joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000a300
Capabilities:
Move file

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x58], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, r8
mov rdi, rdx
xor eax, eax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
xor esi, esi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
mov rax, qword [rbp - 0x40]
test rax, rax
je 0x18000a372
cmp qword [rbp - 0x38], rsi
jne 0x18000a372
lea rcx, [rbp - 0x38]
call rax
mov rcx, rbx
call fcn.18003d950
test al, al
je 0x18000a3e5
mov rcx, rbx
call fcn.180067810
test al, al
jne 0x18000a3e5
lea r8, str..tmp
mov rdx, rbx
lea rcx, [rbp - 0x30]
call fcn.18000e720
nop
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.180067160
lea rcx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rcx, qword [rbp - 0x30]
xor edx, edx
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
nop
cmp qword [rbp - 0x18], 8
jb 0x18000a3d5
mov rcx, qword [rbp - 0x30]
call fcn.180139b7c
mov qword [rbp - 0x18], 7
mov qword [rbp - 0x20], rsi
mov word [rbp - 0x30], si
mov rdx, rbx
mov rcx, rdi
call fcn.180067160
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x18000a400
mov rcx, qword [rbp - 0x38]
call rax
nop
mov rax, qword [rbp - 0x48]
test rax, rax
je 0x18000a40f
mov rcx, qword [rbp - 0x38]
call rax
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18000a42c
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x50]
test eax, eax
cmovne rcx, rsi
mov qword [rbp - 0x50], rcx
mov rcx, qword [rbp - 0x50]
test rcx, rcx
je 0x18000a449
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, qword [rbp - 0x50]
test eax, eax
cmovne rcx, rsi
mov qword [rbp - 0x50], rcx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x180017980
Capabilities:
Write file on windows

Disassembly:
mov r11, rsp
push rsi
push rdi
push r14
sub rsp, 0x90
mov qword [r11 - 0x50], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rdx
mov rsi, rcx
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x78], 0
je 0x180017adf
add rbx, 0x28
mov qword [r11 - 0x68], rbx
xor dil, dil
mov byte [rsp + 0x48], dil
test rbx, rbx
je 0x180017a02
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800179fd
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, 0xffffff7f
je 0x1800179f6
xor dil, dil
jmp 0x1800179fd
mov byte [rbx + 8], 1
mov dil, 1
mov byte [rsp + 0x48], dil
mov rcx, qword [rsi + 8]
cmp qword [rcx + 0x18], 8
jb 0x180017a10
mov rcx, qword [rcx]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 4
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [r14 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180017abe
xor r8d, r8d
mov rdx, rbp
lea rcx, [rsp + 0x60]
call fcn.18004eb40
nop
lea r9d, [r14 + 2]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0x10
cmovae rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x50]
mov r8d, dword [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x78], 0x10
jb 0x180017aab
mov rcx, qword [rsp + 0x60]
call fcn.180139b7c
mov qword [rsp + 0x78], 0xf
mov qword [rsp + 0x70], r14
mov byte [rsp + 0x60], 0
test rbx, rbx
je 0x180017ada
test dil, dil
je 0x180017ada
mov rcx, qword [rbx]
test rcx, rcx
je 0x180017ad6
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [rbx + 8], 0
mov qword [rsp + 0x40], r14
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.180139310
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180021370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov esi, edx
mov rbx, r9
movsx eax, sil
mov rdx, rcx
movd xmm6, eax
punpcklbw xmm6, xmm6
punpcklwd xmm6, xmm6
pshufd xmm6, xmm6, 0
test rcx, rcx
je 0x1800214f1
test rbx, rbx
je 0x1800214f1
movsxd rdi, dword [rsp + 0x70]
test edi, edi
jle 0x1800214f1
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x1800214f1
mov r15, qword [rsp + 0x80]
test r15, r15
je 0x1800214f1
cmp qword [r14], 0
jne 0x1800214f1
mov qword [rsp + 0x50], rbp
lea ebp, [rdi + 0x50]
mov ecx, ebp
call qword [rdx + 0x10]
mov r8, rax
test rax, rax
jne 0x180021423
or eax, 0xffffffff
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
xor r9d, r9d
cmp edi, 0x20
jb 0x1800214af
lea edx, [rdi - 1]
movsxd rcx, edx
lea eax, [rdx + 0x50]
add rcx, rbx
movsxd r10, eax
lea rax, [r8 + 0x50]
add r10, r8
cmp rax, rcx
ja 0x18002144f
cmp r10, rbx
jae 0x1800214af
mov eax, edi
and eax, 0x8000001f
jge 0x18002145f
dec eax
or eax, 0xffffffe0
inc eax
mov r11d, edi
mov r10d, 0x60
sub r11d, eax
nop dword [rax + rax]
movsxd rcx, r9d
lea eax, [r10 - 0x10]
add r9d, 0x20
movsxd rdx, eax
lea eax, [r10 - 0x50]
movdqu xmm0, xmmword [rcx + rbx]
movsxd rcx, eax
pxor xmm0, xmm6
movdqu xmmword [rdx + r8], xmm0
movsxd rdx, r10d
add r10d, 0x20
movdqu xmm0, xmmword [rcx + rbx]
pxor xmm0, xmm6
movdqu xmmword [rdx + r8], xmm0
cmp r9d, r11d
jl 0x180021470
movsxd rcx, r9d
mov rdx, rdi
cmp rcx, rdi
jge 0x1800214e4
lea rax, [r8 + 0x50]
sub rbx, r8
add rax, rcx
sub rdx, rcx
nop word [rax + rax]
movzx ecx, byte [rbx + rax - 0x50]
lea rax, [rax + 1]
xor cl, sil
mov byte [rax - 1], cl
dec rdx
jne 0x1800214d0
mov qword [r14], r8
mov dword [r15], ebp
xor eax, eax
jmp 0x180021405
or eax, 0xffffffff
jmp 0x18002140a
Function at 0x180021500
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x30
movaps xmmword [rsp + 0x20], xmm6
mov esi, edx
movsxd rdi, r9d
movsx eax, sil
mov rbx, r8
mov rdx, rcx
movd xmm6, eax
punpcklbw xmm6, xmm6
punpcklwd xmm6, xmm6
pshufd xmm6, xmm6, 0
test rcx, rcx
je 0x18002163d
test rbx, rbx
je 0x18002163d
test r9d, r9d
jle 0x18002163d
mov r14, qword [rsp + 0x60]
test r14, r14
je 0x18002163d
mov r15, qword [rsp + 0x68]
test r15, r15
je 0x18002163d
cmp qword [r14], 0
jne 0x18002163d
mov ecx, edi
call qword [rdx + 0x10]
mov r8, rax
test rax, rax
je 0x18002163d
xor edx, edx
cmp edi, 0x20
jb 0x1800215ff
lea eax, [rdi - 1]
movsxd rcx, eax
lea rax, [rcx + rbx]
lea r9, [rcx + r8]
cmp r8, rax
ja 0x1800215b0
cmp r9, rbx
jae 0x1800215ff
mov eax, edi
and eax, 0x8000001f
jge 0x1800215c0
dec eax
or eax, 0xffffffe0
inc eax
mov r9d, edi
sub r9d, eax
nop word [rax + rax]
movsxd rax, edx
movdqu xmm0, xmmword [rax + rbx]
pxor xmm0, xmm6
movdqu xmmword [rax + r8], xmm0
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm0, xmmword [rcx + rbx]
pxor xmm0, xmm6
movdqu xmmword [rcx + r8], xmm0
cmp edx, r9d
jl 0x1800215d0
movsxd rcx, edx
mov rdx, rdi
cmp rcx, rdi
jge 0x180021633
sub rbx, r8
lea rax, [rcx + r8]
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rbx + rax]
lea rax, [rax + 1]
xor cl, sil
mov byte [rax - 1], cl
dec rdx
jne 0x180021620
mov qword [r14], r8
mov dword [r15], edi
xor eax, eax
jmp 0x180021640
or eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x20]
mov r14, qword [rsp + 0x58]
add rsp, 0x30
pop r15
ret

Function at 0x180023d30
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r14
sub rsp, 0x460
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov rdi, rdx
mov r14d, ecx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x30], rdx
xor ebx, ebx
mov qword [rdx + 0x10], rbx
cmp qword [rdx + 0x18], 8
jb 0x180023d73
mov rax, qword [rdx]
jmp 0x180023d76
mov rax, rdx
mov word [rax], bx
call fcn.180023e60
movzx esi, al
mov byte [rsp + 0x20], al
jmp 0x180023d9b
test sil, sil
jne 0x180023e2f
cmp r14d, 0x1a
jne 0x180023e2f
mov qword [rdi + 0x10], rbx
cmp qword [rdi + 0x18], 8
jb 0x180023dbe
mov rax, qword [rdi]
jmp 0x180023dc1
mov rax, rdi
mov word [rax], bx
mov word [rsp + 0x40], bx
xor edx, edx
mov r8d, 0x40e
lea rcx, [rsp + 0x42]
call fcn.180140c00
mov r8d, 0x207
lea rdx, [rsp + 0x40]
lea rcx, [0x1801aa738]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [rsp + 0x40], 0
je 0x180023e0e
lea rax, [rsp + 0x40]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x180023e04
mov r8, rbx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.180005920
movzx esi, sil
mov eax, 1
cmp qword [rdi + 0x10], 0
cmovne esi, eax
movzx eax, sil
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0x490]
add rsp, 0x460
pop r14
pop rdi
pop rsi
ret
Function at 0x180031b50
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x40], rax
xor edx, edx
mov r8d, 0x11c
mov rbx, rcx
call fcn.180140c00
mov rcx, rbx
mov dword [rbx], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180031c57
mov eax, dword [rbx + 4]
cmp eax, 6
ja 0x180031ba4
jne 0x180031c42
cmp dword [rbx + 8], 2
jb 0x180031c42
lea rcx, [0x1801aaf98]
mov qword [rsp + 0x68], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
je 0x180031c3d
mov edx, 1
mov rcx, rax
lea r8d, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
test rax, rax
je 0x180031c3d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x180031c3d
movups xmm0, xmmword [0x1801aafb8]
movups xmm1, xmmword [0x1801aafc8]
mov rcx, rax
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
test rax, rax
je 0x180031c3d
lea rcx, [rax + 6]
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x180031c3d
cmp word [rdi + 2], ax
jbe 0x180031c3d
movzx edx, word [rdi + 0x32]
movzx eax, word [rdi + 0x30]
movzx ecx, word [rdi + 0x36]
mov dword [rbx + 4], edx
mov dword [rbx + 8], eax
mov dword [rbx + 0xc], ecx
mov rdi, qword [rsp + 0x68]
mov al, 1
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180139310
add rsp, 0x50
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180139310
add rsp, 0x50
pop rbx
ret
Function at 0x18003f640
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r15, r8
mov r14, rdx
mov rsi, rcx
xor dil, dil
mov byte [rsp + 0x30], dil
xor r12d, r12d
mov word [rsp + 0x40], r12w
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x42]
call fcn.180140c00
lea rdx, [rsp + 0x40]
mov rcx, rsi
call fcn.18003f360
cmp byte [rsi + 0x40], dil
je 0x18003f6d3
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003f6cf
test al, 0x10
jne 0x18003f6cf
call fcn.180073ca0
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180074170
test al, al
jne 0x18003f6d3
xor al, al
jmp 0x18003f744
mov qword [rsi + 0x48], r12
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x18003f744
lea rdx, [0x1801ab418]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003f725
mov qword [rsi + 0x48], rbx
mov qword [rsp + 0x20], rsi
lea r9, [0x18003f240]
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call rax
test eax, eax
sete dil
mov byte [rsp + 0x30], dil
mov qword [rsi + 0x48], r12
jmp 0x18003f732
test rbx, rbx
je 0x18003f740
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, dil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret

Function at 0x18003f770
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x470
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov r15, r8
mov r14, rdx
mov rdi, rcx
xor sil, sil
mov byte [rsp + 0x30], sil
xor r12d, r12d
mov word [rsp + 0x40], r12w
xor edx, edx
mov r8d, 0x410
lea rcx, [rsp + 0x42]
call fcn.180140c00
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.18003f360
cmp byte [rdi + 0x40], sil
je 0x18003f803
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003f7ff
test al, 0x10
jne 0x18003f7ff
call fcn.180073ca0
lea rdx, [rsp + 0x40]
mov rcx, rax
call fcn.180074170
test al, al
jne 0x18003f803
xor al, al
jmp 0x18003f87f
mov qword [rdi + 0x48], r12
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x18003f87f
lea rdx, [0x1801ab428]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r10, rax
test rax, rax
je 0x18003f860
mov qword [rdi + 0x48], rbx
mov eax, dword [rdi + 0x50]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
lea r9, [0x18003f240]
xor r8d, r8d
mov rdx, r15
mov rcx, r14
call r10
test eax, eax
sete sil
mov byte [rsp + 0x30], sil
mov qword [rdi + 0x48], r12
jmp 0x18003f86d
test rbx, rbx
je 0x18003f87b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, sil
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0x4b8]
add rsp, 0x470
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18003f8e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c8]
sub rsp, 0x4c8
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov r14, r9
mov rdi, r8
mov rbx, rdx
mov r15, rcx
mov r12, qword [rbp + 0x430]
xor r13b, r13b
xor esi, esi
mov word [rbp - 0x70], si
xor edx, edx
mov r8d, 0x410
lea rcx, [rbp - 0x6e]
call fcn.180140c00
lea rdx, [rbp - 0x70]
mov rcx, r15
call fcn.18003f360
cmp byte [r15 + 0x40], sil
je 0x18003f984
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x18003f97d
test al, 0x10
jne 0x18003f97d
call fcn.180073ca0
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.180074170
test al, al
jne 0x18003f984
xor al, al
jmp 0x18003fb20
mov qword [r15 + 0x48], rsi
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x18003f97d
lea rdx, [0x1801ab438]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003fb0d
mov qword [r15 + 0x48], rsi
xor ecx, ecx
mov qword [rsp + 0x48], rcx
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x54], 0xffffffff
lea rcx, [rsp + 0x54]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], rcx
mov r9, r15
lea r8, [0x18003f240]
mov rdx, rdi
mov rcx, rbx
call rax
test eax, eax
sete r13b
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18003fb00
cmp dword [rsp + 0x50], 0
jle 0x18003fadf
xor ebx, ebx
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rbx
mov word [rsp + 0x70], bx
movsxd rdx, dword [rsp + 0x50]
mov rcx, r14
call fcn.18003fe60
mov edi, ebx
cmp dword [rsp + 0x50], ebx
jle 0x18003fab8
nop dword [rax]
mov rcx, qword [rsp + 0x48]
add rcx, rbx
cmp dword [rcx + 0x10], 0
setne byte [rsp + 0x68]
mov rax, qword [rcx + 8]
mov qword [rsp + 0x60], rax
mov rax, qword [rcx]
mov qword [rsp + 0x58], rax
lea rdx, [rcx + 0x14]
cmp word [rdx], 0
jne 0x18003fa81
xor r8d, r8d
jmp 0x18003fa90
or r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], 0
jne 0x18003fa85
lea rcx, [rsp + 0x70]
call fcn.180005920
lea rdx, [rsp + 0x58]
mov rcx, r14
call fcn.18003fec0
inc edi
add rbx, 0x21c
cmp edi, dword [rsp + 0x50]
jl 0x18003fa50
xor ebx, ebx
cmp qword [rbp - 0x78], 8
jb 0x18003fac9
mov rcx, qword [rsp + 0x70]
call fcn.180139b7c
mov qword [rbp - 0x78], 7
mov qword [rbp - 0x80], rbx
mov word [rsp + 0x70], bx
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x18003fb00
lea rdx, [0x1801ab448]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18003fb00
mov rcx, qword [rsp + 0x48]
call rax
test r12, r12
je 0x18003fb0d
mov ecx, dword [rsp + 0x54]
mov dword [r12], ecx
xor eax, eax
mov qword [r15 + 0x48], rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
movzx eax, r13b
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.180139310
add rsp, 0x4c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18004fc80
Capabilities:
Clear file content

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
test rax, rax
jne 0x18004fc93
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x18004fc8c
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
add rsp, 0x28
ret

Function at 0x18004ff00
Capabilities:
Hash data with md5

Disassembly:
mov rcx, qword [rcx + 8]
mov rcx, qword [rcx]
jmp fcn.180170f30

Function at 0x180050030
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
mov rdi, rdx
test rcx, rcx
je 0x180050055
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov word [rbx + 8], 0
cmp qword [rdi + 0x10], 0
je 0x18005006e
cmp qword [rdi + 0x18], 8
jb 0x180050070
mov rdi, qword [rdi]
jmp 0x180050070
xor edi, edi
mov r8, rdi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x180050096
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180050096
mov byte [rbx + 9], 1
cmp qword [rbx], 0
mov rbx, qword [rsp + 0x30]
setne al
add rsp, 0x20
pop rdi
ret

Function at 0x1800500b0
Capabilities:
Check mutex on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor ebp, ebp
test rcx, rcx
je 0x1800500ee
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], rbp
mov word [rdi + 8], bp
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.180075720
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rcx, [rbx + 0x10]
jne 0x180050116
mov rcx, rbp
cmp qword [rsi + 0x10], 0
je 0x180050129
cmp qword [rsi + 0x18], 8
jb 0x18005012c
mov rsi, qword [rsi]
jmp 0x18005012c
mov rsi, rbp
mov r8, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
je 0x180050150
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x180050150
mov byte [rdi + 9], 1
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x180050177
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], rbp
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18005018a
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], rbp
mov rcx, rbx
call fcn.180139b7c
mov qword [rsp + 0x28], rbp
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800501d0
Capabilities:
Check mutex on windows

Disassembly:
push rsi
push rdi
push r14
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rax, qword [0x1802247b8]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, rdx
mov rdi, rcx
mov rcx, qword [rcx]
xor r14d, r14d
test rcx, rcx
je 0x180050215
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi], r14
mov word [rdi + 8], r14w
xor eax, eax
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.180075840
nop
mov rbx, qword [rsp + 0x28]
cmp qword [rbx], 0
lea rbp, [rbx + 0x10]
jne 0x18005023e
mov rbp, r14
cmp qword [rsi + 0x10], 0
je 0x180050256
cmp qword [rsi + 0x18], 8
jb 0x180050251
mov r8, qword [rsi]
jmp 0x180050259
mov r8, rsi
jmp 0x180050259
mov r8, r14
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
test rax, rax
jne 0x1800502ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
jne 0x1800502a7
lea ecx, [rax + 5]
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rsi + 0x10], 0
je 0x180050293
cmp qword [rsi + 0x18], 8
jb 0x180050296
mov rsi, qword [rsi]
jmp 0x180050296
mov rsi, r14
mov r8, rsi
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rdi], rax
cmp qword [rdi], 0
je 0x1800502ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1800502be
mov byte [rdi + 9], 1
mov rcx, qword [rdi]
call fcn.180061300
cmp qword [rdi], 0
setne sil
mov rdi, qword [rbx]
test rdi, rdi
je 0x1800502ed
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180050300
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbx + 8], r14
mov rcx, rbx
call fcn.180139b7c
mov qword [rsp + 0x28], r14
movzx eax, sil
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180139310
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret