joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400894b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
sub rsp, 8
mov r11d, r8d
mov r10, rdx
mov r9d, ecx
test rdx, rdx
jne 0x1400894c9
xor eax, eax
add rsp, 8
ret
mov qword [rsp], rdi
not r9d
lea rdi, [0x1400f1fd0]
cmp r11d, 8
jb 0x1400895c2
mov qword [rsp + 0x10], rbx
mov rbx, r11
shr rbx, 3
nop dword [rax]
movzx ecx, byte [r10]
mov eax, r9d
shr r9d, 8
xor rcx, rax
add r10, 8
add r11d, 0xfffffff8
movzx eax, cl
movzx ecx, byte [r10 - 7]
mov edx, dword [rdi + rax*4]
xor edx, r9d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 6]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 5]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 4]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 3]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 2]
mov r8d, dword [rdi + rax*4]
xor r8d, edx
mov eax, r8d
shr r8d, 8
xor rcx, rax
movzx eax, cl
movzx ecx, byte [r10 - 1]
mov edx, dword [rdi + rax*4]
xor edx, r8d
mov eax, edx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov r9d, dword [rdi + rax*4]
xor r9d, edx
sub rbx, 1
jne 0x1400894f0
mov rbx, qword [rsp + 0x10]
test r11d, r11d
je 0x1400895f0
nop word [rax + rax]
movzx ecx, byte [r10]
mov eax, r9d
inc r10
xor rcx, rax
shr eax, 8
movzx edx, cl
mov r9d, dword [rdi + rdx*4]
xor r9d, eax
add r11d, 0xffffffff
jne 0x1400895d0
mov rdi, qword [rsp]
not r9d
mov eax, r9d
add rsp, 8
ret

Function at 0x140089680
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov r9d, dword [rcx + 8]
mov r10, rcx
movzx r11d, dl
mov edx, dword [rcx]
mov r8d, r9d
and r8d, 0xfffd
mov rcx, rdx
shr edx, 8
or r8d, 2
mov eax, r8d
xor eax, 1
imul eax, r8d
lea r8, [0x1400f1fd0]
shr eax, 8
xor r11b, al
movsx rax, r11b
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
movzx eax, cl
mov dword [r10], ecx
movzx ecx, r9b
add eax, dword [r10 + 4]
shr r9d, 8
imul eax, eax, 0x8088405
inc eax
mov dword [r10 + 4], eax
movzx eax, byte [r10 + 7]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, r9d
mov dword [r10 + 8], eax
mov al, r11b
ret
Function at 0x140089da0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rsi, r8
mov rdi, r9
mov rbp, rdx
mov r10, rcx
imul esi, edx
cmp byte [r9], 0
je 0x140089df0
mov rdx, rcx
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x48]
mov r8d, esi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140089dea
mov byte [rdi + 0x10], 1
mov eax, dword [rsp + 0x48]
jmp 0x140089e21
mov edx, dword [r9 + 0x2c]
mov ecx, dword [r9 + 0x28]
mov qword [rsp + 0x40], rbx
lea eax, [rdx + rsi]
cmp eax, ecx
jbe 0x140089e08
sub ecx, edx
mov esi, ecx
add rdx, qword [r9 + 0x20]
mov r8d, esi
mov rcx, r10
call fcn.1400b01c0
add dword [rdi + 0x2c], esi
mov rbx, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x58]
xor edx, edx
div rbp
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140089e40
Capabilities:
Read file on windows

Disassembly:
push rbx
push r12
sub rsp, 0x38
cmp byte [rcx], 0
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x30], rdi
mov edi, 1
mov r12, rdx
mov rbx, rcx
je 0x140089e90
mov rcx, qword [rcx + 8]
lea r9, [rsp + 0x60]
lea rdx, [rsp + 0x50]
mov r8d, edi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140089e8a
mov byte [rbx + 0x10], dil
mov esi, dword [rsp + 0x60]
jmp 0x140089eca
mov qword [rsp + 0x58], rbp
mov ebp, dword [rcx + 0x2c]
mov ecx, dword [rcx + 0x28]
lea eax, [rbp + 1]
cmp eax, ecx
jbe 0x140089ea6
mov edi, ecx
sub edi, ebp
mov rdx, rbp
lea rcx, [rsp + 0x50]
mov r8d, edi
add rdx, qword [rbx + 0x20]
mov esi, edi
call fcn.1400b01c0
lea r11d, [rbp + rdi]
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x2c], r11d
mov rdi, qword [rsp + 0x30]
cmp esi, 1
mov rsi, qword [rsp + 0x68]
jne 0x140089eec
movzx eax, byte [rsp + 0x50]
mov dword [r12], eax
xor eax, eax
add rsp, 0x38
pop r12
pop rbx
ret
cmp byte [rbx], 0
je 0x140089ee2
cmp byte [rbx + 0x10], 0
je 0x140089ee2
or eax, 0xffffffff
add rsp, 0x38
pop r12
pop rbx
ret
Function at 0x14008baf0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push rbx
push rsi
sub rsp, 0x458
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x440], rax
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x14008bb2d
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14008bb2d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
movzx eax, word [rsi]
test ax, ax
je 0x14008bc27
mov qword [rsp + 0x480], rbp
mov qword [rsp + 0x450], rdi
mov rcx, rsi
mov rdi, rsi
nop
cmp ax, 0x2f
je 0x14008bb5c
cmp ax, 0x5c
jne 0x14008bb5f
mov rdi, rcx
mov ax, word [rcx + 2]
add rcx, 2
test ax, ax
jne 0x14008bb50
xor ebp, ebp
cmp rdi, rsi
je 0x14008bba7
sub rdi, rsi
lea rcx, [rsp + 0x230]
mov rdx, rsi
sar rdi, 1
add rdi, rdi
mov r8, rdi
call fcn.1400b01c0
lea rdx, [rsp + 0x230]
mov rcx, rbx
mov word [rsp + rdi + 0x230], bp
call fcn.14008baf0
mov word [rsp + 0x20], bp
mov rbp, qword [rsp + 0x480]
test rbx, rbx
je 0x14008bbd2
lea rcx, [rsp + 0x20]
sub rcx, rbx
movzx eax, word [rbx]
add rbx, 2
mov word [rcx + rbx - 2], ax
test ax, ax
jne 0x14008bbc1
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x20]
repne scasw ax, word [rdi]
xor ecx, ecx
nop word [rax + rax]
movzx eax, word [rsi + rcx]
add rcx, 2
mov word [rdi + rcx - 4], ax
test ax, ax
jne 0x14008bbf0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov rdi, qword [rsp + 0x450]
cmp eax, 0xffffffff
jne 0x14008bc27
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rcx, qword [rsp + 0x440]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0x458
pop rsi
pop rbx
ret
Function at 0x14008d850
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14008d86e
mov eax, 0xffffff9a
add rsp, 0x28
pop rdi
pop rsi
ret
cmp dword [rcx + 0x1c], 0
je 0x14008d862
cmp qword [rcx + 0x80], 0
je 0x14008d883
call fcn.14008b080
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14008ac60
test eax, eax
je 0x14008d8aa
mov eax, 0xffffff99
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0xb0
mov qword [rsp + 0x48], rbx
call fcn.1400ad42c
mov rbx, rax
test rax, rax
jne 0x14008d8d0
lea eax, [rbx - 0x68]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
mov ecx, 0x4000
mov qword [rsp + 0x20], rbp
call fcn.1400ad42c
mov ecx, dword [rsp + 0x40]
xor ebp, ebp
mov dword [rbx + 0x68], ecx
mov ecx, dword [rsp + 0x50]
mov qword [rbx], rax
mov dword [rbx + 0x70], ebp
mov dword [rbx + 0x6c], ecx
test rax, rax
jne 0x14008d916
mov rcx, rbx
call fcn.1400b0538
mov rbx, qword [rsp + 0x48]
lea eax, [rbp - 0x68]
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
mov dword [rbx + 0x64], ebp
mov eax, dword [rdi + 0x40]
mov ecx, ebp
cmp dword [rdi + 0x38], ecx
mov dword [rbx + 0x78], eax
mov dword [rbx + 0x74], ebp
mov eax, dword [rdi + 0x38]
sete cl
mov dword [rbx + 0x90], eax
mov rax, qword [rdi]
mov qword [rbx + 0x88], rax
mov eax, dword [rdi + 0x10]
mov dword [rbx + 0x24], ebp
mov dword [rbx + 0x94], eax
test ecx, ecx
jne 0x14008d96d
lea rcx, [rbx + 8]
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
mov qword [rbx + 0x48], rbp
call fcn.1400899e0
test eax, eax
jne 0x14008d96d
mov dword [rbx + 0x64], 1
mov eax, dword [rdi + 0x44]
mov dword [rbx + 0x7c], eax
mov eax, dword [rdi + 0x48]
mov dword [rbx + 0x80], eax
movzx eax, byte [rdi + 0x34]
and al, 1
mov byte [rbx + 0x98], al
mov eax, dword [rdi + 0x34]
shr eax, 3
test al, 1
je 0x14008d99e
movzx eax, byte [rdi + 0x3d]
mov byte [rbx + 0xac], al
jmp 0x14008d9a8
movzx eax, byte [rdi + 0x43]
mov byte [rbx + 0xac], al
movzx eax, byte [rbx + 0x98]
mov dword [rbx + 0x9c], 0x12345678
mov dword [rbx + 0xa0], 0x23456789
neg al
mov dword [rbx + 0xa4], 0x34567890
sbb ecx, ecx
and ecx, 0xc
mov dword [rbx + 0xa8], ecx
test rsi, rsi
je 0x14008da4a
lea r8, [0x1400f1fd0]
movzx eax, byte [rsi]
test al, al
je 0x14008da4a
mov edx, dword [rbx + 0x9c]
mov rcx, rdx
shr edx, 8
xor rcx, rax
movzx eax, cl
mov ecx, dword [r8 + rax*4]
xor ecx, edx
mov edx, dword [rbx + 0xa4]
movzx eax, cl
mov dword [rbx + 0x9c], ecx
movzx ecx, dl
add eax, dword [rbx + 0xa0]
shr edx, 8
imul eax, eax, 0x8088405
inc eax
mov dword [rbx + 0xa0], eax
movzx eax, byte [rbx + 0xa3]
xor rcx, rax
mov eax, dword [r8 + rcx*4]
xor eax, edx
add rsi, 1
mov dword [rbx + 0xa4], eax
jne 0x14008d9e6
mov ecx, dword [rdi + 0x7c]
mov eax, dword [rsp + 0x58]
mov dword [rbx + 0x10], ebp
mov rbp, qword [rsp + 0x20]
lea ecx, [rcx + rax + 0x1e]
xor eax, eax
mov dword [rbx + 0x60], ecx
mov qword [rdi + 0x80], rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x14008dd80
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r9d
mov r13d, r8d
mov rbp, rdx
mov rbx, rcx
jne 0x14008de93
cmp dword [rcx + 8], 0xffffffff
jne 0x14008de93
lea rdx, [rcx + 0x250]
mov ecx, 0x104
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbx + 0x250]
repne scasw ax, word [rdi]
not rcx
movzx eax, word [rbx + rcx*2 + 0x24c]
cmp ax, 0x5c
je 0x14008de09
cmp ax, 0x2f
je 0x14008de09
xor eax, eax
lea rdi, [rbx + 0x250]
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov eax, dword [0x1400fc944]
mov dword [rdi - 2], eax
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
cmp esi, 1
jne 0x14008de41
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x14008de41
mov eax, 0x2000000
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rsi
pop rbp
ret
lea r9, [rsp + 0x40]
mov r8d, esi
mov edx, r13d
mov rcx, rbp
call fcn.140089ad0
test rax, rax
jne 0x14008de6b
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rsi
pop rbp
ret
mov rcx, rax
call fcn.14008d4c0
xor ecx, ecx
mov edx, 0x200
test rax, rax
mov qword [rbx], rax
cmove ecx, edx
mov eax, ecx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rsi
pop rbp
ret
mov eax, 0x1000000
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rsi
pop rbp
ret
Function at 0x14008fc70
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4e0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x538], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x4d0], rax
movsxd r13, r8d
mov r14, rdx
mov rbx, rcx
lea rcx, str.Cryptdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
mov qword [rsp + 0x48], rax
lea rdx, str.MD5Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
lea rdx, str.MD5Update
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rax
lea rdx, str.MD5Final
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
cmp r13d, 0x10
jge 0x14008fd18
test rdi, rdi
je 0x14008fd11
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x14008fe14
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rsi + 1]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
mov qword [rsp + 0x50], rax
cmp rax, 0xffffffffffffffff
je 0x14008fdf4
lea rcx, [rsp + 0x60]
call r12
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14008fdce
nop word [rax + rax]
mov r8d, dword [rsp + 0x40]
test r8d, r8d
je 0x14008fdce
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x60]
call rbp
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x40]
mov r8d, 0x400
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x14008fd90
lea rcx, [rsp + 0x60]
call r15
mov rdx, r13
mov r9d, 0x10
lea r8, [rsp + 0xb8]
mov rcx, r14
call fcn.1400ad128
mov esi, 1
cmp rbx, 0xffffffffffffffff
je 0x14008fe04
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test rdi, rdi
je 0x14008fe12
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
mov rcx, qword [rsp + 0x4d0]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x538]
add rsp, 0x4e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400921a0
Capabilities:
Check if file exists

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x100
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x130], rbx
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0xf0], rax
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], rbp
mov word [rsp + 0x38], bp
mov rcx, rdx
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x14009223c
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140025740
nop
cmp qword [rsp + 0x50], 8
jb 0x140092234
mov rcx, qword [rsp + 0x38]
call fcn.1400ad0b8
mov rax, rbx
jmp 0x140092350
mov byte [rsp + 0x58], 0
xor eax, eax
mov qword [rsp + 0x59], rax
mov dword [rsp + 0x61], eax
mov word [rsp + 0x65], ax
mov byte [rsp + 0x67], al
mov word [rsp + 0x70], bp
xor edx, edx
lea r8d, [rax + 0x7e]
lea rcx, [rsp + 0x72]
call fcn.1400ad2f0
mov r8d, 0x10
lea rdx, [rsp + 0x58]
mov rcx, rdi
call fcn.14008fc70
lea r8, [rsp + 0x70]
mov edx, 0x10
lea rcx, [rsp + 0x58]
call fcn.1400014b0
test esi, esi
jne 0x1400922f2
mov ecx, 0x20
lea rdx, [rsp + 0xae]
nop word [rax + rax]
movzx eax, word [rdx]
mov word [rsp + rcx*2 + 0x70], ax
inc rcx
sub rdx, 2
cmp rcx, 0x40
jb 0x1400922b0
mov r9d, 0x10
lea r8, [rsp + 0x58]
lea edx, [r9 + 0x70]
lea rcx, [rsp + 0x70]
call fcn.14008fe40
lea r8, [rsp + 0x70]
mov edx, 0x10
lea rcx, [rsp + 0x58]
call fcn.1400014b0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x70]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140025a70
mov qword [rbx + 0x20], 7
mov qword [rbx + 0x18], rbp
mov word [rbx + 8], bp
or r9, 0xffffffffffffffff
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140025740
nop
cmp qword [rsp + 0x50], 8
jb 0x14009234d
mov rcx, qword [rsp + 0x38]
call fcn.1400ad0b8
mov rax, rbx
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.1400ad2c0
mov rbx, qword [rsp + 0x130]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400932e0
Capabilities:
Check mutex on windows
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x240
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor esi, esi
mov rbx, rcx
lea r8, str.GlobalWeatherTool_UpdaterProcess_Mutex
mov qword [rcx], rsi
mov dword [rcx + 8], esi
mov qword [rcx + 0x10], rsi
mov qword [rcx + 0x48], 7
mov qword [rcx + 0x40], rsi
mov word [rcx + 0x30], si
mov qword [rcx + 0x70], 7
mov qword [rcx + 0x68], rsi
mov word [rcx + 0x58], si
mov qword [rcx + 0x98], 7
mov qword [rcx + 0x90], rsi
mov word [rcx + 0x80], si
mov qword [rcx + 0xc0], 7
mov qword [rcx + 0xb8], rsi
mov word [rcx + 0xa8], si
mov qword [rcx + 0xc8], rsi
mov qword [rcx + 0xd0], rsi
mov dword [rcx + 0x18], esi
mov dword [rcx + 0x1c], esi
mov dword [rcx + 0x20], esi
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexW]
mov rcx, qword [rbx]
mov rdi, rax
cmp rcx, rax
je 0x1400933b7
cmp dword [rbx + 8], esi
je 0x1400933a3
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400933b4
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], rsi
mov qword [rbx], rdi
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400933d9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x1400933d2
cmp eax, 0x80
jne 0x1400933d9
mov dword [rbx + 8], 1
lea rcx, [rsp + 0x22]
xor edx, edx
mov r8d, 0x206
mov word [rsp + 0x20], si
call fcn.1400ad2f0
mov r9d, 1
lea rdx, [rsp + 0x20]
lea r8d, [r9 + 0x19]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea rdx, str.WeatherTool
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbx + 0xd8]
lea r8, str.download
lea rdx, [rsp + 0x20]
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov rax, rbx
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.1400ad2c0
lea r11, [rsp + 0x240]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1400941d0
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x480
mov rax, qword [0x14012a4f8]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rcx, rdx
xor edx, edx
mov r12, r8
xor edi, edi
call fcn.14008e3d0
mov rsi, rax
test rax, rax
je 0x140094366
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x22c
mov dword [rsp + 0x20], edi
call fcn.1400ad2f0
lea r8, [rsp + 0x20]
or edx, 0xffffffff
mov rcx, rsi
call fcn.14008bee0
test eax, eax
jne 0x140094366
mov qword [rsp + 0x4a0], rbx
mov qword [rsp + 0x478], rbp
mov ebp, dword [rsp + 0x20]
lea rcx, [rsp + 0x252]
xor edx, edx
mov r8d, 0x206
mov qword [rsp + 0x470], r13
mov ebx, edi
mov word [rsp + 0x250], di
call fcn.1400ad2f0
lea r13d, [rdi + 1]
test ebp, ebp
jle 0x140094348
nop
lea r8, [rsp + 0x20]
mov edx, ebx
mov rcx, rsi
call fcn.14008bee0
test eax, eax
jne 0x140094348
lea r8, [rsp + 0x24]
lea rcx, [rsp + 0x250]
mov rdx, r12
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x140094328
lea rcx, [rsp + 0x250]
call qword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x14009433e
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1400942fc
test r13b, al
je 0x1400942fc
and eax, 0xfffffffe
lea rcx, [rsp + 0x250]
mov edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x140094328
lea rcx, [rsp + 0x250]
mov edx, r13d
call fcn.14007e6a0
test eax, eax
jne 0x140094328
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, [rsp + 0x250]
mov edx, ebx
mov rcx, rsi
call fcn.14008e4b0
test eax, eax
jne 0x140094348
inc ebx
cmp ebx, ebp
jl 0x140094280
cmp ebx, ebp
mov rbp, qword [rsp + 0x478]
mov rbx, qword [rsp + 0x4a0]
cmove edi, r13d
mov r13, qword [rsp + 0x470]
mov rcx, rsi
call fcn.14008e860
mov eax, edi
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.1400ad2c0
add rsp, 0x480
pop r12
pop rdi
pop rsi
ret
Function at 0x140097690
Capabilities:
Check if file exists
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rbx, rcx
add rcx, 0xd8
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1400976bd
lea rdx, [rbx + 0xd8]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectory]
lea rax, [rsp + 0x48]
lea r8, [0x140097670]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x10]
mov rdi, rax
cmp rcx, rax
je 0x140097706
test rcx, rcx
je 0x140097702
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x10], rdi
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14009775a
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov dword [rsp + 0x40], 0
test eax, eax
jne 0x14009775a
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x14009775a
cmp dword [rsp + 0x40], 0
jne 0x14009775a
mov rcx, rbx
call fcn.140094390
test eax, eax
je 0x14009775a
mov eax, 1
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140098ec0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x2c], 0
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov edx, 4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x30], eax
cmp dword [rsp + 0x30], 0
jne 0x140098f0f
jmp 0x140098f68
xor eax, eax
test eax, eax
jne 0x140098f04
mov rax, qword [rsp + 0x20]
mov ecx, dword [rax]
lea rax, [rsp + 0x28]
xchg dword [rax], ecx
mov eax, dword [rsp + 0x28]
cmp eax, 0x8b55ff8b
jne 0x140098f4a
mov ecx, 0x9090c033
mov rax, qword [rsp + 0x20]
xchg dword [rax], ecx
mov rax, qword [rsp + 0x20]
add rax, 4
mov ecx, 0x900004c2
xchg dword [rax], ecx
lea r9, [rsp + 0x2c]
mov r8d, dword [rsp + 0x2c]
mov edx, 4
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x30]
add rsp, 0x48
ret