joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020bc0
Capabilities:
Hash data with md5

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x110
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov rbp, rcx
add rcx, 0x38
lea rdx, [rsp + 0x38]
call fcn.140031c00
nop
cmp qword [rsp + 0x50], 0
je 0x140020dd8
mov r8d, 7
lea rdx, [0x1400fc320]
lea rcx, [rsp + 0x38]
call fcn.1400219b0
lea rdx, vtable.CMD5Checksum.0
mov qword [rsp + 0x90], rdx
xor eax, eax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
xor esi, esi
mov dword [rsp + 0xec], esi
mov dword [rsp + 0xe8], esi
mov dword [rsp + 0xf0], 0x67452301
mov dword [rsp + 0xf4], 0xefcdab89
mov dword [rsp + 0xf8], 0x98badcfe
mov dword [rsp + 0xfc], 0x10325476
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r8, qword [rsp + 0x40]
mov r9d, dword [rsp + 0x50]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x90]
call fcn.1400321a0
nop
mov rdi, qword [rax]
lea rcx, [0x14012bdf0]
mov rax, qword [0x14012bdf0]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
test rdi, rdi
je 0x140020d30
test rdi, 0xffffffffffff0000
jne 0x140020d30
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.140020620
test rax, rax
je 0x140020d42
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140022430
mov rbx, qword [rsp + 0x20]
jmp 0x140020d42
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140021730
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x80], 0xf
mov qword [rsp + 0x78], rsi
mov byte [rsp + 0x68], 0
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140004cb0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140020d96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140020db3
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 8]
lea rdx, [rsp + 0x60]
call fcn.140021120
nop
cmp qword [rsp + 0x80], 0x10
jb 0x140020dd8
mov rcx, qword [rsp + 0x68]
call fcn.1400ad0b8
nop
cmp qword [rsp + 0x58], 0x10
jb 0x140020dea
mov rcx, qword [rsp + 0x40]
call fcn.1400ad0b8
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1400ad2c0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140025520
Capabilities:
Get common file path
Get startup folder

Disassembly:
push rdi
sub rsp, 0x260
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x270], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rdx
mov qword [rsp + 0x30], rdx
xor edi, edi
mov dword [rsp + 0x20], edi
mov word [rsp + 0x40], di
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x42]
call fcn.1400ad2f0
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rdi
mov word [rbx + 8], di
mov dword [rsp + 0x20], 1
lea r9d, [rdi + 1]
lea r8d, [rdi + 0x2e]
lea rdx, [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x40]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140025a70
mov r8d, 0x1a
lea rdx, str.BaiduCommonI18Nconf.db
mov rcx, rbx
call fcn.1400258f0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x270]
add rsp, 0x260
pop rdi
ret
Function at 0x140029900
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x100], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rbp, rdx
xor esi, esi
mov dword [rsp + 0x20], esi
lea rdx, [rsp + 0x38]
call fcn.140029c20
nop
lea rax, vtable.CMD5Checksum.0
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0xbc], esi
mov dword [rsp + 0xb8], esi
mov dword [rsp + 0xc0], 0x67452301
mov dword [rsp + 0xc4], 0xefcdab89
mov dword [rsp + 0xc8], 0x98badcfe
mov dword [rsp + 0xcc], 0x10325476
lea r8, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r8, qword [rsp + 0x40]
mov r9d, dword [rsp + 0x50]
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.1400321a0
nop
mov rdi, qword [rax]
lea rcx, [0x14012bdf0]
mov rax, qword [0x14012bdf0]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
test rdi, rdi
je 0x140029a40
test rdi, 0xffffffffffff0000
jne 0x140029a40
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.140020620
test rax, rax
je 0x140029a52
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140022430
mov rbx, qword [rsp + 0x20]
jmp 0x140029a52
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140021730
mov rbx, qword [rsp + 0x20]
mov qword [rbp + 0x20], 0xf
mov qword [rbp + 0x18], rsi
mov byte [rbp + 8], 0
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
mov rcx, rbp
call fcn.140004cb0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140029a9e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140029abc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
cmp qword [rsp + 0x58], 0x10
jb 0x140029ad3
mov rcx, qword [rsp + 0x40]
call fcn.1400ad0b8
mov rax, rbp
jmp 0x140029ad6
mov rax, rbp
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x100]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140029b00
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x10], rax
mov eax, edx
mov r11d, edx
mov rbx, rcx
and eax, 0xfffffff0
mov byte [rsp], 0x54
mov byte [rsp + 1], 0x5a
mov byte [rsp + 2], 0x8f
mov byte [rsp + 3], 0x1a
mov byte [rsp + 4], 0x2a
mov byte [rsp + 5], 0x3c
mov byte [rsp + 6], 0x4e
mov byte [rsp + 7], 0x72
mov byte [rsp + 8], 0xa8
mov byte [rsp + 9], 0x1b
mov byte [rsp + 0xa], 0xa
mov byte [rsp + 0xb], 0xbd
mov byte [rsp + 0xc], 0x2a
mov byte [rsp + 0xd], 0x4c
mov byte [rsp + 0xe], 0x56
mov byte [rsp + 0xf], 0x15
mov r10d, 0
jbe 0x140029bd0
inc rcx
dec eax
shr eax, 4
inc eax
mov r10d, eax
mov r9d, eax
shl r10d, 4
nop dword [rax + rax]
lea rdx, [rsp + 1]
mov r8d, 4
nop dword [rax + rax]
movzx eax, byte [rdx - 1]
add rcx, 4
add rdx, 4
xor byte [rcx - 5], al
movzx eax, byte [rdx - 4]
xor byte [rcx - 4], al
movzx eax, byte [rdx - 3]
xor byte [rcx - 3], al
movzx eax, byte [rdx - 2]
xor byte [rcx - 2], al
sub r8, 1
jne 0x140029ba0
sub r9, 1
jne 0x140029b90
movsxd rax, r10d
cmp r10d, r11d
jae 0x140029c02
sub r11d, r10d
lea rcx, [rax + rbx]
lea rdx, [rsp]
mov r8d, r11d
nop word [rax + rax]
movzx eax, byte [rdx]
inc rcx
inc rdx
xor byte [rcx - 1], al
sub r8, 1
jne 0x140029bf0
mov rcx, qword [rsp + 0x10]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0x20
pop rbx
ret
Function at 0x140031540
Capabilities:
Hash data with md5

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xe0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x110], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov rdi, rdx
mov rbp, rcx
cmp qword [rdx + 0x18], 0
je 0x140031746
call fcn.140030ee0
cmp qword [rdi + 0x18], 0
je 0x140031746
lea rax, vtable.CMD5Checksum.0
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
xor esi, esi
mov dword [rsp + 0xbc], esi
mov dword [rsp + 0xb8], esi
mov dword [rsp + 0xc0], 0x67452301
mov dword [rsp + 0xc4], 0xefcdab89
mov dword [rsp + 0xc8], 0x98badcfe
mov dword [rsp + 0xcc], 0x10325476
lea r8d, [rax + 7]
lea rdx, [0x1400fc320]
mov rcx, rdi
call fcn.1400219b0
mov r11, qword [rdi + 0x18]
cmp qword [rdi + 0x20], 0x10
jb 0x14003163a
mov r8, qword [rdi + 8]
jmp 0x14003163e
lea r8, [rdi + 8]
mov r9d, r11d
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.1400321a0
nop
mov rdi, qword [rax]
lea rcx, [0x14012bdf0]
mov rax, qword [0x14012bdf0]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x20], rbx
test rdi, rdi
je 0x1400316a4
test rdi, 0xffffffffffff0000
jne 0x1400316a4
movzx edi, di
xor edx, edx
mov ecx, edi
call fcn.140020620
test rax, rax
je 0x1400316b6
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140022430
mov rbx, qword [rsp + 0x20]
jmp 0x1400316b6
mov rdx, rdi
lea rcx, [rsp + 0x20]
call fcn.140021730
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x58], 0xf
mov qword [rsp + 0x50], rsi
mov byte [rsp + 0x40], 0
xor eax, eax
or rsi, 0xffffffffffffffff
mov rcx, rsi
mov rdi, rbx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.140004cb0
nop
lea rdx, [rbx - 0x18]
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140031707
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x140031724
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp + 8]
lea rdx, [rsp + 0x38]
call fcn.140021120
nop
cmp qword [rsp + 0x58], 0x10
jb 0x140031746
mov rcx, qword [rsp + 0x40]
call fcn.1400ad0b8
nop
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x110]
add rsp, 0xe0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140034360
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x250
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [0x140131350]
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x20], esi
test al, 1
jne 0x1400343c0
or eax, 1
lea rcx, [0x1400ed400]
mov qword [0x140131348], 7
mov qword [0x140131340], rsi
mov word [0x140131330], si
mov dword [0x140131350], eax
call fcn.1400b0198
cmp qword [0x140131340], rsi
jne 0x140034426
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x268], rdi
mov word [rsp + 0x30], si
call fcn.1400ad2f0
lea rdx, [rsp + 0x30]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [0x140131328]
call fcn.140025a70
mov rdi, qword [rsp + 0x268]
cmp qword [0x140131348], 8
lea rcx, [0x140131330]
cmovae rcx, qword [0x140131330]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x140034453
lea rcx, [0x140131328]
call fcn.140034590
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rsi
lea rdx, [0x140131328]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rcx, rbx
mov word [rbx + 8], si
call fcn.140025740
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x270]
add rsp, 0x250
pop rsi
ret
Function at 0x140034d50
Capabilities:
Get file size

Disassembly:
push rsi
sub rsp, 0x40
cmp qword [rcx + 0x20], 8
jb 0x140034d63
mov rcx, qword [rcx + 8]
jmp 0x140034d67
add rcx, 8
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edx, 0x80000000
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140034da3
xor eax, eax
add rsp, 0x40
pop rsi
ret
lea rdx, [rsp + 0x50]
mov rcx, rax
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp eax, 0xffffffff
jne 0x140034dd4
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140034dd4
xor eax, eax
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop rsi
ret
mov qword [rsp + 0x58], rbx
mov ebx, dword [rsp + 0x50]
mov rcx, rsi
shl rbx, 0x20
add rbx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x60]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rsi
ret
Function at 0x140035110
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x4d0
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x4c0], rax
mov rbx, rdx
mov r12, rcx
cmp qword [rdx + 0x20], 8
jb 0x14003515b
lea rdi, [rdx + 8]
mov rcx, qword [rdi]
jmp 0x140035162
lea rdi, [rdx + 8]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x140035185
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call fcn.140025740
mov al, 1
jmp 0x14003533d
mov bpl, 1
xor r14d, r14d
mov word [rsp + 0xa0], r14w
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0xa2]
call fcn.1400ad2f0
cmp qword [rbx + 0x20], 8
jb 0x1400351b3
mov rdi, qword [rdi]
mov r8, rdi
mov edx, 0x104
lea rcx, [rsp + 0xa0]
call fcn.1400aeb10
lea rcx, [rsp + 0xa0]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
mov r13, rax
mov r9, qword [rbx + 0x18]
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, r13
repne scasw ax, word [rdi]
not rcx
dec rcx
movsxd rdx, ecx
sub r9, rdx
xor r8d, r8d
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140029e30
nop
mov esi, 1
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r14
mov word [rsp + 0x50], r14w
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.140025740
nop
nop word [rax + rax]
lea rax, [rsp + 0x78]
cmp qword [rsp + 0x90], 8
cmovae rax, qword [rsp + 0x78]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
lea r9, str._s__d_s
mov edx, 0x104
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x2b0]
call fcn.1400ae9cc
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x2b0]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x2b0]
lea rcx, [rsp + 0x48]
call fcn.140025a70
inc esi
cmp esi, 0x400
jg 0x1400352d3
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x1400352ea
jmp 0x140035240
xor r8d, r8d
lea rdx, [0x1400f9500]
lea rcx, [rsp + 0x48]
call fcn.140025a70
xor bpl, bpl
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, r12
call fcn.140025740
nop
cmp qword [rsp + 0x68], 8
jb 0x140035311
mov rcx, qword [rsp + 0x50]
call fcn.1400ad0b8
mov qword [rsp + 0x68], 7
mov qword [rsp + 0x60], r14
mov word [rsp + 0x50], r14w
cmp qword [rsp + 0x90], 8
jb 0x14003533a
mov rcx, qword [rsp + 0x78]
call fcn.1400ad0b8
mov al, bpl
mov rcx, qword [rsp + 0x4c0]
xor rcx, rsp
call fcn.1400ad2c0
lea r11, [rsp + 0x4d0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x1400356c0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
cmp qword [rcx + 0x20], 8
mov rdi, rcx
jb 0x1400356de
lea rbx, [rcx + 8]
mov rcx, qword [rcx + 8]
jmp 0x1400356e5
lea rbx, [rcx + 8]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1400357b2
mov rdx, qword [rdi + 0x18]
mov rcx, 0xffffffffffffffff
mov eax, 2
add edx, 4
mov qword [rsp + 0x70], rsi
mul rdx
cmovo rax, rcx
mov rcx, rax
call fcn.140097a1c
cmp qword [rdi + 0x20], 8
mov rsi, rax
jb 0x140035727
mov rbx, qword [rbx]
mov edx, dword [rdi + 0x18]
mov r8, rbx
mov rcx, rax
add edx, 3
call fcn.1400aeb10
mov r11, qword [rdi + 0x18]
xor eax, eax
mov qword [rsi + r11*2], rax
xor ecx, ecx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x48], rax
mov eax, 0x414
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
mov rcx, rsi
test eax, eax
sete bl
call fcn.1400afc58
mov rsi, qword [rsp + 0x70]
mov al, bl
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400357c0
Capabilities:
Delete directory
Delete file
Write file on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0xb0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0xa0], rax
lea r8, str.:_test4822FBB5_0309_420f_9DA2_FA5B8B854946
mov rdx, rcx
lea rcx, [r11 - 0x40]
call fcn.140037aa0
nop
lea r8, str._test4822FBB5_0309_420f_9DA2_FA5B8B854947.txt
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x50]
call fcn.140037aa0
nop
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x80]
cmp qword [rsp + 0x98], 8
cmovae rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor bl, bl
lea rcx, [rsp + 0x78]
call fcn.140034590
xor esi, esi
test eax, eax
je 0x140035914
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140035907
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
lea r8d, [rsi + 0xa]
lea rdx, str.test_write
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
movzx ebx, bl
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x58]
cmp qword [rsp + 0x70], 8
cmovae rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dl, 1
lea rcx, [rsp + 0x78]
call fcn.1400356c0
nop
cmp qword [rsp + 0x70], 8
jb 0x140035926
mov rcx, qword [rsp + 0x58]
call fcn.1400ad0b8
mov qword [rsp + 0x70], 7
mov qword [rsp + 0x68], rsi
mov word [rsp + 0x58], si
cmp qword [rsp + 0x98], 8
jb 0x140035955
mov rcx, qword [rsp + 0x80]
call fcn.1400ad0b8
mov al, bl
jmp 0x140035957
mov al, bl
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400ad2c0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140037320
Capabilities:
Check mutex on windows

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, rdx
mov rbx, rcx
mov qword [r11 - 0x20], 7
xor eax, eax
mov qword [r11 - 0x28], rax
mov word [rsp + 0x30], ax
lea r8d, [rax + 0x1a]
lea rdx, str.GlobalMutex_BIDUI18NGUID_
lea rcx, [r11 - 0x40]
call fcn.140025a70
nop
cmp qword [rdi + 0x20], 8
jb 0x14003737f
mov rcx, qword [rdi + 8]
jmp 0x140037383
lea rcx, [rdi + 8]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, rax
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rsp + 0x28]
call fcn.1400258f0
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov qword [rbx], rax
test rax, rax
je 0x1400373f5
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x1400373f5
cmp qword [rsp + 0x48], 8
jb 0x1400373ee
mov rcx, qword [rsp + 0x30]
call fcn.1400ad0b8
mov eax, 1
jmp 0x140037409
cmp qword [rsp + 0x48], 8
jb 0x140037407
mov rcx, qword [rsp + 0x30]
call fcn.1400ad0b8
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x140038550
Capabilities:
Query or enumerate registry key

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x2b0
mov qword [rsp + 0x80], 0xfffffffffffffffe
mov qword [rsp + 0x2d0], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
mov rdi, r9
mov rbx, rdx
mov qword [rsp + 0x88], rdx
xor ebp, ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x48], rbp
lea ecx, [rbp + 8]
call fcn.1400aee14
test rax, rax
je 0x1400385ac
mov qword [rax], rbx
jmp 0x1400385af
mov rax, rbp
mov qword [rbx], rax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], rbp
mov qword [rbx + 0x28], rbp
mov dword [rsp + 0x50], 1
cmp qword [rdi + 0x20], 8
jb 0x1400385d3
mov rdx, qword [rdi + 8]
jmp 0x1400385d7
lea rdx, [rdi + 8]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 8
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140038723
mov esi, ebp
mov word [rsp + 0x90], bp
xor edx, edx
mov r8d, 0x206
lea rcx, [rsp + 0x92]
call fcn.1400ad2f0
mov dword [rsp + 0x40], 0x104
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x140038713
nop dword [rax]
inc esi
mov qword [rsp + 0x78], 7
mov qword [rsp + 0x70], rbp
mov word [rsp + 0x60], bp
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x90]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x58]
call fcn.140025a70
nop
lea rdx, [rsp + 0x58]
mov rcx, rbx
call fcn.140039eb0
nop
cmp qword [rsp + 0x78], 8
jb 0x1400386c0
mov rcx, qword [rsp + 0x60]
call fcn.1400ad0b8
mov dword [rsp + 0x40], 0x104
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x90]
call fcn.1400ad2f0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rbp
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x90]
mov edx, esi
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x140038660
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
jmp 0x140038726
mov rax, rbx
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x2d0]
add rsp, 0x2b0
pop rdi
pop rsi
pop rbp
ret