joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001b57c
Capabilities:
Get common file path

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r13
push r14
sub rsp, 0xd0
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov rax, qword [0x100023110]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rbx, rdx
mov rbp, rcx
xor r13d, r13d
mov qword [rsp + 0x20], r13
mov dword [rsp + 0x2c], r13d
mov dword [rsp + 0x28], r13d
mov word [rsp + 0x40], r13w
mov dword [rcx + 0x100], r13d
lea edx, [r13 + 0x40]
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, r13d
je 0x10001b6f8
cmp eax, 0x40
ja 0x10001b6f8
mov rcx, rbx
call fcn.10001aee0
mov rdi, rax
cmp rax, r13
je 0x10001b6c8
cmp rax, rbx
je 0x10001b6c8
mov r8, rax
sub r8, rbx
sar r8, 1
dec r8
mov rdx, rbx
lea rcx, [rsp + 0x20]
call fcn.100016100
cmp eax, r13d
jge 0x10001b66a
lea rdx, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rdx
je 0x10001b726
test byte [rcx + 0x1c], 1
je 0x10001b726
lea edx, [r13 + 0x13]
mov r9d, eax
lea r8, [0x100001848]
mov rcx, qword [rcx + 0x10]
call fcn.1000048bc
jmp 0x10001b726
mov rdx, qword [rsp + 0x20]
lea rcx, [rsp + 0x40]
call sub.msvcrt.dll__wcsicmp
cmp eax, r13d
jne 0x10001b726
mov ebx, r13d
lea r14, [0x100023e80]
mov rsi, r14
mov rdx, rdi
mov rcx, qword [rsi]
call sub.msvcrt.dll__wcsicmp
cmp eax, r13d
je 0x10001b6ac
inc ebx
add rsi, 0x10
cmp ebx, 2
jb 0x10001b68f
jmp 0x10001b726
mov dword [rbp + 0x100], 1
mov eax, ebx
add rax, rax
mov eax, dword [r14 + rax*8 + 8]
mov dword [rbp + 0x104], eax
jmp 0x10001b726
lea rdx, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rdx
je 0x10001b726
test byte [rcx + 0x1c], 1
je 0x10001b726
mov edx, 0x12
lea r8, [0x100001848]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
jmp 0x10001b726
lea rdx, [0x100023120]
mov rcx, qword [0x100023120]
cmp rcx, rdx
je 0x10001b726
test byte [rcx + 0x1c], 1
je 0x10001b726
mov edx, 0x11
lea r8, [0x100001848]
mov rcx, qword [rcx + 0x10]
call fcn.100004898
mov ebx, dword [rbp + 0x100]
mov edx, 1
lea rcx, [rsp + 0x20]
call fcn.1000170b4
mov eax, ebx
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.10001e7a0
mov rbx, qword [rsp + 0x110]
add rsp, 0xd0
pop r14
pop r13
pop rdi
pop rsi
pop rbp
ret
Function at 0x10001da04
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0x230
mov rax, qword [0x100023110]
xor rax, rsp
mov qword [rsp + 0x220], rax
test ecx, ecx
je 0x10001da5b
sub ecx, 1
je 0x10001da52
sub ecx, 1
je 0x10001da49
cmp ecx, 1
je 0x10001da52
lea rcx, [0x100003e48]
jmp 0x10001da62
lea rcx, [0x100003e30]
jmp 0x10001da62
lea rcx, [0x100003e38]
jmp 0x10001da62
lea rcx, [0x100003e20]
call sub.KERNEL32.dll_OutputDebugStringA
mov r8, qword [rsp + 0x248]
mov ebx, 0x1ff
lea r9, [rsp + 0x250]
lea rcx, [rsp + 0x20]
mov rdx, rbx
call sub.msvcrt.dll__vsnprintf
test eax, eax
js 0x10001daa5
cdqe
cmp rax, rbx
ja 0x10001daa5
jne 0x10001da9e
mov byte [rsp + 0x21f], 0
lea rcx, [rsp + 0x20]
jmp 0x10001dab4
mov byte [rsp + 0x21f], 0
lea rcx, [0x100003e58]
call sub.KERNEL32.dll_OutputDebugStringA
lea rcx, [0x100003e6c]
call sub.KERNEL32.dll_OutputDebugStringA
mov rcx, qword [rsp + 0x220]
xor rcx, rsp
call fcn.10001e7a0
add rsp, 0x230
pop rbx
ret
Function at 0x10001e7a0
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x100023110]
jne 0x10001e7bb
rol rcx, 0x10
test cx, 0xffff
jne 0x10001e7b7
ret 0
ror rcx, 0x10
jmp 0x10001e980
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x100023f80]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov r11, qword [0x100024078]
mov qword [rsp + 0x58], r11
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.ntdll.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10001ea05
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x100023f80]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.ntdll.dll_RtlVirtualUnwind
jmp 0x10001ea27
mov rax, qword [rsp + 0x88]
mov qword [0x100024078], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x100024018], rax
mov rax, qword [0x100024078]
mov qword [0x100023ef0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x100024000], rax
mov dword [0x100023ee0], 0xc0000409
mov dword [0x100023ee4], 1
mov rax, qword [0x100023110]
mov qword [rsp + 0x68], rax
mov rax, qword [0x100023118]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x1000016c0]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x14000129e
Capabilities:
Terminate process

Disassembly:
jmp 0x140011030
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, 2
call fcn.1400013de
movzx ecx, bx
mov r11, rax
cmp ebx, ecx
je 0x14001105f
lea rcx, str.Internal_buffer_overflow
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.14000141f
mov eax, ebx
mov byte [r11 + 1], bl
sar eax, 8
mov byte [r11], al
add rsp, 0x20
pop rbx
ret
Function at 0x14000141f
Capabilities:
Terminate process

Disassembly:
jmp 0x14001d074
push rbx
sub rsp, 0x20
test rcx, rcx
lea rbx, str.corrupt_pack_file_or_internal_error
mov rax, rdx
cmovne rbx, rcx
test rdx, rdx
jne 0x14001d0c0
call fcn.140001203
test rax, rax
jne 0x14001d0c0
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rdx, str.Error:_unpacker:__s_n
mov r8, rbx
lea rcx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fprintf]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.MSVCR100.dll_abort]
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.14000169a

Function at 0x14000145b
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x14001d224
test r8d, r8d
jle 0x14001d277
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov r9, qword [rdi]
movsxd r8, ebx
mov edx, 1
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fwrite]
test eax, eax
jle 0x14001d278
add dword [rdi + 0x34], eax
movsxd rcx, eax
sub ebx, eax
add rsi, rcx
test ebx, ebx
jg 0x14001d241
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.MSVCR100.dll__errno]
mov rcx, qword [rdi + 0x50]
lea rdx, str.Error:_write_on_output_file_failed_err_d_n
mov rcx, qword [rcx + 0xc0]
mov r8d, dword [rax]
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x140001695
Capabilities:
Terminate process

Disassembly:
jmp 0x14001d45c
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14002cec0]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsxd rdi, edx
mov rbx, rcx
test edx, edx
je 0x14001d49b
cmp edi, dword [rcx + 0xc]
jne 0x14001d48f
mov eax, dword [rcx + 0x10]
jmp 0x14001d55c
mov eax, dword [rcx + 8]
cmp eax, 0
cmove eax, edi
mov dword [rcx + 8], eax
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rdx + 0x24]
call sub.MSVCR100.dll_memset
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR100.dll__gmtime64]
mov r10, rax
test rax, rax
jne 0x14001d4e5
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_gmtime_failure__invalid_input_archive_n
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.MSVCR100.dll_fprintf]
or ecx, 0xffffffff
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov dword [rbx + 0xc], edi
mov r11d, dword [rax + 0x14]
mov edx, 0x7bc
add r11d, 0x76c
cmp r11d, edx
jge 0x14001d522
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, 1
mov rcx, rbx
mov r8d, r9d
call fcn.140001352
mov r11d, eax
jmp 0x14001d555
add r11d, 0xffffffc4
shl r11d, 9
or r11d, dword [rax + 0xc]
shl r11d, 5
or r11d, dword [rax + 8]
shl r11d, 6
or r11d, dword [rax + 4]
mov eax, dword [rax + 0x10]
inc eax
shl r11d, 5
shl eax, 0x15
or r11d, eax
mov eax, dword [r10]
shr eax, 1
or r11d, eax
mov dword [rbx + 0x10], r11d
mov eax, r11d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001e4c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret

Function at 0x14000169a
Capabilities:
Terminate process

Disassembly:
jmp 0x140012660
sub rsp, 0x28
test rdx, rdx
lea r8, str.error_unpacking_archive
cmovne r8, rdx
cmp byte [r8], 0x40
jne 0x14001267b
inc r8
mov rcx, qword [rcx + 0xc0]
lea rdx, [0x140028f8c]
call qword [sym.imp.MSVCR100.dll_fprintf]
or ecx, 0xffffffff
call qword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x1400016b3
Capabilities:
Terminate process

Disassembly:
jmp 0x14001d35c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14001d3b1
lea rdx, [0x140029ef4]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fopen]
mov qword [rbx], rax
test rax, rax
jne 0x14001d3b1
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_Could_not_open_jar_file:__s_n
mov r8, rdi
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 3
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1400016c2
Capabilities:
Create directory

Disassembly:
jmp 0x14001cfc0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x14002cec0]
xor rax, rsp
mov qword [rsp + 0x130], rax
movsxd rbx, ecx
mov rcx, rdx
mov rdi, rdx
call sub.MSVCR100.dll_strlen
cmp rax, rbx
jbe 0x14001d02e
lea rcx, [rsp + 0x20]
mov rdx, rdi
call sub.MSVCR100.dll_strcpy
lea rcx, [rsp + 0x20]
mov edx, 0x2f
call qword [sym.imp.MSVCR100.dll_strrchr]
test rax, rax
je 0x14001d02e
lea rdx, [rsp + 0x20]
mov ecx, ebx
mov byte [rax], 0
call fcn.1400016c2
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR100.dll__mkdir]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14001e4c0
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x140011030
Capabilities:
Terminate process

Disassembly:
jmp 0x140011030
push rbx
sub rsp, 0x20
mov ebx, edx
mov edx, 2
call fcn.1400013de
movzx ecx, bx
mov r11, rax
cmp ebx, ecx
je 0x14001105f
lea rcx, str.Internal_buffer_overflow
xor edx, edx
add rsp, 0x20
pop rbx
jmp fcn.14000141f
mov eax, ebx
mov byte [r11 + 1], bl
sar eax, 8
mov byte [r11], al
add rsp, 0x20
pop rbx
ret

Function at 0x140012660
Capabilities:
Terminate process

Disassembly:
jmp 0x140012660
sub rsp, 0x28
test rdx, rdx
lea r8, str.error_unpacking_archive
cmovne r8, rdx
cmp byte [r8], 0x40
jne 0x14001267b
inc r8
mov rcx, qword [rcx + 0xc0]
lea rdx, [0x140028f8c]
call qword [sym.imp.MSVCR100.dll_fprintf]
or ecx, 0xffffffff
call qword [sym.imp.MSVCR100.dll_exit]
int3
Function at 0x14001cfc0
Capabilities:
Create directory

Disassembly:
jmp 0x14001cfc0
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x14002cec0]
xor rax, rsp
mov qword [rsp + 0x130], rax
movsxd rbx, ecx
mov rcx, rdx
mov rdi, rdx
call sub.MSVCR100.dll_strlen
cmp rax, rbx
jbe 0x14001d02e
lea rcx, [rsp + 0x20]
mov rdx, rdi
call sub.MSVCR100.dll_strcpy
lea rcx, [rsp + 0x20]
mov edx, 0x2f
call qword [sym.imp.MSVCR100.dll_strrchr]
test rax, rax
je 0x14001d02e
lea rdx, [rsp + 0x20]
mov ecx, ebx
mov byte [rax], 0
call fcn.1400016c2
lea rcx, [rsp + 0x20]
call qword [sym.imp.MSVCR100.dll__mkdir]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.14001e4c0
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret

Function at 0x14001d074
Capabilities:
Terminate process

Disassembly:
jmp 0x14001d074
push rbx
sub rsp, 0x20
test rcx, rcx
lea rbx, str.corrupt_pack_file_or_internal_error
mov rax, rdx
cmovne rbx, rcx
test rdx, rdx
jne 0x14001d0c0
call fcn.140001203
test rax, rax
jne 0x14001d0c0
call qword [sym.imp.MSVCR100.dll___iob_func]
lea rdx, str.Error:_unpacker:__s_n
mov r8, rbx
lea rcx, [rax + 0x60]
call qword [sym.imp.MSVCR100.dll_fprintf]
add rsp, 0x20
pop rbx
jmp qword [sym.imp.MSVCR100.dll_abort]
mov rdx, rbx
mov rcx, rax
add rsp, 0x20
pop rbx
jmp fcn.14000169a

Function at 0x14001d224
Capabilities:
Terminate process
Write file on windows

Disassembly:
jmp 0x14001d224
test r8d, r8d
jle 0x14001d277
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
mov r9, qword [rdi]
movsxd r8, ebx
mov edx, 1
mov rcx, rsi
call qword [sym.imp.MSVCR100.dll_fwrite]
test eax, eax
jle 0x14001d278
add dword [rdi + 0x34], eax
movsxd rcx, eax
sub ebx, eax
add rsi, rcx
test ebx, ebx
jg 0x14001d241
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
call qword [sym.imp.MSVCR100.dll__errno]
mov rcx, qword [rdi + 0x50]
lea rdx, str.Error:_write_on_output_file_failed_err_d_n
mov rcx, qword [rcx + 0xc0]
mov r8d, dword [rax]
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 1
call qword [sym.imp.MSVCR100.dll_exit]
int3

Function at 0x14001d35c
Capabilities:
Terminate process

Disassembly:
jmp 0x14001d35c
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rdi, rdx
mov rbx, rcx
jne 0x14001d3b1
lea rdx, [0x140029ef4]
mov rcx, rdi
call qword [sym.imp.MSVCR100.dll_fopen]
mov qword [rbx], rax
test rax, rax
jne 0x14001d3b1
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_Could_not_open_jar_file:__s_n
mov r8, rdi
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.MSVCR100.dll_fprintf]
mov ecx, 3
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x14001d45c
Capabilities:
Terminate process

Disassembly:
jmp 0x14001d45c
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14002cec0]
xor rax, rsp
mov qword [rsp + 0x70], rax
movsxd rdi, edx
mov rbx, rcx
test edx, edx
je 0x14001d49b
cmp edi, dword [rcx + 0xc]
jne 0x14001d48f
mov eax, dword [rcx + 0x10]
jmp 0x14001d55c
mov eax, dword [rcx + 8]
cmp eax, 0
cmove eax, edi
mov dword [rcx + 8], eax
xor edx, edx
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x40], rdi
lea r8d, [rdx + 0x24]
call sub.MSVCR100.dll_memset
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCR100.dll__gmtime64]
mov r10, rax
test rax, rax
jne 0x14001d4e5
mov rcx, qword [rbx + 0x50]
lea rdx, str.Error:_gmtime_failure__invalid_input_archive_n
mov rcx, qword [rcx + 0xc0]
call qword [sym.imp.MSVCR100.dll_fprintf]
or ecx, 0xffffffff
call qword [sym.imp.MSVCR100.dll_exit]
int3
mov dword [rbx + 0xc], edi
mov r11d, dword [rax + 0x14]
mov edx, 0x7bc
add r11d, 0x76c
cmp r11d, edx
jge 0x14001d522
and dword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov r9d, 1
mov rcx, rbx
mov r8d, r9d
call fcn.140001352
mov r11d, eax
jmp 0x14001d555
add r11d, 0xffffffc4
shl r11d, 9
or r11d, dword [rax + 0xc]
shl r11d, 5
or r11d, dword [rax + 8]
shl r11d, 6
or r11d, dword [rax + 4]
mov eax, dword [rax + 0x10]
inc eax
shl r11d, 5
shl eax, 0x15
or r11d, eax
mov eax, dword [r10]
shr eax, 1
or r11d, eax
mov dword [rbx + 0x10], r11d
mov eax, r11d
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14001e4c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x80
pop rdi
ret
Function at 0x14001e9db
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x14002cec0]
jne 0x14001e4da
rol rcx, 0x10
test cx, 0xffff
jne 0x14001e4d6
repz ret
ror rcx, 0x10
jmp 0x14001e934
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x14002d5e0]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x14002d6d8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x14001e9b9
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x14002d5e0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x14001e9db
mov rax, qword [rsp + 0x88]
mov qword [0x14002d6d8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x14002d678], rax
mov rax, qword [0x14002d6d8]
mov qword [0x14002d550], rax
mov rax, qword [rsp + 0x90]
mov qword [0x14002d660], rax
mov dword [0x14002d540], 0xc0000409
mov dword [0x14002d544], 1
mov rax, qword [0x14002cec0]
mov qword [rsp + 0x68], rax
mov rax, qword [0x14002cec8]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x14002d5d8], eax
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x140029fb8]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x14002d5d8], 0
jne 0x14001ea62
mov ecx, 1
call sub.MSVCR100.dll___crt_debugger_hook
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret
Function at 0x140008930
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x490], rbx
mov rax, qword [0x14008c010]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov dword [rbp], 0x438
mov edx, dword [rcx + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
lea rcx, [rbp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400089a0
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x140008a1a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400089cb
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14006d150
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x140008a1a
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x30]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x140008a1d
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x140008a2a
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140008a42
inc rbx
test eax, eax
jne 0x140008a30
test ecx, ecx
mov rcx, rsi
je 0x140008aa2
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140008991
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x140008a9e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140008a99
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008b19
mov rcx, r8
call fcn.14006c3cc
xor eax, eax
jmp 0x140008ae5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x28]
cmp rdx, 0x10
jb 0x140008ae2
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140008add
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140008b19
mov rcx, r8
call fcn.14006c3cc
mov rax, rbx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.14006bf30
mov rbx, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140008fc0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rdi
mov rax, qword [0x14008c010]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov dword [rbp], 0x238
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
nop word [rax + rax]
lea rcx, [rbp + 0x2c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140009040
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x1400090ba
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000906b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.14006d150
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x1400090ba
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x2c]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x1400090bd
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x1400090ca
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x1400090e2
inc rbx
test eax, eax
jne 0x1400090d0
test ecx, ecx
mov rcx, rsi
je 0x140009142
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140009030
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000913e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140009139
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400091c3
mov rcx, r8
call fcn.14006c3cc
xor eax, eax
jmp 0x140009183
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov ebx, dword [rbp + 8]
cmp rdx, 0x10
jb 0x140009181
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000917c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400091c3
mov rcx, r8
call fcn.14006c3cc
mov eax, ebx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.14006bf30
mov rbx, qword [rbp + 0x270]
mov rsi, qword [rbp + 0x280]
mov rdi, qword [rbp + 0x288]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000aaa0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x14000aad4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x14000aac0
ret