joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14013a6e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movzx edx, dx
mov r8d, 0xa
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
je 0x14013a74f
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rdi, rax
test rax, rax
je 0x14013a74f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rcx, rax
call fcn.14013a820
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_FreeResource]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14013a760
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x40
xor ebx, ebx
xor r9d, r9d
mov edx, 0x80000000
mov qword [rsp + 0x30], rbx
lea r8d, [rbx + 1]
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14013a807
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x60], rdi
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, eax
mov ebp, eax
call fcn.140298640
mov rdi, rax
test rax, rax
je 0x14013a7f4
lea r9, [rsp + 0x58]
mov r8d, ebp
mov rdx, rax
mov rcx, rsi
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14013a7ec
cmp dword [rsp + 0x58], ebp
jb 0x14013a7ec
mov rcx, rdi
call fcn.14013a820
mov rbx, rax
mov rcx, rdi
call fcn.140298600
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rsi
ret

Function at 0x14013af00
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x130], rax
lea rdx, str.comctl32
mov r8d, 8
mov rbx, rcx
call fcn.14029cba0
test eax, eax
jne 0x14013af3f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x14013af88
lea rcx, [rsp + 0x20]
mov edx, 0x104
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r8, [0x14033071c]
lea rcx, [rsp + 0x20]
mov edx, 0x104
call fcn.14029cccc
lea rcx, [rsp + 0x20]
mov r8, rbx
mov edx, 0x104
call fcn.14029cccc
xor edx, edx
lea rcx, [rsp + 0x20]
lea r8d, [rdx + 8]
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0x140
pop rbx
ret
Function at 0x14013e6e0
Capabilities:
Delete registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov eax, dword [0x1403fe608]
mov ebx, edx
test al, 1
jne 0x14013e724
or eax, 1
lea rcx, [0x1402de040]
mov qword [0x1403fe5e8], 0xffffffff80000002
mov dword [0x1403fe608], eax
lea rax, vtable.Core::Win32::RegistryKey.0
mov qword [0x1403fe5e0], rax
call fcn.140299c6c
lea rdx, [0x140329c48]
lea rcx, [0x1403fe5e0]
call fcn.1400ec430
mov rdi, rax
test rax, rax
je 0x14013e7d0
dec ebx
je 0x14013e789
dec ebx
je 0x14013e780
dec ebx
je 0x14013e777
dec ebx
je 0x14013e76e
mov rcx, qword [rax + 8]
lea rdx, str.ProxyMode
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x14013e7c3
lea rcx, str.Manual
jmp 0x14013e790
lea rcx, [0x140329a78]
jmp 0x14013e790
lea rcx, str.WPAD
jmp 0x14013e790
lea rcx, str.None
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], 0
jne 0x14013e794
add eax, eax
lea rdx, str.ProxyMode
mov r9d, 1
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov rcx, qword [rdi + 8]
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x14013f470
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x60
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov rbx, rcx
lea rax, [rcx + 0x18]
mov qword [r11 + 0x10], rax
lea rsi, [rax + 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rsp + 0x38]
mov rcx, rbx
call fcn.14013f6a0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x38]
call fcn.1401ebac0
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x14013f4e3
test al, 0x10
je 0x14013f4e3
cmp dword [rsp + 0x30], 0
jle 0x14013f504
mov rcx, qword [rsp + 0x28]
call fcn.140298600
jmp 0x14013f504
cmp dword [rsp + 0x30], 0
jle 0x14013f4f4
mov rcx, qword [rsp + 0x28]
call fcn.140298600
xor r8d, r8d
mov rdx, qword [rsp + 0x38]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.1400d06a0
nop
mov rbp, qword [rbx + 0xb0]
xor r9d, r9d
lea edx, [r9 + 2]
mov r8d, 0x40000000
lea rcx, [rsp + 0x48]
call fcn.1401f2360
mov rdi, rax
test rax, rax
je 0x14013f586
mov word [rsp + 0x80], 0xfeff
mov r9, qword [rax]
mov r8d, 2
lea rdx, [rsp + 0x80]
mov rcx, rax
call qword [r9 + 0x48]
mov rdx, rdi
mov rcx, rbp
call fcn.1401f1110
mov rdx, qword [rdi]
mov rcx, rdi
call qword [rdx + 0x20]
mov rax, qword [rdi]
mov edx, 1
mov rcx, rdi
call qword [rax]
mov byte [rbx + 0xb8], 0
mov bl, 1
jmp 0x14013f588
xor bl, bl
cmp dword [rsp + 0x50], 0
jle 0x14013f59a
mov rcx, qword [rsp + 0x48]
call fcn.140298600
nop
cmp dword [rsp + 0x40], 0
jle 0x14013f5ac
mov rcx, qword [rsp + 0x38]
call fcn.140298600
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop rdi
pop rsi
pop rbp
ret
Function at 0x14013fd40
Capabilities:
Delete file

Disassembly:
push rdi
sub rsp, 0x2c0
mov qword [rsp + 0x58], 0xfffffffffffffffe
mov qword [rsp + 0x2d8], rbx
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x2b0], rax
mov rbx, rcx
lea rax, [rcx + 0x18]
mov qword [rsp + 0x50], rax
lea rdi, [rax + 8]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400d06a0
nop
mov rcx, qword [rbx + 0xb0]
test rcx, rcx
je 0x14013fdb5
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
mov qword [rbx + 0xb0], 0
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp rax, 0xffffffffffffffff
je 0x14013fdfb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400d06a0
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [rsp + 0x48], 0
jle 0x14013fdfb
mov rcx, qword [rsp + 0x40]
call fcn.140298600
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.14013f6a0
nop
mov dl, 1
lea rcx, [rsp + 0x20]
call fcn.1400ed320
mov rcx, rbx
call fcn.14013f1e0
nop
cmp dword [rsp + 0x28], 0
jle 0x14013fe30
mov rcx, qword [rsp + 0x20]
call fcn.140298600
nop
cmp dword [rsp + 0x38], 0
jle 0x14013fe42
mov rcx, qword [rsp + 0x30]
call fcn.140298600
nop
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov al, 1
mov rcx, qword [rsp + 0x2b0]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0x2d8]
add rsp, 0x2c0
pop rdi
ret
Function at 0x140141df0
Capabilities:
Create thread
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
movzx eax, word [rdx + 0x10]
mov rdi, rdx
mov rbx, rcx
cmp ax, 0x14
jne 0x140141e1d
mov qword [rdx + 0x18], 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp ax, 1
jne 0x140141eab
call fcn.1401e6230
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edx, 0xfa
mov rcx, rax
call fcn.14013a6e0
mov ecx, 0xfdb361
mov qword [rbx + 0xa0], rax
call qword [sym.imp.GDI32.dll_CreateSolidBrush]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0xa8], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
lea r8, [0x140141f30]
mov qword [rbx + 0xb8], rax
lea rax, [rsp + 0x48]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0xb0], rax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp ax, 2
jne 0x140141f0e
mov rdx, qword [rcx + 0xb0]
test rdx, rdx
je 0x140141f01
mov rcx, qword [rcx + 0xb8]
xor r9d, r9d
mov r8d, 0x3e8
call qword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
cmp eax, 0x102
jne 0x140141ee9
mov rcx, qword [rbx + 0xb0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0xb8]
mov qword [rbx + 0xb0], 0
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0xa8]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.1401e6230
Function at 0x140141f40
Capabilities:
Capture screenshot
Check for time delay via gettickcount

Disassembly:
mov r11, rsp
push r14
sub rsp, 0xa0
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x78], rax
cmp qword [rcx + 0xa0], 0
mov r14, rcx
je 0x140142176
mov rax, qword [rcx]
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov qword [r11 - 0x10], rdi
mov qword [r11 - 0x20], r13
mov qword [r11 - 0x28], r15
call qword [rax]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov rdi, rax
mov qword [rsp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
mov edx, 1
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rdx, qword [r14]
mov rcx, r14
call qword [rdx]
lea rdx, [rsp + 0x68]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetClientRect]
mov ebx, dword [rsp + 0x74]
mov r13d, dword [rsp + 0x70]
sub ebx, dword [rsp + 0x6c]
sub r13d, dword [rsp + 0x68]
mov rcx, rdi
mov dword [rsp + 0x50], ebx
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov r8d, ebx
mov edx, r13d
mov rcx, rdi
mov rbp, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov rcx, rbp
mov rdx, rax
mov qword [rsp + 0x60], rax
call qword [sym.imp.GDI32.dll_SelectObject]
mov rcx, qword [r14 + 0xa0]
xor edi, edi
mov r15d, dword [rcx + 0x10]
mov sil, 1
sub r15d, r13d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [r14 + 0xb8]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140142132
mov qword [rsp + 0x90], r12
lea r12d, [r13 - 8]
nop dword [rax]
nop dword [rax + rax]
mov r8, qword [r14 + 0xa8]
lea rdx, [rsp + 0x68]
mov rcx, rbp
call qword [sym.imp.USER32.dll_FillRect]
mov rcx, qword [r14 + 0xa0]
mov r9d, 8
mov eax, dword [rcx + 0x14]
mov r8d, r9d
mov rdx, rbp
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r12d
mov dword [rsp + 0x20], edi
call fcn.14013ada0
mov rcx, qword [rsp + 0x58]
xor eax, eax
mov dword [rsp + 0x40], 0xcc0020
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x50]
mov r9d, r13d
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.GDI32.dll_BitBlt]
test sil, sil
je 0x1401420d0
inc edi
cmp edi, r15d
jne 0x1401420de
xor sil, sil
jmp 0x1401420de
dec edi
movzx esi, sil
mov eax, 1
cmove esi, eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xa
jae 0x14014210b
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xa
jb 0x1401420f1
lea r12d, [r13 - 8]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [r14 + 0xb8]
xor edx, edx
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140142050
mov r12, qword [rsp + 0x90]
mov rcx, rbp
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r15, qword [rsp + 0x80]
mov r13, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140297ff0
add rsp, 0xa0
pop r14
ret
Function at 0x1401487f0
Capabilities:
Get disk information

Disassembly:
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x108], rbx
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0xe0], rax
movzx ebx, cx
movabs rax, 0x5c003a003f
mov qword [rsp + 0x50], rax
mov word [rsp + 0x50], cx
mov dword [rsp + 0x38], 0x40
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor edi, edi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x1401488e5
lea rdx, [0x140330520]
lea rcx, [rsp + 0x60]
call fcn.14029848c
movzx ecx, bx
test eax, eax
jne 0x14014888a
call fcn.14014a2b0
mov rbx, rax
jmp 0x1401488b9
call fcn.14029b068
movzx ebx, ax
mov ecx, 0x2a0
call fcn.14029806c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401488b6
movzx edx, bx
mov rcx, rax
call fcn.140149990
mov rbx, rax
jmp 0x1401488b9
mov rbx, rdi
test rbx, rbx
je 0x1401488e5
mov ecx, 0x118
call fcn.14029806c
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1401488e0
mov rdx, rbx
mov rcx, rax
call fcn.140148330
mov rdi, rax
mov rax, rdi
jmp 0x1401488e7
xor eax, eax
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.140297ff0
mov rbx, qword [rsp + 0x108]
add rsp, 0xf0
pop rdi
ret
Function at 0x140149d60
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
mov r8d, edx
mov r9, rcx
xor r8d, 0xdeadbeef
cmp edx, 4
jl 0x140149da8
mov r10d, edx
shr r10, 2
mov eax, r10d
neg eax
lea edx, [rdx + rax*4]
imul eax, dword [r9], 0x5bd1e995
imul r8d, r8d, 0x5bd1e995
add r9, 4
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r8d, ecx
dec r10
jne 0x140149d81
dec edx
je 0x140149dca
dec edx
je 0x140149dbf
dec edx
jne 0x140149dd8
movzx eax, byte [r9 + 2]
shl eax, 0x10
xor r8d, eax
movzx eax, byte [r9 + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [r9]
xor eax, r8d
imul r8d, eax, 0x5bd1e995
mov eax, r8d
shr eax, 0xd
xor eax, r8d
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
ret

Function at 0x14014a2b0
Capabilities:
Get volume information via ioctl

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x70
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x68], rax
movsd xmm0, qword [0x1403232b0]
movsd qword [rsp + 0x58], xmm0
mov eax, dword [0x1403232b8]
mov dword [rsp + 0x60], eax
movzx eax, word [0x1403232bc]
mov word [rsp + 0x64], ax
call fcn.14029b068
movzx ebp, ax
mov word [rsp + 0x60], ax
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [rbx + 3]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14014a386
lea ecx, [rbx + 0x60]
call fcn.14029806c
mov rdi, rax
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x60
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor r8d, r8d
mov edx, 0x90064
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x14014a38a
mov rcx, rdi
call fcn.1402012c0
xor eax, eax
jmp 0x14014a3ba
call fcn.14014a220
mov ecx, 0x128
call fcn.14029806c
mov qword [rsp + 0x50], rax
test rax, rax
je 0x14014a3b7
mov r9, rdi
mov r8, rsi
movzx edx, bp
mov rcx, rax
call fcn.140149e10
mov rbx, rax
mov rax, rbx
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x14014e380
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
lea rax, vtable.HitmanPro35::RemnantKeyScanThread.0
mov qword [rcx + 8], rdx
mov rbx, rcx
mov qword [rcx], rax
mov rax, qword [rdx + 8]
mov qword [rcx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
xor r9d, r9d
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, 0x10000
mov qword [rbx + 0x30], rax
mov dword [rbx + 0x38], 0x8000
call fcn.140298640
mov ecx, 0x10000
mov qword [rbx + 0x40], rax
call fcn.140298640
mov ecx, 0x10000
mov qword [rbx + 0x48], rax
call fcn.140298640
mov ecx, 0x10000
mov qword [rbx + 0x50], rax
call fcn.140298640
lea r8, [0x14014e4d0]
mov qword [rbx + 0x58], rax
lea rax, [rsp + 0x40]
mov r9, rbx
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x20], rax
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14014f230
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
lea rdx, [0x140331f28]
call fcn.14029ce30
mov rsi, rax
test rax, rax
je 0x14014f37f
mov r9, rax
mov ebp, 1
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x70]
call fcn.14029d13c
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x20]
call fcn.14029d13c
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 3]
lea rcx, [rsp + 0x68]
call fcn.14029d13c
mov r9, rsi
mov r8d, ebp
lea edx, [rbp + 7]
lea rcx, [rsp + 0x78]
call fcn.14029d13c
lea ecx, [rbp + 0x57]
call fcn.14029806c
mov rdi, rax
mov qword [rsp + 0x30], rax
xor ecx, ecx
test rax, rax
je 0x14014f351
lea rax, vtable.BloomFilter.0
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
mov qword [rdi + 0x20], rcx
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x38], rax
mov qword [rdi + 0x40], rcx
mov ecx, 0xa5a5a5a5
mov eax, dword [rsp + 0x68]
test eax, eax
cmovne ecx, eax
mov dword [rdi + 0x48], ecx
movsd xmm0, qword [rsp + 0x78]
movsd qword [rdi + 0x50], xmm0
mov rax, qword [rdi + 0x38]
cmp rax, 0
cmove rax, rbp
mov qword [rdi + 0x38], rax
mov rcx, rdi
call fcn.14014f570
mov rcx, rdi
call fcn.14014f390
mov rbx, qword [rdi + 0x30]
shr rbx, 3
mov rcx, rbx
call fcn.140298640
mov qword [rdi + 0x20], rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.1402a04b0
nop
jmp 0x14014f354
mov rdi, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rdi + 0x40], rcx
mov r8, qword [rdi + 0x30]
shr r8, 3
mov r9, rsi
mov rdx, rbp
mov rcx, qword [rdi + 0x20]
call fcn.14029d13c
mov rcx, rsi
call fcn.14029a16c
mov rax, rdi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401508a0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x6d0
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x6c0], rax
mov rbp, rcx
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x2a0]
mov dword [rsp + 0x30], 0x104
call qword [sym.imp.USERENV.dll_GetProfilesDirectoryW]
lea r8, [0x1403232c8]
lea rcx, [rsp + 0x2a0]
mov edx, 0x104
call fcn.14029a500
lea r8, [rsp + 0x2a0]
lea rcx, [rsp + 0x4b0]
mov edx, 0x104
call fcn.1402980d8
lea r8, [0x14032967c]
lea rcx, [rsp + 0x4b0]
mov edx, 0x104
call fcn.14029a500
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x4b0]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140150a68
mov qword [rsp + 0x6e8], rbx
mov qword [rsp + 0x6f0], rdi
nop dword [rax]
test byte [rsp + 0x50], 0x10
je 0x140150a39
movzx edx, word [rsp + 0x7c]
movzx ecx, word [rsp + 0x7e]
cmp dx, word [0x140322fd0]
jne 0x14015098b
cmp cx, word [0x140322fd2]
je 0x140150a39
cmp dx, word [0x14032968c]
jne 0x1401509b2
cmp cx, word [0x14032968e]
jne 0x1401509b2
movzx eax, word [rsp + 0x80]
cmp ax, word [0x140329690]
je 0x140150a39
lea rcx, [rsp + 0x7c]
or rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1401509c0
lea rdx, [rsp + 0x2a0]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rdx + rcx*2], 0
jne 0x1401509d6
add eax, 2
add ecx, eax
movsxd rdi, ecx
lea rcx, [rdi + rdi]
call fcn.140298640
lea r8, [rsp + 0x2a0]
mov rdx, rdi
mov rcx, rax
mov rbx, rax
mov qword [rsp + 0x38], rax
call fcn.1402980d8
lea r8, [rsp + 0x7c]
mov rdx, rdi
mov rcx, rbx
call fcn.14029a500
movzx eax, byte [0x1403fdd7b]
lea r9, [rsp + 0x38]
lea rdx, [rsp + 0x40]
mov rcx, rbp
mov byte [rsp + 0x20], al
call fcn.1400df640
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140150960
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rdi, qword [rsp + 0x6f0]
mov rbx, qword [rsp + 0x6e8]
mov rcx, qword [rsp + 0x6c0]
xor rcx, rsp
call fcn.140297ff0
mov rbp, qword [rsp + 0x6f8]
add rsp, 0x6d0
pop rsi
ret
Function at 0x140152f90
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2f0
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x1403eaa10]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
mov rsi, rdx
mov rdi, rcx
cmp qword [0x1403ffe58], 0
jne 0x140153027
lea rcx, str.Cryptdll.dll
call fcn.14013af00
mov rbx, rax
test rax, rax
je 0x140153027
lea rdx, str.MD5Init
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403ffe58], rax
lea rdx, str.MD5Update
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403ffe68], rax
lea rdx, str.MD5Final
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1403ffe60], rax
mov edx, 0x104
lea rcx, [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x140153045
xor al, al
jmp 0x14015318d
lea rax, [rsp + 0xd0]
or rbx, 0xffffffffffffffff
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140153051
mov qword [rsp + 0x38], 0
test ebx, ebx
jne 0x140153076
lea rax, [0x140323de0]
mov qword [rsp + 0x30], rax
jmp 0x1401530a0
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1401e9030
movsxd r9, ebx
mov eax, dword [rsp + 0x38]
inc eax
movsxd rdx, eax
lea r8, [rsp + 0xd0]
mov rcx, qword [rsp + 0x30]
call fcn.14029b4d8
mov edx, ebx
lea rcx, [rsp + 0x30]
call fcn.1401ea290
nop
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.1400fa9f0
mov rcx, rax
mov dword [rsp + 0x20], 0
lea r9, vtable.type_info.0
lea r8, vtable.type_info.0
xor edx, edx
call fcn.1402b6e68
mov rbx, rax
cmp dword [rsp + 0x38], 0
jle 0x1401530ee
mov rcx, qword [rsp + 0x30]
call fcn.140298600
test rbx, rbx
je 0x14015303e
call fcn.14017b910
mov qword [rsp + 0x48], rax
test rax, rax
je 0x14015303e
lea rcx, [rsp + 0x60]
call qword [0x1403ffe58]
mov r8d, 8
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x60]
call qword [0x1403ffe68]
lea rcx, [rsp + 0x60]
call qword [0x1403ffe60]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x68]
call qword [sym.imp.RPCRT4.dll_UuidToStringW]
mov rdx, qword [rsp + 0x40]
mov rcx, rdi
call fcn.1401e7490
mov r8d, 0x7b
mov rcx, rdi
call fcn.1401e9fd0
mov edx, dword [rdi + 0xc]
inc edx
mov rcx, rdi
call fcn.1401e9030
movsxd rdx, dword [rdi + 0xc]
mov rax, qword [rdi]
mov ecx, 0x7d
mov word [rax + rdx*2], cx
mov edx, dword [rdi + 0xc]
inc edx
mov rcx, rdi
call fcn.1401ea290
mov al, 1
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140297ff0
lea r11, [rsp + 0x2f0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret