joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140012810
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14001f190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
xor edx, edx
mov word [rcx + rax], dx
add rsp, 0x38
ret

Function at 0x140012850
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14001f190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
movsxd rax, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx]
lea rax, [rcx + rax - 1]
add rsp, 0x38
ret

Function at 0x140012900
Capabilities:
Get thread local storage value

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x38
mov ecx, dword [0x14001f190]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x20], rax
mov eax, dword [rsp + 0x40]
shl eax, 1
cdqe
mov rcx, qword [rsp + 0x20]
mov rcx, qword [rcx + 0x10]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x20]
mov qword [rcx + 0x10], rax
add rsp, 0x38
ret

Function at 0x140012c50
Capabilities:
Set thread local storage value

Disassembly:
sub rsp, 0x38
mov r8d, 0x18
xor edx, edx
mov rcx, qword [0x140021310]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rsp + 0x20], rax
mov r8d, 0x10
xor edx, edx
mov rcx, qword [0x140021310]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rsp + 0x20]
mov qword [rcx], rax
mov rax, qword [rsp + 0x20]
mov qword [rax + 8], 0x10
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x10], 0
mov rdx, qword [rsp + 0x20]
mov ecx, dword [0x14001f190]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x38
ret
Function at 0x140016fb4
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
cmp dword [0x140021118], 0
mov r14, rdx
mov r15, rcx
lea rbx, [0x140021128]
jne 0x140017001
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov rcx, rbx
mov dword [0x140021150], eax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x140021118], 1
mov ecx, dword [0x140021150]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rbp, rax
test rax, rax
jne 0x1400170d6
mov rcx, qword [0x140020444]
lea edx, [rax + 8]
lea r8d, [rax + 0x28]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbp, rax
test rax, rax
je 0x140017101
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [0x140021120]
test rax, rax
je 0x140017051
mov qword [rax], rbp
mov rcx, rbx
mov qword [rbp + 8], rax
mov qword [0x140021120], rbp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x20]
mov r8, rdi
mov rcx, rax
mov rdx, rbx
mov dword [rsp + 0x20], 0x100000
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov rdx, qword [rbp + 0x20]
lea rcx, [rbp + 0x18]
lea r8, [0x14001711c]
mov r9, rbp
mov dword [rsp + 0x28], 8
or dword [rsp + 0x20], 0xffffffff
call qword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
mov ecx, dword [0x140021150]
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, qword [0x140020444]
xor edx, edx
lea r8d, [rdx + 0x18]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140017101
mov qword [rax + 8], r15
mov qword [rax + 0x10], r14
mov rcx, qword [rbp + 0x10]
mov qword [rax], rcx
mov qword [rbp + 0x10], rax
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x140001120
Capabilities:
Change the wallpaper

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x30], 1
xor edi, edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
xor r8d, r8d
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rax
lea rax, vtable.Gdiplus::Bitmap.0
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rdi
lea rdx, [rsp + 0x20]
lea rcx, [0x140003360]
call qword [sym.imp.gdiplus.dll_GdipCreateBitmapFromFile]
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x58], edi
test eax, eax
jne 0x1400011f0
lea rdx, [0x140003320]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140001240
mov rcx, rax
lea rdx, [0x140003360]
call fcn.140001240
mov rcx, rax
lea rdx, [0x140001420]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov r9d, 3
lea r8, [0x140003360]
xor edx, edx
mov ecx, 0x14
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
nop
mov rcx, rbx
call qword [sym.imp.gdiplus.dll_GdipDisposeImage]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400014e0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret

Function at 0x140001dd8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001e22
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001e22
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001e22
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001e22
cmp dword [rcx + 0x84], 0xe
jbe 0x140001e22
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001e24
xor al, al
add rsp, 0x28
ret
Function at 0x180001000
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x28
cmp edx, 1
jne 0x180001034
mov edx, 5
lea rcx, str.cmd.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor r9d, r9d
lea r8, str.PWNED
lea rdx, str.PWNED
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 1
add rsp, 0x28
ret
Function at 0x180008f3c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180008f6c
xor eax, eax
jmp 0x18000902f
mov rbp, rbx
cmp word [rax], si
je 0x180008f91
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180008f78
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180008f74
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180008e5c
movsxd r14, eax
test eax, eax
jne 0x180008fcf
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180008f65
mov rcx, r14
call fcn.18000a1cc
mov rdi, rax
test rax, rax
jne 0x180008fe8
xor ecx, ecx
call fcn.180007494
jmp 0x180008fc4
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180008e5c
test eax, eax
jne 0x180009019
mov rcx, rdi
call fcn.180007494
jmp 0x180009023
xor ecx, ecx
call fcn.180007494
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x18000e780
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x18000e7a8
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x18000e7a8
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret

Function at 0x14000b50c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [0x14000e050]
test rax, rax
je 0x14000b556
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000b556
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000b556
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000b556
cmp dword [rcx + 0x84], 0xe
jbe 0x14000b556
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000b558
xor al, al
add rsp, 0x28
ret

Function at 0x140001070
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
sub rsp, 0x100
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x30]
mov rsi, qword [rax + 0x10]
mov rbx, qword [rax + 0x40]
mov rax, qword [rax]
cmp dword [rbx + 0xc], 0x320033
jne 0x140001088
mov rcx, rsi
mov rdx, 0xc917432
call fcn.14000116b
mov r14, rax
mov rbx, 0x6c6c
push rbx
movabs rbx, 0x642e323372657375
push rbx
mov rcx, rsp
sub rsp, 0x18
call r14
mov rbx, rax
mov rcx, rbx
mov rdx, 0x1e380a6a
call fcn.14000116b
mov r14, rax
xor r9, r9
xor r8, r8
xor rdx, rdx
xor rcx, rcx
call r14
mov rcx, rsi
mov rdx, 0x1a22f51
call fcn.14000116b
mov r14, rax
xor rax, rax
push rax
movabs rax, 0x6578652e636c6163
push rax
mov rcx, rsp
sub rsp, 0x20
mov rdx, 1
call r14
mov rcx, rsi
movabs rdx, 0xbbafdf85
call fcn.14000116b
mov r14, rax
mov rax, 0x6461
push rax
movabs rax, 0x6572685474697845
push rax
mov rcx, rsi
mov rdx, rsp
sub rsp, 0x20
call r14
mov r14, rax
add rsp, 0x188
sub rsp, 0x18
xor rcx, rcx
call r14
ret

Function at 0x14000116b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x40
push rsi
mov rdi, rdx
mov rbx, rcx
mov rsi, qword [rbx + 0x3c]
mov rax, rsi
shl rax, 0x36
shr rax, 0x36
mov rsi, qword [rbx + rax + 0x88]
shl rsi, 0x20
shr rsi, 0x20
add rsi, rbx
push rsi
mov esi, dword [rsi + 0x20]
add rsi, rbx
xor rcx, rcx
dec ecx
inc ecx
lodsd eax, dword [rsi]
add rax, rbx
xor edx, edx
cmp byte [rax], 0
je 0x1400011c0
ror edx, 7
push rcx
movsx ecx, byte [rax]
add edx, ecx
pop rcx
inc rax
jmp 0x1400011ac
cmp edx, edi
jne 0x1400011a4
pop rsi
mov edx, dword [rsi + 0x24]
add rdx, rbx
movsx ecx, word [rdx + rcx*2]
mov edx, dword [rsi + 0x1c]
add rdx, rbx
mov eax, dword [rdx + rcx*4]
add rax, rbx
pop rsi
add rsp, 0x40
ret

Function at 0x140001ae4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b2e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b2e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b2e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b2e
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b2e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b30
xor al, al
add rsp, 0x28
ret
Function at 0x140011267
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140023a00
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov ecx, dword [rsp + 0x468]
mov rax, qword [0x140039080]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14004322d]
call fcn.140011cda
nop
xor edx, edx
mov ecx, 2
call fcn.1400115eb
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x140023a88
lea rdx, str.Failed_to_take_snapshot_of_processes.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011154
lea rdx, [0x14001107d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140023b7d
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011807
test eax, eax
je 0x140023b72
mov eax, dword [rbp + 0x440]
cmp dword [rbp + 0x38], eax
je 0x140023b5d
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0
je 0x140023b5d
mov edx, 0x40
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x140023b20
lea rdx, str.Set_priority_of_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011690
lea rdx, [rbp + 0x5c]
mov rcx, rax
call fcn.140011690
lea rdx, str._to_low._n
mov rcx, rax
call fcn.140011690
nop
jmp 0x140023b4f
lea rdx, str.Failed_to_set_priority_for_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140011690
lea rdx, [rbp + 0x5c]
mov rcx, rax
call fcn.140011690
lea rdx, [0x140032e54]
mov rcx, rax
call fcn.140011690
nop
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011b6d
test eax, eax
jne 0x140023aa4
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1400322b0]
call fcn.140011adc
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14001160e
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140011753
Capabilities:
Terminate process

Disassembly:
jmp 0x140026fd0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret
Function at 0x140011938
Capabilities:
Parse pe header

Disassembly:
jmp 0x140027b00
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140027b20
xor al, al
jmp 0x140027ba1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140027b33
xor al, al
jmp 0x140027ba1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x140027b5d
xor al, al
jmp 0x140027ba1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140027b71
xor al, al
jmp 0x140027ba1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140027b83
xor al, al
jmp 0x140027ba1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x140027b9f
xor al, al
jmp 0x140027ba1
mov al, 1
add rsp, 0x38
ret
Function at 0x140011a05
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140023810
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x140039080]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14004322d]
call fcn.140011cda
nop
xor edx, edx
mov ecx, 2
call fcn.1400115eb
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14002388e
lea rdx, str.Failed_to_take_snapshot_of_processes.
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140011154
lea rdx, [0x14001107d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
jmp 0x140023974
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011807
test eax, eax
je 0x140023969
mov r8d, dword [rbp + 0x38]
xor edx, edx
mov ecx, 0x200
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x288], rax
cmp qword [rbp + 0x288], 0
je 0x140023954
mov edx, 0x20
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
test eax, eax
je 0x140023917
lea rdx, str.Set_priority_of_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140011690
lea rdx, [rbp + 0x5c]
mov rcx, rax
call fcn.140011690
lea rdx, str._to_normal._n
mov rcx, rax
call fcn.140011690
nop
jmp 0x140023946
lea rdx, str.Failed_to_set_priority_for_process
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140011690
lea rdx, [rbp + 0x5c]
mov rcx, rax
call fcn.140011690
lea rdx, [0x140032e54]
mov rcx, rax
call fcn.140011690
nop
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011b6d
test eax, eax
jne 0x1400238aa
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x140032330]
call fcn.140011adc
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14001160e
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140011afa
Capabilities:
Enumerate processes

Disassembly:
jmp 0x14001c410
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x468]
mov rax, qword [0x140039080]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x1400430fa]
call fcn.140011cda
nop
mov dword [rbp + 4], 0
xor edx, edx
mov ecx, 2
call fcn.1400115eb
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0xffffffffffffffff
jne 0x14001c4a0
lea rdx, [0x1400318e0]
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140011690
lea rdx, [0x14001161d]
mov rcx, rax
call qword [sym.imp.MSVCP140D.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
nop
xor eax, eax
jmp 0x14001c4f6
mov dword [rbp + 0x50], 0x238
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.140011807
test eax, eax
je 0x14001c4e8
lea rdx, [rbp + 0x7c]
mov rcx, qword [rbp + 0x440]
call fcn.14001144c
movzx eax, al
test eax, eax
je 0x14001c4d7
mov eax, dword [rbp + 0x58]
mov dword [rbp + 4], eax
jmp 0x14001c4e8
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x28]
call fcn.140011b6d
test eax, eax
jne 0x14001c4b8
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140030090]
call fcn.140011adc
mov rax, rdi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.14001160e
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret
Function at 0x140011c21
Capabilities:
Write file on windows

Disassembly:
jmp 0x140019ae0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x140039080]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400430f7]
call fcn.140011cda
nop
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x140019b47
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x140019b4e
mov al, 1
jmp 0x140019ca3
call fcn.14001149c
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
movzx edx, ax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov word [rbp + 0x160], ax
call fcn.14001149c
movzx ecx, word [rbp + 0x160]
movzx edx, cx
movzx ecx, ax
call fcn.140011546
movzx eax, al
test eax, eax
je 0x140019ba4
xor al, al
jmp 0x140019ca3
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x140019c09
cmp dword [rbp + 0x154], 1
je 0x140019c14
cmp dword [rbp + 0x154], 3
je 0x140019c92
jmp 0x140019ca1
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x72], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x140019c64
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x140019c64
xor al, al
jmp 0x140019ca3
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x72]
test eax, eax
jne 0x140019c7f
mov dword [rbp + 0x154], 1
jmp 0x140019c89
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x140019ca3
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x72], 0
mov al, 1
jmp 0x140019ca3
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x140031080]
call fcn.140011adc
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.14001160e
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x1400253f0
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011d52
movzx eax, al
test eax, eax
jne 0x140025410
mov ecx, 7
call fcn.140011aff
nop
mov byte [rsp + 0x20], 0
call fcn.140011b54
mov byte [rsp + 0x21], al
cmp dword [0x140039900], 1
jne 0x140025434
mov ecx, 7
call fcn.140011aff
nop
jmp 0x14002548c
cmp dword [0x140039900], 0
jne 0x140025487
mov dword [0x140039900], 1
lea rdx, [0x14002f770]
lea rcx, [0x14002f440]
call fcn.1400115e6
test eax, eax
je 0x140025468
mov eax, 0xff
jmp 0x140025591
lea rdx, [0x14002f330]
lea rcx, [section..rdata]
call fcn.140011b40
mov dword [0x140039900], 2
jmp 0x14002548c
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011ad2
call fcn.140011983
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x1400254e9
mov rcx, qword [rsp + 0x30]
call fcn.1400114e2
movzx eax, al
test eax, eax
je 0x1400254e9
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140044020]
nop
call fcn.140011a1e
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14002551d
mov rcx, qword [rsp + 0x38]
call fcn.1400114e2
movzx eax, al
test eax, eax
je 0x14002551d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011c8a
nop
call fcn.140025640
mov dword [rsp + 0x28], eax
call fcn.140011938
movzx eax, al
test eax, eax
jne 0x14002553c
mov ecx, dword [rsp + 0x28]
call fcn.1400110f5
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14002554b
call fcn.140011ca8
nop
xor edx, edx
mov cl, 1
call fcn.140011497
mov eax, dword [rsp + 0x28]
jmp 0x140025591
add rsp, 0x68
ret