joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e6e5c
Capabilities:
Print debug messages

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x13b8]
mov eax, 0x14b8
call fcn.140398e10
sub rsp, rax
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rbp + 0x13a0], rax
mov rcx, qword [rcx + 0x38]
mov r10d, edx
mov rax, qword [rbp + 0x1410]
mov r14, qword [rbp + 0x1418]
mov r15, qword [rbp + 0x1420]
test rcx, rcx
je 0x1400e6ef9
mov dword [rsp + 0x78], edx
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x30], rdx
lea rdx, [rbp - 0x78]
mov qword [rsp + 0x28], rdx
lea rdx, [rbp - 0x70]
mov dword [rsp + 0x70], r9d
lea r9, [rsp + 0x70]
mov qword [rbp - 0x68], r8
lea r8, [rbp - 0x68]
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x78], r14
mov qword [rbp - 0x70], rax
mov rax, qword [rcx]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x78]
call qword [rax + reloc.WS2_32.dll_recv]
jmp 0x1400e6fac
mov eax, 0x66666667
lea rsi, str.vdiwe
imul r10d
lea rcx, [rbp - 0x60]
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
sub r10d, eax
movsxd rax, r10d
mov rsi, qword [rsi + rax*8]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
xor edx, edx
lea rcx, [rbp - 0x50]
mov r8d, 0x13e8
call fcn.14039b120
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
movzx ecx, word [rbp - 0x52]
mov edx, 0x13e8
movzx r8d, word [rbp - 0x54]
movzx r10d, word [rbp - 0x56]
movzx r11d, word [rbp - 0x58]
movzx ebx, word [rbp - 0x5a]
movzx edi, word [rbp - 0x5e]
movzx r9d, word [rbp - 0x60]
mov qword [rsp + 0x68], r15
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x48], ecx
lea rcx, [rbp - 0x50]
mov dword [rsp + 0x40], r8d
lea r8, str.__d__d__d:_d:_02d:_02d:_03d__05d___s__s:_s_n
mov dword [rsp + 0x38], r10d
mov dword [rsp + 0x30], r11d
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], edi
call fcn.140089e20
lea rcx, [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rbp + 0x13a0]
xor rcx, rsp
call fcn.140398000
add rsp, 0x14b8
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x1400ed1b8
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rdx, rcx
jmp 0x1400ed1c0
movabs rcx, 0xcbf29ce484222325
xor r8d, r8d
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc r8
imul rcx, r9
cmp r8, 4
jb 0x1400ed1cd
mov rax, rcx
ret
Function at 0x14011fd70
Capabilities:
Resume thread
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xf0
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rbp + 0x17], rax
mov r15, r8
mov rsi, rdx
mov r14, rcx
xor r12d, r12d
mov ebx, r12d
mov qword [rsp + 0x40], rbx
cmp byte [rdx + 0x10], r12b
je 0x14011fe59
movzx edi, byte [rdx + 0x11]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateJobObjectW]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x14011fe47
xorps xmm0, xmm0
movups xmmword [rbp - 0x79], xmm0
movups xmmword [rbp - 0x69], xmm0
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
mov dword [rbp - 0x51], 1
mov dword [rbp - 0x69], 0xc08
mov r9d, 0x90
lea r8, [rbp - 0x79]
lea edx, [r12 + 9]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
jne 0x14011fe47
test dil, dil
jne 0x14011fe59
mov dword [rsp + 0x30], 0xff
mov r9d, 4
lea r8, [rsp + 0x30]
mov edx, r9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetInformationJobObject]
test eax, eax
jne 0x14011fe59
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14011fe59
xor r14b, r14b
jmp 0x14011fee2
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, r14
call fcn.14011f990
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
test al, al
je 0x14011feb9
test rbx, rbx
je 0x14011ff17
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_AssignProcessToJobObject]
test eax, eax
jne 0x14011ff17
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x14011ff17
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
xor r14b, r14b
test rdi, rdi
je 0x14011fecf
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x30], r12
test rsi, rsi
je 0x14011fee2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x38], r12
test rbx, rbx
je 0x14011fef5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rsp + 0x40], r12
movzx eax, r14b
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.140398000
add rsp, 0xf0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov r14b, 1
jmp 0x14011febc
Function at 0x140124840
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rbx
sub rsp, 0x40
mov rbx, rcx
cmp dword [rcx + 8], 0
jle 0x140124921
call fcn.140124ba0
test al, al
je 0x140124921
lea rax, [rsp + 0x20]
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
lea r8d, [rax - 1]
mov rdx, qword [rbx]
lea rcx, [rsp + 0x20]
call fcn.140123b70
nop
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1401248ab
cmp word [rcx], 0
jne 0x1401248b2
lea rcx, [0x1404d345c]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1401248e4
test al, 1
je 0x1401248e4
and eax, 0xfffffffe
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x1401248d4
cmp word [rcx], 0
jne 0x1401248db
lea rcx, [0x1404d345c]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
nop
lea rcx, [rsp + 0x20]
call fcn.140123b10
mov rcx, qword [rbx]
test rcx, rcx
je 0x1401248fc
cmp word [rcx], 0
jne 0x140124903
lea rcx, [0x1404d345c]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebx, eax
test eax, eax
jne 0x140124915
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, 1
sete al
add rsp, 0x40
pop rbx
ret
xor al, al
add rsp, 0x40
pop rbx
ret

Function at 0x1401249b0
Capabilities:
Get file size
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test rcx, rcx
jne 0x1401249e0
lea eax, [rcx - 1]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov qword [rsp + 0x48], rbx
test r9d, r9d
js 0x140124a2d
lea rdx, [rsp + 0x40]
movsxd rbx, r9d
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov rax, qword [rsp + 0x40]
mov ecx, 0xffffffff
cmp rax, rcx
je 0x140124a2d
test rax, rax
je 0x140124a2d
cmp rax, rbx
jb 0x140124a2d
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x140124a2d
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
lea r9, [rsp + 0x40]
mov r8d, esi
mov dword [rsp + 0x40], ebx
mov rdx, rbp
mov qword [rsp + 0x20], rbx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x140124a56
mov ebx, dword [rsp + 0x40]
jmp 0x140124a5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rbp, qword [rsp + 0x50]
mov eax, ebx
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140124a80
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 8]
mov rbx, rcx
test eax, eax
jle 0x140124b8a
cmp eax, 1
jl 0x140124abf
dec eax
mov r8d, 1
movsxd rdx, eax
mov rax, qword [rcx]
lea rcx, [rax + rdx*2]
lea rdx, [0x1405138a4]
call fcn.1403bb584
test eax, eax
je 0x140124b57
mov eax, dword [rbx + 8]
cmp eax, 1
jl 0x140124ae9
dec eax
lea rdx, str.___t_n_r
movsxd rcx, eax
mov r8d, 1
mov rax, qword [rbx]
lea rcx, [rax + rcx*2]
call fcn.1403bb584
test eax, eax
je 0x140124b57
mov r8d, dword [rbx + 8]
mov ecx, dword [rbx + 0xc]
inc r8d
cmp ecx, r8d
jge 0x140124b3a
mov qword [rsp + 0x30], rdi
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
lea edi, [rax + rcx]
cmp edi, r8d
cmovle edi, r8d
cmp edi, ecx
jle 0x140124b35
mov rcx, qword [rbx]
movsxd rdx, edi
lea rdx, [rdx*2 + 2]
call fcn.1403a8174
movsxd rcx, dword [rbx + 8]
xor edx, edx
mov qword [rbx], rax
mov word [rax + rcx*2], dx
mov dword [rbx + 0xc], edi
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rbx]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140124b41
mov eax, dword [0x1405138a4]
mov dword [rcx], eax
inc dword [rbx + 8]
mov rdx, qword [rbx]
test rdx, rdx
je 0x140124b65
cmp word [rdx], 0
jne 0x140124b6c
lea rdx, [0x1404d345c]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
test eax, eax
je 0x140124b82
cmp eax, 0xb7
jne 0x140124b8a
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret
Function at 0x140126c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x50]
xor ebp, ebp
mov rax, qword [rsp + 0x58]
mov r13, r9
mov rbx, qword [rsp + 0x68]
mov r12, rdx
mov qword [r14], r8
mov qword [rbx], rax
mov rax, qword [r14]
cmp rax, r9
je 0x140126dc4
mov r15, qword [rsp + 0x60]
lea r9d, [rbp + 1]
mov rdi, qword [rbx]
mov r11d, 0x2800
mov r8d, 0x3ff
mov r10d, 0x2400
cmp rdi, r15
je 0x140126dc4
movzx edx, word [r12]
xor sil, sil
movzx ecx, word [rax]
cmp r9w, dx
jae 0x140126ccb
lea eax, [r10 + rcx]
cmp ax, r8w
ja 0x140126deb
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x140126ce2
mov eax, ecx
add cx, r11w
cmp cx, r8w
ja 0x140126ce2
shl eax, 0xa
mov sil, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140126cf5
movzx r8d, al
mov r10d, ebp
mov r11d, ebp
jmp 0x140126d42
mov r8d, eax
cmp eax, 0x800
jae 0x140126d0f
shr r8d, 6
mov r10d, r9d
or r8b, 0xc0
mov r11d, r9d
jmp 0x140126d42
cmp eax, 0x10000
jae 0x140126d29
shr r8d, 0xc
mov r10d, 2
or r8b, 0xe0
mov r11d, r10d
jmp 0x140126d42
shr r8d, 0x12
mov r10d, 3
movzx r11d, sil
or r8b, 0xf0
xor r11d, 1
add r11d, r11d
lea r9d, [r11 + 1]
mov rdx, r15
sub rdx, rdi
mov ecx, r9d
cmp rdx, rcx
jl 0x140126dc4
add qword [r14], 2
test sil, sil
jne 0x140126d63
cmp r10d, 3
jae 0x140126d6f
mov rcx, qword [rbx]
mov r9d, r11d
mov byte [rcx], r8b
inc qword [rbx]
test r9d, r9d
je 0x140126da1
lea r8d, [r10 + r10*2]
add r8d, r8d
nop dword [rax + rax]
sub r8d, 6
mov edx, eax
mov ecx, r8d
dec r9d
shr edx, cl
mov rcx, qword [rbx]
and dl, 0x3f
or dl, 0x80
mov byte [rcx], dl
inc qword [rbx]
test r9d, r9d
jg 0x140126d80
shr eax, 0xa
mov r9d, 1
test sil, sil
mov ecx, r9d
cmovne ecx, eax
mov word [r12], cx
mov rax, qword [r14]
cmp rax, r13
jne 0x140126c7f
mov rax, qword [rsp + 0x40]
cmp rax, qword [r14]
sete bpl
mov eax, ebp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov eax, 2
jmp 0x140126dd2

Function at 0x140129050
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x40
mov rbx, rcx
mov dword [rsp + 0x20], 0
cmp qword [rdx + 0x18], 8
jb 0x14012906f
mov rdx, qword [rdx]
mov rcx, rdx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140129098
mov dword [rbx + 8], eax
mov qword [rbx], 0
mov dword [rsp + 0x20], 1
mov rax, rbx
add rsp, 0x40
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.GetFileAttributesW_failed
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], 0x19
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.1401307b0
nop
mov rcx, qword [rax]
mov qword [rbx], rcx
mov qword [rax], 0x36
cmp qword [rbx], 0
jne 0x1401290ec
mov rcx, rbx
call fcn.140136b40
nop
mov dword [rsp + 0x20], 1
mov rcx, qword [rsp + 0x58]
movzx eax, cl
not al
test al, 1
jne 0x140129107
call fcn.140136020
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140129150
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xa0
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rbp + 0x3f], rax
mov edi, r8d
mov rax, rdx
mov rbx, rcx
mov qword [rbp - 0x19], rcx
mov dword [rbp - 0x39], 0
cmp qword [rdx + 0x18], 8
jb 0x140129190
mov rax, qword [rdx]
mov edx, edi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x1401291bf
mov qword [rbx], 0
mov ecx, 2
mov dword [rbp - 0x39], ecx
and ecx, 0xfffffffd
mov dword [rbp - 0x39], ecx
or ecx, 1
mov dword [rbp - 0x39], ecx
jmp 0x1401292b5
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea rdx, [rbp + 0x1f]
mov ecx, edi
call fcn.1401370a0
lea rcx, [rbp + 0x1f]
mov qword [rbp + 0xf], rcx
lea rcx, [rbp + 0xf]
sub rax, rcx
sub rax, 0x10
mov qword [rbp + 0x17], rax
mov qword [rbp - 0x11], 0
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
lea rcx, [rbp - 0x11]
call fcn.14007d020
nop
mov dword [rbp - 0x39], 4
mov rdx, qword [rbp + 0x17]
add rdx, 0x23
xor r8d, r8d
lea rcx, [rbp - 0x11]
call fcn.14008b020
lea rdx, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rdx, qword [rbp - 0x11]
lea rcx, [rdx + 0x23]
movups xmm0, xmmword [str.SetFileAttributesW_failed:_attrs_]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [0x14052a818]
movups xmmword [rdx + 0x10], xmm1
movzx eax, word [0x14052a828]
mov word [rdx + 0x20], ax
movzx eax, byte [0x14052a82a]
mov byte [rdx + 0x22], al
mov r8, qword [rbp + 0x17]
test r8, r8
je 0x14012926c
mov rdx, qword [rbp + 0xf]
call fcn.14039b2e0
lea rax, [rbp - 0x11]
cmp qword [rbp + 7], 0x10
cmovae rax, qword [rbp - 0x11]
mov qword [rbp - 0x29], rax
mov rax, qword [rbp - 1]
mov qword [rbp - 0x21], rax
movaps xmm0, xmmword [rbp - 0x29]
movdqa xmmword [rbp - 0x29], xmm0
lea r8, [rbp - 0x29]
mov edx, esi
mov rcx, rbx
call fcn.1401307b0
mov eax, 5
mov dword [rbp - 0x39], eax
and eax, 0xfffffffb
mov dword [rbp - 0x39], eax
lea rcx, [rbp - 0x11]
call fcn.14007cfc0
nop
mov rax, rbx
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.140398000
mov rbx, qword [rsp + 0xd8]
add rsp, 0xa0
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401297e0
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, r8
mov rbx, rdx
mov qword [rbp - 0x30], rdx
xor r13d, r13d
mov dword [rbp - 0x50], r13d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
lea rcx, [rbp - 0x28]
call fcn.140078ca0
nop
mov r15, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x140129845
mov rsi, qword [rsi]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, r15d
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, 2
test eax, eax
jle 0x14012995d
movsxd r12, eax
inc r12
mov eax, edi
mul r12
mov rdx, 0xffffffffffffffff
cmovo rax, rdx
mov rcx, rax
call fcn.1403987c8
mov r14, rax
mov qword [rbp - 0x40], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
test eax, eax
js 0x1401298cd
mov r8, rsi
cmp rsi, r12
jae 0x1401298cd
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140078ce0
nop
mov rcx, r14
call fcn.140398020
test esi, esi
jle 0x14012995d
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x14012993a
lea rax, str.CreateDirectoryW_failed
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov edx, eax
mov rcx, rbx
call fcn.1401307b0
mov dword [rbp - 0x50], 1
lea rcx, [rbp - 0x28]
call fcn.14007cec0
nop
jmp 0x1401299a3
mov qword [rbx], r13
mov eax, 4
mov dword [rbp - 0x50], eax
and eax, 0xfffffffb
mov dword [rbp - 0x50], eax
or eax, 1
mov dword [rbp - 0x50], eax
lea rcx, [rbp - 0x28]
call fcn.14007cec0
nop
jmp 0x1401299a3
lea rax, str.Failed_to_convert_to_wstring
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x1c
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov edx, 3
mov rcx, rbx
call fcn.140136090
mov dword [rbp - 0x50], edi
and edi, 0xfffffffd
mov dword [rbp - 0x50], edi
or edi, 1
mov dword [rbp - 0x50], edi
lea rcx, [rbp - 0x28]
call fcn.14007cec0
nop
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140398000
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1401299e0
Capabilities:
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rsi, r8
mov rbx, rdx
mov qword [rbp - 0x30], rdx
xor r13d, r13d
mov dword [rbp - 0x50], r13d
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], r13
lea rcx, [rbp - 0x28]
call fcn.140078ca0
nop
mov r15, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 0x10
jb 0x140129a45
mov rsi, qword [rsi]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, r15d
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov edi, 2
test eax, eax
jle 0x140129b57
movsxd r12, eax
inc r12
mov eax, edi
mul r12
mov rdx, 0xffffffffffffffff
cmovo rax, rdx
mov rcx, rax
call fcn.1403987c8
mov r14, rax
mov qword [rbp - 0x40], rax
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], rax
mov r9d, r15d
mov r8, rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rsi, eax
test eax, eax
js 0x140129acd
mov r8, rsi
cmp rsi, r12
jae 0x140129acd
mov rdx, r14
lea rcx, [rbp - 0x28]
call fcn.140078ce0
nop
mov rcx, r14
call fcn.140398020
test esi, esi
jle 0x140129b57
lea rcx, [rbp - 0x28]
cmp qword [rbp - 0x10], 8
cmovae rcx, qword [rbp - 0x28]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x140129b34
lea rax, str.RemoveDirectoryW_failed
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], reloc.WS2_32.dll_socket
call qword [sym.imp.KERNEL32.dll_GetLastError]
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov edx, eax
mov rcx, rbx
call fcn.1401307b0
mov dword [rbp - 0x50], 1
lea rcx, [rbp - 0x28]
call fcn.14007cec0
nop
jmp 0x140129b9d
mov qword [rbx], r13
mov eax, 4
mov dword [rbp - 0x50], eax
and eax, 0xfffffffb
mov dword [rbp - 0x50], eax
or eax, 1
mov dword [rbp - 0x50], eax
lea rcx, [rbp - 0x28]
call fcn.14007cec0
nop
jmp 0x140129b9d
lea rax, str.Failed_to_convert_to_wstring
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 0x1c
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
lea r8, [rbp - 0x40]
mov edx, 3
mov rcx, rbx
call fcn.140136090
mov dword [rbp - 0x50], edi
and edi, 0xfffffffd
mov dword [rbp - 0x50], edi
or edi, 1
mov dword [rbp - 0x50], edi
lea rcx, [rbp - 0x28]
call fcn.14007cec0
nop
mov rax, rbx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140398000
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14012f640
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x1405b7cb8]
cmp rax, 0x100
jb 0x14012f674
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_RaiseException]
lea rdx, [0x1405b7cc0]
lea rcx, [0x14012f8b0]
mov qword [rdx + rax*8], rcx
inc rax
mov qword [0x1405b7cb8], rax
mov ecx, 0x210
call fcn.1403982c8
mov rbx, rax
mov qword [rsp + 0x40], rax
mov qword [rax + 0x208], 0
mov edx, 0x104
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, 0x104
jae 0x14012f6c9
mov qword [rbx + 0x208], rbx
mov qword [0x1405b5c28], rbx
add rsp, 0x30
pop rbx
ret
Function at 0x140130530
Capabilities:
Create process on windows

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x14058f6b8]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r15, r8
mov r14, rdx
mov rbp, rcx
xor edi, edi
mov dword [rsp + 0x30], edi
call fcn.14012f3d0
mov rcx, qword [rax + 0x208]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rcx
mov r9, r15
mov r8, r14
mov rdx, rbp
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rsi, rax
cmp eax, 0x20
ja 0x140130755
mov dword [rsp + 0x38], 2
mov dword [rsp + 0x30], 1
mov ecx, 0xe8
call fcn.1403982c8
mov qword [rsp + 0x48], rax
mov rcx, rax
call fcn.1401166d0
mov rbx, rax
lea rcx, [rsp + 0x50]
call fcn.140126190
nop
mov edi, 3
mov dword [rsp + 0x30], edi
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1401305e2
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.14010fc80
lea rdx, [0x14051417c]
mov rcx, rax
call fcn.14010ea90
mov rcx, rax
lea rdx, str.C:codeWeChatPinYinwxkb01_mozc_basewin_util.cc
call fcn.14010ea90
mov rcx, rax
lea rdx, [0x14051917c]
call fcn.14010ea90
mov edx, 0x219
mov rcx, rax
call fcn.14010b3a0
mov rcx, rax
lea rdx, [0x140528ca4]
call fcn.14010ea90
mov rbx, rax
call fcn.140126a50
lea r12, [0x1404d34b0]
mov rdx, r12
cmp byte [rax + 0xc], 0
cmovne rdx, qword [str.e_31m]
mov rcx, rbx
call fcn.14010ea90
mov rcx, rax
lea rdx, str.LOG_
call fcn.14010ea90
mov rdx, qword [str.ERROR]
mov rcx, rax
call fcn.14010ea90
mov rcx, rax
lea rdx, [0x140519184]
call fcn.14010ea90
mov rbx, rax
call fcn.140126a50
lea rdx, str.e_0m
cmp byte [rax + 0xc], 0
cmove rdx, r12
mov rcx, rbx
call fcn.14010ea90
mov rcx, rax
lea rdx, [0x140528c80]
call fcn.14010ea90
mov rcx, rax
lea rdx, str.result___32
call fcn.14010ea90
mov rcx, rax
lea rdx, [0x140528c7c]
call fcn.14010ea90
mov rcx, rax
lea rdx, str.ShellExecute_failed.
call fcn.14010ea90
mov rcx, rax
lea rdx, str.__error:
call fcn.14010ea90
mov edx, esi
mov rcx, rax
call fcn.14010b1e0
mov rcx, rax
lea rdx, str.__verb:
call fcn.14010ea90
mov rdx, rbp
mov rcx, rax
call fcn.140130970
mov rcx, rax
lea rdx, str.__file:
call fcn.14010ea90
mov rdx, r14
mov rcx, rax
call fcn.140130970
mov rcx, rax
lea rdx, str.__parameters:
call fcn.14010ea90
mov rdx, r15
mov rcx, rax
call fcn.140130970
mov rbx, rax
mov qword [rsp + 0x40], rax
jmp 0x14013075a
mov rbx, qword [rsp + 0x40]
test dil, 2
je 0x140130772
and edi, 0xfffffffd
mov dword [rsp + 0x30], edi
lea rcx, [rsp + 0x50]
call fcn.14007cfc0
nop
test dil, 1
je 0x140130787
and edi, 0xfffffffe
mov dword [rsp + 0x30], edi
mov rdx, rbx
call fcn.140126770
cmp esi, 0x20
seta al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140398000
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret