joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003340
Capabilities:
Create process on windows

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0x90
xorps xmm0, xmm0
movzx ebx, r9b
movups xmmword [rax - 0x78], xmm0
mov dword [rax - 0x78], 0x70
lea r9, str.runas
mov dword [rax - 0x74], 0x40
test r8b, r8b
movups xmmword [rax - 0x68], xmm0
movups xmmword [rax - 0x58], xmm0
movups xmmword [rax - 0x48], xmm0
movups xmmword [rax - 0x38], xmm0
movups xmmword [rax - 0x28], xmm0
movups xmmword [rax - 0x18], xmm0
mov qword [rsp + 0x38], rcx
lea rax, str.open
cmovne rax, r9
mov qword [rsp + 0x40], rdx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x50], 5
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x1400033ce
lea rcx, str.Failed_to_launch_process.
call fcn.140005810
xor al, al
add rsp, 0x90
pop rbx
ret
lea rcx, str.Launch_succeeded
call fcn.140005810
test bl, bl
je 0x14000346e
lea rcx, str.waiting_for_exit...
mov qword [rsp + 0xa0], rdi
call fcn.140005810
mov rbx, qword [rsp + 0x88]
mov edi, 0xffffffff
mov edx, edi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0xb0]
mov dword [rsp + 0xb0], 0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [rsp + 0xb0]
lea rcx, str.Application_exited_with_code__d
test eax, eax
cmove edx, edi
mov dword [rsp + 0xb0], edx
call fcn.140005810
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0xb0], 0
mov rdi, qword [rsp + 0xa0]
sete al
add rsp, 0x90
pop rbx
ret
mov al, 1
add rsp, 0x90
pop rbx
ret

Function at 0x1400035b0
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x840
cmp dword [0x1400275f0], 0
mov rbx, rcx
jle 0x1400035fe
cmp qword [0x1400275f8], 8
lea rdx, [0x1400275e0]
mov r8, 0xffffffffffffffff
cmovae rdx, qword [0x1400275e0]
inc r8
cmp word [rdx + r8*2], 0
jne 0x1400035e3
call fcn.1400023f0
mov al, 1
add rsp, 0x840
pop rbx
ret
lea rax, [rsp + 0x858]
mov qword [rsp + 0x850], rsi
mov qword [rsp + 0x30], rax
lea r8, str.InstallFolder
xor esi, esi
mov dword [rsp + 0x858], 0x800
lea rax, [rsp + 0x40]
mov rcx, 0xffffffff80000002
mov qword [rsp + 0x28], rax
lea rdx, str.SOFTWAREWOW6432NodeRockstar_GamesLauncher
mov qword [rsp + 0x20], rsi
lea r9d, [rsi + 2]
call qword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x140003714
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], si
jne 0x140003662
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.1400023f0
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rbx + 0x10]
mov rax, rdx
sub rax, rcx
cmp rax, 0xd
jb 0x1400036db
mov qword [rsp + 0x860], rdi
lea rdi, [rcx + 0xd]
mov qword [rbx + 0x10], rdi
cmp rdx, 8
jb 0x1400036a6
mov rbx, qword [rbx]
lea rcx, [rbx + rcx*2]
mov r8d, 0x1a
lea rdx, str.Launcher.exe
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi*2], si
mov al, 1
mov rdi, qword [rsp + 0x860]
mov rsi, qword [rsp + 0x850]
add rsp, 0x840
pop rbx
ret
movzx r8d, byte [rsp + 0x858]
lea r9, str.Launcher.exe
mov edx, 0xd
mov qword [rsp + 0x20], 0xd
mov rcx, rbx
call fcn.140004710
mov rsi, qword [rsp + 0x850]
mov al, 1
add rsp, 0x840
pop rbx
ret
mov rsi, qword [rsp + 0x850]
xor al, al
add rsp, 0x840
pop rbx
ret
Function at 0x140004230
Capabilities:
Accept command line arguments

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
test rax, rax
je 0x1400042ae
movzx edx, word [rax]
test dx, dx
je 0x1400042ae
mov rcx, rax
cmp dx, 0x22
jne 0x14000426c
lea rdx, [0x14001e204]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x1400042ae
add rax, 4
jmp 0x140004281
lea rdx, [0x14001dd34]
call sub.VCRUNTIME140.dll_wcsstr
test rax, rax
je 0x1400042ae
add rax, 2
test rax, rax
je 0x1400042ae
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140004290
mov rdx, rax
mov rcx, rbx
call fcn.1400023f0
mov al, 1
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1400051d8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r8, dword [0x14000003c]
lea rsi, [0x140000000]
add r8, rsi
mov rbx, rdx
mov rdi, rcx
cmp dword [r8 + 0x84], 0xd
jbe 0x140005250
mov r10d, dword [r8 + 0xf0]
xor r9d, r9d
test r10d, r10d
je 0x140005250
movzx ecx, word [r8 + 0x14]
movzx r11d, word [r8 + 6]
add rcx, 0x18
mov r10d, dword [r10 + rsi + 0xc]
add rcx, r8
test r11d, r11d
je 0x140005250
mov eax, dword [rcx + 0xc]
cmp r10d, eax
jb 0x140005244
mov edx, dword [rcx + 8]
add eax, edx
cmp r10d, eax
jb 0x140005262
inc r9d
add rcx, 0x28
cmp r9d, r11d
jb 0x140005232
xor eax, eax
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov dword [rdi], edx
mov eax, dword [rcx + 0x24]
mov dword [rbx], eax
mov eax, dword [rcx + 0xc]
add rax, rsi
jmp 0x140005252

Function at 0x140006a90
Capabilities:
Accept command line arguments

Disassembly:
test rdx, rdx
je 0x140006b9c
push rbx
sub rsp, 0x40
xorps xmm0, xmm0
mov qword [rsp + 0x50], rsi
xorps xmm1, xmm1
mov qword [rsp + 0x60], rdi
movups xmmword [rsp + 0x20], xmm0
mov rbx, rcx
mov r8, 0xffffffffffffffff
movdqu xmmword [rsp + 0x30], xmm1
inc r8
cmp word [rdx + r8*2], 0
jne 0x140006ac3
lea rcx, [rsp + 0x20]
call fcn.140001f40
lea rcx, [rsp + 0x20]
call fcn.140005e50
cmp qword [rsp + 0x38], 8
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x58]
mov dword [rsp + 0x58], 0
cmovae rcx, qword [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edx, dword [rsp + 0x58]
lea rcx, str.Processing__d_command_line_arguments
mov rsi, rax
call fcn.140005810
mov rdi, qword [rbx + 8]
mov rbx, qword [rbx]
cmp rbx, rdi
je 0x140006b48
nop word [rax + rax]
mov edx, dword [rsp + 0x58]
mov r8, rsi
mov rcx, qword [rbx]
call fcn.1400064d0
add rbx, 8
cmp rbx, rdi
jne 0x140006b30
mov rdx, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
cmp rdx, 8
jb 0x140006b97
mov rcx, qword [rsp + 0x20]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006b92
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006b92
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001af28
add rsp, 0x40
pop rbx
ret
Function at 0x140007830
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.1400077b0
test al, al
jne 0x14000786e
mov dl, 1
xor ecx, ecx
call fcn.140005860
cmp qword [rbx + 0x18], 8
jb 0x140007855
mov rbx, qword [rbx]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dl, 1
xor ecx, ecx
add rsp, 0x20
pop rbx
jmp fcn.140005860
add rsp, 0x20
pop rbx
ret

Function at 0x140008420
Capabilities:
Get file version info

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x20
xor eax, eax
mov rsi, rdx
mov qword [rdx + 8], rax
mov rbx, rcx
mov qword [rdx], rax
cmp qword [rcx + 0x18], 8
jb 0x140008441
mov rcx, qword [rcx]
xor edx, edx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
test eax, eax
jne 0x140008456
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
mov rcx, rbp
mov qword [rsp + 0x50], rdi
call fcn.14001b654
cmp qword [rbx + 0x18], 8
mov rdi, rax
jb 0x140008470
mov rbx, qword [rbx]
mov r9, rdi
mov r8d, ebp
xor edx, edx
mov rcx, rbx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x1400084da
lea r9, [rsp + 0x40]
mov rcx, rdi
lea r8, [rsp + 0x48]
lea rdx, [0x14001dcbc]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x1400084da
mov rax, qword [rsp + 0x48]
movzx ecx, word [rax + 8]
movzx r8d, word [rax + 0xc]
movzx edx, word [rax + 0xe]
movzx eax, word [rax + 0xa]
mov dword [rsi + 4], ecx
mov rcx, rdi
mov dword [rsi], eax
mov dword [rsi + 8], edx
mov dword [rsi + 0xc], r8d
call fcn.14001af28
mov rdi, qword [rsp + 0x50]
mov al, 1
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
mov rcx, rdi
call fcn.14001af28
mov rdi, qword [rsp + 0x50]
xor al, al
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret

Function at 0x140008990
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rbx + 0x18], 8
jb 0x1400089ab
mov rbx, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp eax, 0xffffffff
jne 0x1400089c3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov dl, 1
xor ecx, ecx
call fcn.140005860
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x1400089e0
Capabilities:
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov edi, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rbx + 0x18], 8
mov rcx, rbx
jb 0x140008a04
mov rcx, qword [rbx]
mov edx, edi
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x140008a4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov edi, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
cmp qword [rbx + 0x18], 8
jb 0x140008a2a
mov rbx, qword [rbx]
mov r9, rbx
lea rcx, str.Failed_to_set_file_attributes:__d__0x_x__for__ls
mov r8d, edi
mov edx, edi
call fcn.140005810
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov dl, 1
xor ecx, ecx
call fcn.140005860
mov rbx, qword [rsp + 0x30]
mov al, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140008a70
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
mov dl, 1
xor ecx, ecx
call fcn.140005860
cmp qword [rdi + 0x18], 8
mov rcx, rdi
jb 0x140008a98
mov rcx, qword [rdi]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x30], rbp
xor r8d, r8d
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea edx, [rbp + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x140008af3
mov dl, 1
xor ecx, ecx
call fcn.140005860
cmp qword [rdi + 0x18], 8
jb 0x140008adf
mov rdi, qword [rdi]
lea rcx, str.Couldnt_open__ls
mov rdx, rdi
call fcn.140005810
jmp 0x140008bc9
lea rdx, [rsp + 0x78]
mov qword [rsp + 0x78], rbp
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x140008b31
mov dl, 1
xor ecx, ecx
call fcn.140005860
cmp qword [rdi + 0x18], 8
jb 0x140008b1d
mov rdi, qword [rdi]
lea rcx, str.Cant_get_file_size:__ls
mov rdx, rdi
call fcn.140005810
jmp 0x140008bc9
cmp dword [rsp + 0x7c], ebp
jle 0x140008b52
cmp qword [rdi + 0x18], 8
jb 0x140008b41
mov rdi, qword [rdi]
lea rcx, str.File_too_big:__ls
mov rdx, rdi
call fcn.140005810
jmp 0x140008bc9
mov edx, dword [rsp + 0x78]
lea r8, [rsp + 0x60]
mov rcx, rsi
call fcn.140008f30
mov r8d, dword [rsp + 0x78]
lea r9, [rsp + 0x70]
mov rdx, qword [rsi]
mov rcx, rbx
mov dword [rsp + 0x70], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140008b9e
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x70], eax
jb 0x140008b9e
mov dl, 1
xor ecx, ecx
call fcn.140005860
mov dil, 1
jmp 0x140008bd6
mov dl, 1
xor ecx, ecx
call fcn.140005860
cmp qword [rdi + 0x18], 8
jb 0x140008bb1
mov rdi, qword [rdi]
mov r8d, dword [rsp + 0x78]
lea rcx, str.Only_read__d_out_of__d_bytes_for__ls
mov edx, dword [rsp + 0x70]
mov r9, rdi
call fcn.140005810
xor dil, dil
lea rcx, [rbx - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140008be8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dl, 1
xor ecx, ecx
call fcn.140005860
mov rbx, qword [rsp + 0x68]
movzx eax, dil
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009b10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140009bd9
cmp byte [rcx + 0x71], 0
je 0x140009bd9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140009bcc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009b88
sub eax, 1
je 0x140009b8c
cmp eax, 2
jne 0x140009bcc
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140009bba
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140009bcc
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret

Function at 0x140009bf0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140009cbb
cmp byte [rcx + 0x72], 0
je 0x140009cbb
mov rax, qword [rcx]
mov qword [rsp + 0x68], rdi
mov edi, 0xffff
mov edx, edi
call qword [rax + 0x18]
cmp di, ax
je 0x140009cae
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009c6a
sub eax, 1
je 0x140009c6e
cmp eax, 2
jne 0x140009cae
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x72], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140009c9c
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140009cae
cmp byte [rbx + 0x72], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x140009d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x80], 0
mov rbx, rcx
je 0x140009e8c
mov rcx, qword [rcx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [rcx], rax
jne 0x140009dd4
mov rdx, qword [rbx + 0x88]
mov r8, qword [rbx + 0x90]
mov qword [rcx], rdx
sub r8d, edx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
mov rax, qword [rbx + 0x50]
mov dword [rax], r8d
cmp qword [rbx + 0x68], 0
lea rdi, [rbx + 0x71]
je 0x140009e2e
cmp byte [rdi], 0
je 0x140009e2e
mov rax, qword [rbx]
mov edx, 0xffffffff
mov rcx, rbx
call qword [rax + 0x18]
cmp eax, 0xffffffff
jne 0x140009dfb
xor al, al
jmp 0x140009e30
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009e4f
sub eax, 1
je 0x140009e52
cmp eax, 2
jne 0x140009df7
mov byte [rdi], 0
mov al, 1
mov rcx, qword [rbx + 0x80]
xor esi, esi
test al, al
mov ebp, esi
cmovne rbp, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
cmovne rbp, rsi
jmp 0x140009e94
mov byte [rdi], 0
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rsi, rax
je 0x140009e84
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140009df7
cmp byte [rdi], 0
sete al
jmp 0x140009e30
xor esi, esi
lea rdi, [rcx + 0x71]
mov ebp, esi
mov rcx, rbx
mov byte [rbx + 0x7c], 0
mov byte [rdi], 0
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbx + 0x80], rsi
mov rax, rbp
mov rcx, qword [0x140027728]
mov rbp, qword [rsp + 0x70]
mov qword [rbx + 0x68], rsi
mov rsi, qword [rsp + 0x78]
mov qword [rbx + 0x74], rcx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x140009ee0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x80], 0
mov rbx, rcx
je 0x140009ff1
mov rcx, qword [rcx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [rcx], rax
jne 0x140009f37
mov rdx, qword [rbx + 0x88]
mov r8, qword [rbx + 0x90]
mov qword [rcx], rdx
sub r8, rdx
mov rax, qword [rbx + 0x38]
sar r8, 1
mov qword [rax], rdx
mov rax, qword [rbx + 0x50]
mov dword [rax], r8d
cmp qword [rbx + 0x68], 0
lea rdi, [rbx + 0x72]
je 0x140009f93
cmp byte [rdi], 0
je 0x140009f93
mov rax, qword [rbx]
mov esi, 0xffff
mov edx, esi
mov rcx, rbx
call qword [rax + 0x18]
cmp si, ax
jne 0x140009f60
xor al, al
jmp 0x140009f95
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140009fb4
sub eax, 1
je 0x140009fb7
cmp eax, 2
jne 0x140009f5c
mov byte [rdi], 0
mov al, 1
mov rcx, qword [rbx + 0x80]
xor esi, esi
test al, al
mov ebp, esi
cmovne rbp, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test eax, eax
cmovne rbp, rsi
jmp 0x140009ff9
mov byte [rdi], 0
mov rsi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rsi, rax
je 0x140009fe9
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140009f5c
cmp byte [rdi], 0
sete al
jmp 0x140009f95
xor esi, esi
lea rdi, [rcx + 0x72]
mov ebp, esi
mov rcx, rbx
mov byte [rbx + 0x7c], 0
mov byte [rdi], 0
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Init_void____ptr64]
mov qword [rbx + 0x80], rsi
mov rax, rbp
mov rcx, qword [0x140027720]
mov rbp, qword [rsp + 0x70]
mov qword [rbx + 0x68], rsi
mov rsi, qword [rsp + 0x78]
mov qword [rbx + 0x74], rcx
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x14000a3b0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov edi, 0xffff
movzx esi, dx
mov rbx, rcx
cmp di, dx
jne 0x14000a3d2
xor eax, eax
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000a405
mov rax, qword [rcx + 0x58]
movsxd rcx, dword [rax]
lea rax, [rdx + rcx*2]
cmp rdx, rax
jae 0x14000a405
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_protected:_wchar_t____ptr64___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::_Pninc_void____ptr64]
mov word [rax], si
movzx eax, si
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x90], rbp
je 0x14000a518
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000a44c
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub rdx, rcx
mov rax, qword [rbx + 0x38]
sar rdx, 1
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14000a476
movzx ecx, si
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputwc]
cmp ax, di
je 0x14000a518
movzx edi, si
jmp 0x14000a518
lea rax, [rsp + 0xa0]
mov word [rsp + 0x40], si
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x42]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64__wchar_t_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000a4d2
sub eax, 1
je 0x14000a4d2
cmp eax, 2
jne 0x14000a518
movzx ecx, word [rsp + 0x40]
jmp 0x14000a458
mov rbp, qword [rsp + 0xa0]
lea rax, [rsp + 0x48]
sub rbp, rax
je 0x14000a503
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rbp
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbp, rax
jne 0x14000a518
lea rax, [rsp + 0x40]
mov byte [rbx + 0x72], 1
cmp qword [rsp + 0xa8], rax
cmovne di, si
mov rbp, qword [rsp + 0x90]
movzx eax, di
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x14000c0d0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rbp, rcx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x14000c10e
lea rcx, str.Could_not_get_a_valid_snapshot_of_the_process.
jmp 0x14000c127
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
je 0x14000c13d
lea rcx, str.Could_not_get_the_process_information_from_the_snapshot.
mov dl, 1
call fcn.140005860
xor sil, sil
lea rdi, [rbp + 0x38]
cmp rbx, 0xffffffffffffffff
je 0x14000c18c
jmp 0x14000c183
lea rdi, [rbp + 0x38]
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rdi]
mov dword [rsp + 0x20], 0x238
test rcx, rcx
je 0x14000c1c5
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
call qword [rax + 0x10]
test al, al
je 0x14000c180
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14000c150
mov sil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000c1a8
mov r8, qword [rcx]
cmp rcx, rbp
setne dl
call qword [r8 + 0x20]
mov qword [rdi], 0
lea r11, [rsp + 0x260]
movzx eax, sil
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call sub.MSVCP140.dll_void___cdecl_std::_Xbad_function_call_void_
int3