joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400ec962
Capabilities:
Print debug messages

Disassembly:
jmp 0x1402ae1b0
mov qword [rsp + 8], rcx
push rbp
sub rsp, 0x50
lea rbp, [rsp + 0x30]
mov rax, qword [0x14032f1c0]
xor rax, rbp
mov qword [rbp + 0x18], rax
cmp qword [rbp + 0x30], 0
jne 0x1402ae1d6
jmp 0x1402ae253
mov rcx, qword [rbp + 0x30]
call fcn.1400ebb0c
inc rax
mov qword [rbp], rax
cmp qword [rbp], 0
jne 0x1402ae1ef
jmp 0x1402ae253
mov rax, qword [rbp]
shl rax, 1
mov rcx, rax
add rcx, 0xf
cmp rcx, rax
ja 0x1402ae20c
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400ea180
sub rsp, rax
lea rax, [rsp + 0x30]
mov qword [rbp + 8], rax
mov rax, qword [rbp]
dec rax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x30]
mov r8, qword [rbp]
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0x10]
call fcn.1400ea8b0
test eax, eax
jne 0x1402ae253
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rcx, qword [rbp + 0x18]
xor rcx, rbp
call fcn.1400ebe63
lea rsp, [rbp + 0x20]
pop rbp
ret
Function at 0x1400ecd77
Capabilities:
Create process on windows

Disassembly:
jmp 0x1402ab140
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x128
lea rcx, [rsp + 0xe8]
call fcn.1400eb382
lea rcx, [rsp + 0xb8]
call fcn.1400eb382
lea rcx, [rsp + 0x88]
call fcn.1400eb382
call fcn.1400ec35e
mov r8d, eax
lea rdx, [rsp + 0xe8]
mov rcx, qword [rsp + 0x130]
call fcn.1400eafef
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1402ab1e2
mov dword [rsp + 0x54], 0
lea rcx, [rsp + 0x88]
call fcn.1400eb97c
lea rcx, [rsp + 0xb8]
call fcn.1400eb97c
lea rcx, [rsp + 0xe8]
call fcn.1400eb97c
mov eax, dword [rsp + 0x54]
jmp 0x1402ab388
call fcn.1400ec35e
mov r8d, eax
lea rdx, [rsp + 0xb8]
mov rcx, qword [rsp + 0x138]
call fcn.1400eafef
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1402ab242
mov dword [rsp + 0x5c], 0
lea rcx, [rsp + 0x88]
call fcn.1400eb97c
lea rcx, [rsp + 0xb8]
call fcn.1400eb97c
lea rcx, [rsp + 0xe8]
call fcn.1400eb97c
mov eax, dword [rsp + 0x5c]
jmp 0x1402ab388
mov qword [rsp + 0x70], 0
cmp qword [rsp + 0x168], 0
je 0x1402ab2c8
call fcn.1400ec35e
mov r8d, eax
lea rdx, [rsp + 0x88]
mov rcx, qword [rsp + 0x168]
call fcn.1400eafef
mov dword [rsp + 0x60], eax
cmp dword [rsp + 0x60], 0
je 0x1402ab2b6
mov dword [rsp + 0x64], 0
lea rcx, [rsp + 0x88]
call fcn.1400eb97c
lea rcx, [rsp + 0xb8]
call fcn.1400eb97c
lea rcx, [rsp + 0xe8]
call fcn.1400eb97c
mov eax, dword [rsp + 0x64]
jmp 0x1402ab388
lea rcx, [rsp + 0x88]
call fcn.1400eb288
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0xb8]
call fcn.1400eb288
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0xe8]
call fcn.1400eb288
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x160]
mov qword [rsp + 0x30], rax
mov eax, dword [rsp + 0x158]
mov dword [rsp + 0x28], eax
mov eax, dword [rsp + 0x150]
mov dword [rsp + 0x20], eax
mov r9, qword [rsp + 0x148]
mov r8, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov dword [rsp + 0x68], eax
lea rcx, [rsp + 0x88]
call fcn.1400eb97c
lea rcx, [rsp + 0xb8]
call fcn.1400eb97c
lea rcx, [rsp + 0xe8]
call fcn.1400eb97c
mov eax, dword [rsp + 0x68]
add rsp, 0x128
ret

Function at 0x1400ece53
Capabilities:
Set environment variable

Disassembly:
jmp 0x14029d730
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x38]
mov rdx, qword [rax]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
add rsp, 0x28
ret
Function at 0x1400ed21d
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401bab80
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1401baba0
xor al, al
jmp 0x1401bac21
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1401babb3
xor al, al
jmp 0x1401bac21
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1401babdd
xor al, al
jmp 0x1401bac21
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x1401babf1
xor al, al
jmp 0x1401bac21
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x1401bac03
xor al, al
jmp 0x1401bac21
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x1401bac1f
xor al, al
jmp 0x1401bac21
mov al, 1
add rsp, 0x38
ret
Function at 0x1400edbb4
Capabilities:
Terminate process

Disassembly:
jmp 0x1401dd410
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov ecx, 0x17
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1401dd43e
mov ecx, 5
int 0x29
mov r8d, 1
mov edx, 0xc0000417
mov ecx, 2
call fcn.1400ee933
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000417
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret
Function at 0x1400ee9c4
Capabilities:
Print debug messages

Disassembly:
jmp 0x140278550
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rsp, 0x28
ret
Function at 0x1400eeb5e
Capabilities:
Set thread local storage value

Disassembly:
jmp 0x1401dc490
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
call fcn.1401dbde0
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1401dc4d9
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x30], rax
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
mov rax, qword [rsp + 0x30]
call qword [0x140351020]
jmp 0x1401dc4e8
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
add rsp, 0x48
ret

Function at 0x1400eeca8
Capabilities:
Set environment variable

Disassembly:
jmp 0x1402ba3c0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xb8
lea rcx, [rsp + 0x78]
call fcn.1400eb382
lea rcx, [rsp + 0x48]
call fcn.1400eb382
call fcn.1400ec35e
mov r8d, eax
lea rdx, [rsp + 0x78]
mov rcx, qword [rsp + 0xc0]
call fcn.1400eafef
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x1402ba42f
mov dword [rsp + 0x24], 0
lea rcx, [rsp + 0x48]
call fcn.1400eb97c
lea rcx, [rsp + 0x78]
call fcn.1400eb97c
mov eax, dword [rsp + 0x24]
jmp 0x1402ba4c0
call fcn.1400ec35e
mov r8d, eax
lea rdx, [rsp + 0x48]
mov rcx, qword [rsp + 0xc8]
call fcn.1400eafef
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0
je 0x1402ba476
mov dword [rsp + 0x2c], 0
lea rcx, [rsp + 0x48]
call fcn.1400eb97c
lea rcx, [rsp + 0x78]
call fcn.1400eb97c
mov eax, dword [rsp + 0x2c]
jmp 0x1402ba4c0
lea rcx, [rsp + 0x48]
call fcn.1400eb288
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x78]
call fcn.1400eb288
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x48]
call fcn.1400eb97c
lea rcx, [rsp + 0x78]
call fcn.1400eb97c
mov eax, dword [rsp + 0x30]
add rsp, 0xb8
ret
Function at 0x1400eef78
Capabilities:
Create thread

Disassembly:
jmp 0x14023fee0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x90], 0
je 0x14023ff0c
mov dword [rsp + 0x30], 1
jmp 0x14023ff14
mov dword [rsp + 0x30], 0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
jne 0x14023ff5d
lea rax, str.procedure___nullptr
mov qword [rsp + 0x28], rax
lea rax, [0x1402de9f8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
mov r8d, 0xc8
lea rdx, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
mov ecx, 2
call fcn.1400e9b36
cmp eax, 1
jne 0x14023ff5d
int3
cmp dword [rsp + 0x34], 0
jne 0x14023ff9f
call fcn.1400eb2d3
mov dword [rax], 0x16
mov qword [rsp + 0x20], 0
mov r9d, 0xc8
lea r8, str.minkernelcrtsucrt_src_appcrt_startup_thread.cpp
lea rdx, str._beginthreadex
lea rcx, str.procedure___nullptr
call fcn.1400ee2a8
xor eax, eax
jmp 0x14024009f
mov rdx, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
call fcn.14023f9d0
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.14023f7d0
lea rcx, [rsp + 0x40]
call fcn.14023f840
movzx eax, al
test eax, eax
jne 0x14023ffef
mov qword [rsp + 0x50], 0
lea rcx, [rsp + 0x40]
call fcn.14023f820
mov rax, qword [rsp + 0x50]
jmp 0x14024009f
lea rcx, [rsp + 0x40]
call fcn.14023fb80
mov ecx, dword [rsp + 0x88]
lea rdx, [rsp + 0x38]
mov qword [rsp + 0x28], rdx
mov edx, dword [rsp + 0xa0]
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x14023f580]
mov edx, ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
jne 0x140240063
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400eac52
mov qword [rsp + 0x58], 0
lea rcx, [rsp + 0x40]
call fcn.14023f820
mov rax, qword [rsp + 0x58]
jmp 0x14024009f
cmp qword [rsp + 0xa8], 0
je 0x14024007c
mov rax, qword [rsp + 0xa8]
mov ecx, dword [rsp + 0x38]
mov dword [rax], ecx
lea rcx, [rsp + 0x40]
call fcn.14023fb40
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x60], rax
lea rcx, [rsp + 0x40]
call fcn.14023f820
mov rax, qword [rsp + 0x60]
add rsp, 0x78
ret
Function at 0x14027ef50
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400ea180
sub rsp, rax
mov rax, qword [0x14032f1c0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140334900]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x60], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14027f142
lea rax, [rsp + 0x147f]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x38], rax
jae 0x14027f096
mov rax, qword [rsp + 0x50]
cmp qword [rsp + 0x48], rax
jae 0x14027f096
mov rax, qword [rsp + 0x48]
movzx eax, byte [rax]
mov byte [rsp + 0x31], al
mov rax, qword [rsp + 0x48]
inc rax
mov qword [rsp + 0x48], rax
movzx eax, byte [rsp + 0x31]
mov byte [rsp + 0x30], al
movsx eax, byte [rsp + 0x30]
cmp eax, 0xa
jne 0x14027f07b
mov eax, dword [rsp + 0x70]
inc eax
mov dword [rsp + 0x70], eax
mov rax, qword [rsp + 0x38]
mov byte [rax], 0xd
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, byte [rsp + 0x30]
mov byte [rax], cl
mov rax, qword [rsp + 0x38]
inc rax
mov qword [rsp + 0x38], rax
jmp 0x14027f018
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x44]
mov r8d, dword [rsp + 0x40]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14027f102
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x68], eax
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14027f161
mov eax, dword [rsp + 0x44]
mov ecx, dword [rsp + 0x6c]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x6c], eax
mov eax, dword [rsp + 0x40]
cmp dword [rsp + 0x44], eax
jae 0x14027f13d
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14027f161
jmp 0x14027efee
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400ebe63
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x14027f210
Capabilities:
Write file on windows

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
mov eax, 0x1498
call fcn.1400ea180
sub rsp, rax
mov rax, qword [0x14032f1c0]
xor rax, rsp
mov qword [rsp + 0x1480], rax
mov eax, dword [rsp + 0x14b8]
sar eax, 6
cdqe
lea rcx, [0x140334900]
mov edx, dword [rsp + 0x14b8]
and edx, 0x3f
movsxd rdx, edx
imul rdx, rdx, 0x48
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + rdx + 0x28]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x14c8]
mov rcx, qword [rsp + 0x14c0]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0xc
rep stosb byte [rdi], al
mov rax, qword [rsp + 0x14c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14027f41d
lea rax, [rsp + 0x147e]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x60]
cmp qword [rsp + 0x38], rax
jae 0x14027f369
mov rax, qword [rsp + 0x58]
cmp qword [rsp + 0x50], rax
jae 0x14027f369
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
mov word [rsp + 0x40], ax
mov rax, qword [rsp + 0x50]
add rax, 2
mov qword [rsp + 0x50], rax
movzx eax, word [rsp + 0x40]
mov word [rsp + 0x30], ax
movzx eax, word [rsp + 0x30]
cmp eax, 0xa
jne 0x14027f349
mov eax, dword [rsp + 0x78]
add eax, 2
mov dword [rsp + 0x78], eax
mov eax, 0xd
mov rcx, qword [rsp + 0x38]
mov word [rcx], ax
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx ecx, word [rsp + 0x30]
mov word [rax], cx
mov rax, qword [rsp + 0x38]
add rax, 2
mov qword [rsp + 0x38], rax
jmp 0x14027f2d8
lea rax, [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
sub rcx, rax
mov rax, rcx
sar rax, 1
mov eax, eax
shl rax, 1
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x48]
mov r8d, dword [rsp + 0x44]
lea rdx, [rsp + 0x80]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x14027f3dd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x70], eax
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14027f43c
mov eax, dword [rsp + 0x48]
mov ecx, dword [rsp + 0x74]
add ecx, eax
mov eax, ecx
mov dword [rsp + 0x74], eax
mov eax, dword [rsp + 0x44]
cmp dword [rsp + 0x48], eax
jae 0x14027f418
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
jmp 0x14027f43c
jmp 0x14027f2ae
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0x14b0]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x14b0]
mov rcx, qword [rsp + 0x1480]
xor rcx, rsp
call fcn.1400ebe63
add rsp, 0x1498
pop rdi
pop rsi
ret
Function at 0x1400080a0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1400080c2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x14000813c
mov rdi, r14
mov rcx, rbx
call fcn.14000bad0
test rax, rax
jle 0x140008114
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.140054de0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x14000812c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140008134
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1400080d6
sub r14, rdi
jmp 0x14000821f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140008153
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140008155
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140008187
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140054de0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x14000821c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400081c2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400081fd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.14003c3e0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x14000821c
cmp rbp, rax
ja 0x1400081d0
test rbp, rbp
je 0x14000821c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.14003c3e0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140028690
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x140071080]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor esi, esi
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], si
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi - 1]
lea r8, str.cs2.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
test eax, eax
jle 0x1400287c2
mov r8, qword [rsp + 0x48]
cmp rbx, r8
ja 0x14002872f
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rax, qword [rsp + 0x38]
mov qword [rsp + 0x48], rbx
mov word [rax + rbx*2], si
jmp 0x14002878e
mov rdx, rbx
sub rdx, r8
mov rdi, qword [rsp + 0x50]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140028776
mov qword [rsp + 0x48], rbx
lea r9, [rsp + 0x38]
cmp rdi, 7
cmova r9, qword [rsp + 0x38]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x14002876b
movzx eax, si
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], si
jmp 0x14002878e
mov word [rsp + 0x20], si
mov r9, rdx
movzx r8d, byte [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.14000e080
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rax, qword [rsp + 0x38]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
lea r8, str.cs2.exe
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x64]
call fcn.140055520
mov dword [rsp + 0x60], 0x238
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14002884f
nop dword [rax]
lea rdi, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rdi, qword [rsp + 0x38]
lea rax, [rbp - 0x74]
sub rdi, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140028833
add rax, 2
test ecx, ecx
jne 0x140028820
test edx, edx
je 0x14002884b
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140028800
jmp 0x14002884f
mov esi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x140028897
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140028892
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400288c1
call fcn.14002d6d0
mov eax, esi
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.14002d6b0
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
call fcn.14003cbf0
int3
Function at 0x1400288d0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140071080]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
mov edi, edx
mov ebx, esi
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x20], edi
jne 0x140028954
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140028954
cmp byte [rsp + 0x30], sil
jne 0x140028980
test rbx, rbx
jne 0x140028900
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.14002d6b0
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, rbx
jmp 0x14002895b
Function at 0x14002b8ec
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov r9d, 2
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
test eax, eax
jne 0x14002b926
xor r9d, r9d
mov dword [rsp + 0x60], r9d
jmp 0x14002b92b
mov r9d, dword [rsp + 0x60]
and qword [rsp + 0x30], 0
mov r8d, edi
and dword [rsp + 0x28], 0
xor edx, edx
mov ecx, 0x1300
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov edx, eax
test eax, eax
je 0x14002b974
mov r8, qword [rbx]
dec r8
add r8, rdx
movzx ecx, byte [r8]
lea rax, [0x1400596c0]
cmp byte [rcx + rax], 0
je 0x14002b974
dec r8
sub rdx, 1
jne 0x14002b95a
mov rbx, qword [rsp + 0x50]
mov rax, rdx
add rsp, 0x40
pop rdi
ret

Function at 0x14002e3dc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002e426
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002e426
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002e426
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002e426
cmp dword [rcx + 0x84], 0xe
jbe 0x14002e426
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14002e428
xor al, al
add rsp, 0x28
ret

Function at 0x14003cda8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
xor edi, edi
mov esi, edx
mov rbp, rcx
test r8, r8
jne 0x14003cddf
call fcn.140039e4c
mov dword [rax], 0x16
call fcn.14003cbd0
xor eax, eax
jmp 0x14003ce6d
mov rdx, r9
mov rcx, r8
call fcn.14003cd44
mov rbx, rax
test rax, rax
je 0x14003ce6a
lea rax, [rsp + 0x50]
mov rdx, rsi
mov qword [rsp + 0x28], rax
lea r8, [0x14003cc70]
mov eax, dword [rsp + 0x60]
mov r9, rbx
mov rcx, rbp
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rdx, rax
test rax, rax
jne 0x14003ce57
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.140039dc0
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x14003ce3e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14003ce4d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rcx, rbx
call fcn.14004321c
jmp 0x14003ce6a
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14003ce67
mov eax, dword [rsp + 0x50]
mov dword [rcx], eax
mov rdi, rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret

Function at 0x14003e748
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x14003e544