joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440deb
Capabilities:
Log keystrokes via polling

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x38
mov eax, dword [rcx + 8]
mov rbx, rcx
mov r12d, edx
cmp eax, 0x200
jne 0x440eb3
call qword [sym.imp.USER32.dll_GetCapture]
test rax, rax
jne 0x440efb
mov rcx, qword [rbx]
call method.IWindow.findWindow_HWND___
mov r13, rax
test rax, rax
je 0x440efb
mov rcx, rax
call method.IWindow.getTopParent__
mov rcx, rax
test rax, rax
je 0x440efb
mov rax, qword [rax]
mov edx, 0x68
call qword [rax + 0xb8]
mov r12, rax
test rax, rax
je 0x440efb
mov rdx, qword [rbx + 0x18]
lea r14, [rsp + 0x28]
mov rcx, r14
call method.Point.Point_long_
mov rdx, r14
mov rcx, r13
call method.IWindow.toScreen_Point_const_
lea rdx, [rsp + 0x20]
mov rcx, r12
mov qword [rsp + 0x20], rax
call method.IWindow.fromScreen_Point_const_
mov rdx, r14
mov rcx, r12
mov qword [rsp + 0x28], rax
call fcn.0043fb18
mov rdx, rax
shr rdx, 0x20
mov ebx, edx
or ebx, eax
je 0x440efb
mov rcx, r12
call method.IWindow.captureCursor__
jmp 0x440f3e
and eax, 0xfffffffb
cmp eax, 0x100
jne 0x440efb
cmp qword [0x005e9e30], 0
je 0x440efb
mov r13, qword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x12
call r13
test ax, ax
js 0x440efb
mov rax, qword [rbx + 0x10]
cmp rax, 0x73
je 0x440f2d
ja 0x440ef5
cmp rax, 2
je 0x440f2d
cmp rax, 9
je 0x440eff
jmp 0x440efb
cmp rax, 0x75
je 0x440f0c
xor eax, eax
jmp 0x440f40
mov ecx, 0x11
call r13
test ax, ax
jns 0x440efb
mov r12, qword [0x005e9e30]
mov ecx, 0x10
call r13
movsx edx, ax
mov rcx, r12
not edx
shr edx, 0x1f
call fcn.00440cf2
jmp 0x440f3e
test r12b, r12b
jne 0x440efb
mov rcx, qword [0x005e9e30]
call fcn.0043edde
mov al, 1
add rsp, 0x38
pop rbx
pop r12
pop r13
pop r14
ret

Function at 0x446c36
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rsi, rcx
call method.IWindow.getHandle__
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x446d2e
call qword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x446d27
mov r9d, dword [rsi + 0x44]
mov ebx, dword [rsi + 0x40]
lea r13, [rsp + 0x30]
lea r12, [rsp + 0x38]
mov rcx, r13
cmp r9d, ebx
mov r8d, ebx
cmovbe r8d, r9d
cmovae ebx, r9d
mov dword [rsp + 0x2c], r8d
call fcn.004cdf4c
mov rax, qword [rsi + 0x30]
or r9d, 0xffffffff
mov r8d, dword [rsp + 0x2c]
lea rdx, [rsi + 0x28]
cmp ebx, dword [rax]
je 0x446caf
sub ebx, r8d
mov r9d, ebx
mov rcx, r12
call fcn.004ce822
mov rdx, r12
mov rcx, r13
call fcn.004ce2ae
mov rcx, r12
call fcn.004cddea
mov rax, qword [rsp + 0x30]
mov ecx, 0x2000
mov eax, dword [rax]
lea edx, [rax + 1]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r12, rax
test rax, rax
je 0x446d1f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
test rax, rax
je 0x446d1f
mov rsi, qword [rsp + 0x30]
mov rdi, rax
mov edx, dword [rsi]
add rsi, 4
lea ecx, [rdx + 1]
rep movsb byte [rdi], byte [rsi]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, r12
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
mov rcx, r13
call fcn.004cddea
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r12
pop r13
ret
Function at 0x45af94
Capabilities:
Check for time delay via gettickcount

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x30
mov eax, dword [rdx]
mov r12, rcx
cmp dword [rcx + 0x1a8], eax
jne 0x45afc6
mov ebx, dword [rdx + 4]
cmp dword [rcx + 0x1ac], ebx
jne 0x45afc6
mov eax, dword [rcx + 0x188]
sub ebx, dword [rcx + 0x190]
cmp ebx, eax
jge 0x45afd3
jmp 0x45aff6
mov rax, qword [rdx]
mov qword [r12 + 0x1a8], rax
jmp 0x45b047
add eax, 0x1d
cmp ebx, eax
jg 0x45aff6
mov rcx, qword [rcx + 0x1c0]
or ebx, 0xffffffff
mov rax, qword [rcx]
call qword [rax + 0x190]
test eax, eax
jne 0x45b058
jmp 0x45b0ff
lea rcx, [rsp + 0x20]
mov rdx, r12
call fcn.00456e98
movsxd rax, dword [rsp + 0x2c]
sub eax, dword [rsp + 0x24]
sub eax, 0x1e
cmp ebx, eax
jl 0x45b047
mov rcx, qword [r12 + 0x1c0]
mov rax, qword [rcx]
call qword [rax + 0x190]
mov ebx, dword [r12 + 0x168]
mov rcx, r12
mov esi, eax
call fcn.00457266
sub ebx, eax
cmp esi, ebx
je 0x45b0ff
mov ebx, 1
jmp 0x45b058
mov dword [r12 + 0x1b0], 0
jmp 0x45b0ff
cmp dword [r12 + 0x1b0], 0
mov rax, qword [sym.imp.KERNEL32.dll_GetTickCount]
jne 0x45b082
call rax
mov dword [r12 + 0x1b4], 0
mov dword [r12 + 0x1b0], eax
jmp 0x45b0ff
call rax
mov edx, eax
sub edx, dword [r12 + 0x1b0]
cmp edx, 0x12b
jbe 0x45b0ff
mov dword [r12 + 0x1b0], eax
mov eax, dword [r12 + 0x1b4]
cmp eax, 7
ja 0x45b0be
cmp eax, 3
ja 0x45b0b9
cmp eax, 1
jbe 0x45b0c1
add ebx, ebx
jmp 0x45b0c1
shl ebx, 2
jmp 0x45b0c1
shl ebx, 3
inc eax
or r8d, 0xffffffff
or edx, 0xffffffff
mov rcx, r12
mov dword [r12 + 0x1b4], eax
call fcn.0045a0de
test al, al
je 0x45b0e6
mov rcx, r12
call method.IWindow.update__
xor r9d, r9d
mov r8d, ebx
or edx, 0xffffffff
mov rcx, r12
add rsp, 0x30
pop rbx
pop rsi
pop r12
jmp fcn.0045a230
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop r12
ret

Function at 0x4671ad
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x30
mov rax, qword [rcx]
mov ebx, r8d
mov rdi, rcx
mov rsi, rdx
mov r8d, 0xa
lea rdx, [rsp + 0x28]
lea rcx, [rax + 4]
call sub.msvcrt.dll_strtol
imul eax, ebx
mov r9d, eax
mov rax, qword [rsp + 0x28]
mov al, byte [rax]
test al, al
jne 0x4671ed
mov dword [rsi], r9d
mov r8b, 1
jmp 0x467256
cmp ebx, 1
seta r8b
cmp al, 0x2e
sete al
and r8b, al
jne 0x467203
xor r8d, r8d
jmp 0x467256
xor ecx, ecx
mov r10d, 0xa
mov rax, qword [rsp + 0x28]
lea rdx, [rax + 1]
mov qword [rsp + 0x28], rdx
movsx eax, byte [rax + 1]
test al, al
je 0x46723e
cmp ebx, 1
jbe 0x46723e
sub eax, 0x30
cmp eax, 9
ja 0x4671fe
imul ecx, ecx, 0xa
xor edx, edx
add ecx, eax
mov eax, ebx
div r10d
mov ebx, eax
jmp 0x46720b
mov rax, qword [rdi]
imul ecx, ebx
cmp dword [rax], 0
je 0x467251
cmp byte [rax + 4], 0x2d
jne 0x467251
neg ecx
add ecx, r9d
mov dword [rsi], ecx
mov eax, r8d
add rsp, 0x30
pop rbx
pop rsi
pop rdi
ret
Function at 0x4a714e
Capabilities:
Read data from internet
Receive data

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
sub rsp, 0x30
mov eax, dword [rcx + 0x10]
mov r12, rcx
mov rbp, rdx
mov r13d, r8d
cmp eax, 1
je 0x4a7178
sub eax, 2
cmp eax, 1
jbe 0x4a71ab
jmp 0x4a7284
lea r14, [rsp + 0x28]
lea rdx, str.receiving_data...
mov rcx, r14
call fcn.004cdfee
xor r8d, r8d
mov rdx, r14
mov rcx, r12
call fcn.004a6ed4
mov rcx, r14
call fcn.004cddea
mov dword [r12 + 0x10], 2
test ebp, ebp
je 0x4a71c5
mov r14, qword [sym.imp.WININET.dll_InternetReadFileExA]
lea r13, [r12 + 0x80]
lea rbp, [r12 + 0x18]
jmp 0x4a71d3
mov edx, r13d
jmp 0x4a7225
mov dword [r12 + 0x10], 2
cmp dword [r12 + 0x10], 2
jne 0x4a723a
xor eax, eax
mov ecx, 0xe
mov rdi, rbp
mov r9, r12
rep stosd dword [rdi], eax
mov r8d, 1
mov qword [r12 + 0x38], r13
mov rdx, rbp
mov dword [r12 + 0x18], 0x38
mov dword [r12 + 0x40], 0x1000
mov rcx, qword [r12 + 0x60]
call r14
test eax, eax
jne 0x4a723a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
cmp eax, 0x3e5
je 0x4a722f
mov rcx, r12
call fcn.004a70dc
jmp 0x4a72ad
mov dword [r12 + 0x10], 3
jmp 0x4a72ad
mov rax, qword [r12]
mov r8d, dword [r12 + 0x40]
mov rdx, r13
mov rcx, r12
call qword [rax + 8]
cmp dword [r12 + 0x40], 0
jne 0x4a71ca
lea r13, [rsp + 0x28]
lea rdx, [0x00535511]
mov rcx, r13
call fcn.004cdfee
mov rcx, r12
xor r8d, r8d
mov rdx, r13
call fcn.004a6ed4
mov rcx, r13
call fcn.004cddea
jmp 0x4a72ad
mov rcx, qword [0x0053bb30]
lea rdx, str.onCompletion_in_wrong_state
call fcn.004d0399
mov edx, dword [r12 + 0x10]
mov rcx, rax
call fcn.004d0482
mov rcx, rax
call fcn.004d075f
nop
add rsp, 0x30
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret

Function at 0x4a72f6
Capabilities:
Write file on windows

Disassembly:
push r13
push r12
sub rsp, 0x48
mov r12, rcx
test r8d, r8d
je 0x4a7381
mov rcx, qword [rcx + 0x78]
cmp rcx, 0xffffffffffffffff
je 0x4a7365
mov dword [rsp + 0x34], 0
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4a73af
lea r13, [rsp + 0x38]
lea rdx, str.failed:_couldnt_write_file_to_disk
mov rcx, r13
call fcn.004cdfee
or r8d, 0xffffffff
mov rdx, r13
mov rcx, r12
call fcn.004a6ed4
mov rcx, r13
call fcn.004cddea
mov rcx, r12
call fcn.004a70a0
jmp 0x4a73af
lea r13, [rsp + 0x38]
mov rcx, r13
call fcn.004cdfe2
lea rcx, [r12 + 0x70]
mov rdx, r13
call fcn.004ce162
jmp 0x4a73a6
lea r13, [rsp + 0x38]
lea rdx, [rcx + 0x70]
mov rcx, r13
call fcn.004cdf96
mov rcx, r12
call fcn.004a70a0
mov rax, qword [r12]
mov rdx, r13
mov rcx, r12
call qword [rax]
mov rcx, r13
call fcn.004cddea
nop
add rsp, 0x48
pop r12
pop r13
ret
Function at 0x4a7744
Capabilities:
Get http content length

Disassembly:
sub rsp, 0x48
mov rcx, qword [rcx + 0x60]
mov dword [rsp + 0x38], 0
test rcx, rcx
je 0x4a777f
lea r9, [rsp + 0x3c]
lea r8, [rsp + 0x38]
mov edx, 0x20000005
mov dword [rsp + 0x3c], 4
mov qword [rsp + 0x20], 0
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov eax, dword [rsp + 0x38]
add rsp, 0x48
ret

Function at 0x4a7b42
Capabilities:
Read file on windows

Disassembly:
push r14
mov eax, 0x1030
push r13
push r12
call fcn.004d3790
sub rsp, rax
lea rdx, [0x00535779]
mov rcx, qword [rcx]
add rcx, 4
call sub.msvcrt.dll_fopen
mov r12, rax
test rax, rax
je 0x4a7bbd
lea r14, [rsp + 0x30]
mov r9, rax
mov r8d, 0x1000
mov edx, 1
mov rcx, r14
lea r13, [rsp + 0x28]
call sub.msvcrt.dll_fread
mov rdx, r14
mov rcx, r13
mov eax, eax
lea r8, [r14 + rax]
call fcn.004ce00e
mov rcx, r13
call fcn.004a7ab1
mov rcx, r13
call fcn.004cddea
mov rcx, r12
call sub.msvcrt.dll_fclose
mov al, 1
jmp 0x4a7bda
mov rcx, qword [0x0053bb30]
lea rdx, str.file_does_not_exist
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
xor eax, eax
add rsp, 0x1030
pop r12
pop r13
pop r14
ret
Function at 0x4a930c
Capabilities:
Delete directory
Delete file

Disassembly:
push r14
mov eax, 0x4030
push r13
push r12
push rbp
push rdi
push rsi
push rbx
call fcn.004d3790
sub rsp, rax
xor esi, esi
movabs rdi, 0xaaaaaaaaaaaaaaab
mov rbx, rcx
call fcn.004a926a
mov r12, qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov r13, qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov rdx, qword [rbx + 0x30]
mov rax, qword [rbx + 0x38]
sub rax, rdx
sar rax, 3
imul rax, rdi
cmp esi, eax
jae 0x4a93ae
mov ebp, esi
lea r14, [rsp + 0x2f]
imul rbp, rbp, 0x18
mov rcx, qword [rdx + rbp + 8]
add rcx, 4
call r12
mov rax, qword [rbx + 0x30]
lea r9, [rsp + 0x20]
mov r8, r14
mov edx, 0x4000
mov rcx, qword [rax + rbp + 8]
add rcx, 4
call r13
test eax, eax
je 0x4a93aa
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x4a93a1
mov byte [rax], 0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
inc esi
jmp 0x4a9345
lea rcx, [rbx + 0x40]
lea rdx, [0x004d66a0]
call fcn.004cfb2c
mov r13, qword [rbx + 0x30]
mov rsi, qword [rbx + 0x38]
lea r12, [rbx + 0x30]
mov rdi, r13
cmp rsi, rdi
je 0x4a93e9
lea rcx, [rdi + 8]
call fcn.004cddea
mov rcx, rdi
add rdi, 0x18
call fcn.004cddea
jmp 0x4a93cd
sub rsi, r13
mov rdx, r13
mov rcx, r12
mov r8, rsi
movabs rsi, 0xaaaaaaaaaaaaaab
shr r8, 3
imul r8, rsi
movabs rsi, 0x1fffffffffffffff
and r8, rsi
imul r8, r8, 0x18
add r8, r13
call fcn.004ceba6
mov rcx, r12
call fcn.004cead0
lea rcx, [rbx + 0x20]
call fcn.004a835e
lea rcx, [rbx + 0x18]
call fcn.004a8374
nop
add rsp, 0x4030
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4ad250
Capabilities:
Get local ipv4 addresses

Disassembly:
push r12
mov eax, 0x8048
push rdi
push rsi
push rbx
call fcn.004d3790
sub rsp, rax
xor r8d, r8d
mov edx, 0x10
lea rax, [rsp + 0x38]
lea rbx, [rsp + 0x40]
mov r12, rcx
mov ecx, 2
mov qword [rsp + 0x20], rax
mov r9, rbx
mov dword [rsp + 0x38], 0x8000
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
test eax, eax
jne 0x4ad2e6
lea rsi, [rsp + 0x3c]
mov rax, qword [rbx + 0xb0]
test rax, rax
je 0x4ad2dd
mov rdx, qword [rax + 0x10]
xor ecx, ecx
mov edi, dword [rdx + 4]
mov edx, dword [rax + 0x20]
xor eax, eax
cmp eax, edx
je 0x4ad2c4
shr ecx, 1
inc eax
or ecx, 0x80000000
jmp 0x4ad2b4
call qword [sym.imp.WS2_32.dll_htonl]
mov rdx, rsi
mov rcx, r12
not eax
or eax, edi
mov dword [rsp + 0x3c], eax
call fcn.005175d0
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x4ad29a
mov rax, qword [r12 + 8]
cmp qword [r12], rax
jne 0x4ad307
lea rdx, [rsp + 0x3c]
mov rcx, r12
mov dword [rsp + 0x3c], 0xffffffff
call fcn.005175d0
nop
add rsp, 0x8048
pop rbx
pop rsi
pop rdi
pop r12
ret

Function at 0x4ad4e6
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x4f0
mov edx, 6
lea r12, [rsp + 0x78]
mov rbx, rcx
mov dword [rcx + 0xa8], 0xffffffff
mov rcx, r12
mov dword [rsp + 0x78], 0
mov dword [rsp + 0x478], 4
call fcn.004acc70
mov ecx, 0x162e
mov word [rsp + 0x4c], 2
mov rdi, qword [sym.imp.WS2_32.dll_htons]
call rdi
xor r9d, r9d
mov dword [rsp + 0x50], 0xffffffff
mov rdx, r12
mov rcx, qword [rbx + 0x78]
mov word [rsp + 0x4e], ax
lea rax, [rsp + 0x4c]
mov dword [rsp + 0x28], 0x10
mov r8d, dword [rsp + 0x478]
mov qword [rsp + 0x20], rax
mov rbp, qword [sym.imp.WS2_32.dll_sendto]
call rbp
test eax, eax
jg 0x4ad588
lea rcx, str.sendto_old
call sub.msvcrt.dll_perror
mov r13, qword [rbx + 0x90]
mov rsi, qword [rbx + 0x88]
lea r14, str.sendto
cmp r13, rsi
je 0x4ad5cb
xor r9d, r9d
mov r8d, dword [rsp + 0x478]
mov rcx, qword [rsi]
mov rdx, r12
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jg 0x4ad5c5
mov rcx, r14
call fcn.004acb70
add rsi, 8
jmp 0x4ad59d
cmp qword [rbx + 0x80], 0xffffffffffffffff
je 0x4ad646
mov ecx, 0x162e
mov word [rsp + 0x5c], 0x17
call rdi
lea rdx, [rsp + 0x64]
mov ecx, 0xf
xor r9d, r9d
mov rdi, rdx
mov word [rsp + 0x5e], ax
xor eax, eax
lea r8, [rsp + 0x5c]
rep stosb byte [rdi], al
mov byte [rsp + 0x73], 1
mov rcx, qword [rbx + 0x80]
mov rdx, r12
mov qword [rsp + 0x20], r8
mov r8d, dword [rsp + 0x478]
mov word [rsp + 0x64], 0x2ff
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x28], 0x1c
call rbp
test eax, eax
jg 0x4ad646
lea rcx, str.sendto6
call fcn.004acb70
inc dword [rbx + 0xb4]
jne 0x4ad689
lea rax, [0x00520270]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], rax
call fcn.004d5bc0
xor r9d, r9d
xor r8d, r8d
mov ecx, 0x64
mov rdx, rax
call sym.winbox.exe_addTimer_unsigned_int__EventListener__void__bool_
mov dword [rbx + 0xa8], eax
add rsp, 0x4f0
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
Function at 0x4adcf9
Capabilities:
Create directory
Get common file path
Get file attributes

Disassembly:
push r14
push r13
push r12
push rbx
sub rsp, 0x458
lea r12, [0x005ea300]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
mov qword [rsp + 0x20], r12
mov r13, rcx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov rbx, qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test eax, eax
jns 0x4add99
mov edx, 0x104
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea rdx, str.AppData
mov rcx, r12
call sub.msvcrt.dll_strcat
mov rcx, r12
call rbx
inc eax
jne 0x4add99
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x4add99
mov rcx, qword [0x0053bb30]
lea rdx, str.couldnt_make_directory
call fcn.004d0399
mov rdx, r12
mov rcx, rax
call fcn.004d0399
mov rcx, rax
call fcn.004d075f
mov rcx, r13
call fcn.004cdf4c
jmp 0x4ade01
lea r12, [rsp + 0x32]
lea r8, [0x005ea300]
lea rdx, str._sMikrotik
mov rcx, r12
call sub.msvcrt.dll_sprintf
mov rcx, r12
call rbx
inc eax
jne 0x4addc8
xor edx, edx
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea r14, [rsp + 0x23c]
mov r8, r12
lea rdx, str._sWinbox
mov rcx, r14
call sub.msvcrt.dll_sprintf
mov rcx, r14
call rbx
inc eax
jne 0x4addf6
xor edx, edx
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, r14
mov rcx, r13
call fcn.004cdfee
mov rax, r13
add rsp, 0x458
pop rbx
pop r12
pop r13
pop r14
ret

Function at 0x4ade13
Capabilities:
Enumerate files on windows

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x178
xor r14d, r14d
lea r13, [rsp + 0x20]
mov rbx, rdx
lea rbp, [rsp + 0x30]
mov rdx, rcx
mov rcx, r13
call fcn.004cdf96
lea rdx, [0x00535d28]
mov rcx, r13
call fcn.004ce17a
mov rax, qword [rsp + 0x20]
mov rdx, rbp
lea rcx, [rax + 4]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x4adf28
mov r14, qword [sym.imp.KERNEL32.dll_FindNextFileA]
lea rsi, [rsp + 0x5c]
lea rdi, [rsp + 0x28]
lea rdx, [0x00535d2b]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4adf0b
lea rdx, [0x00535d2d]
mov rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x4adf0b
mov rdx, rsi
mov rcx, rdi
call fcn.004cdfee
mov rcx, qword [rbx]
mov r15, qword [rbx + 8]
sub r15, rcx
call fcn.004d1482
sar r15, 3
shr eax, 3
cmp r15d, eax
jne 0x4adef2
mov rdx, qword [rbx + 8]
sub rdx, qword [rbx]
mov eax, 1
mov rcx, rbx
sar rdx, 3
mov r8d, 8
add edx, edx
cmove edx, eax
shl edx, 3
call fcn.004ceaf6
mov rcx, qword [rbx + 8]
mov rdx, rdi
call fcn.004cdfa8
add qword [rbx + 8], 8
mov rcx, rdi
call fcn.004cddea
mov rdx, rbp
mov rcx, r12
call r14
test eax, eax
jne 0x4ade80
mov rcx, r12
mov r14b, 1
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, r13
call fcn.004cddea
mov eax, r14d
add rsp, 0x178
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4adf47
Capabilities:
Get common file path

Disassembly:
push r14
push r13
push r12
sub rsp, 0x230
lea r14, [rsp + 0x28]
mov r12, rcx
mov ecx, 0x104
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4adf78
mov rcx, r12
call fcn.004cdf4c
jmp 0x4adfa5
lea r13, [rsp + 0x12c]
xor r8d, r8d
lea rdx, [0x00535d30]
mov rcx, r14
mov r9, r13
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x4adf6e
mov rdx, r13
mov rcx, r12
call fcn.004cdfee
mov rax, r12
add rsp, 0x230
pop r12
pop r13
pop r14
ret

Function at 0x4b5a48
Capabilities:
Get common file path

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rbp, rdx
mov r12, r8
mov rsi, r9
lea rdx, [0x005ea6e0]
mov ecx, 0x104
mov rdi, rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
xor eax, eax
mov ecx, 0x26
rep stosd dword [rdi], eax
mov rax, qword [rsp + 0x70]
mov dword [rbx], 0x98
mov qword [rbx + 8], r12
mov qword [rbx + 0x18], rax
lea rax, [0x005ea6e0]
mov qword [rbx + 0x50], rax
mov rax, qword [rsp + 0x78]
mov dword [rbx + 0x2c], 1
mov qword [rbx + 0x68], rax
mov eax, dword [rsp + 0x80]
mov qword [rbx + 0x30], rbp
mov dword [rbx + 0x38], 0x104
mov qword [rbx + 0x58], rsi
mov dword [rbx + 0x60], eax
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret

Function at 0x4b5b35
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x360
lea rdx, str._s
lea rbx, [rsp + 0x160]
mov r8, rcx
lea rdi, [rsp + 0x20]
mov rsi, rcx
mov rcx, rbx
call sub.msvcrt.dll_sprintf
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r12, rax
test rax, rax
je 0x4b5bd0
mov rbp, qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp byte [rsp + 0x4c], 0x2e
je 0x4b5bba
lea r9, [rsp + 0x4c]
mov r8, rsi
lea rdx, str._s_s
mov rcx, rbx
call sub.msvcrt.dll_sprintf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov rcx, rbx
test al, 0x10
je 0x4b5bb4
call fcn.004b5b35
jmp 0x4b5bba
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, rdi
mov rcx, r12
call rbp
test eax, eax
jne 0x4b5b7f
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
add rsp, 0x360
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
Function at 0x4b5fbc
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x5d8
lea r15, [rsp + 0x60]
mov esi, ecx
lea rbp, [rsp + 0x78]
mov rcx, r15
lea rbx, [rsp + 0x1b8]
call fcn.004adcf9
mov rax, qword [rsp + 0x60]
lea rdx, str._s
mov rcx, rbx
lea r8, [rax + 4]
call sub.msvcrt.dll_sprintf
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov r14, rax
test rax, rax
je 0x4b625d
mov rdi, qword [sym.imp.KERNEL32.dll_CreateFileA]
lea rax, [rsp + 0xa4]
lea r12, [rsp + 0x68]
mov rdx, rax
mov rcx, r12
mov qword [rsp + 0x40], rax
call fcn.004cdfee
xor r8d, r8d
mov edx, 0x2d
mov rcx, r12
call fcn.005296f0
mov r9d, eax
cmp eax, 0xffffffff
je 0x4b6080
lea r13, [rsp + 0x3b8]
xor r8d, r8d
mov rdx, r12
mov rcx, r13
call fcn.004ce822
mov rcx, r12
mov rdx, r13
call fcn.004ce2ae
mov rcx, r13
call fcn.004cddea
mov rcx, r12
call fcn.004ae1c0
test eax, eax
jne 0x4b60b6
mov rcx, r12
call fcn.004cddea
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4b6022
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4b625d
mov rax, qword [rsp + 0x60]
mov r9, qword [rsp + 0x40]
mov rcx, rbx
lea rdx, str._s_s
lea r8, [rax + 4]
call sub.msvcrt.dll_sprintf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
je 0x4b608c
test sil, sil
jne 0x4b6249
lea r13, [rsp + 0x3b8]
mov r8, rbx
lea rdx, str._s_system.crc
mov rcx, r13
call sub.msvcrt.dll_sprintf
mov rcx, r13
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call rdi
mov rcx, rax
test rax, rax
jne 0x4b61cb
mov r8, rbx
lea rdx, str._s_routeros.crc
mov rcx, r13
call sub.msvcrt.dll_sprintf
mov rcx, r13
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call rdi
mov rcx, rax
test rax, rax
jne 0x4b61cb
mov r8, rbx
lea rdx, str._s_roteros.crc
mov rcx, r13
call sub.msvcrt.dll_sprintf
mov rcx, r13
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], 0
mov r8d, 1
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
call rdi
mov rcx, rax
test rax, rax
je 0x4b608c
lea r13, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
xor r8d, r8d
xor edx, edx
mov r9, r13
call qword [sym.imp.KERNEL32.dll_GetFileTime]
mov rcx, qword [rsp + 0x40]
test eax, eax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x4b6256
call rax
lea r8, [rsp + 0x5e]
lea rdx, [rsp + 0x5a]
mov rcx, r13
mov r9, qword [sym.imp.KERNEL32.dll_FileTimeToDosDateTime]
mov qword [rsp + 0x48], r8
mov qword [rsp + 0x40], r9
call r9
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea rdx, [rsp + 0x5c]
mov r8, qword [rsp + 0x48]
mov rcx, r13
mov r9, qword [rsp + 0x40]
call r9
movzx eax, word [rsp + 0x5c]
movzx edx, word [rsp + 0x5a]
sub eax, edx
cmp eax, 0x1f
jle 0x4b608c
mov rcx, rbx
call fcn.004b5b35
jmp 0x4b608c
call rax
jmp 0x4b608c
mov rcx, r15
call fcn.004cddea
nop
add rsp, 0x5d8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret