joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140150e40
Capabilities:
Capture screenshot
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push r14
sub rsp, 0xa0
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp qword [rcx + 0xa0], 0
mov r14, rcx
je 0x140151076
mov rax, qword [rcx]
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r15
call qword [rax]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rdx, qword [r14]
mov rcx, r14
call qword [rdx]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [rsp + 0x74]
mov r13d, dword [rsp + 0x70]
sub ebx, dword [rsp + 0x6c]
sub r13d, dword [rsp + 0x68]
mov rcx, rdi
mov dword [rsp + 0x50], ebx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, ebx
mov edx, r13d
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, rbp
mov rdx, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [r14 + 0xa0]
xor edi, edi
mov r15d, dword [rcx + 0x10]
mov sil, 1
sub r15d, r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [r14 + 0xb8]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140151032
mov qword [rsp + 0x90], r12
lea r12d, [r13 - 8]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [r14 + 0xa8]
lea rdx, [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, qword [r14 + 0xa0]
mov r9d, 8
mov eax, dword [rcx + 0x14]
mov r8d, r9d
mov rdx, rbp
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x20], edi
call fcn.14014a7c0
mov rcx, qword [rsp + 0x58]
xor eax, eax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x50]
mov r9d, r13d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
test sil, sil
je 0x140150fd0
inc edi
cmp edi, r15d
jne 0x140150fde
xor sil, sil
jmp 0x140150fde
dec edi
movzx esi, sil
mov eax, 1
cmove esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xa
jae 0x14015100b
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xa
jb 0x140150ff1
lea r12d, [r13 - 8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [r14 + 0xb8]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140150f50
mov r12, qword [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1402bcad0
add rsp, 0xa0
pop r14
ret
Function at 0x1401525d0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x20
mov rdx, qword [rcx + 0x30]
lea rax, vtable.RegKeyMonitor.0
mov rbx, rcx
mov qword [rcx], rax
mov rcx, qword [rcx + 0x28]
xor r9d, r9d
mov r8d, 0x2710
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x14015260d
mov rcx, qword [rbx + 0x30]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rbx + 0x20]
add rsp, 0x20
pop rbx
jmp fcn.1402bd0e0

Function at 0x140152650
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rsi, rax
test rax, rax
jne 0x14015268b
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
mov qword [rsp + 0x48], rbp
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbp, rax
test rax, rax
jne 0x1401526ce
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x48]
xor eax, eax
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x40
mov qword [rsp + 0x40], rbx
call fcn.1402bcb4c
mov rbx, rax
test rax, rax
je 0x14015274f
lea rax, vtable.RegKeyMonitor.0
lea rcx, str.ScanAndClean
mov qword [rbx + 0x10], rsi
mov qword [rbx], rax
mov rax, qword [rdi]
mov qword [rbx + 0x18], rbp
mov qword [rbx + 8], rax
call fcn.1402bfd80
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r8, [0x140152770]
mov qword [rbx + 0x28], rax
lea rax, [rbx + 0x38]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x30], rax
jmp 0x140152751
xor ebx, ebx
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x140152780
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rsi
sub rsp, 0x48
mov r9, qword [rcx + 0x10]
mov edx, 1
mov rbx, rcx
mov rcx, qword [rcx + 8]
lea r8d, [rdx + 3]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
test eax, eax
je 0x1401527c2
mov r8, qword [rbx + 0x20]
lea rdx, str.Started_monitoring__ls...
mov ecx, 1
call fcn.140172980
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
xor esi, esi
xor r8d, r8d
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x60], esi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x140152808
xor dil, dil
jmp 0x140152834
cmp dword [rsp + 0x60], esi
setne dil
test dil, dil
je 0x140152834
mov r8, qword [rbx + 0x20]
lea rdx, str.State__ls_is_set__initial_
mov ecx, 1
call fcn.140172980
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rax, qword [rbx + 0x28]
mov qword [rsp + 0x30], rax
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x38], rax
nop word [rax + rax]
xor r8d, r8d
lea rdx, [rsp + 0x30]
or r9d, 0xffffffff
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
test eax, eax
je 0x140152916
cmp eax, 1
jne 0x140152850
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rbx + 8]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x60]
lea r9, [rsp + 0x70]
xor r8d, r8d
mov dword [rsp + 0x60], esi
mov dword [rsp + 0x68], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x1401528b1
xor al, al
jmp 0x1401528b8
cmp dword [rsp + 0x60], esi
setne al
cmp al, dil
je 0x1401528f2
mov rcx, qword [rbx + 0x18]
movzx edi, al
test al, al
je 0x1401528d7
call qword [sym.imp.KERNEL32.dll_SetEvent]
lea rdx, str.State__ls_is_set
jmp 0x1401528e4
call qword [sym.imp.KERNEL32.dll_ResetEvent]
lea rdx, str.State__ls_is_reset
mov r8, qword [rbx + 0x20]
mov ecx, 1
call fcn.140172980
mov r9, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
mov edx, 1
lea r8d, [rdx + 3]
mov dword [rsp + 0x20], 1
call qword [sym.imp.ADVAPI32.dll_RegNotifyChangeKeyValue]
jmp 0x140152850
mov r8, qword [rbx + 0x20]
lea rdx, str.Stopped_monitoring__ls
mov ecx, 1
call fcn.140172980
mov rdi, qword [rsp + 0x40]
add rsp, 0x48
pop rsi
pop rbx
ret
Function at 0x1401578f0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0xe0], rax
movzx ebx, cx
movabs rax, 0x5c003a003f
mov qword [rsp + 0x50], rax
mov word [rsp + 0x50], cx
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1401579e5
lea rdx, [0x14035a910]
lea rcx, [rsp + 0x60]
call fcn.1402bcf6c
movzx ecx, bx
test eax, eax
jne 0x14015798a
call fcn.1401593b0
mov rbx, rax
jmp 0x1401579b9
call fcn.1402c026c
movzx ebx, ax
mov ecx, 0x2a0
call fcn.1402bcb4c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401579b6
movzx edx, bx
mov rcx, rax
call fcn.140158a90
mov rbx, rax
jmp 0x1401579b9
mov rbx, rdi
test rbx, rbx
je 0x1401579e5
mov ecx, pe_nt_image_headers64
call fcn.1402bcb4c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401579e0
mov rdx, rbx
mov rcx, rax
call fcn.140157430
mov rdi, rax
mov rax, rdi
jmp 0x1401579e7
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
Function at 0x140158e60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov r8d, edx
mov r9, rcx
xor r8d, 0xdeadbeef
cmp edx, 4
jl 0x140158ea8
mov r10d, edx
shr r10, 2
mov eax, r10d
neg eax
lea edx, [rdx + rax*4]
imul eax, dword [r9], 0x5bd1e995
imul r8d, r8d, 0x5bd1e995
add r9, 4
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r8d, ecx
dec r10
jne 0x140158e81
dec edx
je 0x140158eca
dec edx
je 0x140158ebf
dec edx
jne 0x140158ed8
movzx eax, byte [r9 + 2]
shl eax, 0x10
xor r8d, eax
movzx eax, byte [r9 + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [r9]
xor eax, r8d
imul r8d, eax, 0x5bd1e995
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x1401593b0
Capabilities:
Get volume information via ioctl

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x68], rax
movsd xmm0, qword [0x14034c070]
movsd qword [rsp + 0x58], xmm0
mov eax, dword [0x14034c078]
mov dword [rsp + 0x60], eax
movzx eax, word [0x14034c07c]
mov word [rsp + 0x64], ax
call fcn.1402c026c
movzx ebp, ax
mov word [rsp + 0x60], ax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 3]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140159486
lea ecx, [rbx + 0x60]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90064
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14015948a
mov rcx, rdi
call fcn.14021ae20
xor eax, eax
jmp 0x1401594ba
call fcn.140159320
mov ecx, 0x128
call fcn.1402bcb4c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x1401594b7
mov r9, rdi
mov r8, rsi
movzx edx, bp
mov rcx, rax
call fcn.140158f10
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14015d3e0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, vtable.HitmanPro35::RemnantKeyScanThread.0
mov qword [rcx + 8], rdx
mov rbx, rcx
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, 0x10000
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], 0x8000
call fcn.1402bd120
mov ecx, 0x10000
mov qword [rbx + 0x40], rax
call fcn.1402bd120
mov ecx, 0x10000
mov qword [rbx + 0x48], rax
call fcn.1402bd120
mov ecx, 0x10000
mov qword [rbx + 0x50], rax
call fcn.1402bd120
lea r8, [0x14015d530]
mov qword [rbx + 0x58], rax
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14015e290
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
lea rdx, [0x14035c140]
call fcn.1402c24c8
mov rsi, rax
test rax, rax
je 0x14015e3df
mov r9, rax
mov ebp, 1
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x70]
call fcn.1402c27d4
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x20]
call fcn.1402c27d4
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 3]
lea rcx, [rsp + 0x68]
call fcn.1402c27d4
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x78]
call fcn.1402c27d4
lea ecx, [rbp + 0x57]
call fcn.1402bcb4c
mov rdi, rax
mov qword [rsp + 0x30], rax
xor ecx, ecx
test rax, rax
je 0x14015e3b1
lea rax, vtable.BloomFilter.0
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
mov qword [rdi + 0x20], rcx
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rcx
mov ecx, 0xa5a5a5a5
mov eax, dword [rsp + 0x68]
test eax, eax
cmovne ecx, eax
mov dword [rdi + 0x48], ecx
movsd xmm0, qword [rsp + 0x78]
movsd qword [rdi + 0x50], xmm0
mov rax, qword [rdi + 0x38]
cmp rax, 0
cmove rax, rbp
mov qword [rdi + 0x38], rax
mov rcx, rdi
call fcn.14015e5d0
mov rcx, rdi
call fcn.14015e3f0
mov rbx, qword [rdi + 0x30]
shr rbx, 3
mov rcx, rbx
call fcn.1402bd120
mov qword [rdi + 0x20], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1402c5760
nop
jmp 0x14015e3b4
mov rdi, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rdi + 0x40], rcx
mov r8, qword [rdi + 0x30]
shr r8, 3
mov r9, rsi
mov rdx, rbp
mov rcx, qword [rdi + 0x20]
call fcn.1402c27d4
mov rcx, rsi
call fcn.1402bed04
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x14015f900
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x6d0
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov rbp, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2a0]
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
lea r8, [0x14034c088]
lea rcx, [rsp + 0x2a0]
mov edx, 0x104
call fcn.1402bf098
lea r8, [rsp + 0x2a0]
lea rcx, [rsp + 0x4b0]
mov edx, 0x104
call fcn.1402bcbb8
lea r8, [0x1403526ec]
lea rcx, [rsp + 0x4b0]
mov edx, 0x104
call fcn.1402bf098
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14015fac8
mov qword [rsp + 0x6e8], rbx
mov qword [rsp + 0x6f0], rdi
nop dword [rax]
test byte [rsp + 0x50], 0x10
je 0x14015fa99
movzx edx, word [rsp + 0x7c]
movzx ecx, word [rsp + 0x7e]
cmp dx, word [0x14034bd50]
jne 0x14015f9eb
cmp cx, word [0x14034bd52]
je 0x14015fa99
cmp dx, word [0x1403526fc]
jne 0x14015fa12
cmp cx, word [0x1403526fe]
jne 0x14015fa12
movzx eax, word [rsp + 0x80]
cmp ax, word [0x140352700]
je 0x14015fa99
lea rcx, [rsp + 0x7c]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x14015fa20
lea rdx, [rsp + 0x2a0]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x14015fa36
add eax, 2
add ecx, eax
movsxd rdi, ecx
lea rcx, [rdi + rdi]
call fcn.1402bd120
lea r8, [rsp + 0x2a0]
mov rdx, rdi
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x38], rax
call fcn.1402bcbb8
lea r8, [rsp + 0x7c]
mov rdx, rdi
mov rcx, rbx
call fcn.1402bf098
movzx eax, byte [0x14043124e]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov byte [rsp + 0x20], al
call fcn.1400e3ef0
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14015f9c0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x6f0]
mov rbx, qword [rsp + 0x6e8]
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.1402bcad0
mov rbp, qword [rsp + 0x6f8]
add rsp, 0x6d0
pop rsi
ret
Function at 0x1401620d0
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [0x140433350], 0
jne 0x140162167
lea rcx, str.Cryptdll.dll
call fcn.14014a9e0
mov rbx, rax
test rax, rax
je 0x140162167
lea rdx, str.MD5Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140433350], rax
lea rdx, str.MD5Update
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140433348], rax
lea rdx, str.MD5Final
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140433358], rax
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140162185
xor al, al
jmp 0x1401622cd
lea rax, [rsp + 0xd0]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140162191
mov qword [rsp + 0x38], 0
test ebx, ebx
jne 0x1401621b6
lea rax, [0x14034d1a0]
mov qword [rsp + 0x30], rax
jmp 0x1401621e0
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1402028a0
movsxd r9, ebx
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0xd0]
mov rcx, qword [rsp + 0x30]
call fcn.1402c06dc
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.140203bb0
nop
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400fb230
mov rcx, rax
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
call fcn.1402dc608
mov rbx, rax
cmp dword [rsp + 0x38], 0
jle 0x14016222e
mov rcx, qword [rsp + 0x30]
call fcn.1402bd0e0
test rbx, rbx
je 0x14016217e
call fcn.14018e370
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14016217e
lea rcx, [rsp + 0x60]
call qword [0x140433350]
mov r8d, 8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call qword [0x140433348]
lea rcx, [rsp + 0x60]
call qword [0x140433358]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.140200d00
mov r8d, 0x7b
mov rcx, rdi
call fcn.1402038f0
mov edx, dword [rdi + 0xc]
inc edx
mov rcx, rdi
call fcn.1402028a0
movsxd rdx, dword [rdi + 0xc]
mov rax, qword [rdi]
mov ecx, 0x7d
mov word [rax + rdx*2], cx
mov edx, dword [rdi + 0xc]
inc edx
mov rcx, rdi
call fcn.140203bb0
mov al, 1
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.1402bcad0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1401674a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
push rsi
push rdi
mov rbp, rsp
sub rsp, 0x80
mov qword [rbp - 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xb0], rbx
mov rax, qword [0x14041da10]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
lea rax, vtable.Core::ByteArray.0
mov qword [rbp - 0x50], rax
xor esi, esi
mov dword [rbp - 0x48], esi
mov qword [rbp - 0x40], rsi
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov qword [rbp - 0x38], rax
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.14020c740
mov r11, qword [rbp - 0x40]
test al, al
je 0x140167611
mov eax, dword [rbp - 0x48]
cmp eax, 0x4000
jl 0x140167611
mov r10, r11
mov ecx, 0x5a4d
cmp word [r11], cx
jne 0x140167611
mov dword [rbp - 0x28], 0x6972645c
mov dword [rbp - 0x24], 0x73726576
mov dword [rbp - 0x20], 0x6374655c
mov dword [rbp - 0x1c], 0x736f685c
mov word [rbp - 0x18], 0x7374
mov byte [rbp - 0x16], sil
mov r9d, 0x1000
lea ebx, [rax - 0x400]
cmp ebx, r9d
jle 0x14016759e
nop
mov r8, r10
mov eax, esi
lea rdx, [rbp - 0x28]
nop dword [rax]
movzx ecx, byte [r8]
lea r8, [r8 + 1]
cmp cl, byte [rdx]
jne 0x140167593
cmp eax, 0x12
je 0x140167611
inc eax
inc rdx
movsxd rcx, eax
cmp rcx, 0x13
jb 0x140167570
inc r10
inc r9d
cmp r9d, ebx
jl 0x140167560
lea rax, [0x14034d1a0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rsi
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x50]
call fcn.140167650
mov rcx, rdi
test al, al
je 0x1401675ee
mov edx, dword [rbp - 0x54]
call fcn.1402028a0
movsxd r9, dword [rbp - 0x54]
mov eax, dword [rdi + 8]
inc eax
movsxd rdx, eax
mov r8, qword [rbp - 0x60]
mov rcx, qword [rdi]
call fcn.1402c06dc
mov edx, dword [rbp - 0x54]
mov rcx, rdi
call fcn.140203bb0
jmp 0x1401675fa
mov rdx, qword [0x14041eee8]
call fcn.140200d00
mov bl, 1
cmp dword [rbp - 0x58], 0
jle 0x14016760b
mov rcx, qword [rbp - 0x60]
call fcn.1402bd0e0
mov r11, qword [rbp - 0x40]
jmp 0x140167613
xor bl, bl
test r11, r11
je 0x140167627
mov r8, r11
xor edx, edx
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1402bcad0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret