joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140019600
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
cmp qword [rcx + 0x18], 0
mov rbx, rcx
jne 0x1400196b3
mov ecx, 0x18
call fcn.14001edf8
xor ecx, ecx
lea r8, [0x140019730]
mov r9, rbx
xor edx, edx
mov dword [rax + 0x12], ecx
mov word [rax + 0x16], cx
mov qword [rax + 8], rcx
mov word [rax + 0x10], cx
mov qword [rbx + 0x18], rax
mov qword [rax], 0xffffffffffffffff
mov rax, qword [rbx + 0x18]
mov byte [rax + 0x10], cl
mov rax, qword [rbx + 0x18]
add rax, 8
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x18]
lea r8, str.Created_monitoring_thread_with_ID__d
xor edx, edx
mov qword [rcx], rax
mov r9, qword [rbx + 0x18]
mov r9d, dword [r9 + 8]
call fcn.140016d70
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax]
cmp rcx, 0xffffffffffffffff
je 0x14001969d
test rcx, rcx
je 0x14001969d
mov byte [rax + 0x11], 1
add rsp, 0x30
pop rbx
ret
lea r8, str._Failed_to_create_monitor_thread____Detections::StartMonitor
mov edx, 2
add rsp, 0x30
pop rbx
jmp fcn.140016ae0
add rsp, 0x30
pop rbx
ret

Function at 0x14001ad30
Capabilities:
Read file via mapping

Disassembly:
push rbx
sub rsp, 0x30
lea rax, [0x140031474]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
mov rcx, 0xffffffffffffffff
mov dword [rsp + 0x20], 4
mov r8d, 4
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rbx, rax
test rax, rax
jne 0x14001ad8c
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_create_shared_memory._Error_code:__lu_n
mov edx, 2
mov r9d, eax
call fcn.140016d70
xor al, al
add rsp, 0x30
pop rbx
ret
xor r9d, r9d
mov qword [rsp + 0x20], 4
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x14001add9
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_map_view_of_file._Error_code_:___lu_n
mov edx, 2
mov r9d, eax
call fcn.140016d70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x30
pop rbx
ret
cmp dword [rax], 0x539
jne 0x14001adfb
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
add rsp, 0x30
pop rbx
ret
mov dword [rax], 0x539
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x14001ae10
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x28], rax
lea rcx, [0x1400321b0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
jne 0x14001ae56
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Failed_to_fetch_ntdll_module___StopAPCInjection._Error_code_:___lu_n
mov edx, 2
call fcn.140016d70
jmp 0x14001af05
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
jne 0x14001ae82
lea r8, str.Failed_to_fetch_ntdll.Ordinal8_address___StopAPCInjection
mov edx, 2
call fcn.140016ae0
jmp 0x14001af05
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov edx, 1
mov r8d, 0x40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001aebf
mov r9, rbx
lea r8, str.Failed_to_call_VirtualProtect_on_Oridinal8_address___StopAPCInjection:__llX
mov edx, 1
call fcn.140016860
xor al, al
jmp 0x14001af07
mov byte [rbx], 0xc3
lea r9, [rsp + 0x20]
mov r8d, dword [rsp + 0x20]
mov edx, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
nop
mov al, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x30
pop rbx
ret
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x30
pop rbx
ret
Function at 0x14001c1d0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x140]
mov edx, 0x104
xor edi, edi
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x14001c244
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_retrieve_Windows_directory_path___Services::GetWindowsPath:__d_n
mov edx, 2
mov r9d, eax
call fcn.140016d70
xorps xmm0, xmm0
lea rdx, [0x14003240e]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov qword [rbx + 0x18], rdi
jmp 0x14001c2be
mov r8d, 0x104
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x140]
call qword [sym.imp.KERNEL32.dll_GetVolumePathNameA]
test eax, eax
jne 0x14001c295
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.Failed_to_retrieve_volume_path_name___Services::GetWindowsPath:__d_n
mov edx, 2
mov r9d, eax
call fcn.140016d70
xorps xmm0, xmm0
lea rdx, [0x14003240e]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov qword [rbx + 0x18], rdi
jmp 0x14001c2be
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rdi
nop
inc r8
cmp byte [rax + r8], dil
jne 0x14001c2b0
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.1400135b0
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001edd0
mov rbx, qword [rsp + 0x278]
add rsp, 0x260
pop rdi
ret

Function at 0x14001d890
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov r10, qword [rdx]
mov rbx, rdx
mov r11, rcx
test r10, r10
je 0x14001d90f
cmp qword [rcx + 8], 0xffffffffffffffff
jne 0x14001d8b6
mov eax, 0xd
add rsp, 0x20
pop rbx
ret
mov r8d, dword [rdx + 8]
mov rdx, r10
mov qword [rsp + 0x30], rdi
call fcn.14001d940
mov rcx, qword [r11 + 8]
xor r9d, r9d
mov r8d, dword [rbx + 8]
mov rdx, r10
call qword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
mov edi, 8
cmp eax, dword [rbx + 8]
cmove edi, ecx
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001d8f5
call fcn.14001edf0
mov edx, send
mov rcx, rbx
call fcn.14001edf0
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov eax, send
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, edx
call fcn.14001d980
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14001d890
Function at 0x14001d920
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov r10, qword [rdx]
mov rbx, rdx
mov r11, rcx
test r10, r10
je 0x14001d90f
cmp qword [rcx + 8], 0xffffffffffffffff
jne 0x14001d8b6
mov eax, 0xd
add rsp, 0x20
pop rbx
ret
mov r8d, dword [rdx + 8]
mov rdx, r10
mov qword [rsp + 0x30], rdi
call fcn.14001d940
mov rcx, qword [r11 + 8]
xor r9d, r9d
mov r8d, dword [rbx + 8]
mov rdx, r10
call qword [sym.imp.WS2_32.dll_send]
xor ecx, ecx
mov edi, 8
cmp eax, dword [rbx + 8]
cmove edi, ecx
mov rcx, qword [rbx]
test rcx, rcx
je 0x14001d8f5
call fcn.14001edf0
mov edx, send
mov rcx, rbx
call fcn.14001edf0
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
mov eax, send
add rsp, 0x20
pop rbx
ret
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, edx
call fcn.14001d980
mov rdx, rax
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x14001d890

Function at 0x14001d940
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
test r8d, r8d
jle 0x14001d978
nop dword [rax + rax]
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
xor cl, 0x90
lea eax, [rcx + 0x70]
sub cl, 0x70
test r9b, 1
movzx ecx, cl
movzx eax, al
cmovne ecx, eax
inc r9d
mov byte [rdx - 1], cl
cmp r9d, r8d
jl 0x14001d950
ret

Function at 0x14001de10
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rbx, rcx
xor ebp, ebp
mov r14, rdx
mov edi, ebp
mov rcx, qword [rax + 0x18]
mov rsi, qword [rcx + 0x20]
nop dword [rax]
mov rax, qword [rbx + 0x18]
cmp edi, 0x100
jge 0x14001dec1
mov rdx, rbx
cmp rax, 7
jbe 0x14001de58
mov rdx, qword [rbx]
mov rcx, qword [rsi + 0x40]
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x14001de6e
mov rsi, qword [rsi]
inc edi
jmp 0x14001de40
cmp qword [r14 + 0x18], 7
mov r8, r14
jbe 0x14001de7b
mov r8, qword [r14]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rsi + 0x40]
inc rdx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
movzx eax, word [r14 + 0x10]
mov rcx, rbx
add ax, ax
inc ax
mov word [rsi + 0x38], ax
movzx eax, word [r14 + 0x10]
add ax, ax
inc ax
mov word [rsi + 0x3a], ax
call fcn.140012400
mov rcx, r14
call fcn.140012400
mov al, 1
jmp 0x14001df54
cmp rax, 7
jbe 0x14001def8
mov rcx, qword [rbx]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14001def3
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001df67
mov rcx, r8
call fcn.14001edf0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x14001df42
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001df3d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001df67
mov rcx, r8
call fcn.14001edf0
mov qword [r14 + 0x10], rbp
xor al, al
mov qword [r14 + 0x18], 7
mov word [r14], bp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001df70
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
cmp qword [rcx + 0x18], 0xf
jbe 0x14001dfa0
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x14001e09b
mov esi, dword [rax + 0x3c]
add rsi, rax
xor edi, edi
mov dword [rsp + 0x28], edi
lea r9, [rsp + 0x28]
mov edx, 4
mov r8d, 0x40
lea rcx, [rsi + 6]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001e02d
lea r8, str._VirtualProtect_failed___Process::ChangeNumberOfSections
mov edx, 2
call fcn.140016ae0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14001e025
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x14001e020
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001e113
mov rcx, r8
call fcn.14001edf0
mov byte [rbx], 0
jmp 0x14001e0e8
mov dword [rsi + 6], 1
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x28]
mov edx, 4
lea rcx, [rsi + 6]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14001e05a
lea r8, str._VirtualProtect__2nd_call__failed___Process::ChangeNumberOfSections
jmp 0x14001dfe0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14001e094
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001e08f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001e113
mov rcx, r8
call fcn.14001edf0
mov byte [rbx], 0
mov al, 1
jmp 0x14001e0ea
lea r8, str._PIMAGE_DOS_HEADER_or_hInst_was_NULL___Process::ChangeNumberOfSections
mov edx, 2
call fcn.140016ae0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14001e0e3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14001e0de
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001e113
mov rcx, r8
call fcn.14001edf0
xor edi, edi
mov byte [rbx], dil
xor al, al
mov qword [rbx + 0x18], send
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.14001edd0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001e120
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor esi, esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, eax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x20], rax
cmp rax, 0xffffffffffffffff
je 0x14001e1b3
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001e1b3
cmp dword [rsp + 0x38], edi
je 0x14001e1af
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14001e195
jmp 0x14001e1b3
mov esi, dword [rsp + 0x50]
cmp rbx, 0xffffffffffffffff
je 0x14001e1c2
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14001edd0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14001e1f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
mov dword [rsp + 0x20], 0x238
xor ebp, ebp
mov ecx, 2
xor edx, edx
mov edi, ebp
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x14001e2ae
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14001e2ae
nop
cmp qword [rbx + 0x18], 7
mov r8, rbx
jbe 0x14001e26d
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001e294
add rax, 2
test ecx, ecx
jne 0x14001e280
test edx, edx
mov rcx, rsi
lea rdx, [rsp + 0x20]
cmove edi, dword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x14001e260
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14001e2f2
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14001e2ed
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14001e32c
mov rcx, r8
call fcn.14001edf0
mov qword [rbx + 0x10], rbp
mov eax, edi
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14001edd0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14001e340
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
test rax, rax
jne 0x14001e375
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str._Failed_to_get_module_handle:__d___GetSectionAddress_n
mov edx, 2
mov r9d, eax
call fcn.140016d70
xor eax, eax
add rsp, 0x28
ret
mov eax, 0x5a4d
cmp word [r9], ax
je 0x14001e398
lea r8, str._Invalid_DOS_header___GetSectionAddress._n
mov edx, 2
call fcn.140016ae0
xor eax, eax
add rsp, 0x28
ret
movsxd rcx, dword [r9 + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
je 0x14001e3bf
lea r8, str._Invalid_NT_header___GetSectionAddress._n
mov edx, 2
call fcn.140016ae0
xor eax, eax
add rsp, 0x28
ret
movzx edx, word [rcx + 0x14]
lea r10, str..text
add rdx, 0x18
add rdx, rcx
xor r8d, r8d
test rdx, rdx
je 0x14001e3ff
xor eax, eax
nop dword [rax + rax]
movzx ecx, byte [rdx + rax]
inc rax
cmp cl, byte [r10 + rax - 1]
jne 0x14001e3ff
cmp rax, 6
jne 0x14001e3e0
mov eax, dword [rdx + 0xc]
add rax, r9
add rsp, 0x28
ret
add rdx, 0x28
inc r8d
cmp r8d, 6
jl 0x14001e3d4
lea r8, str..text_section_not_found._n
mov edx, 1
call fcn.140016ae0
xor eax, eax
add rsp, 0x28
ret
Function at 0x14001e730
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0xa70
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0xa60], rax
mov r14, rcx
xor r15d, r15d
mov dword [rsp + 0x48], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r9, [rsp + 0x48]
mov r8d, 0x800
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14001e8e9
mov ecx, dword [rsp + 0x48]
mov eax, ecx
shr rax, 3
cmp qword [r14 + 0xb0], rax
jae 0x14001e8fa
mov ebp, r15d
test ecx, 0xfffffff8
jbe 0x14001e8c5
movabs r12, 0xaaaaaaaaaaaaaaa
nop dword [rax]
mov ecx, 0x620
call fcn.14001edf8
mov rdi, rax
xor edx, edx
mov r8d, 0x620
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov ecx, ebp
lea rsi, [rsp + 0x50]
lea rsi, [rsi + rcx*8]
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x104
lea r8, [rsp + 0x850]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
test eax, eax
je 0x14001e8e0
lea rcx, [rdi + 0x200]
lea r8, [rsp + 0x850]
mov edx, 0x200
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rax, qword [rsi]
mov qword [rdi + 0x618], rax
mov rbx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x18
lea r8, [rsp + 0x30]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
je 0x14001e8d7
mov rax, qword [rsp + 0x30]
mov qword [rdi + 0x600], rax
mov eax, dword [rsp + 0x38]
mov dword [rdi + 0x608], eax
lea rbx, [r14 + 0xa8]
mov rsi, qword [rbx]
cmp qword [rbx + 8], r12
je 0x14001e8c9
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r15
mov ecx, 0x18
call fcn.14001edf8
mov qword [rax + 0x10], rdi
inc qword [rbx + 8]
mov rcx, qword [rsi + 8]
mov qword [rax], rsi
mov qword [rax + 8], rcx
mov qword [rsp + 0x28], r15
mov qword [rsi + 8], rax
mov qword [rcx], rax
inc ebp
mov eax, dword [rsp + 0x48]
shr eax, 3
cmp ebp, eax
jb 0x14001e7c0
mov al, 1
jmp 0x14001e8fc
lea rcx, str.list_too_long
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xlength_error_char_const____ptr64_]
int3
lea r8, str.Unable_to_parse_module_information___Process::FillModuleList
jmp 0x14001e8f0
lea r8, str.Unable_to_parse_module_named___Process::FillModuleList
jmp 0x14001e8f0
lea r8, str.EnumProcessModules_failed___Process::FillModuleList
mov edx, 2
call fcn.140016ae0
xor al, al
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.14001edd0
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x14001e930
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x30
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
movsxd rcx, dword [rax + 0x3c]
mov ebx, dword [rcx + rax + 0xd0]
add rbx, rax
je 0x14001e9aa
mov dword [rsp + 0x20], 0
lea r9, [rsp + 0x20]
mov edx, 8
mov r8d, 0x40
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14001e9aa
mov rax, qword [rbx + 0x18]
lea rcx, [0x14001cda0]
mov qword [rax], rcx
mov al, 1
jmp 0x14001e9ac
xor al, al
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14001edd0
add rsp, 0x30
pop rbx
ret

Function at 0x14001e9c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x260
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 7
mov word [rcx], ax
mov dword [rsp + 0x20], 1
mov r8d, edx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14001eac7
lea r9, [rsp + 0x38]
mov r8d, 8
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14001eaa2
mov r9d, 0x104
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14001ea93
lea rax, [rsp + 0x40]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14001ea70
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.140012bc0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001eae1
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.GetModuleBaseName_failed_with_error__d____Process::GetProcessName
jmp 0x14001eaaf
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r8, str.EnumProcessModules_failed_with_error__d____Process::GetProcessName
mov r9d, eax
mov edx, 2
call fcn.140016d70
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14001eae1
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.OpenProcess_failed_with_error__d____Process::GetProcessName
mov edx, 2
call fcn.140016d70
mov rax, rbx
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.14001edd0
mov rbx, qword [rsp + 0x280]
add rsp, 0x260
pop rdi
ret
Function at 0x14001eb10
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x650
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rsp + 0x640], rax
mov rax, qword gs:[0x60]
mov ecx, 0x18
mov rsi, qword [rax + 0x18]
add rsi, 0x10
mov rbx, qword [rsi]
call fcn.14001edf8
mov rdi, rax
xor eax, eax
mov qword [rdi], rax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
mov r8, qword [rbx + 0x50]
lea rcx, [rsp + 0x220]
mov edx, 0x200
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, qword [rbx + 0x60]
lea rcx, [rsp + 0x20]
mov edx, 0x100
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rax, qword [rbx + 0x30]
mov rdx, qword [rdi + 8]
mov qword [rsp + 0x638], rax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x620], rax
mov eax, dword [rbx + 0x40]
mov dword [rsp + 0x628], eax
cmp rdx, qword [rdi + 0x10]
je 0x14001ebd6
mov rcx, rdx
mov r8d, 0x620
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcpy
add qword [rdi + 8], 0x620
jmp 0x14001ebe3
lea r8, [rsp + 0x20]
mov rcx, rdi
call fcn.140013e40
mov rbx, qword [rbx]
cmp rbx, rsi
jne 0x14001eb62
mov rax, rdi
mov rcx, qword [rsp + 0x640]
xor rcx, rsp
call fcn.14001edd0
lea r11, [rsp + 0x650]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x14001ec20
Capabilities:
Access peb ldr_data

Disassembly:
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov r8, rcx
mov r10, rcx
mov r9, qword [rax + 0x18]
add r9, 0x10
mov rdi, qword [r9]
mov rax, qword [rdi + 0x60]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001ec64
add rax, 2
test ecx, ecx
jne 0x14001ec50
test edx, edx
je 0x14001eca8
nop dword [rax + rax]
mov rdi, qword [rdi]
cmp rdi, r9
je 0x14001ed1f
mov rax, qword [rdi + 0x60]
mov r8, r10
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x14001eca4
add rax, 2
test ecx, ecx
jne 0x14001ec90
test edx, edx
jne 0x14001ec70
mov ecx, 0x620
mov qword [rsp + 0x30], rbx
call fcn.14001edf8
xor edx, edx
mov r8d, 0x620
mov rcx, rax
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
mov r8, qword [rdi + 0x50]
lea rcx, [rbx + 0x200]
mov edx, 0x200
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov r8, qword [rdi + 0x60]
mov edx, 0x100
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
mov rcx, qword [rdi + 0x30]
mov qword [rbx + 0x618], rcx
mov rax, qword [rdi + 0x30]
mov qword [rbx + 0x600], rax
mov eax, dword [rdi + 0x40]
mov dword [rbx + 0x608], eax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x14001fa40
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001fa8a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001fa8a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001fa8a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001fa8a
cmp dword [rcx + 0x84], 0xe
jbe 0x14001fa8a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001fa8c
xor al, al
add rsp, 0x28
ret