joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d060
Capabilities:
Write file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x60
mov rsi, rdx
mov rax, qword [r8 + 8]
add rax, qword [r8]
mov qword [rsp + 0x30], rax
cmp qword [rcx + 0x80], 0
je 0x14000d13a
mov rbx, r8
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x14000d124
cmp byte [rdi + 0x71], 0
je 0x14000d124
mov rax, qword [rdi]
mov rcx, rdi
mov edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14000d13a
mov rcx, qword [rdi + 0x68]
lea r9, [rsp + 0x60]
lea rdx, [rdi + 0x74]
mov rax, qword [rcx]
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], r8
lea r14, [rsp + 0x40]
mov r8, r14
call qword [rax + 0x40]
cmp eax, 3
je 0x14000d120
cmp eax, 1
je 0x14000d0f1
test eax, eax
jne 0x14000d13a
mov byte [rdi + 0x71], 0
mov r15, qword [rsp + 0x38]
sub r15, r14
je 0x14000d118
mov r9, qword [rdi + 0x80]
mov edx, 1
mov rcx, r14
mov r8, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp r15, rax
jne 0x14000d13a
cmp byte [rdi + 0x71], 0
jne 0x14000d13a
jmp 0x14000d124
mov byte [rdi + 0x71], 0
mov rcx, qword [rdi + 0x80]
lea rdx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fsetpos]
test eax, eax
je 0x14000d157
mov qword [rsi], 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsi + 8], xmm0
mov rax, rsi
add rsp, 0x60
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
mov rax, qword [rbx + 0x10]
mov qword [rdi + 0x74], rax
mov rcx, qword [rdi + 0x18]
lea rdx, [rdi + 0x70]
cmp qword [rcx], rdx
jne 0x14000d18f
mov eax, dword [rdi + 0x90]
mov rdx, qword [rdi + 0x88]
mov qword [rcx], rdx
mov rcx, qword [rdi + 0x38]
mov qword [rcx], rdx
sub eax, edx
mov rcx, qword [rdi + 0x50]
mov dword [rcx], eax
mov rax, qword [rdi + 0x74]
mov rcx, qword [rsp + 0x30]
mov qword [rsi], rcx
mov qword [rsi + 8], 0
mov qword [rsi + 0x10], rax
jmp 0x14000d148
Function at 0x140012630
Capabilities:
Allocate or change rwx memory
Terminate process

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 0x10], 0xfffffffffffffffe
lea r8, [rdx + 0xfff]
and r8, 0xfffffffffffff000
mov qword [rbp - 0x20], rcx
mov rcx, qword [rcx]
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
test rax, rax
je 0x1400126d5
mov rdi, qword [rbp - 0x20]
mov rax, qword [rdi + 0x20]
cmp rax, 0x10
jb 0x1400126b6
mov rcx, qword [rdi + 8]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400126b1
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140012718
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140031ab8
mov qword [rdi + 0x18], 0
mov qword [rdi + 0x20], 0xf
mov byte [rdi + 8], 0
mov rax, rsi
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp - 0x14], eax
lea rcx, str._panic__Allocation_failed:_:x_n
lea rdx, [rbp - 0x14]
call fcn.140014290
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
jmp 0x14001271e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x1400131f0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x2178
call fcn.140031c20
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x20e0], xmm6
mov qword [rbp + 0x20d8], 0xfffffffffffffffe
mov rsi, rdx
mov r8d, ecx
xor ebx, ebx
mov ecx, 0x410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
je 0x140013455
mov rdi, rax
lea rdx, [rbp - 0x60]
lea r9, [rbp + 0x20d4]
mov rcx, rax
mov r8d, 0x2000
call sub.KERNEL32.dll_K32EnumProcessModules
xor ebx, ebx
test eax, eax
je 0x140013455
cmp dword [rbp + 0x20d4], 8
jb 0x140013455
xor r13d, r13d
lea rbx, [rbp + 0x1fa0]
xorps xmm6, xmm6
lea r14, [rbp + 0x20b0]
mov qword [rbp + 0x20a8], rsi
jmp 0x1400132bf
add r15, 0x28
mov rdx, r15
mov rcx, rax
call fcn.140031ab8
test r12b, r12b
jne 0x140013453
inc r13
mov eax, dword [rbp + 0x20d4]
shr rax, 3
cmp r13, rax
jae 0x14001344f
mov rdx, qword [rbp + r13*8 - 0x60]
mov rcx, rdi
mov r8, rbx
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x1400132a9
movaps xmmword [rbp + 0x20c0], xmm6
movaps xmmword [rbp + 0x20b0], xmm6
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x140013472
mov r15, rax
cmp rax, 0xf
ja 0x140013330
mov qword [rbp + 0x20c0], r15
mov qword [rbp + 0x20c8], 0xf
mov rcx, r14
mov rdx, rbx
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, rbp
add r15, 0x20b0
jmp 0x1400133aa
mov rsi, rdi
mov rdi, r14
mov r14, r15
or r14, 0xf
cmp r14, 0x17
mov eax, 0x16
cmovb r14, rax
cmp r14, 0xfff
jb 0x14001336b
lea rcx, [r14 + 0x28]
call fcn.140031a74
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
jmp 0x140013377
lea rcx, [r14 + 1]
call fcn.140031a74
mov r12, rax
mov qword [rbp + 0x20b0], r12
mov qword [rbp + 0x20c0], r15
mov qword [rbp + 0x20c8], r14
mov rcx, r12
mov rdx, rbx
mov r8, r15
call sub.VCRUNTIME140.dll_memcpy
add r15, r12
mov r14, rdi
mov rdi, rsi
mov rsi, qword [rbp + 0x20a8]
mov byte [r15], 0
mov r8, qword [rsi + 0x10]
mov rax, qword [rbp + 0x20c0]
sub rax, r8
jae 0x1400133e0
mov r15, qword [rbp + 0x20c8]
xor r12d, r12d
cmp r15, 0x10
jb 0x1400132a0
jmp 0x14001341c
cmp qword [rsi + 0x18], 0x10
mov rdx, rsi
jb 0x1400133ed
mov rdx, qword [rsi]
mov r15, qword [rbp + 0x20c8]
mov rcx, r14
cmp r15, 0x10
jb 0x140013404
mov rcx, qword [rbp + 0x20b0]
add rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete r12b
cmp r15, 0x10
jb 0x1400132a0
mov rcx, qword [rbp + 0x20b0]
lea rdx, [r15 + 1]
cmp rdx, 0x1000
jb 0x14001329b
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jb 0x140013291
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
xor ebx, ebx
jmp 0x140013455
mov bl, 1
mov eax, ebx
movaps xmm6, xmmword [rbp + 0x20e0]
add rsp, 0x2178
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14000b9b0
int3
Function at 0x140014d70
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1e8
movaps xmmword [rsp + 0x1d0], xmm6
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
xorps xmm6, xmm6
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov r12d, 0x10000
lea r8, [rsp + 0x30]
mov edx, 0x10000
mov r9d, 0x30
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140014f8f
xor r14d, r14d
lea r15, [rsp + 0x60]
lea rbp, [rsp + 0x30]
jmp 0x140014e10
mov ecx, 0x57
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x30]
mov r13, qword [rsp + 0x48]
add r13, rax
mov r9d, 0x30
mov rcx, rbx
mov rdx, r13
mov r8, rbp
call sub.KERNEL32.dll_VirtualQueryEx
mov r12, r13
test rax, rax
je 0x140014f5a
mov r13, qword [rsp + 0x48]
mov eax, r13d
not eax
shl rax, 0x34
je 0x140014f5a
mov rax, qword [rsp + 0x30]
lea rcx, [rax + r13]
cmp rcx, r12
jb 0x140014f5a
cmp dword [rsp + 0x50], 0x1000
jne 0x140014ded
mov ecx, dword [rsp + 0x54]
cmp cl, 1
je 0x140014ded
and ecx, 0x100
jne 0x140014ded
test r12, r12
je 0x140014dd9
movaps xmmword [rsp + 0x80], xmm6
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm6
mov r9d, 0x30
mov rcx, rbx
mov rdx, r12
mov r8, r15
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140014de3
mov qword [rsp + 0x20], 0
mov r9d, 0x40
mov rcx, rbx
mov rdx, r12
lea r8, [rsp + 0x98]
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140014de3
movzx eax, word [rsp + 0x98]
cmp eax, 0x5a4d
jne 0x140014f0c
mov eax, dword [rsp + 0xd4]
cmp rax, 0x40
jb 0x140014f0c
cmp qword [rsp + 0x78], rax
jb 0x140014f0c
movsxd rdx, eax
add rdx, r12
mov qword [rsp + 0x20], 0
mov r9d, 0xf8
mov rcx, rbx
lea r8, [rsp + 0xd8]
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140014de3
cmp dword [rsp + 0xd8], 0x4550
je 0x140014f16
mov ecx, 0xc1
jmp 0x140014dde
movzx eax, word [rsp + 0xee]
test eax, 0x2000
cmove r14, r12
add r12, 0x10000
movaps xmmword [rsp + 0x50], xmm6
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
mov r9d, 0x30
mov rcx, rbx
mov rdx, r12
mov r8, rbp
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
jne 0x140014e10
test r14, r14
je 0x140014f8f
lea rdx, [rsp + 0xd8]
mov rcx, rbx
call sub.KERNEL32.dll_IsWow64Process
test eax, eax
je 0x140014f99
mov r8d, dword [rsp + 0xd8]
mov dword [rsp + 0x20], edi
mov rcx, rbx
mov rdx, r14
mov r9, rsi
call fcn.140014fc0
jmp 0x140014f9b
mov ecx, 0x10dd
call sub.KERNEL32.dll_SetLastError
xor eax, eax
movaps xmm6, xmmword [rsp + 0x1d0]
add rsp, 0x1e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140015cc0
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa8
test rdx, rdx
je 0x140015d87
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
lea r8, [rsp + 0x30]
mov r9d, 0x30
call sub.KERNEL32.dll_VirtualQueryEx
test rax, rax
je 0x140015d91
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x68]
mov r9d, 0x40
mov rcx, rbx
mov rdx, rdi
call sub.KERNEL32.dll_ReadProcessMemory
xor ebp, ebp
test eax, eax
je 0x140015d93
movzx eax, word [rsp + 0x68]
cmp eax, 0x5a4d
jne 0x140015d80
mov eax, dword [rsp + 0xa4]
cmp rax, 0x40
jb 0x140015d80
cmp qword [rsp + 0x48], rax
jb 0x140015d80
cdqe
add rdi, rax
mov qword [rsp + 0x20], 0
mov r9d, 0xf8
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call sub.KERNEL32.dll_ReadProcessMemory
test eax, eax
je 0x140015d93
mov ebp, 1
cmp dword [rsi], 0x4550
je 0x140015d93
mov ecx, 0xc1
jmp 0x140015d8c
mov ecx, 0x57
call sub.KERNEL32.dll_SetLastError
xor ebp, ebp
mov eax, ebp
add rsp, 0xa8
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x140015f20
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x1f8
mov ebx, r9d
mov rsi, r8
mov r12, rdx
mov rdi, rcx
lea r8d, [rbx + 0x1c8]
mov dword [rsp + 0x20], 4
xor r14d, r14d
xor edx, edx
mov r9d, 0x1000
call sub.KERNEL32.dll_VirtualAllocEx
test rax, rax
je 0x140016198
mov r15, rax
mov qword [rsp + 0x28], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0xb2], xmm0
movups xmmword [rsp + 0xc2], xmm0
movups xmmword [rsp + 0xd2], xmm0
movups xmmword [rsp + 0xdc], xmm0
mov word [rsp + 0xb0], 0x5a4d
mov dword [rsp + 0xec], 0x40
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xb0]
mov r9d, 0x40
mov rcx, rdi
mov rdx, rax
call sub.KERNEL32.dll_WriteProcessMemory
xor r14d, r14d
test eax, eax
je 0x140016198
cmp qword [rsp + 0x28], 0x40
jne 0x140016198
lea r13, [r15 + 0x40]
lea rcx, [rsp + 0xf4]
xor r14d, r14d
mov r8d, 0x104
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0xf0], 0x4550
mov dword [rsp + 0x104], 0x200000f0
mov word [rsp + 0xf6], 1
mov word [rsp + 0x108], 0x20b
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0xf0]
mov r9d, 0x108
mov rcx, rdi
mov rdx, r13
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140016198
cmp qword [rsp + 0x28], 0x108
jne 0x140016198
lea rdx, [r15 + 0x148]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movabs rax, 0x72756f7465642e
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x54], 0x170
lea r13d, [rbx + 0x58]
mov dword [rsp + 0x58], r13d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x48]
mov r9d, 0x28
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140016198
cmp qword [rsp + 0x28], 0x28
jne 0x140016198
lea rdx, [r15 + 0x170]
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0x80], xmm0
movabs rax, 0x72744400000040
mov qword [rsp + 0x70], rax
mov dword [rsp + 0x78], 0x40
mov dword [rsp + 0x7c], r13d
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x70]
mov r9d, 0x40
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140016198
cmp qword [rsp + 0x28], 0x40
jne 0x140016198
lea rdx, [r15 + 0x1b0]
lea eax, [rbx + 0x18]
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x34], 0
movups xmm0, xmmword [r12]
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x20], rbp
lea r8, [rsp + 0x30]
mov r9d, 0x18
mov rcx, rdi
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
je 0x140016198
cmp qword [rsp + 0x28], 0x18
jne 0x140016198
mov ebx, ebx
add r15, 0x1c8
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rdx, r15
mov r8, rsi
mov r9, rbx
call sub.KERNEL32.dll_WriteProcessMemory
test eax, eax
setne al
cmp qword [rsp + 0x28], rbx
sete cl
and cl, al
movzx r14d, cl
mov eax, r14d
add rsp, 0x1f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1400172b0
Capabilities:
Resume thread
Terminate process

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
mov r14, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0xe0]
mov r11, qword [rsp + 0xd8]
mov r10, qword [rsp + 0xd0]
mov ebp, dword [rsp + 0xc8]
mov eax, dword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
test rbx, rbx
lea rsi, [0x1400331e0]
cmovne rsi, rbx
test r14, r14
jne 0x140017319
xorps xmm0, xmm0
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 0
lea r14, [rsp + 0x50]
mov ebx, ebp
or ebx, 4
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], eax
call rsi
test eax, eax
je 0x140017399
mov rdi, qword [rsp + 0xf8]
mov ebx, dword [rsp + 0xf0]
mov rcx, qword [r14]
mov rdx, rdi
mov r8d, ebx
call fcn.140014d70
test eax, eax
jne 0x140017376
mov ecx, dword [r14 + 0x10]
mov edx, ebx
mov r8, rdi
mov r9, rsi
call fcn.140016510
test eax, eax
je 0x14001739d
test bpl, 4
jne 0x140017385
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_ResumeThread
mov esi, 1
lea rax, [rsp + 0x50]
cmp r14, rax
mov r14, rax
jne 0x1400173bd
jmp 0x1400173ac
xor esi, esi
jmp 0x1400173bd
mov rcx, qword [r14]
mov edx, 0xffffffff
call sub.KERNEL32.dll_TerminateProcess
xor esi, esi
mov rcx, qword [r14]
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [r14 + 8]
call sub.KERNEL32.dll_CloseHandle
mov eax, esi
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret

Function at 0x140017820
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x258
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1d0], 0xfffffffffffffffe
mov rax, rcx
mov qword [rbp - 0x48], 0
lea rcx, vtable.fmt::v7::basic_memory_buffer_char__500__class_std::allocator_char__.0
mov qword [rbp - 0x58], rcx
lea rsi, [rbp - 0x38]
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], 0x1f4
movups xmm0, xmmword [r8]
movaps xmmword [rbp + 0x1c0], xmm0
lea rcx, [rbp - 0x58]
lea r8, [rbp + 0x1c0]
call rax
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov r8d, 1
mov r9, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov ecx, 0xa
mov rdx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov rcx, qword [rbp - 0x50]
cmp rcx, rsi
je 0x1400178e8
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x1000
jb 0x1400178e3
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x1400178f3
add rdx, 0x27
mov rcx, rax
call fcn.140031ab8
nop
add rsp, 0x258
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140019cf0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, r8
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rsi
jae 0x140019db7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov esi, dword [rax]
lea rax, vtable.std::exception.0
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rax, [0x140038c10]
mov qword [rbp - 0x50], rax
mov byte [rbp - 0x48], 1
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll___std_exception_copy
lea rax, vtable.fmt::v7::system_error.0
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x30], 0
mov qword [rbp - 0x50], 0
lea rax, [rbp - 0x30]
mov qword [rbp - 0x48], rax
lea rax, str.cannot_write_to_file
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x14
lea rcx, [rbp - 0x20]
lea r8, [rbp - 0x60]
lea r9, [rbp - 0x50]
mov edx, esi
call fcn.1400179e0
mov byte [rbp - 0x30], 1
cmp byte [rbp - 0x30], 0
jne 0x140019dc2
lea rax, vtable.std::exception.0
mov qword [rbp - 0x20], rax
lea rcx, [rbp - 0x18]
call sub.VCRUNTIME140.dll___std_exception_destroy
nop
add rsp, 0x88
pop rsi
pop rbp
ret
lea rsi, [rbp - 0x50]
lea rdx, [rbp - 0x20]
mov rcx, rsi
call fcn.1400215e0
lea rdx, [0x1400429a0]
mov rcx, rsi
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x14002e300
Capabilities:
Resume thread

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov esi, dword [0x140045bf0]
call sub.KERNEL32.dll_GetCurrentThreadId
mov ecx, eax
mov eax, 0x10dd
cmp esi, ecx
jne 0x14002e443
mov rdi, qword [0x140045bf8]
test rdi, rdi
je 0x14002e3a9
lea rsi, [rsp + 0x28]
xorps xmm6, xmm6
jmp 0x14002e353
mov rbx, qword [rdi]
mov rcx, rdi
call fcn.140031ab0
mov rdi, rbx
test rbx, rbx
je 0x14002e3a9
mov r8d, dword [rdi + 0x28]
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x20]
movzx edx, byte [rax + 0x3e]
mov r9, rsi
call sub.KERNEL32.dll_VirtualProtect
cmp dword [rdi + 8], 0
jne 0x14002e340
mov rax, qword [rdi + 0x20]
test rax, rax
je 0x14002e340
mov rcx, rax
and rcx, 0xffffffffffff0000
movups xmmword [rax + 0x50], xmm6
movups xmmword [rax + 0x40], xmm6
movups xmmword [rax + 0x30], xmm6
movups xmmword [rax + 0x20], xmm6
movups xmmword [rax + 0x10], xmm6
movups xmmword [rax], xmm6
mov rdx, qword [rcx + 0x10]
mov qword [rax + 0x48], rdx
mov qword [rcx + 0x10], rax
jmp 0x14002e340
mov qword [0x140045bf8], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov rdi, qword [0x140045c18]
test rdi, rdi
je 0x14002e400
mov rsi, rax
lea rbx, [rsp + 0x2c]
nop dword [rax]
mov edx, 0x10000
mov rcx, rdi
mov r8d, 0x20
mov r9, rbx
call sub.KERNEL32.dll_VirtualProtect
mov r8d, 0x10000
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_FlushInstructionCache
mov rdi, qword [rdi + 8]
test rdi, rdi
jne 0x14002e3d0
mov rsi, qword [0x140045c00]
test rsi, rsi
je 0x14002e42c
nop dword [rax]
mov rcx, qword [rsi + 8]
call sub.KERNEL32.dll_ResumeThread
mov rdi, qword [rsi]
mov rcx, rsi
call fcn.140031ab0
mov rsi, rdi
test rdi, rdi
jne 0x14002e410
mov qword [0x140045c00], 0
mov dword [0x140045bf0], 0
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002f810
Capabilities:
Allocate or change rwx memory

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
movaps xmmword [rsp + 0x50], xmm6
movzx eax, cx
mov edi, 0x10000
sub rdi, rax
test rax, rax
cmove rdi, rax
add rdi, rcx
cmp rdi, rdx
jae 0x14002f90f
mov rsi, rdx
xorps xmm6, xmm6
lea rbx, [rsp + 0x20]
jmp 0x14002f860
add rdi, 0x8000000
cmp rdi, rsi
jae 0x14002f90f
cmp rdi, qword [0x1400458d8]
jb 0x14002f872
cmp rdi, qword [0x1400458e0]
jbe 0x14002f850
movaps xmmword [rsp + 0x40], xmm6
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm6
mov r8d, 0x30
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_VirtualQuery
test rax, rax
je 0x14002f90f
cmp dword [rsp + 0x40], 0x10000
mov rax, qword [rsp + 0x38]
jne 0x14002f8f0
cmp rax, 0x10000
jb 0x14002f8f0
mov edx, 0x10000
mov rcx, rdi
mov r8d, 0x3000
mov r9d, 0x40
call sub.KERNEL32.dll_VirtualAlloc
mov r14, rax
test rax, rax
jne 0x14002f912
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x677
je 0x14002f912
add rdi, 0x10000
jmp 0x14002f857
add rax, qword [rsp + 0x20]
movzx ecx, ax
mov edi, 0x10000
sub rdi, rcx
test rcx, rcx
cmove rdi, rcx
add rdi, rax
jmp 0x14002f857
xor r14d, r14d
mov rax, r14
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002f930
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
sub rsp, 0x58
test rcx, rcx
je 0x14002fa06
mov rsi, rcx
test rdx, rdx
je 0x14002f94e
mov qword [rdx], 0
movzx eax, byte [rsi]
cmp al, 0xff
je 0x14002fa0a
cmp al, 0xeb
jne 0x14002fa79
movsx rax, byte [rsi + 1]
lea rdi, [rsi + rax]
add rdi, 2
movzx eax, byte [rsi + rax + 2]
cmp eax, 0xe9
je 0x14002fa7e
cmp eax, 0xff
jne 0x14002fa89
cmp byte [rdi + 1], 0x25
jne 0x14002fa89
movsxd rsi, dword [rdi + 2]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rdi
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14002fa89
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14002fa89
lea rcx, [rdi + rsi]
add rcx, 6
mov r8d, dword [rax + rdx + 0xe8]
add r8, rax
cmp r8, rcx
ja 0x14002fa89
mov eax, dword [rax + rdx + 0xec]
add r8, rax
cmp r8, rcx
jbe 0x14002fa89
mov rdi, qword [rcx]
jmp 0x14002fa89
xor edi, edi
jmp 0x14002fa89
cmp byte [rsi + 1], 0x25
jne 0x14002fa6e
movsxd rdi, dword [rsi + 2]
lea rdx, [rsp + 0x28]
mov r8d, 0x30
mov rcx, rsi
call sub.KERNEL32.dll_VirtualQuery
mov rax, qword [rsp + 0x30]
movzx ecx, word [rax]
cmp ecx, 0x5a4d
jne 0x14002fa6e
movsxd rdx, dword [rax + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x14002fa6e
lea rcx, [rsi + rdi]
add rcx, 6
mov r8d, dword [rax + rdx + 0xe8]
add r8, rax
cmp r8, rcx
ja 0x14002fa6e
mov eax, dword [rax + rdx + 0xec]
add r8, rax
cmp r8, rcx
jbe 0x14002fa6e
mov rsi, qword [rcx]
movzx eax, byte [rsi]
cmp al, 0xeb
je 0x14002f961
mov rdi, rsi
jmp 0x14002fa89
movsxd rax, dword [rdi + 1]
add rdi, rax
add rdi, 5
mov rax, rdi
add rsp, 0x58
pop rdi
pop rsi
ret