joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400149e0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x90
mov rax, qword [0x140300b88]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbp, rdx
mov rbx, rcx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
cmp qword [rcx + 0x18], 8
jb 0x140014a20
mov rcx, qword [rcx]
xor r14d, r14d
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r14 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140014a61
call fcn.140014590
mov esi, eax
mov rdi, qword [rsp + 0x48]
jmp 0x140014a69
mov qword [rsp + 0x48], rax
mov esi, r14d
test esi, esi
jns 0x140014b5e
cmp esi, 0x80070002
je 0x140014b21
lfence
mov rdx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140014a8d
mov rdx, qword [rbx]
mov r8d, esi
lea rcx, str.Failed_to_open_password_file__s__hr0x_X
call fcn.14004e280
mov rcx, rbx
call fcn.140014880
test al, al
je 0x140014b21
lea rcx, str.Security_reset_succeeded
call fcn.14004e280
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x140014ac1
mov rcx, qword [rbx]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140014aff
call fcn.140014590
mov esi, eax
mov rdi, qword [rsp + 0x48]
jmp 0x140014b07
mov qword [rsp + 0x48], rax
mov esi, r14d
test esi, esi
je 0x140014b5e
cmp esi, 0x80070002
je 0x140014b21
mov edx, esi
lea rcx, str.Failed_to_open_password_file_after_reset_hr0x_X
call fcn.14004e280
lfence
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x140014b34
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140208e10
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x40], r14d
mov qword [rsp + 0x20], r14
lea r9, [rsp + 0x40]
mov r8d, 0x26
lea rdx, [rsp + 0x58]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140014b8a
call fcn.140014590
mov eax, dword [rsp + 0x40]
cmp rax, 0x27
jae 0x140014c0d
mov byte [rsp + rax + 0x58], 0
lea rax, [rsp + 0x58]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140014ba5
lea rdx, [rsp + 0x58]
mov rcx, rbp
call fcn.140002850
test rdi, rdi
je 0x140014bd2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, r14
mov qword [rsp + 0x48], r14
mov rcx, rbx
call fcn.140014880
test al, al
jne 0x140014bf8
cmp qword [rbx + 0x18], 8
jb 0x140014be8
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, str.Warning:_Failed_to_update_security_on_password_file__s
call fcn.14004e280
nop
test rdi, rdi
je 0x140014c06
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140014b36
call fcn.1402092e0
int3
Function at 0x140015a30
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x140300b88]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x34], 4
call fcn.140015ae0
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x140015ac1
mov rdx, qword [rbx + 8]
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
xor r9d, r9d
lea rax, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140015aa8
cmp dword [rsp + 0x30], eax
setne al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140208e10
add rsp, 0x40
pop rbx
ret
cmp eax, 0x3fa
jne 0x140015ac1
mov rcx, qword [rbx + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbx + 0x38], 0
xor al, al
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140208e10
add rsp, 0x40
pop rbx
ret
Function at 0x140018510
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov edx, 0x85
mov rcx, qword [rcx + 0x18]
call fcn.14002d6b0
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140018542
lea eax, [rbx + 0xb]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rax + 8]
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x140018574
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x30]
mov rdx, 0xffffffffffffffff
test eax, eax
cmovne rcx, rdx
jmp 0x140018579
mov rcx, qword [rsp + 0x30]
mov qword [rdi + 0x20], rcx
mov rcx, qword [rbx + 8]
cmp rcx, 0xffffffffffffffff
je 0x14001858d
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.1402122e0
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400289d0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
xor ebp, ebp
mov r14, rdx
mov rdi, rcx
test rcx, rcx
je 0x140028ac6
test rdx, rdx
je 0x140028ac6
mov rbx, 0xffffffffffffffff
inc rbx
cmp word [rcx + rbx*2], bp
jne 0x140028a06
add rbx, 0x2e
cmp rbx, 0x7fff
ja 0x140028ac6
mov qword [rsp + 0x40], rsi
lfence
lea rcx, [rbx + rbx]
call fcn.1402122d0
mov rsi, rax
test rax, rax
jne 0x140028a57
lea eax, [rsi + 6]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
lfence
mov r9, rdi
mov qword [rsp + 0x20], r14
lea r8, str._s_S
mov rdx, rbx
mov rcx, rsi
call fcn.140027d00
movsxd rcx, eax
lea rax, [rbx - 1]
cmp rcx, rax
je 0x140028a91
mov rcx, rsi
mov ebp, 3
call fcn.1402122e0
mov eax, ebp
jmp 0x140028a3c
lfence
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140028ab7
call qword [sym.imp.KERNEL32.dll_GetLastError]
add eax, 0xfffffffe
mov ecx, 3
cmp eax, 1
cmovbe ecx, ebp
mov ebp, ecx
mov rcx, rsi
call fcn.1402122e0
mov eax, ebp
jmp 0x140028a3c
mov eax, 1
jmp 0x140028a41
Function at 0x14002a2e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r15
sub rsp, 0x48
mov rbp, qword [rsp + 0x90]
mov r13, r8
mov r15, rdx
mov r12, rcx
test rbp, rbp
jne 0x14002a315
lea eax, [rbp + 1]
add rsp, 0x48
pop r15
pop r13
pop r12
pop rbp
ret
mov edx, 0x50
mov qword [rsp + 0x78], rsi
mov qword [rbp], 0
lea ecx, [rdx - 0x4f]
call fcn.1402122f4
mov rsi, rax
test rax, rax
jne 0x14002a34b
lea eax, [rsi + 6]
mov rsi, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r13
pop r12
pop rbp
ret
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x40], r14
test r15, r15
je 0x14002a506
xor edi, edi
lea r14, str.HKEY_LOCAL_MACHINE
nop
mov rcx, qword [r14]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x14002a380
mov r8, rbx
mov rdx, r15
call fcn.14021f144
test eax, eax
je 0x14002a3b3
inc rdi
add r14, 0x10
mov rax, rdi
cmp rdi, 0xa
jb 0x14002a370
cmp rax, 0xa
je 0x14002a506
movzx ecx, word [r15 + rbx*2]
lea rax, [r15 + rbx*2]
cmp cx, 0x5c
je 0x14002a3d1
test cx, cx
jne 0x14002a506
cmp cx, 0x5c
jne 0x14002a3df
movzx ecx, word [rax + 2]
add rax, 2
cmp cx, 0x5c
je 0x14002a3d1
add rdi, rdi
xor ebx, ebx
test cx, cx
mov edx, ebx
lea rcx, str.HKEY_LOCAL_MACHINE
mov r9d, 0x20119
cmovne rdx, rax
lea rax, [rsp + 0x38]
mov rcx, qword [rcx + rdi*8 + 8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002a506
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, r13
mov dword [rsp + 0x90], ebx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002a468
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.1402122e0
lea eax, [rbx + 3]
jmp 0x14002a513
mov rcx, qword [rsp + 0x88]
mov eax, dword [rsp + 0x90]
mov qword [rsi + 8], rbx
mov dword [rcx], eax
mov rcx, r15
call fcn.1402186b0
mov qword [rsi + 0x18], rax
test rax, rax
jne 0x14002a4a8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call fcn.1402122e0
mov eax, 6
jmp 0x14002a513
mov rcx, r13
call fcn.1402186b0
mov qword [rsi + 0x20], rax
test rax, rax
jne 0x14002a4dc
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsi + 0x18]
call fcn.1402122e0
mov rcx, rsi
call fcn.1402122e0
mov eax, 6
jmp 0x14002a513
mov eax, dword [rsp + 0x30]
mov dword [rsi + 0x4c], eax
mov dword [rsi + 0x10], 3
test r12, r12
je 0x14002a4f3
mov qword [r12], rsi
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rbp], rsi
jmp 0x14002a513
mov rcx, rsi
call fcn.1402122e0
mov eax, recv
mov rdi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x78]
add rsp, 0x48
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x14002ad00
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov r14, qword [rcx + 8]
mov r15d, edx
mov rbp, rcx
test r14, r14
je 0x14002af7b
xor r12d, r12d
lea r13, str.HKEY_LOCAL_MACHINE
mov edi, r12d
mov rsi, r13
nop word [rax + rax]
mov rcx, qword [rsi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], r12w
jne 0x14002ad50
mov r8, rbx
mov rdx, r14
call fcn.14021f144
test eax, eax
je 0x14002ad83
inc rdi
add rsi, 0x10
mov rax, rdi
cmp rdi, 0xa
jb 0x14002ad40
cmp rax, 0xa
je 0x14002af7b
movzx ecx, word [r14 + rbx*2]
lea rax, [r14 + rbx*2]
cmp cx, 0x5c
je 0x14002ada1
test cx, cx
jne 0x14002af7b
cmp cx, 0x5c
jne 0x14002adaf
movzx ecx, word [rax + 2]
add rax, 2
cmp cx, 0x5c
je 0x14002ada1
add rdi, rdi
mov rdx, r12
test cx, cx
mov r9d, r15d
cmovne rdx, rax
lea rax, [rsp + 0xb8]
mov rcx, qword [r13 + rdi*8 + 8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002aec1
mov rcx, qword [rsp + 0xb8]
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x58], r12
xor r9d, r9d
mov qword [rsp + 0x50], r12
xor r8d, r8d
mov qword [rsp + 0x48], rax
xor edx, edx
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x14002ae44
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 3
jmp 0x14002af80
mov edx, dword [rsp + 0xa0]
mov ecx, 1
add rdx, 2
call fcn.1402122f4
mov rcx, qword [rsp + 0xb8]
mov rdi, rax
test rax, rax
jne 0x14002ae77
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [rdi + 6]
jmp 0x14002af80
mov eax, dword [rsp + 0xa0]
xor r9d, r9d
mov rdx, qword [rbp + 0x10]
xor r8d, r8d
mov dword [rsp + 0xb0], eax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14002aecb
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1402122e0
mov eax, recv
jmp 0x14002af80
mov ecx, reloc.WS2_32.dll_WSACleanup
call fcn.1402122d0
mov rbx, rax
test rax, rax
je 0x14002aef2
lea rcx, [rax + 4]
call fcn.140134d00
test eax, eax
jne 0x14002af0f
mov rcx, rbx
call fcn.1402122e0
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rdi
call fcn.1402122e0
mov eax, 3
jmp 0x14002af80
mov r8d, dword [rsp + 0xb0]
lea rcx, [rbx + 4]
mov rdx, rdi
mov dword [rbx], 2
call fcn.140134d60
lea rcx, [rbp + 0x19]
test rcx, rcx
je 0x14002af55
mov r8d, dword [rbx]
sub r8d, 1
je 0x14002af4c
cmp r8d, 1
jne 0x14002af55
lea rdx, [rbx + 4]
call fcn.1401349e0
jmp 0x14002af55
lea rdx, [rbx + 4]
call fcn.140135fa0
mov rcx, rbx
call fcn.1402122e0
mov rcx, rdi
mov byte [rbp + 0x18], 1
call fcn.1402122e0
mov rcx, qword [rsp + 0xb8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x14002af80
mov eax, 1
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002b560
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r12d, r9d
mov r14, r8
mov rbp, rdx
mov r15, rcx
test rcx, rcx
je 0x14002b6bd
test rdx, rdx
je 0x14002b6bd
test r8, r8
je 0x14002b6bd
mov qword [r8 + 8], rcx
mov rcx, r8
mov qword [r8 + 0x10], rdx
mov edx, r9d
call fcn.14002ad00
test eax, eax
jne 0x14002b6c2
mov dword [r14], 3
lea rsi, str.HKEY_LOCAL_MACHINE
mov byte [r14 + 0x18], 1
xor edi, edi
nop dword [rax]
mov rcx, qword [rsi]
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rcx + rbx*2], 0
jne 0x14002b5e0
mov r8, rbx
mov rdx, r15
call fcn.14021f144
test eax, eax
je 0x14002b613
inc rdi
add rsi, 0x10
mov rax, rdi
cmp rdi, 0xa
jb 0x14002b5d0
cmp rax, 0xa
je 0x14002b6bd
movzx ecx, word [r15 + rbx*2]
lea rax, [r15 + rbx*2]
cmp cx, 0x5c
je 0x14002b631
test cx, cx
jne 0x14002b6bd
cmp cx, 0x5c
jne 0x14002b63f
movzx ecx, word [rax + 2]
add rax, 2
cmp cx, 0x5c
je 0x14002b631
xor edx, edx
add rdi, rdi
test cx, cx
mov r9d, r12d
lea rcx, str.HKEY_LOCAL_MACHINE
cmovne rdx, rax
lea rax, [rsp + 0x30]
mov rcx, qword [rcx + rdi*8 + 8]
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14002b6b6
mov rcx, qword [rsp + 0x30]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x28], 0
xor r8d, r8d
mov rdx, rbp
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x14002b6b6
mov eax, dword [rsp + 0x70]
mov dword [r14 + 0x3c], eax
xor eax, eax
jmp 0x14002b6c2
mov eax, 3
jmp 0x14002b6c2
mov eax, 1
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14002d070
Capabilities:
Get file size

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 8]
lea rdx, [rsp + 0x34]
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [rsp + 0x30], eax
cmp eax, 0xffffffff
jne 0x14002d0ab
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
mov rdx, 0xffffffffffffffff
mov rax, qword [rsp + 0x30]
test ecx, ecx
cmovne rax, rdx
add rsp, 0x28
ret
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x14002d390
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
cmp dword [rcx], 0
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
jne 0x14002d3e7
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x80]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14002d3db
mov ebx, 0xffffffff
mov dword [rsp + 0x80], ebx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [rsp + 0x80]
jmp 0x14002d48e
mov r10, qword [0x140308978]
mov ebx, 0xffffffff
test r10, r10
jne 0x14002d435
mov rcx, qword [0x140308970]
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x140308d30]
mov rcx, qword [0x140308970]
mov qword [0x140308978], rax
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x140308970]
test rax, rax
je 0x14002d48e
mov r10, qword [0x140308978]
mov rax, qword [rdi + 0x10]
xor r9d, r9d
mov rcx, qword [rdi + 8]
xor r8d, r8d
mov qword [rsp + 0x98], rax
xor edx, edx
mov qword [rsp + 0x40], 0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov dword [rsp + 0x30], esi
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rax
mov rax, r10
call qword [case.0x14004822f.0]
test eax, eax
jne 0x14002d48e
mov rbx, qword [rsp + 0x58]
mov ecx, ebx
add qword [rdi + 0x10], rcx
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret

Function at 0x14002d600
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], 0
mov rsi, rcx
test rcx, rcx
je 0x14002d695
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.14002da50
test eax, eax
je 0x14002d695
mov qword [rsp + 0x38], rdi
xor ebx, ebx
mov rdi, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14002d671
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, 0xffffffff
cmp eax, 5
jne 0x14002d671
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x14002d666
xor ebx, ebx
jmp 0x14002d671
mov ecx, 5
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp rdi, rsi
je 0x14002d683
test rdi, rdi
je 0x14002d683
mov rcx, rdi
call fcn.1402122e0
mov rdi, qword [rsp + 0x38]
mov eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x40]
mov eax, 0xffffffff
add rsp, 0x20
pop rsi
ret
Function at 0x14002de30
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, 1
xor eax, eax
lock cmpxchg dword [0x140308990], ebx
jne 0x14002de63
call fcn.140035b70
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140308988], rax
jmp 0x14002de6a
mov rax, qword [0x140308988]
test rax, rax
je 0x14002dec9
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp qword [0x140308998], 0
jne 0x14002dea1
call fcn.140035b70
mov rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [0x140308998], rax
xor edx, edx
lea ecx, [rdx + 0xc]
call fcn.14012ed50
call fcn.140119630
mov ebx, eax
test eax, eax
jne 0x14002debc
inc dword [0x140308984]
mov rcx, qword [0x140308988]
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x14003ec40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov r14, qword [0x1403089d0]
test r14, r14
je 0x14003eddd
cmp qword [r14 + 0x68], 0
je 0x14003eddd
lea r8, str.Starting_communications_threads...
mov edx, 1
mov ecx, 0x10000
call fcn.140040c70
xor r15d, r15d
mov esi, r15d
cmp r15d, dword [r14 + 0x60]
jae 0x14003ed2e
nop dword [rax]
mov rax, qword [r14 + 0x68]
mov ecx, esi
mov rbx, qword [rax + rcx*8]
test rbx, rbx
je 0x14003ed2a
mov rbp, qword [rbx + 0x38]
test rbp, rbp
je 0x14003ed2a
lea rcx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [rbx + 0x88], 1
lea rcx, [rbx + 0x60]
je 0x14003ed24
mov byte [rbx + 0x88], 1
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov r9, qword [rbx + 0x40]
lea rax, [rbp + 0x10]
mov r8, qword [rbx + 0x48]
xor edx, edx
mov qword [rsp + 0x28], rax
xor ecx, ecx
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbp + 8], rax
test rax, rax
je 0x14003ed0f
inc esi
cmp esi, dword [r14 + 0x60]
jb 0x14003eca0
jmp 0x14003ed2a
lea rcx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbx + 0x60]
mov byte [rbx + 0x88], r15b
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp esi, dword [r14 + 0x60]
jne 0x14003ed37
mov al, 1
jmp 0x14003eddf
test esi, esi
je 0x14003ed83
mov qword [rsp + 0x50], r12
mov r12, r15
mov ebp, esi
nop word [rax + rax]
mov rax, qword [r14 + 0x68]
mov rbx, qword [r12 + rax]
lea rcx, [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea rcx, [rbx + 0x60]
mov byte [rbx + 0x88], r15b
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r12, [r12 + 8]
sub rbp, 1
jne 0x14003ed50
mov r12, qword [rsp + 0x50]
mov rcx, qword [r14]
test rcx, rcx
je 0x14003ed93
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CancelIoEx]
test esi, esi
je 0x14003eddd
mov edi, esi
nop dword [rax]
mov rax, qword [r14 + 0x68]
mov rbx, qword [r15 + rax]
test rbx, rbx
je 0x14003edd3
mov rbx, qword [rbx + 0x38]
test rbx, rbx
je 0x14003edd3
cmp qword [rbx + 8], 0
je 0x14003edd3
nop dword [rax]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14003edc0
add r15, 8
sub rdi, 1
jne 0x14003eda0
xor al, al
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1400459b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140300b88]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, qword [r8]
mov r14, r9
mov rbp, qword [rsp + 0xe0]
mov rsi, rdx
mov r15, qword [rsp + 0xe8]
mov rbx, rcx
mov r12, qword [rsp + 0xf0]
test rdi, rdi
je 0x140045ab6
cmp qword [rdi + 8], 0xffffffffffffffff
je 0x140045ab6
cmp byte [rcx + 4], 0
je 0x140045a19
mov eax, dword [rdi]
cmp dword [rcx], eax
jl 0x140045ab6
mov r9, rsi
lea rdx, str._FT_T
mov r8, rbx
lea rcx, [rsp + 0x38]
call fcn.140044280
mov r8d, dword [rsp + 0x48]
lea rdx, [rsp + 0x38]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x30]
xor eax, eax
mov qword [rsp + 0x68], 0xffffffffffffffff
cmp qword [rsp + 0x50], 0x10
mov dword [rsp + 0x30], eax
cmovae rdx, qword [rsp + 0x38]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140045ab6
mov rcx, qword [rsp + 0x38]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140045ab1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140045afe
call fcn.1402090c4
mov rcx, qword [r14]
test rcx, rcx
je 0x140045ac9
mov r8, rsi
mov rdx, rbx
call fcn.140044540
mov r9, r15
mov qword [rsp + 0x20], r12
mov r8, rbp
mov rdx, rsi
mov rcx, rbx
call fcn.140046a80
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140208e10
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.140212258
int3