790
test eax, eax
jne 0x14003ffab
mov rcx, qword [rbp - 9]
lea rdx, [0x140152878]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x14003ff60
mov bl, 1
jmp 0x14003ffab
lea r8, [rbp + 0xf]
mov qword [rbp + 0x27], 7
lea rdx, [0x140152890]
mov qword [rbp + 0x1f], rbx
lea rcx, [rbp - 9]
mov word [rbp + 0xf], bx
call fcn.14005db50
test eax, eax
jne 0x14003ff9d
lea rdx, [0x14014da88]
lea rcx, [rbp + 0xf]
call fcn.1400314b8
test eax, eax
setne bl
xor r8d, r8d
lea rcx, [rbp + 0xf]
mov dl, 1
call fcn.140029bc0
lea rcx, [rbp - 9]
call fcn.14005d610
xor r8d, r8d
lea rcx, [rbp + 0x2f]
mov dl, 1
call fcn.140029bc0
mov al, bl
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
Function at 0x14004e490
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rcx + 0x10]
xor esi, esi
mov dword [rsp + 0x20], esi
movzx r14d, dl
mov rdi, rcx
mov ebp, esi
test rax, rax
jne 0x14004e4cb
mov al, 1
jmp 0x14004e69a
cmp rax, 0x104
jb 0x14004e4da
xor al, al
jmp 0x14004e69a
lea rdx, [rsp + 0x28]
mov qword [rsp + 0x98], rbx
call fcn.14005a840
mov r9d, 2
lea rdx, [0x140150730]
xor r8d, r8d
mov rcx, rax
call fcn.1400509c0
lea rcx, [rsp + 0x28]
mov rbx, rax
call fcn.1400599c0
cmp rbx, 0xffffffffffffffff
je 0x14004e562
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14005a840
lea rdx, [rsp + 0x28]
mov rcx, rdi
mov rbx, rax
call fcn.14005a6a0
mov rcx, rax
movzx r8d, r14b
mov rdx, rbx
call fcn.14004dfa0
lea rcx, [rsp + 0x28]
movzx ebx, al
call fcn.1400599c0
lea rcx, [rsp + 0x48]
call fcn.1400599c0
movzx eax, bl
jmp 0x14004e692
cmp qword [rdi + 0x18], 8
jb 0x14004e56e
mov rcx, qword [rdi]
jmp 0x14004e571
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x14004e585
mov al, 1
jmp 0x14004e692
test bl, 1
je 0x14004e5ac
cmp qword [rdi + 0x18], 8
jb 0x14004e596
mov rcx, qword [rdi]
jmp 0x14004e599
mov rcx, rdi
mov edx, ebx
and edx, 0xfffffffe
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14004e690
test bl, 0x10
jne 0x14004e5ce
cmp qword [rdi + 0x18], 8
jb 0x14004e5bb
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
jmp 0x14004e692
test r14b, r14b
je 0x14004e618
mov ebp, 1
mov qword [rsp + 0x40], 7
mov r8d, ebp
mov qword [rsp + 0x38], rsi
lea rdx, [0x140150738]
mov word [rsp + 0x28], si
lea rcx, [rsp + 0x28]
call fcn.140029c40
movzx r8d, bpl
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.14004dfa0
test al, al
jne 0x14004e618
xor bl, bl
jmp 0x14004e61a
mov bl, 1
test bpl, 1
je 0x14004e672
mov rax, qword [rsp + 0x40]
cmp rax, 8
jb 0x14004e672
mov rcx, qword [rsp + 0x28]
inc rax
movabs rdx, 0x7fffffffffffffff
cmp rax, rdx
ja 0x14004e6b8
add rax, rax
cmp rax, 0x1000
jb 0x14004e66d
test cl, 0x1f
jne 0x14004e6be
mov rax, qword [rcx - 8]
cmp rax, rcx
jae 0x14004e6c4
sub rcx, rax
cmp rcx, 8
jb 0x14004e6ca
cmp rcx, 0x27
ja 0x14004e6d0
mov rcx, rax
call fcn.140111e78
test bl, bl
je 0x14004e690
cmp qword [rdi + 0x18], 8
jb 0x14004e680
mov rdi, qword [rdi]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x14004e692
xor al, al
mov rbx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140111850
mov rbp, qword [rsp + 0xa0]
add rsp, 0x70
pop r14
pop rdi
pop rsi
ret
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
call fcn.140116070
int3
Function at 0x14004ef30
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor r9d, r9d
lea rax, [rsp + 0x50]
mov rbx, rcx
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 0x28]
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x14004f001
cmp word [rsp + 0x50], 0
je 0x14004f001
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004ef90
xor edi, edi
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
mov word [rbx], di
test r8, r8
jne 0x14004efcc
cmp qword [rbx + 0x18], 8
mov qword [rbx + 0x10], rdi
jb 0x14004efc4
mov rax, qword [rbx]
mov word [rax], di
jmp 0x14004efd9
mov rax, rbx
mov word [rbx], di
jmp 0x14004efd9
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140029c40
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call fcn.140050760
cmp rax, 0xffffffffffffffff
je 0x14004f080
or r8, 0xffffffffffffffff
mov rdx, rax
mov rcx, rbx
call fcn.14002b250
jmp 0x14004f080
xor edi, edi
mov qword [rsp + 0x48], 7
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rdi
mov word [rsp + 0x30], di
call fcn.14004ed80
mov qword [rbx + 0x18], 7
mov rcx, rbx
mov qword [rbx + 0x10], rdi
mov word [rbx], di
test al, al
je 0x14004f042
lea rdx, [rsp + 0x30]
call fcn.140029ff0
jmp 0x14004f076
mov r8d, 3
lea rdx, [0x140150740]
call fcn.140029c40
xor edx, edx
xor r8d, r8d
mov rcx, rbx
call fcn.140050760
cmp rax, 0xffffffffffffffff
je 0x14004f076
or r8, 0xffffffffffffffff
mov rdx, rax
mov rcx, rbx
call fcn.14002b250
lea rcx, [rsp + 0x30]
call fcn.1400599c0
mov rax, rbx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140111850
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140052960
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rsi, qword [rsp + 0xe0]
lea rax, [0x1401624d0]
mov qword [rcx], rax
mov rbx, rcx
add rcx, 8
xor r14d, r14d
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdi, rdx
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], r14
mov byte [rcx], r14b
call fcn.14002a2a0
mov dword [rbx + 0x28], r14d
lea rax, [0x140162290]
mov qword [rbx], rax
movabs rax, 0xfeedc0dedeadbeef
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], r14
mov qword [rbx + 0x40], r14
test rsi, rsi
jne 0x1400529eb
int3
mov ecx, 0x38
call fcn.140111b94
cmp qword [rdi + 0x18], 0x10
mov rbp, rax
jb 0x140052a04
mov rcx, qword [rdi]
jmp 0x140052a07
mov rcx, rdi
mov rax, qword [rdi + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x30], 0x67452301
mov dword [rsp + 0x34], 0xefcdab89
mov dword [rsp + 0x38], 0x98badcfe
mov qword [rsp + 0x3c], 0x10325476
mov dword [rsp + 0x44], r14d
call fcn.14008ca10
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call fcn.14008cb90
mov rdx, qword [rsp + 0x20]
mov r8, rsi
bswap rdx
mov rcx, rbp
call fcn.140083720
mov rcx, qword [rbx + 0x38]
mov qword [rbx + 0x38], rax
test rcx, rcx
je 0x140052a83
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov ecx, 0x38
call fcn.140111b94
mov r9, rax
mov r8, rsi
mov rax, qword [rbx + 0x38]
mov rcx, qword [rax + 8]
mov rdx, qword [rcx]
mov rcx, r9
call fcn.140083720
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x40], rax
test rcx, rcx
je 0x140052abe
mov r8, qword [rcx]
mov edx, 1
call qword [r8]
mov rax, rbx
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140052b60
Capabilities:
Hash data with md5

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xb0
mov rax, qword [0x1401750b8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rsi, qword [rsp + 0x100]
lea rax, [0x1401624d0]
mov r15, qword [rsp + 0x118]
mov rbx, rcx
mov r14, qword [rsp + 0x120]
xor r12d, r12d
mov qword [rcx], rax
or r9, 0xffffffffffffffff
add rcx, 8
xor r8d, r8d
mov rdi, rdx
mov qword [rcx + 0x18], 0xf
mov qword [rcx + 0x10], r12
mov byte [rcx], r12b
call fcn.14002a2a0
mov dword [rbx + 0x28], r12d
lea rax, [0x140162290]
mov qword [rbx], rax
movabs rax, 0xfeedc0dedeadbeef
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], r12
mov qword [rbx + 0x40], r12
test rsi, rsi
jne 0x140052bff
int3
mov ecx, 0x40
call fcn.140111b94
cmp qword [rdi + 0x18], 0x10
mov rbp, rax
jb 0x140052c18
mov rcx, qword [rdi]
jmp 0x140052c1b
mov rcx, rdi
mov rax, qword [rdi + 0x10]
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x40], 0x67452301
mov dword [rsp + 0x44], 0xefcdab89
mov dword [rsp + 0x48], 0x98badcfe
mov qword [rsp + 0x4c], 0x10325476
mov dword [rsp + 0x54], r12d
call fcn.14008ca10
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x30]
call fcn.14008cb90
mov rax, qword [rsp + 0x108]
mov r9, r15
mov rdx, qword [rsp + 0x30]
mov r8, rsi
bswap rdx
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.140083870
mov rcx, qword [rbx + 0x38]
mov qword [rbx + 0x38], rax
test rcx, rcx
je 0x140052ca7
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov ecx, 0x40
call fcn.140111b94
mov r10, rax
mov r9, r14
mov rax, qword [rbx + 0x38]
mov r8, rsi
mov rcx, qword [rax + 8]
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx]
mov rcx, r10
call fcn.140083870
mov rcx, qword [rbx + 0x40]
mov qword [rbx + 0x40], rax
test rcx, rcx
je 0x140052cf2
mov r8, qword [rcx]
mov edx, 1
call qword [r8]
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140111850
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret