joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400093b0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x180]
sub rsp, 0x280
movaps xmmword [rsp + 0x270], xmm6
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rbp + 0x160], rax
call fcn.14003acb0
mov r8d, eax
lea rdx, str.Runtime_generation_users_request:__i
xor ecx, ecx
mov ebx, eax
call fcn.14002a430
cmp ebx, 3
jne 0x1400094d4
lea ecx, [rbx - 2]
call fcn.140001830
mov r8d, eax
xor edx, edx
mov ecx, 0x100411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400095e3
xorps xmm0, xmm0
lea rcx, [rsp + 0x52]
xor eax, eax
movaps xmmword [rsp + 0x30], xmm0
xor edx, edx
movaps xmmword [rsp + 0x40], xmm0
mov r8d, 0x206
mov word [rsp + 0x50], ax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov byte [rbp + 0x158], 0
mov dword [rbp + 0x15c], 1
call fcn.140002df0
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
movups xmm6, xmmword [rax]
call fcn.140007c60
lea rcx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.140002d90
mov r8, rax
lea rdx, str.The_complete_dump_generation_process_has_taken__llu_ms.
mov ecx, 7
call fcn.14002a430
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.140024e70
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, str.Memory_dump_report_successfully_archived.
mov edx, 0x1388
call fcn.14001f3a0
jmp 0x1400095f4
cmp ebx, 4
jne 0x1400095f4
lea ecx, [rbx - 3]
call fcn.140001830
mov r8d, eax
xor edx, edx
mov ecx, 0x100411
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x1400095e3
xorps xmm0, xmm0
lea rcx, [rsp + 0x52]
xor eax, eax
movaps xmmword [rsp + 0x30], xmm0
xor edx, edx
movaps xmmword [rsp + 0x40], xmm0
mov r8d, 0x206
mov word [rsp + 0x50], ax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x20]
mov byte [rbp + 0x158], 0
mov dword [rbp + 0x15c], 1
call fcn.140002df0
mov ecx, 0x1d
movups xmm6, xmmword [rax]
call fcn.140002440
mov rcx, rax
mov edx, 0x1388
call fcn.14001f3a0
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140007b90
lea rcx, [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.140002d90
mov r8, rax
lea rdx, str.The_complete_dump_generation_process_has_taken__llu_ms.
mov ecx, 7
call fcn.14002a430
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x1e
call fcn.140002440
mov rcx, rax
mov edx, 0x1388
call fcn.14001f3a0
xor r8d, r8d
lea rcx, [rsp + 0x30]
xor edx, edx
call fcn.140024e70
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, 0x1f
call fcn.140002440
mov rcx, rax
mov edx, 0x1388
call fcn.14001f3a0
jmp 0x1400095f4
lea rdx, str.Failed_to_open_the_engine_process._Aborting_the_user_request.
mov ecx, 6
call fcn.14002a3c0
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400d51a0
mov rbx, qword [rsp + 0x290]
movaps xmm6, xmmword [rsp + 0x270]
add rsp, 0x280
pop rbp
ret
Function at 0x140009620
Capabilities:
Delete file

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call fcn.1400085d0
xor edx, edx
lea ecx, [rdx + 1]
call fcn.140008260
call fcn.14002b040
mov ecx, 9
mov dl, 1
call fcn.14002b200
test al, al
je 0x14000968a
call fcn.140008710
call fcn.14001f690
mov rcx, rbx
test al, al
je 0x140009675
call fcn.1400096c0
call fcn.140008830
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400096a2
call fcn.140009a10
call fcn.140008830
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400096a2
call fcn.14001f690
mov rcx, rbx
test al, al
je 0x14000969d
call fcn.1400096c0
jmp 0x1400096a2
call fcn.140009a10
mov ecx, 0x1e
call fcn.140001b90
test al, al
je 0x1400096b5
call fcn.140009e80
add rsp, 0x20
pop rbx
jmp 0x14002af90
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x20
xor dil, dil
xor ebp, ebp
cmp bp, word [0x14013693c]
jae 0x14002b025
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], r14
lea r14, [0x140132fd0]
mov qword [rsp + 0x38], rsi
nop
movzx eax, dil
imul rbx, rax, 0x24c
add rbx, r14
cmp byte [rbx + 0x248], bpl
je 0x14002b006
lea rcx, [rbx + 0x40]
call fcn.140002100
test al, al
je 0x14002b006
lea r9, [rbx + 0x40]
mov r8, rbx
lea rdx, str.Deleting_engine_crash_file___s__at___ws_
mov ecx, 0xf
call fcn.14002a430
lea rcx, [rbx + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
inc dil
movzx eax, dil
cmp ax, word [0x14013693c]
jb 0x14002afc0
mov r14, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov word [0x140136940], bp
mov word [0x14013693c], bp
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140009d70
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rbx, rdx
mov ecx, 0x7530
call fcn.1400085d0
mov ecx, 1
call fcn.140008570
test al, al
jne 0x140009dbf
lea rdx, str.The_Dxdiag_has_failed_the_generation._Retry_and_bypass_the_diagnostics.
mov ecx, 3
call fcn.14002a650
mov dl, 1
mov ecx, 1
call fcn.140008260
mov ecx, 0x7530
call fcn.1400085d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
test eax, eax
jne 0x140009de9
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x140009de9
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
lea rdx, str.The_shared_mutex_has_been_released.
xor ecx, ecx
call fcn.14002a430
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Handle_to_the_engine_process_has_been_closed.
xor ecx, ecx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.14002a430
Function at 0x14001fca0
Capabilities:
Create process on windows

Disassembly:
mov r11, rsp
sub rsp, 0xf8
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0xe0], rax
cmp word [0x14012f320], 0
je 0x14001fdcf
xorps xmm0, xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0x78], xmm0
xor eax, eax
mov qword [r11 - 8], rbx
mov qword [rsp + 0x60], rax
lea rdx, [0x14012f320]
xor ebx, ebx
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
xor r9d, r9d
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor ecx, ecx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 8
mov dword [rsp + 0x20], ebx
movups xmmword [r11 - 0x70], xmm0
movups xmmword [r11 - 0x60], xmm0
movups xmmword [r11 - 0x50], xmm0
movups xmmword [r11 - 0x40], xmm0
movups xmmword [r11 - 0x30], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x14001fda0
mov rcx, qword [rsp + 0x50]
mov edx, 0x1388
call qword [sym.imp.USER32.dll_WaitForInputIdle]
test eax, eax
jne 0x14001fd70
mov ecx, dword [rsp + 0x64]
lea rdx, [0x14001f9f0]
xor r8d, r8d
call qword [sym.imp.USER32.dll_EnumThreadWindows]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x14012f320]
mov ecx, 0x10
lea rdx, str.ReportCodBug:_Process_has_been_started_with_the_cmdline___ws_.
call fcn.14002a430
jmp 0x14001fdc0
call fcn.1400023f0
mov r9, rax
lea r8, [0x14012f320]
lea rdx, str.ReportCodBug:_Failed_to_create_a_process_for_the_.exe___ws____ws_.
mov ecx, 0x10
call fcn.14002a3c0
mov word [0x14012f320], bx
mov rbx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0xf8
ret
Function at 0x140024150
Capabilities:
Delete file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r15
lea rbp, [rsp - 0x2f]
sub rsp, 0xa8
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rbp + 0x17], rax
movzx r15d, dl
mov rdi, rcx
lea rdx, str.Beginning_to_fill_the_archive_with_collected_files.
mov ecx, 5
call fcn.14002a430
xor r12d, r12d
shl r15d, 0x13
movzx esi, r12w
cmp byte [0x140132528], sil
jbe 0x140024364
mov qword [rsp + 0xf0], r13
lea r13, [0x140025bc0]
mov qword [rsp + 0xa0], r14
nop word [rax + rax]
mov rcx, rdi
call fcn.140002100
test al, al
je 0x1400241d5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xorps xmm0, xmm0
lea rcx, [rbp - 0x59]
mov r9d, 0x4000
xor r8d, r8d
mov rdx, rdi
movups xmmword [rbp - 0x59], xmm0
movups xmmword [rbp - 0x49], xmm0
movups xmmword [rbp - 0x39], xmm0
movups xmmword [rbp - 0x29], xmm0
movups xmmword [rbp - 0x19], xmm0
movups xmmword [rbp - 9], xmm0
movups xmmword [rbp + 7], xmm0
call fcn.140027280
test eax, eax
je 0x140024343
mov edx, r15d
lea rcx, [rbp - 0x59]
call fcn.140023f50
lea rcx, [rbp - 0x59]
movzx r14d, al
call fcn.140026e90
test eax, eax
je 0x14002430a
mov rbx, qword [rbp + 0xf]
test rbx, rbx
je 0x140024303
cmp qword [rbp - 0x31], r12
je 0x140024303
mov r8, qword [rbp - 0x29]
test r8, r8
je 0x140024303
mov eax, dword [rbp - 0x45]
add eax, 0xfffffffe
cmp eax, 1
ja 0x140024303
mov rcx, qword [rbp - 0x19]
mov qword [rbp + 0xf], r12
mov rdx, qword [rbx]
call r8
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
movups xmmword [rbx + 0x10], xmm0
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbp - 0x19]
call qword [rbp - 0x29]
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
movups xmmword [rbx + 0x30], xmm0
mov rdx, qword [rbx + 0x40]
mov rcx, qword [rbp - 0x19]
call qword [rbp - 0x29]
xorps xmm0, xmm0
movups xmmword [rbx + 0x40], xmm0
movups xmmword [rbx + 0x50], xmm0
mov rcx, qword [rbx + 0x70]
test rcx, rcx
je 0x1400242d3
cmp dword [rbp - 0x41], 4
jne 0x1400242cf
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [rbp - 0x3d]
cmp eax, 0xffffffff
mov eax, 0x15
cmove ecx, eax
mov dword [rbp - 0x3d], ecx
mov qword [rbx + 0x70], r12
cmp qword [rbp - 9], r13
jne 0x1400242f3
mov rdx, qword [rbx + 0x80]
test rdx, rdx
je 0x1400242f3
mov rcx, qword [rbp - 0x19]
call qword [rbp - 0x29]
mov qword [rbx + 0x80], r12
mov rcx, qword [rbp - 0x19]
mov rdx, rbx
call qword [rbp - 0x29]
mov dword [rbp - 0x45], r12d
jmp 0x14002430a
mov dword [rbp - 0x3d], 0x18
mov ecx, 5
test r14b, r14b
jne 0x140024335
lea rdx, str.A_file_was_too_big_to_be_added_in_the_zip._Recreating_the_zip_without_it.
call fcn.14002a650
movzx eax, byte [0x140132528]
inc si
cmp si, ax
jb 0x1400241c0
jmp 0x140024354
lea rdx, str.Creation_of_the_archive_completed.
call fcn.14002a430
jmp 0x140024354
lea rdx, str.Impossible_to_initialize_the_archive._Creation_aborted.
mov ecx, 5
call fcn.14002a3c0
mov r14, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xf0]
mov rcx, qword [rbp + 0x17]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0xa8
pop r15
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140024450
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push rbx
push rdi
push r14
mov eax, 0x3840
call fcn.1400d57d0
sub rsp, rax
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0x3830], rax
mov qword [rsp + 0x3870], rbp
mov r8d, 0x208
mov rbp, rcx
movzx r14d, dx
lea rcx, [rsp + 0x3620]
mov qword [rsp + 0x3878], rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, str..zip
mov r9, rbp
lea r8, str._s_s
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x3620]
call fcn.14001f730
xor edx, edx
lea rcx, [rsp + 0x290]
mov r8d, 0x3390
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x40]
xor edi, edi
lea rcx, [rsp + 0x3620]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140024563
nop dword [rax + rax]
movzx ecx, di
lea rax, [rsp + 0x6c]
imul rdx, rcx, 0x210
lea rbx, [rsp + 0x290]
mov qword [rsp + 0x20], rax
add rbx, rdx
lea r8, str._s_s
mov r9, rbp
mov edx, 0x104
lea rcx, [rbx + 8]
call fcn.14001f730
mov rax, qword [rsp + 0x54]
inc di
mov qword [rbx], rax
cmp di, 0x19
jae 0x14002455a
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140024500
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rsi, qword [rsp + 0x3878]
lea r8, [rsp + 0x3620]
mov rbp, qword [rsp + 0x3870]
xor ecx, ecx
movzx r9d, di
mov eax, r14d
mov dword [rsp + 0x20], eax
cmp di, r14w
ja 0x14002459f
lea rdx, str.Number_of_Zips_found_for___ws__:__u____u._Not_necessary_to_delete_some_zips.
call fcn.14002a430
jmp 0x140024637
lea rdx, str.Number_of_Zips_found_for___ws__:__u____u._Deleting_oldest_zips:
call fcn.14002a430
movzx r9d, byte [rsp + 0x30]
movzx eax, di
imul rcx, rax, 0x210
movabs rax, 0xf83e0f83e0f83e1
imul rcx
mov r8, rdx
lea rdx, [rsp + 0x290]
sar r8, 5
add rdx, rcx
mov rax, r8
lea rcx, [rsp + 0x290]
shr rax, 0x3f
add r8, rax
call fcn.140023420
imul rcx, r14, 0x210
lea rbx, [rsp + 0x298]
add rbx, rcx
sub di, r14w
movzx edi, di
nop word [rax + rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov r8, rbx
lea rdx, str.Deleted_file:___ws_
xor ecx, ecx
call fcn.14002a430
add rbx, 0x210
sub rdi, 1
jne 0x140024610
mov rcx, qword [rsp + 0x3830]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0x3840
pop r14
pop rdi
pop rbx
ret
Function at 0x140024bb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x20], rsi
push rbp
lea rbp, [rsp - 0x170]
sub rsp, 0x270
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor edx, edx
mov dword [rsp + 0x38], 0x656c6966
mov r8d, 0x208
mov dword [rsp + 0x3c], 0x657a6973
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x40], 0x6f736a2e
mov word [rsp + 0x44], 0x6e
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x38]
mov edx, 0x104
lea rcx, [rsp + 0x50]
call fcn.1400021d0
xor esi, esi
lea r8, [0x1400df484]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x30], rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
test eax, eax
je 0x140024c60
mov cl, 1
call fcn.1400023a0
mov r9, rax
lea r8, [rsp + 0x50]
lea rdx, str.Impossible_to_create_the_file_at___ws____s_
lea ecx, [rsi + 5]
call fcn.14002a650
jmp 0x140024dd9
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1400e55d4]
mov qword [rsp + 0x280], rbx
mov qword [rsp + 0x290], r14
call fcn.1400079c0
mov rcx, qword [rsp + 0x30]
lea rdx, str._t_filesize_unit_:__bytes_
call fcn.1400079c0
cmp byte [0x140132528], sil
lea r14, [0x140119600]
jbe 0x140024d36
mov qword [rsp + 0x288], rdi
nop
movzx eax, si
imul rbx, rax, 0x24e
add rbx, r14
cmp byte [rbx + 0x24d], 0
je 0x140024cdd
call fcn.14002a370
lea rcx, [rbx + 0x40]
call fcn.1400022c0
mov edi, eax
call fcn.14002a4d0
jmp 0x140024ce8
lea rcx, [rbx + 0x40]
call fcn.1400022c0
mov edi, eax
mov rcx, qword [rsp + 0x30]
lea rdx, str.__n_t__s_:__u
mov r9d, edi
mov r8, rbx
call fcn.1400079c0
movzx r9d, byte [rbx + 0x249]
lea rdx, str.Collected_file___s__Priority__u_:__u_Kb
mov r8, rbx
mov dword [rsp + 0x20], edi
mov ecx, 5
call fcn.14002a430
movzx eax, byte [0x140132528]
inc si
cmp si, ax
jb 0x140024cb0
mov rdi, qword [rsp + 0x288]
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1400e5630]
call fcn.1400079c0
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
movzx eax, byte [0x140132528]
cmp al, 0x21
setb bl
jb 0x140024d7b
mov r8d, eax
lea rdx, str.The_limit_of_files_to_zip_has_been_reached.___u_
mov ecx, 5
call fcn.14002a650
movzx eax, byte [0x140132528]
test bl, bl
je 0x140024dc9
movzx eax, al
lea r8, [rsp + 0x38]
imul rbx, rax, 0x24e
mov edx, 0x40
add rbx, r14
mov rcx, rbx
call fcn.140002710
lea rcx, [rbx + 0x40]
mov edx, 0x104
lea r8, [rsp + 0x50]
call fcn.140002910
inc byte [0x140132528]
mov word [rbx + 0x249], 0
mov word [rbx + 0x24c], 1
mov rbx, qword [rsp + 0x280]
mov r14, qword [rsp + 0x290]
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.1400d51a0
mov rsi, qword [rsp + 0x298]
add rsp, 0x270
pop rbp
ret

Function at 0x140024e00
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, 0xa
lea ecx, [rdi - 2]
call fcn.1400018d0
mov rcx, rax
movzx edx, di
call fcn.140024450
lea ebx, [rdi - 5]
call fcn.140024720
mov rcx, rax
movzx edx, bx
call fcn.140024450
call fcn.140024660
mov rcx, rax
movzx edx, di
call fcn.140024450
call fcn.140025160
mov rcx, rax
movzx edx, bx
call fcn.140024450
call fcn.140025220
mov rcx, rax
movzx edx, di
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140024450
Function at 0x1400252e0
Capabilities:
Delete file
Move file

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x250
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rsi, rcx
test dl, dl
je 0x140025312
call fcn.140024720
jmp 0x140025317
call fcn.140024660
mov ecx, 8
mov rbx, rax
call fcn.1400018d0
mov rdx, rbx
mov rcx, rax
mov rdi, rax
call fcn.140002980
test al, al
je 0x14002534f
mov r8, rdi
lea rdx, str.The_generated_zip_wont_be_moved_because_the_current_folder_is_the_same_as_the_targeted_folder___ws_
mov ecx, 5
call fcn.14002a3c0
jmp 0x140025408
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov qword [rsp + 0x28], rax
lea r9, str._s_s
mov edx, 0x104
mov qword [rsp + 0x20], rbx
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
call fcn.1400029a0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.140002980
test al, al
je 0x1400253ba
lea r8, [rsp + 0x30]
mov ecx, 5
lea rdx, str.The_generated_zip_is_already_located_in_the_targeted_folder._No_need_to_move_it___ws_
call fcn.14002a430
jmp 0x140025408
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x1400253e4
lea r8, [rsp + 0x30]
mov ecx, 5
lea rdx, str.The_generated_zip_has_been_moved_to_targeted_folder.___ws_
call fcn.14002a430
jmp 0x140025408
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.1400023f0
mov r8, rax
lea rdx, str.Impossible_to_move_the_zip_file_into_the_targeted_folder.___ws_
mov ecx, 5
call fcn.14002a650
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400d51a0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140025980
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x1400e4e00]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x1400259f9
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x1400259a0
test r8, r8
je 0x140025a1d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x140025a00
not ecx
mov eax, ecx
ret

Function at 0x140025b30
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rsi, r9
mov rcx, qword [rcx + 0x68]
mov rbp, r8
mov rdi, rdx
mov rcx, qword [rcx + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__ftelli64]
mov rcx, qword [rbx + 0x68]
add rdi, qword [rcx + 0x78]
js 0x140025b9c
cmp rax, rdi
je 0x140025b81
mov rcx, qword [rcx + 0x70]
xor r8d, r8d
mov rdx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x140025b9c
mov r9, qword [rbx + 0x68]
mov r8, rsi
mov edx, 1
mov rcx, rbp
mov r9, qword [r9 + 0x70]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x140025ba5
mov dword [rbx + 0x1c], 0x16
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002a540
Capabilities:
Delete file
Move file

Disassembly:
sub rsp, 0x258
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp qword [0x140132fb8], 0
je 0x14002a596
lea rdx, str._Closing_the_logfile_
xor ecx, ecx
call fcn.14002a430
mov rcx, qword [0x140132fb8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
mov rcx, qword [0x140132fb8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov qword [0x140132fb8], 0
xor edx, edx
mov byte [0x140132fc0], 1
mov r8d, 0x208
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov ecx, 9
call fcn.1400018d0
lea rcx, str.crashhandler.log
mov edx, 0x104
mov qword [rsp + 0x28], rcx
lea r9, str._s_s
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r8, 0xffffffffffffffff
call fcn.1400029a0
lea rdx, [rsp + 0x30]
lea rcx, [0x140132db0]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14002a62b
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [0x140132db0]
call fcn.140002910
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0x258
ret
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400d51a0
add rsp, 0x258
ret
Function at 0x14002ad10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rax, qword [0x14011e878]
xor rax, rsp
mov qword [rbp + 0x150], rax
xor r14d, r14d
mov dword [rsp + 0x30], 0x6f666e69
cmp r14w, word [0x14013693c]
lea rsi, [0x140132fd0]
mov dword [rsp + 0x34], 0x6f736a2e
movzx ebx, r14w
mov word [rsp + 0x38], 0x6e
jae 0x14002adbc
nop dword [rax]
nop dword [rax + rax]
movzx eax, bx
lea rcx, [rsp + 0x30]
imul rdi, rax, 0x24c
lea rdx, [rdi + rsi]
call fcn.1400027b0
test al, al
je 0x14002adb0
lea rcx, [rsi + 0x40]
add rcx, rdi
call fcn.140002100
test al, al
jne 0x14002ae91
inc bx
cmp bx, word [0x14013693c]
jb 0x14002ad80
lea r8, [rsp + 0x30]
mov ecx, 0xf
lea rdx, str.Impossible_to_find_the_file___s__from_the_extracted_crash_files._Attempting_to_retrieve_it_directly_from_the_Temp_directory.
call fcn.14002a650
call fcn.14002ccc0
cmp r14w, word [0x14013693c]
movzx ebx, r14w
jae 0x14002ae2c
nop word [rax + rax]
movzx eax, bx
lea rcx, [rsp + 0x30]
imul rdi, rax, 0x24c
lea rdx, [rdi + rsi]
call fcn.1400027b0
test al, al
je 0x14002ae20
lea rcx, [rsi + 0x40]
add rcx, rdi
call fcn.140002100
test al, al
jne 0x14002aeac
inc bx
cmp bx, word [0x14013693c]
jb 0x14002adf0
lea r8, [rsp + 0x30]
mov ecx, 0xf
lea rdx, str.Impossible_to_find_the_file___s__from_the_Temp_directory._Attempting_to_create_a_default_one.
call fcn.14002a650
xor edx, edx
lea rcx, [rsp + 0x40]
mov r8d, 0x208
call sub.VCRUNTIME140.dll_memset
lea r8, [rsp + 0x30]
mov edx, 0x104
lea rcx, [rsp + 0x40]
call fcn.1400021d0
lea rcx, [rsp + 0x40]
call fcn.14002c750
test al, al
jne 0x14002aec7
lea r8, [rsp + 0x30]
mov ecx, 0xf
lea rdx, str.Impossible_to_create_the___s__file.
call fcn.14002a3c0
jmp 0x14002af60
lea r8, [rsp + 0x30]
mov ecx, 0xf
lea rdx, str.The_file___s__has_been_found_in_the_datafile.
call fcn.14002a430
jmp 0x14002af60
lea r8, [rsp + 0x30]
mov ecx, 0xf
lea rdx, str.The_file___s__has_been_found_in_the_Temp_directory.
call fcn.14002a430
jmp 0x14002af60
movzx ebx, word [0x14013693c]
cmp rbx, 0x19
jb 0x14002aeed
lea r8, [rsp + 0x30]
mov ecx, 0xf
lea rdx, str.The_limit_of_files_has_been_reached._As_the__s_file_is_mandatory_for_the_upload__override_the_last_extracted_crash_file.
call fcn.14002a3c0
dec rbx
imul rbx, rbx, 0x24c
lea r8, [rsp + 0x40]
mov edx, 0x104
add rbx, rsi
lea rcx, [rbx + 0x40]
call fcn.140002910
lea r8, [rsp + 0x30]
mov edx, 0x40
mov rcx, rbx
call fcn.140002710
movzx r8d, word [0x14013693c]
lea rax, [rsp + 0x30]
mov r9d, 0x19
mov dword [rsp + 0x28], r14d
lea rdx, str.File__u_created_by_default___max:__u__:__s__priority__u_
mov word [rbx + 0x248], 1
mov byte [rbx + 0x24a], r14b
mov qword [rsp + 0x20], rax
lea ecx, [r9 - 0xa]
call fcn.14002a430
inc word [0x14013693c]
mov rcx, qword [rbp + 0x150]
xor rcx, rsp
call fcn.1400d51a0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret