joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400620b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x290
mov rsi, rcx
lea rcx, [rsp + 0x40]
movaps xmmword [rax - 0x28], xmm6
mov rbp, rdx
call fcn.1400083e0
lea rdx, [rsp + 0x38]
movsd xmm6, qword [0x1400a2c58]
mov rcx, rsi
call qword [sym.imp.ole32.dll_StringFromIID]
xor r12d, r12d
cmp eax, r12d
mov edi, eax
jl 0x1400622d3
mov rcx, qword [rsp + 0x38]
call fcn.1400172a0
lea rdx, str.interface_
lea rcx, [rsp + 0x40]
mov rbx, rax
call fcn.1400089b0
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140012750
lea rdx, str.TypeLib
lea rcx, [rsp + 0x40]
call fcn.140012750
mov rcx, rbx
call fcn.140018ec8
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rsp + 0x40]
lea r11, [rsp + 0x2c8]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
cmp eax, r12d
jne 0x1400622d3
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp eax, r12d
jne 0x1400622c5
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.1400172a0
lea rdx, [rsp + 0x60]
mov rcx, rax
mov rbx, rax
call qword [sym.imp.ole32.dll_CLSIDFromString]
mov rcx, rbx
mov edi, eax
call fcn.140018ec8
cmp edi, r12d
jl 0x1400622c5
mov rcx, qword [rsp + 0x2c8]
lea rax, [rsp + 0x2c0]
lea rdx, str.Version
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x2c0], 0x1fe
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x14006226d
mov eax, dword [rsp + 0x2c0]
lea rcx, [rsp + 0x70]
shr eax, 1
mov dword [rsp + 0x2c0], eax
mov word [rsp + rax*2 + 0x70], r12w
call fcn.14001aa14
movapd xmm6, xmm0
movsd xmm1, qword [0x1400a2c58]
movapd xmm0, xmm6
call fcn.14001e980
lea rax, [rsp + 0x30]
cvttsd2si rdx, xmm6
lea rcx, [rsp + 0x60]
xor r9d, r9d
mov qword [rsp + 0x20], rax
cvttsd2si r8, xmm0
call qword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
cmp eax, r12d
mov edi, eax
jl 0x1400622c5
mov rcx, qword [rsp + 0x30]
mov r8, rbp
mov rdx, rsi
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rsp + 0x30]
mov edi, eax
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, qword [rsp + 0x2c8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x40]
call fcn.140003410
lea r11, [rsp + 0x290]
mov eax, edi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x140062300
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
push rsi
push rdi
push r12
sub rsp, 0x2d0
mov rsi, rcx
lea rcx, [rsp + 0x48]
xor r12d, r12d
mov rbp, rdx
mov ebx, 0x80004002
mov dword [rax + 0x18], SafeArrayCreateEx
mov edi, r12d
call fcn.1400083e0
lea r11, [rsp + 0x40]
lea rdx, str.interface
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x1400624b0
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x300]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
lea r8, [rsp + 0x70]
mov edx, edi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, r12d
jne 0x1400624a5
mov eax, dword [rsp + 0x300]
lea rdx, str.interface_
lea rcx, [rsp + 0x48]
mov word [rsp + rax*2 + 0x70], r12w
mov dword [rsp + 0x300], 0x1fe
call fcn.1400089b0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.140012750
mov rdx, qword [rsp + 0x48]
lea r11, [rsp + 0x308]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000000
mov qword [rsp + 0x20], r11
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, r12d
jne 0x14006248e
mov rcx, qword [rsp + 0x308]
lea rax, [rsp + 0x300]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xc0]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, r12d
jne 0x140062480
mov eax, dword [rsp + 0x300]
lea rcx, [rsp + 0xc0]
mov rdx, rbp
shr eax, 1
mov dword [rsp + 0x300], eax
mov word [rsp + rax*2 + 0xc0], r12w
call fcn.140019090
cmp eax, r12d
jne 0x140062480
lea rcx, [rsp + 0x70]
mov rdx, rsi
call qword [sym.imp.ole32.dll_IIDFromString]
mov ebx, eax
mov rcx, qword [rsp + 0x308]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp ebx, r12d
je 0x1400624a5
inc edi
mov dword [rsp + 0x300], SafeArrayCreateEx
jmp 0x140062368
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x48]
call fcn.140003410
lea r11, [rsp + 0x2d0]
mov eax, ebx
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1400627d0
Capabilities:
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x430
xor edi, edi
lea rax, [fcn.14001b224]
mov rsi, rdx
mov qword [rsp + 0x28], rax
mov rbx, rcx
mov qword [rsp + 0x20], rdi
cmp byte [rcx + 0x48], dil
jne 0x140062826
mov rcx, qword [rcx + 0x50]
lea rdx, [0x14009d504]
call fcn.14001ad8c
mov rdi, rax
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x140062826
lea edx, [rax + 0x1f]
jmp 0x1400628d1
lea rcx, [rbx + 0x178]
call fcn.140040d20
lea rcx, [rbx + 0x170]
call fcn.140040d50
mov dword [rsp + 0x440], 1
lea r9, [rsp + 0x440]
lea rdx, [rsp + 0x30]
mov r8d, 0x400
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400628cc
mov eax, dword [rsp + 0x440]
test eax, eax
je 0x1400628b1
test rdi, rdi
je 0x140062891
lea rcx, [rsp + 0x30]
mov rdx, rax
mov r9, rdi
mov r8d, 1
call fcn.14001b0f4
jmp 0x1400628a2
lea rcx, [rbx + 0x50]
lea rdx, [rsp + 0x30]
mov r8, rax
call fcn.1400127a0
mov ecx, dword [rsp + 0x440]
add qword [rbx + 0x10], rcx
test ecx, ecx
jne 0x140062849
cmp qword [rbx + 0x10], 0
mov rcx, rbx
jne 0x1400628c2
mov edx, SafeArrayDestroyDescriptor
jmp 0x1400628d4
xor r8d, r8d
mov r9b, 1
xor edx, edx
jmp 0x1400628dd
mov edx, SafeArrayAllocDescriptor
mov rcx, rbx
xor r9d, r9d
mov r8d, 0xdeadbeef
call fcn.140050e70
lea rcx, [rsp + 0x20]
mov bl, al
call fcn.140040bc0
lea r11, [rsp + 0x430]
mov rsi, qword [r11 + 0x20]
mov al, bl
mov rbx, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140062910
Capabilities:
Connect to http server

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov sil, r9b
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
je 0x14006294a
mov edx, 0x1d
mov r8d, 0xdeadbeef
xor r9d, r9d
call fcn.140050e70
jmp 0x140062a2a
mov ebp, dword [rcx + 0x70]
mov rcx, qword [rdx + 0x60]
mov eax, dword [rdx + 0xe0]
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov r9, qword [rdx + 0x40]
movzx r8d, word [rdx + 0xe8]
mov rdx, qword [rdx + 0x20]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rbx], rax
test rax, rax
jne 0x140062995
lea edx, [rax + 0x15]
mov rcx, rbx
jmp 0x140062937
mov rdx, qword [rdi + 0xc0]
and qword [rsp + 0x20], 0
mov r9d, ebp
mov r8d, 0x80000000
mov rcx, rax
call qword [sym.imp.WININET.dll_FtpOpenFileW]
mov rcx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov qword [rsp + 0x48], rcx
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x1400629db
xor r9d, r9d
lea edx, [rax + 0x16]
mov r8d, 0xdeadbeef
jmp 0x140062a14
lea rdx, [rsp + 0x70]
mov rcx, rax
call qword [sym.imp.WININET.dll_FtpGetFileSize]
mov ecx, dword [rsp + 0x70]
shl rcx, 0x20
mov eax, eax
or rcx, rax
mov qword [rbx + 0x18], rcx
test sil, sil
je 0x140062a0c
mov rdx, rdi
mov rcx, rbx
call fcn.1400627d0
jmp 0x140062a1c
xor r8d, r8d
mov r9b, 1
xor edx, edx
mov rcx, rbx
call fcn.140050e70
lea rcx, [rsp + 0x40]
mov bl, al
call fcn.140040bc0
mov al, bl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
Function at 0x140062a40
Capabilities:
Connect to http server
Send data
Send http request

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x70
cmp dword [rdx + 0xe4], 4
mov esi, dword [rcx + 0x70]
mov r13b, r9b
mov r12b, r8b
mov rbp, rdx
mov rbx, rcx
jne 0x140062a6c
bts esi, 0x17
mov eax, dword [rdx + 0xe0]
mov r10, qword [rdx + 0x60]
and qword [rsp + 0x38], 0
mov r9, qword [rdx + 0x40]
movzx r8d, word [rdx + 0xe8]
and dword [rsp + 0x30], 0
mov rdx, qword [rdx + 0x20]
mov rcx, qword [rcx + 8]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r10
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rbx], rax
test rax, rax
jne 0x140062ac5
lea edx, [rax + 0xb]
xor r9d, r9d
mov r8d, 0xdeadbeef
mov rcx, rbx
call fcn.140050e70
jmp 0x140062c2a
and qword [rsp + 0x38], 0
mov r8, qword [rbp + 0xc0]
mov dword [rsp + 0x30], esi
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
xor r9d, r9d
xor edx, edx
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpOpenRequestW]
mov rcx, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov qword [rsp + 0x48], rcx
mov rdi, rax
mov qword [rsp + 0x40], rax
test rax, rax
jne 0x140062b11
lea edx, [rax + 0xc]
jmp 0x140062c0b
test r12b, r12b
je 0x140062b24
mov r8, rbp
mov rdx, rax
mov rcx, rbx
call fcn.140050ec0
bt esi, 0xc
jae 0x140062b75
mov esi, SafeArrayAllocDescriptor
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0xa0]
mov rcx, rdi
mov edx, esi
mov dword [rsp + 0xa8], 4
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
bts dword [rsp + 0xa0], 8
lea r9d, [rsi - 0x1b]
lea r8, [rsp + 0xa0]
mov edx, esi
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetSetOptionW]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x140062c06
mov rdx, rdi
mov rcx, rbx
call fcn.140040c70
cmp eax, 0xc8
jne 0x140062c06
and dword [rsp + 0xa0], 0
lea rax, [rsp + 0xa0]
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x50]
mov edx, 5
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0xa8], SafeArrayDestroyDescriptor
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
lea rcx, [rsp + 0x50]
call fcn.140019d3c
mov rcx, rbx
mov qword [rbx + 0x18], rax
test r13b, r13b
je 0x140062bfc
mov rdx, rdi
call fcn.1400627d0
jmp 0x140062c1c
xor r8d, r8d
mov r9b, 1
xor edx, edx
jmp 0x140062c17
mov edx, reloc.WSOCK32.dll_listen
mov rcx, rbx
mov r8d, 0xdeadbeef
xor r9d, r9d
call fcn.140050e70
lea rcx, [rsp + 0x40]
mov bl, al
call fcn.140040bc0
mov al, bl
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140062c40
Capabilities:
Parse url

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rbx, rdx
xor edx, edx
mov rsi, r8
lea r8d, [rdx + 0x60]
lea rcx, [rsp + 0x28]
call fcn.140019a70
mov ebp, 1
mov rcx, rbx
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x30], ebp
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x70], ebp
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x20], 0xf0
call fcn.140019b5c
lea r9, [rsp + 0x20]
xor r8d, r8d
mov rcx, rbx
mov rdx, rax
call qword [sym.imp.WININET.dll_InternetCrackUrlW]
test eax, eax
je 0x140062dbd
mov r9d, dword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
xor r8d, r8d
mov rcx, rsi
call fcn.14005b9f0
mov r9d, dword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
lea rcx, [rsi + 0x20]
xor r8d, r8d
call fcn.14005b9f0
mov r9d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsi + 0x40]
xor r8d, r8d
call fcn.14005b9f0
mov r9d, dword [rsp + 0x60]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsi + 0x60]
xor r8d, r8d
call fcn.14005b9f0
mov r9d, dword [rsp + 0x70]
mov rdx, qword [rsp + 0x68]
lea rcx, [rsi + 0x80]
xor r8d, r8d
call fcn.14005b9f0
mov r9d, dword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
lea rcx, [rsi + 0xa0]
xor r8d, r8d
call fcn.14005b9f0
lea r8, [rsi + 0xa0]
lea rdx, [rsp + 0x90]
lea rcx, [rsi + 0x80]
call fcn.14005bcc0
lea rcx, [rsi + 0xc0]
mov rdx, rax
call fcn.140001110
lea rcx, [rsp + 0x90]
call fcn.140003410
mov ecx, dword [rsp + 0x34]
movzx r11d, word [rsp + 0x44]
mov dword [rsi + 0xe4], ecx
sub ecx, ebp
mov word [rsi + 0xe8], r11w
je 0x140062db4
cmp ecx, ebp
je 0x140062da8
mov dword [rsi + 0xe0], 3
jmp 0x140062dba
mov dword [rsi + 0xe0], 2
jmp 0x140062dba
mov dword [rsi + 0xe0], ebp
mov al, bpl
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x140062f00
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov rsi, rcx
cmp byte [rcx + 0x168], dil
je 0x140062f7c
cmp dl, dil
je 0x140062f7c
xor r9d, r9d
mov r8b, 1
xor edx, edx
add rcx, 0x170
mov qword [rsp + 0x20], rdi
call fcn.140040d80
mov r9b, 1
lea rcx, [rsi + 0x178]
mov r8b, r9b
xor edx, edx
mov qword [rsp + 0x20], rdi
call fcn.140040d80
lea rcx, [0x140062ec0]
mov r8, rsi
xor edx, edx
call fcn.14001cbe4
lea rcx, [rsi + 0x170]
or edx, 0xffffffff
call fcn.140040cc0
cmp dword [rsi + 0x20], edi
sete al
jmp 0x140062f81
call fcn.140062de0
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x140063090
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x2e0
lea rcx, [rsp + 0x48]
call fcn.140002350
mov rax, qword [rsp + 0x58]
mov r11, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x48]
lea rdx, [0x1400a0228]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
inc dword [rax]
mov qword [rsp + 0x70], r11
mov qword [rsp + 0x80], rax
call fcn.140012750
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x90]
mov bl, 1
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x140063265
mov bpl, byte [rsp + 0x330]
mov sil, byte [rsp + 0x328]
mov rdi, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x300]
call fcn.140003ae0
cmp eax, 1
je 0x14006325e
cmp eax, 0xb
jne 0x140063157
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140063131
lea rdx, [0x14009cf5c]
lea rcx, [rsp + 0xbc]
call fcn.140019cfc
test eax, eax
je 0x140063241
lea rdx, [0x1400a0230]
lea rcx, [rsp + 0xbc]
call fcn.140019cfc
test eax, eax
je 0x140063241
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140001110
lea rdx, [rsp + 0xbc]
lea rcx, [rsp + 0x48]
call fcn.140012750
test byte [rsp + 0x90], 0x10
je 0x140063211
test sil, sil
je 0x1400631c2
inc qword [rdi]
test bpl, bpl
je 0x140063241
lea rdx, [0x14009ad4c]
lea rcx, [rsp + 0x48]
call fcn.140012750
mov r9, qword [rsp + 0x318]
mov r8, qword [rsp + 0x310]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x300]
mov byte [rsp + 0x30], bpl
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x20], rdi
call fcn.140063090
mov bl, al
test al, al
je 0x140063260
jmp 0x140063241
mov eax, dword [rsp + 0xb0]
mov ecx, dword [rsp + 0xac]
shl rcx, 0x20
or rcx, rax
mov rax, qword [rsp + 0x310]
add qword [rax], rcx
test sil, sil
je 0x140063241
mov rax, qword [rsp + 0x318]
inc qword [rax]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140063131
jmp 0x140063260
xor bl, bl
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.140003410
lea rcx, [rsp + 0x48]
call fcn.140003410
mov al, bl
mov rbx, qword [rsp + 0x308]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140063300
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
xor ebx, ebx
mov r14, r8
mov r13, rdx
lea r15d, [rbx + 1]
mov rsi, rcx
mov r12d, ebx
mov bpl, r15b
lea edi, [rbx + 4]
mov r9, qword [rsi]
lea rcx, [rsp + 0x24]
mov r8, rdi
mov rdx, r15
call fcn.14001b5b8
lea rdx, [rsp + 0x24]
mov r9d, 0x18ee
mov r8d, edi
mov rcx, rsi
call fcn.14005b0e0
lea rdx, str.FILE
lea rcx, [rsp + 0x24]
mov byte [rsp + 0x28], bl
call fcn.14001aa30
cmp eax, ebx
jne 0x1400634bf
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r15
mov rdx, rdi
add r12d, r15d
call fcn.14001b5b8
mov edi, dword [rsp + 0x20]
mov r9, qword [rsi]
xor edi, 0xadbc
lea rcx, [rsp + 0x30]
mov rdx, r15
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.14001b5b8
lea r9d, [rdi + 0xb33f]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.14005b0e0
movsxd r11, edi
xor eax, eax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov word [rsp + r11*2 + 0x30], ax
call fcn.140019150
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r15
mov edx, 4
call fcn.14001b5b8
mov edi, dword [rsp + 0x20]
mov r9, qword [rsi]
xor edi, 0xf820
lea rcx, [rsp + 0x30]
mov rdx, r15
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.14001b5b8
lea r9d, [rdi + 0xf479]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.14005b0e0
movsxd r11, edi
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov rcx, r14
mov word [rsp + r11*2 + 0x30], bx
call fcn.140019150
lea rcx, [rsp + 0x240]
mov rdx, r13
call fcn.140019cfc
cmp eax, ebx
je 0x1400634f1
lea rdx, [0x14009d500]
mov rcx, r13
call fcn.140019cfc
cmp eax, ebx
jne 0x14006347b
cmp r12d, ebx
je 0x1400634f1
mov rcx, qword [rsi]
mov r8d, r15d
mov edx, r15d
call fcn.14001ae4c
mov r9, qword [rsi]
mov edi, 4
lea rcx, [rsp + 0x2c]
mov rdx, rdi
mov r8, r15
call fcn.14001b5b8
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsi]
xor edx, 0x87bc
mov r8d, r15d
mov dword [rsp + 0x2c], edx
add edx, 0x18
call fcn.14001ae4c
jmp 0x1400634c2
mov bpl, bl
cmp bpl, r15b
je 0x140063337
mov eax, 6
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x1400634d0
Function at 0x140063500
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d0
xor r15d, r15d
mov rbx, rdx
mov edx, dword [rcx + 8]
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov dword [rsp + 0x4c], r15d
mov dword [rsp + 0x50], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r15w
mov r13, rcx
mov rcx, qword [rcx]
mov r14, r8
lea r12d, [r15 + 1]
xor r8d, r8d
mov rbp, r9
mov word [rax - 0x486], r15w
mov qword [rax - 0x258], r15
mov dword [rsp + 0x24], r12d
call fcn.14001ae4c
lea r8, [rsp + 0x4c0]
xor r9d, r9d
mov rdx, rbx
mov rcx, r13
call fcn.140063300
cmp eax, r15d
je 0x1400635ab
lea eax, [r15 + 6]
jmp 0x140063721
mov r9, qword [r13]
lea rcx, [rsp + 0x700]
mov r8, r12
mov rdx, r12
call fcn.14001b5b8
mov r9, qword [r13]
mov edi, 4
lea rcx, [rsp + 0x20]
mov rdx, rdi
mov r8, r12
call fcn.14001b5b8
mov esi, dword [rsp + 0x20]
mov r9, qword [r13]
lea rcx, [rsp + 0x20]
mov ebx, 0x87bc
mov r8, r12
mov rdx, rdi
xor esi, ebx
call fcn.14001b5b8
mov r11d, dword [rsp + 0x20]
mov r9, qword [r13]
xor r11d, ebx
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, rdi
mov dword [rbp], r11d
call fcn.14001b5b8
mov edi, dword [rsp + 0x20]
mov rcx, qword [r13]
mov r8d, r12d
mov edx, reloc.WSOCK32.dll_recv
xor edi, 0xa685
call fcn.14001ae4c
mov ecx, dword [rbp]
call fcn.14001a154
movsxd rbx, esi
mov rcx, rbx
mov rbp, rax
call fcn.14001a154
mov r9, qword [r13]
mov r8d, 1
mov rcx, rax
mov rdx, rbx
mov r12, rax
call fcn.14001b5b8
mov r9d, dword [r13 + 0xc]
mov r8d, esi
mov rdx, r12
mov rcx, r13
add r9d, 0x2477
call fcn.14005b0e0
lea rcx, [rsp + 0x24]
mov r8d, esi
mov rdx, r12
call fcn.140041680
cmp edi, dword [rsp + 0x24]
je 0x1400636a9
mov rcx, rbp
call fcn.14001a438
mov rcx, r12
call fcn.14001a438
mov eax, 0xa
jmp 0x140063721
cmp byte [rsp + 0x700], 1
jne 0x140063711
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], r15d
mov dword [rsp + 0x44], r15d
mov dword [rsp + 0x48], r15d
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x60], r15
mov word [rsp + 0x68], r15w
mov word [rsp + 0x272], r15w
mov qword [rsp + 0x4a0], r15
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rbp
call fcn.14005b2f0
mov rcx, r12
call fcn.14001a438
jmp 0x14006371c
mov rcx, rbp
call fcn.14001a438
mov rbp, r12
mov qword [r14], rbp
xor eax, eax
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140064470
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov r13b, byte [0x1400b13c7]
mov rsi, rdx
mov rdi, rcx
call fcn.14001c4c4
mov edx, 0x8000
mov ecx, eax
call fcn.14001c36c
mov rcx, rsi
mov ebp, eax
call fcn.1400418b0
test al, al
je 0x1400644dc
call fcn.140051d00
mov rcx, rsi
movsxd rbx, eax
call fcn.140063f40
mov r9, rdi
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.14001b0f4
mov r12, rax
jmp 0x140064522
call fcn.140063fa0
or edx, 0xffffffff
mov rcx, rax
call fcn.140015b00
lea rdx, [0x14009d144]
mov rcx, rdi
mov r8, rax
mov rbx, rax
call fcn.14001c4fc
mov rcx, rbx
movsxd r12, eax
call fcn.140018ec8
test r13b, r13b
je 0x140064522
mov rcx, rsi
call fcn.140063fa0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, rdi
call fcn.14001ba80
mov rcx, rdi
call fcn.14001c4c4
mov edx, 0x4000
mov ecx, eax
cmp ebp, 0xffffffff
je 0x140064540
mov edx, ebp
call fcn.14001c36c
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, r12
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x140064570
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xac0
mov rbx, rdx
lea rdx, [rsp + 0x280]
mov dil, r8b
call fcn.140017250
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.140017250
lea rcx, [rsp + 0x280]
call fcn.1400437b0
xor ebx, ebx
cmp al, bl
jne 0x1400645b7
xor al, al
jmp 0x14006474e
lea rcx, [rsp + 0x70]
call fcn.1400437b0
cmp al, bl
je 0x140064688
cmp dil, bl
je 0x1400645b0
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
lea rcx, [rsp + 0x280]
cmp eax, ebx
jne 0x14006461f
lea rdx, [rsp + 0x70]
call fcn.140019cfc
cmp eax, ebx
je 0x140064618
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
cmp eax, ebx
setne al
jmp 0x14006474e
mov al, 1
jmp 0x14006474e
lea rax, [rsp + 0x490]
lea r9, [rsp + 0x6a0]
lea r8, [rsp + 0x8b0]
lea rdx, [rsp + 0xae8]
mov qword [rsp + 0x20], rax
call fcn.14001a7ac
lea rdx, [0x14009ad4c]
lea rcx, [rsp + 0x70]
call fcn.140019124
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x70]
call fcn.140019124
cmp word [rsp + 0x490], bx
je 0x140064688
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x70]
call fcn.140019124
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
call fcn.140043700
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x280]
cmp al, bl
je 0x1400646d1
mov r8b, 1
call fcn.14005c1d0
cmp al, bl
je 0x1400645b0
lea rcx, [rsp + 0x280]
mov dl, 1
call fcn.14005c120
cmp al, bl
jmp 0x140064610
call fcn.140019cfc
cmp eax, ebx
je 0x1400645b0
lea rcx, [rsp + 0x280]
call fcn.140019b5c
lea rcx, [rsp + 0x70]
mov word [rsp + rax*2 + 0x282], bx
call fcn.140019b5c
lea rcx, [rsp + 0x30]
mov word [rsp + rax*2 + 0x72], bx
lea rax, [rsp + 0x280]
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x48], rax
mov eax, 0x614
mov dword [rsp + 0x54], ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x38], 1
mov word [rsp + 0x50], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
cmp eax, ebx
sete al
mov rbx, qword [rsp + 0xad0]
add rsp, 0xac0
pop rdi
ret