joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400025b0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400025dd
xor eax, eax
jmp 0x140002749
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002617
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140002617
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140002749
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000273c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000265a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140002685
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002741
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400026f4
sub eax, 1
je 0x1400026f4
cmp eax, 2
jne 0x14000273c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140002741
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140002722
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000273c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140002741
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140004b00
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140002b60
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140002c33
cmp byte [rcx + 0x71], 0
je 0x140002c33
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140002c2f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140002bf4
sub eax, 1
je 0x140002bf8
cmp eax, 2
jne 0x140002c2f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004b00
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140002c26
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140002c2f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140002bdc
xor al, al
jmp 0x140002bdc
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140004b00
add rsp, 0x60
pop rbx
ret
Function at 0x140005528
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005572
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140005572
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140005572
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140005572
cmp dword [rcx + 0x84], 0xe
jbe 0x140005572
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140005574
xor al, al
add rsp, 0x28
ret
Function at 0x140001890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x14002d140]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rcx, str.Bsod_Functions
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
movdqa xmm0, xmmword [0x140026310]
xor ebx, ebx
movdqu xmmword [rbp + 0x17], xmm0
mov ecx, ebx
mov dword [rbp + 0x27], 0x100f2f1
nop word [rax + rax]
lea eax, [rcx - 0x7a]
xor byte [rbp + rcx + 0x17], al
inc rcx
cmp rcx, 0x12
jb 0x1400018e0
mov byte [rbp + 0x2a], bl
mov rcx, rbx
mov dword [rbp - 9], 0xe5ecf3e8
mov dword [rbp - 5], 0xe1e8a5e6
mov word [rbp - 1], 0xe2
mov byte [rbp + 1], 1
nop
lea eax, [rcx - 0x7a]
xor byte [rbp + rcx - 9], al
inc rcx
cmp rcx, 9
jb 0x140001910
lea rcx, [rbp - 9]
mov byte [rbp + 1], bl
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
lea rdx, [rbp + 0x17]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movdqa xmm0, xmmword [0x1400262b0]
mov rdx, rbx
movdqu xmmword [rbp + 0x2f], xmm0
mov rdi, rax
mov word [rbp + 0x3f], 0x100
nop dword [rax]
nop word [rax + rax]
lea ecx, [rdx - 0x7a]
xor byte [rbp + rdx + 0x2f], cl
inc rdx
cmp rdx, 0x10
jb 0x140001960
mov byte [rbp + 0x40], bl
mov dword [rbp + 7], 0xe5ecf3e8
mov dword [rbp + 0xb], 0xe1e8a5e6
mov word [rbp + 0xf], 0xe2
mov byte [rbp + 0x11], 1
nop dword [rax + rax]
lea eax, [rbx - 0x7a]
xor byte [rbp + rbx + 7], al
inc rbx
cmp rbx, 9
jb 0x140001990
lea rcx, [rbp + 7]
mov byte [rbp + 0x11], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp + 0x2f]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r8d, r8d
lea r9, [rbp + 0x47]
mov dl, 1
mov rbx, rax
lea ecx, [r8 + 0x13]
call rdi
lea rax, [rbp + 0x4b]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 6
mov ecx, 0xc00002b4
call rbx
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.14001f5d0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret

Function at 0x140001a20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140001a43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x7a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x10
jb 0x140001a30
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x140001d10
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x290
mov rax, qword [0x14002d140]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rcx
mov edi, 2
mov ecx, edi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov r8d, 0x12c
lea rcx, [rsp + 0x24]
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x20]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rdi, 1
jne 0x140001d70
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [rcx + 0x20]
mov rcx, rbx
movups xmmword [rdx + 0x10], xmm1
movups xmmword [rdx + 0x20], xmm0
lea rdx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001e1a
nop
lea rdx, [rsp + 0x17c]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x140001e4a
lea rdx, [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140001df0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.14001f5d0
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x158]
jmp 0x140001e25
Function at 0x140002080
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2a], 0
je 0x1400020a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x7a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x29
jb 0x140002090
mov byte [rcx + 0x2a], 0
mov rax, rcx
ret

Function at 0x1400020b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x1400020d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x7a]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x13
jb 0x1400020c0
mov byte [rcx + 0x14], 0
mov rax, rcx
ret
Function at 0x140004070
Capabilities:
Encode data using xor
Execute command

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
lea rcx, str.KillDBG
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
movdqa xmm0, xmmword [0x140026260]
xor ebx, ebx
movdqa xmm1, xmmword [0x140026250]
mov ecx, ebx
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140026110]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x20], 0xed9797f0
mov dword [rbp - 0x1c], 0xc8d2859a
mov dword [rbp - 0x18], 0xfff29fd2
mov dword [rbp - 0x14], 0x100f2e4
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x7a]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x3e
jb 0x1400040e0
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x11], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140026260]
mov rcx, rbx
movdqa xmm1, xmmword [0x140026230]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400260f0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140026000]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x10], 1
nop dword [rax + rax]
lea eax, [rcx - 0x7a]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x3f
jb 0x140004140
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x10], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140026260]
movdqa xmm1, xmmword [0x140026220]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140026120]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140026350]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov word [rbp - 0x10], 0x100
nop word [rax + rax]
lea eax, [rbx - 0x7a]
xor byte [rbp + rbx - 0x50], al
inc rbx
cmp rbx, 0x40
jb 0x1400041a0
lea rcx, [rbp - 0x50]
mov byte [rbp - 0xf], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
jmp qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
Function at 0x1400041e0
Capabilities:
Encode data using xor
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
lea rcx, str.Loop_KillDBG
mov qword [rsp + 0x88], rbx
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
lea rcx, [rbp + 0x10]
call fcn.140001700
mov rax, qword [rbp + 0x10]
movabs rcx, 0x7ffffff207b8a7ff
cmp rax, rcx
jge 0x140004229
movabs rbx, 0xdf8475800
add rbx, rax
jmp 0x140004233
movabs rbx, 0x7fffffffffffffff
lea rcx, [rbp + 0x10]
call fcn.140001700
mov rax, qword [rbp + 0x10]
cmp rax, rbx
jge 0x1400042ce
mov qword [rsp + 0x90], rsi
movabs rsi, 0x431bde82d7b634db
mov qword [rsp + 0x98], rdi
movabs rdi, 0x4e94914f0000
nop dword [rax]
mov rcx, rbx
sub rcx, rax
cmp rcx, rdi
jl 0x140004282
mov ecx, 0x5265c00
jmp 0x1400042a7
mov rax, rsi
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x1400042a5
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
lea rcx, [rbp + 0x10]
call fcn.140001700
mov rax, qword [rbp + 0x10]
cmp rax, rbx
jl 0x140004270
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
movdqa xmm0, xmmword [0x140026260]
xor ebx, ebx
movdqa xmm1, xmmword [0x140026250]
mov ecx, ebx
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140026110]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x20], 0xed9797f0
mov dword [rbp - 0x1c], 0xc8d2859a
mov dword [rbp - 0x18], 0xfff29fd2
mov dword [rbp - 0x14], 0x100f2e4
nop word [rax + rax]
lea eax, [rcx - 0x7a]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x3e
jb 0x140004320
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x11], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140026260]
mov rcx, rbx
movdqa xmm1, xmmword [0x140026230]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x1400260f0]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140026000]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov byte [rbp - 0x10], 1
nop dword [rax + rax]
lea eax, [rcx - 0x7a]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x3f
jb 0x140004380
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x10], bl
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x140026260]
movdqa xmm1, xmmword [0x140026220]
movdqa xmmword [rbp - 0x50], xmm0
movdqa xmm0, xmmword [0x140026120]
movdqa xmmword [rbp - 0x40], xmm1
movdqa xmm1, xmmword [0x140026350]
movdqa xmmword [rbp - 0x30], xmm0
movdqa xmmword [rbp - 0x20], xmm1
mov word [rbp - 0x10], 0x100
nop word [rax + rax]
lea eax, [rbx - 0x7a]
xor byte [rbp + rbx - 0x50], al
inc rbx
cmp rbx, 0x40
jb 0x1400043e0
mov rbx, qword [rsp + 0x88]
lea rcx, [rbp - 0x50]
mov byte [rbp - 0xf], 0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x70
pop rbp
jmp qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
Function at 0x140004450
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x68
mov rax, qword [0x14002d140]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
movdqa xmm0, xmmword [0x140026340]
mov r8, rax
movdqu xmmword [rsp + 0x20], xmm0
xor eax, eax
mov dword [rsp + 0x30], 0xf8f5e5f9
mov dword [rsp + 0x34], 0xf3f3f2ee
mov word [rsp + 0x38], 0x100
lea ecx, [rax - 0x7a]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x18
jb 0x1400044a0
lea rdx, [rsp + 0x20]
mov byte [rsp + 0x39], 0
mov rcx, r8
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor r9d, r9d
lea rdx, [rsp + 0x48]
lea r8d, [r9 + 2]
lea ecx, [r9 + 0x23]
call rax
test eax, eax
jne 0x140004537
cmp byte [rsp + 0x48], al
je 0x140004537
cmp byte [rsp + 0x49], al
je 0x1400044f7
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001f5d0
add rsp, 0x68
ret
xorps xmm0, xmm0
mov qword [rsp + 0x30], 0
mov r8d, 0x1f
mov qword [rsp + 0x38], 0
lea rdx, str.SystemKernelDebuggerInformation
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call fcn.14000e410
lea rcx, [rsp + 0x20]
call fcn.140001e60
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14001f5d0
add rsp, 0x68
ret
Function at 0x140006330
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x14002d140]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x20], rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400063fb
lea rdx, str.Tool_helper_cannot_be_created
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14000dc20
mov rcx, rax
lea rdx, [0x14000ddf0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400063cc
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400063c7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400064d0
mov rcx, r8
call fcn.14001f98c
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001f5d0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140006420
lea rdx, str.Tool_helper_cannot_retrieve_the_first_entry_of_process_list
jmp 0x140006375
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rbp + rax + 0x2c], 0
jne 0x140006430
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140006447
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x10]
cmp r8, rax
jne 0x14000645d
lea rdx, [rbp + 0x2c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140006484
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140006420
test rsi, rsi
je 0x140006392
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140006392
test rsi, rsi
je 0x140006493
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400064c9
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1400064c4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400064d0
mov rcx, r8
call fcn.14001f98c
mov al, 1
jmp 0x1400063ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000a4c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x14002d140]
xor rax, rsp
mov qword [rsp + 0x60], rax
xor ebx, ebx
lea rcx, str.Main_Function
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
call fcn.1400047f0
mov dword [0x14002f788], 0x3e8
mov byte [0x14002f78d], 1
mov byte [0x14002f785], 1
mov byte [0x14002f78c], 1
mov byte [0x14002f784], bl
mov byte [0x14002f787], bl
mov byte [0x14002f786], 1
lea ecx, [rbx + 8]
call fcn.14001f710
lea rcx, [0x140004550]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400101c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000a68f
cmp dword [rsp + 0x38], ebx
je 0x14000a683
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000a683
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
lea ecx, [rbx + 8]
call fcn.14001f710
lea rcx, [0x140004420]
mov qword [rax], rcx
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x1400101c0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000a673
cmp dword [rsp + 0x38], ebx
je 0x14000a667
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000a667
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x30], xmm0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14000a634
lea rdx, [0x140024ec0]
lea rcx, [rsp + 0x30]
call fcn.14000bb10
mov rcx, rax
call fcn.140001e60
lea ecx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400020e0
call fcn.140009d70
mov edx, 1
lea ecx, [rdx + 9]
call qword [sym.imp.KERNEL32.dll_SleepEx]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14001f5d0
add rsp, 0x70
pop rbx
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14000af60
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x14000af88
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000afae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14000afb0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x14000b009
test ecx, ecx
jle 0x14000afe9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x14000b009
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x14000b009
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x14000b030
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x14000b052
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x14000b068
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x14000b084
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x14000b086
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x14000b0c2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000b15e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14000b0fd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000b13e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000b15e
cmp rbx, rax
ja 0x14000b110
test rbx, rbx
je 0x14000b15e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret