joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400112d5
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140011820
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x468
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xb2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x488]
mov rax, qword [section..data]
xor rax, rbp
mov qword [rbp + 0x438], rax
lea rcx, [0x1400240a4]
call fcn.1400113a2
nop
mov dword [rbp + 0x2a4], 0
xor edx, edx
mov ecx, 2
call fcn.1400111a9
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
jne 0x14001189c
lea rcx, str._X__ERROR:_Invalid_Handle_Value_for_process_snapshot_handle..._n
call fcn.14001119a
nop
xor eax, eax
jmp 0x140011905
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.140011244
mov dword [rbp + 0x284], eax
cmp dword [rbp + 0x284], 0
je 0x1400118f4
mov rdx, qword [rbp + 0x460]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x1400118df
mov eax, dword [rbp + 0x38]
mov dword [rbp + 0x2a4], eax
jmp 0x1400118f4
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.14001135c
mov dword [rbp + 0x284], eax
jmp 0x1400118b6
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x2a4]
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x14001ac80]
call fcn.140011334
mov rax, rdi
mov rcx, qword [rbp + 0x438]
xor rcx, rbp
call fcn.1400111bd
lea rsp, [rbp + 0x448]
pop rdi
pop rbp
ret
Function at 0x140012840
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.1400113ca
movzx eax, al
test eax, eax
jne 0x140012860
mov ecx, 7
call fcn.14001133e
nop
mov byte [rsp + 0x20], 0
call fcn.140011357
mov byte [rsp + 0x21], al
cmp dword [0x14001e868], 1
jne 0x140012884
mov ecx, 7
call fcn.14001133e
nop
jmp 0x1400128dc
cmp dword [0x14001e868], 0
jne 0x1400128d7
mov dword [0x14001e868], 1
lea rdx, [0x14001a660]
lea rcx, [0x14001a330]
call fcn.14001119f
test eax, eax
je 0x1400128b8
mov eax, 0xff
jmp 0x1400129e1
lea rdx, [0x14001a220]
lea rcx, [section..rdata]
call fcn.14001134d
mov dword [0x14001e868], 2
jmp 0x1400128dc
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.14001132a
call fcn.1400112bc
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140012939
mov rcx, qword [rsp + 0x30]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x140012939
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x140025020]
nop
call fcn.1400112f3
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001296d
mov rcx, qword [rsp + 0x38]
call fcn.140011154
movzx eax, al
test eax, eax
je 0x14001296d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011389
nop
call fcn.140012a90
mov dword [rsp + 0x28], eax
call fcn.140011299
movzx eax, al
test eax, eax
jne 0x14001298c
mov ecx, dword [rsp + 0x28]
call fcn.14001105a
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x14001299b
call fcn.140011393
nop
xor edx, edx
mov cl, 1
call fcn.140011145
mov eax, dword [rsp + 0x28]
jmp 0x1400129e1
add rsp, 0x68
ret
Function at 0x180001250
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
xor ebx, ebx
movsxd rbp, edx
xor r11d, r11d
xor r10d, r10d
mov r14, r9
mov r15, r8
mov rdi, rcx
test edx, edx
jle 0x18000138c
mov rsi, rcx
lea r12, [0x18002b590]
neg rsi
mov rdx, rcx
movzx eax, byte [rdx]
cmp al, 0x3d
jne 0x1800012a6
inc r11d
cmp r11d, 2
jg 0x1800012f9
cmp al, 0x7f
ja 0x1800012f9
movzx eax, al
movzx ecx, byte [rax + r12]
cmp cl, 0x7f
je 0x1800012f9
cmp cl, 0x40
jae 0x1800012c1
test r11d, r11d
jne 0x1800012f9
inc rdx
inc ebx
inc r10d
lea rax, [rsi + rdx]
cmp rax, rbp
jl 0x180001296
test ebx, ebx
je 0x18000138c
lea eax, [rbx + rbx*2]
lea eax, [rax*2 + 7]
sar eax, 3
cmp dword [r9], eax
jge 0x180001303
mov dword [r9], eax
mov eax, 0xfffffff0
jmp 0x18000138e
mov eax, 0xffffffee
jmp 0x18000138e
xor r8d, r8d
xor r11d, r11d
mov r9d, 3
mov rax, r15
test r10d, r10d
jle 0x180001386
nop word [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rcx + r12]
xor ecx, ecx
cmp dl, 0x40
sete cl
and edx, 0x3f
sub r9d, ecx
inc r11d
mov ecx, r8d
mov r8d, edx
shl ecx, 6
or r8d, ecx
cmp r11d, 4
jne 0x18000137b
xor r11d, r11d
test r9d, r9d
jle 0x18000135e
mov ecx, r8d
shr ecx, 0x10
mov byte [rax], cl
inc rax
cmp r9d, 1
jle 0x18000136f
mov ecx, r8d
shr ecx, 8
mov byte [rax], cl
inc rax
cmp r9d, 2
jle 0x18000137b
mov byte [rax], r8b
inc rax
dec r10d
inc rdi
test r10d, r10d
jg 0x180001320
sub eax, r15d
mov dword [r14], eax
xor eax, eax
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
Function at 0x1800029e0
Capabilities:
Read .ini file

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x798]
sub rsp, 0x898
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x1800420b0]
xor rax, rsp
mov qword [rbp + 0x780], rax
mov edi, r9d
mov r14, r8
mov rsi, rdx
mov rbx, rcx
lea r9, [rcx + 0xb0]
cmp qword [r9 + 0x18], 8
jb 0x180002a2f
mov r9, qword [r9]
mov r8d, edi
mov rdx, r14
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp eax, edi
jne 0x180002bab
mov qword [rsp + 0x50], 7
xor r15d, r15d
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
xor r8d, r8d
lea rdx, [0x18002b8d8]
lea rcx, [rsp + 0x38]
call fcn.180002090
nop
xor edx, edx
mov r8d, 0x800
lea rcx, [rbp - 0x80]
call fcn.180014da0
mov r8d, edi
lea rdx, [0x18002b768]
lea rcx, [rbp - 0x80]
call fcn.180002310
lea rax, [rbp - 0x80]
mov r9, r14
mov r8, rsi
lea rdx, [rsp + 0x58]
mov rcx, rbx
mov qword [rsp + 0x20], rax
cmp byte [rbx + 1], r15b
je 0x180002b06
call fcn.1800028a0
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180002b04
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180002ae2
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.1800021e0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180001bf0
nop
jmp 0x180002b57
call fcn.1800029a0
mov rbx, rax
lea rax, [rsp + 0x38]
cmp rax, rbx
je 0x180002b57
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180002b35
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.1800021e0
mov qword [rsp + 0x50], 7
mov qword [rsp + 0x48], r15
mov word [rsp + 0x38], r15w
mov rdx, rbx
lea rcx, [rsp + 0x38]
call fcn.180001bf0
nop
mov r8, qword [rsp + 0x70]
cmp r8, 8
jb 0x180002b74
inc r8
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0x58]
call fcn.1800021e0
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 8
cmovae rcx, qword [rsp + 0x38]
call fcn.180016dfc
mov ebx, eax
mov r8, qword [rsp + 0x50]
cmp r8, 8
jb 0x180002ba9
inc r8
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.1800021e0
mov eax, ebx
mov rcx, qword [rbp + 0x780]
xor rcx, rsp
call fcn.180011e50
add rsp, 0x898
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x180002bd0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x888
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov rax, qword [0x1800420b0]
xor rax, rsp
mov qword [rsp + 0x870], rax
mov r15, r9
mov r14, r8
mov rbx, rdx
mov rbp, rcx
mov qword [rsp + 0x40], rdx
mov rsi, qword [rsp + 0x8e0]
xor edi, edi
mov dword [rsp + 0x30], edi
xor edx, edx
mov r8d, 0x800
lea rcx, [rsp + 0x70]
call fcn.180014da0
lea rax, [rbp + 0xb0]
cmp qword [rax + 0x18], 8
jb 0x180002c3d
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x70]
mov r8, rsi
mov rdx, r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rdi
cmp qword [rbx + 0x18], 8
jb 0x180002c76
mov rax, qword [rbx]
jmp 0x180002c79
mov rax, rbx
mov word [rax], di
cmp word [rsp + 0x70], di
je 0x180002c9a
lea rax, [rsp + 0x70]
or rdi, 0xffffffffffffffff
nop dword [rax]
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180002c90
mov r8, rdi
lea rdx, [rsp + 0x70]
mov rcx, rbx
call fcn.180002090
mov dword [rsp + 0x30], 1
cmp qword [rbx + 0x18], 8
jb 0x180002cbe
mov rax, qword [rbx]
jmp 0x180002cc1
mov rax, rbx
mov r11, rsi
sub r11, rax
nop word [rax + rax]
movzx r10d, word [rax]
movzx edx, word [rax + r11]
sub r10d, edx
jne 0x180002ce6
add rax, 2
test edx, edx
jne 0x180002cd0
test r10d, r10d
jne 0x180002d38
mov qword [rsp + 0x20], rsi
mov r9, r15
mov r8, r14
lea rdx, [rsp + 0x48]
mov rcx, rbp
cmp byte [rbp + 1], r10b
je 0x180002d0b
call fcn.1800028a0
jmp 0x180002d10
call fcn.1800029a0
mov rdx, rax
mov rcx, rbx
call fcn.180001b80
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180002d38
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1800021e0
mov rax, rbx
mov rcx, qword [rsp + 0x870]
xor rcx, rsp
call fcn.180011e50
add rsp, 0x888
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180008990
Capabilities:
Check if file exists
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
or r8, 0xffffffffffffffff
mov rbx, rcx
mov rdi, r8
nop dword [rax]
inc rdi
cmp word [rcx + rdi*2], 0
jne 0x1800089b0
lea eax, [rdi + 1]
movsxd rcx, eax
mov eax, 2
mul rcx
cmovo rax, r8
mov rcx, rax
call fcn.180011ea0
mov rsi, rax
sub rax, rbx
nop word [rax + rax]
movzx ecx, word [rbx]
mov word [rax + rbx], cx
lea rbx, [rbx + 2]
test cx, cx
jne 0x1800089e0
xor r14d, r14d
movsxd rdi, edi
mov ebx, r14d
lea ebp, [r14 + 1]
test rdi, rdi
js 0x180008a4f
mov qword [rsp + 0x40], r15
mov r15d, 0x5c
nop dword [rax]
cmp word [rsi + rbx*2], r15w
jne 0x180008a3d
mov rcx, rsi
mov word [rsi + rbx*2], r14w
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180008a38
xor edx, edx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x180008a47
mov word [rsi + rbx*2], r15w
inc rbx
cmp rbx, rdi
jle 0x180008a10
jmp 0x180008a4a
mov ebp, r14d
mov r15, qword [rsp + 0x40]
mov rcx, rsi
call fcn.180011954
mov rbx, qword [rsp + 0x48]
mov eax, ebp
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x180008a70
Capabilities:
Check if file exists
Get common file path

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x1800420b0]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x290], rbx
mov rsi, rdx
xor bl, bl
mov rbp, rcx
call fcn.180008de0
xor edi, edi
test al, al
je 0x180008b0c
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rdi
call fcn.180008cf0
test al, al
je 0x180008b0c
mov r8, qword [rsp + 0x30]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x298], r14
lea edx, [rdi + 0x1a]
mov r14d, 1
mov qword [rsp + 0x20], rax
mov r9d, r14d
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, r14d
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x298]
test bl, bl
jne 0x180008b20
xor r9d, r9d
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 + 0x1a]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov rbx, qword [rsp + 0x290]
lea rcx, [rsp + 0x40]
or rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], di
jne 0x180008b31
test eax, eax
je 0x180008bef
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax + rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x180008b50
mov eax, dword [0x18002b8dc]
lea rdx, [rsp + 0x40]
sub rdx, 2
mov dword [rcx], eax
nop dword [rax + rax]
cmp word [rdx + 2], di
lea rdx, [rdx + 2]
jne 0x180008b70
xor r8d, r8d
nop dword [rax]
movzx ecx, word [rsi + r8*2]
mov word [rdx + r8*2], cx
lea r8, [r8 + 1]
test cx, cx
jne 0x180008b80
lea rcx, [rsp + 0x40]
sub rcx, 2
nop dword [rax]
cmp word [rcx + 2], di
lea rcx, [rcx + 2]
jne 0x180008ba0
mov dword [rcx], eax
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x180008bc5
lea rcx, [rsp + 0x40]
call fcn.180008990
cmp word [rsp + 0x40], di
je 0x180008bdf
lea rax, [rsp + 0x40]
or rdi, 0xffffffffffffffff
inc rdi
cmp word [rax + rdi*2], 0
jne 0x180008bd5
mov r8, rdi
lea rdx, [rsp + 0x40]
mov rcx, rbp
call fcn.180002090
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180011e50
add rsp, 0x260
pop rdi
pop rsi
pop rbp
ret

Function at 0x180008de0
Capabilities:
Get common file path

Disassembly:
sub rsp, 0x248
mov rax, qword [0x1800420b0]
xor rax, rsp
mov qword [rsp + 0x230], rax
movzx eax, byte [0x180043178]
test al, al
jne 0x180008e92
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x208
call fcn.180014da0
mov r9d, 1
lea rdx, [rsp + 0x20]
xor ecx, ecx
lea r8d, [r9 + 0x19]
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x180008e8b
lea rcx, [rsp + 0x20]
call fcn.1800197e8
lea rdx, str.config_systemprofile
lea rcx, [rsp + 0x20]
call fcn.1800150e8
test rax, rax
jne 0x180008e6b
lea rdx, str.documents_and_settingslocalservice
lea rcx, [rsp + 0x20]
call fcn.1800150e8
test rax, rax
je 0x180008e8b
mov al, 1
mov byte [0x180043178], al
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180011e50
add rsp, 0x248
ret
movzx eax, byte [0x180043178]
mov rcx, qword [rsp + 0x230]
xor rcx, rsp
call fcn.180011e50
add rsp, 0x248
ret
Function at 0x180009280
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov ebp, r9d
mov edi, r8d
mov rsi, rdx
mov r14, rcx
xor bl, bl
call fcn.180008de0
mov r15d, 1
test al, al
je 0x180009306
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], 0
call fcn.180008cf0
test al, al
je 0x180009306
mov r8, qword [rsp + 0x30]
mov r9d, r15d
mov edx, edi
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
movzx ebx, bl
cmove ebx, r15d
call qword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test bl, bl
je 0x180009306
movzx eax, bl
jmp 0x180009324
mov r9d, ebp
mov r8d, edi
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
movzx ecx, bl
cmovne ecx, r15d
movzx eax, cl
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x180009340
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov qword [rsp + 0x68], 0xfffffffffffffffe
mov qword [rsp + 0x180], rbx
mov rax, qword [0x1800420b0]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov r15d, r9d
movzx r12d, r8b
mov rsi, rdx
mov rdi, rcx
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rsp + 0x70]
call fcn.180014da0
mov dword [rsp + 0x70], 0x68
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rbp - 8], 7
xor r13d, r13d
mov qword [rbp - 0x10], r13
mov word [rbp - 0x20], r13w
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r13
mov word [rbp], r13w
lea r14d, [rax + 1]
or rbx, 0xffffffffffffffff
test rsi, rsi
je 0x180009472
cmp word [rsi], r13w
jne 0x1800093ee
mov r8d, r13d
jmp 0x1800093fc
mov r8, rbx
inc r8
cmp word [rsi + r8*2], 0
jne 0x1800093f1
mov rdx, rsi
lea rcx, [rbp]
call fcn.180002090
cmp qword [rbp + 0x10], 0
je 0x180009472
mov r8, r14
lea rdx, [0x18002c234]
lea rcx, [rbp - 0x20]
call fcn.180002090
cmp word [rdi], 0
jne 0x18000942d
mov r8, r13
jmp 0x18000943b
mov r8, rbx
inc r8
cmp word [rdi + r8*2], 0
jne 0x180009430
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.1800054d0
mov r8d, 2
lea rdx, [0x18002c238]
lea rcx, [rbp - 0x20]
call fcn.1800054d0
mov r9, rbx
xor r8d, r8d
lea rdx, [rbp]
lea rcx, [rbp - 0x20]
call fcn.180001e20
jmp 0x180009499
cmp word [rdi], 0
jne 0x180009480
mov rbx, r13
jmp 0x18000948a
inc rbx
cmp word [rdi + rbx*2], 0
jne 0x180009480
mov r8, rbx
mov rdx, rdi
lea rcx, [rbp - 0x20]
call fcn.180002090
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rcx, str.CreateRunProcess__s_
call fcn.18000a010
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 8
cmovae rdx, qword [rbp - 0x20]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x180009500
mov r14d, r13d
jmp 0x180009531
test r12b, r12b
je 0x18000951a
or edx, 0xffffffff
test r15d, r15d
cmovg edx, r15d
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rbp + 0x18]
cmp r8, 8
jb 0x18000954b
inc r8
mov rdx, qword [rbp]
lea rcx, [rbp]
call fcn.1800021e0
mov qword [rbp + 0x18], 7
mov qword [rbp + 0x10], r13
mov word [rbp], r13w
mov r8, qword [rbp - 8]
cmp r8, 8
jb 0x180009576
inc r8
mov rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x20]
call fcn.1800021e0
mov eax, r14d
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.180011e50
mov rbx, qword [rsp + 0x180]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180009a10
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800420b0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
test rcx, rcx
jne 0x180009a53
xor eax, eax
jmp 0x180009be2
mov qword [rsp + 0x60], 7
xor ebx, ebx
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rcx], bx
jne 0x180009a72
mov r8d, ebx
jmp 0x180009a80
or r8, 0xffffffffffffffff
inc r8
cmp word [rcx + r8*2], bx
jne 0x180009a76
mov rdx, rcx
lea rcx, [rsp + 0x48]
call fcn.180002090
nop
lea rcx, [rsp + 0x48]
call fcn.18000bb10
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.180014da0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180009bc3
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180009bb9
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
cmp word [rbp - 0x64], 0
jne 0x180009afd
mov r8, rbx
jmp 0x180009b10
lea rax, [rbp - 0x64]
or r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x180009b05
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x28]
call fcn.180002090
nop
lea rcx, [rsp + 0x28]
call fcn.18000bb10
lea r8, [rsp + 0x48]
cmp qword [rsp + 0x60], 8
cmovae r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x28]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x40]
cmp rdi, 8
cmovae rcx, r14
mov r9, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x38]
call fcn.180005440
test eax, eax
je 0x180009b8d
cmp rdi, 8
jb 0x180009b7b
lea r8, [rdi + 1]
mov rdx, r14
lea rcx, [rsp + 0x28]
call fcn.1800021e0
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x180009ad6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x78]
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x180009bc3
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.1800021e0
jmp 0x180009bc3
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x60]
cmp r8, 8
jb 0x180009be0
inc r8
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.1800021e0
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.180011e50
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x180009df0
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push rdi
push r14
lea rbp, [rax - 0x1d8]
sub rsp, 0x2c0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x1800420b0]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rdi, rcx
xor ebx, ebx
xor edx, edx
mov r8d, 0x238
lea rcx, [rsp + 0x70]
call fcn.180014da0
mov qword [rsp + 0x40], 7
mov qword [rsp + 0x38], rbx
mov word [rsp + 0x28], bx
or r14, 0xffffffffffffffff
cmp word [rdi], bx
jne 0x180009e5f
mov r8d, ebx
jmp 0x180009e6c
mov r8, r14
inc r8
cmp word [rdi + r8*2], bx
jne 0x180009e62
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180002090
nop
lea rcx, [rsp + 0x28]
call fcn.18000bb10
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x180009fca
mov dword [rsp + 0x70], 0x238
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x180009fc0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x58], rbx
mov word [rsp + 0x48], bx
cmp word [rbp - 0x64], 0
jne 0x180009ed7
mov r8, rbx
jmp 0x180009eeb
lea rax, [rbp - 0x64]
mov r8, r14
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x180009ee0
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.180002090
nop
lea rcx, [rsp + 0x48]
call fcn.18000bb10
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 8
cmovae rcx, qword [rsp + 0x28]
lea rdx, [rsp + 0x48]
mov rdi, qword [rsp + 0x48]
mov r9, qword [rsp + 0x60]
cmp r9, 8
cmovae rdx, rdi
mov r10, qword [rsp + 0x38]
mov r8, r10
mov r11, qword [rsp + 0x58]
cmp r11, r10
cmovb r8, r11
test r8, r8
jmp 0x180009f6a
movzx eax, word [rcx]
cmp word [rdx], ax
jne 0x180009f5b
add rdx, 2
add rcx, 2
sub r8, 1
jmp 0x180009f6a
mov r8d, 1
cmp word [rdx], ax
cmovb r8d, r14d
jmp 0x180009f6f
jne 0x180009f45
mov r8d, ebx
test r8d, r8d
jne 0x180009f7b
cmp r11, r10
jb 0x180009f7b
jbe 0x180009fa4
cmp r9, 8
jb 0x180009f92
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1800021e0
lea rdx, [rsp + 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
jmp 0x180009eb0
mov ebx, 1
cmp r9, 8
jb 0x180009fc0
lea r8, [r9 + 1]
mov rdx, rdi
lea rcx, [rsp + 0x48]
call fcn.1800021e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r8, qword [rsp + 0x40]
cmp r8, 8
jb 0x180009fe7
inc r8
mov rdx, qword [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.1800021e0
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.180011e50
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret