joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001b14c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov r15, r9
mov rbx, r8
mov rsi, rdx
mov rbp, rcx
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x18001b174
mov rdx, qword [r8]
xor ecx, ecx
movabs r14, 0xcbf29ce484222325
cmp qword [r8 + 0x10], rcx
jbe 0x18001b1a4
movzx eax, byte [rdx + rcx]
xor r14, rax
movabs r8, 0x100000001b3
imul r14, r8
inc rcx
cmp rcx, qword [rbx + 0x10]
jb 0x18001b186
mov r9, r14
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.180003af0
mov rax, qword [rsp + 0x28]
test rax, rax
je 0x18001b1d4
mov rcx, qword [r15]
mov qword [rax + 0x30], rcx
mov qword [rsi], rax
mov byte [rsi + 8], 0
jmp 0x18001b386
movabs rax, 0x492492492492492
cmp qword [rbp + 0x10], rax
je 0x18001b398
lea r12, [rbp + 8]
mov qword [rsp + 0x30], r12
and qword [rsp + 0x38], 0
mov ecx, 0x38
call fcn.1800118ec
mov rdi, rax
mov qword [rsp + 0x38], rax
xorps xmm0, xmm0
movups xmmword [rax + 0x10], xmm0
and qword [rax + 0x20], 0
and qword [rax + 0x28], 0
movups xmm0, xmmword [rbx]
movups xmmword [rax + 0x10], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x20], xmm1
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rax, qword [r15]
mov qword [rdi + 0x30], rax
mov rcx, qword [rbp + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x18001b254
cvtsi2ss xmm0, rcx
jmp 0x18001b269
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rbx, qword [rbp + 0x38]
xorps xmm2, xmm2
test rbx, rbx
js 0x18001b27c
cvtsi2ss xmm2, rbx
jmp 0x18001b294
mov rcx, rbx
shr rcx, 1
mov rax, rbx
and eax, 1
or rcx, rax
cvtsi2ss xmm2, rcx
addss xmm2, xmm2
movaps xmm1, xmm0
divss xmm1, xmm2
comiss xmm1, dword [rbp]
seta al
test al, al
je 0x18001b32f
divss xmm0, dword [rbp]
call sub.ucrtbase.dll_ceilf
xor ecx, ecx
movss xmm1, dword [0x18002c7f8]
comiss xmm0, xmm1
jb 0x18001b2d9
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x18001b2d9
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18001b307
cmp rbx, 0x200
jae 0x18001b304
shl rbx, 3
cmp rbx, rcx
jae 0x18001b307
mov rbx, rcx
mov rdx, rbx
mov rcx, rbp
call fcn.18001b4b4
lea r8, [rdi + 0x10]
mov r9, r14
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.180003af0
movups xmm0, xmmword [rax]
movdqu xmmword [rsp + 0x20], xmm0
mov rdx, qword [rsp + 0x20]
mov r8, qword [rdx + 8]
inc qword [rbp + 0x10]
mov qword [rdi], rdx
mov qword [rdi + 8], r8
mov qword [r8], rdi
mov qword [rdx + 8], rdi
mov rcx, qword [rbp + 0x18]
mov rax, qword [rbp + 0x30]
and rax, r14
add rax, rax
mov r9, qword [rcx + rax*8]
cmp r9, qword [r12]
jne 0x18001b368
mov qword [rcx + rax*8], rdi
jmp 0x18001b37a
cmp r9, rdx
jne 0x18001b373
mov qword [rcx + rax*8], rdi
jmp 0x18001b37f
cmp qword [rcx + rax*8 + 8], r8
jne 0x18001b37f
mov qword [rcx + rax*8 + 8], rdi
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.unordered_map_set_too_long
call fcn.1800231f4
int3
Function at 0x18001b4b4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movabs rax, 0xfffffffffffffff
mov qword [rsp + 0x20], rcx
mov rsi, rcx
bsr rcx, rax
mov eax, 1
shl rax, cl
cmp rdx, rax
ja 0x18001b6d4
mov rbp, qword [rsi + 8]
lea rax, [rdx - 1]
or rax, 1
lea r12, [rsi + 0x18]
bsr rcx, rax
mov ebx, 1
mov r8, rbp
inc ecx
shl rbx, cl
mov rcx, r12
lea rdx, [rbx + rbx]
call fcn.1800039ac
lea rax, [rbx - 1]
mov qword [rsi + 0x38], rbx
mov qword [rsi + 0x30], rax
mov rbx, qword [rsi + 8]
mov rbx, qword [rbx]
mov rdi, rbx
cmp rbx, rbp
je 0x18001b686
mov rdi, qword [rdi]
lea r14, [rbx + 0x10]
mov rax, qword [r14 + 0x18]
mov r8, r14
mov r13, qword [r14 + 0x10]
cmp rax, 0xf
jbe 0x18001b556
mov r8, qword [r14]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r13, r13
je 0x18001b589
movzx eax, byte [r8 + rdx]
movabs r9, 0x100000001b3
xor rcx, rax
inc rdx
imul rcx, r9
cmp rdx, r13
jb 0x18001b567
mov rax, qword [r14 + 0x18]
mov r15, qword [rsi + 0x30]
mov r12, qword [r12]
and r15, rcx
add r15, r15
cmp qword [r12 + r15*8], rbp
jne 0x18001b5ab
mov qword [r12 + r15*8], rbx
mov qword [r12 + r15*8 + 8], rbx
jmp 0x18001b676
mov rsi, qword [r12 + r15*8 + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x18001b5c2
mov rdx, qword [rdx]
mov rcx, r14
cmp rax, 0xf
jbe 0x18001b5ce
mov rcx, qword [r14]
cmp r13, r8
jne 0x18001b646
mov r8, r13
call sub.ucrtbase.dll_memcmp
test eax, eax
jne 0x18001b642
mov r8, qword [rsi]
cmp r8, rbx
je 0x18001b608
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r15*8 + 8], rbx
jmp 0x18001b671
mov rsi, qword [rsi + 8]
lea rdx, [rsi + 0x10]
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x18001b625
mov rdx, qword [rdx]
mov rcx, r14
cmp rax, 0xf
jbe 0x18001b631
mov rcx, qword [r14]
cmp r13, r8
jne 0x18001b646
mov r8, r13
call sub.ucrtbase.dll_memcmp
test eax, eax
je 0x18001b6ae
mov rax, qword [r14 + 0x18]
cmp qword [r12 + r15*8], rsi
jne 0x18001b60f
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rsi
mov rax, qword [rsi + 8]
mov qword [rax], rbx
mov qword [rsi + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
mov qword [r12 + r15*8], rbx
mov rsi, qword [rsp + 0x20]
lea r12, [rsi + 0x18]
mov rbx, rdi
cmp rdi, rbp
jne 0x18001b53b
and qword [rsp + 0x20], 0
lea rcx, [rsp + 0x20]
call fcn.18001b6e4
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rsi]
mov rdx, qword [rbx + 8]
mov qword [rdx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], r8
mov rax, qword [r8 + 8]
mov qword [rax], rbx
mov qword [r8 + 8], rcx
mov qword [rdi + 8], rdx
mov qword [rbx + 8], rax
jmp 0x18001b671
lea rcx, str.invalid_hash_bucket_count
call fcn.1800231f4
int3
Function at 0x18001b7bc
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r15, rdx
mov qword [rsp + 0x20], rcx
mov rbp, r8
mov rdx, rcx
cmp r15, r8
je 0x18001b969
mov rax, qword [rcx + 8]
mov rsi, r15
mov r12, qword [rcx + 0x18]
lea rcx, [r15 + 0x10]
cmp qword [rcx + 0x18], 0xf
mov r14, qword [r15 + 8]
mov r10, qword [rcx + 0x10]
mov qword [rsp + 0x30], rax
jbe 0x18001b815
mov rcx, qword [rcx]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r10, r10
je 0x18001b845
movzx eax, byte [rcx + r8]
inc r8
xor r9, rax
imul r9, r11
cmp r8, r10
jb 0x18001b831
mov r13, qword [rdx + 0x30]
and r13, r9
add r13, r13
mov rax, qword [r12 + r13*8]
mov qword [rsp + 0x28], rax
mov rax, qword [r12 + r13*8 + 8]
mov qword [rsp + 0x38], rax
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.180003d74
mov rcx, qword [0x180039be8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x20]
dec qword [r8 + 0x10]
cmp rbx, qword [rsp + 0x38]
je 0x18001b8af
cmp rsi, rbp
jne 0x18001b862
cmp qword [rsp + 0x28], r15
jne 0x18001b962
mov qword [r12 + r13*8], rsi
jmp 0x18001b962
cmp qword [rsp + 0x28], r15
jne 0x18001b8c4
mov rdx, qword [rsp + 0x30]
mov qword [r12 + r13*8], rdx
mov rax, rdx
jmp 0x18001b8c7
mov rax, r14
mov qword [r12 + r13*8 + 8], rax
jmp 0x18001b998
lea rcx, [rsi + 0x10]
cmp qword [rcx + 0x18], 0xf
mov r10, qword [rcx + 0x10]
jbe 0x18001b8e3
mov rcx, qword [rcx]
xor r9d, r9d
movabs rdx, 0xcbf29ce484222325
test r10, r10
je 0x18001b918
movabs r8, 0x100000001b3
movzx eax, byte [rcx + r9]
inc r9
xor rdx, rax
imul rdx, r8
cmp r9, r10
jb 0x18001b8ff
mov r8, qword [rsp + 0x20]
mov r15, qword [r8 + 0x30]
and r15, rdx
add r15, r15
mov r13, qword [r12 + r15*8 + 8]
mov rbx, rsi
mov rdi, rsi
mov rsi, qword [rsi]
lea rcx, [rbx + 0x10]
call fcn.180003d74
mov rcx, qword [0x180039be8]
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r8, qword [rsp + 0x20]
dec qword [r8 + 0x10]
cmp rbx, r13
je 0x18001b98a
cmp rsi, rbp
jne 0x18001b927
mov qword [r12 + r15*8], rsi
mov qword [r14], rsi
mov qword [rsi + 8], r14
lea r11, [rsp + 0x40]
mov rax, rbp
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rax, qword [rsp + 0x30]
mov qword [r12 + r15*8], rax
mov qword [r12 + r15*8 + 8], rax
cmp rsi, rbp
jne 0x18001b8d1
jmp 0x18001b962
Function at 0x18001cc34
Capabilities:
Check if file exists

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x168]
sub rsp, 0x250
mov rax, qword [0x180036040]
xor rax, rsp
mov qword [rbp + 0x140], rax
xor r15d, r15d
lea rax, [rsp + 0x30]
mov qword [r8], r15
lea rdx, [rsp + 0x30]
sub rcx, rax
mov r14, r8
mov r9d, 0x104
lea rax, [r9 + 0x7ffffefa]
test rax, rax
je 0x18001cca5
movzx eax, word [rcx + rdx]
test ax, ax
je 0x18001cca5
mov word [rdx], ax
add rdx, 2
sub r9, 1
jne 0x18001cc83
test r9, r9
lea rax, [rdx - 2]
lea r8, [0x18002c580]
cmovne rax, rdx
lea rcx, [rsp + 0x30]
mov word [rax], r15w
call fcn.18001ba98
mov ebx, 0x1f0003
lea r8, [rsp + 0x30]
mov ecx, ebx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rdi, rax
test rax, rax
jne 0x18001cd01
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x18001ccf1
mov esi, r15d
jmp 0x18001cd2c
mov rcx, qword [rbp + 0x168]
call fcn.18000a3e4
mov esi, eax
jmp 0x18001cd2c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], r15d
mov rcx, rdi
mov dword [rsp + 0x24], r15d
call fcn.18001cb14
mov esi, eax
test eax, eax
jns 0x18001cd63
mov rcx, qword [rbp + 0x168]
mov edx, eax
call fcn.180003324
test rdi, rdi
jne 0x18001cdef
mov eax, esi
mov rcx, qword [rbp + 0x140]
xor rcx, rsp
call fcn.180023360
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
lea r8, [0x18002c588]
lea rcx, [rsp + 0x30]
call fcn.18001ba98
lea r8, [rsp + 0x30]
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov rbx, rax
test rax, rax
jne 0x18001cd9b
mov rcx, qword [rbp + 0x168]
call fcn.18000a3e4
mov esi, eax
jmp 0x18001cdef
lea rdx, [rsp + 0x24]
mov rcx, rbx
call fcn.18001cb14
mov esi, eax
test eax, eax
jns 0x18001cdcb
mov rcx, qword [rbp + 0x168]
mov edx, eax
call fcn.180003324
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18001ce0e
jmp 0x18001cdef
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18001ce01
movsxd rcx, dword [rsp + 0x24]
mov esi, r15d
movsxd rax, dword [rsp + 0x20]
shl rcx, 0x1f
or rcx, rax
mov qword [r14], rcx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x18001ce1b
jmp 0x18001cd35
mov rcx, qword [rbp + 0x168]
call fcn.18001cb00
int3
mov rcx, qword [rbp + 0x168]
call fcn.18001cb00
int3
mov rcx, qword [rbp + 0x168]
call fcn.18001cb00
int3
Function at 0x18001e5c4
Capabilities:
Check for sandbox and av modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
call qword [sym.imp.dbghelp.dll_SymCleanup]
mov rbx, qword [rdi + 8]
lea rax, str.api_ms_win_core_libraryloader_l1_1_0.dll
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0x28
lea rcx, [0x18002c6c8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movaps xmm0, xmmword [rsp + 0x20]
movdqa xmmword [rsp + 0x20], xmm0
mov r9, rbx
lea r8, [0x18002c688]
lea rdx, [rsp + 0x20]
mov rcx, rax
call fcn.180017fc0
mov qword [rdi + 8], rax
lea rcx, [rdi + 0x50]
call fcn.18000b9d0
add rdi, 0x10
mov rcx, qword [rdi + 0x38]
test rcx, rcx
je 0x18001e653
mov rax, qword [rcx]
cmp rcx, rdi
setne dl
call qword [rax + 0x20]
and qword [rdi + 0x38], 0
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x18001ef20
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x40]
call sub.ucrtbase.dll_memset
nop
mov r8d, 0x30
lea rdx, [rsp + 0x40]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x18001ef6c
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18001f03a
cmp dword [rsp + 0x60], 0x1000
jne 0x18001ef91
mov eax, dword [rsp + 0x64]
and eax, 0xff
cmp eax, 1
je 0x18001ef91
mov eax, dword [rsp + 0x64]
and eax, 0x100
test eax, eax
je 0x18001efa3
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18001f03a
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18001efcb
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18001f03a
mov rax, qword [rsp + 0x28]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18001f000
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18001f03a
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x18001f01c
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18001f03a
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x28]
jmp 0x18001f03a
add rsp, 0x78
ret

Function at 0x18001f1a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18001f3c0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18001f2a7
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18001f204
mov rax, qword [0x180036008]
cmp qword [rsp + 0x20], rax
ja 0x18001f204
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18001f1c6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.ucrtbase.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18001f233
jmp 0x18001f2a7
cmp dword [rsp + 0x50], 0x10000
jne 0x18001f28a
cmp qword [rsp + 0x48], 0x10000
jb 0x18001f28a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18001f278
mov rax, qword [rsp + 0x28]
jmp 0x18001f2a9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18001f2a2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.18001f3c0
mov qword [rsp + 0x20], rax
jmp 0x18001f1c6
xor eax, eax
add rsp, 0x68
ret
Function at 0x18001f2b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18001f400
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18001f3b3
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18001f30b
mov rax, qword [0x180036008]
cmp qword [rsp + 0x20], rax
ja 0x18001f30b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18001f2cd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call sub.ucrtbase.dll_memset
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18001f33a
jmp 0x18001f3b3
cmp dword [rsp + 0x50], 0x10000
jne 0x18001f391
cmp qword [rsp + 0x48], 0x10000
jb 0x18001f391
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18001f37f
mov rax, qword [rsp + 0x28]
jmp 0x18001f3b5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18001f3ae
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18001f400
mov qword [rsp + 0x20], rax
jmp 0x18001f2cd
xor eax, eax
add rsp, 0x68
ret
Function at 0x18001f450
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18001f9e0
mov qword [rsp + 0x28], 0
cmp qword [0x180038f48], 0
jne 0x18001f498
cmp qword [0x180038f40], 0
je 0x18001f498
mov rax, qword [0x180038f40]
mov qword [0x180038f48], rax
cmp qword [0x180038f48], 0
je 0x18001f53e
mov rax, qword [0x180038f48]
cmp qword [rax + 0x10], 0
je 0x18001f53e
mov rax, qword [0x180038f48]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18001f53e
mov rax, qword [0x180038f48]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18001f53e
mov rax, qword [0x180038f48]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x18001f504
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18001f50b
xor eax, eax
jmp 0x18001f6b9
mov rax, qword [0x180038f48]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call sub.ucrtbase.dll_memset
mov rax, qword [rsp + 0x28]
jmp 0x18001f6b9
mov rax, qword [0x180038f40]
mov qword [0x180038f48], rax
jmp 0x18001f560
mov rax, qword [0x180038f48]
mov rax, qword [rax + 8]
mov qword [0x180038f48], rax
cmp qword [0x180038f48], 0
je 0x18001f5ad
cmp qword [0x180038f48], 0
je 0x18001f5ab
mov rax, qword [0x180038f48]
cmp qword [rax + 0x10], 0
je 0x18001f5ab
mov rax, qword [0x180038f48]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18001f5ab
mov rax, qword [0x180038f48]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18001f5ab
jmp 0x18001f4dc
jmp 0x18001f54e
mov rcx, qword [rsp + 0x60]
call fcn.180021890
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.18001f6c0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x18001f6b7
mov rax, qword [rsp + 0x48]
mov qword [0x180038f48], rax
mov rax, qword [0x180038f48]
mov dword [rax], 0x52727464
mov rax, qword [0x180038f48]
mov qword [rax + 0x10], 0
mov rax, qword [0x180038f48]
mov rcx, qword [0x180038f40]
mov qword [rax + 8], rcx
mov rax, qword [0x180038f48]
mov qword [0x180038f40], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x180038f48]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x18001f668
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x18001f6a2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18001f65e
mov rax, qword [0x180038f48]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x18001f4dc
xor eax, eax
add rsp, 0x58
ret
Function at 0x140002cf0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x190]
sub rsp, 0x290
mov rax, qword [0x140044080]
xor rax, rsp
mov qword [rbp + 0x180], rax
mov rbx, rcx
mov r8, rcx
lea rdx, str._s.
lea rcx, [rbp + 0x80]
call fcn.140001160
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rdi, rax
xor esi, esi
movzx edx, byte [rsp + 0x6c]
movzx ecx, byte [rsp + 0x6d]
cmp dl, 0x2e
jne 0x140002d7a
test cl, cl
je 0x140002ec4
cmp dl, dl
jne 0x140002d7a
cmp cl, dl
jne 0x140002d7a
cmp byte [rsp + 0x6e], 0
je 0x140002ec4
test byte [rsp + 0x40], 0x10
je 0x140002e6a
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rsi
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x140002da0
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.140009850
nop
mov r8d, 1
lea rdx, [0x14003d5a4]
lea rcx, [rsp + 0x20]
call fcn.140008070
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002de0
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.140008070
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call fcn.140002cf0
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140002ec4
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140002f0b
call fcn.14000cb90
jmp 0x140002ec4
lea r9, [rsp + 0x6c]
mov r8, rbx
lea rdx, str._s_s
lea rcx, [rbp + 0x80]
call fcn.140001160
test byte [rsp + 0x40], 1
je 0x140002e9d
mov edx, 0x80
lea rcx, [rbp + 0x80]
call fcn.140015f58
lea rcx, [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x140002ec4
mov ecx, dword [rsp + 0x5c]
shl rcx, 0x20
mov eax, dword [rsp + 0x60]
or rcx, rax
add qword [0x140046bd0], rcx
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140002d50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x180]
xor rcx, rsp
call fcn.14000cb70
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
call fcn.1400175e8
int3