joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000c9d0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rax, qword [r8 + 8]
add rax, qword [r8]
mov qword [rsp + 0x30], rax
cmp qword [rcx + 0x80], 0
je 0x14000caaa
mov rbx, r8
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x14000ca94
cmp byte [rdi + 0x71], 0
je 0x14000ca94
mov rax, qword [rdi]
mov rcx, rdi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000caaa
mov rcx, qword [rdi + 0x68]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], r8
lea r14, [rsp + 0x40]
mov r8, r14
call qword [rax + 0x40]
cmp eax, 3
je 0x14000ca90
cmp eax, 1
je 0x14000ca61
test eax, eax
jne 0x14000caaa
mov byte [rdi + 0x71], 0
mov r15, qword [rsp + 0x38]
sub r15, r14
je 0x14000ca88
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x14000caaa
cmp byte [rdi + 0x71], 0
jne 0x14000caaa
jmp 0x14000ca94
mov byte [rdi + 0x71], 0
mov rcx, qword [rdi + 0x80]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fsetpos]
test eax, eax
je 0x14000cac7
mov qword [rsi], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x74], rax
mov rcx, qword [rdi + 0x18]
lea rdx, [rdi + 0x70]
cmp qword [rcx], rdx
jne 0x14000caff
mov eax, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rcx], rdx
mov rcx, qword [rdi + 0x38]
mov qword [rcx], rdx
sub eax, edx
mov rcx, qword [rdi + 0x50]
mov dword [rcx], eax
mov rax, qword [rdi + 0x74]
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], rax
jmp 0x14000cab8
Function at 0x140012310
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], 0xfffffffffffffffe
lea r8, [rdx + 0xfff]
and r8, 0xfffffffffffff000
mov qword [rbp - 0x20], rcx
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x1400123b5
mov rdi, qword [rbp - 0x20]
mov rax, qword [rdi + 0x20]
cmp rax, 0x10
jb 0x140012396
mov rcx, qword [rdi + 8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140012391
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400123f8
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400318f8
mov qword [rdi + 0x18], 0
mov qword [rdi + 0x20], 0xf
mov byte [rdi + 8], 0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x14], eax
lea rcx, str._panic__Allocation_failed:_:x_n
lea rdx, [rbp - 0x14]
call fcn.140014040
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x1400123fe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140012ee0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x2178
call fcn.140031a60
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x20e0], xmm6
mov qword [rbp + 0x20d8], 0xfffffffffffffffe
mov rsi, rdx
mov r8d, ecx
xor ebx, ebx
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140013145
mov rdi, rax
lea rdx, [rbp - 0x60]
lea r9, [rbp + 0x20d4]
mov rcx, rax
mov r8d, 0x2000
call sub.KERNEL32.dll_K32EnumProcessModules
xor ebx, ebx
test eax, eax
je 0x140013145
cmp dword [rbp + 0x20d4], 8
jb 0x140013145
xor r13d, r13d
lea rbx, [rbp + 0x1fa0]
xorps xmm6, xmm6
lea r14, [rbp + 0x20b0]
mov qword [rbp + 0x20a8], rsi
jmp 0x140012faf
add r15, 0x28
mov rdx, r15
mov rcx, rax
call fcn.1400318f8
test r12b, r12b
jne 0x140013143
inc r13
mov eax, dword [rbp + 0x20d4]
shr rax, 3
cmp r13, rax
jae 0x14001313f
mov rdx, qword [rbp + r13*8 - 0x60]
mov rcx, rdi
mov r8, rbx
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x140012f99
movaps xmmword [rbp + 0x20c0], xmm6
movaps xmmword [rbp + 0x20b0], xmm6
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x140013162
mov r15, rax
cmp rax, 0xf
ja 0x140013020
mov qword [rbp + 0x20c0], r15
mov qword [rbp + 0x20c8], 0xf
mov rcx, r14
mov rdx, rbx
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, rbp
add r15, 0x20b0
jmp 0x14001309a
mov rsi, rdi
mov rdi, r14
mov r14, r15
or r14, 0xf
cmp r14, 0x17
mov eax, 0x16
cmovb r14, rax
cmp r14, 0xfff
jb 0x14001305b
lea rcx, [r14 + 0x28]
call fcn.1400318b4
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140013067
lea rcx, [r14 + 1]
call fcn.1400318b4
mov r12, rax
mov qword [rbp + 0x20b0], r12
mov qword [rbp + 0x20c0], r15
mov qword [rbp + 0x20c8], r14
mov rcx, r12
mov rdx, rbx
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, r12
mov r14, rdi
mov rdi, rsi
mov rsi, qword [rbp + 0x20a8]
mov byte [r15], 0
mov r8, qword [rsi + 0x10]
mov rax, qword [rbp + 0x20c0]
sub rax, r8
jae 0x1400130d0
mov r15, qword [rbp + 0x20c8]
xor r12d, r12d
cmp r15, 0x10
jb 0x140012f90
jmp 0x14001310c
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x1400130dd
mov rdx, qword [rsi]
mov r15, qword [rbp + 0x20c8]
mov rcx, r14
cmp r15, 0x10
jb 0x1400130f4
mov rcx, qword [rbp + 0x20b0]
add rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete r12b
cmp r15, 0x10
jb 0x140012f90
mov rcx, qword [rbp + 0x20b0]
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x140012f8b
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jb 0x140012f81
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor ebx, ebx
jmp 0x140013145
mov bl, 1
mov eax, ebx
movaps xmm6, xmmword [rbp + 0x20e0]
add rsp, 0x2178
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14000b310
int3
Function at 0x140014b20
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
movaps xmmword [rsp + 0x1d0], xmm6
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov r12d, 0x10000
lea r8, [rsp + 0x30]
mov edx, 0x10000
mov r9d, 0x30
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140014d3f
xor r14d, r14d
lea r15, [rsp + 0x60]
lea rbp, [rsp + 0x30]
jmp 0x140014bc0
mov ecx, 0x57
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x30]
mov r13, qword [rsp + 0x48]
add r13, rax
mov r9d, 0x30
mov rcx, rbx
mov rdx, r13
mov r8, rbp
call sub.KERNEL32.dll_VirtualQueryEx
mov r12, r13
test rax, rax
je 0x140014d0a
mov r13, qword [rsp + 0x48]
mov eax, r13d
not eax
shl rax, 0x34
je 0x140014d0a
mov rax, qword [rsp + 0x30]
lea rcx, [rax + r13]
cmp rcx, r12
jb 0x140014d0a
cmp dword [rsp + 0x50], 0x1000
jne 0x140014b9d
mov ecx, dword [rsp + 0x54]
cmp cl, 1
je 0x140014b9d
and ecx, 0x100
jne 0x140014b9d
test r12, r12
je 0x140014b89
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov r9d, 0x30
mov rcx, rbx
mov rdx, r12
mov r8, r15
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140014b93
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, rbx
mov rdx, r12
lea r8, [rsp + 0x98]
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140014b93
movzx eax, word [rsp + 0x98]
cmp eax, 0x5a4d
jne 0x140014cbc
mov eax, dword [rsp + 0xd4]
cmp rax, 0x40
jb 0x140014cbc
cmp qword [rsp + 0x78], rax
jb 0x140014cbc
movsxd rdx, eax
add rdx, r12
mov qword [rsp + 0x20], 0
mov r9d, 0xf8
mov rcx, rbx
lea r8, [rsp + 0xd8]
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140014b93
cmp dword [rsp + 0xd8], 0x4550
je 0x140014cc6
mov ecx, 0xc1
jmp 0x140014b8e
movzx eax, word [rsp + 0xee]
test eax, 0x2000
cmove r14, r12
add r12, 0x10000
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov r9d, 0x30
mov rcx, rbx
mov rdx, r12
mov r8, rbp
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
jne 0x140014bc0
test r14, r14
je 0x140014d3f
lea rdx, [rsp + 0xd8]
mov rcx, rbx
call sub.KERNEL32.dll_IsWow64Process
test eax, eax
je 0x140014d49
mov r8d, dword [rsp + 0xd8]
mov dword [rsp + 0x20], edi
mov rcx, rbx
mov rdx, r14
mov r9, rsi
call fcn.140014d70
jmp 0x140014d4b
mov ecx, 0x10dd
call sub.KERNEL32.dll_SetLastError
xor eax, eax
movaps xmm6, xmmword [rsp + 0x1d0]
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140015a70
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
test rdx, rdx
je 0x140015b37
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov r9d, 0x30
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140015b41
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x68]
mov r9d, 0x40
mov rcx, rbx
mov rdx, rdi
call sub.KERNEL32.dll_ReadProcessMemory
xor ebp, ebp
test eax, eax
je 0x140015b43
movzx eax, word [rsp + 0x68]
cmp eax, 0x5a4d
jne 0x140015b30
mov eax, dword [rsp + 0xa4]
cmp rax, 0x40
jb 0x140015b30
cmp qword [rsp + 0x48], rax
jb 0x140015b30
cdqe
add rdi, rax
mov qword [rsp + 0x20], 0
mov r9d, 0xf8
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140015b43
mov ebp, 1
cmp dword [rsi], 0x4550
je 0x140015b43
mov ecx, 0xc1
jmp 0x140015b3c
mov ecx, 0x57
call sub.KERNEL32.dll_SetLastError
xor ebp, ebp
mov eax, ebp
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140015cd0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1f8
mov ebx, r9d
mov rsi, r8
mov r12, rdx
mov rdi, rcx
lea r8d, [rbx + 0x1c8]
mov dword [rsp + 0x20], 4
xor r14d, r14d
xor edx, edx
mov r9d, 0x1000
call sub.KERNEL32.dll_VirtualAllocEx
test rax, rax
je 0x140015f48
mov r15, rax
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb2], xmm0
movups xmmword [rsp + 0xc2], xmm0
movups xmmword [rsp + 0xd2], xmm0
movups xmmword [rsp + 0xdc], xmm0
mov word [rsp + 0xb0], 0x5a4d
mov dword [rsp + 0xec], 0x40
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xb0]
mov r9d, 0x40
mov rcx, rdi
mov rdx, rax
call sub.KERNEL32.dll_WriteProcessMemory
xor r14d, r14d
test eax, eax
je 0x140015f48
cmp qword [rsp + 0x28], 0x40
jne 0x140015f48
lea r13, [r15 + 0x40]
lea rcx, [rsp + 0xf4]
xor r14d, r14d
mov r8d, 0x104
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0xf0], 0x4550
mov dword [rsp + 0x104], 0x200000f0
mov word [rsp + 0xf6], 1
mov word [rsp + 0x108], 0x20b
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xf0]
mov r9d, 0x108
mov rcx, rdi
mov rdx, r13
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140015f48
cmp qword [rsp + 0x28], 0x108
jne 0x140015f48
lea rdx, [r15 + 0x148]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movabs rax, 0x72756f7465642e
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], 0x170
lea r13d, [rbx + 0x58]
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x48]
mov r9d, 0x28
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140015f48
cmp qword [rsp + 0x28], 0x28
jne 0x140015f48
lea rdx, [r15 + 0x170]
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movabs rax, 0x72744400000040
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x40
mov dword [rsp + 0x7c], r13d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x70]
mov r9d, 0x40
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140015f48
cmp qword [rsp + 0x28], 0x40
jne 0x140015f48
lea rdx, [r15 + 0x1b0]
lea eax, [rbx + 0x18]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x30]
mov r9d, 0x18
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140015f48
cmp qword [rsp + 0x28], 0x18
jne 0x140015f48
mov ebx, ebx
add r15, 0x1c8
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rdx, r15
mov r8, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
setne al
cmp qword [rsp + 0x28], rbx
sete cl
and cl, al
movzx r14d, cl
mov eax, r14d
add rsp, 0x1f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140017060
Capabilities:
Resume thread
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xe0]
mov r11, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xd0]
mov ebp, dword [rsp + 0xc8]
mov eax, dword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
test rbx, rbx
lea rsi, [0x140033020]
cmovne rsi, rbx
test r14, r14
jne 0x1400170c9
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
lea r14, [rsp + 0x50]
mov ebx, ebp
or ebx, 4
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call rsi
test eax, eax
je 0x140017149
mov rdi, qword [rsp + 0xf8]
mov ebx, dword [rsp + 0xf0]
mov rcx, qword [r14]
mov rdx, rdi
mov r8d, ebx
call fcn.140014b20
test eax, eax
jne 0x140017126
mov ecx, dword [r14 + 0x10]
mov edx, ebx
mov r8, rdi
mov r9, rsi
call fcn.1400162c0
test eax, eax
je 0x14001714d
test bpl, 4
jne 0x140017135
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_ResumeThread
mov esi, 1
lea rax, [rsp + 0x50]
cmp r14, rax
mov r14, rax
jne 0x14001716d
jmp 0x14001715c
xor esi, esi
jmp 0x14001716d
mov rcx, qword [r14]
mov edx, 0xffffffff
call sub.KERNEL32.dll_TerminateProcess
xor esi, esi
mov rcx, qword [r14]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x1400175d0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov rax, rcx
mov qword [rbp - 0x48], 0
lea rcx, vtable.fmt::v7::basic_memory_buffer_char__500__class_std::allocator_char__.0
mov qword [rbp - 0x58], rcx
lea rsi, [rbp - 0x38]
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], 0x1f4
movups xmm0, xmmword [r8]
movaps xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp - 0x58]
lea r8, [rbp + 0x1c0]
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov r8d, 1
mov r9, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov rcx, qword [rbp - 0x50]
cmp rcx, rsi
je 0x140017698
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x1000
jb 0x140017693
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400176a3
add rdx, 0x27
mov rcx, rax
call fcn.1400318f8
nop
add rsp, 0x258
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140019ab0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rsi
jae 0x140019b77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [rax]
lea rax, vtable.std::exception.0
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rax, [0x140038ae7]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 1
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll___std_exception_copy
lea rax, vtable.fmt::v7::system_error.0
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x30], 0
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x48], rax
lea rax, str.cannot_write_to_file
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x14
lea rcx, [rbp - 0x20]
lea r8, [rbp - 0x60]
lea r9, [rbp - 0x50]
mov edx, esi
call fcn.140017790
mov byte [rbp - 0x30], 1
cmp byte [rbp - 0x30], 0
jne 0x140019b82
lea rax, vtable.std::exception.0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x18]
call sub.VCRUNTIME140.dll___std_exception_destroy
nop
add rsp, 0x88
pop rsi
pop rbp
ret
lea rsi, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1400213c0
lea rdx, [0x1400428e0]
mov rcx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14002e140
Capabilities:
Resume thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov esi, dword [0x140045b90]
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
mov eax, 0x10dd
cmp esi, ecx
jne 0x14002e283
mov rdi, qword [0x140045b98]
test rdi, rdi
je 0x14002e1e9
lea rsi, [rsp + 0x28]
xorps xmm6, xmm6
jmp 0x14002e193
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.1400318f0
mov rdi, rbx
test rbx, rbx
je 0x14002e1e9
mov r8d, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x20]
movzx edx, byte [rax + 0x3e]
mov r9, rsi
call sub.KERNEL32.dll_VirtualProtect
cmp dword [rdi + 8], 0
jne 0x14002e180
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x14002e180
mov rcx, rax
and rcx, 0xffffffffffff0000
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov rdx, qword [rcx + 0x10]
mov qword [rax + 0x48], rdx
mov qword [rcx + 0x10], rax
jmp 0x14002e180
mov qword [0x140045b98], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov rdi, qword [0x140045bb8]
test rdi, rdi
je 0x14002e240
mov rsi, rax
lea rbx, [rsp + 0x2c]
nop dword [rax]
mov edx, 0x10000
mov rcx, rdi
mov r8d, 0x20
mov r9, rbx
call sub.KERNEL32.dll_VirtualProtect
mov r8d, 0x10000
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_FlushInstructionCache
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x14002e210
mov rsi, qword [0x140045ba0]
test rsi, rsi
je 0x14002e26c
nop dword [rax]
mov rcx, qword [rsi + 8]
call sub.KERNEL32.dll_ResumeThread
mov rdi, qword [rsi]
mov rcx, rsi
call fcn.1400318f0
mov rsi, rdi
test rdi, rdi
jne 0x14002e250
mov qword [0x140045ba0], 0
mov dword [0x140045b90], 0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002f650
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
movzx eax, cx
mov edi, 0x10000
sub rdi, rax
test rax, rax
cmove rdi, rax
add rdi, rcx
cmp rdi, rdx
jae 0x14002f74f
mov rsi, rdx
xorps xmm6, xmm6
lea rbx, [rsp + 0x20]
jmp 0x14002f6a0
add rdi, 0x8000000
cmp rdi, rsi
jae 0x14002f74f
cmp rdi, qword [0x1400458d8]
jb 0x14002f6b2
cmp rdi, qword [0x1400458e0]
jbe 0x14002f690
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov r8d, 0x30
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x14002f74f
cmp dword [rsp + 0x40], 0x10000
mov rax, qword [rsp + 0x38]
jne 0x14002f730
cmp rax, 0x10000
jb 0x14002f730
mov edx, 0x10000
mov rcx, rdi
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r14, rax
test rax, rax
jne 0x14002f752
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x14002f752
add rdi, 0x10000
jmp 0x14002f697
add rax, qword [rsp + 0x20]
movzx ecx, ax
mov edi, 0x10000
sub rdi, rcx
test rcx, rcx
cmove rdi, rcx
add rdi, rax
jmp 0x14002f697
xor r14d, r14d
mov rax, r14
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002f770
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x58
test rcx, rcx
je 0x14002f846
mov rsi, rcx
test rdx, rdx
je 0x14002f78e
mov qword [rdx], 0
movzx eax, byte [rsi]
cmp al, 0xff
je 0x14002f84a
cmp al, 0xeb
jne 0x14002f8b9
movsx rax, byte [rsi + 1]
lea rdi, [rsi + rax]
add rdi, 2
movzx eax, byte [rsi + rax + 2]
cmp eax, 0xe9
je 0x14002f8be
cmp eax, 0xff
jne 0x14002f8c9
cmp byte [rdi + 1], 0x25
jne 0x14002f8c9
movsxd rsi, dword [rdi + 2]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rdi
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14002f8c9
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14002f8c9
lea rcx, [rdi + rsi]
add rcx, 6
mov r8d, dword [rax + rdx + 0xe8]
add r8, rax
cmp r8, rcx
ja 0x14002f8c9
mov eax, dword [rax + rdx + 0xec]
add r8, rax
cmp r8, rcx
jbe 0x14002f8c9
mov rdi, qword [rcx]
jmp 0x14002f8c9
xor edi, edi
jmp 0x14002f8c9
cmp byte [rsi + 1], 0x25
jne 0x14002f8ae
movsxd rdi, dword [rsi + 2]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rsi
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14002f8ae
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14002f8ae
lea rcx, [rsi + rdi]
add rcx, 6
mov r8d, dword [rax + rdx + 0xe8]
add r8, rax
cmp r8, rcx
ja 0x14002f8ae
mov eax, dword [rax + rdx + 0xec]
add r8, rax
cmp r8, rcx
jbe 0x14002f8ae
mov rsi, qword [rcx]
movzx eax, byte [rsi]
cmp al, 0xeb
je 0x14002f7a1
mov rdi, rsi
jmp 0x14002f8c9
movsxd rax, dword [rdi + 1]
add rdi, rax
add rdi, 5
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret