joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000c03c
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push r12
sub rsp, 0xb0
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x100010478], rbx
je 0x10000c095
cmp rax, rbx
jne 0x10000c088
mov edi, 1
jmp 0x10000c095
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10000c06f
mov eax, dword [0x100010470]
cmp eax, 1
jne 0x10000c0aa
lea ecx, [rax + 0x1e]
call sub.msvcrt.dll__amsg_exit
jmp 0x10000c10f
mov eax, dword [0x100010470]
test eax, eax
jne 0x10000c105
mov dword [0x100010470], 1
lea r12, [0x100001538]
lea rbx, [0x100001520]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
cmp rbx, r12
jae 0x10000c0f7
test eax, eax
jne 0x10000c0fb
mov rcx, qword [rbx]
test rcx, rcx
je 0x10000c0ec
call rcx
mov dword [rsp + 0x30], eax
add rbx, 8
mov qword [rsp + 0x38], rbx
jmp 0x10000c0d5
test eax, eax
je 0x10000c10f
mov eax, 0xff
jmp 0x10000c259
mov dword [0x10000f74c], 1
mov eax, dword [0x100010470]
cmp eax, 1
jne 0x10000c137
lea rdx, [0x100001518]
lea rcx, [0x100001508]
call sub.msvcrt.dll__initterm
mov dword [0x100010470], 2
test edi, edi
jne 0x10000c144
xor eax, eax
xchg qword [0x100010478], rax
cmp qword [0x100010480], 0
je 0x10000c16d
lea rcx, [0x100010480]
call fcn.10000c6dc
test eax, eax
je 0x10000c16d
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100010480]
mov rax, qword [sym.imp.msvcrt.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
cmp byte [rbx], 0x20
ja 0x10000c1f8
cmp byte [rbx], 0
je 0x10000c18e
test edi, edi
jne 0x10000c1f8
mov al, byte [rbx]
test al, al
je 0x10000c1a2
cmp al, 0x20
ja 0x10000c1a2
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x10000c18e
test byte [rsp + 0x7c], 1
movzx eax, word [rsp + 0x80]
mov r9d, 0xa
cmovne r9d, eax
mov r8, rbx
xor edx, edx
lea rcx, [0x100000000]
call fcn.100003458
mov dword [0x10000f748], eax
cmp dword [0x10000f72c], 0
jne 0x10000c1e1
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x10000f74c], 0
jne 0x10000c1f6
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x10000f748]
jmp 0x10000c259
cmp byte [rbx], 0x22
jne 0x10000c20a
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, byte [rbx]
call qword [sym.imp.msvcrt.dll__ismbblead]
test eax, eax
je 0x10000c21f
inc rbx
mov qword [rsp + 0x28], rbx
inc rbx
mov qword [rsp + 0x28], rbx
jmp 0x10000c180
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop r12
ret
sub rsp, 0x28
call fcn.10000c7e4
add rsp, 0x28
jmp 0x10000c03c
Function at 0x10000c380
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x10000f100]
jne 0x10000c39b
rol rcx, 0x10
test cx, 0xffff
jne 0x10000c397
ret 0
ror rcx, 0x10
jmp 0x10000c8a0
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x10000f800]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x10000f8f8]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x10000c925
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x10000f800]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x10000c947
mov rax, qword [rsp + 0x88]
mov qword [0x10000f8f8], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x10000f898], rax
mov rax, qword [0x10000f8f8]
mov qword [0x10000f770], rax
mov rax, qword [rsp + 0x90]
mov qword [0x10000f880], rax
mov dword [0x10000f760], 0xc0000409
mov dword [0x10000f764], 1
mov rax, qword [0x10000f100]
mov qword [rsp + 0x68], rax
mov rax, qword [0x10000f108]
mov qword [rsp + 0x70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x100001598]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x10000c3a8
Capabilities:
Print debug messages

Disassembly:
push rbx
sub rsp, 0x540
mov rax, qword [0x10000f100]
xor rax, rsp
mov qword [rsp + 0x530], rax
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rbx, qword [rsp + 0x158]
lea rdx, [rsp + 0x40]
mov rcx, rbx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
test rax, rax
je 0x10000c425
and qword [rsp + 0x38], 0
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x50]
mov r9, rax
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x60]
mov r8, rbx
mov qword [rsp + 0x20], rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_RtlVirtualUnwind]
jmp 0x10000c445
mov rax, qword [rsp + 0x548]
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x548]
mov qword [rsp + 0xf8], rax
lea rcx, [0x100001560]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rcx, qword [rsp + 0x530]
xor rcx, rsp
call fcn.10000c380
add rsp, 0x540
pop rbx
ret

Function at 0x10000c73c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
test rcx, rcx
je 0x10000c789
cmp rcx, 0xffffffffffffffff
je 0x10000c789
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x10000c781
cmp dword [rcx + 0x3c], edx
jl 0x10000c781
cmp dword [rcx + 0x3c], 0x10000000
jae 0x10000c781
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x10000c789
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140001070
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x290
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov ecx, 2
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001118
lea rsi, str.explorer.exe
nop word [rax + rax]
lea rdx, [rsp + 0x6c]
mov rax, 0xffffffffffffffff
nop dword [rax]
movzx ecx, word [rdx + rax*2 + 2]
cmp cx, word [rsi + rax*2 + 2]
jne 0x140001100
add rax, 2
cmp rax, 0xd
je 0x140001114
movzx ecx, word [rdx + rax*2]
cmp cx, word [rsi + rax*2]
je 0x1400010e0
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400010d0
jmp 0x140001118
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14000113b
lea rcx, str.Process_not_found_:_
call fcn.140001010
mov eax, 1
jmp 0x1400011d5
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
xor edx, edx
mov dword [rsp + 0x20], 0x40
mov rcx, rax
mov r9d, pe_overlay
mov r8d, 0xaa
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsp + 0x30], 0
xor r8d, r8d
mov r9, rax
mov dword [rsp + 0x28], 0
xor edx, edx
mov qword [rsp + 0x20], 0
mov rcx, rsi
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rcx, rax
mov edx, 0xffffffff
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140001210
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x140001ad0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001b1a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001b1a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001b1a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001b1a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001b1a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001b1c
xor al, al
add rsp, 0x28
ret
Function at 0x140002770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov r10d, dword [0x140120130]
lea rsi, [0x140000000]
xor r10d, dword [rcx + 4]
mov r11, rcx
mov eax, dword [rcx + 8]
mov ebx, 2
mov edi, 8
mov ecx, r10d
shr rcx, 0x10
movzx edx, cl
mov ecx, r10d
shr rcx, 0x18
mov r9d, dword [rsi + rdx*4 + 0x120960]
add r9d, dword [rsi + rcx*4 + 0x120560]
mov ecx, r10d
shr rcx, 8
movzx edx, cl
movzx ecx, r10b
xor r9d, dword [rsi + rdx*4 + 0x121160]
add r9d, dword [rsi + rcx*4 + 0x120d60]
lea ecx, [rbx - 1]
xor r9d, dword [rsi + rcx*4 + 0x120130]
xor eax, r9d
mov ecx, eax
shr rcx, 0x10
movzx edx, cl
mov ecx, eax
shr rcx, 0x18
mov r8d, dword [rsi + rdx*4 + 0x120960]
add r8d, dword [rsi + rcx*4 + 0x120560]
mov ecx, eax
shr rcx, 8
movzx edx, cl
movzx ecx, al
xor r8d, dword [rsi + rdx*4 + 0x121160]
add r8d, dword [rsi + rcx*4 + 0x120d60]
mov ecx, ebx
add ebx, 2
xor r8d, dword [rsi + rcx*4 + 0x120130]
xor r10d, r8d
sub rdi, 1
jne 0x1400027a1
xor eax, dword [0x140120174]
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov dword [r11 + 4], eax
mov dword [r11 + 8], r10d
ret
Function at 0x140007c50
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
cmp qword [rdx + 0x18], 7
mov r12, rdx
mov r13, rcx
mov qword [rsp + 0x48], rdx
jbe 0x140007c7e
mov rax, qword [rdx]
mov qword [rsp + 0x48], rax
cmp qword [rcx + 0x18], 7
mov qword [rsp + 0x50], r13
jbe 0x140007c92
mov rax, qword [rcx]
mov qword [rsp + 0x50], rax
mov ecx, WSAStartup
xor edx, edx
call fcn.140001af0
mov ecx, 0x75
mov edx, 1
movzx r15d, ax
call fcn.140001af0
mov ecx, WSAGetLastError
mov edx, 2
movzx r14d, ax
call fcn.140001af0
mov ecx, 0x61
mov edx, 3
movzx ebp, ax
call fcn.140001af0
mov ecx, reloc.WS2_32.dll_WSAStartup
mov edx, 4
movzx esi, ax
call fcn.140001af0
xor ecx, ecx
mov edx, 5
movzx edi, ax
call fcn.140001af0
movzx ecx, word [0x1400db39c]
mov edx, 6
movzx ebx, ax
call fcn.140001af0
movzx ecx, word [0x1400db39e]
mov edx, 7
movzx r9d, ax
call fcn.140001af0
movzx ecx, word [str.drop_mapper]
mov edx, 8
movzx r8d, ax
call fcn.140001af0
movzx ecx, word [0x1400db3a2]
mov edx, 9
movzx r11d, ax
call fcn.140001af0
movzx ecx, word [0x1400db3a4]
mov edx, 0xa
movzx r10d, ax
call fcn.140001af0
mov ecx, 0x133
xor r15w, cx
mov ecx, 0x134
xor r14w, cx
mov word [rsp + 0x30], r15w
mov ecx, 0x135
mov word [rsp + 0x32], r14w
xor bp, cx
mov ecx, 0x136
xor si, cx
mov word [rsp + 0x34], bp
mov ecx, 0x137
mov word [rsp + 0x36], si
xor di, cx
mov ecx, 0x138
xor bx, cx
mov word [rsp + 0x38], di
mov ecx, 0x139
mov word [rsp + 0x3a], bx
xor r9w, cx
mov ecx, 0x13a
xor r8w, cx
mov word [rsp + 0x3c], r9w
mov r9, qword [rsp + 0x48]
mov ecx, 0x13b
xor r11w, cx
mov word [rsp + 0x3e], r8w
mov ecx, 0x13c
mov word [rsp + 0x40], r11w
xor r10w, cx
mov ecx, 0x13d
xor ax, cx
mov word [rsp + 0x42], r10w
xor ebx, ebx
mov word [rsp + 0x44], ax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov word [rsp + 0x46], bx
mov r8, qword [rsp + 0x50]
lea rdx, [rsp + 0x30]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [r13 + 0x18]
cmp rdx, 7
jbe 0x140007e61
mov rcx, qword [r13]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140007e5c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007eda
mov rcx, r8
call fcn.1400c7260
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], 7
mov word [r13], bx
mov rdx, qword [r12 + 0x18]
cmp rdx, 7
jbe 0x140007eaf
mov rcx, qword [r12]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140007eaa
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140007eda
mov rcx, r8
call fcn.1400c7260
mov qword [r12 + 0x10], rbx
mov word [r12], bx
mov rbx, qword [rsp + 0xb0]
mov qword [r12 + 0x18], 7
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140007ef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
lea rcx, str.drop_mapper
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
xor ebp, ebp
mov rcx, rdi
cmp qword [rdi + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x140007f31
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140007fd2
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140007fa4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140007f9f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000807b
mov rcx, r8
call fcn.1400c7260
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c6ee0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140008017
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140008013
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000800e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000807b
mov rcx, r8
call fcn.1400c7260
xor al, al
jmp 0x140007fa6
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x41200
mov qword [rsp + 0x20], rbp
lea rdx, [0x140123960]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140008064
cmp rax, 7
jbe 0x140008013
lea rdx, [rax*2 + 2]
jmp 0x140007fea
cmp rax, 7
jbe 0x140007fa4
lea rdx, [rax*2 + 2]
jmp 0x140007f77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140008090
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, rcx
lea rcx, str.drop_driver
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
xor ebp, ebp
mov rcx, rdi
cmp qword [rdi + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x1400080d1
mov rcx, qword [rdi]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140008172
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140008144
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14000813f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000821b
mov rcx, r8
call fcn.1400c7260
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400c6ee0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x1400081b7
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x1400081b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400081ae
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000821b
mov rcx, r8
call fcn.1400c7260
xor al, al
jmp 0x140008146
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2400
mov qword [rsp + 0x20], rbp
lea rdx, [0x140121560]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140008204
cmp rax, 7
jbe 0x1400081b3
lea rdx, [rax*2 + 2]
jmp 0x14000818a
cmp rax, 7
jbe 0x140008144
lea rdx, [rax*2 + 2]
jmp 0x140008117
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140009600
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r14
push r15
mov r15, rcx
mov r14, r8
mov rbp, rdx
sub r15, qword [r8 + 0x30]
je 0x14000978f
test byte [r8 + 0x5e], 0x40
jne 0x140009628
xor eax, eax
pop r15
pop r14
pop rbp
ret
movzx edx, word [r14 + 0x14]
movzx eax, word [r14 + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, r14
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14000978f
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140009663
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x140009677
add rdx, 0x28
cmp rdx, r9
jb 0x140009651
mov eax, 1
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x30], rdi
mov edi, dword [rdx + 0x14]
sub rdi, rcx
mov qword [rsp + 0x38], r12
mov r12d, dword [r14 + 0xb4]
add rdi, r8
add rdi, rbp
add r12, rdi
test rdi, rdi
je 0x140009785
cmp rdi, r12
jae 0x140009785
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov eax, dword [rdi + 4]
test eax, eax
je 0x14000977b
add eax, 0xfffffff8
shr eax, 1
je 0x14000976c
lea rbx, [rdi + 8]
mov esi, eax
nop
movzx r9d, word [rbx]
movzx eax, r9w
shr ax, 0xc
and r9d, 0x80000fff
jge 0x1400096f2
dec r9d
or r9d, 0xfffff000
inc r9d
cmp ax, 3
je 0x1400096fe
cmp ax, 0xa
jne 0x14000975e
movzx r11d, word [r14 + 0x14]
movzx r8d, word [r14 + 6]
add r11, 0x18
mov r10d, dword [rdi]
add r11, r14
mov rax, r11
lea rcx, [r8 + r8*4]
lea rdx, [r11 + rcx*8]
cmp r11, rdx
jae 0x140009753
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x140009734
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x140009745
lea rdx, [r8 + r8*4]
add rax, 0x28
lea rcx, [r11 + rdx*8]
cmp rax, rcx
jmp 0x140009720
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r10
add rcx, rbp
jne 0x140009756
mov rcx, rbp
movzx eax, r9w
add qword [rax + rcx], r15
add rbx, 2
sub rsi, 1
jne 0x1400096d0
mov eax, dword [rdi + 4]
add rdi, rax
cmp rdi, r12
jb 0x1400096b3
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov eax, 1
pop r15
pop r14
pop rbp
ret
Function at 0x140009cc0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1401200c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov ecx, 2
xor edi, edi
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140009d5c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140009d5c
mov qword [rsp + 0x280], rsi
lea rsi, str.ModernWarfare.exe
lea rdx, [rsp + 0x4c]
mov rax, rdi
nop dword [rax + rax]
movzx ecx, word [rsi + rax*2]
cmp cx, word [rdx + rax*2]
jne 0x140009d88
movzx ecx, word [rsi + rax*2 + 2]
cmp cx, word [rdx + rax*2 + 2]
jne 0x140009d88
add rax, 2
cmp rax, 0x12
jne 0x140009d30
mov edi, dword [rsp + 0x28]
mov rsi, qword [rsp + 0x280]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400c6ee0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140009d20
jmp 0x140009d54
Function at 0x14000da10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000da38
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000da5e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000da60
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000dab9
test ecx, ecx
jle 0x14000da99
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000dab9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000dab9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14000dae0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000db02
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000db18
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000db34
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000db36
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000db72
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000dc0e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000dbad
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000dbee
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000dc0e
cmp rbx, rax
ja 0x14000dbc0
test rbx, rbx
je 0x14000dc0e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret