joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14005093c
Capabilities:
Delete directory
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0xff60]
mov eax, 0x10060
call fcn.1400357e0
sub rsp, rax
mov bl, dl
lea r8, [rsp + 0x60]
mov edx, 0x7fff
call fcn.14004fc08
lea rcx, [rsp + 0x60]
call fcn.14005017c
xor edi, edi
test al, al
je 0x1400509e1
lea rcx, [rsp + 0x60]
test bl, bl
jne 0x140050993
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
jmp 0x1400509e1
call fcn.140024e38
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rdi
mov word [rsp + rax*2 + 0x62], di
lea rax, [rsp + 0x60]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x30], rax
mov eax, 0x614
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x44], edi
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 3
mov word [rsp + 0x40], ax
call qword [sym.imp.SHELL32.dll_SHFileOperationW]
test eax, eax
sete al
lea r11, [rsp + 0x10060]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x1400509f8
Capabilities:
Shutdown system

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
mov esi, edx
mov edi, ecx
lea rdx, str.SeShutdownPrivilege
lea rcx, [rsp + 0x30]
call fcn.14004e7f0
lea rcx, [rsp + 0x30]
call fcn.140040cd8
xor ebx, ebx
test al, al
je 0x140050a87
cmp edi, 0x20
je 0x140050a76
cmp edi, 0x40
je 0x140050a7b
test dil, 0xb
jne 0x140050a48
xor edx, edx
mov ecx, edi
call qword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x140050a85
test dil, 0x14
mov r9d, ebx
mov eax, 1
cmovne r9d, eax
test dil, 2
mov dword [rsp + 0x28], esi
cmovne ebx, eax
xor r8d, r8d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownExW]
jmp 0x140050a85
mov ebx, 1
xor edx, edx
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetSystemPowerState]
mov ebx, eax
lea rcx, [rsp + 0x30]
call fcn.1400403cc
mov rsi, qword [rsp + 0x68]
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x140050aa4
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
test ecx, ecx
js 0x140050b25
push rbx
sub rsp, 0x20
mov ebx, ecx
test ecx, ecx
je 0x140050b1a
cmp ecx, 0xf
jae 0x140050b18
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x140050b18
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x38]
xorps xmm1, xmm1
xorps xmm0, xmm0
sub rax, qword [rsp + 0x40]
cvtsi2sd xmm0, qword [rsp + 0x48]
cvtsi2sd xmm1, rax
divsd xmm1, xmm0
mulsd xmm1, qword [0x1400c5b90]
cvttsd2si rax, xmm1
cmp eax, ebx
jb 0x140050ad2
jmp 0x140050b20
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x20
pop rbx
ret
Function at 0x140050cc8
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x40
xor r9d, r9d
xor r8d, r8d
mov rbx, rcx
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_PostMessageW]
xor r9d, r9d
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
lea edx, [r9 + 0x10]
xor r8d, r8d
mov rcx, rbx
mov dword [rsp + 0x28], 0x1f4
mov dword [rsp + 0x20], 2
call qword [sym.imp.USER32.dll_SendMessageTimeoutW]
test rax, rax
jne 0x140050d4a
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x40
pop rbx
ret

Function at 0x140052d28
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x60
mov eax, dword [rcx]
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov rbx, r9
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayGetElement
test al, 0x10
je 0x140052d76
mov ecx, r8d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140052e03
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.140052b3c
jmp 0x140052e2c
test edx, eax
je 0x140052dac
mov rax, qword [r9]
test rax, rax
jne 0x140052e2f
mov rcx, qword [rsp + 0x90]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140052e09
or rax, 0xffffffffffffffff
jmp 0x140052e2f
mov ecx, r8d
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
jbe 0x140052d60
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x40]
lea rcx, [0x1400c7110]
mov edx, 0x40000000
mov r8d, 2
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140052e09
and qword [rbx], 0
jmp 0x140052e2c
mov rcx, qword [rbx]
lea rdx, [rsp + 0x70]
mov r8d, 1
call fcn.140052b3c
mov rcx, rbx
call fcn.140052ab8
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
mov rax, qword [rbx]
add rsp, 0x60
pop rbx
ret
Function at 0x140052e38
Capabilities:
Create pipe

Disassembly:
push rbx
sub rsp, 0x60
mov eax, dword [rcx]
and dword [rsp + 0x50], 0
and qword [rsp + 0x48], 0
mov rbx, r9
mov dword [rsp + 0x40], reloc.OLEAUT32.dll_SafeArrayGetElement
test al, 0x10
je 0x140052e88
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbx], rax
cmp rax, 0xffffffffffffffff
je 0x140052f17
mov r8d, 1
mov rdx, rbx
mov rcx, rax
call fcn.140052b3c
jmp 0x140052f40
test al, 1
je 0x140052ebe
mov rax, qword [r9]
test rax, rax
jne 0x140052f43
mov rdx, qword [rsp + 0x90]
lea r8, [rsp + 0x40]
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreatePipe]
test eax, eax
jne 0x140052f1d
or rax, 0xffffffffffffffff
jmp 0x140052f43
mov ecx, 0xfffffff6
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov r8d, 1
lea rcx, [rax - 1]
mov qword [rbx], rax
cmp rcx, 0xfffffffffffffffd
jbe 0x140052e78
and qword [rsp + 0x30], 0
lea r9, [rsp + 0x40]
lea rcx, [0x1400c7110]
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbx], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140052f1d
and qword [rbx], 0
jmp 0x140052f40
mov rcx, qword [rbx]
lea rdx, [rsp + 0x70]
mov r8d, 1
call fcn.140052b3c
mov rcx, rbx
call fcn.140052ab8
mov rax, qword [rsp + 0x70]
mov qword [rbx], rax
mov rax, qword [rbx]
add rsp, 0x60
pop rbx
ret

Function at 0x140053070
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
and dword [rsp + 0x58], 0
call fcn.1400530d8
test al, al
je 0x1400530b2
test rdx, rdx
je 0x1400530b2
test r8, r8
je 0x1400530b2
and qword [rsp + 0x20], 0
lea rbx, [rcx + 0x28]
lea r9, [rsp + 0x58]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1400530b2
mov rcx, rbx
call fcn.140052ab8
mov eax, dword [rsp + 0x58]
add rsp, 0x30
pop rbx
ret

Function at 0x140053348
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x58], 0
mov rbx, rcx
jne 0x14005337f
lea rax, [rsp + 0x40]
mov r9, rcx
lea r8, [0x140053338]
mov qword [rsp + 0x28], rax
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x58], rax
add rsp, 0x30
pop rbx
ret

Function at 0x140053388
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
lea rsi, [rcx + 0x58]
mov rdi, rcx
cmp qword [rsi], 0
je 0x1400533f0
mov eax, dword [rcx + 0x60]
mov ebp, 0x1f6
xchg dword [rcx + 0x60], eax
cmp eax, ebp
je 0x1400533f0
add rcx, 0x28
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rsi]
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsi]
mov edx, 0x3e8
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call fcn.140052ab8
xchg dword [rdi + 0x60], ebp
lea rcx, [rdi + 0x28]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14005546c
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
dec dword [reloc.WSOCK32.dll_accept]
jne 0x14005547d
call fcn.140055568
mov rax, qword [0x1400de0c8]
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400de0c8], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
shr eax, 1
add rsp, 0x28
ret

Function at 0x1400554c0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 0x28
dec dword [reloc.WSOCK32.dll_accept]
jne 0x1400554d1
call fcn.140055568
mov rax, qword [0x1400de0c8]
xorps xmm0, xmm0
mov ecx, dword [rax]
add rax, 4
mov qword [0x1400de0c8], rax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x1400ca4b0]
add rsp, 0x28
ret

Function at 0x140055520
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r8d, 1
mov dword [0x1400de0d0], ecx
lea rdx, [0x1400de0d4]
mov ecx, r8d
mov eax, dword [rdx - 4]
shr eax, 0x1e
xor eax, dword [rdx - 4]
imul eax, eax, 0x6c078965
add eax, ecx
add ecx, r8d
mov dword [rdx], eax
lea rdx, [rdx + 4]
cmp ecx, 0x270
jl 0x140055536
mov dword [reloc.WSOCK32.dll_accept], r8d
mov dword [0x1400de0b0], r8d
ret

Function at 0x140055568
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
cmp dword [0x1400de0b0], 0
lea rbx, [0x1400de0d0]
jne 0x14005558d
xor ecx, ecx
call fcn.140028334
mov rcx, rax
call fcn.140055520
mov dword [reloc.WSOCK32.dll_accept], 0x270
mov qword [0x1400de0c8], rbx
mov r9d, 0xe3
mov r10d, 0x9908b0df
mov r11d, 0x7ffffffe
mov edx, dword [rbx + 4]
mov al, dl
and al, 1
neg al
sbb ecx, ecx
xor edx, dword [rbx]
and edx, r11d
and ecx, r10d
xor edx, dword [rbx]
shr edx, 1
xor edx, dword [rbx + 0x634]
xor edx, ecx
mov dword [rbx], edx
add rbx, 4
dec r9d
jne 0x1400555b0
mov r9d, 0x18c
lea r8, [rbx + 4]
mov edx, dword [r8]
mov al, dl
and al, 1
neg al
sbb ecx, ecx
xor edx, dword [rbx]
and edx, r11d
and ecx, r10d
xor edx, dword [rbx]
shr edx, 1
xor edx, dword [rbx - 0x38c]
xor edx, ecx
mov dword [rbx], edx
lea rbx, [r8]
dec r9d
jne 0x1400555e0
mov ecx, dword [0x1400de0d0]
mov al, cl
and al, 1
neg al
mov eax, dword [r8]
sbb edx, edx
xor eax, ecx
and eax, r11d
and edx, r10d
xor eax, dword [r8]
shr eax, 1
xor eax, dword [r8 - 0x38c]
xor eax, edx
mov dword [r8], eax
add rsp, 0x20
pop rbx
ret
Function at 0x140055b94
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov edx, 1
mov rbx, rcx
lea r8d, [rdx + 7]
cmp dword [rcx + 0x1c], edx
jne 0x140055bc5
mov edx, dword [rcx + 0x14]
add rdx, qword [rcx + 8]
lea rcx, [rsp + 0x30]
call fcn.140024790
jmp 0x140055bd3
mov r9, qword [rcx + 0x28]
lea rcx, [rsp + 0x30]
call fcn.140028784
movzx ecx, byte [rsp + 0x34]
movzx eax, byte [rsp + 0x35]
add dword [rbx + 0x14], 8
shl ecx, 8
lea rdx, str.EA06
xor ebx, ebx
or ecx, eax
movzx eax, byte [rsp + 0x36]
mov byte [rsp + 0x34], bl
shl ecx, 8
or ecx, eax
movzx eax, byte [rsp + 0x37]
shl ecx, 8
or ecx, eax
mov dword [rdi], ecx
lea rcx, [rsp + 0x30]
call fcn.140028860
test eax, eax
setne bl
mov eax, ebx
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140055ccc
Capabilities:
Read file on windows

Disassembly:
push rbx
sub rsp, 0x20
test dword [rcx + 0x484], 0xfffeffff
mov rbx, rcx
jne 0x140055d03
mov r9, qword [rcx + 0x28]
mov rcx, qword [rcx + 0x478]
mov edx, 1
mov r8d, 0x10000
call fcn.140028784
and dword [rbx + 0x484], 0
movsxd rdx, dword [rbx + 0x484]
mov rax, qword [rbx + 0x478]
mov al, byte [rdx + rax]
lea ecx, [rdx + 1]
mov dword [rbx + 0x484], ecx
add rsp, 0x20
pop rbx
ret

Function at 0x140055d24
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0x480]
mov rax, qword [rcx + 0x470]
mov rbx, rcx
mov byte [r8 + rax], dl
mov edx, 1
mov r8d, 0x10000
add dword [rcx + 0x480], edx
cmp dword [rcx + 0x480], r8d
jne 0x140055d70
mov r9, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x470]
call fcn.140026fe0
and dword [rbx + 0x480], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140055d78
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
movsxd rax, dword [rcx + 0x480]
mov rbx, rcx
test eax, eax
je 0x140055dab
mov r9, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x470]
mov r8, rax
mov edx, 1
call fcn.140026fe0
and dword [rbx + 0x480], 0
add rsp, 0x20
pop rbx
ret

Function at 0x140055fb8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov ebx, r9d
mov esi, r8d
mov rdi, rdx
call fcn.140055db4
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.140055e10
test esi, esi
je 0x140056003
mov ebx, esi
lea rcx, [rsp + 0x20]
call fcn.140055f80
xor byte [rdi], al
inc rdi
dec rbx
jne 0x140055fef
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400569a4
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x230
mov rbx, rdx
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
lea rdx, [0x1400c71a8]
lea rcx, [rsp + 0x20]
mov r9, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
add rsp, 0x230
pop rbx
ret

Function at 0x140057730
Capabilities:
Create directory
Delete directory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 8], rcx
push rbp
push rdi
push r14
lea rbp, [rax - 0x4ff68]
mov eax, 0x50050
call fcn.1400357e0
sub rsp, rax
mov sil, r9b
mov rdi, r8
mov rcx, rdx
lea r9, [rsp + 0x40]
lea r8, [rbp + 0xff50]
mov edx, 0x7fff
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor r14d, r14d
test eax, eax
jne 0x140057785
xor eax, eax
jmp 0x1400578c5
lea r8, [rbp + 0xff50]
lea rdx, str.___s
lea rcx, [rsp + 0x50]
call fcn.140025a64
lea rcx, [rsp + 0x50]
call fcn.140024e38
mov rbx, rax
cmp word [rsp + rax*2 + 0x4e], 0x5c
jne 0x1400577c0
cmp word [rsp + rax*2 + 0x4c], 0x3a
je 0x1400577c0
mov word [rsp + rax*2 + 0x4e], r14w
xor edx, edx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1400577d4
test sil, sil
je 0x14005777e
mov qword [rsp + 0x30], r14
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rdi
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140057814
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14005777e
lea rcx, [rbp + 0x1ff50]
xor edx, edx
mov r8d, 0x2fffa
call fcn.140024eb0
add bx, bx
lea rdx, [rsp + 0x50]
mov word [rbp + 0x1ff5a], bx
lea rcx, [rbp + 0x1ff60]
add bx, 2
mov r8d, 0x7fff
mov dword [rbp + 0x1ff50], 0xa0000003
mov word [rbp + 0x1ff5c], bx
call fcn.140026854
movzx eax, word [rbp + 0x1ff5a]
mov qword [rsp + 0x38], r14
add ax, 0xc
lea r8, [rbp + 0x1ff50]
mov edx, 0x900a4
movzx r9d, ax
mov word [rbp + 0x1ff54], ax
lea rax, [rbp + 0x4ff70]
mov qword [rsp + 0x30], rax
add r9d, 8
mov rcx, rsi
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rsi
test eax, eax
jne 0x1400578ba
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140057806
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea r11, [rsp + 0x50050]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14005cd64
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbp
push rbx
push rsi
push rdi
lea rbp, [rax - 0x1a8]
sub rsp, 0x288
mov rcx, rdx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov sil, bl
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14005ce10
lea rdx, [0x1400b0998]
lea rcx, [rsp + 0x5c]
call fcn.140025918
test eax, eax
je 0x14005cdfe
lea rdx, [0x1400c72a0]
lea rcx, [rsp + 0x5c]
call fcn.140025918
test eax, eax
je 0x14005cdfe
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x5c]
mov edx, eax
mov eax, dword [rbp + 0x1c8]
or edx, dword [rbp + 0x1c0]
not eax
and edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x14005ce29
mov sil, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14005cda5
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [rbp + 0x1d0], bl
jne 0x14005ce39
mov al, sil
jmp 0x14005cef6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x14005cef6
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c7298]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14005cee9
mov rsi, qword [rbp + 0x1b8]
test byte [rsp + 0x30], 0x10
je 0x14005ced3
lea rdx, [0x1400b0998]
lea rcx, [rsp + 0x5c]
call fcn.140025918
test eax, eax
je 0x14005ced3
lea rdx, [0x1400c72a0]
lea rcx, [rsp + 0x5c]
call fcn.140025918
test eax, eax
je 0x14005ced3
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov al, byte [rbp + 0x1d0]
mov r9d, dword [rbp + 0x1c8]
mov r8d, dword [rbp + 0x1c0]
mov rcx, qword [rbp + 0x1b0]
mov rdx, rsi
mov byte [rsp + 0x20], al
call fcn.14005cd64
test al, al
je 0x14005ceeb
lea rcx, [0x1400c72a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14005ce5f
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
add rsp, 0x288
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14005cf04
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x288
mov rcx, rdx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov ebp, r9d
mov sil, bl
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14005cf99
lea rdx, [0x1400b0998]
lea rcx, [rsp + 0x5c]
call fcn.140025918
test eax, eax
je 0x14005cf87
lea rdx, [0x1400c72a0]
lea rcx, [rsp + 0x5c]
call fcn.140025918
test eax, eax
je 0x14005cf87
mov rdx, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x5c]
mov r8d, ebp
call fcn.14004f864
test al, al
je 0x14005cfb7
mov sil, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14005cf41
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov bpl, byte [rsp + 0x2d0]
test bpl, bpl
jne 0x14005cfc7
mov al, sil
jmp 0x14005d082
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x14005d082
lea rdx, [rsp + 0x30]
lea rcx, [0x1400c7298]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14005d075
mov esi, dword [rsp + 0x2c8]
test byte [rsp + 0x30], 0x10
je 0x14005d05f
lea rdx, [0x1400b0998]
lea rcx, [rsp + 0x5c]
call fcn.140025918
test eax, eax
je 0x14005d05f
lea rdx, [0x1400c72a0]
lea rcx, [rsp + 0x5c]
call fcn.140025918
test eax, eax
je 0x14005d05f
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2b0]
mov r9d, esi
mov byte [rsp + 0x20], bpl
call fcn.14005cf04
test al, al
je 0x14005d077
lea rcx, [0x1400c72a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14005cfed
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
add rsp, 0x288
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14005d2b8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
lea rbp, [rax - 0x1f8]
sub rsp, 0x2e0
lea rcx, [rsp + 0x48]
call fcn.140012aec
mov rax, qword [rsp + 0x48]
lea rdx, [0x1400c7298]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x50]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
inc dword [rax]
mov qword [rbp - 0x80], rax
call fcn.1400040c0
mov rcx, qword [rsp + 0x48]
lea rdx, [rbp - 0x70]
mov bl, 1
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14005d469
mov sil, byte [rbp + 0x228]
mov rdi, qword [rbp + 0x220]
mov rcx, qword [rbp + 0x200]
call fcn.14000d650
cmp eax, 1
je 0x14005d462
cmp eax, 0xb
jne 0x14005d373
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14005d34e
lea rdx, [0x1400b0998]
lea rcx, [rbp - 0x44]
call fcn.140025918
test eax, eax
je 0x14005d449
lea rdx, [0x1400c72a0]
lea rcx, [rbp - 0x44]
call fcn.140025918
test eax, eax
je 0x14005d449
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.1400075d4
lea rdx, [rbp - 0x44]
lea rcx, [rsp + 0x48]
call fcn.1400040c0
test byte [rbp - 0x70], 0x10
je 0x14005d423
test sil, sil
je 0x14005d3ce
inc qword [rdi]
cmp byte [rbp + 0x230], 0
je 0x14005d449
lea rdx, [0x1400b0b70]
lea rcx, [rsp + 0x48]
call fcn.1400040c0
mov al, byte [rbp + 0x230]
mov r9, qword [rbp + 0x218]
mov r8, qword [rbp + 0x210]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rbp + 0x200]
mov byte [rsp + 0x30], al
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x20], rdi
call fcn.14005d2b8
mov bl, al
test al, al
je 0x14005d464
jmp 0x14005d449
mov eax, dword [rbp - 0x50]
mov ecx, dword [rbp - 0x54]
shl rcx, 0x20
or rcx, rax
mov rax, qword [rbp + 0x210]
add qword [rax], rcx
test sil, sil
je 0x14005d449
mov rax, qword [rbp + 0x218]
inc qword [rax]
mov rcx, qword [rsp + 0x40]
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x14005d34e
jmp 0x14005d464
xor bl, bl
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.14000838c
lea rcx, [rsp + 0x48]
call fcn.14000838c
mov al, bl
mov rbx, qword [rsp + 0x308]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret