joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180017cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xa0
mov rbx, qword [0x18007f050]
mov eax, dword [rbx + 8]
test al, 2
je 0x180017ce6
test byte [rbx + 0xc], 1
je 0x180017ce6
mov dil, 1
jmp 0x180017ce9
xor dil, dil
test byte [rbx + 8], 1
je 0x180017d05
xor r8d, r8d
mov edx, 0xffffffff
mov ecx, 0x20e
call fcn.180011c60
test al, al
jne 0x180017d28
test dil, dil
je 0x180017f49
xor r8d, r8d
mov edx, 0xffffffff
mov ecx, 0x26c
call fcn.180011c60
test al, al
je 0x180017f49
test byte [rbx + 0x5bf4], 8
je 0x180017d5c
movdqa xmm0, xmmword [0x1800726c0]
lea rcx, [rsp + 0x31]
movdqa xmm1, xmmword [str.CancelRequest___nquestForward__d_n_t]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x50], 0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.18001a790
cmp dword [rbx + 0x3eec], 0
je 0x180017d7e
xor edx, edx
xor ecx, ecx
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
jmp fcn.180007290
cmp dword [rbx + 0x48a4], 0
je 0x180017db6
xor ecx, ecx
call fcn.180015b50
mov rax, qword [0x18007f050]
mov word [rax + 0x48a9], 1
mov byte [rax + 0x48ab], 1
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
ret
mov rdi, qword [rbx + 0x4868]
mov qword [rsp + 0xb8], rsi
test rdi, rdi
je 0x180017ee9
cmp rdi, qword [rdi + 0x358]
je 0x180017ee9
test dword [rdi + 0xc], 0x4000000
jne 0x180017ee9
mov rsi, qword [rdi + 0x348]
test rsi, rsi
je 0x180017ee9
movaps xmmword [rsp + 0x90], xmm6
mov rcx, rsi
movss xmm6, dword [rdi + 0x18]
movaps xmmword [rsp + 0x80], xmm7
movss xmm7, dword [rdi + 0x1c]
movaps xmmword [rsp + 0x70], xmm8
movss xmm8, dword [rdi + 0x20]
movaps xmmword [rsp + 0x60], xmm9
movss xmm9, dword [rdi + 0x24]
call fcn.180011000
movss xmm0, dword [rsi + 0xf0]
addss xmm8, xmm6
movss xmm1, dword [rsi + 0xf4]
addss xmm9, xmm7
mov rdx, qword [0x18007f050]
xor eax, eax
mov ecx, dword [rdi + 0x60]
movaps xmm3, xmm6
movaps xmm6, xmmword [rsp + 0x90]
subss xmm3, xmm0
movaps xmm2, xmm7
subss xmm8, xmm0
movaps xmm7, xmmword [rsp + 0x80]
subss xmm9, xmm1
mov dword [rdx + 0x48a4], eax
subss xmm2, xmm1
mov dword [rdx + 0x4874], eax
mov rax, qword [rdx + 0x4868]
shufps xmm3, xmm3, 0xe1
mov dword [rdx + 0x4870], ecx
movss xmm3, xmm2
shufps xmm3, xmm3, 0xc6
movss xmm3, xmm8
mov dword [rax + 0x380], ecx
mov rax, qword [rdx + 0x4868]
movaps xmm8, xmmword [rsp + 0x70]
shufps xmm3, xmm3, 0x27
movss xmm3, xmm9
movaps xmm9, xmmword [rsp + 0x60]
shufps xmm3, xmm3, 0x39
movups xmmword [rax + 0x388], xmm3
mov word [rdx + 0x48a9], 1
mov byte [rdx + 0x48ab], 1
jmp 0x180017f41
movsxd rdx, dword [rbx + 0x4830]
test edx, edx
jle 0x180017f1f
mov rax, qword [rbx + 0x4838]
imul rcx, rdx, 0x38
mov r8, qword [rcx + rax - 0x30]
test r8, r8
je 0x180017f1f
test dword [r8 + 0xc], 0x8000000
jne 0x180017f1f
lea ecx, [rdx - 1]
mov dl, 1
call fcn.180014050
jmp 0x180017f41
xor eax, eax
test rdi, rdi
je 0x180017f3b
mov ecx, dword [rdi + 0xc]
bt ecx, 0x1a
jb 0x180017f35
bt ecx, 0x18
jb 0x180017f3b
mov dword [rdi + 0x380], eax
mov dword [rbx + 0x4870], eax
mov rsi, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop rdi
ret
Function at 0x180019390
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5bb8], 0
lea rbx, [rcx + 0x5bc0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180019437
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x1800193ea
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18001ba80
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.180004f30
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5bb8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5bc8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x18007f048]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x18001943f
mov rcx, rbx
call fcn.180004f30
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800199c0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x18007f050]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x180019a23
mov qword [rsp], rbx
lea rbx, [0x180070510]
nop dword [rax]
cmp r9b, 0x23
jne 0x180019a03
cmp byte [r8], r9b
jne 0x180019a03
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800199f0
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5b68]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x180019a57
mov r10, qword [r10 + 0x5b70]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x180019a5e
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x180019a44
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x18001a880
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
lea rbp, [rax - 0x5f]
sub rsp, 0xa8
mov rbx, qword [0x18007f050]
lea r8, [rbp - 0x38]
movaps xmmword [rax - 0x38], xmm6
xor esi, esi
movaps xmmword [rax - 0x48], xmm7
mov dword [rbp - 0x39], 0x4623235f
movups xmm7, xmmword [rbx + 0x4724]
mov dword [rbx + 0x470c], esi
lea edx, [rsi + 1]
mov rax, qword [rbx + 0x4860]
movups xmm6, xmmword [rbx + 0x4734]
mov dword [rbp - 0x35], 0x6765726f
mov dword [rbp - 0x31], 0x6e756f72
mov rcx, qword [rax]
mov word [rbp - 0x2d], 0x64
call fcn.180007750
movss xmm0, dword [0x1800720ac]
movaps xmm1, xmm6
shufps xmm1, xmm6, 0x55
movaps xmm3, xmm6
subss xmm3, xmm0
shufps xmm6, xmm6, 0xaa
shufps xmm7, xmm7, 0xff
addss xmm6, xmm0
subss xmm7, xmm0
mov rdi, rax
addss xmm1, xmm0
movsd xmm0, qword [rbx + 0xdfc]
movaps xmm4, xmm0
movsd qword [rbp + 0x7f], xmm0
shufps xmm4, xmm4, 0x55
comiss xmm3, xmm4
jbe 0x18001a933
movaps xmm2, xmm3
jmp 0x18001a93a
movaps xmm2, xmm6
minss xmm2, xmm4
movss xmm4, dword [rbp + 0x7f]
comiss xmm7, xmm4
jbe 0x18001a949
movaps xmm0, xmm7
jmp 0x18001a950
movaps xmm0, xmm1
minss xmm0, xmm4
test byte [rax + 0x30], 1
lea r8, [rbp + 0x67]
movss dword [rbp + 0x77], xmm0
lea rdx, [rbp + 0x6f]
movss xmm0, dword [0x18007203c]
mov rcx, rdi
addss xmm3, xmm0
movss dword [rbp + 0x7b], xmm2
addss xmm7, xmm0
mov dword [rsp + 0x20], esi
movss dword [rbp + 0x73], xmm3
xorps xmm3, xmm3
movss dword [rbp + 0x6f], xmm7
je 0x18001a996
subss xmm1, xmm0
subss xmm6, xmm0
jmp 0x18001a9a6
subss xmm1, dword [0x180072038]
subss xmm6, dword [0x180072038]
movss dword [rbp + 0x67], xmm1
movss dword [rbp + 0x6b], xmm6
call fcn.1800260d0
movss xmm6, dword [0x180072070]
mov r9d, 0xff00ff00
mov r8d, dword [rdi + 0x78]
mov rcx, rdi
mov rdx, qword [rdi + 0x80]
movss dword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], 1
call fcn.180024240
mov r9d, 0xff00ff00
movss dword [rsp + 0x20], xmm6
lea r8, [rbp + 0x77]
mov dword [rdi + 0x78], esi
lea rdx, [rbp + 0x7f]
mov rcx, rdi
call fcn.180026640
movaps xmm6, xmmword [rsp + 0x90]
movaps xmm7, xmmword [rsp + 0x80]
add rsp, 0xa8
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18001adf0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov qword [r11 + 0x20], r9
push rbp
push rdi
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0xb0
mov rdi, qword [0x18007f050]
mov esi, edx
mov r15d, ecx
movsxd rax, dword [rdi + 0x5c3c]
mov rbx, qword [rdi + 0x3ea0]
cmp eax, 0xffffffff
jne 0x18001af4b
inc eax
mov qword [r11 + 8], r14
mov dword [rdi + 0x5c3c], eax
xor eax, eax
mov esi, dword [rbx + 0xd0]
mov ecx, dword [rdi + 0x5c4c]
inc esi
movaps xmmword [r11 - 0x28], xmm6
xorps xmm6, xmm6
mov qword [rbp + 0x27], rax
cmp esi, ecx
jle 0x18001ae84
test ecx, ecx
je 0x18001ae6c
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x18001ae71
mov eax, 8
cmp eax, esi
lea rcx, [rdi + 0x5c48]
mov edx, esi
cmovg edx, eax
call fcn.18001be10
movsxd rax, dword [rdi + 0x5c48]
cmp esi, eax
jle 0x18001aedb
movsxd rcx, esi
cmp rax, rcx
jge 0x18001aedb
movsd xmm1, qword [rbp + 0x27]
lea rdx, [rax + rax*8]
shl rdx, 3
sub rcx, rax
nop word [rax + rax]
mov rax, qword [rdi + 0x5c50]
lea rdx, [rdx + 0x48]
movups xmmword [rdx + rax - 0x48], xmm6
movups xmmword [rdx + rax - 0x38], xmm6
movups xmmword [rdx + rax - 0x28], xmm6
movups xmmword [rdx + rax - 0x18], xmm6
movsd qword [rdx + rax - 8], xmm1
sub rcx, 1
jne 0x18001aeb0
movaps xmm6, xmmword [rsp + 0xa0]
xor ecx, ecx
mov r14, qword [rsp + 0xd0]
mov dword [rdi + 0x5c48], esi
mov edx, dword [rbx + 0xd0]
lea eax, [rdx + 1]
test eax, eax
jle 0x18001b04d
mov r9d, ecx
mov r8d, ecx
nop word [rax + rax]
cmp ecx, edx
jge 0x18001af21
mov rax, qword [rbx + 0xd8]
mov edx, dword [r8 + rax]
jmp 0x18001af24
mov edx, r15d
mov rax, qword [rdi + 0x5c50]
inc ecx
add r8, 4
mov dword [r9 + rax], edx
add r9, 0x48
mov edx, dword [rbx + 0xd0]
lea eax, [rdx + 1]
cmp ecx, eax
jl 0x18001af10
jmp 0x18001b04d
cmp eax, dword [rbx + 0xd0]
jne 0x18001b04d
lea rcx, [rax + rax*8]
mov rax, qword [rdi + 0x5c50]
lea rbx, [rax + rcx*8]
mov ecx, esi
sub ecx, 4
je 0x18001b026
sub ecx, 7
je 0x18001afe5
sub ecx, 1
je 0x18001afb5
cmp ecx, 1
jne 0x18001b045
cmp byte [rbx + 0xc], 0
lea rcx, [rbx + 0xc]
jne 0x18001b04d
movdqa xmm0, xmmword [0x180072680]
lea r8, [rbp - 0x38]
movdqu xmmword [rbp - 0x39], xmm0
mov word [rbp - 0x29], 0x5d65
mov r9d, r15d
mov byte [rbp - 0x27], 0
jmp 0x18001b03b
mov r9, r8
mov dword [rbp - 0x39], 0x6f76283c
lea r8, [rbp - 0x38]
mov dword [rbp - 0x35], 0x292a6469
lea rcx, [rbx + 0xc]
mov dword [rbp - 0x31], 0x70257830
mov edx, 0x39
mov byte [rbp - 0x2d], 0
call fcn.1800046d0
jmp 0x18001b045
mov r9, 0xffffffffffffffff
nop dword [rax]
inc r9
cmp byte [r8 + r9], 0
jne 0x18001aff0
mov qword [rsp + 0x20], r8
lea rcx, [rbx + 0xc]
lea r8, [rbp + 0x80]
mov dword [rbp + 0x7f], 0x2a2e257a
mov edx, 0x39
mov word [rbp + 0x83], 0x73
call fcn.1800046d0
jmp 0x18001b045
mov r9d, r8d
mov dword [rbp + 0x7f], 0x642547
lea r8, [rbp + 0x80]
lea rcx, [rbx + 0xc]
mov edx, 0x39
call fcn.1800046d0
mov byte [rbx + 5], 1
mov byte [rbx + 8], sil
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x180047420
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x20
mov ecx, 0x210
call fcn.1800118e0
cmp byte [rax], 0
je 0x18004748f
xor edx, edx
mov ecx, 0x210
call fcn.1800126e0
test al, al
je 0x18004748f
mov ecx, 0xa0
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18004748f
mov rbx, qword [0x18007f050]
cmp byte [rbx + 0x37a9], 0
je 0x18004747b
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x210
call fcn.180004210
mov dword [rbx + 0x380], 0x210
mov dword [rbx + 0x940], 0xa0
mov ecx, 0x214
call fcn.1800118e0
cmp byte [rax], 0
je 0x1800474f8
xor edx, edx
mov ecx, 0x214
call fcn.1800126e0
test al, al
je 0x1800474f8
mov ecx, 0xa1
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1800474f8
mov rbx, qword [0x18007f050]
cmp byte [rbx + 0x37a9], 0
je 0x1800474e4
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x214
call fcn.180004210
mov dword [rbx + 0x384], 0x214
mov dword [rbx + 0x950], 0xa1
mov ecx, 0x212
call fcn.1800118e0
cmp byte [rax], 0
je 0x18004755f
xor edx, edx
