joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14014bf30
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2d8], rbx
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
lea rax, [rcx + 0x18]
mov qword [rsp + 0x50], rax
lea rdi, [rax + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d10e0
nop
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x14014bfa5
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0xb0], 0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14014bfeb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400d10e0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rsp + 0x48], 0
jle 0x14014bfeb
mov rcx, qword [rsp + 0x40]
call fcn.1402b7350
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14014b890
nop
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400eb4a0
mov rcx, rbx
call fcn.14014b3d0
nop
cmp dword [rsp + 0x28], 0
jle 0x14014c020
mov rcx, qword [rsp + 0x20]
call fcn.1402b7350
nop
cmp dword [rsp + 0x38], 0
jle 0x14014c032
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2c0
pop rdi
ret
Function at 0x14014dfe0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx eax, word [rdx + 0x10]
mov rdi, rdx
mov rbx, rcx
cmp ax, 0x14
jne 0x14014e00d
mov qword [rdx + 0x18], 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp ax, 1
jne 0x14014e09b
call fcn.1401f9d40
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0xfa
mov rcx, rax
call fcn.1401473a0
mov ecx, 0xfdb361
mov qword [rbx + 0xa0], rax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r8, [0x14014e120]
mov qword [rbx + 0xb8], rax
lea rax, [rsp + 0x48]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xb0], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp ax, 2
jne 0x14014e0fe
mov rdx, qword [rcx + 0xb0]
test rdx, rdx
je 0x14014e0f1
mov rcx, qword [rcx + 0xb8]
xor r9d, r9d
mov r8d, 0x3e8
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x14014e0d9
mov rcx, qword [rbx + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0xb8]
mov qword [rbx + 0xb0], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xa8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1401f9d40
Function at 0x14014e130
Capabilities:
Capture screenshot
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push r14
sub rsp, 0xa0
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp qword [rcx + 0xa0], 0
mov r14, rcx
je 0x14014e366
mov rax, qword [rcx]
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r15
call qword [rax]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rdx, qword [r14]
mov rcx, r14
call qword [rdx]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [rsp + 0x74]
mov r13d, dword [rsp + 0x70]
sub ebx, dword [rsp + 0x6c]
sub r13d, dword [rsp + 0x68]
mov rcx, rdi
mov dword [rsp + 0x50], ebx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, ebx
mov edx, r13d
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, rbp
mov rdx, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [r14 + 0xa0]
xor edi, edi
mov r15d, dword [rcx + 0x10]
mov sil, 1
sub r15d, r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [r14 + 0xb8]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14014e322
mov qword [rsp + 0x90], r12
lea r12d, [r13 - 8]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [r14 + 0xa8]
lea rdx, [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, qword [r14 + 0xa0]
mov r9d, 8
mov eax, dword [rcx + 0x14]
mov r8d, r9d
mov rdx, rbp
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x20], edi
call fcn.140147ab0
mov rcx, qword [rsp + 0x58]
xor eax, eax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x50]
mov r9d, r13d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
test sil, sil
je 0x14014e2c0
inc edi
cmp edi, r15d
jne 0x14014e2ce
xor sil, sil
jmp 0x14014e2ce
dec edi
movzx esi, sil
mov eax, 1
cmove esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xa
jae 0x14014e2fb
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xa
jb 0x14014e2e1
lea r12d, [r13 - 8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [r14 + 0xb8]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x14014e240
mov r12, qword [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402b6d40
add rsp, 0xa0
pop r14
ret
Function at 0x14014f8e0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x30]
lea rax, vtable.RegKeyMonitor.0
mov rbx, rcx
mov qword [rcx], rax
mov rcx, qword [rcx + 0x28]
xor r9d, r9d
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x14014f91d
mov rcx, qword [rbx + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 0x20]
add rsp, 0x20
pop rbx
jmp fcn.1402b7350

Function at 0x14014f960
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
jne 0x14014f99b
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbp, rax
test rax, rax
jne 0x14014f9de
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x40
mov qword [rsp + 0x40], rbx
call fcn.1402b6dbc
mov rbx, rax
test rax, rax
je 0x14014fa5f
lea rax, vtable.RegKeyMonitor.0
lea rcx, str.ScanAndClean
mov qword [rbx + 0x10], rsi
mov qword [rbx], rax
mov rax, qword [rdi]
mov qword [rbx + 0x18], rbp
mov qword [rbx + 8], rax
call fcn.1402b9ff0
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r8, [0x14014fa80]
mov qword [rbx + 0x28], rax
lea rax, [rbx + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x30], rax
jmp 0x14014fa61
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x14014fa90
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x48
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rbx, rcx
mov rcx, qword [rcx + 8]
lea r8d, [rdx + 3]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x14014fad2
mov r8, qword [rbx + 0x20]
lea rdx, str.Started_monitoring__ls...
mov ecx, 1
call fcn.14016fab0
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
xor esi, esi
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14014fb18
xor dil, dil
jmp 0x14014fb44
cmp dword [rsp + 0x60], esi
setne dil
test dil, dil
je 0x14014fb44
mov r8, qword [rbx + 0x20]
lea rdx, str.State__ls_is_set__initial_
mov ecx, 1
call fcn.14016fab0
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x38], rax
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x30]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x14014fc26
cmp eax, 1
jne 0x14014fb60
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x14014fbc1
xor al, al
jmp 0x14014fbc8
cmp dword [rsp + 0x60], esi
setne al
cmp al, dil
je 0x14014fc02
mov rcx, qword [rbx + 0x18]
movzx edi, al
test al, al
je 0x14014fbe7
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, str.State__ls_is_set
jmp 0x14014fbf4
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, str.State__ls_is_reset
mov r8, qword [rbx + 0x20]
mov ecx, 1
call fcn.14016fab0
mov r9, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
mov edx, 1
lea r8d, [rdx + 3]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x14014fb60
mov r8, qword [rbx + 0x20]
lea rdx, str.Stopped_monitoring__ls
mov ecx, 1
call fcn.14016fab0
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbx
ret
Function at 0x140154c00
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0xe0], rax
movzx ebx, cx
movabs rax, 0x5c003a003f
mov qword [rsp + 0x50], rax
mov word [rsp + 0x50], cx
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x140154cf5
lea rdx, [0x1403541d0]
lea rcx, [rsp + 0x60]
call fcn.1402b71dc
movzx ecx, bx
test eax, eax
jne 0x140154c9a
call fcn.1401566c0
mov rbx, rax
jmp 0x140154cc9
call fcn.1402ba4dc
movzx ebx, ax
mov ecx, 0x2a0
call fcn.1402b6dbc
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140154cc6
movzx edx, bx
mov rcx, rax
call fcn.140155da0
mov rbx, rax
jmp 0x140154cc9
mov rbx, rdi
test rbx, rbx
je 0x140154cf5
mov ecx, 0x118
call fcn.1402b6dbc
mov qword [rsp + 0x40], rax
test rax, rax
je 0x140154cf0
mov rdx, rbx
mov rcx, rax
call fcn.140154740
mov rdi, rax
mov rax, rdi
jmp 0x140154cf7
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1402b6d40
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
Function at 0x140156170
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov r8d, edx
mov r9, rcx
xor r8d, 0xdeadbeef
cmp edx, 4
jl 0x1401561b8
mov r10d, edx
shr r10, 2
mov eax, r10d
neg eax
lea edx, [rdx + rax*4]
imul eax, dword [r9], 0x5bd1e995
imul r8d, r8d, 0x5bd1e995
add r9, 4
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r8d, ecx
dec r10
jne 0x140156191
dec edx
je 0x1401561da
dec edx
je 0x1401561cf
dec edx
jne 0x1401561e8
movzx eax, byte [r9 + 2]
shl eax, 0x10
xor r8d, eax
movzx eax, byte [r9 + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [r9]
xor eax, r8d
imul r8d, eax, 0x5bd1e995
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x1401566c0
Capabilities:
Get volume information via ioctl

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x68], rax
movsd xmm0, qword [0x140345f80]
movsd qword [rsp + 0x58], xmm0
mov eax, dword [0x140345f88]
mov dword [rsp + 0x60], eax
movzx eax, word [0x140345f8c]
mov word [rsp + 0x64], ax
call fcn.1402ba4dc
movzx ebp, ax
mov word [rsp + 0x60], ax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 3]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140156796
lea ecx, [rbx + 0x60]
call fcn.1402b6dbc
mov rdi, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90064
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14015679a
mov rcx, rdi
call fcn.1402150f0
xor eax, eax
jmp 0x1401567ca
call fcn.140156630
mov ecx, 0x128
call fcn.1402b6dbc
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1401567c7
mov r9, rdi
mov r8, rsi
movzx edx, bp
mov rcx, rax
call fcn.140156220
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14015a700
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, vtable.HitmanPro35::RemnantKeyScanThread.0
mov qword [rcx + 8], rdx
mov rbx, rcx
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, 0x10000
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], 0x8000
call fcn.1402b7390
mov ecx, 0x10000
mov qword [rbx + 0x40], rax
call fcn.1402b7390
mov ecx, 0x10000
mov qword [rbx + 0x48], rax
call fcn.1402b7390
mov ecx, 0x10000
mov qword [rbx + 0x50], rax
call fcn.1402b7390
lea r8, [0x14015a850]
mov qword [rbx + 0x58], rax
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14015b5b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
lea rdx, [0x140355ee0]
call fcn.1402bc798
mov rsi, rax
test rax, rax
je 0x14015b6ff
mov r9, rax
mov ebp, 1
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x70]
call fcn.1402bcaa4
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x20]
call fcn.1402bcaa4
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 3]
lea rcx, [rsp + 0x68]
call fcn.1402bcaa4
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x78]
call fcn.1402bcaa4
lea ecx, [rbp + 0x57]
call fcn.1402b6dbc
mov rdi, rax
mov qword [rsp + 0x30], rax
xor ecx, ecx
test rax, rax
je 0x14015b6d1
lea rax, vtable.BloomFilter.0
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
mov qword [rdi + 0x20], rcx
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rcx
mov ecx, 0xa5a5a5a5
mov eax, dword [rsp + 0x68]
test eax, eax
cmovne ecx, eax
mov dword [rdi + 0x48], ecx
movsd xmm0, qword [rsp + 0x78]
movsd qword [rdi + 0x50], xmm0
mov rax, qword [rdi + 0x38]
cmp rax, 0
cmove rax, rbp
mov qword [rdi + 0x38], rax
mov rcx, rdi
call fcn.14015b8f0
mov rcx, rdi
call fcn.14015b710
mov rbx, qword [rdi + 0x30]
shr rbx, 3
mov rcx, rbx
call fcn.1402b7390
mov qword [rdi + 0x20], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1402bfa30
nop
jmp 0x14015b6d4
mov rdi, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rdi + 0x40], rcx
mov r8, qword [rdi + 0x30]
shr r8, 3
mov r9, rsi
mov rdx, rbp
mov rcx, qword [rdi + 0x20]
call fcn.1402bcaa4
mov rcx, rsi
call fcn.1402b8f74
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015cc20
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x6d0
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov rbp, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2a0]
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
lea r8, [0x140345f98]
lea rcx, [rsp + 0x2a0]
mov edx, 0x104
call fcn.1402b9308
lea r8, [rsp + 0x2a0]
lea rcx, [rsp + 0x4b0]
mov edx, 0x104
call fcn.1402b6e28
lea r8, [0x14034c84c]
lea rcx, [rsp + 0x4b0]
mov edx, 0x104
call fcn.1402b9308
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14015cde8
mov qword [rsp + 0x6e8], rbx
mov qword [rsp + 0x6f0], rdi
nop dword [rax]
test byte [rsp + 0x50], 0x10
je 0x14015cdb9
movzx edx, word [rsp + 0x7c]
movzx ecx, word [rsp + 0x7e]
cmp dx, word [0x140345c60]
jne 0x14015cd0b
cmp cx, word [0x140345c62]
je 0x14015cdb9
cmp dx, word [0x14034c85c]
jne 0x14015cd32
cmp cx, word [0x14034c85e]
jne 0x14015cd32
movzx eax, word [rsp + 0x80]
cmp ax, word [0x14034c860]
je 0x14015cdb9
lea rcx, [rsp + 0x7c]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14015cd40
lea rdx, [rsp + 0x2a0]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14015cd56
add eax, 2
add ecx, eax
movsxd rdi, ecx
lea rcx, [rdi + rdi]
call fcn.1402b7390
lea r8, [rsp + 0x2a0]
mov rdx, rdi
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x38], rax
call fcn.1402b6e28
lea r8, [rsp + 0x7c]
mov rdx, rdi
mov rcx, rbx
call fcn.1402b9308
movzx eax, byte [0x14042918e]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov byte [rsp + 0x20], al
call fcn.1400e2a00
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14015cce0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x6f0]
mov rbx, qword [rsp + 0x6e8]
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.1402b6d40
mov rbp, qword [rsp + 0x6f8]
add rsp, 0x6d0
pop rsi
ret
Function at 0x14015f3f0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x140415a10]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [0x14042b278], 0
jne 0x14015f487
lea rcx, str.Cryptdll.dll
call fcn.140147cd0
mov rbx, rax
test rax, rax
je 0x14015f487
lea rdx, str.MD5Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14042b278], rax
lea rdx, str.MD5Update
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14042b288], rax
lea rdx, str.MD5Final
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14042b280], rax
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x14015f4a5
xor al, al
jmp 0x14015f5ed
lea rax, [rsp + 0xd0]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x14015f4b1
mov qword [rsp + 0x38], 0
test ebx, ebx
jne 0x14015f4d6
lea rax, [0x140346ce0]
mov qword [rsp + 0x30], rax
jmp 0x14015f500
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1401fcb40
movsxd r9, ebx
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0xd0]
mov rcx, qword [rsp + 0x30]
call fcn.1402ba94c
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1401fde50
nop
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400f8ca0
mov rcx, rax
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
call fcn.1402d68d8
mov rbx, rax
cmp dword [rsp + 0x38], 0
jle 0x14015f54e
mov rcx, qword [rsp + 0x30]
call fcn.1402b7350
test rbx, rbx
je 0x14015f49e
call fcn.14018b340
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14015f49e
lea rcx, [rsp + 0x60]
call qword [0x14042b278]
mov r8d, 8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call qword [0x14042b288]
lea rcx, [rsp + 0x60]
call qword [0x14042b280]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1401fafa0
mov r8d, 0x7b
mov rcx, rdi
call fcn.1401fdb90
mov edx, dword [rdi + 0xc]
inc edx
mov rcx, rdi
call fcn.1401fcb40
movsxd rdx, dword [rdi + 0xc]
mov rax, qword [rdi]
mov ecx, 0x7d
mov word [rax + rdx*2], cx
mov edx, dword [rdi + 0xc]
inc edx
mov rcx, rdi
call fcn.1401fde50
mov al, 1
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1402b6d40
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret