joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ab05e
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov r8, rcx
test rcx, rcx
je 0x14045457a
movzx r9d, word [rcx]
test cl, r11b
clc
test r9w, r9w
jmp 0x1401b1ebd
je 0x14045457a
mov r10d, 0x811c9dc5
mov rcx, 0x4c63574
movzx rax, ax
lea eax, [r9 - 0x41]
bt cx, 0xcc
shl cx, cl
movsxd rcx, r12d
cmp ax, 0x19
cbw
jmp 0x14038a906
jne 0x1401b1ed4
mov eax, r10d
jmp 0x14059b9a0
lea ecx, [r9 + 0x20]
not ah
movzx ax, cl
movsx rax, r10w
lea r8, [r8 + 2]
mov al, 0xe4
jmp 0x1404c8810
ret
xor eax, r10d
imul r10d, eax, 0x1000193
cmc
cmp r14, 0x5cff6200
test r9w, r9w
je 0x1401b22ed
mov rcx, rdx
dec rdx
test dil, r10b
test rcx, rcx
jmp 0x1401b22e7
sub eax, eax
jmp 0x1403fb80c
cmova cx, r9w
sar r9b, cl
bts ax, bp
movzx r9d, word [r8]
movzx eax, cx
jmp 0x1403fd81b
ret

Function at 0x1401a561a
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rdx, rcx
test rcx, rcx
je 0x1405bef3e
movzx r8d, word [rcx]
test r8w, r8w
jmp 0x14075625c
ret
ret
xor eax, eax
jmp 0x140221ef8
je 0x1405bef3e
mov r9d, 0x811c9dc5
lea eax, [r8 - 0x41]
mov cl, dil
xor ecx, ecx
bt rcx, rdi
cmp ax, 0x19
lea ecx, [r8 + 0x20]
setnp al
lea rdx, [rdx + 2]
cmova cx, r8w
bts r8d, ebx
sbb eax, 0x6ea33f13
not ax
movzx r8d, word [rdx]
xadd ax, ax
movzx eax, cx
clc
xor eax, r9d
shrd r9w, si, 0xa
stc
imul r9d, eax, 0x1000193
stc
cmp r13b, bl
test r8w, r8w
jne 0x140756268
mov eax, r9d
jmp 0x14021aac8

Function at 0x1402ae67a
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
je 0x140609802
mov r8d, 0x811c9dc5
sal cx, 0xa1
movzx eax, word [r9]
jmp 0x14020c398
movzx ecx, word [r9]
sub ax, 0x41
test rsp, rbp
add cx, 0x20
clc
cmp ax, 0x19
cdqe
cmova cx, word [r9]
mov ax, r9w
movzx ax, bh
lahf
lea r9, [r9 + 2]
inc ax
movzx eax, cx
jmp 0x14038ac01
mov r9, rcx
cmp spl, 0x38
test rcx, rcx
jmp 0x140488714
xor eax, r8d
movzx r8d, r10w
shr r8b, 0x2d
rcr r8b, cl
imul r8d, eax, 0x1000193
cmc
sub rdx, 1
jmp 0x14046bf00
jne 0x14008d232
mov eax, r8d
jmp 0x1404ff203
je 0x140609802
test rdx, rdx
jmp 0x14008d222
ret
xor eax, eax
ret

Function at 0x14043bbcd
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
ret
je 0x1400e6e66
inc rcx
stc
movzx eax, al
xor eax, edx
imul edx, eax, 0x1000193
mov al, byte [rcx]
clc
cmc
test al, al
jne 0x140149bac
mov eax, edx
jmp 0x1407eae4b
test rcx, rcx
jmp 0x14046fe20
je 0x1400e6e66
mov al, byte [rcx]
mov edx, 0x811c9dc5
test r11b, bl
test al, al
jmp 0x140149ba6
ret

Function at 0x1404adf4f
Capabilities:
Hash data using fnv

Disassembly:
je 0x14073a14e
mov rcx, r9
jmp 0x14058f193
test rcx, rcx
jmp 0x14073a148
je 0x1405e5391
mov r8d, 0x811c9dc5
jmp 0x1404d9d9f
mov rdx, rcx
mov r9b, 0x62
mov r9d, 8
test rcx, rcx
jmp 0x140559b04
inc rdx
movzx eax, al
test rdx, 0x70a231a3
xor eax, r8d
bts r8, r9
shld r8, rcx, 0x13
sub r8w, 0x7f51
imul r8d, eax, 0x1000193
mov al, byte [rdx]
stc
test al, al
jmp 0x14012ea3e
je 0x1405e5391
mov al, byte [rcx]
clc
test al, sil
test al, al
jmp 0x1403e2185
dec r9
jmp 0x14022f12f
xor eax, eax
jmp 0x14077d31a
jne 0x1404d9d9f
mov eax, r8d
ret
ret
Function at 0x1405730bd
Capabilities:
Hash data using fnv

Disassembly:
jb 0x1407f9a41
mov eax, ecx
ret
jne 0x1407eb44b
sub eax, eax
jmp 0x1403afeef
cmp r8, rdx
jmp 0x14010d4b1
ret
xor r8d, r8d
bsf r9, rsp
mov r9, rcx
test rcx, rcx
jmp 0x140136dfb
inc r8
cmp bpl, 0xb8
xor eax, ecx
movsxd rcx, r14d
imul ecx, eax, 0x1000193
cmc
jmp 0x140184c67
mov ecx, 0x811c9dc5
cmp r10b, r13b
jmp 0x1407f9a38
test rdx, rdx
je 0x14010d4b7
movzx eax, byte [r8 + r9]
jmp 0x1405ecc99

Function at 0x1407808e4
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
sub eax, eax
jmp 0x14036d76f
ret
je 0x140355941
mov r9b, byte [rcx]
cmp esp, ebx
clc
test r9b, r9b
jmp 0x14085cf67
jne 0x14085cf75
mov eax, r10d
ret
mov r8, rcx
test rcx, rcx
jmp 0x1403e71e8
je 0x140355941
mov r10d, 0x811c9dc5
cqo
movzx edx, r9b
xchg cl, al
ror rax, cl
movzx rcx, cx
sub r9b, 0x41
btc ecx, 0xe4
cmp r9b, 0x19
lea eax, [rdx + 0x20]
movzx ecx, al
not r9b
cdqe
cbw
cmova ecx, edx
xchg r9b, r9b
inc r8
movzx eax, cl
xor eax, r10d
rcl r10b, 0x5c
imul r10d, eax, 0x1000193
mov r9b, byte [r8]
test r9b, r9b
jmp 0x14061c113
Function at 0x140895b1b
Capabilities:
Execute anti-debugging instructions
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
movsx r9d, r13w
or r9b, al
mov qword [rsp + 0x18], rbp
cmovns r8w, sp
rol bpl, cl
movzx bp, r8b
mov qword [rsp + 0x20], rsi
ror bp, 0x61
btr rsi, 0xcf
jmp 0x140895b4c
push rdi
push r14
adc r9, rcx
btc r10w, 8
mov r8, rdx
xadd r10, rdi
movsx r9w, r13b
movzx r9w, spl
mov r9, rdx
shl di, cl
shl bpl, 0x4c
mov bpl, 0x98
shr r8, 3
mov esi, 0xd31403a
movsxd r10, edx
movsx r14, bx
mov rdi, rcx
movsx r14d, bx
movabs rsi, 0xcbf29ce484222325
cmovo r14d, r13d
movabs rbp, 0x100000001b3
bswap r10d
movabs r14, 0x7080100200400801
mov r10b, spl
mov r10d, 8
jmp 0x140895bc0
jmp 0x140895c65
dec r8
rdtsc
movzx r11d, r15w
shl rdx, 0x20
lea r11, [rsp + 0x18]
rol ch, cl
or rax, rdx
bswap edx
btc ebx, 0x35
mov rbx, r10
mov rcx, rax
movsxd rdx, r9d
mov edx, 0x397c63af
jmp 0x140895bf5
ror rcx, 3
cmovo rdx, rsp
btc dx, 0xec
xor rcx, rax
movsxd rax, edi
clc
mov rax, r14
cqo
movzx edx, cx
and rdx, rsi
mul rcx
test r15d, eax
add rcx, r14
mov rcx, rsi
xor rdx, rax
setg al
mov qword [rsp + 0x18], rdx
movzx eax, byte [r11]
jmp 0x140895c34
inc r11
xor rcx, rax
cmc
imul rcx, rbp
cmc
cmp r11b, dl
sub rbx, 1
jmp 0x140895c4c
jne 0x140895c2b
xor rcx, rdx
cmp r8, rbp
mov qword [rdi], rcx
clc
add rdi, r10
clc
cmp r8b, 0xf1
cmc
test r8, r8
jmp 0x140895c6d
jne 0x140895bc5
and r9d, 7
jmp 0x140895c7c
je 0x140895d3f
rdtsc
sbb cl, r10b
shl rdx, 0x20
or rax, rdx
mov rcx, rax
movsx dx, bpl
cwd
ror rcx, 3
xor rcx, rax
clc
shl dh, cl
mov rax, r14
or dx, 0x6e25
mul rcx
rcr cx, cl
or ecx, 0x71376cd6
test r13, r10
lea rcx, [rsp + 0x18]
xor rdx, rax
bswap ax
movzx ax, r11b
movzx rax, bp
mov qword [rsp + 0x18], rdx
movzx eax, byte [rcx]
jmp 0x140895cda
inc rcx
test dx, 0x1e25
stc
xor rsi, rax
imul rsi, rbp
cmp r10w, 0x4e61
sub r10, 1
jmp 0x140895cf9
jne 0x140895cd2
xor rdx, rsi
jmp 0x140895d0c
mov qword [rsp + 0x18], rdx
test rdi, rdi
jmp 0x140895d19
je 0x140895d3f
lea rsi, [rsp + 0x18]
mov rcx, r9
movzx bp, bpl
mov r14d, 0x625e08a7
sets r14b
rep movsb byte [rdi], byte [rsi]
movzx esi, r12w
not bp
mov rbx, qword [rsp + 0x20]
movsx bp, spl
mov rbp, qword [rsp + 0x28]
mov rsi, 0x55082488
jmp 0x140895d5a
mov rsi, qword [rsp + 0x30]
movsx di, r13b
movzx di, r13b
mov dil, dil
pop r14
pop rdi
jmp 0x140895d74
ret
Function at 0x1408a6133
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
movsx rax, bp
bswap rax
push rsi
movzx ax, dh
movsx ax, dh
cmovb eax, ebp
push rdi
movzx ax, r12b
cmovb ax, bx
push r12
jmp 0x1408a615e
push r13
movsx eax, r13w
movsxd rax, ebp
cdqe
push r14
bswap rax
movsx ax, sil
movzx ax, bh
push r15
movzx eax, r11w
mov eax, 0x2040
jmp 0x1408a6187
call fcn.140056160
nop
add r12b, 0x91
stc
sub rsp, rax
inc eax
bsr ax, r14w
cbw
mov qword [rsp + 0x30], 0xfffffffffffffffe
movzx r12, r11w
movzx r13w, sil
mov qword [rsp + 0x2080], rbx
cmovo r12w, dx
mov rbx, r9
xchg r15, r12
mov r15, r8
shrd bp, r15w, 0x46
mov r13, rdx
cmc
setns al
and dh, 0x52
mov rbp, rcx
shrd dx, si, 0x6e
mov dword [rsp + 0x2090], 4
stc
neg dx
bt cx, sp
mov r12d, dword [r8]
sub dl, r11b
jmp 0x1408a61ff
xor r14b, r14b
and dword [r9], 0
bswap dx
rol dx, 0x5b
rcl al, cl
and dword [r9 + 4], 0
and dword [r8], 0
and dword [rsp + 0x2098], 0
setl cl
cqo
mov rax, qword [rbp + 0x58]
cdq
cqo
lea rcx, [rsp + 0x2090]
movsx dx, spl
movsx r8, r12w
movsx r8d, cx
mov qword [rsp + 0x20], rcx
mov dl, bh
cqo
lea r9, [rsp + 0x2098]
cdq
cqo
cmovbe dx, r15w
mov r8d, 0x2000
bswap ecx
mov cl, 0x70
movzx dx, dil
lea rdx, [rsp + 0x40]
not rcx
setbe ch
mov rcx, qword [rbp + 0x88]
jmp 0x1408a6280
call rax
nop
test r9b, r12b
test eax, eax
jmp 0x1408a628d
jne 0x1408a6409
mov edx, dword [rsp + 0x2090]
test edx, edx
js 0x1408a6401
cmp edx, 1
jg 0x1408a63b4
test r14b, r14b
jmp 0x1408a62b3
jne 0x1408a638d
mov esi, dword [rsp + 0x2098]
clc
test esi, esi
jmp 0x1408a62c8
je 0x1408a638d
mov r8d, dword [r15]
lea eax, [r8 + rsi]
cmp eax, r12d
jmp 0x1408a62dd
jbe 0x1408a62f0
mov r14b, 1
jmp 0x1408a62eb
jmp 0x1408a638d
mov rcx, rsi
bt edi, ecx
mov rdi, r8
cmp rsp, r9
add rdi, r13
jmp 0x1408a6304
je 0x1408a6348
test esi, esi
jmp 0x1408a6311
je 0x1408a6348
lea rsi, [rsp + 0x40]
cmovge dx, sp
rep movsb byte [rdi], byte [rsi]
not sil
shr r8b, 0xb6
xor si, bx
mov r8d, dword [r15]
cmc
bswap cx
mov edx, dword [rsp + 0x2090]
mov esi, dword [rsp + 0x2098]
add ecx, 0x3cd10483
cmc
mov ecx, esi
clc
test esi, esi
jmp 0x1408a6352
je 0x1408a6378
lea rdi, [rsp + 0x40]
cmp r12, 0x223a6dc1
xor eax, eax
jmp 0x1408a636b
rep stosb byte [rdi], al
cmovbe ax, sp
movzx eax, r9w
xadd eax, eax
lea eax, [r8 + rsi]
test sp, 0x9b6
test r15, rbp
mov dword [r15], eax
cmp r11b, 0x32
clc
stc
test edx, edx
jmp 0x1408a6394
jne 0x1408a6218
test r14b, r14b
je 0x1408a641a
mov dword [rbx + 4], 0x6f
jmp 0x1408a63af
jmp 0x1408a6410
cmp edx, 4
jmp 0x1408a63bc
jne 0x1408a6401
mov byte [rbp + 0xcc], 1
mov rdx, 0x343655f0
mov rdx, rbx
mov rcx, rbp
jmp 0x1408a63db
call fcn.1408a68aa
nop
cbw
mov dword [rbx], 0xd000122f
mov al, 0x9e
movsx eax, r11w
not ax
movzx eax, word [rbp + 0xc8]
mov dword [rbx + 4], eax
jmp 0x1408a641a
mov dword [rbx + 4], edx
jmp 0x1408a6410
mov dword [rbx + 4], eax
and sil, 0x31
mov dword [rbx], 0xd0001207
sar dil, 0x87
mov rbx, qword [rsp + 0x2080]
clc
add rsp, 0x2040
mov bpl, 0xe0
jmp 0x1408a6436
pop r15
not edi
movzx edi, r11w
xchg r14w, di
pop r14
movzx r13d, cx
movsxd r12, esp
pop r13
movzx r12, r12w
pop r12
movsx si, dil
not dil
pop rdi
bswap si
pop rsi
cmovae bp, si
movsx rbp, sp
pop rbp
ret
Function at 0x140016214
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r15
lea rbp, [rax - 0x388]
sub rsp, 0x470
mov rsi, rdx
lea rdx, [rsp + 0x50]
xor bl, bl
mov ecx, 0x104
xor dil, dil
mov byte [rbp + 0x390], bl
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea r8, [rbp + 0x3a0]
mov rdx, rsi
call fcn.140015f1c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x140085128
mov eax, dword [0x1400d9f28]
test eax, eax
je 0x14001638a
mov r15d, 1
lea rcx, [0x1400dbf10]
cmp eax, r15d
je 0x14008514a
lea rax, [rbp + 0x390]
lea r8, [0x1400d9f28]
lea rdx, [0x1400d9f50]
mov qword [rsp + 0x20], rax
call fcn.140016590
test al, al
je 0x140016393
mov al, byte [0x1400dbf10]
mov dil, byte [0x1400dbf11]
lea r9, [0x1400d9f20]
lea r8, [rbp + 0x160]
lea rcx, [0x1400d9f50]
mov edx, 0x104
mov byte [0x1400d9f2c], al
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov bl, byte [rbp + 0x390]
mov r8d, dword [0x1400d9f28]
lea rdx, [0x1400d9f50]
call fcn.14001598c
test eax, eax
jne 0x14008516e
cmp dil, r15b
je 0x140085191
call fcn.140016be0
call fcn.140017b68
cmp byte [0x1400d9f2c], 0
jne 0x140016337
lea rcx, [0x1400dab40]
call fcn.140015dc8
lea rcx, [0x1400da160]
mov edx, r15d
call fcn.140007890
cmp byte [0x1400d9f2c], 0
jne 0x14001635b
lea rcx, [0x1400dab40]
call fcn.14001639c
lea rcx, [0x1400dbf10]
call fcn.140016400
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea r11, [rsp + 0x470]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
or dword [0x1400d9e70], 0xffffffff
jmp 0x140016367
mov dword [0x1400d9e70], r15d
jmp 0x140016367
lea r8, [0x1400c4ecc]
lea rdx, str.Compiled_AutoIT_Script_by_CWAutComp_v2.17
mov r9d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
jmp 0x140016372
mov r8, qword [0x1400d9f30]
or r9d, 0xffffffff
mov edx, r15d
call fcn.14004ab50
mov al, byte [0x1400d9e76]
mov byte [0x1400dbf12], al
jmp 0x1400162f4
lea rcx, [0x1400dbf10]
call fcn.140016400
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1400d9e70], r15d
jmp 0x140016372
call fcn.1400509bc
test al, al
jne 0x140016318
cmp byte [rbp + 0x3a0], al
jne 0x140016318
lea rdx, [rbp + 0x160]
mov r8d, 0x104
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [0x1400af97c]
lea rcx, [rsp + 0x30]
call fcn.14000dda4
lea rcx, [rsp + 0x30]
test bl, bl
je 0x140085204
lea rdx, [0x1400c4f38]
call fcn.140015b3c
lea rdx, [0x1400d9f50]
lea rcx, [rsp + 0x30]
call fcn.140015b3c
lea rdx, [0x1400c4f38]
lea rcx, [rsp + 0x30]
jmp 0x140085207
mov rdx, rsi
call fcn.140015b3c
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9, qword [rsp + 0x30]
mov rcx, rax
lea rax, [rsp + 0x50]
lea r8, [rbp + 0x160]
lea rdx, str.runas
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rcx, [rsp + 0x30]
call fcn.14000de70
nop
jmp 0x14001635b
Function at 0x14004f398
Capabilities:
Copy file
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x380]
sub rsp, 0x480
mov rbx, rdx
lea rdx, [rbp + 0x170]
mov dil, r8b
call fcn.14001787c
lea rdx, [rsp + 0x60]
mov rcx, rbx
call fcn.14001787c
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
xor ebx, ebx
test eax, eax
jne 0x14004f423
test dil, dil
je 0x14004f41c
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call fcn.140026678
test eax, eax
je 0x14004f415
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
mov al, 1
jmp 0x14004f4cb
xor al, al
jmp 0x14004f4cb
lea rcx, [rbp + 0x170]
call fcn.140050ae4
test al, al
je 0x14004f41c
lea rcx, [rsp + 0x60]
call fcn.140050ae4
test al, al
je 0x14004f4e0
test dil, dil
je 0x14004f41c
lea rdx, [0x1400c5fe8]
lea rcx, [rbp + 0x170]
call fcn.140025bb4
lea rcx, [rbp + 0x170]
call fcn.140025b98
lea rcx, [rsp + 0x60]
mov word [rbp + rax*2 + 0x172], bx
call fcn.140025b98
lea rcx, [rsp + 0x20]
mov word [rsp + rax*2 + 0x62], bx
lea rax, [rbp + 0x170]
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], rax
mov eax, 0x614
mov dword [rsp + 0x44], ebx
mov qword [rsp + 0x20], rbx
mov dword [rsp + 0x28], 2
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
lea rcx, [rsp + 0x60]
call fcn.14004f774
test al, al
je 0x14004f41c
lea rcx, [rsp + 0x60]
call fcn.140050ae4
test al, al
jmp 0x14004f448
Function at 0x14004f504
Capabilities:
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1028]
mov eax, 0x1100
call fcn.140036710
sub rsp, rax
mov rbx, rdx
lea rdx, [rbp + 0x360]
xor edi, edi
mov r15b, r9b
mov r12b, r8b
mov sil, dil
call fcn.14001787c
lea rdx, [rbp + 0x570]
mov rcx, rbx
call fcn.14001787c
lea rdx, [rbp + 0x570]
lea rcx, [rbp + 0x360]
call fcn.140050a4c
lea rcx, [rbp + 0x360]
mov r13b, al
call fcn.140050ae4
test al, al
je 0x14004f592
lea rdx, [0x1400c5fe8]
lea rcx, [rbp + 0x360]
call fcn.140025bb4
lea rcx, [rbp + 0x570]
call fcn.140050ae4
test al, al
je 0x14004f5b5
lea rdx, [0x1400c5fe8]
lea rcx, [rbp + 0x570]
call fcn.140025bb4
lea rax, [rbp + 0xdf0]
lea r9, [rbp + 0x9d0]
lea r8, [rbp + 0xbe0]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x360]
mov qword [rsp + 0x20], rax
call fcn.140026db8
lea rdx, [rbp + 0x780]
lea rcx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov r14b, 1
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14004f743
cmp r14b, 1
jne 0x14004f743
test byte [rbp + 0x780], 0x10
jne 0x14004f716
lea rax, [rbp + 0x150]
lea r9, [rbp + 0x570]
lea r8, [rbp + 0xdf0]
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0x7ac]
mov qword [rsp + 0x20], rax
call fcn.14004ff08
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x40]
call fcn.140025be0
lea rdx, [rbp + 0xbe0]
lea rcx, [rsp + 0x40]
call fcn.140025bb4
lea rdx, [rbp + 0x7ac]
lea rcx, [rsp + 0x40]
call fcn.140025bb4
lea rcx, [rbp + 0x150]
call fcn.140017fa0
test al, al
je 0x14004f6b5
test r12b, r12b
je 0x14004f736
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x14004f6d4
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
cmp r15b, 1
jne 0x14004f706
test r13b, r13b
jne 0x14004f6ec
call qword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x14004f70f
lea rdx, [rbp + 0x150]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x14004f746
jmp 0x14004f713
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14004f736
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x14004f70f
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x14004f736
mov sil, 1
lea rdx, [rbp + 0x780]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14004f604
mov r14b, dil
jmp 0x14004f604
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x14004f752
mov dil, sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, dil
lea r11, [rsp + 0x1100]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x14004f774
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x230
mov rdx, rcx
lea rcx, [rsp + 0x20]
mov r8d, 0x104
call fcn.140015d8c
lea rcx, [rsp + 0x20]
call fcn.140025b98
xor esi, esi
mov edi, 0x5c
test rax, rax
je 0x14004f7bb
cmp word [rsp + rax*2 + 0x1e], di
jne 0x14004f7bb
mov word [rsp + rax*2 + 0x1e], si
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x14004f846
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x14004f7eb
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14004f7f0
mov al, 1
jmp 0x14004f84c
cmp eax, 3
jne 0x14004f84a
lea rcx, [rsp + 0x20]
call fcn.140017ab4
mov edx, edi
mov rcx, rax
mov rbx, rax
call fcn.140027724
mov rcx, rbx
test rax, rax
jne 0x14004f816
call fcn.140025ab0
jmp 0x14004f84a
mov word [rax], si
call fcn.14004f774
mov rcx, rbx
mov dil, al
call fcn.140025ab0
test dil, dil
je 0x14004f841
lea rcx, [rsp + 0x20]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne dil
mov al, dil
jmp 0x14004f84c
test al, 0x10
jne 0x14004f7e7
xor al, al
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14004f864
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x5a0]
sub rsp, 0x6a0
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov r14b, bl
call fcn.14001787c
lea rcx, [rsp + 0x30]
call fcn.140050ae4
test al, al
je 0x14004f8af
lea rdx, [0x1400c5fe8]
lea rcx, [rsp + 0x30]
call fcn.140025bb4
lea r8, [rbp + 0x390]
lea rdx, [rbp + 0x5c8]
lea rcx, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
call fcn.140026db8
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov sil, 1
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14004f95b
cmp sil, 1
jne 0x14004f95b
test byte [rbp + 0x140], 0x10
jne 0x14004f942
lea rdx, [rbp + 0x5c8]
lea rcx, [rsp + 0x30]
mov r14b, sil
call fcn.140025be0
lea rdx, [rbp + 0x390]
lea rcx, [rsp + 0x30]
call fcn.140025bb4
lea rdx, [rbp + 0x16c]
lea rcx, [rsp + 0x30]
call fcn.140025bb4
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x14004f95e
lea rdx, [rbp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14004f8ed
mov sil, bl
jmp 0x14004f8ed
mov bl, r14b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
lea r11, [rsp + 0x6a0]
mov al, bl
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x140055dd4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, 1
mov dword [0x1400dd290], ecx
lea rdx, [0x1400dd294]
mov ecx, r8d
mov eax, dword [rdx - 4]
shr eax, 0x1e
xor eax, dword [rdx - 4]
imul eax, eax, 0x6c078965
add eax, ecx
add ecx, r8d
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp ecx, 0x270
jl 0x140055dea
mov dword [reloc.WSOCK32.dll_accept], r8d
mov dword [0x1400dd270], r8d
ret

Function at 0x140055e1c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400dd270], 0
lea rbx, [0x1400dd290]
jne 0x140055e41
xor ecx, ecx
call fcn.140029104
mov rcx, rax
call fcn.140055dd4
mov dword [reloc.WSOCK32.dll_accept], 0x270
mov qword [0x1400dd288], rbx
mov r9d, 0xe3
mov r10d, 0x9908b0df
mov r11d, 0x7ffffffe
mov edx, dword [rbx + 4]
mov al, dl
and al, 1
neg al
sbb ecx, ecx
xor edx, dword [rbx]
and edx, r11d
and ecx, r10d
xor edx, dword [rbx]
shr edx, 1
xor edx, dword [rbx + 0x634]
xor edx, ecx
mov dword [rbx], edx
add rbx, 4
dec r9d
jne 0x140055e64
mov r9d, 0x18c
lea r8, [rbx + 4]
mov edx, dword [r8]
mov al, dl
and al, 1
neg al
sbb ecx, ecx
xor edx, dword [rbx]
and edx, r11d
and ecx, r10d
xor edx, dword [rbx]
shr edx, 1
xor edx, dword [rbx - 0x38c]
xor edx, ecx
mov dword [rbx], edx
lea rbx, [r8]
dec r9d
jne 0x140055e94
mov ecx, dword [0x1400dd290]
mov al, cl
and al, 1
neg al
mov eax, dword [r8]
sbb edx, edx
xor eax, ecx
and eax, r11d
and edx, r10d
xor eax, dword [r8]
shr eax, 1
xor eax, dword [r8 - 0x38c]
xor eax, edx
mov dword [r8], eax
add rsp, 0x20
pop rbx
ret

Function at 0x140056448
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov edx, 1
mov rbx, rcx
lea r8d, [rdx + 7]
cmp dword [rcx + 0x1c], edx
jne 0x140056479
mov edx, dword [rcx + 0x14]
add rdx, qword [rcx + 8]
lea rcx, [rsp + 0x30]
call fcn.1400254f0
jmp 0x140056487
mov r9, qword [rcx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140029554
movzx ecx, byte [rsp + 0x34]
movzx eax, byte [rsp + 0x35]
add dword [rbx + 0x14], 8
shl ecx, 8
lea rdx, str.509B
xor ebx, ebx
or ecx, eax
movzx eax, byte [rsp + 0x36]
mov byte [rsp + 0x34], bl
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x37]
shl ecx, 8
or ecx, eax
mov dword [rdi], ecx
lea rcx, [rsp + 0x30]
call fcn.140029630
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140056580
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
test dword [rcx + 0x48c], 0xfffeffff
mov rbx, rcx
jne 0x1400565b7
mov r9, qword [rcx + 0x28]
mov rcx, qword [rcx + 0x480]
mov edx, 1
mov r8d, 0x10000
call fcn.140029554
and dword [rbx + 0x48c], 0
movsxd rdx, dword [rbx + 0x48c]
mov rax, qword [rbx + 0x480]
mov al, byte [rdx + rax]
lea ecx, [rdx + 1]
mov dword [rbx + 0x48c], ecx
add rsp, 0x20
pop rbx
ret