joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001a58c
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov edi, edx
mov rbx, rcx
mov word [rcx + 0x46a], si
mov ebp, 0x10000
dec edi
cmp dword [rbx + 0x46c], esi
jne 0x14001a69b
cmp dword [rbx + 0x1c], 1
jne 0x14001a5f8
mov ecx, dword [rbx + 0x14]
mov r8, qword [rbx + 8]
movzx eax, byte [rcx + r8]
lea edx, [rcx + 1]
shl eax, 8
mov dword [rbx + 0x14], edx
or dword [rbx + 0x468], eax
movzx ecx, byte [rdx + r8]
lea eax, [rdx + 1]
or dword [rbx + 0x468], ecx
mov dword [rbx + 0x14], eax
jmp 0x14001a691
mov eax, dword [rbx + 0x48c]
cmp eax, esi
je 0x14001a606
cmp eax, ebp
jne 0x14001a624
mov r9, qword [rbx + 0x28]
mov rcx, qword [rbx + 0x480]
mov r8, rbp
mov edx, 1
call fcn.140077d08
mov dword [rbx + 0x48c], esi
movsxd rcx, dword [rbx + 0x48c]
mov r10, qword [rbx + 0x480]
movzx eax, byte [rcx + r10]
inc ecx
shl eax, 8
mov dword [rbx + 0x48c], ecx
or dword [rbx + 0x468], eax
cmp ecx, esi
je 0x14001a650
cmp ecx, ebp
jne 0x14001a66a
mov r9, qword [rbx + 0x28]
mov r8, rbp
mov edx, 1
mov rcx, r10
call fcn.140077d08
mov dword [rbx + 0x48c], esi
movsxd r8, dword [rbx + 0x48c]
mov rax, qword [rbx + 0x480]
movzx edx, byte [r8 + rax]
lea eax, [r8 + 1]
or dword [rbx + 0x468], edx
add dword [rbx + 0x14], 2
mov dword [rbx + 0x48c], eax
mov dword [rbx + 0x46c], 0x10
shl dword [rbx + 0x468], 1
dec dword [rbx + 0x46c]
mov eax, dword [rbx + 0x468]
cmp edi, esi
jne 0x14001a5b3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
shr eax, 0x10
add rsp, 0x20
pop rdi
ret

Function at 0x14001a6d0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
add rcx, 0x44
lea r8d, [rdx + 8]
call fcn.1400761e0
mov dword [rbx + 0x34], 0x67452301
mov dword [rbx + 0x38], 0xefcdab89
mov dword [rbx + 0x3c], 0x98badcfe
mov dword [rbx + 0x40], 0x10325476
add rsp, 0x20
pop rbx
ret
Function at 0x14001b320
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x1d0
mov rdi, rcx
mov rsi, rdx
lea rcx, [0x1400956d0]
or edx, 0xffffffff
call fcn.140013b14
lea rcx, [rsp + 0xc0]
mov rdx, rax
mov rbx, rax
call fcn.140076ad0
mov rcx, rbx
call fcn.140075884
lea rcx, [rsp + 0x30]
call fcn.14001a6d0
lea rcx, [rsp + 0xc0]
call fcn.1400768c0
lea rcx, [rsp + 0x30]
mov rbx, rax
call fcn.14001a6d0
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x30]
mov r8d, ebx
call fcn.14001a70c
lea rcx, [rsp + 0x30]
call fcn.14001a7c0
xor ebx, ebx
mov dword [rdi + 0xc], ebx
mov rcx, rbx
mov edx, ebx
movzx eax, byte [rsp + rcx + 0x30]
inc rcx
add edx, eax
cmp rcx, 0x10
jl 0x14001b3af
mov dword [rdi + 0xc], edx
lea rdx, [0x140097f10]
mov rcx, rsi
call fcn.1400774dc
mov qword [rdi], rax
cmp rax, rbx
jne 0x14001b3e0
mov eax, 1
jmp 0x14001b44f
mov rcx, rdi
call fcn.14001b464
mov esi, eax
cmp eax, ebx
je 0x14001b3fa
mov rcx, qword [rdi]
call fcn.140077974
mov eax, esi
jmp 0x14001b44f
mov r9, qword [rdi]
mov edx, 1
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 0xf]
call fcn.140077d08
lea rdx, [rsp + 0x20]
mov r9d, 0x99f2
mov r8d, reloc.WSOCK32.dll_recv
mov rcx, rdi
call fcn.14001b5b4
mov dword [rdi + 0xc], ebx
mov ecx, ebx
movzx eax, byte [rsp + rbx + 0x20]
inc rbx
imul ecx, eax
cmp rbx, 0x10
jl 0x14001b42e
mov dword [rdi + 0xc], ecx
mov rcx, qword [rdi]
call fcn.14007934c
mov dword [rdi + 8], eax
xor eax, eax
lea r11, [rsp + 0x1d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14001b464
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x10040
call fcn.140090020
sub rsp, rax
xor edx, edx
mov rbx, rcx
lea rcx, [0x140000000]
lea esi, [rdx + 1]
mov al, byte [rdx + rcx + 0xa82f0]
mov byte [rsp + rdx + 0x20], al
mov al, byte [rdx + rcx + 0xa8078]
mov byte [rsp + rdx + 0x28], al
add rdx, rsi
cmp rdx, 8
jl 0x14001b48b
lea rdx, str.AU3_
lea rcx, [rsp + 0x10058]
call fcn.140076ad0
lea rdx, [rsp + 0x10058]
lea rcx, [rsp + 0x30]
mov r8d, 4
call fcn.1400753d0
xor edi, edi
mov r9, qword [rbx]
lea rcx, [rsp + 0x40]
mov r8d, 0x10000
mov rdx, rsi
call fcn.140077d08
cmp eax, 0x18
mov r11, rax
jl 0x14001b599
lea r10d, [rax - 0x14]
xor edx, edx
test r10d, r10d
jle 0x14001b535
lea r8, [rsp + 0x40]
xor r9d, r9d
xor ecx, ecx
mov al, byte [r8 + rcx]
cmp byte [rsp + rcx + 0x20], al
jne 0x14001b525
add rcx, rsi
add r9d, esi
cmp rcx, 0x14
jl 0x14001b50f
cmp r9d, 0x14
je 0x14001b54c
add edx, esi
add r8, rsi
cmp edx, r10d
jl 0x14001b50a
mov rcx, qword [rbx]
mov r8d, esi
mov edx, 0xffffffec
lea edi, [rdi + r11 - 0x14]
call fcn.14007759c
jmp 0x14001b4d8
mov rcx, qword [rbx]
lea edx, [rdi + rdx + 0x14]
xor r8d, r8d
call fcn.14007759c
mov r9, qword [rbx]
lea rcx, [rsp + 0x10058]
mov r8d, 4
mov rdx, rsi
call fcn.140077d08
lea rdx, str.EA06
lea rcx, [rsp + 0x10058]
mov byte [rsp + 0x1005c], 0
call fcn.140077180
neg eax
sbb eax, eax
and eax, 4
jmp 0x14001b59e
mov eax, 3
lea r11, [rsp + 0x10040]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14001b5b4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x100
lea rcx, [rsp + 0x20]
mov ebx, r9d
mov edi, r8d
mov rsi, rdx
call fcn.14001b144
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.14001b294
test edi, edi
je 0x14001b624
mov rbx, rdi
lea rcx, [rsp + 0x20]
call fcn.14001b1a0
lea rcx, [rsp + 0x20]
call fcn.14001b1a0
mov ecx, 0xff
mulsd xmm0, qword [0x14009da80]
cvttsd2si eax, xmm0
cmp eax, 0x100
cmovge eax, ecx
xor byte [rsi], al
inc rsi
sub rbx, 1
jne 0x14001b5ec
lea r11, [rsp + 0x100]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14001bb30
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x6d0
xor ebp, ebp
mov rdi, rdx
mov edx, dword [rcx + 8]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rbp
mov dword [rsp + 0x40], ebp
mov dword [rsp + 0x44], ebp
mov dword [rsp + 0x48], ebp
mov dword [rsp + 0x4c], ebp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rbp
mov word [rsp + 0x68], bp
mov r12, rcx
mov rcx, qword [rcx]
mov r13, r8
lea r15d, [rbp + 1]
xor r8d, r8d
mov ebx, r15d
mov rsi, r9
mov word [rax - 0x486], bp
mov dword [rsp + 0x24], ebx
mov qword [rax - 0x258], rbp
call fcn.14007759c
lea r8, [rsp + 0x4c0]
xor r9d, r9d
mov rdx, rdi
mov rcx, r12
call fcn.14001bd70
cmp eax, ebp
je 0x14001bbd3
lea eax, [rbp + 6]
jmp 0x14001bd4d
mov r9, qword [r12]
lea rcx, [rsp + 0x700]
mov r8, r15
mov rdx, r15
call fcn.140077d08
mov r9, qword [r12]
mov ebp, 4
lea rcx, [rsp + 0x20]
mov rdx, rbp
mov r8, r15
call fcn.140077d08
mov r14d, dword [rsp + 0x20]
mov r9, qword [r12]
lea rcx, [rsp + 0x20]
mov edi, 0x87bc
mov r8, r15
mov rdx, rbp
xor r14d, edi
call fcn.140077d08
mov r11d, dword [rsp + 0x20]
mov r9, qword [r12]
xor r11d, edi
lea rcx, [rsp + 0x20]
mov r8, r15
mov rdx, rbp
mov dword [rsi], r11d
call fcn.140077d08
mov r15d, dword [rsp + 0x20]
mov rcx, qword [r12]
lea edx, [rbp + 0xc]
mov r8d, ebx
xor r15d, 0xa685
call fcn.14007759c
mov ecx, dword [rsi]
call fcn.140076968
movsxd rdi, r14d
mov rcx, rdi
mov rsi, rax
call fcn.140076968
mov r9, qword [r12]
mov r8, rbx
mov rcx, rax
mov rdx, rdi
mov rbp, rax
call fcn.140077d08
mov r9d, dword [r12 + 0xc]
mov r8d, r14d
mov rdx, rbp
mov rcx, r12
add r9d, 0x2477
call fcn.14001b5b4
xor edi, edi
cmp r14d, edi
je 0x14001bcbd
lea rcx, [rsp + 0x24]
mov r8d, r14d
mov rdx, rbp
call fcn.140019ffc
mov ebx, dword [rsp + 0x24]
cmp r15d, ebx
je 0x14001bcd9
mov rcx, rsi
call fcn.140076b88
mov rcx, rbp
call fcn.140076b88
mov eax, 0xa
jmp 0x14001bd4d
cmp byte [rsp + 0x700], 1
jne 0x14001bd3c
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], edi
mov dword [rsp + 0x44], edi
mov dword [rsp + 0x48], edi
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rdi
mov word [rsp + 0x68], di
mov word [rsp + 0x272], di
mov qword [rsp + 0x4a0], rdi
mov dword [rsp + 0x4c], 1
mov dword [rsp + 0x50], 1
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], rsi
call fcn.14001a064
mov rcx, rbp
call fcn.140076b88
jmp 0x14001bd47
mov rcx, rsi
call fcn.140076b88
mov rsi, rbp
mov qword [r13], rsi
xor eax, eax
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14001bd70
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x450
xor ebx, ebx
mov r14, r8
mov r13, rdx
lea r15d, [rbx + 1]
mov rsi, rcx
mov r12d, ebx
mov bpl, r15b
lea edi, [rbx + 4]
mov r9, qword [rsi]
lea rcx, [rsp + 0x24]
mov r8, rdi
mov rdx, r15
call fcn.140077d08
lea rdx, [rsp + 0x24]
mov r9d, 0x18ee
mov r8d, edi
mov rcx, rsi
call fcn.14001b5b4
lea rdx, str.FILE
lea rcx, [rsp + 0x24]
mov byte [rsp + 0x28], bl
call fcn.140077180
cmp eax, ebx
jne 0x14001bf2f
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r15
mov rdx, rdi
add r12d, r15d
call fcn.140077d08
mov edi, dword [rsp + 0x20]
mov r9, qword [rsi]
xor edi, 0xadbc
lea rcx, [rsp + 0x30]
mov rdx, r15
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.140077d08
lea r9d, [rdi + 0xb33f]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.14001b5b4
movsxd r11, edi
xor eax, eax
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x240]
mov word [rsp + r11*2 + 0x30], ax
call fcn.140075b0c
mov r9, qword [rsi]
lea rcx, [rsp + 0x20]
mov r8, r15
mov edx, 4
call fcn.140077d08
mov edi, dword [rsp + 0x20]
mov r9, qword [rsi]
xor edi, 0xf820
lea rcx, [rsp + 0x30]
mov rdx, r15
lea ebx, [rdi + rdi]
movsxd r8, ebx
call fcn.140077d08
lea r9d, [rdi + 0xf479]
lea rdx, [rsp + 0x30]
mov r8d, ebx
mov rcx, rsi
call fcn.14001b5b4
movsxd r11, edi
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov rcx, r14
mov word [rsp + r11*2 + 0x30], bx
call fcn.140075b0c
lea rcx, [rsp + 0x240]
mov rdx, r13
call fcn.140076450
cmp eax, ebx
je 0x14001bf61
lea rdx, [0x1400985a0]
mov rcx, r13
call fcn.140076450
cmp eax, ebx
jne 0x14001beeb
cmp r12d, ebx
je 0x14001bf61
mov rcx, qword [rsi]
mov r8d, r15d
mov edx, r15d
call fcn.14007759c
mov r9, qword [rsi]
mov edi, 4
lea rcx, [rsp + 0x2c]
mov rdx, rdi
mov r8, r15
call fcn.140077d08
mov edx, dword [rsp + 0x2c]
mov rcx, qword [rsi]
xor edx, 0x87bc
mov r8d, r15d
mov dword [rsp + 0x2c], edx
add edx, 0x18
call fcn.14007759c
jmp 0x14001bf32
mov bpl, bl
cmp bpl, r15b
je 0x14001bda7
mov eax, 6
lea r11, [rsp + 0x450]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor eax, eax
jmp 0x14001bf40
Function at 0x140029a44
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x288
mov rcx, rdx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov ebp, r9d
mov sil, bl
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140029ae9
lea rdx, [0x140098004]
lea rcx, [rsp + 0x5c]
call fcn.140076450
cmp eax, ebx
je 0x140029ac7
lea rdx, [0x14009b2a0]
lea rcx, [rsp + 0x5c]
call fcn.140076450
cmp eax, ebx
je 0x140029ac7
mov rdx, qword [rsp + 0x2c0]
lea rcx, [rsp + 0x5c]
mov r8d, ebp
call fcn.1400119b4
cmp al, bl
je 0x140029ad9
mov sil, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jmp 0x140029a7f
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x140029bc2
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov bpl, byte [rsp + 0x2d0]
cmp bpl, bl
jne 0x140029b07
mov al, sil
jmp 0x140029bc2
lea rdx, [rsp + 0x30]
lea rcx, [0x14009b298]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140029bb5
mov esi, dword [rsp + 0x2c8]
test byte [rsp + 0x30], 0x10
je 0x140029b9f
lea rdx, [0x140098004]
lea rcx, [rsp + 0x5c]
call fcn.140076450
cmp eax, ebx
je 0x140029b9f
lea rdx, [0x14009b2a0]
lea rcx, [rsp + 0x5c]
call fcn.140076450
cmp eax, ebx
je 0x140029b9f
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2b0]
mov r9d, esi
mov byte [rsp + 0x20], bpl
call fcn.140029a44
cmp al, bl
je 0x140029bb7
lea rcx, [0x14009b2a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jne 0x140029b2d
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
add rsp, 0x288
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002b96c
Capabilities:
Create directory
Delete directory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0xa90
mov dil, r9b
mov rbx, r8
mov rcx, rdx
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x880]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor esi, esi
cmp eax, esi
jne 0x14002b9ac
xor eax, eax
jmp 0x14002bb0d
lea r8, [rsp + 0x880]
lea rdx, str.___s
lea rcx, [rsp + 0x50]
call fcn.14007659c
lea rcx, [rsp + 0x50]
call fcn.140075704
cmp word [rsp + rax*2 + 0x4e], 0x5c
jne 0x14002b9f8
lea rcx, [rsp + 0x50]
call fcn.140075704
cmp word [rsp + rax*2 + 0x4c], 0x3a
je 0x14002b9f8
lea rcx, [rsp + 0x50]
call fcn.140075704
mov word [rsp + rax*2 + 0x4e], si
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, esi
jne 0x14002ba0c
cmp dil, sil
je 0x14002b9a5
mov qword [rsp + 0x30], rsi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rbx
mov dword [rsp + 0x28], 0x2200000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002ba4c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x14002b9a5
xor edx, edx
lea rcx, [rsp + 0x260]
lea r8d, [rdx + 0x14]
call fcn.1400761e0
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x260], 0xa0000003
call fcn.140075704
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x270]
add ax, ax
mov r8d, 0x104
mov word [rsp + 0x26a], ax
add ax, 2
mov word [rsp + 0x26c], ax
call fcn.1400762cc
movzx r11d, word [rsp + 0x26a]
add r11w, 0xc
mov qword [rsp + 0x38], rsi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
movzx r9d, r11w
lea r8, [rsp + 0x260]
mov edx, 0x900a4
mov rcx, rdi
add r9d, 8
mov dword [rsp + 0x28], esi
mov word [rsp + 0x264], r11w
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, rdi
cmp eax, esi
jne 0x14002bb02
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14002ba3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
lea r11, [rsp + 0xa90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x14002cab4
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
mov rax, rsp
mov dword [rax + 0x20], r9d
mov dword [rax + 0x18], r8d
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x288
mov rcx, rdx
lea rdx, [rsp + 0x30]
xor ebx, ebx
mov ebp, r9d
mov sil, bl
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002cb69
lea rdx, [0x140098004]
lea rcx, [rsp + 0x5c]
call fcn.140076450
cmp eax, ebx
je 0x14002cb47
lea rdx, [0x14009b2a0]
lea rcx, [rsp + 0x5c]
call fcn.140076450
cmp eax, ebx
je 0x14002cb47
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea rcx, [rsp + 0x5c]
mov edx, eax
mov eax, ebp
or edx, dword [rsp + 0x2c0]
not eax
and edx, eax
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
cmp eax, ebx
je 0x14002cb59
mov sil, 1
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jmp 0x14002caef
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x14002cc42
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov bpl, byte [rsp + 0x2d0]
cmp bpl, bl
jne 0x14002cb87
mov al, sil
jmp 0x14002cc42
lea rdx, [rsp + 0x30]
lea rcx, [0x14009b298]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14002cc35
mov esi, dword [rsp + 0x2c8]
test byte [rsp + 0x30], 0x10
je 0x14002cc1f
lea rdx, [0x140098004]
lea rcx, [rsp + 0x5c]
call fcn.140076450
cmp eax, ebx
je 0x14002cc1f
lea rdx, [0x14009b2a0]
lea rcx, [rsp + 0x5c]
call fcn.140076450
cmp eax, ebx
je 0x14002cc1f
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov r8d, dword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2b0]
mov r9d, esi
mov byte [rsp + 0x20], bpl
call fcn.14002cab4
cmp al, bl
je 0x14002cc37
lea rcx, [0x14009b2a0]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
jne 0x14002cbad
mov bl, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov al, bl
add rsp, 0x288
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14002db84
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], r9
mov qword [rax + 0x18], r8
mov qword [rax + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x2e0
lea rcx, [rsp + 0x48]
call fcn.140001d54
mov rax, qword [rsp + 0x50]
mov r11, qword [rsp + 0x48]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x58]
lea rdx, [0x14009b298]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
inc dword [rax]
mov qword [rsp + 0x68], r11
mov qword [rsp + 0x80], rax
call fcn.140001ef4
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x90]
mov bl, 1
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov qword [rsp + 0x40], rax
cmp rax, 0xffffffffffffffff
je 0x14002dd58
mov bpl, byte [rsp + 0x330]
mov sil, byte [rsp + 0x328]
mov rdi, qword [rsp + 0x320]
mov rcx, qword [rsp + 0x300]
call fcn.140025bbc
cmp eax, 1
je 0x14002dd51
cmp eax, 0xb
jne 0x14002dc4b
lea ecx, [rax - 1]
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002dc25
lea rdx, [0x140098004]
lea rcx, [rsp + 0xbc]
call fcn.140076450
test eax, eax
je 0x14002dd35
lea rdx, [0x14009b2a0]
lea rcx, [rsp + 0xbc]
call fcn.140076450
test eax, eax
je 0x14002dd35
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x48]
call fcn.140001e80
lea rdx, [rsp + 0xbc]
lea rcx, [rsp + 0x48]
call fcn.140001ef4
test byte [rsp + 0x90], 0x10
je 0x14002dd05
test sil, sil
je 0x14002dcb6
inc qword [rdi]
test bpl, bpl
je 0x14002dd35
lea rdx, [0x140095dac]
lea rcx, [rsp + 0x48]
call fcn.140001ef4
mov r9, qword [rsp + 0x318]
mov r8, qword [rsp + 0x310]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x300]
mov byte [rsp + 0x30], bpl
mov byte [rsp + 0x28], sil
mov qword [rsp + 0x20], rdi
call fcn.14002db84
mov bl, al
test al, al
je 0x14002dd53
jmp 0x14002dd35
mov eax, dword [rsp + 0xb0]
mov ecx, dword [rsp + 0xac]
shl rcx, 0x20
or rcx, rax
mov rax, qword [rsp + 0x310]
add qword [rax], rcx
test sil, sil
je 0x14002dd35
mov rax, qword [rsp + 0x318]
inc qword [rax]
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x14002dd53
jmp 0x14002dc25
xor bl, bl
mov rax, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rcx, [rsp + 0x68]
call fcn.140001e50
lea rcx, [rsp + 0x48]
call fcn.140001e50
mov al, bl
mov rbx, qword [rsp + 0x308]
add rsp, 0x2e0
pop rdi
pop rsi
pop rbp
ret
Function at 0x140032184
Capabilities:
Connect to http server

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov sil, r9b
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
je 0x1400321b3
mov r8b, r9b
call fcn.1400322cc
jmp 0x1400322b5
mov ebp, dword [rcx + 0x90]
mov rcx, qword [rdx + 0x60]
mov eax, dword [rdx + 0xe0]
and qword [rsp + 0x38], 0
and dword [rsp + 0x30], 0
mov r9, qword [rdx + 0x40]
movzx r8d, word [rdx + 0xe8]
mov rdx, qword [rdx + 0x20]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 8]
call qword [sym.imp.WININET.dll_InternetConnectW]
mov qword [rbx], rax
test rax, rax
jne 0x140032222
mov dword [rbx + 0x20], reloc.WSOCK32.dll_setsockopt
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x24], eax
mov rcx, qword [rbx + 0x190]
test rcx, rcx
je 0x14003221b
call qword [sym.imp.KERNEL32.dll_SetEvent]
xor al, al
jmp 0x1400322b5
mov rdx, qword [rdi + 0xc0]
and qword [rsp + 0x20], 0
mov r9d, ebp
mov r8d, 0x80000000
mov rcx, rax
call qword [sym.imp.WININET.dll_FtpOpenFileW]
mov rdi, rax
test rax, rax
jne 0x140032252
mov dword [rbx + 0x20], SafeArrayGetElement
jmp 0x140032200
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.WININET.dll_FtpGetFileSize]
mov ecx, dword [rsp + 0x60]
shl rcx, 0x20
mov eax, eax
or rcx, rax
mov qword [rbx + 0x18], rcx
test sil, sil
je 0x140032292
cmp byte [rbx + 0x48], 0
mov rdx, rdi
mov rcx, rbx
je 0x140032289
call fcn.140032644
jmp 0x14003228e
call fcn.1400324e8
mov bl, al
jmp 0x1400322aa
and dword [rbx + 0x20], 0
mov rcx, qword [rbx + 0x190]
test rcx, rcx
je 0x1400322a8
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov bl, 1
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
Function at 0x1400322cc
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x60
mov eax, dword [rcx + 0x90]
and qword [rsp + 0x28], 0
mov rsi, rdx
mov rdx, qword [rcx + 0x28]
mov rbx, rcx
mov rcx, qword [rcx + 8]
and eax, 0x80000000
mov bpl, r8b
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], eax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
test rax, rax
jne 0x14003233d
mov dword [rbx + 0x20], reloc.OLEAUT32.dll_SafeArrayCreateEx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x24], eax
mov rcx, qword [rbx + 0x190]
test rcx, rcx
je 0x1400324d5
call qword [sym.imp.KERNEL32.dll_SetEvent]
jmp 0x1400324d5
mov ecx, dword [rsi + 0xe0]
lea rax, [rbx + 0x108]
lea r8, [rbx + 0xa0]
cmp ecx, 1
lea rsi, [rbx + 0xc0]
cmove r8, rax
lea rax, [rbx + 0x128]
cmp ecx, 1
cmove rsi, rax
mov rax, qword [r8 + 8]
test rax, rax
je 0x1400323a3
mov r8, qword [r8]
lea r9d, [rax + 1]
mov edx, 0x2b
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetSetOptionW]
mov r9d, dword [rsi + 8]
mov r8, qword [rsi]
inc r9d
mov edx, 0x2c
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetSetOptionW]
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WININET.dll_HttpSendRequestW]
test eax, eax
je 0x1400324aa
and dword [rsp + 0x80], 0
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x30]
mov edx, 0x20000013
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x98], 4
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
or ecx, 0xffffffff
test eax, eax
cmovne ecx, dword [rsp + 0x30]
cmp ecx, 0xc8
jne 0x1400324aa
and dword [rsp + 0x80], 0
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x98]
lea r8, [rsp + 0x38]
mov edx, 5
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x98], SafeArrayDestroyDescriptor
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
lea rcx, [rsp + 0x38]
call fcn.140076490
mov qword [rbx + 0x18], rax
test bpl, bpl
je 0x140032487
cmp byte [rbx + 0x48], 0
mov rdx, rdi
mov rcx, rbx
je 0x140032473
call fcn.140032644
jmp 0x140032478
call fcn.1400324e8
mov rcx, rdi
mov bl, al
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, bl
jmp 0x1400324d7
and dword [rbx + 0x20], 0
mov rcx, qword [rbx + 0x190]
test rcx, rcx
je 0x14003249d
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov al, 1
jmp 0x1400324d7
mov dword [rbx + 0x20], 0x2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbx + 0x24], eax
mov rcx, qword [rbx + 0x190]
test rcx, rcx
je 0x1400324cc
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
mov rbx, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret