joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400512e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
xor eax, eax
movsxd rbx, edx
mov rdi, rcx
lea rcx, [rsp + 0x48]
lea edx, [rax + 1]
mov byte [rsp + 0x48], 0
mov qword [rsp + 0x49], rax
mov qword [rsp + 0x51], rax
mov qword [rsp + 0x59], rax
mov qword [rsp + 0x61], rax
mov dword [rsp + 0x69], eax
mov word [rsp + 0x6d], ax
mov byte [rsp + 0x6f], al
call qword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
xor r9d, r9d
lea rcx, [rsp + 0x48]
lea edx, [r9 + 1]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
xor r11d, r11d
lea rax, [rsp + 0x48]
xor r8d, r8d
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x18
lea edx, [r11 + 1]
lea rcx, [rsp + 0x30]
lea r9, str.Global07863591_63B9_4289_8CFA_9E3717EF20CE
test ebx, ebx
jne 0x140051378
lea r9, str.Global9DA02AFD_F453_42A2_920E_AE7666D43EE3
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0x40], rax
test rax, rax
jne 0x140051395
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
lea rax, [rdi + 0x48]
mov r9, rbx
lea r8, [0x140051af0]
mov qword [rsp + 0x28], rax
xor ebx, ebx
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.1400d86a0
test rax, rax
mov qword [rdi + 0x30], rax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x140052990
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rdi, rcx
xor esi, esi
mov qword [rcx], rsi
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], rsi
mov dword [rcx + 0x18], send
mov dword [rcx + 0x38], esi
mov dword [rcx + 0x3c], 0xa
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rsi
mov dword [rcx + 0x1c], 0x3f400000
mov dword [rcx + 0x20], 0x3e800000
mov dword [rcx + 0x24], 0x40100000
xor eax, eax
movss xmm1, dword [0x14013873c]
movabs rcx, 0x8000000000000000
movss xmm0, dword [0x1401329f0]
comiss xmm1, xmm0
jbe 0x140052a18
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x140052a18
mov rax, rcx
cvttss2si rdx, xmm1
add rdx, rax
mov qword [rdi + 0x28], rdx
xor eax, eax
movss xmm1, dword [0x140138738]
comiss xmm1, xmm0
jbe 0x140052a3f
subss xmm1, xmm0
comiss xmm1, xmm0
jae 0x140052a3f
mov rax, rcx
cvttss2si rcx, xmm1
add rcx, rax
mov rax, rcx
cmp rcx, 0x11
cmovb rax, rsi
mov qword [rdi + 0x30], rax
mov qword [rdi + 0x50], rsi
mov qword [rdi + 0x58], rsi
mov dword [rdi + 0x60], send
mov dword [rdi + 0x80], esi
mov dword [rdi + 0x84], 0xa
mov qword [rdi + 0x88], rsi
mov qword [rdi + 0x90], rsi
mov dword [rdi + 0x64], 0x3f400000
mov dword [rdi + 0x68], 0x3e800000
mov dword [rdi + 0x6c], 0x40100000
mov qword [rdi + 0x70], rdx
cmovb rcx, rsi
mov qword [rdi + 0x78], rcx
lea rcx, [rdi + 0x98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x140052ad1
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140052ac9
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.1400022b0
nop
lea rcx, [rdi + 0xc0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
test eax, eax
jne 0x140052afe
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140052af6
movzx eax, ax
or eax, 0x80070000
mov ecx, eax
call fcn.1400022b0
nop
lea rbx, [rdi + 0xe8]
mov qword [rsp + 0x48], rbx
mov qword [rbx], rsi
mov dword [rdi + 0xf0], esi
mov dword [rdi + 0xf4], esi
mov qword [rdi + 0xf8], rsi
mov dword [rdi + 0x100], esi
mov dword [rdi + 0x104], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx], rax
mov rax, rdi
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x140052c00
Capabilities:
Get system information on windows

Disassembly:
mov rax, rsp
push r13
sub rsp, 0x70
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
movaps xmmword [rax - 0x18], xmm6
movaps xmm6, xmm3
mov r12d, r8d
mov esi, edx
mov rbx, rcx
cmp qword [rcx], 0
je 0x140052c41
mov eax, 1
jmp 0x140052d0f
xor edi, edi
mov dword [rcx + 0x104], edi
test edx, edx
jne 0x140052c61
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x48]
lea esi, [r11 + r11]
cmp esi, r12d
cmova esi, r12d
mov r9d, esi
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rbx], rax
mov r13d, edi
test rax, rax
setne r13b
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140052c99
movzx eax, ax
or eax, 0x80070000
mov edx, edi
test r13d, r13d
cmove edx, eax
mov eax, edi
test edx, edx
setns al
test eax, eax
jne 0x140052ce7
mov r9d, esi
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rbx], rax
mov ebx, edi
test rax, rax
setne bl
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140052cdb
movzx eax, ax
or eax, 0x80070000
test ebx, ebx
cmove edi, eax
mov ecx, edi
call fcn.1400022b0
movss dword [rbx + 0x100], xmm6
mov dword [rbx + 0xfc], r12d
mov dword [rbx + 0xf8], esi
mov edx, esi
mov rcx, rbx
call fcn.140052d80
xor eax, eax
jmp 0x140052d0f
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
movaps xmm6, xmmword [rsp + 0x60]
mov rsp, r11
pop r13
ret
Function at 0x140052f30
Capabilities:
Terminate thread

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rsi
mov rbx, rcx
mov rax, qword [rcx]
mov qword [rsp + 0x58], rax
test rax, rax
je 0x140053028
mov eax, 1
xchg dword [rcx + 0x104], eax
call fcn.1400534d0
cmp qword [rbx + 0x10], 0
je 0x140052f94
xor eax, eax
mov dword [rsp + 0x20], eax
cmp eax, dword [rbx + 0x18]
jae 0x140052f94
mov rcx, qword [rbx + 8]
cmp qword [rcx + rax*8], 0
je 0x140052f90
mov rdi, qword [rcx + rax*8]
jmp 0x140052f96
inc eax
jmp 0x140052f76
xor edi, edi
test rdi, rdi
je 0x14005300a
mov rsi, qword [rdi + 8]
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [rdi], eax
je 0x140052fb4
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_TerminateThread]
cmp qword [rdi + 0x10], 0
je 0x140052fc6
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x28], rcx
jmp 0x140053005
xor ecx, ecx
mov qword [rsp + 0x28], rcx
xor edx, edx
mov eax, dword [rdi + 0x18]
div dword [rbx + 0x18]
inc edx
mov dword [rsp + 0x24], edx
nop dword [rax + rax]
test rcx, rcx
jne 0x140053005
cmp edx, dword [rbx + 0x18]
jae 0x140053005
mov r8, qword [rbx + 8]
cmp qword [r8 + rdx*8], rcx
je 0x140052ffd
mov rcx, qword [r8 + rdx*8]
mov qword [rsp + 0x28], rcx
inc edx
mov dword [rsp + 0x24], edx
jmp 0x140052fe0
mov rdi, rcx
jmp 0x140052f96
lea rcx, [rbx + 8]
call fcn.140053790
mov rcx, qword [rbx]
test rcx, rcx
je 0x140053028
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], 0
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400534d0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r13d, eax
lea r15, [r12 + 0x98]
mov qword [rsp + 0x38], r15
mov byte [rsp + 0x40], 0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x40], 1
mov r14, qword [r12 + 0x10]
xor esi, esi
test r14d, r14d
jle 0x1400536a7
or r9, 0xffffffffffffffff
xor r8d, r8d
xor edx, edx
mov rcx, qword [r12]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
je 0x14005369c
mov edx, 0x8ca0
mov rcx, qword [r12 + 0xe8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ebx, eax
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
test ecx, ecx
je 0x140053691
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r13d
cmp eax, 0x8ca0
jae 0x1400536a7
cmp ebx, 0x102
je 0x140053683
mov ecx, dword [r12 + 0xf0]
xor edx, edx
mov eax, ecx
div dword [r12 + 0x18]
mov rbx, qword [r12 + 8]
test rbx, rbx
je 0x140053683
mov rbx, qword [rbx + rdx*8]
test rbx, rbx
je 0x140053683
cmp dword [rbx + 0x18], ecx
jne 0x1400535cd
cmp dword [rbx], ecx
je 0x1400535d3
mov rbx, qword [rbx + 0x10]
jmp 0x1400535bb
test rbx, rbx
je 0x140053683
lea rdi, [r12 + 0xc0]
mov qword [rsp + 0x28], rdi
mov byte [rsp + 0x30], 0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov byte [rsp + 0x30], 1
lea rcx, [r12 + 0x50]
mov edx, dword [rbx]
call fcn.140053880
cmp dword [rax], 0
je 0x14005361d
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x30], 0
jmp 0x140053683
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x30], 0
mov rdi, qword [rbx + 8]
mov dword [rsp + 0x80], 0
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeThread]
cmp dword [rsp + 0x80], 0x103
jne 0x140053666
mov edx, 0x8ca0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, r13d
cmp eax, 0x8ca0
jae 0x14005368f
mov edx, dword [rbx]
lea rcx, [r12 + 8]
call fcn.1400536e0
nop
inc esi
cmp esi, r14d
jge 0x1400536a7
jmp 0x140053531
jmp 0x1400536a7
mov ecx, 0x80004005
call fcn.1400022b0
int3
mov ecx, 0x80004005
call fcn.1400022b0
nop
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov byte [rsp + 0x40], 0
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400556b0
Capabilities:
Terminate process

Disassembly:
push rdi
sub rsp, 0x170
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov dword [rsp + 0x40], 0x114
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x44]
call fcn.1400dd9f0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [rsp + 0x50], 2
je 0x140055711
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rax, qword [0x140183638]
test rax, rax
jne 0x1400557c9
lea rdi, vtable.CLockMgr_class_CCSWrapper_.0
mov qword [rsp + 0x20], rdi
lea rcx, [0x14018f4d0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x30], 1
or ebx, 0xffffffff
cmp qword [0x14018f4d0], rax
je 0x140055773
call qword [sym.imp.USER32.dll_InSendMessage]
mov ecx, 0x2710
test eax, eax
cmovne ebx, ecx
mov edx, ebx
mov rcx, qword [0x14018f4d0]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x140183638]
test rax, rax
jne 0x1400557ab
mov eax, dword [0x140192a38]
test al, 1
jne 0x14005579d
or eax, 1
mov dword [0x140192a38], eax
call fcn.140055510
lea rcx, [0x14011a890]
call fcn.1400d8538
nop
lea rax, [0x140192a08]
mov qword [0x140183638], rax
mov qword [rsp + 0x20], rdi
mov rcx, qword [0x14018f4d0]
test rcx, rcx
je 0x1400557c9
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rax, qword [0x140183638]
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret

Function at 0x140055d90
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, edx
mov rbx, rcx
call fcn.140055ec0
cmp edi, eax
je 0x140055eb2
mov rcx, rbx
test eax, eax
jne 0x140055e52
mov rax, qword [rbx]
call qword [rax + reloc.WS2_32.dll_recv]
test eax, eax
je 0x140055eb2
or rcx, 0xffffffffffffffff
xor eax, eax
lea r9, [rbx + 0x18]
mov rdi, r9
repne scasw ax, word [rdi]
not rcx
dec rcx
je 0x140055df1
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbx + 0x218], rax
lea rax, [rbx + 0xc]
lea r8, [0x140055ff0]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call fcn.1400d86a0
cmp eax, 0xffffffff
je 0x140055eb2
mov rcx, rbx
call fcn.140055ec0
test eax, eax
jne 0x140055eb2
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.140055ec0
test eax, eax
je 0x140055e30
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call fcn.140055ec0
test eax, eax
je 0x140055ea0
mov rcx, qword [rbx + 0x218]
test rcx, rcx
je 0x140055e6d
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rbx
call fcn.140055ec0
test eax, eax
je 0x140055e97
nop dword [rax]
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, rbx
call fcn.140055ec0
test eax, eax
jne 0x140055e80
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x18]
mov rcx, qword [rbx + 0x218]
test rcx, rcx
je 0x140055eb2
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140057460
Capabilities:
Query service status
Stop service

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rdx, str.ProcObsrv
mov r8d, 0xf01ff
mov rbx, rcx
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rdi, rax
test rax, rax
jne 0x1400574a4
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x140057534
lea r8, [rsp + 0x20]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14005754c
test rbx, rbx
je 0x140057526
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x140057526
mov qword [rsp + 0x68], rsi
mov esi, 0x2710
cmp dword [rsp + 0x24], 1
je 0x140057521
mov eax, 0xcccccccd
mul dword [rsp + 0x38]
shr edx, 3
cmp edx, 0x3e8
jae 0x140057502
mov edx, 0x3e8
jmp 0x140057507
cmp edx, esi
cmova edx, esi
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x1400574e0
mov rsi, qword [rsp + 0x68]
mov bl, 1
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140057526
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x140057528

Function at 0x140057800
Capabilities:
Start service

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
movzx esi, r8w
mov rbx, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140057830
xor al, al
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
xor edx, edx
xor ecx, ecx
mov r8d, 0xf003f
mov qword [rsp + 0x30], rdi
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov rdi, rax
test rax, rax
jne 0x14005785a
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
jmp 0x1400578ef
movzx ecx, si
dec ecx
je 0x1400578d5
dec ecx
je 0x1400578cb
dec ecx
je 0x140057877
dec ecx
jne 0x140057897
mov rcx, rax
call fcn.140057460
jmp 0x1400578e0
mov r8d, 0xf01ff
mov rdx, rbp
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov rbx, rax
test rax, rax
jne 0x14005789b
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor bl, bl
jmp 0x1400578e3
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1400578be
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
jne 0x140057891
mov bl, 1
jmp 0x1400578e3
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov bl, 1
jmp 0x1400578e3
mov rcx, rax
call fcn.140057110
jmp 0x1400578e0
mov rdx, rbx
mov rcx, rax
call fcn.140056c80
movzx ebx, al
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movzx eax, bl
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
Function at 0x140057b50
Capabilities:
Create thread

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x80
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
cmp byte [rcx + 0x18], 0
jne 0x140057cd4
lea rcx, [rsp + 0xb8]
call fcn.140085530
nop
lea r8, str.processes.log
mov rdx, rax
lea rcx, [rsp + 0xb0]
call fcn.1400162e0
nop
lea rcx, [rdi + 0x50]
mov rdx, rax
call fcn.140001cf0
nop
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140057bcd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140057bed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor ebx, ebx
mov qword [rdi + 0x28], rbx
lea rcx, [rdi + 0x30]
xor r8d, r8d
lea rdx, [0x140129a38]
call fcn.140002120
lea rcx, [rdi + 0x38]
xor r8d, r8d
lea rdx, [0x140129a38]
call fcn.140002120
mov qword [rdi + 0x40], rbx
mov qword [rdi + 0x48], rbx
mov qword [rdi + 0x10], rsi
mov dword [rsp + 0xa0], ebx
mov byte [rdi + 0x19], bl
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ebx
mov r9, rdi
lea r8, [0x140057d60]
xor edx, edx
xor ecx, ecx
call fcn.1400d86a0
mov qword [rdi + 0x20], rax
test rax, rax
jne 0x140057c93
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140057c6e
movzx eax, ax
or eax, 0x80070000
lea r8, str.m_hThread
mov edx, eax
lea rcx, [rsp + 0x38]
call fcn.140058db0
lea rdx, [0x140176c18]
lea rcx, [rsp + 0x38]
call fcn.1400de560
int3
cmp rax, 0xffffffffffffffff
jne 0x140057cd0
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jle 0x140057cab
movzx eax, ax
or eax, 0x80070000
lea r8, str.m_hThread____HANDLE__1
mov edx, eax
lea rcx, [rsp + 0x58]
call fcn.140058db0
lea rdx, [0x140176c18]
lea rcx, [rsp + 0x58]
call fcn.1400de560
int3
mov byte [rdi + 0x18], 1
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x140059890
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x4f0], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rdi, r8
mov r13, rdx
mov r14, rcx
xor r15d, r15d
mov ebp, r15d
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x20], rax
mov r9, rdi
mov r8, r13
lea rdx, [0x14012ffa0]
lea rcx, [rsp + 0x20]
call fcn.140016060
movzx eax, byte [r14 + 0x70]
test al, al
je 0x140059937
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or rbx, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140059930
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
xor eax, eax
jmp 0x140059a50
lea rdx, [rsp + 0x40]
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r12, rax
cmp rax, 0xffffffffffffffff
jne 0x140059959
lea rdx, [rdi - 0x18]
jmp 0x140059918
lea rsi, [rsp + 0x290]
sub rsi, r13
or rbx, 0xffffffffffffffff
nop dword [rax + rax]
mov word [rsp + 0x290], r15w
xor edx, edx
mov r8d, 0x20a
lea rcx, [rsp + 0x292]
call fcn.1400dd9f0
mov rdx, r13
nop word [rax + rax]
movzx eax, word [rdx]
mov word [rsi + rdx], ax
add rdx, 2
test ax, ax
jne 0x1400599a0
lea rdi, [rsp + 0x290]
xor eax, eax
mov rcx, rbx
repne scasw ax, word [rdi]
mov eax, dword [0x14012ed28]
mov dword [rdi - 2], eax
lea rdi, [rsp + 0x290]
xor eax, eax
mov rcx, rbx
repne scasw ax, word [rdi]
lea rdx, [rsp + 0x6c]
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x1400599e0
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x2c], eax
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x28], eax
add rbp, qword [rsp + 0x28]
lea rdx, [rsp + 0x40]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140059a26
movzx eax, byte [r14 + 0x70]
test al, al
je 0x140059970
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x140059a4d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
mov rax, rbp
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x4f0]
add rsp, 0x4b0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140059a80
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x4b0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x4f8], rbx
mov rax, qword [0x14017c430]
xor rax, rsp
mov qword [rsp + 0x4a0], rax
mov rsi, r8
mov r12, rdx
mov rbp, rcx
xor r13d, r13d
mov word [rsp + 0x290], r13w
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x292]
call fcn.1400dd9f0
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 8]
cmp r8, rcx
je 0x140059b04
mov rdx, rcx
call fcn.14005c710
mov rdi, rax
mov rdx, qword [rbp + 0x10]
mov rcx, rax
call fcn.14005c3a0
mov qword [rbp + 0x10], rdi
mov rcx, r12
lea rdx, [rsp + 0x290]
sub rdx, r12
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x140059b20
lea rdi, [rsp + 0x290]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
mov rax, qword [0x14012ffb0]
mov qword [rdi - 2], rax
lea rdi, [rsp + 0x290]
xor eax, eax
or rcx, 0xffffffffffffffff
repne scasw ax, word [rdi]
xor ecx, ecx
nop
movzx eax, word [rsi + rcx]
mov word [rdi + rcx - 2], ax
add rcx, 2
test ax, ax
jne 0x140059b60
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x290]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140059b95
xor eax, eax
jmp 0x140059c7b
lea rax, [rsp + 0x28]
mov qword [rsp + 0x38], rax
nop
mov qword [rsp + 0x20], r13
lea rcx, [0x14017bd30]
mov rax, qword [0x14017bd30]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x6c]
mov r8, r12
lea rdx, [0x14012f290]
lea rcx, [rsp + 0x28]
call fcn.140016060
mov edx, dword [rsp + 0x48]
mov dword [rsp + 0x24], edx
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x20], eax
test byte [rsp + 0x40], 0x10
jne 0x140059bfe
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 8]
call fcn.14005c2d0
nop
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140059c1e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + VariantCopy]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x140059c3c
movzx eax, byte [rbp + 0x70]
test al, al
je 0x140059ba0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 8]
mov rax, qword [rbp + 0x10]
sub rax, rcx
test rax, 0xfffffffffffffff0
je 0x140059b8e
mov rdx, qword [rbp + 0x10]
mov r8, rdx
sub r8, rcx
sar r8, 4
lea r9, [0x140059530]
call fcn.14005c5c0
mov eax, 1
mov rcx, qword [rsp + 0x4a0]
xor rcx, rsp
call fcn.1400d4d90
mov rbx, qword [rsp + 0x4f8]
add rsp, 0x4b0
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret