joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140035136
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400438c0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x1400da10d]
call fcn.140035c53
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x140043917
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140043a23
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1400439bc
cmp qword [rbp + 0x28], 0
jle 0x1400439bc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x14004395c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.140035b90
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x140043a12
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x140043a12
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x1400356d6
Capabilities:
Terminate process

Disassembly:
jmp 0x14009c910
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400358c5
Capabilities:
Parse pe header

Disassembly:
jmp 0x14009d440
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14009d460
xor al, al
jmp 0x14009d4e1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14009d473
xor al, al
jmp 0x14009d4e1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14009d49d
xor al, al
jmp 0x14009d4e1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14009d4b1
xor al, al
jmp 0x14009d4e1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14009d4c3
xor al, al
jmp 0x14009d4e1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14009d4df
xor al, al
jmp 0x14009d4e1
mov al, 1
add rsp, 0x38
ret
Function at 0x140035c30
Capabilities:
Write file on windows

Disassembly:
jmp 0x14003db10
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x2e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1c8]
mov rax, qword [0x1400c9640]
xor rax, rbp
mov qword [rbp + 0x168], rax
lea rcx, [0x1400da10d]
call fcn.140035c53
mov rax, qword [rbp + 0x190]
cmp qword [rax + 0x68], 0
je 0x14003db76
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14003db7d
mov al, 1
jmp 0x14003dccd
call fcn.14003534d
mov rcx, qword [rbp + 0x190]
mov rcx, qword [rcx]
mov qword [rbp + 0x158], rcx
mov edx, eax
mov rcx, qword [rbp + 0x190]
mov rax, qword [rbp + 0x158]
call qword [rax + 0x18]
mov dword [rbp + 0x160], eax
call fcn.14003534d
mov ecx, dword [rbp + 0x160]
mov edx, ecx
mov ecx, eax
call fcn.1400359dd
movzx eax, al
test eax, eax
je 0x14003dbce
xor al, al
jmp 0x14003dccd
mov qword [rbp + 8], 0x20
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x190]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rax, qword [rbp + 0x190]
mov rcx, qword [rax + 0x68]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x154], eax
cmp dword [rbp + 0x154], 0
je 0x14003dc33
cmp dword [rbp + 0x154], 1
je 0x14003dc3e
cmp dword [rbp + 0x154], 3
je 0x14003dcbc
jmp 0x14003dccb
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x14003dc8e
mov rax, qword [rbp + 0x190]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x14003dc8e
xor al, al
jmp 0x14003dccd
mov rax, qword [rbp + 0x190]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x14003dca9
mov dword [rbp + 0x154], 1
jmp 0x14003dcb3
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x14003dccd
mov rax, qword [rbp + 0x190]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x14003dccd
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1400a5830]
call fcn.140035a50
mov rax, rdi
mov rcx, qword [rbp + 0x168]
xor rcx, rbp
call fcn.1400355be
lea rsp, [rbp + 0x178]
pop rdi
pop rbp
ret
Function at 0x140035c9e
Capabilities:
Terminate process

Disassembly:
jmp 0x14003ce60
mov byte [rsp + 0x18], r8b
mov dword [rsp + 0x10], edx
mov dword [rsp + 8], ecx
push rbp
push rdi
sub rsp, 0x158
lea rbp, [rsp + 0x30]
lea rcx, [0x1400da115]
call fcn.140035c53
mov eax, dword [rbp + 0x140]
mov dword [0x1400c9ebc], eax
mov eax, dword [rbp + 0x148]
mov dword [0x1400c9ec0], eax
mov qword [rbp + 8], 0
call fcn.140035b95
test eax, eax
jne 0x14003cece
lea rdx, str.ERROR:_could_not_start_GLFW3_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140035159
mov ecx, 0xffffffff
call qword [sym.imp.ucrtbased.dll_exit]
movzx eax, byte [rbp + 0x150]
test eax, eax
je 0x14003cf33
call fcn.140035311
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x28]
call fcn.140035bc7
mov qword [rbp + 0x48], rax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax]
mov dword [0x1400c9ebc], eax
mov rax, qword [rbp + 0x48]
mov eax, dword [rax + 4]
mov dword [0x1400c9ec0], eax
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x28]
lea r8, str.Capybara_OpenGL
mov edx, dword [0x1400c9ec0]
mov ecx, dword [0x1400c9ebc]
call fcn.140035c35
mov qword [rbp + 8], rax
jmp 0x14003cf5b
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, str.Capybara_OpenGL
mov edx, dword [0x1400c9ec0]
mov ecx, dword [0x1400c9ebc]
call fcn.140035c35
mov qword [rbp + 8], rax
lea rdx, [0x140035a28]
mov rcx, qword [rbp + 8]
call fcn.1400351c7
lea rdx, [0x140035b0e]
mov rcx, qword [rbp + 8]
call fcn.140035bcc
mov rcx, qword [rbp + 8]
call fcn.140035ab4
mov byte [0x1400cb80e], 1
call fcn.1400355e1
test eax, eax
je 0x14003cfab
lea rdx, str.ERROR:_could_not_start_GLEW_n
mov rcx, qword [sym.imp.MSVCP140D.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140035159
xor eax, eax
jmp 0x14003cfb9
mov ecx, 1
call fcn.140035db1
mov rax, qword [rbp + 8]
lea rsp, [rbp + 0x128]
pop rdi
pop rbp
ret
Function at 0x1400fa160
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14044e3b0]
mov rcx, qword [rax + 0x2020]
mov r10, qword [rax + 0x1c10]
movsxd rax, dword [rcx + 0x7c]
movups xmm0, xmmword [rcx + 0x174]
movss xmm4, dword [rcx + 0x174]
movss xmm3, dword [rcx + 0x178]
movss xmm2, dword [rcx + 0x17c]
movss xmm1, dword [rcx + 0x180]
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
imul r9, rax, 0x68
mov rax, qword [r10 + 0x280]
add r9, qword [rcx + 0x18]
movups xmmword [r10 + 0x220], xmm0
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r10 + 0x280]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [r9 + 0x57]
mov rdx, qword [r10 + 0x280]
mov rcx, qword [rcx + 0x1a8]
add rsp, 0x38
jmp 0x140147900

Function at 0x1400fa230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14044e3b0]
mov rcx, qword [rax + 0x2020]
mov r9, qword [rax + 0x1c10]
movups xmm0, xmmword [r9 + 0x220]
movups xmmword [rcx + 0x174], xmm0
mov rax, qword [r9 + 0x280]
movups xmm0, xmmword [rcx + 0x154]
movss xmm4, dword [rcx + 0x154]
movss xmm3, dword [rcx + 0x158]
movss xmm2, dword [rcx + 0x15c]
movss xmm1, dword [rcx + 0x160]
movups xmmword [r9 + 0x220], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x280]
movups xmm0, xmmword [rsp + 0x20]
movsxd r8, dword [rax + 0x58]
mov rdx, qword [rax + 0x60]
add r8, r8
movups xmmword [rdx + r8*8 - 0x10], xmm0
movzx r8d, byte [rcx + 0x1f7]
mov rcx, qword [rcx + 0x1a8]
mov rdx, qword [r9 + 0x280]
add rsp, 0x38
jmp 0x140147900
Function at 0x140117960
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x140117984
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x140117a12
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1401179e0
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x1401179e0
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.140360e00
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1401179fd
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x140117a05
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x1401179a1
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x140117af0
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x140117a29
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140117a2b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140117a5d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.140360e00
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140117aed
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140117a98
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x140117ace
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.14033a7d0
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x140117aed
cmp rsi, rax
ja 0x140117aa1
test rsi, rsi
je 0x140117aed
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.14033a7d0
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x14011c590
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x30
cmp byte [0x14044e461], 0
mov rbx, rcx
je 0x14011c675
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14011c675
mov edx, dword [rbx + 0x2d4]
lea rcx, [0x14044e288]
add edx, 0x1128
movaps xmmword [rsp + 0x20], xmm6
call fcn.1400fb380
movss xmm6, dword [0x14037175c]
lea rcx, [0x14044e288]
movaps xmm2, xmm6
mov edx, eax
mov ebx, eax
call fcn.140110850
lea edx, [rbx + 4]
movaps xmm2, xmm6
lea rcx, [0x14044e288]
call fcn.140110850
lea edx, [rbx + 8]
movaps xmm2, xmm6
lea rcx, [0x14044e288]
call fcn.140110850
lea edx, [rbx + 0xc]
movaps xmm2, xmm6
lea rcx, [0x14044e288]
call fcn.140110850
lea edx, [rbx + 0x10]
movaps xmm2, xmm6
lea rcx, [0x14044e288]
call fcn.140110850
lea edx, [rbx + 0x14]
movaps xmm2, xmm6
lea rcx, [0x14044e288]
call fcn.140110850
lea edx, [rbx + 0x18]
movaps xmm2, xmm6
lea rcx, [0x14044e288]
call fcn.140110850
lea edx, [rbx + 0x1c]
movaps xmm2, xmm6
lea rcx, [0x14044e288]
call fcn.140110850
movaps xmm6, xmmword [rsp + 0x20]
add rsp, 0x30
pop rbx
ret

Function at 0x14011c740
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x30]
lea rcx, [rbp + 8]
call fcn.1400fcea0
nop
cmp qword [rbp], 0
jne 0x14011c79a
mov rax, qword [rbp + 0x90]
mov eax, dword [rax + 0x10]
mov dword [rbp + 8], eax
mov rax, qword [rbp + 0x90]
mov r8d, dword [rax + 0x10]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x14011c7aa
mov dword [rbp + 0x7c], 1
jmp 0x14011c7b1
mov dword [rbp + 0x7c], 0
cmp dword [rbp + 0x7c], 0
jne 0x14011c86b
mov eax, dword [rbp + 0x98]
mov ecx, dword [rbp + 0xb0]
add ecx, eax
mov eax, ecx
mov dword [rbp + 0x30], eax
movsxd rax, dword [rbp + 0x30]
lea rcx, [rbp + 0x34]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8, qword [rbp + 0xa8]
mov rdx, rax
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
movsxd rax, dword [rbp + 0x30]
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xa0]
mov rdx, rax
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
movsxd rax, dword [rbp + 0x30]
mov qword [rsp + 0x20], 0
mov r9d, dword [rbp + 0x34]
mov r8, qword [rbp + 0xa8]
mov rdx, rax
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
movsxd rax, dword [rbp + 0x30]
lea rcx, [rbp + 0x38]
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0x34]
mov r8, qword [rbp + 0xa8]
mov rdx, rax
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x14011fe30
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
cmp byte [0x14044e460], 0
je 0x14011feb2
cmp byte [0x14044e24d], 0
jne 0x14011fe52
call fcn.14011df60
mov byte [0x14044e24d], 1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test al, 1
je 0x14011fe6b
movss xmm2, dword [0x140371760]
jmp 0x14011fe9c
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14011feb2
mov edx, dword [0x14044e284]
lea rcx, [0x14044e288]
call fcn.140110680
movss xmm2, dword [0x140371768]
ucomiss xmm0, xmm2
jp 0x14011fe9c
je 0x14011feb2
mov edx, dword [0x14044e284]
lea rcx, [0x14044e288]
add rsp, 0x28
jmp fcn.140110850
add rsp, 0x28
ret

Function at 0x140120250
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
cmp byte [0x14044e44f], 0
je 0x1401202c0
mov qword [rsp + 0x30], rbx
call fcn.140120160
mov ecx, 0xa0
mov ebx, eax
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140120283
mov dword [rsp + 0x48], 0x438c0000
jmp 0x14012029b
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x1401202bb
mov dword [rsp + 0x48], 0x419316d5
mov r9d, 4
mov dword [rsp + 0x20], ebx
lea r8, [rsp + 0x48]
mov edx, 0x3a05c20
lea rcx, [0x14044e288]
call fcn.14011c740
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret

Function at 0x140120b30
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x30]
lea rcx, [rbp + 8]
call fcn.1400fcea0
nop
cmp qword [rbp], 0
jne 0x140120b8a
mov rax, qword [rbp + 0x90]
mov eax, dword [rax + 0x10]
mov dword [rbp + 8], eax
mov rax, qword [rbp + 0x90]
mov r8d, dword [rax + 0x10]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp], rax
movsxd rax, dword [rbp + 0x98]
lea rcx, [rbp + 0x30]
mov qword [rsp + 0x20], rcx
mov r9d, 0x40
mov r8, qword [rbp + 0xa8]
mov rdx, rax
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
movsxd rax, dword [rbp + 0x98]
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xa0]
mov rdx, rax
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
nop
movsxd rax, dword [rbp + 0x98]
mov qword [rsp + 0x20], 0
mov r9d, dword [rbp + 0x30]
mov r8, qword [rbp + 0xa8]
mov rdx, rax
mov rcx, qword [rbp]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
nop
mov al, 1
lea rsp, [rbp + 0x80]
pop rbp
ret
Function at 0x140121580
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x14044a300]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
xor edx, edx
mov ecx, 2
mov ebx, edi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rsi, rax
call sub.KERNEL32.dll_Process32FirstW
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14012168e
lea rdx, str.AndroidEmulatorEx.exe
lea rcx, [rsp + 0x4c]
call fcn.14033b700
test eax, eax
jne 0x140121600
mov dword [0x14044e2d8], 1
lea rdx, str.AndroidEmulatorEn.exe
lea rcx, [rsp + 0x4c]
call fcn.14033b700
test eax, eax
jne 0x14012161f
mov dword [0x14044e2d8], 3
lea rdx, str.aow_exe.exe
lea rcx, [rsp + 0x4c]
call fcn.14033b700
test eax, eax
jne 0x14012164c
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x14012164c
mov edi, dword [rsp + 0x28]
mov ebx, eax
mov dword [0x14044e2dc], 1
lea rdx, str.AndroidProcess.exe
lea rcx, [rsp + 0x4c]
call fcn.14033b700
test eax, eax
jne 0x140121679
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x140121679
mov edi, dword [rsp + 0x28]
mov ebx, eax
mov dword [0x14044e2d8], 2
lea rdx, [rsp + 0x20]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1401215e1
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14031ab80
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1401216c0
Capabilities:
Enumerate gui resources

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x14044a300]
xor rax, rsp
mov qword [rbp + 0x10], rax
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov qword [rbp - 0x60], rcx
mov qword [rbp - 0x60], rdx
mov qword [rbp - 0x58], r8
xor r14d, r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], r14
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
xor r8d, r8d
lea rdx, [0x1403713d0]
lea rcx, [rbp - 0x50]
call fcn.140113240
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
xor r8d, r8d
lea rdx, [0x1403713d0]
lea rcx, [rbp - 0x30]
call fcn.140113240
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
lea rax, [rbp - 0x50]
cmp rax, rdi
je 0x140121776
mov rdx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140121769
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x10]
lea rcx, [rbp - 0x50]
call fcn.1401219b0
lea rax, [rbp - 0x30]
cmp rax, rbx
je 0x140121799
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14012178c
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rbp - 0x30]
call fcn.1401219b0
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
call fcn.140120ff0
nop
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x50]
call fcn.140120ff0
nop
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.140121120
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x30]
lea rcx, [0x140121280]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140121120
nop
lea rcx, [rsp + 0x30]
call fcn.140121210
nop
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140121857
mov rax, qword [rbp]
sub rax, rcx
sar rax, 3
lea rdx, [rax*8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140121846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140121925
call fcn.14031aaec
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140121897
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140121892
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140121925
call fcn.14031aaec
movdqa xmm0, xmmword [0x140371830]
movdqa xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 7
jbe 0x1401218ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401218e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140121925
call fcn.14031aaec
movdqa xmm0, xmmword [0x140371830]
movdqa xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x50], r14w
mov rcx, rbx
call fcn.140116af0
nop
mov rcx, rdi
call fcn.140116af0
mov rax, rsi
mov rcx, qword [rbp + 0x10]
xor rcx, rsp
call fcn.14031ab80
add rsp, 0x120
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140330a70
nop
int3
Function at 0x140121930
Capabilities:
Enumerate process modules

Disassembly:
push rbx
mov eax, 0x1040
call fcn.14031b0d0
sub rsp, rax
mov rax, qword [0x14044a300]
xor rax, rsp
mov qword [rsp + 0x1030], rax
mov ebx, ecx
lea r8, [rsp + 0x20]
mov edx, 0x1000
lea rcx, [rsp + 0x30]
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
je 0x14012198c
mov edx, dword [rsp + 0x20]
shr edx, 2
xor ecx, ecx
cmp ecx, edx
jae 0x140121986
cmp ebx, dword [rsp + rcx*4 + 0x30]
jne 0x140121982
mov al, 1
jmp 0x14012198c
inc ecx
jmp 0x140121974
xor al, al
jmp 0x14012198c
mov rcx, qword [rsp + 0x1030]
xor rcx, rsp
call fcn.14031ab80
add rsp, 0x1040
pop rbx
ret