joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800050ac
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x180]
sub rsp, 0x280
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rbp + 0x170], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov esi, r14d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x180005144
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18000513b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rsp + 0x38], eax
je 0x180005137
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x180005117
mov esi, dword [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov dword [rsp + 0x20], 1
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1800051b9
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1800051b0
cmp dword [rsp + 0x38], esi
je 0x1800051a3
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x180005189
lea rdx, [rsp + 0x5c]
mov rcx, rbx
call fcn.18000b5e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rbp + 0x170]
xor rcx, rsp
call fcn.18000dee0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x1800051e4
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
xor ebx, ebx
call fcn.180010770
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
jmp 0x180005262
lea rdx, [0x18003b9d8]
lea rcx, [rsp + 0x4c]
call fcn.180014a64
test eax, eax
jne 0x180005254
inc ebx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18000523d
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000dee0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x18000528c
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x234
xor ebx, ebx
call fcn.180010770
xor edx, edx
mov dword [rsp + 0x20], 0x238
lea ecx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180005314
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call fcn.180014a64
test eax, eax
je 0x180005310
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1800052eb
mov ebx, dword [rsp + 0x28]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000dee0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x18000533c
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x160
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rbx, rcx
mov qword [rsp + 0x30], rcx
lea rax, [rsp + 0x40]
xor ecx, ecx
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xor ecx, ecx
mov qword [rbx + 0x18], 0xf
mov qword [rbx], rcx
lea rdx, [rsp + 0x40]
mov qword [rbx + 0x10], rcx
mov byte [rbx], cl
mov rcx, rbx
test eax, eax
jns 0x18000539f
lea rdx, [0x18003b54b]
call fcn.18000b810
mov rax, rbx
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18000dee0
add rsp, 0x160
pop rbx
ret

Function at 0x180005f08
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x270
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rsi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x180005f4f
xor al, al
jmp 0x180005fd3
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor ebx, ebx
test eax, eax
je 0x180005fc8
mov bpl, bl
jmp 0x180005f81
mov rdx, rsi
lea rcx, [rsp + 0x4c]
call fcn.180014a64
test eax, eax
je 0x180005f95
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180005f70
jmp 0x180005fc5
mov r8d, dword [rsp + 0x28]
mov ebp, 1
mov ecx, ebp
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x180005fc5
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, bpl
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18000dee0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180005ffc
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x200
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x70]
lea r8d, [rdx + 0x68]
call fcn.180010770
cmp qword [rbx + 0x18], 0x10
mov rdx, rbx
mov dword [rsp + 0x70], 0x68
mov dword [rsp + 0xac], 1
jb 0x18000604a
mov rdx, qword [rbx]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x70]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800060d1
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800060cc
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800060fa
mov rcx, r8
call fcn.18000df00
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.18000dee0
add rsp, 0x200
pop rbx
ret
call fcn.180016ee8
int3

Function at 0x180006100
Capabilities:
Create process on windows

Disassembly:
push rbx
sub rsp, 0x200
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor edx, edx
mov rbx, rcx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x68]
call fcn.180010770
cmp qword [rbx + 0x18], 0x10
mov eax, 3
mov word [rsp + 0x90], ax
mov rdx, rbx
mov dword [rsp + 0x50], 0x68
mov dword [rsp + 0x8c], 1
jb 0x18000615b
mov rdx, qword [rbx]
lea rcx, [rsp + 0xe0]
call qword [sym.imp.KERNEL32.dll_lstrcpyA]
lea rax, [rsp + 0xc0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0xe0]
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x40], rax
xor edx, edx
and qword [rsp + 0x38], 0
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20
and dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800061e5
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1800061e0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000620e
mov rcx, r8
call fcn.18000df00
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.18000dee0
add rsp, 0x200
pop rbx
ret
call fcn.180016ee8
int3
Function at 0x180006214
Capabilities:
Create restart manager session
Enumerate processes that use resource

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r13
push r14
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rbp], rax
mov rbx, rcx
mov qword [rbp - 0x78], rcx
or dword [rbp - 0x70], 0xffffffff
and qword [rsp + 0x40], 0
and qword [rsp + 0x50], 0
and qword [rsp + 0x58], 0
mov rdx, rcx
lea rcx, [rsp + 0x40]
call fcn.18000b900
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.180001ef4
mov rdi, rax
mov eax, dword [rax + 0x10]
inc eax
movsxd r14, eax
mov eax, 2
mul r14
mov r13, 0xffffffffffffffff
cmovo rax, r13
mov rcx, rax
call fcn.18000e560
mov rsi, rax
cmp qword [rdi + 0x18], 8
jb 0x1800062ad
mov rdi, qword [rdi]
mov r8, rdi
mov rdx, r14
mov rcx, rsi
call fcn.18001561c
mov qword [rbp - 0x60], rsi
lea rcx, [rsp + 0x60]
call fcn.18000b57c
and dword [rbp - 0x80], 0
and dword [rbp - 0x6c], 0
or dword [rbp - 0x68], 0xffffffff
lea r8, [rbp - 0x50]
xor edx, edx
lea rcx, [rbp - 0x70]
call qword [sym.imp.RstrtMgr.DLL_RmStartSession]
test eax, eax
jne 0x1800063ad
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], eax
and qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp - 0x60]
lea edx, [rax + 1]
mov ecx, dword [rbp - 0x70]
call qword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x1800063a3
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8, [rbp - 0x6c]
lea rdx, [rbp - 0x80]
mov ecx, dword [rbp - 0x70]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
cmp eax, 0xea
jne 0x1800063a3
mov ecx, dword [rbp - 0x80]
inc ecx
mov eax, 0x29c
mul rcx
cmovo rax, r13
mov rcx, rax
call fcn.18000e560
mov rdi, rax
mov ecx, dword [rbp - 0x80]
mov dword [rbp - 0x6c], ecx
xor edx, edx
lea r8d, [rdx + 8]
mov rcx, rax
call fcn.180010770
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9, rdi
lea r8, [rbp - 0x6c]
lea rdx, [rbp - 0x80]
mov ecx, dword [rbp - 0x70]
call qword [sym.imp.RstrtMgr.DLL_RmGetList]
test eax, eax
jne 0x18000639b
xor r8d, r8d
xor edx, edx
mov ecx, dword [rbp - 0x70]
call qword [sym.imp.RstrtMgr.DLL_RmShutdown]
mov rcx, rdi
call fcn.1800162a4
mov ecx, dword [rbp - 0x70]
call qword [sym.imp.RstrtMgr.DLL_RmEndSession]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800063e3
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800063de
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000641c
mov rcx, r8
call fcn.18000df00
and qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rbp]
xor rcx, rsp
call fcn.18000dee0
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret
call fcn.180016ee8
int3
Function at 0x180006424
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x2b0]
sub rsp, 0x3b0
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rbp + 0x2a0], rax
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
and dword [rsp + 0x20], 0
and qword [rcx], 0
and qword [rcx + 0x10], 0
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
lea rdx, [0x18003b54b]
call fcn.18000b810
mov dword [rsp + 0x20], 1
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call fcn.180010770
mov dword [rsp + 0x50], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180006592
mov rdx, rsi
lea rcx, [rsp + 0x7c]
call fcn.180014a64
test eax, eax
je 0x1800064e3
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x1800064ba
mov r8d, dword [rsp + 0x58]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov r9d, 0x104
lea r8, [rbp + 0x190]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
and qword [rsp + 0x28], 0
and qword [rsp + 0x38], 0
mov qword [rsp + 0x40], 0xf
lea rdx, [rbp + 0x190]
lea rcx, [rsp + 0x28]
call fcn.18000b810
lea rax, [rsp + 0x28]
cmp rdi, rax
je 0x180006559
xor r8d, r8d
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.18000b9a4
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180006592
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000658d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800065b7
call fcn.18000df00
mov rax, rdi
mov rcx, qword [rbp + 0x2a0]
xor rcx, rsp
call fcn.18000dee0
mov rbx, qword [rsp + 0x3e0]
add rsp, 0x3b0
pop rdi
pop rsi
pop rbp
ret
call fcn.180016ee8
int3
Function at 0x180009dfc
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180009e21
xor eax, eax
jmp 0x180009f1e
cmp qword [rcx + 0x68], 0
je 0x180009e32
call fcn.18000a614
jmp 0x180009f1e
mov rax, qword [rcx + 0x38]
mov rbp, rdi
mov rdx, qword [rax]
test rdx, rdx
je 0x180009e49
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180009e4b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180009e80
cmp rax, rdi
mov rbx, rdi
mov rcx, r14
cmovb rbx, rax
mov r8, rbx
call fcn.18000fd00
mov rax, qword [rsi + 0x50]
sub rbp, rbx
add r14, rbx
mov r8, rbp
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180009f18
mov r9, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r9], rax
jne 0x180009ebb
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r9], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
mov rbx, r8
cmp r8, r15
jbe 0x180009ef3
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.1800169d4
sub rbp, rax
add r14, rax
mov rbx, rbp
cmp rax, r15
jne 0x180009f2f
cmp rbp, r15
ja 0x180009ec9
mov r8, rbx
test rbx, rbx
je 0x180009f18
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.1800169d4
mov r8, rbx
sub r8, rax
sub rdi, r8
mov rax, rdi
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
sub rdi, rbp
jmp 0x180009f1b
Function at 0x18000a2c4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x18000a2fd
xor eax, eax
jmp 0x18000a41f
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x18000a337
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x18000a337
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x18000a41f
cmp qword [rbx + 0x80], 0
je 0x18000a41d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18000a372
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18000a395
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.18001480c
cmp eax, edi
cmovne edi, esi
jmp 0x18000a41d
lea r8, [rbp - 0x40]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + 0x38]
test eax, eax
je 0x18000a3e3
sub eax, 1
je 0x18000a3e3
cmp eax, 2
jne 0x18000a41d
movsx ecx, byte [rbp - 0x30]
jmp 0x18000a37f
mov r14, qword [rbp - 0x40]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x18000a40d
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.180015f58
cmp r14, rax
jne 0x18000a41d
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x38], rax
mov eax, esi
jne 0x18000a41f
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.18000dee0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x18000b31c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180041080]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18000b38b
cmp byte [rcx + 0x71], 0
je 0x18000b38b
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x18000b3df
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x18000b3a5
sub eax, 1
je 0x18000b3a9
cmp eax, 2
jne 0x18000b3df
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.18000dee0
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x18000b3d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.180015f58
cmp rdi, rax
jne 0x18000b3df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18000b38d
xor al, al
jmp 0x18000b38d

Function at 0x180014800
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov ebx, ecx
test r8d, r8d
jne 0x1800146d7
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1800146d7
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1800146d7
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1800146d7
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1800146d7
cmp dword [rcx + 0x84], 0xe
jbe 0x1800146d7
cmp dword [rcx + 0xf8], 0
je 0x1800146d7
mov ecx, ebx
call fcn.180014778
lea rax, [rbp + 0x18]
mov byte [rbp + 0x28], 0
mov qword [rbp - 0x20], rax
lea r9, [rbp - 0x2c]
lea rax, [rbp + 0x20]
mov qword [rbp - 0x18], rax
lea r8, [rbp - 0x20]
lea rax, [rbp + 0x28]
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x28]
mov eax, 2
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
call fcn.180014568
cmp dword [rbp + 0x20], 0
je 0x180014724
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18001472c
int3
xor r8d, r8d
xor edx, edx
jmp 0x180014670

Function at 0x180020228
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x180020248
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.180017fa4
or eax, 0xffffffff
jmp 0x18002024a
xor eax, eax
add rsp, 0x28
ret
Function at 0x413a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413bc6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042fb00
xorps xmm15, xmm15
mov r14, qword [0x0058a9e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x413a8b
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x413aa0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
nop
test rbx, rbx
jbe 0x413ac5
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x413ad9
cmp rbx, 0x1000
jae 0x413a95
nop dword [rax]
jmp 0x413b49
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop
cmp rbx, 0x1000
jae 0x413aed
xor edx, edx
jmp 0x413b40
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.0042fb00
xorps xmm15, xmm15
mov r14, qword [0x0058a9e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
nop dword [rax]
test dl, dl
jne 0x413acf
jmp 0x413ab4
call fcn.0045d4c0
xorps xmm15, xmm15
mov r14, qword [0x0058a9e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.00433f00
lea rax, [0x004a5758]
mov ebx, 0x18
call fcn.00434800
mov rax, qword [rsp + 0x38]
call fcn.00434500
lea rax, [0x004a5818]
mov ebx, 0x19
call fcn.00434800
mov rax, qword [rsp + 0x30]
nop
call fcn.00434500
call fcn.00434160
call fcn.00433f80
lea rax, [0x004a77c8]
mov ebx, 0x21
nop dword [rax + rax]
call fcn.004325c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00459960
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.00413a20
Function at 0x413c00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x413e2a
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.0042fb80
xorps xmm15, xmm15
mov r14, qword [0x0058a9e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x413c79
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x413c8c
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x413cb0
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
nop
jmp 0x413cc4
cmp rbx, 0x1000
jae 0x413c83
jmp 0x413d45
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x413cd6
xor esi, esi
jmp 0x413d36
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
nop dword [rax]
call fcn.0042fb80
xorps xmm15, xmm15
mov r14, qword [0x0058a9e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x413cba
nop
jmp 0x413ca2
call fcn.0045d4c0
xorps xmm15, xmm15
mov r14, qword [0x0058a9e8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x413dc5
call fcn.00433f00
lea rax, [0x004a5be7]
mov ebx, 0x19
call fcn.00434800
mov rax, qword [rsp + 0x68]
call fcn.00434500
lea rax, [0x004a5818]
mov ebx, 0x19
call fcn.00434800
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.00434500
call fcn.00434160
call fcn.00433f80
lea rax, [0x004a2b4f]
mov ebx, 0xd
nop dword [rax + rax]
call fcn.004325c0
cmp eax, 0x5af
je 0x413d68
call fcn.00433f00
lea rax, [0x004a5be7]
mov ebx, 0x19
nop dword [rax]
call fcn.00434800
mov rax, qword [rsp + 0x38]
call fcn.00434500
lea rax, [0x004a5818]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.00434800
mov eax, dword [rsp + 0x34]
call fcn.00434500
call fcn.00434160
call fcn.00433f80
lea rax, [0x004a71c2]
mov ebx, 0x1f
call fcn.004325c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00459960
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00413c00