joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000b930
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
cmp qword [rcx + 0x80], 0
je 0x14000b95d
mov rax, qword [rsi + 0x18]
lea rcx, [rsi + 0x70]
cmp qword [rax], rcx
je 0x14000b964
cmp qword [rsi + 0x68], 0
jne 0x14000b98e
jmp 0x14000ba13
xor eax, eax
jmp 0x14000ba2d
mov ecx, dword [rsi + 0x90]
mov rdx, qword [rsi + 0x88]
mov qword [rax], rdx
mov rax, qword [rsi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rsi + 0x50]
mov dword [rax], ecx
cmp qword [rsi + 0x68], 0
je 0x14000ba13
cmp byte [rsi + 0x71], 0
je 0x14000ba13
mov rax, qword [rsi]
mov rcx, rsi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000ba0b
mov rcx, qword [rsi + 0x68]
lea r9, [rsp + 0x50]
lea rdx, [rsi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x28]
mov qword [rsp + 0x20], r8
lea rdi, [rsp + 0x30]
mov r8, rdi
call qword [rax + 0x40]
cmp eax, 3
je 0x14000ba0f
cmp eax, 1
je 0x14000b9de
test eax, eax
jne 0x14000ba0b
mov byte [rsi + 0x71], 0
mov rbx, qword [rsp + 0x28]
sub rbx, rdi
je 0x14000ba05
mov r9, qword [rsi + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x14000ba0b
cmp byte [rsi + 0x71], 0
je 0x14000ba13
xor edi, edi
jmp 0x14000ba16
mov byte [rsi + 0x71], 0
mov rdi, rsi
mov rcx, qword [rsi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, eax
xor eax, eax
test ecx, ecx
cmove rax, rdi
mov byte [rsi + 0x7c], 0
mov byte [rsi + 0x71], 0
lea rcx, [rsi + 8]
mov qword [rsi + 0x18], rcx
lea rcx, [rsi + 0x10]
mov qword [rsi + 0x20], rcx
lea rcx, [rsi + 0x28]
mov qword [rsi + 0x38], rcx
lea rcx, [rsi + 0x30]
mov qword [rsi + 0x40], rcx
lea rcx, [rsi + 0x48]
mov qword [rsi + 0x50], rcx
lea rcx, [rsi + 0x4c]
mov qword [rsi + 0x58], rcx
mov qword [rsi + 0x48], 0
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
movups xmmword [rsi + 0x28], xmm0
mov qword [rsi + 0x80], 0
mov rcx, qword [0x14004496c]
mov qword [rsi + 0x74], rcx
mov qword [rsi + 0x68], 0
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x14000bb90
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x88
cmp edx, 0xffffffff
je 0x14000bc93
mov esi, edx
mov rdi, rcx
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000bbda
mov rdx, qword [rdi + 0x58]
mov r8d, dword [rdx]
test r8d, r8d
jle 0x14000bbda
dec r8d
mov dword [rdx], r8d
lea rdx, [rcx + 1]
mov qword [rax], rdx
mov byte [rcx], sil
jmp 0x14000bd04
cmp qword [rdi + 0x80], 0
je 0x14000bc97
mov rax, qword [rdi + 0x18]
lea rcx, [rdi + 0x70]
cmp qword [rax], rcx
je 0x14000bc9e
mov rcx, qword [rdi + 0x68]
test rcx, rcx
je 0x14000bcca
mov byte [rsp + 0x4f], sil
lea rax, [rsp + 0x80]
lea r9, [rsp + 0x50]
lea rdx, [rdi + 0x74]
mov r10, qword [rcx]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rax
lea r14, [rsp + 0x60]
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x58]
mov qword [rsp + 0x20], rax
lea rbx, [rsp + 0x4f]
mov r8, rbx
call qword [r10 + 0x38]
mov ebp, 0xffffffff
cmp eax, 2
jae 0x14000bce3
mov r15, qword [rsp + 0x50]
sub r15, r14
je 0x14000bc83
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x14000bd02
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x58], rbx
mov eax, 0xffffffff
jmp 0x14000bcfd
xor esi, esi
jmp 0x14000bd04
mov esi, 0xffffffff
jmp 0x14000bd04
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x14000bc06
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
jmp 0x14000bd04
cmp eax, 3
jne 0x14000bd02
mov rdx, qword [rdi + 0x80]
movsx ecx, byte [rsp + 0x4f]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
cmp eax, 0xffffffff
cmove esi, eax
mov ebp, esi
mov esi, ebp
mov eax, esi
add rsp, 0x88
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000c1b0
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x14000c1eb
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14000c1f2
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
xor esi, esi
jmp 0x14000c2e9
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x14000c245
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x14000c245
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x14000c256
jmp 0x14000c2e6
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x14000c2e6
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x14000c282
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
mov r15, qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
nop dword [rax]
cmp r14, 0x1000
jb 0x14000c2c1
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call r15
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x14000c290
jmp 0x14000c2e6
test r14, r14
je 0x14000c2e3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub r14, rax
jmp 0x14000c2e6
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret

Function at 0x14000c300
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x14000c336
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rbx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x14000c383
test rsi, rsi
jle 0x14000c383
mov rax, qword [rbx + 0x58]
mov r15d, dword [rax]
test r15d, r15d
jle 0x14000c383
cmp r15, rsi
cmovae r15, rsi
mov rdx, rdi
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x58]
sub dword [rax], r15d
mov rax, qword [rbx + 0x40]
add qword [rax], r15
test r14, r14
jg 0x14000c38b
jmp 0x14000c3ab
mov r14, rsi
test r14, r14
jle 0x14000c3ab
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x14000c3ab
mov edx, 1
mov rcx, rdi
mov r8, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub r14, rax
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x14000c3c0
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rsi, rdx
mov rax, qword [rcx + 0x38]
lea r13, [rcx + 0x70]
cmp qword [rax], r13
mov rax, qword [rcx + 0x68]
sete bpl
cmp r9d, 1
sete r15b
test rax, rax
sete r12b
cmp qword [rcx + 0x80], 0
je 0x14000c4ea
mov ebx, r9d
mov r14, r8
mov rdi, rcx
test rax, rax
je 0x14000c4a6
cmp byte [rdi + 0x71], 0
je 0x14000c4a6
mov rax, qword [rdi]
mov rcx, rdi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000c4ea
mov rcx, qword [rdi + 0x68]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rsp + 0x40]
call qword [rax + 0x40]
cmp eax, 3
je 0x14000c4a2
cmp eax, 1
lea rcx, [rsp + 0x40]
je 0x14000c46f
test eax, eax
jne 0x14000c4ea
mov byte [rdi + 0x71], 0
mov rax, qword [rsp + 0x38]
sub rax, rcx
je 0x14000c49a
mov r9, qword [rdi + 0x80]
mov edx, 1
mov r8, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp qword [rsp + 0x30], rax
jne 0x14000c4ea
cmp byte [rdi + 0x71], 0
jne 0x14000c4ea
jmp 0x14000c4a6
mov byte [rdi + 0x71], 0
and r15b, r12b
and r15b, bpl
movzx eax, r15b
sub r14, rax
cmp ebx, 1
jne 0x14000c4bd
test r14, r14
je 0x14000c4d4
mov rcx, qword [rdi + 0x80]
mov rdx, r14
mov r8d, ebx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__fseeki64]
test eax, eax
jne 0x14000c4ea
mov rcx, qword [rdi + 0x80]
lea rdx, [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fgetpos]
test eax, eax
je 0x14000c50c
mov qword [rsi], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x68
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rdi + 0x18]
cmp qword [rax], r13
jne 0x14000c534
mov ecx, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rax], rdx
mov rax, qword [rdi + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rdi + 0x50]
mov dword [rax], ecx
mov rax, qword [rdi + 0x74]
mov rcx, qword [rsp + 0x40]
mov qword [rsi], rcx
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], rax
jmp 0x14000c4f8
Function at 0x14000c550
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rax, qword [r8 + 8]
add rax, qword [r8]
mov qword [rsp + 0x30], rax
cmp qword [rcx + 0x80], 0
je 0x14000c62a
mov rbx, r8
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x14000c614
cmp byte [rdi + 0x71], 0
je 0x14000c614
mov rax, qword [rdi]
mov rcx, rdi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000c62a
mov rcx, qword [rdi + 0x68]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], r8
lea r14, [rsp + 0x40]
mov r8, r14
call qword [rax + 0x40]
cmp eax, 3
je 0x14000c610
cmp eax, 1
je 0x14000c5e1
test eax, eax
jne 0x14000c62a
mov byte [rdi + 0x71], 0
mov r15, qword [rsp + 0x38]
sub r15, r14
je 0x14000c608
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x14000c62a
cmp byte [rdi + 0x71], 0
jne 0x14000c62a
jmp 0x14000c614
mov byte [rdi + 0x71], 0
mov rcx, qword [rdi + 0x80]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fsetpos]
test eax, eax
je 0x14000c647
mov qword [rsi], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x74], rax
mov rcx, qword [rdi + 0x18]
lea rdx, [rdi + 0x70]
cmp qword [rcx], rdx
jne 0x14000c67f
mov eax, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rcx], rdx
mov rcx, qword [rdi + 0x38]
mov qword [rcx], rdx
sub eax, edx
mov rcx, qword [rdi + 0x50]
mov dword [rcx], eax
mov rax, qword [rdi + 0x74]
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], rax
jmp 0x14000c638
Function at 0x140011e90
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], 0xfffffffffffffffe
lea r8, [rdx + 0xfff]
and r8, 0xfffffffffffff000
mov qword [rbp - 0x20], rcx
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x140011f35
mov rdi, qword [rbp - 0x20]
mov rax, qword [rdi + 0x20]
cmp rax, 0x10
jb 0x140011f16
mov rcx, qword [rdi + 8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140011f11
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140011f78
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.1400311b8
mov qword [rdi + 0x18], 0
mov qword [rdi + 0x20], 0xf
mov byte [rdi + 8], 0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x14], eax
lea rcx, str._panic__Allocation_failed:_:x_n
lea rdx, [rbp - 0x14]
call fcn.140013900
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x140011f7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400143e0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
movaps xmmword [rsp + 0x1d0], xmm6
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov r12d, 0x10000
lea r8, [rsp + 0x30]
mov edx, 0x10000
mov r9d, 0x30
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x1400145ff
xor r14d, r14d
lea r15, [rsp + 0x60]
lea rbp, [rsp + 0x30]
jmp 0x140014480
mov ecx, 0x57
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x30]
mov r13, qword [rsp + 0x48]
add r13, rax
mov r9d, 0x30
mov rcx, rbx
mov rdx, r13
mov r8, rbp
call sub.KERNEL32.dll_VirtualQueryEx
mov r12, r13
test rax, rax
je 0x1400145ca
mov r13, qword [rsp + 0x48]
mov eax, r13d
not eax
shl rax, 0x34
je 0x1400145ca
mov rax, qword [rsp + 0x30]
lea rcx, [rax + r13]
cmp rcx, r12
jb 0x1400145ca
cmp dword [rsp + 0x50], 0x1000
jne 0x14001445d
mov ecx, dword [rsp + 0x54]
cmp cl, 1
je 0x14001445d
and ecx, 0x100
jne 0x14001445d
test r12, r12
je 0x140014449
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov r9d, 0x30
mov rcx, rbx
mov rdx, r12
mov r8, r15
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140014453
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, rbx
mov rdx, r12
lea r8, [rsp + 0x98]
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140014453
movzx eax, word [rsp + 0x98]
cmp eax, 0x5a4d
jne 0x14001457c
mov eax, dword [rsp + 0xd4]
cmp rax, 0x40
jb 0x14001457c
cmp qword [rsp + 0x78], rax
jb 0x14001457c
movsxd rdx, eax
add rdx, r12
mov qword [rsp + 0x20], 0
mov r9d, 0xf8
mov rcx, rbx
lea r8, [rsp + 0xd8]
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140014453
cmp dword [rsp + 0xd8], 0x4550
je 0x140014586
mov ecx, 0xc1
jmp 0x14001444e
movzx eax, word [rsp + 0xee]
test eax, 0x2000
cmove r14, r12
add r12, 0x10000
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov r9d, 0x30
mov rcx, rbx
mov rdx, r12
mov r8, rbp
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
jne 0x140014480
test r14, r14
je 0x1400145ff
lea rdx, [rsp + 0xd8]
mov rcx, rbx
call sub.KERNEL32.dll_IsWow64Process
test eax, eax
je 0x140014609
mov r8d, dword [rsp + 0xd8]
mov dword [rsp + 0x20], edi
mov rcx, rbx
mov rdx, r14
mov r9, rsi
call fcn.140014630
jmp 0x14001460b
mov ecx, 0x10dd
call sub.KERNEL32.dll_SetLastError
xor eax, eax
movaps xmm6, xmmword [rsp + 0x1d0]
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140015330
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
test rdx, rdx
je 0x1400153f7
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov r9d, 0x30
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140015401
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x68]
mov r9d, 0x40
mov rcx, rbx
mov rdx, rdi
call sub.KERNEL32.dll_ReadProcessMemory
xor ebp, ebp
test eax, eax
je 0x140015403
movzx eax, word [rsp + 0x68]
cmp eax, 0x5a4d
jne 0x1400153f0
mov eax, dword [rsp + 0xa4]
cmp rax, 0x40
jb 0x1400153f0
cmp qword [rsp + 0x48], rax
jb 0x1400153f0
cdqe
add rdi, rax
mov qword [rsp + 0x20], 0
mov r9d, 0xf8
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140015403
mov ebp, 1
cmp dword [rsi], 0x4550
je 0x140015403
mov ecx, 0xc1
jmp 0x1400153fc
mov ecx, 0x57
call sub.KERNEL32.dll_SetLastError
xor ebp, ebp
mov eax, ebp
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140015590
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1f8
mov ebx, r9d
mov rsi, r8
mov r12, rdx
mov rdi, rcx
lea r8d, [rbx + 0x1c8]
mov dword [rsp + 0x20], 4
xor r14d, r14d
xor edx, edx
mov r9d, 0x1000
call sub.KERNEL32.dll_VirtualAllocEx
test rax, rax
je 0x140015808
mov r15, rax
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb2], xmm0
movups xmmword [rsp + 0xc2], xmm0
movups xmmword [rsp + 0xd2], xmm0
movups xmmword [rsp + 0xdc], xmm0
mov word [rsp + 0xb0], 0x5a4d
mov dword [rsp + 0xec], 0x40
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xb0]
mov r9d, 0x40
mov rcx, rdi
mov rdx, rax
call sub.KERNEL32.dll_WriteProcessMemory
xor r14d, r14d
test eax, eax
je 0x140015808
cmp qword [rsp + 0x28], 0x40
jne 0x140015808
lea r13, [r15 + 0x40]
lea rcx, [rsp + 0xf4]
xor r14d, r14d
mov r8d, 0x104
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0xf0], 0x4550
mov dword [rsp + 0x104], 0x200000f0
mov word [rsp + 0xf6], 1
mov word [rsp + 0x108], 0x20b
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xf0]
mov r9d, 0x108
mov rcx, rdi
mov rdx, r13
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140015808
cmp qword [rsp + 0x28], 0x108
jne 0x140015808
lea rdx, [r15 + 0x148]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movabs rax, 0x72756f7465642e
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], 0x170
lea r13d, [rbx + 0x58]
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x48]
mov r9d, 0x28
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140015808
cmp qword [rsp + 0x28], 0x28
jne 0x140015808
lea rdx, [r15 + 0x170]
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movabs rax, 0x72744400000040
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x40
mov dword [rsp + 0x7c], r13d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x70]
mov r9d, 0x40
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140015808
cmp qword [rsp + 0x28], 0x40
jne 0x140015808
lea rdx, [r15 + 0x1b0]
lea eax, [rbx + 0x18]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x30]
mov r9d, 0x18
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140015808
cmp qword [rsp + 0x28], 0x18
jne 0x140015808
mov ebx, ebx
add r15, 0x1c8
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rdx, r15
mov r8, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
setne al
cmp qword [rsp + 0x28], rbx
sete cl
and cl, al
movzx r14d, cl
mov eax, r14d
add rsp, 0x1f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140016920
Capabilities:
Resume thread
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xe0]
mov r11, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xd0]
mov ebp, dword [rsp + 0xc8]
mov eax, dword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
test rbx, rbx
lea rsi, [0x1400328c0]
cmovne rsi, rbx
test r14, r14
jne 0x140016989
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
lea r14, [rsp + 0x50]
mov ebx, ebp
or ebx, 4
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call rsi
test eax, eax
je 0x140016a09
mov rdi, qword [rsp + 0xf8]
mov ebx, dword [rsp + 0xf0]
mov rcx, qword [r14]
mov rdx, rdi
mov r8d, ebx
call fcn.1400143e0
test eax, eax
jne 0x1400169e6
mov ecx, dword [r14 + 0x10]
mov edx, ebx
mov r8, rdi
mov r9, rsi
call fcn.140015b80
test eax, eax
je 0x140016a0d
test bpl, 4
jne 0x1400169f5
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_ResumeThread
mov esi, 1
lea rax, [rsp + 0x50]
cmp r14, rax
mov r14, rax
jne 0x140016a2d
jmp 0x140016a1c
xor esi, esi
jmp 0x140016a2d
mov rcx, qword [r14]
mov edx, 0xffffffff
call sub.KERNEL32.dll_TerminateProcess
xor esi, esi
mov rcx, qword [r14]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140016e90
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov rax, rcx
mov qword [rbp - 0x48], 0
lea rcx, vtable.fmt::v7::basic_memory_buffer_char__500__class_std::allocator_char__.0
mov qword [rbp - 0x58], rcx
lea rsi, [rbp - 0x38]
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], 0x1f4
movups xmm0, xmmword [r8]
movaps xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp - 0x58]
lea r8, [rbp + 0x1c0]
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov r8d, 1
mov r9, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov rcx, qword [rbp - 0x50]
cmp rcx, rsi
je 0x140016f58
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x1000
jb 0x140016f53
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x140016f63
add rdx, 0x27
mov rcx, rax
call fcn.1400311b8
nop
add rsp, 0x258
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140019370
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rsi
jae 0x140019437
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [rax]
lea rax, vtable.std::exception.0
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rax, [0x140037968]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 1
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll___std_exception_copy
lea rax, vtable.fmt::v7::system_error.0
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x30], 0
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x48], rax
lea rax, str.cannot_write_to_file
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x14
lea rcx, [rbp - 0x20]
lea r8, [rbp - 0x60]
lea r9, [rbp - 0x50]
mov edx, esi
call fcn.140017050
mov byte [rbp - 0x30], 1
cmp byte [rbp - 0x30], 0
jne 0x140019442
lea rax, vtable.std::exception.0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x18]
call sub.VCRUNTIME140.dll___std_exception_destroy
nop
add rsp, 0x88
pop rsi
pop rbp
ret
lea rsi, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.140020c80
lea rdx, [0x140041490]
mov rcx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3