joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001010
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rdx
mov r8d, 0x30
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov eax, 0x5a4d
mov rcx, qword [rsp + 0x28]
cmp word [rcx], ax
je 0x14000104d
xor al, al
jmp 0x14000109c
movsxd rdx, dword [rcx + 0x3c]
cmp dword [rdx + rcx], 0x4550
je 0x14000105e
xor al, al
jmp 0x14000109c
mov r8d, dword [rdx + rcx + 0xe8]
lea rax, [r8 + rcx]
cmp rbx, rax
jb 0x140001085
mov eax, dword [rdx + rcx + 0xec]
add rax, r8
add rax, rcx
cmp rbx, rax
jae 0x140001085
mov al, 1
jmp 0x14000109c
xor al, al
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140007890
add rsp, 0x60
pop rbx
ret
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140007890
add rsp, 0x60
pop rbx
ret

Function at 0x140001290
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
movzx eax, cx
mov rdi, rdx
mov rbx, rcx
test rax, rax
je 0x1400012c1
sub rbx, rax
add rbx, 0x10000
cmp rbx, rdi
jae 0x14000137a
nop word [rax + rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x1400012eb
add rbx, 0x8000000
jmp 0x140001371
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x14000137a
cmp dword [rsp + 0x40], 0x10000
mov rcx, qword [rsp + 0x38]
jne 0x140001356
cmp rcx, 0x10000
jb 0x140001356
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000137c
add rbx, 0x10000
jmp 0x140001371
mov rbx, qword [rsp + 0x20]
add rbx, rcx
movzx ecx, bx
test rcx, rcx
je 0x140001371
mov eax, 0x10000
sub rax, rcx
add rbx, rax
cmp rbx, rdi
jb 0x1400012d0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140007890
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
Function at 0x1400013a0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x50], rax
add rdx, 0xffffffffffff0000
mov rdi, rcx
movzx eax, dx
mov rbx, rdx
sub rbx, rax
test rax, rax
cmove rbx, rdx
cmp rbx, rcx
jbe 0x140001488
nop dword [rax]
lea rax, [rbx - 0x70000000]
cmp rax, 0x10000000
ja 0x1400013fb
sub rbx, 0x8000000
jmp 0x14000147f
xorps xmm0, xmm0
lea rdx, [rsp + 0x20]
mov r8d, 0x30
mov rcx, rbx
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x140001488
cmp dword [rsp + 0x40], 0x10000
jne 0x140001463
cmp qword [rsp + 0x38], 0x10000
jb 0x140001463
mov edx, 0x10000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
test rax, rax
jne 0x14000148a
sub rbx, 0x10000
jmp 0x14000147f
mov rcx, qword [rsp + 0x28]
add rcx, 0xffffffffffff0000
movzx eax, cx
mov rbx, rcx
sub rbx, rax
test rax, rax
cmove rbx, rcx
cmp rbx, rdi
ja 0x1400013e0
xor eax, eax
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140007890
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x1400014b0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
lea rdi, [rcx - 0x7ff80000]
mov rbx, rcx
cmp rcx, 0x7ff80000
ja 0x1400014d2
mov edi, 0x80000
mov qword [rsp + 0x38], rsi
lea rsi, [rcx + 0x7ff80000]
cmp rbx, 0xffffffff80000000
jb 0x1400014ee
mov rsi, 0xfffffffffff80000
movzx eax, byte [rcx]
cmp al, 0xff
jne 0x140001505
cmp byte [rcx + 1], 0x25
jne 0x140001549
movsxd rcx, dword [rcx + 2]
add rcx, 6
jmp 0x140001511
cmp al, 0xe9
jne 0x140001549
movsxd rcx, dword [rcx + 1]
add rcx, 5
add rcx, rbx
cmp rcx, rbx
jae 0x140001534
cmp rcx, 0xffffffff80000000
jae 0x14000152b
lea rsi, [rcx + 0x7ff80000]
jmp 0x140001549
mov rsi, 0xfffffffffff80000
jmp 0x140001549
lea rdi, [rcx - 0x7ff80000]
cmp rcx, 0x7ff80000
ja 0x140001549
mov edi, 0x80000
mov rdx, qword [0x14000d9d0]
mov rax, qword [0x14000d9e0]
mov qword [rsp + 0x30], rbp
test rdx, rdx
jne 0x140001570
test rax, rax
je 0x140001587
mov rdx, rax
mov qword [0x14000d9d0], rax
mov rcx, qword [rdx + 0x10]
test rcx, rcx
je 0x140001587
cmp rcx, rdi
jb 0x140001587
cmp rcx, rsi
jbe 0x1400016da
mov qword [0x14000d9d0], rax
mov rdx, rax
test rax, rax
je 0x1400015d2
mov rcx, rax
nop dword [rax]
test rax, rax
je 0x1400015bc
mov rax, qword [rcx + 0x10]
test rax, rax
je 0x1400015bc
cmp rax, rdi
jb 0x1400015bc
cmp rax, rsi
jbe 0x1400016da
mov rdx, qword [rdx + 8]
mov qword [0x14000d9d0], rdx
mov rcx, rdx
mov rax, rdx
test rdx, rdx
jne 0x1400015a0
movzx eax, bx
sub rbx, rax
cmp rbx, 0x40000000
jbe 0x1400015fc
lea rdx, [rbx - 0x40000000]
mov rcx, rdi
call fcn.1400013a0
mov rdx, rax
test rax, rax
jne 0x140001688
movabs rbp, 0xffffffff40000000
cmp rbx, rbp
jae 0x140001622
lea rcx, [rbx + 0x40000000]
mov rdx, rsi
call fcn.140001290
mov rdx, rax
test rax, rax
jne 0x140001688
cmp rbx, 0x40000000
jbe 0x140001642
lea rcx, [rbx - 0x40000000]
mov rdx, rbx
call fcn.140001290
mov rdx, rax
test rax, rax
jne 0x140001688
cmp rbx, rbp
jae 0x14000165e
lea rdx, [rbx + 0x40000000]
mov rcx, rbx
call fcn.1400013a0
mov rdx, rax
test rax, rax
jne 0x140001688
mov rdx, rbx
mov rcx, rdi
call fcn.1400013a0
mov rdx, rax
test rax, rax
jne 0x140001688
mov rdx, rsi
mov rcx, rbx
call fcn.140001290
mov rdx, rax
test rax, rax
je 0x140001711
mov dword [rdx], 0x52727464
lea rcx, [rdx + 0xffa8]
xor r8d, r8d
mov qword [0x14000d9d0], rdx
mov qword [rdx + 0x10], r8
mov r9d, 0x2a7
mov rax, qword [0x14000d9e0]
mov qword [rdx + 8], rax
lea rax, [rdx + 0xff60]
mov qword [0x14000d9e0], rdx
mov qword [rcx], r8
lea rcx, [rcx - 0x60]
mov r8, rax
sub rax, 0x60
sub r9, 1
jne 0x1400016c2
mov qword [rdx + 0x10], r8
mov rax, qword [rdx + 0x10]
cmp rax, rdi
jb 0x140001711
cmp rax, rsi
ja 0x140001711
mov rcx, qword [rax + 0x48]
movdqa xmm0, xmmword [0x140009a90]
mov qword [rdx + 0x10], rcx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
jmp 0x140001713
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140001730
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x28], rax
cmp dword [0x14000d9cc], 0
jne 0x1400017f4
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, eax
xor eax, eax
lock cmpxchg dword [0x14000d9cc], ecx
jne 0x1400017f4
mov qword [rsp + 0x40], rbx
mov rbx, qword [0x14000d9e0]
mov qword [rsp + 0x30], rdi
xor edi, edi
mov qword [0x14000d9f0], rdi
mov qword [0x14000d9e8], rdi
mov qword [0x14000d9d8], rdi
test rbx, rbx
je 0x1400017d0
nop word [rax + rax]
lea r9, [rsp + 0x20]
mov edx, 0x10000
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1400017c8
mov rbx, qword [rbx + 8]
test rbx, rbx
jne 0x1400017a0
jmp 0x1400017d0
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov dword [0x14000d9c8], edi
mov rdi, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140007890
add rsp, 0x38
ret
mov eax, 0x10dd
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140007890
add rsp, 0x38
ret
Function at 0x140001e00
Capabilities:
Suspend thread

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x14000d9c8]
mov rbx, rcx
test eax, eax
jne 0x140001e99
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rbx, rax
jne 0x140001e2a
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov ecx, 0x10
mov qword [rsp + 0x30], rdi
call fcn.1400078b0
mov rcx, rbx
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x140001e7d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 0x10
mov rcx, rdi
call fcn.1400078ec
mov rdi, qword [rsp + 0x30]
mov eax, ebx
mov dword [0x14000d9c8], ebx
mov qword [0x14000d9d8], 0
add rsp, 0x20
pop rbx
ret
mov rax, qword [0x14000d9e8]
mov qword [rdi], rax
xor eax, eax
mov qword [rdi + 8], rbx
mov qword [0x14000d9e8], rdi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x140002400
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push r14
sub rsp, 0x48
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rdi, rdx
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x14000d9cc], eax
je 0x140002435
mov eax, 0x10dd
jmp 0x14000263b
mov eax, dword [0x14000d9c8]
test eax, eax
jne 0x14000263b
test rdi, rdi
jne 0x140002452
mov eax, 0x57
jmp 0x14000263b
test r14, r14
je 0x14000246e
cmp qword [r14], 0
jne 0x140002478
mov dword [0x14000d9c8], 6
mov qword [0x14000d9d8], r14
mov eax, 6
jmp 0x14000263b
mov qword [rsp + 0x70], rbx
mov ecx, 0x30
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r15
call fcn.1400078b0
mov rbx, qword [r14]
mov rsi, rax
test rbx, rbx
je 0x140002515
cmp byte [rbx], 0xff
jne 0x1400024c8
cmp byte [rbx + 1], 0x25
jne 0x1400024c8
movsxd r15, dword [rbx + 2]
lea rdx, [rbx + 6]
add rdx, r15
mov rcx, rbx
call fcn.140001010
test al, al
je 0x1400024c8
mov rbx, qword [r15 + rbx + 6]
cmp byte [rbx], 0xeb
jne 0x140002515
movsx rax, byte [rbx + 1]
add rbx, 2
add rbx, rax
movzx ecx, byte [rbx]
cmp cl, 0xff
jne 0x140002505
cmp byte [rbx + 1], 0x25
jne 0x140002505
movsxd r15, dword [rbx + 2]
mov rcx, rbx
lea rdx, [r15 + 6]
add rdx, rbx
call fcn.140001010
test al, al
je 0x140002515
mov rbx, qword [r15 + rbx + 6]
jmp 0x140002515
cmp cl, 0xe9
jne 0x140002515
movsxd rax, dword [rbx + 1]
add rbx, 5
add rbx, rax
cmp byte [rdi], 0xff
jne 0x14000253c
cmp byte [rdi + 1], 0x25
jne 0x14000253c
movsxd r15, dword [rdi + 2]
lea rdx, [rdi + 6]
add rdx, r15
mov rcx, rdi
call fcn.140001010
test al, al
je 0x14000253c
mov rdi, qword [r15 + rdi + 6]
cmp byte [rdi], 0xeb
jne 0x140002589
movsx rax, byte [rdi + 1]
add rdi, 2
add rdi, rax
movzx ecx, byte [rdi]
cmp cl, 0xff
jne 0x140002579
cmp byte [rdi + 1], 0x25
jne 0x140002579
movsxd r15, dword [rdi + 2]
mov rcx, rdi
lea rdx, [r15 + 6]
add rdx, rdi
call fcn.140001010
test al, al
je 0x140002589
mov rdi, qword [r15 + rdi + 6]
jmp 0x140002589
cmp cl, 0xe9
jne 0x140002589
movsxd rax, dword [rdi + 1]
add rdi, 5
add rdi, rax
movzx edx, byte [rbx + 0x3e]
mov rbp, qword [rbx + 0x48]
mov r15, qword [rsp + 0x30]
sub rbp, rdx
test dl, dl
je 0x140002602
cmp rdx, 0x1e
ja 0x140002602
cmp qword [rbx + 0x50], rdi
jne 0x140002602
lea r9, [rsp + 0x20]
mov dword [rsp + 0x20], 0
mov r8d, 0x40
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400025d3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x140002610
mov dword [rsi + 8], 1
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x20], rbx
mov qword [rsi + 0x18], rbp
mov eax, dword [rsp + 0x20]
mov dword [rsi + 0x28], eax
mov rax, qword [0x14000d9f0]
mov qword [rsi], rax
xor eax, eax
mov qword [0x14000d9f0], rsi
jmp 0x14000262c
cmp dword [0x14000d958], 0
mov ebx, 9
jne 0x140002616
mov dword [0x14000d9c8], ebx
mov edx, 0x30
mov rcx, rsi
call fcn.1400078ec
mov eax, ebx
mov qword [0x14000d9d8], r14
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140007890
add rsp, 0x48
pop r14
pop rdi
ret
Function at 0x140005b70
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140005b98
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140005bbe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005bc0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005c19
test ecx, ecx
jle 0x140005bf9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005c19
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005c19
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140005c40
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140005c62
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140005c78
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140005c94
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005c96
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005cd2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140005d6e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140005d0d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140005d4e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140005d6e
cmp rbx, rax
ja 0x140005d20
test rbx, rbx
je 0x140005d6e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x1400061d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x1400061fd
xor eax, eax
jmp 0x140006369
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140006237
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140006237
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140006369
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14000635c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000627a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400062a5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140006361
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006314
sub eax, 1
je 0x140006314
cmp eax, 2
jne 0x14000635c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140006361
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140006342
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14000635c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140006361
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140007890
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1400065f0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14000d040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400066c3
cmp byte [rcx + 0x71], 0
je 0x1400066c3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x1400066bf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006684
sub eax, 1
je 0x140006688
cmp eax, 2
jne 0x1400066bf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140007890
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x1400066b6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x1400066bf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000666c
xor al, al
jmp 0x14000666c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140007890
add rsp, 0x60
pop rbx
ret

Function at 0x1400082ec
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008336
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008336
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008336
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008336
cmp dword [rcx + 0x84], 0xe
jbe 0x140008336
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008338
xor al, al
add rsp, 0x28
ret
Function at 0x140001ff0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x140009040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140002075
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140002075
nop
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x1400020a1
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140002050
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140003d20
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140002080
Function at 0x140002a90
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je case.default.0x140002ab1
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140002ade
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140002ae0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140002b39
test ecx, ecx
jle 0x140002b19
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140002b39
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140002b39
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al
add byte [rax], al