joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400304e4
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x28
cmp byte [rcx], 0
je 0x140030505
and byte [0x14019c661], 0xfb
lea rcx, str.SeDebugPrivilege
mov edx, 4
call fcn.14002e788
add rsp, 0x28
ret

Function at 0x14003050c
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov ebp, 0x5c
mov rbx, rcx
mov edx, ebp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
xor esi, esi
jmp 0x14003055d
mov rcx, rbx
mov word [rdi], si
call fcn.1400cf330
cmp eax, esi
jne 0x14003054e
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rdi + 2]
mov edx, ebp
mov word [rdi], bp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov rdi, rax
cmp rax, rsi
jne 0x140030534
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret

Function at 0x140030580
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edx, ecx
lea rcx, [0x14019c170]
jmp fcn.14002bb1c

Function at 0x14003061c
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rbp, rdx
mov rbx, rcx
je 0x140030644
xor eax, eax
jmp 0x140030750
call fcn.14002ac68
test eax, eax
je 0x14003063d
mov rcx, rbx
call fcn.14002ad18
mov rsi, rax
test rax, rax
je 0x14003063d
mov rax, qword [rbx + 0x20]
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, qword [rax + 0x30]
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
jne 0x14003069f
lea r9d, [rax + 0x40]
mov r8d, 0x3000
mov rdx, rsi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdi, rax
test rax, rax
je 0x14003063d
mov r8, rbp
mov rdx, rdi
mov rcx, rbx
call fcn.14002ada0
mov r11, qword [rbx + 0x20]
cmp dword [r11 + 0xb0], 0
jbe 0x1400306d8
cmp dword [r11 + 0xb4], 0
jbe 0x1400306d8
mov rdx, rdi
mov rcx, rbx
call fcn.14002aa9c
test eax, eax
je 0x14003063d
mov rdx, rdi
mov rcx, rbx
call fcn.14002ab2c
mov rcx, rdi
test eax, eax
jne 0x1400306fd
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x14003063d
mov rax, qword [rbx + 0x20]
xor r8d, r8d
mov qword [rax + 0x30], rdi
mov rax, qword [rbx + 0x20]
lea esi, [r8 + 1]
mov eax, dword [rax + 0x28]
mov edx, esi
add rax, rdi
mov qword [rbx + 8], rax
call rax
test eax, eax
jne 0x140030748
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [rbx + reloc.OLEAUT32.dll_VariantClear]
xor edx, edx
mov r8d, 0x8000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualFree]
and qword [rbx + 8], 0
jmp 0x14003063d
mov dword [rbx], esi
mov qword [rbx + 0x10], rdi
mov eax, esi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400307d8
Capabilities:
Get memory capacity

Disassembly:
push rbx
sub rsp, 0x60
xor edx, edx
mov ebx, ecx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0x40]
call fcn.14010c6c0
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x28]
test ebx, ebx
cmovne rax, qword [rsp + 0x30]
add rsp, 0x60
pop rbx
ret

Function at 0x140030854
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov rax, rsp
push r12
push r13
push r14
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r12, r9
mov r13, rcx
mov dword [rax - 0x38], 0x20
lea rbp, [rax - 0x38]
xor ebx, ebx
cmp qword [rsp + 0x80], rbx
cmovne rbp, qword [rsp + 0x80]
movzx r14d, word [rbp + 2]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
cmp rax, rbx
je 0x1400308c1
mov rdx, rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
jmp 0x1400308c3
mov esi, ebx
cmp rdi, rbx
je 0x1400308d9
mov rdx, rdi
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
jmp 0x1400308dc
mov rdi, rbx
mov r13b, bl
test byte [rbp], 1
je 0x1400308fa
cmp rdi, rbx
je 0x1400309ee
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdi, rax
cmp rdi, rbx
je 0x1400309ee
cmp esi, ebx
jle 0x1400309ee
test byte [rbp], 0x40
jne 0x140030973
xor r8d, r8d
mov edx, esi
mov rcx, rdi
call fcn.14005e970
mov r13b, al
cmp al, bl
je 0x140030973
test byte [rbp], 0x20
je 0x140030936
test al, 2
je 0x140030936
xor eax, eax
jmp 0x1400309fb
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140071140
nop
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x3c], esi
mov dword [rsp + 0x38], esi
movzx r8d, word [rbp + 2]
mov rdx, r12
lea rcx, [rsp + 0x30]
call fcn.140067770
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x30]
call fcn.14005b520
jmp 0x1400309b7
lea edx, [rsi + 0x410]
mov rcx, r12
call fcn.1400632e0
mov dword [r12 + 0xc], esi
mov dword [r12 + 8], esi
movsxd rsi, esi
mov r8, rsi
mov rdx, rdi
mov rcx, qword [r12]
call fcn.14010cd30
cmp r14w, bx
je 0x1400309b7
lea r8, [rsi + 1]
shr r8, 1
movzx edx, r14w
mov rcx, qword [r12]
call fcn.14002d430
mov rbx, qword [r12]
movsxd rcx, dword [r12 + 8]
lea eax, [rcx + 0x10]
mov dword [r12 + 0xc], eax
add rcx, rbx
xor edx, edx
lea r8d, [rdx + 0x10]
call fcn.14010c6c0
movsx edx, word [rbp + 2]
movsxd rcx, dword [r12 + 8]
add rcx, qword [r12]
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
call fcn.14010c6c0
movsx ecx, r13b
and ecx, 2
or dword [rbp], ecx
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r13
pop r12
ret
Function at 0x140030a1c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov r12b, r8b
mov rbp, rdx
and qword [rax - 0x38], 0
and qword [rax - 0x40], 0
and dword [rax - 0x48], 0
mov r9d, 3
mov dword [rax - 0x50], r9d
and qword [rax - 0x58], 0
mov r8d, 0x80000000
mov rdx, rcx
lea rcx, [rax - 0x38]
call fcn.14001c898
mov rbx, qword [rsp + 0x40]
test rbx, rbx
jne 0x140030a7f
lea eax, [rbx - 2]
jmp 0x140030b8e
mov rcx, rbx
call fcn.140062bb0
mov rdi, rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14005c450
lea edx, [rdi + 0xc]
mov rcx, rbp
call fcn.1400632e0
mov rsi, qword [rbp]
and dword [rsp + 0x98], 0
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x98]
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [rsp + 0x98]
add rcx, rsi
xor edx, edx
lea r8d, [rdx + 6]
call fcn.14010c6c0
mov edx, dword [rsp + 0x98]
mov dword [rbp + 0xc], edx
mov dword [rbp + 8], edx
mov r8b, r12b
mov rcx, rsi
call fcn.14005e970
mov dil, al
cmp al, 1
jne 0x140030b54
mov rcx, qword [rbp]
mov qword [rsp + 0x50], rcx
and qword [rbp], 0
and dword [rbp + 8], 0
and dword [rbp + 0xc], 0
mov ecx, dword [rsp + 0x98]
mov dword [rsp + 0x5c], ecx
mov dword [rsp + 0x58], ecx
xor r8d, r8d
mov rdx, rbp
lea rcx, [rsp + 0x50]
call fcn.140067770
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [rax + 6]
mov rcx, rbp
call fcn.1400632e0
nop
lea rcx, [rsp + 0x50]
call fcn.14005b520
mov edx, 1
mov rcx, rbp
call fcn.140081dc0
test dil, dil
jns 0x140030b7a
cmp rbx, 0xffffffffffffffff
je 0x140030b75
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
or eax, 0xffffffff
jmp 0x140030b8e
mov edi, dword [rbp + 8]
cmp rbx, 0xffffffffffffffff
je 0x140030b8c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140035050
Capabilities:
Check mutex on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
test byte [section.flag_dat], 1
je 0x1400350b2
lea rcx, str.UCallBackhWnd
call fcn.14002ca80
test rax, rax
je 0x1400350b2
lea r8, str.GlobalPECMD:main_u
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rdi, rax
test rax, rax
je 0x1400350b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
mov rcx, rdi
cmp eax, 0xb7
sete bl
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x1400350b2
lea eax, [rbx + 1]
jmp 0x1400350b4
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x1400354dc
Capabilities:
Clear file content

Disassembly:
mov rax, rsp
sub rsp, 0x48
and qword [rax - 0x10], 0
and qword [rax + 8], 0
mov dword [rax - 0x18], 0x80
mov dword [rax - 0x20], 3
and qword [rax - 0x28], 0
lea rdx, str.D:DebugPeMainU.LOG
lea rcx, [rax + 8]
mov r9d, 7
mov r8d, 0xc0000000
call fcn.14001c898
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
cmp qword [rsp + 0x50], 0
je 0x140035542
cmp qword [rsp + 0x50], 0xffffffffffffffff
je 0x140035542
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x48
ret
Function at 0x140035bd8
Capabilities:
Get disk information

Disassembly:
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [rax + 0x84]
lea edx, [rbx + 0x325]
lea rcx, [rsp + 0x68]
call fcn.140063580
nop
mov r12, qword [rsp + 0x68]
movsxd rax, ebx
lea rdi, [r12 + rax*2]
mov esi, 2
lea r13d, [rsi + 0x5a]
cmp word [rbp], r13w
jne 0x140035cde
xor ebx, ebx
movzx r14d, bx
lea edx, [rsi + 0x2a]
mov rcx, rbp
call qword [sym.imp.SHLWAPI.dll_StrChrW]
mov r13, rax
cmp rax, rbx
je 0x140035c6c
mov word [rax], bx
add r13, rsi
mov rcx, r13
call qword [sym.imp.USER32.dll_CharUpperW]
cmp word [r13], bx
cmovne r14w, word [r13]
add rbp, rsi
mov rdx, rdi
mov ecx, 0x324
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [rdi], bx
je 0x140035d68
cmp word [rdi], r14w
jb 0x140035cc6
mov r9, rbp
mov r8, rdi
lea rdx, str._s_sFonts
mov rcx, r12
call fcn.140029bc4
mov rcx, r12
call fcn.1400cf330
cmp eax, ebx
je 0x140035cc6
lea rdx, [0x1401492d8]
mov rcx, r12
call fcn.14010d9e4
mov rcx, r12
call fcn.140035a84
mov esi, eax
mov rcx, rdi
call fcn.14010d9c8
inc eax
lea rdi, [rdi + rax*2]
cmp word [rdi], bx
jne 0x140035c86
jmp 0x140035d68
mov rcx, rbp
call fcn.14002e004
mov rdi, rax
xor ebx, ebx
mov qword [rsp + 0x60], rbx
mov rcx, rax
call fcn.1400cf330
cmp eax, ebx
je 0x140035d1f
mov rdx, rdi
lea rcx, [rsp + 0x60]
call fcn.140071480
lea rdx, [0x1401492d8]
lea rcx, [rsp + 0x60]
call fcn.140063600
mov rdi, qword [rsp + 0x60]
mov r8, rdi
lea rdx, [0x1401496a8]
mov rcx, r12
call fcn.140029bc4
mov r8d, r13d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp rax, rbx
je 0x140035d47
mov word [rax], bx
mov rcx, rdi
call fcn.1400cf330
cmp eax, ebx
je 0x140035d5d
mov rcx, r12
call fcn.140035a84
mov esi, eax
lea rcx, [rsp + 0x60]
call fcn.14005b520
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
mov eax, esi
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x140036614
Capabilities:
Get common file path
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r12
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov ebp, r8d
mov rdi, rdx
mov rsi, rcx
mov edx, 0x41c
lea rcx, [rax + 0x20]
call fcn.140063580
nop
mov rbx, qword [rsp + 0x68]
xor r12d, r12d
mov word [rbx], r12w
mov rdx, rbx
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r8, rbx
lea rdx, str.__OldDir
mov rcx, rsi
call fcn.140061290
cmp rdi, r12
je 0x140036692
lea eax, [r12 + 0x2a]
cmp ax, word [rdi]
jne 0x1400366c1
add rdi, 2
mov qword [rsp + 0x58], rdi
je 0x1400366c1
mov r8d, 0x104
mov rdx, qword [rsp + 0x68]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp rdi, r12
je 0x1400366b7
mov rdx, rdi
lea rcx, [rsp + 0x68]
call fcn.140063600
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x58]
call fcn.140029d28
mov qword [rsp + 0x20], r12
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x58]
call fcn.14002e730
mov rbx, rax
movzx eax, word [rax]
cmp ax, 0x61
jb 0x1400366fc
cmp ax, 0x7a
ja 0x1400366fc
mov ecx, 0xffdf
and ax, cx
mov word [rbx], ax
mov r8, rbx
lea rdx, [0x140149788]
mov rcx, rsi
call fcn.140061290
cmp ebp, r12d
jne 0x140036725
mov r8, rbx
lea rdx, [0x14014978c]
mov rcx, rsi
call fcn.140061290
xor edx, edx
lea r8d, [rdx + 0x5c]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_StrRChrW]
mov rdi, rax
mov word [rax + 2], r12w
cmp ebp, r12d
jne 0x14003674a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov word [rdi], r12w
mov r8, rbx
lea rdx, [0x140149770]
mov rcx, rsi
call fcn.140061290
cmp ebp, r12d
jne 0x14003677c
mov r8, rbx
lea rdx, [0x140149774]
mov rcx, rsi
call fcn.140061290
call fcn.14002a8c0
mov word [rbx + 4], r12w
mov r8, rbx
lea rdx, [0x140149758]
mov rcx, rsi
call fcn.140061290
cmp ebp, r12d
jne 0x1400367ab
mov r8, rbx
lea rdx, [0x14014975c]
mov rcx, rsi
call fcn.140061290
nop
lea rcx, [rsp + 0x20]
call fcn.14005b520
nop
lea rcx, [rsp + 0x68]
call fcn.14005b520
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret
Function at 0x1400367d8
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r15b, r8b
mov rsi, rdx
mov rbp, rcx
mov edx, 0x400
lea rcx, [rax + 8]
call fcn.140063580
nop
mov r14, qword [rsp + 0x60]
movzx ecx, word [rbp + 0x70]
cmp word [rsi], cx
je 0x140036965
mov edx, 0x3ff
mov r13, rsi
movzx eax, word [rsi]
cmp word [rbp + 0x7a], ax
je 0x14003684a
cmp word [rbp + 0x7c], ax
je 0x14003684a
cmp word [rbp + 0x72], ax
je 0x14003684a
cmp word [rbp + 0x78], ax
jne 0x140036850
add rsi, 2
jmp 0x14003682f
mov r12, rsi
movzx eax, word [rsi]
cmp cx, ax
je 0x140036875
cmp word [rbp + 0x72], ax
je 0x140036875
cmp word [rbp + 0x78], ax
je 0x140036875
add r12, 2
mov ax, word [r12]
cmp cx, ax
jne 0x14003685b
mov rdi, rsi
sub rdi, r13
sar rdi, 1
cmp edi, edx
cmovg edi, edx
movsxd rax, edi
lea rbx, [rax + rax]
mov r8, rbx
mov rdx, r13
mov rcx, r14
call fcn.14010cd30
xor eax, eax
mov word [rbx + r14], ax
dec edi
movsxd rcx, edi
xor ebx, ebx
cmp rcx, rbx
jl 0x1400368ba
movzx eax, word [rbp + 0xc]
xor word [r14 + rcx*2], ax
sub rcx, 1
jns 0x1400368ab
mov r8d, 8
mov rdx, r14
lea rcx, str._ENDFILE
call fcn.14005c4b0
cmp al, bl
jne 0x14003695c
mov r8d, 0xf
mov rdx, rsi
lea rcx, str._ENDFILE_IMPORT
call fcn.14005c4b0
cmp al, bl
je 0x140036910
cmp r15b, bl
jne 0x140036946
cmp rsi, r12
jae 0x14003692e
movzx eax, word [rbp + 0xc]
xor ax, 0x20
mov word [rsi], ax
add rsi, 2
cmp rsi, r12
jb 0x1400368fa
jmp 0x14003692e
cmp r15b, bl
je 0x14003692e
mov r8d, 0x17
mov rdx, rsi
lea rcx, str.FIND__1_____MAIN____
call fcn.14005c510
cmp al, bl
jne 0x140036951
mov rsi, r12
mov cx, word [rbp + 0x70]
cmp word [r12], cx
je 0x140036965
mov edx, 0x3ff
jmp 0x14003682c
movzx eax, word [rbp + 0x70]
mov word [r13], ax
jmp 0x140036965
movzx eax, word [rbp + 0x70]
mov word [r13], ax
jmp 0x140036965
movzx eax, word [rbp + 0x70]
mov word [r13], ax
movzx eax, word [rbp + 0x70]
cmp word [rsi], ax
je 0x14003697e
mov word [rsi], ax
add rsi, 2
mov ax, word [rbp + 0x70]
cmp word [rsi], ax
jne 0x14003696e
lea rcx, [rsp + 0x60]
call fcn.14005b520
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140039864
Capabilities:
Check for time delay via gettickcount
Log keystrokes via application hook

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
sub rsp, 0x60
mov edi, ecx
lea rcx, [0x14019cf50]
mov esi, edx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
bt esi, 0x10
jb 0x1400398a6
mov eax, dword [0x14019c100]
cmp eax, ebx
jne 0x1400398a6
mov dword [0x14019c0f4], ebx
inc dword [0x14019c100]
movzx ebp, sil
cmp qword [0x14019c0f8], rbx
jne 0x1400398ef
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
xor r9d, r9d
lea rdx, [0x1400396f8]
lea ecx, [r9 + 0xd]
mov r8, rax
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
mov qword [0x14019c0f8], rax
cmp rax, rbx
jne 0x1400398ef
dec dword [0x14019c100]
jmp 0x140039a16
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea esi, [rdi + rax]
cmp edi, 0x3e8
jb 0x140039914
xor ecx, ecx
call fcn.14005d2e0
mov r13d, 0xa
cmp ebp, 2
jne 0x1400399dc
cmp edi, ebx
cmove edi, r13d
jmp 0x1400399dc
cmp ebp, 2
je 0x140039945
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, esi
sub edi, eax
cmp edi, ebx
jle 0x1400399ea
mov al, byte [0x1401958af]
cmp al, bl
jle 0x1400399ea
mov eax, edi
cmp edi, r13d
lea rcx, [0x14019c170]
cmova eax, r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x28], 0x4bf
mov dword [rsp + 0x20], eax
call fcn.14002dfd4
jmp 0x1400399d0
mov eax, dword [0x14019c0f4]
cmp eax, ebx
jne 0x1400399dc
cmp ebp, 2
je 0x14003999b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, esi
sub edi, eax
cmp edi, ebx
jle 0x1400399dc
lea rcx, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 1
call qword [sym.imp.USER32.dll_PeekMessageW]
cmp eax, ebx
je 0x1400399dc
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov r11b, byte [0x1401958af]
cmp r11b, bl
jg 0x14003997e
mov eax, dword [0x14019c0f4]
cmp eax, ebx
je 0x14003992e
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x14019c0f4]
add dword [0x14019c100], 0xffffffff
mov eax, dword [0x14019c100]
jne 0x140039a13
mov dword [0x14019c0f4], ebx
mov ebx, r11d
lea rcx, [0x14019cf50]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x60]
mov eax, ebx
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret

Function at 0x14003a9e4
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.14002e004
mov rcx, rax
call fcn.14003050c
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ebx, 1
cmp eax, ebx
jne 0x14003aa12
xor ecx, ecx
jmp 0x14003aa21
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, ecx
cmove eax, ebx
mov ecx, eax
mov eax, ecx
add rsp, 0x20
pop rbx
ret
Function at 0x14003e510
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rax, qword [rcx]
xor r13d, r13d
mov rbx, rdx
mov rsi, rcx
cmp word [rax], r13w
jne 0x14003e5e8
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov rdx, rbx
mov rcx, rsi
movsxd rdi, eax
call fcn.140071480
lea edx, [rdi + 0x3c]
mov rcx, rsi
call fcn.1400635c0
mov rcx, qword [rsi]
call fcn.1400cf330
cmp eax, r13d
jne 0x14003e575
mov rcx, qword [rsi]
call fcn.14003a9e4
mov ebp, r13d
mov r12, rdi
mov rax, qword [rsi]
lea rdi, [rax + r12*2]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
call fcn.14005d820
add ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, str.PECMDDEVI_lu_lu.tmp.dir
mov r9d, ebx
mov rcx, rdi
mov r8d, eax
call qword [sym.imp.USER32.dll_wsprintfW]
mov rcx, qword [rsi]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, r13d
jne 0x14003e5c4
inc ebp
cmp ebp, 0x64
jl 0x14003e57b
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, 0x5c
movsxd rcx, eax
mov rax, qword [rsi]
mov word [rax + rcx*2], dx
mov rax, qword [rsi]
mov word [rax + rcx*2 + 2], r13w
mov rax, qword [rsi]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140046bb8
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x130
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov rax, qword [0x140197b10]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov ebp, r8d
mov r12, rdx
mov rsi, rcx
mov edi, r8d
sar edi, 0x10
lea rdx, [0x140140490]
lea rcx, [rsp + 0x38]
call fcn.140071240
nop
movzx edx, di
mov rcx, qword [rsi]
call fcn.14002d37c
mov ebx, eax
mov edx, 0x20a
lea rcx, [rsp + 0x30]
call fcn.140063580
nop
mov rdx, qword [rsp + 0x30]
mov ecx, 0x208
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14002a68c
nop
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14002af60
mov ecx, dword [r12 + 0x20]
mov dword [rsp + 0x70], ecx
mov r8, qword [rsp + 0x30]
lea rdx, [0x140149770]
lea rcx, [rsp + 0x50]
call fcn.140061290
mov word [rsp + 0x5c], di
movzx edx, di
lea rcx, [rsp + 0x50]
call fcn.1400602b0
mov dword [rsp + 0x28], ebp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x38]
mov r8d, ebx
xor edx, edx
mov rcx, rsi
call fcn.1400435c0
movzx ebx, ax
or ebx, ebp
lea rdi, [0x14019cf50]
mov qword [rsp + 0x48], rdi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
or r9d, 0xffffffff
xor r8d, r8d
lea rdx, [0x140149848]
mov rcx, r12
call fcn.1400307c0
test rax, rax
je 0x140046ce5
mov r8, qword [rax]
lea rdx, [0x140149774]
lea rcx, [rsp + 0x50]
call fcn.140061290
and qword [rsp + 0xb0], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.140045e0c
nop
lea rcx, [rsp + 0xa8]
call fcn.14005b520
nop
lea rcx, [rsp + 0x30]
call fcn.14005b520
nop
lea rcx, [rsp + 0x38]
call fcn.14005b520
mov eax, ebx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.14010bcc0
add rsp, 0x130
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret