joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140021370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 0x10]
mov rbx, rcx
mov rbp, qword [0x140a0f4b8]
test rax, rax
je 0x140021398
mov eax, dword [rax + 4]
mov dword [rcx + 4], eax
mov rcx, qword [rcx + 0x18]
test rcx, rcx
je 0x1400213a6
call fcn.140021370
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x1400213b4
call fcn.140021370
mov r9d, dword [rbx + 0x28]
xor esi, esi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r14
test r9d, r9d
jle 0x140021496
mov r14d, esi
mov rax, qword [rbx + 0x30]
mov r8d, dword [rbx + 0x9c]
mov ecx, dword [rbp + 0x1b18]
inc r8d
mov rdi, qword [r14 + rax]
cmp r8d, ecx
jne 0x1400213fd
mov eax, dword [rdi + 0x2d8]
inc eax
cmp eax, ecx
jge 0x1400213fd
mov dl, 1
jmp 0x140021404
xor dl, dl
cmp r8d, ecx
jne 0x14002142c
test byte [rbx + 0xb4], 0x20
jne 0x140021418
mov eax, dword [rdi + 8]
cmp dword [rbx + 0xac], eax
jne 0x14002142c
cmp byte [rdi + 0xc8], 0
je 0x14002142c
test dword [rdi + 0xc], 0x100000
jne 0x14002142c
mov dl, 1
movzx ecx, byte [rdi + 0x472]
movzx eax, cl
shr al, 2
and al, 1
or al, dl
je 0x140021476
and cl, 0xfb
mov byte [rdi + 0x472], cl
cmp dword [rbx + 0x28], 1
jne 0x14002145c
mov eax, dword [rbx + 8]
shr eax, 0xb
test al, 1
je 0x1400214fc
mov r8d, dword [rbx]
mov rdx, rdi
mov rcx, rbx
call fcn.140020f30
mov r9d, dword [rbx + 0x28]
dec esi
sub r14, 8
jmp 0x140021487
mov eax, dword [rdi + 0x28]
not eax
and dword [rbx + 8], eax
mov eax, dword [rbx + 8]
or eax, dword [rdi + 0x24]
mov dword [rbx + 8], eax
inc esi
add r14, 8
cmp esi, r9d
jl 0x1400213d0
movzx edx, byte [rbx + 0xb5]
movzx ecx, dl
test dl, 1
je 0x1400214c5
cmp r9d, 1
jne 0x1400214c5
mov r8d, dword [rbx + 8]
mov eax, r8d
or eax, dword [rbx + 4]
test al, 0x40
je 0x1400214c5
shr r8d, 0xd
test r9b, r8b
jne 0x1400214c5
or cl, 2
and cl, 0xfe
mov byte [rbx + 0xb5], cl
movzx eax, cl
test cl, 2
je 0x1400214ed
mov rdx, qword [rbx + 0x80]
test rdx, rdx
je 0x1400214ed
test dword [rdx + 0x24], 0x2000
je 0x1400214ed
and al, 0xfd
cmp r9d, 1
jle 0x14002151b
and dword [rbx + 8], 0xffffdfff
jmp 0x140021526
mov rcx, rbx
call fcn.140021290
mov r8d, dword [rbx]
mov rdx, rdi
mov rcx, rbx
mov dword [rbx + 0xc], 1
call fcn.140020f30
jmp 0x14002158c
test al, 2
je 0x140021526
xor dword [rbx + 8], 0x2000
mov ecx, dword [rbx + 8]
and al, 0xfd
mov byte [rbx + 0xb5], al
mov eax, ecx
shr eax, 0xb
shr ecx, 0xa
cmp qword [rbx + 0x10], 0
movzx eax, al
movzx edx, cl
cmovne edx, eax
test r9d, r9d
setg al
or dl, al
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x140021563
test byte [rax + 0xb4], 1
je 0x140021563
mov dl, 1
mov rax, qword [rbx + 0x20]
test rax, rax
je 0x140021579
test byte [rax + 0xb4], 1
je 0x140021579
mov al, 1
jmp 0x14002157b
xor al, al
and byte [rbx + 0xb4], 0xfe
or al, dl
and al, 1
or byte [rbx + 0xb4], al
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400471e0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov r10, rdx
test r8, r8
je 0x14004726b
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140047240
lea r10, [0x1400d1920]
nop dword [rax]
cmp r9b, 0x23
jne 0x140047223
cmp byte [r8], r9b
jne 0x140047223
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r10 + rdx*4]
test r9b, r9b
jne 0x140047210
mov rcx, qword [0x140a0f4b8]
not eax
cmp dword [rcx + 0x1be8], eax
jne 0x140047257
mov dword [rcx + 0x1bec], eax
cmp dword [rcx + 0x1c28], eax
jne 0x1400472bd
mov byte [rcx + 0x1c2c], 1
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rbx, qword [0x140a0f4b8]
mov rax, qword [rbx + 0x1b90]
movsxd rcx, dword [rax + 0x108]
mov rax, qword [rax + 0x110]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, r10
call fcn.140008a20
cmp dword [rbx + 0x1be8], eax
jne 0x1400472a9
mov dword [rbx + 0x1bec], eax
cmp dword [rbx + 0x1c28], eax
jne 0x1400472b8
mov byte [rbx + 0x1c2c], 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x14004d060
Capabilities:
Delete file
Delete service
Modify service
Stop service

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, qword [0x140a0f598]
cmp byte [rbx], 0
je 0x14004d182
mov word [rbx + 0x78], 0
xor edx, edx
mov qword [rsp + 0xb0], rdi
xor ecx, ecx
lea r8d, [rdx + 1]
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rdi, rax
test rax, rax
je 0x14004d1e9
cmp byte [rbx + 0x79], 0
lea rdx, [rbx + 0x48]
mov eax, 0x10020
mov qword [rsp + 0xa8], rsi
mov ecx, reloc.WLDAP32.dll_Ordinal_32
cmovne eax, ecx
mov r8d, eax
or r8d, 2
cmp byte [rbx + 0x7a], 0
cmove r8d, eax
cmp qword [rdx + 0x18], 0x10
jb 0x14004d0e9
mov rdx, qword [rdx]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rsi, rax
test rax, rax
je 0x14004d217
lea r8, [rsp + 0x60]
mov edx, 1
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x14004d20e
cmp byte [rbx + 0x7a], 0
je 0x14004d161
xor eax, eax
mov edx, 0xffffffff
mov qword [rsp + 0x50], rax
mov r9d, edx
mov qword [rsp + 0x48], rax
mov rcx, rsi
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rax
lea r8d, [rax + 4]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
je 0x14004d20e
cmp byte [rbx + 0x79], 0
je 0x14004d190
cmp byte [rbx], 0
jne 0x14004d190
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
jmp 0x14004d1e1
cmp byte [rbx + 0x78], 0
je 0x14004d091
mov al, 1
jmp 0x14004d1f1
mov rcx, rsi
mov qword [rsp + 0xa0], rbp
call qword [sym.imp.ADVAPI32.dll_DeleteService]
mov rcx, rsi
mov ebp, eax
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
cmp byte [rbx + 0x7b], 0
je 0x14004d20a
cmp byte [rbx], 0
je 0x14004d20a
cmp qword [rbx + 0x20], 0x10
lea rcx, [rbx + 8]
jb 0x14004d1ce
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
mov rbp, qword [rsp + 0xa0]
setne al
mov rsi, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.1400bcb70
add rsp, 0x90
pop rbx
ret
test ebp, ebp
jmp 0x14004d1d6
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
jmp 0x14004d1e1
Function at 0x14004d850
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
mov rcx, qword [rcx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 3
jb 0x14004d9b7
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14004d89c
mov rax, qword [rbx]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 3
lea r9, [0x140141698]
mov r8, rbx
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.14005aa20
lea r9, [rsp + 0x50]
cmp qword [rsp + 0x68], 0x10
cmovae r9, qword [rsp + 0x50]
xor edi, edi
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
lea r8, str.cmd.exe
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14004d93a
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d935
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d935
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400bd0c8
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], dil
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14004d983
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004d97e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004d9b0
mov rcx, r8
call fcn.1400bd0c8
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1400bcb70
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14004a9e0
nop
int3
Function at 0x14004de00
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xb0
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
mov qword [rsp + 0x90], rcx
call fcn.1400583a0
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
mov dword [rsp + 0x24], 0x40
xor esi, esi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], rsi
lea rax, str.cmd.exe
mov qword [rsp + 0x38], rax
mov rax, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x14004de92
mov rax, qword [rbx]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x50], esi
mov qword [rsp + 0x58], rsi
lea rcx, [rsp + 0x20]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x14004def5
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14004deee
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004dee9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004df9f
mov rcx, r8
call fcn.1400bd0c8
mov eax, 0xffffffff
jmp 0x14004df6b
mov edx, 0xffffffff
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea rdx, [rsp + 0x98]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [rsp + 0x98]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14004df69
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14004df64
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004df9f
mov rcx, r8
call fcn.1400bd0c8
mov eax, edi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400bcb70
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14004dfb0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
xor edx, edx
mov ebx, edi
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14004e045
nop
lea rdx, [0x1401416b8]
lea rcx, [rsp + 0x4c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
jne 0x14004e033
mov eax, dword [rsp + 0x3c]
cmp eax, ebx
jle 0x14004e033
mov edi, dword [rsp + 0x28]
mov ebx, eax
lea rdx, [rsp + 0x20]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14004e010
mov eax, edi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400bcb70
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1400501f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov rax, qword gs:[0x58]
mov rbx, qword [rax]
mov eax, reloc.WS2_32.dll_recv
xor ebp, ebp
mov eax, dword [rax + rbx]
cmp dword [0x140a473e4], eax
jle 0x14005028b
lea rcx, [0x140a473e4]
call fcn.1400bcd18
cmp dword [0x140a473e4], 0xffffffff
jne 0x14005028b
mov qword [0x140a473b0], rbp
mov qword [0x140a473c0], rbp
mov qword [0x140a473c8], 0xf
lea r8d, [rbp + 0x1a]
lea rdx, str.mnpqrABCDFGHJKLMNPQRSTVWXZ
lea rcx, [0x140a473b0]
call fcn.140058ff0
lea rcx, [0x1400bff10]
call fcn.1400bd0b0
nop
lea rcx, [0x140a473e4]
call fcn.1400bccb8
mov esi, 0x13a8
mov eax, dword [rsi + rbx]
mov r15d, reloc.WLDAP32.dll_Ordinal_32
test al, 1
jne 0x1400502fb
or eax, 1
mov dword [rsi + rbx], eax
mov edi, r15d
add rdi, rbx
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rdi + 0x1384], 0xffffffff
mov dword [rdi + 4], eax
mov edx, 1
lea r8, [rdi + 8]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, 0x270
jb 0x1400502d0
mov dword [rdi], 0x270
mov eax, dword [rsi + rbx]
mov edi, Ordinal_26
test al, 2
jne 0x140050319
or eax, 2
mov dword [rsi + rbx], eax
mov dword [rdi + rbx], ebp
mov eax, dword [0x140a473c0]
dec eax
mov dword [rdi + rbx + 4], eax
mov qword [r14], rbp
mov qword [r14 + 0x10], rbp
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], 0
mov edx, reloc.WS2_32.dll_ntohs
mov rcx, r14
call fcn.140058e90
cmp qword [r14 + 0x18], 0x10
jb 0x14005034b
mov rcx, qword [r14]
mov rdx, rcx
mov r12, rcx
jmp 0x140050354
mov r12, r14
mov rdx, r14
mov rcx, r14
mov r13, qword [r14 + 0x10]
add r13, rdx
cmp rcx, r13
je 0x140050441
mov ebp, edi
add rbp, rbx
mov esi, r15d
add rsi, rbx
mov r8d, 0x80000000
nop word [rax + rax]
mov ebx, dword [rbp + 4]
mov ecx, dword [rbp]
lea eax, [rcx - 0x80000000]
lea r15d, [rcx + r8]
cmp ecx, r8d
cmovae r15d, eax
cmp ebx, r8d
jae 0x1400503a1
add ebx, r8d
jmp 0x1400503a7
add ebx, 0x80000000
sub ebx, r15d
cmp ebx, 0xffffffff
jne 0x1400503bb
mov rcx, rsi
call fcn.14005adf0
mov edx, eax
jmp 0x1400503f9
lea edi, [rbx + 1]
nop
xor r8d, r8d
xor eax, eax
test ebx, ebx
je 0x1400503d9
mov rcx, rsi
call fcn.14005adf0
mov r8d, eax
mov eax, 0xffffffff
xor edx, edx
div edi
mov r9d, edx
mov ecx, eax
xor edx, edx
mov eax, r8d
div edi
cmp eax, ecx
jb 0x1400503f2
cmp r9d, ebx
jne 0x1400503c0
xor edx, edx
mov eax, r8d
div edi
lea ecx, [r15 + rdx]
lea eax, [rcx - 0x80000000]
mov r8d, 0x80000000
lea edx, [rcx + r8]
cmp ecx, r8d
cmovae edx, eax
lea rcx, [0x140a473b0]
cmp qword [0x140a473c8], 0x10
cmovae rcx, qword [0x140a473b0]
movsxd rax, edx
movzx ecx, byte [rax + rcx]
mov byte [r12], cl
inc r12
cmp r12, r13
jne 0x140050380
mov rax, r14
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140052d10
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rsp + 0x48], rax
movss xmm0, dword [0x1407a9258]
movss dword [rsp + 0x38], xmm0
call fcn.14005afa0
mov rcx, qword [0x140a0f510]
lea r8, [rsp + 0x30]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov edx, 0xe0c36e0
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov ebx, dword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov rcx, qword [0x140a0f510]
mov r9d, 0x40
add ebx, 0x5bcc908
mov qword [rsp + 0x20], rax
mov edx, ebx
lea r8d, [r9 - 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [0x140a0f510]
lea r8, [rsp + 0x38]
mov r9d, 4
mov qword [rsp + 0x20], 0
mov edx, ebx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov rcx, qword [0x140a0f510]
lea rax, [rsp + 0x40]
mov r9d, 2
mov qword [rsp + 0x20], rax
mov edx, ebx
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1400bcb70
add rsp, 0x50
pop rbx
ret

Function at 0x140052df0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x140052eb6
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140052eb6
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140052ead
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x140052e71
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140052e93
inc rax
test ecx, ecx
jne 0x140052e80
mov rcx, rdi
test edx, edx
je 0x140052f26
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140052e64
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140052ef0
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140052eeb
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140052f6d
mov rcx, r8
call fcn.1400bd0c8
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400bcb70
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
je 0x140052eb6
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140052f69
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140052f64
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140052f6d
mov rcx, r8
call fcn.1400bd0c8
mov al, 1
jmp 0x140052ef2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140057930
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je case.default.0x140057960
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
mov rsi, rbx
mov r9, qword [rax]
test r9, r9
je 0x140057988
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x14005798a
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400579e3
test ecx, ecx
jle 0x1400579c3
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
sub rbx, rbp
add r14, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400579e3
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400579e3
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x30]
sub rsi, rbx
mov rbx, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
call 0x140218611
mov ch, byte [rsp + 0xf]
shr ch, 7
test dword [rsp + 0x17], 0x80
je 0x1402185d2
fld xword [0x140a516d2]
test ch, cl
je 0x1402185c8
fchs
mov eax, 2
jmp 0x1402184c5
fldz
test ch, cl
Function at 0x140057a10
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140057a32
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140057a41
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140057a64
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140057a66
xor ecx, ecx
mov qword [rsp + 0x20], rdi
movsxd rax, ecx
test ecx, ecx
je 0x140057aa0
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
sub rbx, rdi
add r14, rdi
mov r8, rbx
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140057b47
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x140057adb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov rdi, r8
cmp r8, 0xfff
jbe 0x140057b21
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x140057b60
cmp rbx, rax
ja 0x140057af0
mov r8, rdi
test rdi, rdi
je 0x140057b47
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov r8, rdi
sub r8, rax
sub rbp, r8
mov rdi, qword [rsp + 0x20]
mov rax, rbp
mov rbx, qword [rsp + 0x28]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rbp, rbx
jmp 0x140057b4a
and al, 0xdd
pop rsp
and al, 8
Function at 0x140057f70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140159080]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140057f9d
xor eax, eax
jmp 0x1400580f2
mov rdx, qword [rcx + 0x40]
mov rax, qword [rdx]
test rax, rax
je 0x140057fc8
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
add r8, rax
cmp rax, r8
jae 0x140057fc8
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], dil
mov eax, edi
jmp 0x1400580f2
cmp qword [rcx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400580e5
mov r8, qword [rcx + 0x18]
lea rax, [rcx + 0x70]
cmp qword [r8], rax
jne 0x14005800b
mov rdx, qword [rcx + 0x90]
mov rcx, qword [rcx + 0x88]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140058036
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400580ea
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400580a5
sub eax, 1
je 0x1400580a5
cmp eax, 2
jne 0x1400580e5
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400580ea
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400580d3
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400580e5
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov eax, edi
jne 0x1400580ea
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400bcb70
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret