joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ba050
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r13
mov r15, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
lea r13, [0x140106190]
mov rcx, qword [0x140106190]
cmp rcx, r13
je 0x1400ba0be
test byte [rcx + 0x1c], 1
je 0x1400ba0be
cmp byte [rcx + 0x19], 5
jb 0x1400ba0be
mov edx, 0x53
mov qword [rax - 0x58], r8
mov r9, rdi
lea r8, [0x1400e7210]
mov rcx, qword [rcx + 0x10]
call fcn.14000a2d8
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
mov rdx, rdi
lea rcx, [rbp - 0x28]
call fcn.140004a80
nop
lea rcx, [rbp - 0x28]
call fcn.1400336f0
mov r8, qword [rbp - 0x28]
lea rdx, [rbp - 0x18]
mov rcx, r14
call fcn.1400bbe70
mov ebx, eax
test eax, eax
jne 0x1400ba174
mov dword [rbp - 0x30], 4
lea rax, [rbp - 0x30]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x2c]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
test eax, eax
jne 0x1400ba135
cmp dword [rbp - 0x2c], 4
je 0x1400ba133
lea ebx, [rax + 0xd]
jmp 0x1400ba194
xor ebx, ebx
cmp ebx, 2
jne 0x1400ba194
mov ebx, 0x490
mov r10, qword [0x140106190]
cmp r10, r13
je 0x1400ba1d5
test byte [r10 + 0x1c], 2
je 0x1400ba19b
cmp byte [r10 + 0x19], 4
jb 0x1400ba19b
mov edx, 0x54
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.140003538
jmp 0x1400ba194
cmp eax, 2
jne 0x1400ba194
mov rax, qword [r14]
mov r9, r15
mov r8, rsi
mov rdx, rdi
mov rcx, r14
mov rax, qword [rax + 0x38]
call qword [case.0x14006d218.0]
mov ebx, eax
mov r10, qword [0x140106190]
cmp r10, r13
je 0x1400ba1d5
test byte [r10 + 0x1c], 1
je 0x1400ba1d5
movzx edx, byte [r10 + 0x19]
mov eax, ebx
neg eax
sbb ecx, ecx
and ecx, 0xfffffffd
add ecx, 5
cmp edx, ecx
jb 0x1400ba1d5
mov edx, 0x55
mov r9d, ebx
lea r8, [0x1400e7210]
mov rcx, qword [r10 + 0x10]
call fcn.1400035ec
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
or eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400ba1fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x14006d218.0]
nop
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x1400ba20a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r13, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x1400c034c
Capabilities:
Get local ipv4 addresses

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
mov rbp, rcx
mov rcx, qword [0x140106190]
lea r14, [0x140106190]
cmp rcx, r14
je 0x1400c038f
test byte [rcx + 0x1c], 2
je 0x1400c038f
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e74e8]
mov edx, 0xa
call fcn.140003538
mov eax, 0x1f40
xor ebx, ebx
mov dword [rsp + 0x58], eax
mov ecx, eax
lea rdx, [0x1400da787]
call fcn.1400cda34
mov rsi, rax
test rax, rax
je 0x1400c0456
xor r8d, r8d
lea rax, [rsp + 0x58]
mov r9, rsi
mov qword [rsp + 0x20], rax
xor ecx, ecx
lea edx, [r8 + 0xe]
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersAddresses]
mov edi, eax
cmp eax, 0x7a
je 0x1400c03dc
cmp eax, 0x6f
jne 0x1400c03f4
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
xor esi, esi
inc ebx
cmp ebx, 3
jae 0x1400c040a
mov eax, dword [rsp + 0x58]
jmp 0x1400c039a
movzx eax, di
mov ebx, eax
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
test ebx, ebx
js 0x1400c045b
jmp 0x1400c040d
movzx eax, di
mov ebx, eax
or ebx, 0x80070000
test edi, edi
cmovle ebx, edi
test ebx, ebx
js 0x1400c045b
mov qword [rbp + 0x10], rsi
xor esi, esi
call fcn.1400cd960
test al, al
je 0x1400c045b
call qword [sym.imp.ext_ms_win_casting_receiver_l1_1_0.dll_GetXboxWirelessNetworkInterfaceIndex]
test eax, eax
je 0x1400c045b
mov rcx, qword [rbp + 0x10]
jmp 0x1400c0446
cmp dword [rcx + 4], eax
je 0x1400c044d
mov rcx, qword [rcx + 8]
test rcx, rcx
jne 0x1400c043d
jmp 0x1400c045b
mov dword [rcx + 0x64], 0x47
jmp 0x1400c045b
mov ebx, 0x8007000e
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void____ptr64_]
mov rcx, qword [0x140106190]
cmp rcx, r14
je 0x1400c04a6
test byte [rcx + 0x1c], 2
je 0x1400c04a6
movzx edx, byte [rcx + 0x19]
mov r9d, ebx
sar r9d, 0x1f
and r9d, 0xfffffffd
add r9d, 5
cmp edx, r9d
jl 0x1400c04a6
mov rcx, qword [rcx + 0x10]
lea r8, [0x1400e74e8]
mov edx, reloc.WSOCK32.dll_inet_ntoa
mov r9d, ebx
call fcn.1400035ec
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x1400cc63c
Capabilities:
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0xb0
xor r14d, r14d
mov dword [rsp + 0x20], r14d
lea rcx, [rax - 0x78]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
mov esi, r14d
xor eax, eax
lock cmpxchg qword [0x14010beb8], rbx
je 0x1400cc6a3
cmp rax, rbx
jne 0x1400cc696
mov ebx, 1
mov esi, ebx
jmp 0x1400cc6a8
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400cc67b
mov ebx, 1
mov eax, dword [0x14010bec0]
cmp eax, ebx
jne 0x1400cc6c0
mov edi, 0x1f
mov ecx, edi
call fcn.1401b4000
jmp 0x1400cc72c
mov eax, dword [0x14010bec0]
test eax, eax
jne 0x1400cc721
mov dword [0x14010bec0], ebx
lea r15, [0x1400d8b58]
lea rdi, [0x1400d8b40]
mov qword [rsp + 0x30], rdi
mov eax, r14d
mov dword [rsp + 0x24], eax
cmp rdi, r15
jae 0x1400cc713
test eax, eax
jne 0x1400cc717
cmp qword [rdi], r14
je 0x1400cc708
mov rax, qword [rdi]
mov rcx, qword [case.0x14006d218.0]
call rcx
mov dword [rsp + 0x24], eax
add rdi, 8
mov qword [rsp + 0x30], rdi
jmp 0x1400cc6ea
test eax, eax
je 0x1400cc727
mov eax, 0xff
jmp 0x1400cc882
mov dword [0x140109a30], ebx
mov edi, 0x1f
mov eax, dword [0x14010bec0]
cmp eax, ebx
jne 0x1400cc753
lea rdx, [0x1400d8b38]
lea rcx, [0x1400d89c8]
call sub.msvcrt.dll__initterm
mov dword [0x14010bec0], 2
test esi, esi
jne 0x1400cc761
mov rax, r14
xchg qword [0x14010beb8], rax
cmp qword [0x14010bed8], r14
je 0x1400cc794
lea rcx, [0x14010bed8]
call fcn.1400cd190
test eax, eax
je 0x1400cc794
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x14010bed8]
mov r9, qword [case.0x14006d218.0]
call r9
mov rax, qword [sym.imp.msvcrt.dll__wcmdln]
mov rcx, qword [rax]
test rcx, rcx
jne 0x1400cc7ad
mov eax, 0xff
jmp 0x1400cc882
mov qword [rsp + 0x28], rcx
mov edx, dword [rsp + 0x20]
movzx eax, word [rcx]
cmp ax, 0x20
ja 0x1400cc833
test ax, ax
je 0x1400cc7c8
test edx, edx
jne 0x1400cc833
sub ax, bx
cmp ax, di
ja 0x1400cc7de
add rcx, 2
mov qword [rsp + 0x28], rcx
movzx eax, word [rcx]
jmp 0x1400cc7c8
test byte [rsp + 0x7c], bl
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rcx
xor edx, edx
lea rcx, [0x140000000]
call fcn.140003830
mov dword [0x140109a2c], eax
cmp dword [0x140109a50], r14d
jne 0x1400cc81c
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140109a30], r14d
jne 0x1400cc831
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140109a2c]
jmp 0x1400cc882
cmp ax, 0x22
jne 0x1400cc847
mov eax, r14d
test edx, edx
sete al
mov edx, eax
mov dword [rsp + 0x20], eax
add rcx, 2
mov qword [rsp + 0x28], rcx
jmp 0x1400cc7b6
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop r15
ret
sub rsp, 0x28
call fcn.1400cca70
add rsp, 0x28
jmp 0x1400cc63c
Function at 0x1400cd0a0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400cd0ec
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400cd0e4
cmp dword [rcx + 0x3c], edx
jl 0x1400cd0e4
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400cd0e4
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400cd0ec
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400cd228
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400cd230
push rbx
sub rsp, 0x540
mov rax, qword [0x140109388]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400cd2ad
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400cd2cd
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400cc8d0
add rsp, 0x540
pop rbx
ret

Function at 0x1400cd230
Capabilities:
Print debug messages

Disassembly:
jmp 0x1400cd230
push rbx
sub rsp, 0x540
mov rax, qword [0x140109388]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.ntdll.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.ntdll.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x1400cd2ad
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov r9, rax
mov qword [rsp + 0x30], rcx
mov r8, rbx
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.ntdll.dll_RtlVirtualUnwind]
jmp 0x1400cd2cd
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, str.Invalid_parameter_passed_to_C_runtime_function._n
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.1400cc8d0
add rsp, 0x540
pop rbx
ret
Function at 0x1400080c0
Capabilities:
Log keystrokes via polling

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
movzx eax, byte [0x1401131dd]
test eax, eax
jne 0x1400080d9
jmp 0x140008174
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14000810d
mov rcx, qword [rsp + 0x30]
call fcn.140008080
movzx eax, al
test eax, eax
je 0x14000810d
mov edx, 0x10001
lea rcx, [0x140113270]
call fcn.140022b40
jmp 0x140008174
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x140008163
mov rcx, qword [rsp + 0x30]
call fcn.140008080
movzx eax, al
test eax, eax
jne 0x140008163
mov edx, 0x100
lea rcx, [0x140113270]
call fcn.140022b40
mov edx, 0x10001
lea rcx, [0x140113270]
call fcn.140022b40
mov edx, 0x100
lea rcx, [0x140113270]
call fcn.140022b40
jmp 0x140008174
mov edx, 0x100
lea rcx, [0x140113270]
call fcn.140022b40
add rsp, 0x28
ret

Function at 0x140022230
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x38
movzx eax, byte [0x1401131e6]
test eax, eax
jne 0x140022244
jmp 0x1400223c9
mov dword [rsp + 0x20], 0x20
vmovss xmm0, dword [0x1400efc84]
call fcn.140046e40
vxorps xmm2, xmm2, xmm2
vmovss xmm1, dword [0x1400f0044]
lea rcx, [rsp + 0x24]
call fcn.1400072e0
xor edx, edx
mov rcx, rax
call fcn.140046d30
mov r8d, dword [rsp + 0x20]
xor edx, edx
lea rcx, str.Cheats_List
call fcn.140041bf0
movzx edx, byte [0x1401131c5]
lea rcx, [0x1400ceca4]
call fcn.1400221b0
movzx eax, byte [0x1401131de]
test eax, eax
je 0x1400222d2
movzx eax, byte [0x140113200]
test eax, eax
jne 0x1400222c6
mov ecx, dword [0x1400f90a8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x1400222d2
lea rcx, str.Aimbot__Toggle_
call fcn.1400858f0
movzx edx, byte [0x140113238]
lea rcx, [0x1400ceccc]
call fcn.1400221b0
movzx edx, byte [0x1401131e4]
lea rcx, [0x1400cfe10]
call fcn.1400221b0
movzx edx, byte [0x1401131df]
lea rcx, str.Radar
call fcn.1400221b0
movzx eax, byte [0x1401131d0]
test eax, eax
je 0x14002233e
movzx eax, byte [0x1401131d6]
test eax, eax
jne 0x140022332
mov ecx, dword [0x140113204]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
cwde
test eax, eax
je 0x14002233e
lea rcx, str.TriggerBot__Toggle_
call fcn.1400858f0
movzx edx, byte [0x14011322f]
lea rcx, str.Crosshair
call fcn.1400221b0
movzx edx, byte [0x1401131d5]
lea rcx, str.Headshot_Line
call fcn.1400221b0
movzx edx, byte [0x1401131d7]
lea rcx, str.No_Flash
call fcn.1400221b0
movzx edx, byte [0x1401131dd]
lea rcx, str.Bhop
call fcn.1400221b0
movzx edx, byte [0x1401131e5]
lea rcx, [0x1400cfe80]
call fcn.1400221b0
movzx edx, byte [0x1401131f2]
lea rcx, str.Bomb_Timer
call fcn.1400221b0
movzx edx, byte [0x1401131f0]
lea rcx, str.Spec_List
call fcn.1400221b0
call fcn.140045660
nop
add rsp, 0x38
ret
Function at 0x140022690
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x4d0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400f9010]
xor rax, rbp
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x60], 0x438
mov rax, qword [rbp + 0x4c0]
mov edx, dword [rax + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
call fcn.1400225f0
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x90]
mov qword [rbp + 0x20], rax
cmp qword [rbp + 0x20], 0
jne 0x14002270d
mov qword [rbp + 0x30], 0
jmp 0x1400227ab
mov rax, qword [rbp + 0x20]
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x14002271d
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x14002274c
mov qword [rbp + 0x28], 0
jmp 0x1400227a3
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x40], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140022774
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400c8890
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x40]
mov r8d, ecx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call fcn.140022600
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.14001b040
mov rcx, qword [rbp + 0x30]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x1400227d1
inc rcx
test dl, dl
jne 0x1400227be
xor eax, eax
jmp 0x1400227d6
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140022801
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x88]
mov qword [rbp + 0x48], rax
mov rcx, qword [rbp + 0x4c8]
call fcn.140004080
mov rax, qword [rbp + 0x48]
jmp 0x140022839
lea rdx, [rbp + 0x60]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x1400226ee
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x50], 0
mov rcx, qword [rbp + 0x4c8]
call fcn.140004080
mov rax, qword [rbp + 0x50]
mov rcx, qword [rbp + 0x4a0]
xor rcx, rbp
call fcn.1400c7520
lea rsp, [rbp + 0x4b0]
pop rbp
ret
Function at 0x140023a80
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x2c0
lea rbp, [rsp + 0x20]
mov rax, qword [0x1400f9010]
xor rax, rbp
mov qword [rbp + 0x290], rax
mov dword [rbp + 0x50], 0x238
xor edx, edx
mov ecx, 0xf
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
call fcn.1400225f0
mov dword [rbp + 0x18], eax
lea rax, [rbp + 0x7c]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x28], 0
jne 0x140023af2
mov qword [rbp + 0x38], 0
jmp 0x140023b90
mov rax, qword [rbp + 0x28]
mov qword [rbp + 0x40], rax
mov qword [rbp + 8], 0xffffffffffffffff
inc qword [rbp + 8]
mov rax, qword [rbp + 0x40]
mov rcx, qword [rbp + 8]
cmp word [rax + rcx*2], 0
jne 0x140023b02
mov rax, qword [rbp + 8]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0x3fffffff
jle 0x140023b31
mov qword [rbp + 0x30], 0
jmp 0x140023b88
movsxd rax, dword [rbp]
shl rax, 1
mov qword [rbp + 0x48], rax
movsxd rcx, dword [rbp]
shl rcx, 1
mov rdx, rcx
add rdx, 0xf
cmp rdx, rcx
ja 0x140023b59
movabs rdx, 0xffffffffffffff0
and rdx, 0xfffffffffffffff0
mov rax, rdx
call fcn.1400c8890
sub rsp, rax
lea rax, [rsp + 0x20]
mov r9d, dword [rbp + 0x18]
mov rcx, qword [rbp + 0x48]
mov r8d, ecx
mov rdx, qword [rbp + 0x28]
mov rcx, rax
call fcn.140022600
mov qword [rbp + 0x30], rax
mov rax, qword [rbp + 0x30]
mov qword [rbp + 0x38], rax
mov rcx, qword [rbp + 0x2b8]
call fcn.14001b040
mov rcx, qword [rbp + 0x38]
sub rax, rcx
movzx edx, byte [rcx]
cmp dl, byte [rcx + rax]
jne 0x140023bb6
inc rcx
test dl, dl
jne 0x140023ba3
xor eax, eax
jmp 0x140023bbb
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140023be0
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x58]
mov dword [rbp + 0x1c], eax
mov rcx, qword [rbp + 0x2b8]
call fcn.140004080
mov eax, dword [rbp + 0x1c]
jmp 0x140023c16
lea rdx, [rbp + 0x50]
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140023ad6
mov rcx, qword [rbp + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x20], 0
mov rcx, qword [rbp + 0x2b8]
call fcn.140004080
mov eax, dword [rbp + 0x20]
mov rcx, qword [rbp + 0x290]
xor rcx, rbp
call fcn.1400c7520
lea rsp, [rbp + 0x2a0]
pop rbp
ret
Function at 0x140025c20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x38
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x68], 0
je 0x140025c59
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x140025d47
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x50], 0
jle 0x140025cef
cmp qword [rsp + 0x20], 0
jle 0x140025cef
mov rax, qword [rsp + 0x20]
cmp qword [rsp + 0x50], rax
jge 0x140025c99
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x48]
mov rcx, rax
call fcn.140004970
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rsp + 0x50], 0
jle 0x140025d37
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x80], 0
je 0x140025d37
mov rax, qword [rsp + 0x40]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
sub rcx, rax
mov rax, rcx
add rsp, 0x38
ret
Function at 0x140025d50
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x78
mov rax, qword [0x1400f9010]
xor rax, rsp
mov qword [rsp + 0x60], rax
cmp qword [rsp + 0x90], 0
jg 0x140025d84
xor eax, eax
jmp 0x140025f80
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x68], 0
je 0x140025db6
mov r8, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
jmp 0x140025f80
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
jbe 0x140025e67
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x50]
call fcn.1400051d0
mov rax, qword [rax]
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, qword [rsp + 0x20]
mov rdx, rax
mov rcx, qword [rsp + 0x88]
call fcn.140004970
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov edx, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
mov rax, qword [rsp + 0x80]
cmp qword [rax + 0x80], 0
je 0x140025f70
mov rcx, qword [rsp + 0x80]
call fcn.140027390
mov qword [rsp + 0x48], 0xfff
cmp qword [rsp + 0x50], 0xfff
jbe 0x140025f1d
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8d, 0xfff
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x88]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x28], 0xfff
je 0x140025f18
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
jmp 0x140025f80
jmp 0x140025e93
cmp qword [rsp + 0x50], 0
jbe 0x140025f70
mov rax, qword [rsp + 0x80]
mov r9, qword [rax + 0x80]
mov r8, qword [rsp + 0x50]
mov edx, 1
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x30]
sub rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400c7520
add rsp, 0x78
ret