mov ecx, 0x212
call fcn.1800126e0
test al, al
je 0x18004755f
lea ecx, [rdx + 0x5b]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x18004755f
mov rbx, qword [0x18007f050]
cmp byte [rbx + 0x37a9], 0
je 0x18004754b
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x212
call fcn.180004210
mov dword [rbx + 0x26c], 0x212
mov dword [rbx + 0x948], 0x5b
mov ecx, 0x216
call fcn.1800118e0
cmp byte [rax], 0
je 0x1800475c6
xor edx, edx
mov ecx, 0x216
call fcn.1800126e0
test al, al
je 0x1800475c6
lea ecx, [rdx + 0x5c]
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
jne 0x1800475c6
mov rbx, qword [0x18007f050]
cmp byte [rbx + 0x37a9], 0
je 0x1800475b2
xorps xmm3, xmm3
lea rcx, [rbx + 8]
xor r8d, r8d
mov edx, 0x216
call fcn.180004210
mov dword [rbx + 0x270], 0x216
mov dword [rbx + 0x958], 0x5c
add rsp, 0x20
pop rbx
ret
Function at 0x180048c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov rax, qword [0x18007e010]
xor rax, rsp
mov qword [rbp + 0x70], rax
cmp qword [0x18007f380], 0
jne 0x180048cf2
lea rcx, [rsp + 0x21]
mov dword [rsp + 0x20], 0x64746e0c
mov dword [rsp + 0x24], 0x642e6c6c
mov word [rsp + 0x28], 0x6c6c
mov byte [rsp + 0x2a], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180048ce6
movdqa xmm0, xmmword [0x1800727d0]
lea rdx, [rsp + 0x31]
mov rcx, rax
mov dword [rsp + 0x40], 0x666e496e
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x44], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18007f380], rax
jmp 0x180048ced
mov rax, qword [0x18007f380]
test rax, rax
je 0x180048d59
xor edx, edx
lea rcx, [rsp + 0x5c]
mov r8d, 0x110
call sub.VCRUNTIME140.dll_memset
mov r8b, 3
mov dword [rsp + 0x50], 0x11c
mov edx, 2
mov dword [rsp + 0x54], 6
xor ecx, ecx
mov dword [rsp + 0x58], 3
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov r8b, 3
mov edx, 1
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov edx, 3
lea rcx, [rsp + 0x50]
mov r8, rax
call qword [0x18007f380]
xor ecx, ecx
test eax, eax
sete cl
mov eax, ecx
mov rcx, qword [rbp + 0x70]
xor rcx, rsp
call fcn.18006ba20
add rsp, 0x180
pop rbp
ret
Function at 0x180058760
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x18007e010]
xor rax, rsp
mov qword [rsp + 0x50], rax
cmp edx, 1
jne 0x1800587e0
lea ecx, [rdx + 7]
call fcn.18006bcdc
lea rcx, [0x180058610]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180059860]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x180058800
cmp dword [rsp + 0x38], 0
je 0x1800587f4
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x1800587f4
mov al, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18006ba20
add rsp, 0x68
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x180058fe0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x18007e010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov ecx, 1
call fcn.18006bcdc
mov qword [rsp + 0x30], rax
lea rdi, [rbx + 8]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180059830]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbx], rax
test rax, rax
je 0x180059053
mov rax, rbx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18006ba20
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rdi], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3

Function at 0x18005a520
Capabilities:
Create thread

Disassembly:
sub rsp, 0x68
mov rax, qword [0x18007e010]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov ecx, 8
call fcn.18006bcdc
lea rcx, [0x18007f04b]
mov qword [rax], rcx
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18005b160]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18005a5bb
cmp dword [rsp + 0x38], 0
je 0x18005a5af
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x18005a5af
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18006ba20
add rsp, 0x68
ret
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x18005c590
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x18007e010]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edi, edi
xor edx, edx
lea ecx, [rdi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x18005c5dc
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Couldnt_get_running_processes._n
call fcn.180059660
xor eax, eax
jmp 0x18005c65a
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x18005c620
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Couldnt_get_info_of_processes._n
call fcn.180059660
xor eax, eax
jmp 0x18005c65a
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x18005c64a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x18005c620
jmp 0x18005c64e
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18006ba20
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x18005ce50
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x18007e010]
xor rax, rsp
mov qword [rsp + 0x68], rax
call fcn.18005c590
mov dword [rsp + 0x38], eax
xor ebp, ebp
mov qword [rsp + 0x40], rbp
lea rdx, [rsp + 0x38]
lea rcx, [0x18005c4e0]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rdi, qword [rsp + 0x40]
lea rdx, [rsp + 0x48]
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowRect]
call fcn.18005c680
mov rbx, rax
lea r9d, [rbp + 2]
mov r8b, 0xff
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movdqa xmm0, xmmword [0x180072180]
movdqu xmmword [rsp + 0x58], xmm0
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.dwmapi.dll_DwmExtendFrameIntoClientArea]
mov rsi, qword [0x18007f050]
test rsi, rsi
je 0x18005cef0
inc dword [rsi + 0xf4]
mov ecx, 0x5d78
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x48], rax
test rax, rax
je 0x18005cf21
xor edx, edx
mov rcx, rax
call fcn.180002ee0
mov rbp, rax
mov qword [0x18007f050], rbp
call fcn.18000a500
test rsi, rsi
je 0x18005cf39
mov qword [0x18007f050], rsi
xor ecx, ecx
call fcn.180022f40
mov rcx, rbx
call fcn.180046fa0
call fcn.180046e10
test rdi, rdi
je 0x18005cf5f
mov rdx, rbx
mov rcx, rdi
call fcn.18005c910
jmp 0x18005cf52
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x180067860
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180067888
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1800678ae
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800678b0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180067909
test ecx, ecx
jle 0x1800678e9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180067909
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180067909
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180067930
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180067952
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180067968
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180067984
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180067986
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800679c2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180067a5e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1800679fd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180067a3e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180067a5e
cmp rbx, rax
ja 0x180067a10
test rbx, rbx
je 0x180067a5e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret