joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400c2a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbx, rcx
mov ebp, 0x7ff
movzx ecx, word [rcx + 6]
mov esi, edx
shr cx, 4
and cx, bp
cmp cx, bp
jne 0x1400c2ac1
test byte [rbx + 6], 0xf
jne 0x1400c2ab4
xor edi, edi
cmp word [rbx + 4], di
jne 0x1400c2ab4
cmp word [rbx + 2], di
jne 0x1400c2ab4
cmp word [rbx], di
jne 0x1400c2ab4
lea esi, [rdi + 1]
jmp 0x1400c2ab9
mov esi, 2
movzx eax, si
jmp 0x1400c2cb9
xor edi, edi
test cx, cx
jne 0x1400c2adc
mov rcx, rbx
call fcn.1400c4348
movzx ecx, ax
cmp di, ax
jl 0x1400c2cb6
movsx edx, cx
test esi, esi
jle 0x1400c2b0c
sub ebp, edx
cmp ebp, esi
jg 0x1400c2b0c
movsd xmm0, qword [0x140113930]
cmp word [rbx + 6], di
jge 0x1400c2afe
xorps xmm0, xmmword [0x1400ed4d0]
movsd qword [rbx], xmm0
mov eax, 1
jmp 0x1400c2cb9
movzx r11d, word [rbx + 6]
mov eax, edx
neg eax
cmp eax, esi
jge 0x1400c2b39
add si, cx
mov eax, 0x800f
shl si, 4
and r11w, ax
or si, r11w
mov word [rbx + 6], si
or eax, 0xffffffff
jmp 0x1400c2cb9
movzx r15d, r11w
lea ebp, [rsi - 1]
and r11w, 0xf
mov r13d, 0x8000
mov r12d, 0x10
and r15w, r13w
or r11w, r12w
add ebp, edx
cmp ebp, 0xffffffcb
jl 0x1400c2cab
test ebp, ebp
jns 0x1400c2cab
lea esi, [r12 - 0xf]
movzx r14d, di
cmp bp, 0xfff0
jg 0x1400c2bce
movzx edx, word [rbx + 4]
mov eax, 0xfff0
movzx r8d, word [rbx + 2]
sub ax, bp
shr ax, 4
add ax, si
movzx ecx, ax
movzx eax, cx
shl ax, 4
add bp, ax
test r14w, r14w
mov eax, edi
setne al
movzx r14d, ax
or r14w, word [rbx]
mov word [rbx], r8w
movzx r8d, dx
movzx edx, r11w
mov r11d, edi
sub rcx, rsi
jne 0x1400c2ba0
mov word [rbx + 4], dx
mov word [rbx + 2], r8w
neg bp
je 0x1400c2c4d
movzx r8d, word [rbx]
mov eax, edi
movzx r9d, word [rbx + 2]
movzx edx, r8w
movsx r10d, bp
sub r12d, r10d
mov ecx, r12d
shl dx, cl
test r14w, r14w
movzx r14d, dx
movzx edx, word [rbx + 4]
setne al
or r14w, ax
movzx eax, r9w
shl ax, cl
movzx ecx, bp
shr r8w, cl
mov ecx, r12d
or ax, r8w
mov word [rbx], ax
movzx eax, dx
shl ax, cl
movzx ecx, bp
shr r9w, cl
mov ecx, r12d
or ax, r9w
mov word [rbx + 2], ax
movzx eax, r11w
shl ax, cl
movzx ecx, bp
shr dx, cl
mov ecx, r10d
or ax, dx
mov word [rbx + 4], ax
shr r11w, cl
or r11w, r15w
mov word [rbx + 6], r11w
cmp r13w, r14w
jb 0x1400c2c63
jne 0x1400c2c82
test byte [rbx], sil
je 0x1400c2c82
add word [rbx], si
jne 0x1400c2c82
add word [rbx + 2], si
jne 0x1400c2c82
add word [rbx + 4], si
jne 0x1400c2c82
add r11w, si
mov word [rbx + 6], r11w
jmp 0x1400c2b31
cmp r11w, r15w
jne 0x1400c2b31
cmp word [rbx + 4], di
jne 0x1400c2b31
cmp word [rbx + 2], di
jne 0x1400c2b31
movzx eax, word [rbx]
neg ax
sbb ax, ax
jmp 0x1400c2cb9
mov word [rbx + 6], r15w
mov dword [rbx + 2], edi
mov word [rbx], di
movzx eax, di
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400c4850
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x1401156d0], rbx
je 0x1400c489c
cmp rax, rbx
jne 0x1400c488f
mov ebx, 1
mov esi, ebx
jmp 0x1400c48a1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1400c4874
mov ebx, 1
mov eax, dword [0x1401156d8]
cmp eax, ebx
jne 0x1400c48b7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x1400c4926
mov eax, dword [0x1401156d8]
test eax, eax
jne 0x1400c4920
mov dword [0x1401156d8], ebx
lea r15, [0x1400d77f8]
lea rdi, [0x1400d77e0]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x1400c4912
test eax, eax
jne 0x1400c4916
cmp qword [rdi], 0
je 0x1400c4907
movabs r10, 0xd30527475e523070
mov rax, qword [rdi]
mov rcx, qword [0x1400d71e8]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x1400c48de
test eax, eax
je 0x1400c4926
mov eax, 0xff
jmp 0x1400c4a0c
mov dword [0x140114358], ebx
mov eax, dword [0x1401156d8]
cmp eax, ebx
jne 0x1400c494d
lea rdx, [0x1400d77d8]
lea rcx, [0x1400d7200]
call sub.msvcrt.dll__initterm
mov dword [0x1401156d8], 2
test esi, esi
jne 0x1400c495a
xor eax, eax
xchg qword [0x1401156d0], rax
cmp qword [0x1401156f0], 0
je 0x1400c4998
lea rcx, [0x1401156f0]
call fcn.1400c5080
test eax, eax
je 0x1400c4998
movabs r10, 0x99012e4578d92870
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x1401156f0]
mov r9, qword [0x1400d71e8]
call r9
mov r8, qword [0x140114370]
mov rdx, qword [0x140114368]
mov ecx, dword [0x140114360]
call fcn.140003a80
mov dword [0x140114354], eax
cmp dword [0x140114378], 0
jne 0x1400c49c8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140114358], 0
jne 0x1400c49dd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140114354]
jmp 0x1400c4a0c
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.1401ae000
add rsp, 0x28
jmp 0x1400c4850

Function at 0x1400c4f6c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x1400c4fb8
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c4fb0
cmp dword [rcx + 0x3c], edx
jl 0x1400c4fb0
cmp dword [rcx + 0x3c], 0x10000000
jae 0x1400c4fb0
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x1400c4fb8
mov rax, rdx
add rsp, 0x18
ret

Function at 0x1400c50e0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1400c5108
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x1400c5108
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x1400145d0
Capabilities:
Log keystrokes via polling

Disassembly:
push rsi
sub rsp, 0xa0
movaps xmmword [rsp + 0x90], xmm12
movaps xmmword [rsp + 0x80], xmm11
movaps xmmword [rsp + 0x70], xmm10
movaps xmmword [rsp + 0x60], xmm9
movaps xmmword [rsp + 0x50], xmm8
movaps xmmword [rsp + 0x40], xmm7
movaps xmmword [rsp + 0x30], xmm6
mov rsi, rcx
cmp byte [0x140204a68], 0
je 0x140014724
mov eax, dword [0x140204c18]
mov ecx, dword [0x14020d230]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x28]
jg 0x140014762
mov eax, dword [rsi + 0xc0]
cmp eax, dword [0x140175518]
jbe 0x140014719
movss xmm9, dword [rsi + 0xc4]
movss xmm11, dword [rsi + 0xc8]
movss xmm10, dword [0x140204c10]
movss xmm12, dword [0x140204c14]
movss xmm8, dword [rsi + 0x110]
movss xmm6, dword [0x14020473c]
movss xmm7, dword [0x140204740]
mov ecx, 1
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x140014701
movss xmm0, dword [0x14010c4c0]
mulss xmm11, xmm0
subss xmm11, xmm12
mulss xmm6, xmm11
mulss xmm9, xmm0
subss xmm9, xmm10
mulss xmm7, xmm9
mulss xmm8, dword [str.X94_]
movss xmm0, dword [0x14010be30]
divss xmm0, xmm8
mulss xmm7, xmm0
cvttss2si r8d, xmm7
mulss xmm0, xmm6
cvttss2si edx, xmm0
neg r8d
mov qword [rsp + 0x20], 0
mov ecx, 1
xor r9d, r9d
call qword [sym.imp.USER32.dll_mouse_event]
movsd xmm0, qword [rsi + 0xc4]
mulps xmm0, xmmword [0x14010be20]
movlps qword [0x140204c10], xmm0
jmp 0x140014724
mov qword [0x140204c10], 0
mov rcx, rsi
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x40]
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm9, xmmword [rsp + 0x60]
movaps xmm10, xmmword [rsp + 0x70]
movaps xmm11, xmmword [rsp + 0x80]
movaps xmm12, xmmword [rsp + 0x90]
add rsp, 0xa0
pop rsi
jmp fcn.140013800
lea rcx, [0x140204c18]
call fcn.140106bd8
cmp dword [0x140204c18], 0xffffffff
jne 0x14001463b
xorps xmm0, xmm0
movlps qword [0x140204c10], xmm0
lea rcx, [0x140204c18]
call fcn.140106b6c
jmp 0x14001463b
Function at 0x14001dab0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
cmp byte [0x140204b38], 0
je 0x14001dd11
movss xmm0, dword [0x14010d8a4]
call fcn.140047760
movss xmm0, dword [0x14010cb84]
movlps qword [rbp - 0x10], xmm0
lea rcx, [rbp - 0x10]
xor edx, edx
call fcn.14003e0c0
lea rcx, str.Cheats_List
xor edx, edx
mov r8d, 0x20
call fcn.14003e0f0
cmp byte [0x1402049b0], 0
je 0x14001db36
cmp byte [0x140204c0e], 0
jne 0x14001db2a
mov ecx, dword [0x140175314]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14001db36
lea rcx, str.Aimbot__Toggle_
call fcn.14006c6d0
cmp byte [0x140204bdc], 0
je 0x14001db4b
lea rcx, str.Anti_Record
call fcn.14006c6d0
cmp byte [0x140204b18], 0
je 0x14001db60
lea rcx, str.Bhop
call fcn.14006c6d0
cmp byte [0x140204b28], 0
je 0x14001db75
lea rcx, str.Bomb_Timer
call fcn.14006c6d0
cmp byte [0x140204938], 0
je 0x14001db8a
lea rcx, str.Crosshair
call fcn.14006c6d0
cmp byte [0x140205054], 0
je 0x14001db9f
lea rcx, str.Enemy_Sensor
call fcn.14006c6d0
cmp byte [0x1401752cb], 0
je 0x14001dbb4
lea rcx, [0x14010d94c]
call fcn.14006c6d0
cmp byte [0x1402048e8], 0
je 0x14001dbc9
lea rcx, str.External_Radar
call fcn.14006c6d0
cmp byte [0x140204bc8], 0
je 0x14001dbde
lea rcx, str.Fake_Duck
call fcn.14006c6d0
cmp byte [0x140204b48], 0
je 0x14001dbf3
lea rcx, str.Fast_Stop
call fcn.14006c6d0
xorps xmm0, xmm0
ucomiss xmm0, dword [0x140204b08]
je 0x14001dc0b
lea rcx, str.Flash_Immunity
call fcn.14006c6d0
cmp byte [0x140204b58], 0
je 0x14001dc20
lea rcx, str.Force_Scope
call fcn.14006c6d0
cmp dword [0x1401752f4], 0x5a
je 0x14001dc35
lea rcx, str.Fov_Changer
call fcn.14006c6d0
cmp byte [0x1402047d1], 0
je 0x14001dc4a
lea rcx, str.Headshot_Line
call fcn.14006c6d0
cmp dword [0x140204b78], 0
je 0x14001dc5f
lea rcx, str.HitSound
call fcn.14006c6d0
cmp byte [0x140204b88], 0
je 0x14001dc74
lea rcx, str.Money_Service
call fcn.14006c6d0
cmp byte [0x140205055], 0
je 0x14001dc89
lea rcx, str.No_Smoke
call fcn.14006c6d0
cmp byte [0x140205056], 0
je 0x14001dc9e
lea rcx, str.Radar_Hack
call fcn.14006c6d0
cmp byte [0x140204a68], 0
je 0x14001dcb3
lea rcx, [0x14010d9d3]
call fcn.14006c6d0
cmp byte [0x140205057], 0
je 0x14001dcc8
lea rcx, str.Smoke_Color
call fcn.14006c6d0
cmp byte [0x140204c0c], 0
je 0x14001dcdd
lea rcx, str.Spec_List
call fcn.14006c6d0
cmp byte [0x140204a88], 0
je 0x14001dd0c
cmp byte [0x140204a98], 0
jne 0x14001dd00
mov ecx, dword [0x140204aa8]
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x14001dd0c
lea rcx, str.TriggerBot__Toggle_
call fcn.14006c6d0
call fcn.140043fa0
nop
add rsp, 0x30
pop rbp
ret
Function at 0x14001e620
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp byte [0x140204b48], 0
je 0x14001e81c
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001e81c
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001e81c
mov ecx, 0x41
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001e6c2
cmp byte [0x140205028], 0
je 0x14001e6cc
mov rdi, qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor esi, esi
mov ecx, 0x44
xor edx, edx
call rdi
mov rbx, qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0x44
mov edx, eax
mov r8d, 8
xor r9d, r9d
call rbx
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x44
xor edx, edx
call rdi
mov cl, 0x44
mov edx, eax
mov r8d, 2
xor r9d, r9d
call rbx
jmp 0x14001e6c5
mov sil, 1
mov byte [0x140205028], sil
mov ecx, 0x44
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001e732
cmp byte [0x140205029], 0
je 0x14001e73c
mov rdi, qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor esi, esi
mov ecx, 0x41
xor edx, edx
call rdi
mov rbx, qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0x41
mov edx, eax
mov r8d, 8
xor r9d, r9d
call rbx
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x41
xor edx, edx
call rdi
mov cl, 0x41
mov edx, eax
mov r8d, 2
xor r9d, r9d
call rbx
jmp 0x14001e735
mov sil, 1
mov byte [0x140205029], sil
mov ecx, 0x57
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001e7a2
cmp byte [0x14020502a], 0
je 0x14001e7ac
mov rdi, qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor esi, esi
mov ecx, 0x53
xor edx, edx
call rdi
mov rbx, qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0x53
mov edx, eax
mov r8d, 8
xor r9d, r9d
call rbx
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x53
xor edx, edx
call rdi
mov cl, 0x53
mov edx, eax
mov r8d, 2
xor r9d, r9d
call rbx
jmp 0x14001e7a5
mov sil, 1
mov byte [0x14020502a], sil
mov ecx, 0x53
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x14001e812
cmp byte [0x14020502b], 0
je 0x14001e81c
mov rdi, qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor esi, esi
mov ecx, 0x57
xor edx, edx
call rdi
mov rbx, qword [sym.imp.USER32.dll_keybd_event]
mov cl, 0x57
mov edx, eax
mov r8d, 8
xor r9d, r9d
call rbx
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x57
xor edx, edx
call rdi
mov cl, 0x57
mov edx, eax
mov r8d, 2
xor r9d, r9d
call rbx
jmp 0x14001e815
mov sil, 1
mov byte [0x14020502b], sil
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14001f010
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov qword [rbp - 8], 0xfffffffffffffffe
cmp byte [0x140204b18], 0
je 0x14001f102
mov rdi, rcx
mov ecx, 0x20
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
mov si, ax
mov edi, dword [rdi + 0x100]
lea rcx, [0x140203f60]
lea rdx, [rbp - 0xc]
call fcn.140022190
and edi, 1
test si, si
je 0x14001f0c7
test edi, edi
je 0x14001f0c7
call sub.MSVCP140.dll__Query_perf_frequency
mov rsi, rax
call sub.MSVCP140.dll__Query_perf_counter
mov rcx, rax
cmp rsi, 0x989680
jne 0x14001f10b
imul rax, rcx, 0x64
lea rcx, [rax + 0x1036640]
movabs rdx, 0x7ffffffffefc99bf
cmp rax, rdx
movabs rax, 0x7fffffffffffffff
cmovl rax, rcx
mov qword [rbp - 0x18], rax
lea rcx, [rbp - 0x18]
call fcn.140015a40
lea rcx, [0x140203f60]
mov edx, 0x10001
call fcn.140022110
jmp 0x14001f102
test si, si
je 0x14001f0e3
test edi, edi
jne 0x14001f0e3
lea rcx, [0x140203f60]
mov edx, 0x100
call fcn.140022110
jmp 0x14001f102
test si, si
jne 0x14001f102
cmp dword [rbp - 0xc], 0x10001
jne 0x14001f102
lea rcx, [0x140203f60]
mov edx, 0x100
call fcn.140022110
nop
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
cmp rsi, 0x16e3600
jne 0x14001f172
movabs r9, 0xb2f4fc0794908cf3
mov rax, rcx
imul r9
mov r8, rdx
add r8, rcx
mov rax, r8
shr rax, 0x3f
sar r8, 0x18
add r8, rax
imul rax, r8, 0x16e3600
sub rcx, rax
imul rcx, rcx, 0x3b9aca00
mov rax, rcx
imul r9
mov rax, rdx
imul rdx, r8, 0x3b9aca00
add rax, rcx
mov rcx, rax
shr rcx, 0x3f
sar rax, 0x18
add rax, rcx
add rax, rdx
jmp 0x14001f085
mov rax, rcx
or rax, rsi
shr rax, 0x20
je 0x14001f188
mov rax, rcx
cqo
idiv rsi
jmp 0x14001f18e
mov eax, ecx
xor edx, edx
div esi
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
mov rdx, rsi
or rdx, rax
shr rdx, 0x20
je 0x14001f1af
cqo
idiv rsi
jmp 0x14001f1b3
xor edx, edx
div esi
add rax, rcx
jmp 0x14001f085
Function at 0x140021da0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x458
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x3c0], xmm6
mov rsi, rdx
mov dword [rbp - 0x78], 0x438
mov edx, dword [rcx + 0x10]
sub rsp, 0x20
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov rdi, rax
sub rsp, 0x20
lea rdx, [rbp - 0x78]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
add rsp, 0x20
lea r14, [rbp - 0x48]
movabs r13, 0x100000000
xorps xmm6, xmm6
mov rbx, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
cmp qword [rsi + 0x18], 0x10
mov r15, rsi
jb 0x140021e1d
mov r15, qword [rsi]
sub rsp, 0x20
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
add rsp, 0x20
mov rcx, rax
shl rcx, 0x20
add rcx, r13
sar rcx, 0x1f
mov rax, rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140106cd0
sub rsp, rax
mov r12, rsp
mov byte [r12], 0
sub rsp, 0x40
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], r12
mov ecx, 3
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call rbx
add rsp, 0x40
test eax, eax
mov ecx, 0
cmovne rcx, r12
sub rsp, 0x20
mov rdx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add rsp, 0x20
sub rsp, 0x20
test eax, eax
je 0x140021ecf
mov rcx, rdi
lea rdx, [rbp - 0x78]
call sub.KERNEL32.dll_Module32NextW
add rsp, 0x20
test eax, eax
jne 0x140021e10
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
xor edi, edi
jmp 0x140021ee0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov rdi, qword [rbp - 0x50]
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x140021f22
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140021f15
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140021f53
add rax, 0x28
mov rdx, rax
mov rcx, r8
sub rsp, 0x20
call fcn.140106af4
add rsp, 0x20
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, rdi
movaps xmm6, xmmword [rbp + 0x3c0]
lea rsp, [rbp + 0x3d8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140026f10
Capabilities:
Get disk information

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x148
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xc0], 0xfffffffffffffffe
mov rsi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rcx, [0x14010eadd]
lea r9, [rbp + 0xbc]
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
lea rcx, [rbp - 0x40]
mov edx, 1
call fcn.14001ec40
lea rcx, [rbp - 0x30]
mov edx, dword [rbp + 0xbc]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rcx, [rbp - 0x40]
mov rdx, rsi
call fcn.14001edf0
lea rdi, [rbp + 0x58]
mov rax, qword [rbp - 0x40]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rax - 0x40], rcx
mov rax, qword [rbp - 0x40]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0x98]
mov dword [rbp + rax - 0x44], ecx
lea rbx, [rbp - 0x28]
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp - 0x28], rax
mov rcx, rbx
call fcn.140014e30
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::ios_base::destructor_void____ptr64]
mov rax, rsi
add rsp, 0x148
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x140027090
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x258
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1c0], xmm6
mov rsi, rdx
mov dword [rbp - 0x78], 0x238
sub rsp, 0x20
mov ecx, 0xf
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov rdi, rax
sub rsp, 0x20
lea rdx, [rbp - 0x78]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
add rsp, 0x20
lea r14, [rbp - 0x4c]
movabs r12, 0x100000000
xorps xmm6, xmm6
mov r13, qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
cmp qword [rsi + 0x18], 0x10
mov r15, rsi
jb 0x14002710d
mov r15, qword [rsi]
sub rsp, 0x20
mov rcx, r14
call sub.api_ms_win_crt_string_l1_1_0.dll_wcslen
add rsp, 0x20
mov rcx, rax
shl rcx, 0x20
add rcx, r12
sar rcx, 0x1f
mov rax, rcx
add rax, 0xf
and rax, 0xfffffffffffffff0
call fcn.140106cd0
sub rsp, rax
mov rbx, rsp
mov byte [rbx], 0
sub rsp, 0x40
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rbx
mov ecx, 3
xor edx, edx
mov r8, r14
mov r9d, 0xffffffff
call r13
add rsp, 0x40
test eax, eax
mov ecx, 0
cmovne rcx, rbx
sub rsp, 0x20
mov rdx, r15
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
add rsp, 0x20
sub rsp, 0x20
test eax, eax
je 0x1400271bd
mov rcx, rdi
lea rdx, [rbp - 0x78]
call sub.KERNEL32.dll_Process32NextW
add rsp, 0x20
test eax, eax
jne 0x140027100
sub rsp, 0x20
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
xor edi, edi
jmp 0x1400271cd
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov edi, dword [rbp - 0x70]
mov rax, qword [rsi + 0x18]
cmp rax, 0x10
jb 0x14002720f
mov rcx, qword [rsi]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140027202
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14002723f
add rax, 0x28
mov rdx, rax
mov rcx, r8
sub rsp, 0x20
call fcn.140106af4
add rsp, 0x20
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov eax, edi
movaps xmm6, xmmword [rbp + 0x1c0]
lea rsp, [rbp + 0x1d8]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub rsp, 0x20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140029580
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
mov rax, qword [0x140203ac0]
xor rax, rsp
mov qword [rsp + 0x80], rax
cmp edx, 0xffffffff
je 0x1400296ad
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x1400295dd
mov rax, qword [rdi + 0x58]
mov ecx, dword [rax]
test ecx, ecx
jle 0x1400295dd
dec ecx
mov dword [rax], ecx
mov rax, qword [rdi + 0x40]
mov rcx, qword [rax]
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x1400296f2
cmp qword [rdi + 0x80], 0
je 0x1400296b1
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
jne 0x140029617
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x1400296b8
mov byte [rsp + 0x5f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x48]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x5f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x1400296d1
mov r15, qword [rsp + 0x48]
sub r15, r14
je 0x14002969d
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x1400296f0
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x50], rbx
mov eax, 0xffffffff
jmp 0x1400296eb
xor esi, esi
jmp 0x1400296f2
mov esi, 0xffffffff
jmp 0x1400296f2
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x1400296f2
cmp eax, 3
jne 0x1400296f0
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x5f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140106b10
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret