joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010980
Capabilities:
Extract resource via kernel32 functions
Import public key

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
lea r8, str.CERTIFICATE
xor ecx, ecx
mov edx, 0xc7
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x140010a5a
mov rdx, rax
mov qword [rsp + 0x40], rbp
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rbx
xor ecx, ecx
mov ebp, eax
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x140010a55
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x140010a55
mov r9d, 1
mov qword [rsp + 0x48], rsi
xor r8d, r8d
mov dword [rsp + 0x20], 0
xor edx, edx
lea rcx, [rdi + 0xa88]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140010a50
mov r8d, ebp
mov rdx, rbx
mov ecx, 1
call qword [sym.imp.CRYPT32.dll_CertCreateCertificateContext]
mov rbx, rax
test rax, rax
je 0x140010a50
mov r8, qword [rax + 0x18]
lea r9, [rdi + 0xa90]
mov rcx, qword [rdi + 0xa88]
add r8, 0x60
mov edx, 1
call qword [sym.imp.CRYPT32.dll_CryptImportPublicKeyInfo]
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x140010a70
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x250
mov rax, qword [0x140114720]
xor rax, rsp
mov qword [rsp + 0x240], rax
cmp dword [rcx + 0x10], 0
mov rbx, rcx
je 0x140010a9b
mov al, 1
jmp 0x140010b23
lea rdx, [rsp + 0x30]
mov ecx, 0x103
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x102
ja 0x140010b40
lea r9, [rbx + 0x418]
mov qword [rsp + 0x268], rdi
xor r8d, r8d
lea rdx, str.UkUpdate
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x140010b3c
lea rdx, [rbx + 0x18]
mov dword [rbx + 0xa48], 0
lea rcx, [rbx + 0xa50]
mov qword [rsp + 0x20], rbx
lea r9, [0x1400101d0]
lea r8, [rbx + 0x418]
call fcn.140002eb0
test rax, rax
je 0x140010b3c
mov dword [rbx + 0x10], 1
mov al, 1
mov rdi, qword [rsp + 0x268]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.1400264d0
add rsp, 0x250
pop rbx
ret
xor al, al
jmp 0x140010b1b
xor al, al
jmp 0x140010b23
Function at 0x140011940
Capabilities:
Query or enumerate registry value

Disassembly:
push rdi
sub rsp, 0x170
mov rax, qword [0x140114720]
xor rax, rsp
mov qword [rsp + 0x160], rax
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x114
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
xor edi, edi
lea rax, [rsp + 0x30]
cmp dword [rsp + 0x50], 2
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
mov ecx, edi
mov qword [rsp + 0x20], rax
setne cl
xor r8d, r8d
add rcx, 0xffffffff80000001
lea r9d, [rdi + 3]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1400119a7
xor eax, eax
jmp 0x1400119ee
mov rcx, qword [rsp + 0x30]
lea rdx, [0x1400cf5b0]
mov qword [rsp + 0x28], rdi
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x180], rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov rcx, qword [rsp + 0x30]
mov ebx, eax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
mov rbx, qword [rsp + 0x180]
sete dil
mov eax, edi
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400264d0
add rsp, 0x170
pop rdi
ret
Function at 0x140019ab0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rsi
mov rdi, r9
mov r11, r8
mov rsi, rdx
mov r10, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
mov r8, qword [r10 + 0x30]
and r8, r9
shl r8, 4
mov rbx, qword [r10 + 0x18]
mov rax, qword [rbx + r8]
cmp rax, qword [r10 + 8]
jne 0x140019b40
mov rbx, qword [r10 + 8]
jmp 0x140019b48
mov rbx, qword [rbx + r8 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140019b90
mov ecx, dword [r11]
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140019b60
cmp rbx, rax
jne 0x140019b50
jmp 0x140019b90
mov rcx, qword [rdi + 8]
mov rax, qword [rdi]
mov qword [rcx], rax
mov rcx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
dec qword [r10 + 0x10]
mov rcx, rdi
call fcn.1400271c4
mov qword [rsi], rbx
mov byte [rsi + 8], 0
mov rax, rsi
jmp 0x140019c27
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140019bca
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r10 + 0x18]
add rdx, r8
mov rax, qword [rdx]
cmp rax, qword [r10 + 8]
jne 0x140019be8
mov qword [rdx], rdi
mov rax, qword [r10 + 0x18]
mov qword [rax + r8 + 8], rdi
jmp 0x140019c14
cmp rax, rbx
jne 0x140019bf2
mov qword [rdx], rdi
jmp 0x140019c14
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140019c14
mov rdx, qword [r10 + 0x18]
mov rax, qword [rdx + r8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r8 + 8], rcx
mov rcx, r10
call fcn.14001dfe0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x140019c40
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push r12
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
mov rsi, rdx
mov r14, rcx
movzx r9d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r9, rax
movabs rcx, 0x100000001b3
imul r9, rcx
movzx eax, byte [r8 + 1]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 2]
xor r9, rax
imul r9, rcx
movzx eax, byte [r8 + 3]
xor r9, rax
imul r9, rcx
mov r12, qword [r14 + 0x30]
and r12, r9
shl r12, 4
mov rbx, qword [r14 + 0x18]
mov rax, qword [rbx + r12]
cmp rax, qword [r14 + 8]
jne 0x140019ccf
mov rbx, qword [r14 + 8]
jmp 0x140019cd7
mov rbx, qword [rbx + r12 + 8]
mov rbx, qword [rbx]
cmp rbx, rax
je 0x140019cff
mov ecx, dword [r8]
nop
mov rbx, qword [rbx + 8]
cmp ecx, dword [rbx + 0x10]
je 0x140019cf0
cmp rbx, rax
jne 0x140019ce0
jmp 0x140019cff
mov qword [rdx], rbx
mov byte [rdx + 8], 0
mov rax, rsi
jmp 0x140019dea
mov rax, qword [r14 + 8]
mov rdi, qword [rax]
mov r9, r8
mov r8, qword [rdi + 8]
mov rdx, rdi
lea rcx, [r14 + 8]
call fcn.1400199f0
mov rdx, rax
movabs rcx, 0x666666666666665
sub rcx, qword [r14 + 0x10]
cmp rcx, 1
jae 0x140019d3d
lea rcx, str.list_T__too_long
call fcn.1400289e4
int3
inc qword [r14 + 0x10]
mov qword [rdi + 8], rdx
mov rax, qword [rax + 8]
mov qword [rax], rdx
mov rdi, qword [r14 + 8]
mov rdi, qword [rdi]
mov qword [rsp + 0x20], rdi
mov rax, qword [rdi]
cmp rbx, rax
je 0x140019d8d
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x18]
add rdx, r12
mov rax, qword [rdx]
cmp rax, qword [r14 + 8]
jne 0x140019dab
mov qword [rdx], rdi
mov rax, qword [r14 + 0x18]
mov qword [rax + r12 + 8], rdi
jmp 0x140019dd7
cmp rax, rbx
jne 0x140019db5
mov qword [rdx], rdi
jmp 0x140019dd7
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x140019dd7
mov rdx, qword [r14 + 0x18]
mov rax, qword [rdx + r12 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + r12 + 8], rcx
mov rcx, r14
call fcn.14001dfe0
nop
mov qword [rsi], rdi
mov byte [rsi + 8], 1
mov rax, rsi
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x14001bfd0
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0xa0
mov rax, qword [0x140114720]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor edi, edi
mov byte [0x1401257e8], 0
mov dword [0x1401257e4], edi
mov dword [0x1401257e0], edi
mov qword [0x1401257d0], rdi
mov qword [0x1401257d8], rdi
mov byte [0x140124e66], 1
mov byte [0x140124e67], 0
mov byte [0x1401257f0], 0
call qword [sym.imp.USER32.dll_GetForegroundWindow]
test rax, rax
je 0x14001c24b
lea rdx, [0x1401257e4]
mov qword [0x1401257d0], rax
mov rcx, rax
mov qword [0x1401257d8], rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [0x1401257e0], eax
test eax, eax
je 0x14001c24b
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x48
mov ecx, eax
call qword [sym.imp.USER32.dll_GetGUIThreadInfo]
test eax, eax
je 0x14001c24b
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x30]
mov rax, qword [rsp + 0x48]
mov qword [0x1401257d0], rcx
mov qword [0x1401257d8], rax
mov dword [rsp + 0x30], edi
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
je 0x14001c1e6
mov r8d, dword [rsp + 0x30]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0xb0], rbx
movzx edx, r8b
xor rdx, rax
movzx eax, byte [rsp + 0x31]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x32]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x33]
imul rdx, rcx
xor rdx, rax
imul rdx, rcx
mov rcx, qword [0x140127930]
and rdx, qword [0x140127948]
mov rbx, rdx
add rbx, rbx
lea rax, [rdx + rdx]
mov rdx, qword [rcx + rax*8]
lea r9, [rcx + rax*8]
mov rbx, qword [rcx + rbx*8]
mov rcx, qword [0x140127920]
cmp rdx, rcx
jne 0x14001c12f
mov rax, rcx
jmp 0x14001c136
mov rax, qword [r9 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14001c197
cmp r8d, dword [rbx + 0x10]
je 0x14001c146
mov rbx, qword [rbx]
jmp 0x14001c125
cmovne rbx, rcx
cmp rbx, rcx
je 0x14001c197
mov r9, qword [rbx + 0x20]
mov rdx, qword [0x140127908]
cmp r9, rdx
je 0x14001c192
mov rax, qword [r9]
cmp rdx, r9
je 0x14001c192
cmp rdx, rax
je 0x14001c192
mov qword [rsp + 0x28], 1
lea r8, [0x140127908]
lea rcx, [0x140127908]
mov qword [rsp + 0x20], rax
call fcn.140020320
mov r8d, dword [rsp + 0x30]
mov eax, dword [rbx + 0x18]
jmp 0x14001c19d
mov eax, dword [0x140127970]
mov rbx, qword [rsp + 0xb0]
mov dword [rsp + 0x34], eax
cmp eax, 0xffffffff
jne 0x14001c1da
mov ecx, r8d
call fcn.14001d0b0
test al, al
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
setne dil
lea rcx, [0x140127900]
mov dword [rsp + 0x34], edi
call fcn.1400227c0
mov eax, dword [rsp + 0x34]
cmp eax, 1
sete byte [0x1401257e8]
jmp 0x14001c1ed
mov byte [0x1401257e8], dil
mov rcx, qword [0x1401257d0]
lea rdx, [0x1401257f0]
mov r8d, 0x7f
call qword [sym.imp.USER32.dll_GetClassNameA]
mov r8d, 9
lea rdx, str.gdkWindow
lea rcx, [0x1401257f0]
call fcn.14008e810
test eax, eax
lea rdx, str.gdkWindow
mov r8d, 9
lea rcx, [0x1401257f0]
setne byte [0x140124e66]
call fcn.14008e810
test eax, eax
sete byte [0x140124e67]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400264d0
add rsp, 0xa0
pop rdi
ret
Function at 0x14001c270
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
mov ecx, 0x10
call qword [sym.imp.USER32.dll_GetKeyState]
lea rcx, [0x1401256d0]
call qword [sym.imp.USER32.dll_GetKeyboardState]
movzx eax, byte [0x1401256e1]
shr al, 7
mov byte [0x1401257e9], al
movzx eax, byte [0x1401256e2]
shr al, 7
mov byte [0x1401257ea], al
movzx eax, byte [0x1401256e0]
shr al, 7
mov byte [0x1401257eb], al
movzx eax, byte [0x140125770]
shr al, 7
mov byte [0x1401257ec], al
movzx eax, byte [0x140125771]
shr al, 7
test byte [0x14012572b], 0x80
mov byte [0x1401257ed], al
jne 0x14001c2f5
test byte [0x14012572c], 0x80
mov byte [0x1401257ee], 0
je 0x14001c2fc
mov byte [0x1401257ee], 1
add rsp, 0x28
ret
Function at 0x1400222c0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov r9, r8
mov r10, rcx
movzx r8d, byte [r8 + 0x10]
movabs rcx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
mov rdi, rdx
xor r8, rax
movzx eax, byte [r9 + 0x11]
mov rdx, qword [r10 + 0x30]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x12]
imul r8, rcx
xor r8, rax
movzx eax, byte [r9 + 0x13]
imul r8, rcx
xor r8, rax
imul r8, rcx
mov rcx, qword [r10 + 0x18]
and rdx, r8
shl rdx, 4
add rcx, rdx
cmp qword [rcx + 8], r9
jne 0x140022359
cmp qword [rcx], r9
jne 0x14002234f
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x140022364
mov rax, qword [r9 + 8]
mov qword [rcx + 8], rax
jmp 0x140022364
cmp qword [rcx], r9
jne 0x140022369
mov rax, qword [r9]
mov qword [rcx], rax
mov r9, qword [rsp + 0x40]
mov rax, qword [r9 + 8]
mov rcx, r9
mov rbx, qword [r9]
mov qword [rax], rbx
mov rdx, qword [r9]
mov rax, qword [r9 + 8]
mov qword [rdx + 8], rax
dec qword [r10 + 0x10]
call fcn.1400271c4
mov qword [rdi], rbx
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x140022470
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x10], 0
mov rdi, rcx
je 0x140022581
mov rax, qword [rcx + 8]
movabs rcx, 0x100000001b3
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
mov rax, qword [rax]
mov r8d, dword [rax + 0x10]
movabs rax, 0xcbf29ce484222325
mov dword [rsp + 0x30], r8d
movzx edx, r8b
xor rdx, rax
movzx eax, byte [rsp + 0x31]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x32]
imul rdx, rcx
xor rdx, rax
movzx eax, byte [rsp + 0x33]
imul rdx, rcx
xor rdx, rax
mov rax, qword [rdi + 0x48]
imul rdx, rcx
mov rcx, qword [rdi + 0x30]
and rax, rdx
mov rdx, qword [rdi + 0x20]
mov rbx, rax
add rbx, rbx
add rax, rax
mov rbx, qword [rcx + rbx*8]
mov r9, qword [rcx + rax*8]
lea r10, [rcx + rax*8]
cmp r9, rdx
jne 0x14002250f
mov rax, rdx
jmp 0x140022516
mov rax, qword [r10 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x14002252c
cmp r8d, dword [rbx + 0x10]
je 0x140022526
mov rbx, qword [rbx]
jmp 0x140022505
cmovne rbx, rdx
jmp 0x14002252f
mov rbx, rdx
mov rax, qword [rdi]
test rax, rax
je 0x140022541
lea rcx, [rbx + 0x18]
call rax
sub qword [rdi + 0x60], rax
mov r8, rbx
lea rdx, [rsp + 0x30]
lea rcx, [rdi + 0x18]
call fcn.1400222c0
mov rax, qword [rdi + 8]
mov rcx, qword [rax]
mov rdx, qword [rcx + 8]
mov rax, qword [rcx]
mov qword [rdx], rax
mov rdx, qword [rcx]
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
dec qword [rdi + 0x10]
call fcn.1400271c4
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400936c8
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x140093400
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140093400
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140093400
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140093400
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140093400
cmp dword [rcx + 0x84], 0xe
jbe 0x140093400
cmp dword [rcx + 0xf8], esi
je 0x140093400
mov ecx, r14d
call fcn.1400935d0
mov ecx, 2
call fcn.14009768c
nop
cmp byte [0x140128e68], 0
jne 0x1400934ca
mov r15d, 1
mov eax, r15d
xchg dword [0x140128e58], eax
test ebx, ebx
jne 0x140093473
mov rdi, qword [0x140114720]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x140128e60]
cmp rcx, rax
je 0x14009346a
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [0x1400c4980]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x1401291b0]
jmp 0x14009347f
cmp ebx, r15d
jne 0x140093485
lea rcx, [0x1401291c8]
call fcn.1400951e8
nop
test ebx, ebx
jne 0x14009349c
lea rdx, [0x1400c4aa8]
lea rcx, [0x1400c4a80]
call fcn.1400959e8
lea rdx, [0x1400c4ab8]
lea rcx, [0x1400c4ab0]
call fcn.1400959e8
movzx eax, byte [0x140128e68]
test esi, esi
cmove eax, r15d
mov byte [0x140128e68], al
jmp 0x1400934ca
mov ecx, 2
call fcn.1400976e0
test esi, esi
jne 0x1400934e1
mov ecx, r14d
call fcn.1400934fc
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x140093390
Function at 0x1400a7180
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x1400a6da8
call fcn.14008e618
mov dword [rax], 0x16
call fcn.14008e46c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x1400a6d90
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x1400a6d90
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x1400a6dda
lock or dword [rax + 0x14], 0x10
jmp 0x1400a6d90
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x1400a6df7
mov rcx, qword [rbp + 0x10]
call fcn.1400a9dfc
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14008d9d4
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.1400a67e0
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x1400a6e4e
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x1400a6d90
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x1400a6eba
mov rcx, qword [rbp + 0x10]
call fcn.14008d9d4
cmp eax, 0xffffffff
je 0x1400a6ea1
mov rcx, qword [rbp + 0x10]
call fcn.14008d9d4
cmp eax, 0xfffffffe
je 0x1400a6ea1
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.14008d9d4
movsxd rdi, eax
lea rsi, [0x140129a70]
mov rcx, rbx
sar rdi, 6
call fcn.14008d9d4
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x1400a6ea8
lea rax, [0x140114b70]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x1400a6eba
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x1400a6ef0
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x1400a6eec
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x1400a6eec
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x1400a6d93
jmp 0x1400a6d60
Function at 0x140002100
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x290]
sub rsp, 0x390
mov rax, qword [0x14003b020]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov rdi, rdx
mov rbx, rcx
mov r8, rcx
lea rdx, str._s.
lea rcx, [rbp + 0x170]
call fcn.140001250
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140002303
test byte [rsp + 0x20], 0x10
je 0x1400021bd
lea r9, [rsp + 0x4c]
mov r8, rbx
lea rdx, str._s_s
lea rcx, [rbp + 0x60]
call fcn.140001250
movzx ecx, byte [rsp + 0x4c]
movzx eax, byte [rsp + 0x4d]
cmp cl, 0x2e
jne 0x1400021ac
test al, al
je 0x1400022e4
cmp cl, cl
jne 0x1400021ac
cmp al, cl
jne 0x1400021ac
cmp byte [rsp + 0x4e], 0
je 0x1400022e4
mov rdx, rdi
lea rcx, [rbp + 0x60]
call fcn.140002100
jmp 0x1400022e4
mov rdx, rdi
mov rcx, rbx
call fcn.140007b1c
test rax, rax
je 0x140002233
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0xff
call fcn.1400084a0
lea rcx, [rbp + 0x60]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x1400021e5
xor edx, edx
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400021f1
lea rcx, [rbp + 0x60]
dec rcx
nop word [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002210
movzx eax, word [0x140036318]
mov rdx, rbx
mov word [rcx], ax
lea rcx, str.___Found_directory:__s_n
call fcn.1400011f0
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call fcn.140007b1c
test rax, rax
je 0x1400022e4
xor edx, edx
lea rcx, [rbp + 0x60]
mov r8d, 0xff
call fcn.1400084a0
lea rcx, [rbp + 0x60]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002261
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140002270
lea rcx, [rbp + 0x60]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x140002286
movzx eax, word [0x140036318]
mov word [rcx], ax
lea rax, [rbp + 0x60]
dec rax
cmp byte [rax + 1], 0
lea rax, [rax + 1]
jne 0x1400022a1
lea r8, [rsp + 0x4c]
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rdx]
mov byte [rax + rdx], cl
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400022c0
lea r8, [rsp + 0x4c]
mov rdx, rbx
lea rcx, str.____Found_file:__s_s_n
call fcn.1400011f0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x140002163
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.140005d80
mov rbx, qword [rsp + 0x3c0]
add rsp, 0x390
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002330
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x240
mov rax, qword [0x14003b020]
xor rax, rsp
mov qword [rsp + 0x230], rax
xor eax, eax
lea r8, [0x140001fc0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
call fcn.1400027a0
lea r8, [rsp + 0x130]
call fcn.140002ef0
lea r8, [rsp + 0x30]
call fcn.140002ef0
xor ecx, ecx
call fcn.14000e45c
lea rdx, [rsp + 0x30]
mov rbx, rax
lea rcx, [rsp + 0x130]
call fcn.140002100
xor ecx, ecx
call fcn.14000e45c
sub rax, rbx
lea rcx, str.END___i_sec__n
mov rdx, rax
call fcn.1400011f0
xor eax, eax
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.140005d80
add rsp, 0x240
pop rbx
ret

Function at 0x1400145ec
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x140014418