joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401db208
Capabilities:
Encode data using xor

Disassembly:
test edx, edx
je 0x1401db391
push rbp
push rbx
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x88]
sub rsp, 0x188
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov r13, qword [rbp + 0xe0]
mov r14, r9
mov r15, r8
mov ebx, edx
mov r12, rcx
cmp edx, 0x20
jge 0x1401db252
mov qword [r8], 0
jmp 0x1401db374
lea r8, [rsp + 0x20]
mov edx, 0x10
mov rcx, r13
mov qword [rsp + 0x180], rsi
mov qword [rsp + 0x178], rdi
call fcn.1401e4a50
mov eax, ebx
cdq
and edx, 0xf
lea edi, [rdx + rax]
sar edi, 4
shl edi, 4
sub edi, 0x10
lea ecx, [rdi + 1]
movsxd rbx, ecx
mov rcx, rbx
call fcn.140218cbc
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rsi, rax
call fcn.1402577d0
movsxd rbx, edi
mov dword [r14], edi
mov rdi, qword [rsp + 0x178]
movups xmm0, xmmword [rbx + r12]
movaps xmmword [rbp + 0x40], xmm0
cmp rbx, 0x10
jl 0x1401db369
nop word [rax + rax]
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x40]
call fcn.1401e31f0
sub rbx, 0x10
movups xmm0, xmmword [rbx + r12]
movaps xmmword [rbp + 0x40], xmm0
jne 0x1401db31e
lea r8, [rsp + 0x20]
mov edx, 0x10
mov rcx, r13
call fcn.1401e43e0
lea r8, [rsp + 0x20]
lea rdx, [rbp + 0x50]
lea rcx, [rbp + 0x40]
call fcn.1401e1ff0
movaps xmm5, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x40], xmm5
xor ecx, ecx
movzx eax, byte [rbp + rcx + 0x40]
add rcx, 4
xor byte [rbp + rcx + 0x2c], al
movzx eax, byte [rbp + rcx + 0x3d]
xor byte [rbp + rcx + 0x2d], al
movzx eax, byte [rbp + rcx + 0x3e]
xor byte [rbp + rcx + 0x2e], al
movzx eax, byte [rbp + rcx + 0x3f]
xor byte [rbp + rcx + 0x2f], al
cmp rcx, 0x10
jl 0x1401db320
mov rax, qword [rbp + 0x30]
mov qword [rbx + rsi], rax
mov rax, qword [rbp + 0x38]
mov qword [rbx + rsi + 8], rax
cmp rbx, 0x10
jge 0x1401db2d0
mov qword [r15], rsi
mov rsi, qword [rsp + 0x180]
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x188
pop r15
pop r14
pop r13
pop r12
pop rbx
pop rbp
repz ret
Function at 0x1401eff10
Capabilities:
Check os version

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x270
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbp, r9
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
mov dword [rcx], 5
xor r12d, r12d
nop word [rax + rax]
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call fcn.1402577d0
mov eax, dword [rdi]
mov r8b, 1
mov edx, 2
xor ecx, ecx
mov dword [rsp + 0x20], 0x11c
mov dword [rsp + 0x24], eax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0x20]
mov r8, rax
mov edx, 2
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1401efffa
mov dword [rbx], r12d
nop word [rax + rax]
lea rcx, [rsp + 0x140]
xor edx, edx
mov r8d, 0x11c
call fcn.1402577d0
mov eax, dword [rbx]
mov r8b, 1
mov edx, 1
xor ecx, ecx
mov dword [rsp + 0x140], 0x11c
mov dword [rsp + 0x148], eax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0x140]
mov r8, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
jne 0x1401f0025
inc dword [rbx]
cmp dword [rbx], 5
jb 0x1401effa0
inc dword [rdi]
cmp dword [rdi], 0x14
jb 0x1401eff50
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x270
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, [rsp + 0x140]
xor edx, edx
mov r8d, 0x11c
call fcn.1402577d0
mov r8b, 1
mov edx, 0x80
xor ecx, ecx
mov dword [rsp + 0x140], 0x11c
mov byte [rsp + 0x25a], 1
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0x140]
mov edx, 0x80
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1401f007b
mov al, 1
jmp 0x1401f00d5
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x11c
call fcn.1402577d0
mov r8b, 1
mov edx, 0x80
xor ecx, ecx
mov dword [rsp + 0x20], 0x11c
mov byte [rsp + 0x13a], 3
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
lea rcx, [rsp + 0x20]
mov edx, 0x80
mov r8, rax
call qword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
test eax, eax
je 0x1401f00c8
mov al, 3
jmp 0x1401f00d5
mov cl, 2
call fcn.1401efe10
neg eax
sbb al, al
and al, 2
movzx eax, al
mov dword [rsi], eax
call fcn.1401a80b0
mov word [rbp], ax
mov al, 1
jmp 0x1401f0007

Function at 0x1401f25b0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rbx]
or edx, 0xffffffff
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
Function at 0x1401f25e0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
sub rsp, 0x40
mov rbp, r8
mov r8, rdx
movzx edx, cx
mov rcx, r9
mov rbx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1401f261c
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov rdx, rax
mov rcx, rbx
mov qword [rsp + 0x58], rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbx
mov esi, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x1401f2683
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, qword [rbp]
mov qword [rsp + 0x30], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x28], 0x80
mov rdi, rax
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1401f2687
xor al, al
jmp 0x1401f26b7
lea r9, [rsp + 0x50]
mov r8d, esi
mov rdx, rdi
mov rcx, rax
mov dword [rsp + 0x50], 0
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rsi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret

Function at 0x1401f2720
Capabilities:
Check if file exists

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
mov rcx, qword [rcx + 8]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x1401f2850
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x68]
call fcn.140001eb0
mov qword [rsp + 0x60], 0
lea r8, [rsp + 0x60]
lea rdx, [0x1401f2580]
mov ecx, 6
call qword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
mov r9, qword [rsp + 0x60]
lea r8, [rsp + 0x68]
lea rdx, [0x14034bd80]
mov ecx, 0x2722
call fcn.1401f25e0
test al, al
sete dil
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401f27b7
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x1401f2850
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
mov r8, qword [rbx + 8]
lea rdx, str.7za.exe:_ExctractResourceIntoFile_failed._r_n_path____s_r_nlast_error____d
lea rcx, [rsp + 0x58]
call fcn.14001bdb0
mov dword [rsp + 0x50], 0
call fcn.1401f0280
mov rbx, rax
lea rcx, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 8]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
mov rcx, qword [rcx]
call fcn.1401a7260
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x1401f2850
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
add rsp, 0x30
pop rdi
pop rsi
pop rbx
ret
Function at 0x1401fc420
Capabilities:
Get file version info

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
sub rsp, 0x80
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov r12, rdx
mov rdi, rcx
mov dword [rsp + 0xb0], 0
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x30], rbx
lea rdx, [rsp + 0xb0]
mov rcx, qword [r12]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
jne 0x1401fc496
lea rcx, [rbx - 0x18]
call fcn.1400026b0
add rax, 0x18
mov qword [rdi], rax
jmp 0x1401fc574
mov rcx, rbp
call fcn.140218cbc
mov rsi, rax
mov r9, rax
mov r8d, ebp
xor edx, edx
mov rcx, qword [r12]
call sub.VERSION.dll_GetFileVersionInfoW
mov rcx, rsi
test eax, eax
jne 0x1401fc4d3
call fcn.1402512b0
lea rcx, [rbx - 0x18]
call fcn.1400026b0
add rax, 0x18
mov qword [rdi], rax
jmp 0x1401fc574
lea r9, [rsp + 0xb8]
lea r8, [rsp + 0x38]
lea rdx, [0x14033ff78]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1401fc50a
mov rcx, rsi
call fcn.1402512b0
lea rcx, [rbx - 0x18]
call fcn.1400026b0
add rax, 0x18
mov qword [rdi], rax
jmp 0x1401fc574
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x34
call fcn.140250b70
mov r11, qword [rsp + 0x50]
mov r8d, r11d
shr r8d, 0x10
mov rax, r11
shr rax, 0x20
mov ecx, eax
shr ecx, 0x10
movzx eax, ax
movzx r9d, r11w
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
lea rdx, [0x14033ff60]
lea rcx, [rsp + 0x30]
call fcn.14001bdb0
mov rcx, rsi
call fcn.1402512b0
mov rbx, qword [rsp + 0x30]
lea rcx, [rbx - 0x18]
call fcn.1400026b0
add rax, 0x18
mov qword [rdi], rax
or eax, 0xffffffff
lock xadd dword [rbx - 8], eax
dec eax
test eax, eax
jg 0x1401fc590
mov rcx, qword [rbx - 0x18]
mov rax, qword [rcx]
lea rdx, [rbx - 0x18]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, rdi
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret
Function at 0x1401fcd60
Capabilities:
Copy file
Delete file
Move file

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x80
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rcx, qword [rcx]
sub rcx, 0x18
call fcn.1400026b0
add rax, 0x18
mov qword [rsp + 0x90], rax
lea r8, [0x14033ff78]
lea rdx, [0x14034b2e8]
lea rcx, [rsp + 0x90]
call fcn.1400b93d0
lea r8, [0x14033ff78]
lea rdx, [0x14034cf70]
lea rcx, [rsp + 0x90]
call fcn.1400b93d0
lea r8, [0x14033ff78]
lea rdx, [0x140344610]
lea rcx, [rsp + 0x90]
call fcn.1400b93d0
mov rbx, qword [rsp + 0x90]
mov eax, dword [rbx - 0x10]
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
add eax, 2
movsxd rdx, eax
lea rcx, [rsp + 0x28]
call fcn.140006270
movsxd rax, dword [rbx - 0x10]
lea r8, [rbx + rax*2]
sub r8, rbx
sar r8, 1
add r8, r8
mov rdx, rbx
mov rdi, qword [rsp + 0x28]
mov rcx, rdi
call fcn.140250b70
mov qword [rsp + 0x48], rsi
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov dword [rsp + 0x50], 3
mov eax, 0x614
mov word [rsp + 0x68], ax
mov qword [rsp + 0x58], rdi
lea rcx, [rsp + 0x48]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete sil
test rdi, rdi
je 0x1401fce8d
mov rcx, rdi
call fcn.140250354
nop
lea rdx, [rbx - 0x18]
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1401fcea9
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, sil
jmp 0x1401fceb1
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x1401fced0
Capabilities:
Copy file
Move file

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0xa0
mov qword [rsp + 0x98], 0xfffffffffffffffe
mov qword [rsp + 0xc0], rbx
mov rbx, rcx
mov rcx, qword [rdx]
sub rcx, 0x18
call fcn.1400026b0
add rax, 0x18
mov qword [rsp + 0xc8], rax
mov rcx, qword [rbx]
sub rcx, 0x18
call fcn.1400026b0
add rax, 0x18
mov qword [rsp + 0xd0], rax
lea r8, [0x14033ff78]
lea rdx, [0x14034b2e8]
lea rcx, [rsp + 0xc8]
call fcn.1400b93d0
lea r8, [0x14033ff78]
lea rdx, [0x14034b2e8]
lea rcx, [rsp + 0xd0]
call fcn.1400b93d0
lea r8, [0x14033ff78]
lea rdx, [0x14034cf70]
lea rcx, [rsp + 0xc8]
call fcn.1400b93d0
lea r8, [0x14033ff78]
lea rdx, [0x14034cf70]
lea rcx, [rsp + 0xd0]
call fcn.1400b93d0
lea r8, [0x14033ff78]
lea rdx, [0x140344610]
lea rcx, [rsp + 0xc8]
call fcn.1400b93d0
lea r8, [0x14033ff78]
lea rdx, [0x140344610]
lea rcx, [rsp + 0xd0]
call fcn.1400b93d0
xor esi, esi
mov qword [rsp + 0x20], rsi
xor eax, eax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x28], 2
mov rbx, qword [rsp + 0xc8]
mov eax, dword [rbx - 0x10]
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
add eax, 2
movsxd rdx, eax
lea rcx, [rsp + 0x58]
call fcn.140006270
nop
movsxd rax, dword [rbx - 0x10]
lea r8, [rbx + rax*2]
sub r8, rbx
sar r8, 1
add r8, r8
mov rdx, rbx
mov rdi, qword [rsp + 0x58]
mov rcx, rdi
call fcn.140250b70
mov qword [rsp + 0x38], rdi
mov rbx, qword [rsp + 0xd0]
mov eax, dword [rbx - 0x10]
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rsi
add eax, 2
movsxd rdx, eax
lea rcx, [rsp + 0x78]
call fcn.140006270
movsxd rax, dword [rbx - 0x10]
lea r8, [rbx + rax*2]
sub r8, rbx
sar r8, 1
add r8, r8
mov rdx, rbx
mov rsi, qword [rsp + 0x78]
mov rcx, rsi
call fcn.140250b70
mov qword [rsp + 0x30], rsi
mov eax, 0x414
mov word [rsp + 0x40], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete r12b
test rsi, rsi
je 0x1401fd0c4
mov rcx, rsi
call fcn.140250354
nop
test rdi, rdi
je 0x1401fd0d2
mov rcx, rdi
call fcn.140250354
nop
lea rdx, [rbx - 0x18]
or ebx, 0xffffffff
mov eax, ebx
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fd0f0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rax, qword [rsp + 0xc8]
lea rdx, [rax - 0x18]
lock xadd dword [rdx + 0x10], ebx
dec ebx
test ebx, ebx
jg 0x1401fd111
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, r12b
jmp 0x1401fd119
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop r12
pop rdi
pop rsi
ret
Function at 0x1401fd1d0
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push rdi
push r12
sub rsp, 0x50
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], rbp
mov rbp, r9
mov rdi, r8
lea r8, [rsp + 0x38]
mov rdx, qword [rdx]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x1401fd2a3
xor ecx, ecx
mov dword [rsp + 0x78], ecx
mov dword [rsp + 0x30], 7
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1401fd298
mov ecx, dword [rsp + 0x78]
shr rcx, 1
mov eax, 2
mul rcx
mov r12, 0xffffffffffffffff
cmovo rax, r12
mov rcx, rax
call fcn.140218cbc
mov rsi, rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x30]
xor r8d, r8d
mov rdx, qword [rdi]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401fd2aa
mov rcx, rsi
call fcn.1402512b0
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x1401fd370
mov rbx, rsi
cmp word [rsi], 0
je 0x1401fd366
nop word [rax + rax]
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x40], rax
test rbx, 0xffffffffffff0000
jne 0x1401fd306
movzx edi, bx
xor edx, edx
mov ecx, edi
call fcn.140001440
test rax, rax
je 0x1401fd326
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140002960
jmp 0x1401fd326
xor eax, eax
mov rcx, r12
mov rdi, rbx
repne scasw ax, word [rdi]
not rcx
lea r8d, [rcx - 1]
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.140002560
nop
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.1401b8d00
mov rdx, qword [rsp + 0x40]
movsxd rax, dword [rdx - 0x10]
lea rbx, [rbx + rax*2 + 2]
add rdx, 0xffffffffffffffe8
mov eax, r12d
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fd35c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
cmp word [rbx], 0
jne 0x1401fd2c0
mov rcx, rsi
call fcn.1402512b0
mov al, 1
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rsi
ret
Function at 0x1401fd6e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x2b8
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rsp + 0x2a0], rax
movzx esi, r9b
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x38], rdx
mov rbp, rcx
call fcn.1401fd390
movzx edi, al
test al, al
je 0x1401fd730
test sil, sil
je 0x1401fd730
mov al, 1
jmp 0x1401fd84a
lea r8, [0x140341014]
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.14001db30
lea rdx, [rsp + 0x50]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or ecx, 0xffffffff
lock xadd dword [rdx + 0x10], ecx
dec ecx
test ecx, ecx
jg 0x1401fd776
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
cmp rbx, 0xffffffffffffffff
je 0x1401fd827
cmp word [rsp + 0x7c], 0x2e
je 0x1401fd827
test byte [rsp + 0x50], 0x10
je 0x1401fd827
lea r8, [0x14033ff78]
mov rdx, rbp
lea rcx, [rsp + 0x30]
call fcn.14001db30
nop
lea r8, [rsp + 0x7c]
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.14001db30
nop
movzx r9d, sil
mov r8, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x38]
mov rcx, rax
call fcn.1401fd6e0
movzx edi, al
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fd7f9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x1401fd819
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
test dil, dil
je 0x1401fd827
test sil, sil
jne 0x1401fd729
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1401fd776
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
movzx eax, dil
mov rcx, qword [rsp + 0x2a0]
xor rcx, rsp
call fcn.140250fd0
add rsp, 0x2b8
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401fda90
Capabilities:
Create directory

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x100
mov qword [rbp - 0x49], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x140437340]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rdx, qword [rcx]
mov qword [rbp + 0x37], 7
xor esi, esi
mov qword [rbp + 0x2f], rsi
mov word [rbp + 0x1f], si
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rcx, [rbp + 0x1f]
call fcn.140034070
nop
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rsi
mov qword [rbp - 0x79], rsi
lea rdx, [0x14034d070]
lea rcx, [rbp - 0x41]
call fcn.1401fd130
mov rdi, rax
mov qword [rbp - 0x51], rax
mov r8, qword [rax + 0x10]
mov qword [rbp - 0x59], r8
mov qword [rbp - 0x69], rsi
cmp r8, 0x10
ja 0x1401fdb33
lea rax, [rbp - 0x69]
mov rdx, rdi
jmp 0x1401fdb46
mov rcx, r8
call fcn.140218cbc
mov qword [rbp - 0x69], rax
mov rdx, qword [rdi]
mov r8, qword [rbp - 0x59]
mov rcx, rax
call fcn.140250b70
mov r8d, 1
lea rdx, [rbp - 0x69]
lea rcx, [rbp - 0x29]
call fcn.1401ec6a0
mov r8, rax
lea rdx, [rbp + 0x1f]
lea rcx, [rsp + 0x20]
call fcn.1401ee910
nop
cmp qword [rdi + 0x10], 0x10
jbe 0x1401fdb87
mov rcx, qword [rdi]
test rcx, rcx
je 0x1401fdb87
call fcn.1402512b0
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov eax, 7
mov qword [rbp + 0xf], rax
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
cmp rdi, rbx
je 0x1401fdc06
nop word [rax + rax]
or r9, 0xffffffffffffffff
xor r8d, r8d
mov rdx, rdi
lea rcx, [rbp - 9]
call fcn.14008ad60
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 8
cmovae rcx, qword [rbp - 9]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov r8d, 1
lea rdx, [0x14033ff78]
lea rcx, [rbp - 9]
call fcn.1401fbcf0
add rdi, 0x28
cmp rdi, rbx
jne 0x1401fdbb0
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov rax, qword [rbp + 0xf]
cmp rax, 8
jb 0x1401fdc1f
mov rcx, qword [rbp - 9]
call fcn.140250354
mov rbx, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
mov qword [rbp + 0xf], 7
mov qword [rbp + 7], rsi
mov word [rbp - 9], si
test rdi, rdi
je 0x1401fdc74
cmp rdi, rbx
je 0x1401fdc6c
nop dword [rax]
cmp qword [rdi + 0x18], 8
jb 0x1401fdc4f
mov rcx, qword [rdi]
call fcn.140250354
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
add rdi, 0x28
cmp rdi, rbx
jne 0x1401fdc40
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call fcn.140250354
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rsi
mov qword [rbp - 0x79], rsi
cmp qword [rbp + 0x37], 8
jb 0x1401fdc92
mov rcx, qword [rbp + 0x1f]
call fcn.140250354
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140250fd0
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140200b10
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x40
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rbx, rdx
mov rbp, rcx
cmp rdx, r8
je 0x140200cf3
xor r12d, r12d
mov rsi, qword [rbx + 0x10]
lea rcx, [0x14042f270]
mov rax, qword [0x14042f270]
call qword [rax + 0x18]
lea rdi, [rax + 0x18]
mov qword [rsp + 0x20], rdi
test rsi, rsi
je 0x140200ba7
test rsi, 0xffffffffffff0000
jne 0x140200b93
movzx esi, si
xor edx, edx
mov ecx, esi
call fcn.140001440
test rax, rax
je 0x140200bbf
mov r8d, esi
mov rdx, rax
lea rcx, [rsp + 0x20]
call fcn.140002960
jmp 0x140200bba
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rsi
repne scasw ax, word [rdi]
not rcx
dec rcx
jmp 0x140200baa
mov ecx, r12d
mov r8d, ecx
mov rdx, rsi
lea rcx, [rsp + 0x20]
call fcn.140002560
mov rdi, qword [rsp + 0x20]
mov edx, dword [rdi - 0x10]
test edx, edx
js 0x140200ce8
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
sub eax, edx
or ecx, eax
jge 0x140200bea
lea rcx, [rsp + 0x20]
call fcn.140002650
mov rdi, qword [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_PathStripPathW]
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call fcn.140251840
test eax, eax
js 0x140200cdd
cmp eax, dword [rdi - 0xc]
jg 0x140200cdd
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r12w
lea r8, [0x14033ff78]
mov rdx, qword [rsp + 0x88]
lea rcx, [rsp + 0x30]
call fcn.14001db30
nop
lea r8, [rsp + 0x20]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.14000f920
xor r8d, r8d
mov rdx, qword [rax]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140200c77
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x30]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140200c98
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0x20]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x140200cb8
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rbx, qword [rsp + 0x78]
mov rbx, qword [rbx]
mov qword [rsp + 0x78], rbx
cmp rbx, qword [rsp + 0x80]
jne 0x140200b44
mov r9, qword [rsp + 0x88]
jmp 0x140200cf3
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
nop
mov qword [rbp], r9
mov rax, rbp
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret