joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003890
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x180063e08]
xor rax, rsp
mov qword [rsp + 0xb0], rax
movzx esi, dl
mov edi, r8d
mov rbx, rcx
cmp sil, 2
jae 0x18000399a
lea r8d, [rsi + 0x41]
lea rdx, str._c:_
lea rcx, [rsp + 0x30]
call fcn.180001670
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov edx, eax
lea ecx, [rax - 1]
mov eax, 0xfffa
test ax, cx
jne 0x180003900
cmp dx, 2
jne 0x18000399a
cmp dx, 3
lea r9, [rsp + 0x24]
mov ecx, 0x80
lea r8, [rsp + 0x20]
cmovne ecx, esi
lea rdx, [rsp + 0x28]
mov byte [rbx + 0x1cd82], cl
xor eax, eax
movzx ecx, byte [rbx + 0x1cd82]
mov byte [rbx + 0x1cd85], 0
mov word [rbx + 0x1cd83], ax
call fcn.180003430
test eax, eax
je 0x180003958
movzx eax, word [rsp + 0x20]
mov word [rbx + 0x1cd83], ax
movzx eax, byte [rsp + 0x24]
mov byte [rbx + 0x1cd85], al
mov eax, 0x12
mov dword [rbx + 0x5e], 0x200
mov rcx, rbx
mov word [rbx + 0x18], ax
mov byte [rbx + 0x1cd86], sil
call fcn.180003e00
test eax, eax
jne 0x18000399a
nop dword [rax + rax]
mov edx, edi
mov rcx, rbx
call fcn.1800039d0
test eax, eax
jne 0x18000399a
mov rcx, rbx
call fcn.180003e00
test eax, eax
jne 0x180003980
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180007250
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180012d58
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180012d88
xor eax, eax
jmp 0x180012e4b
mov rbp, rbx
cmp word [rax], si
je 0x180012dad
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180012d94
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180012d90
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180012ca8
movsxd r14, eax
test eax, eax
jne 0x180012deb
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180012d81
mov rcx, r14
call fcn.18000f9b4
mov rdi, rax
test rax, rax
jne 0x180012e04
xor ecx, ecx
call fcn.18000e564
jmp 0x180012de0
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180012ca8
test eax, eax
jne 0x180012e35
mov rcx, rdi
call fcn.18000e564
jmp 0x180012e3f
xor ecx, ecx
call fcn.18000e564
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x140001230
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x140005008]
xor rax, rsp
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xorps xmm0, xmm0
lea rcx, str.ntdll.dll
mov r15, rax
xor eax, eax
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9d, 0x18
lea r8, [rsp + 0x50]
mov rdx, rax
mov qword [rsp + 0x40], rax
mov rcx, r15
mov r12, rax
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
mov rbp, qword [rsp + 0x50]
lea rcx, str.C:windows_system32_ntdll.dll
xor ebx, ebx
xor r9d, r9d
mov qword [rsp + 0x30], rbx
mov edx, 0x80000000
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], 3
lea r8d, [rbx + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov rcx, rax
mov dword [rsp + 0x20], ebx
xor edx, edx
mov r8d, 0x1000002
mov r13, rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
xor r9d, r9d
mov qword [rsp + 0x20], rbx
mov rcx, rax
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea edx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
movsxd rsi, dword [rbp + 0x3c]
movzx edi, bx
add rsi, rbp
mov r14, rax
cmp bx, word [rsi + 6]
jae 0x1400013c8
lea r8, str..text
xor r12d, r12d
movzx ecx, word [rsi + 0x14]
movzx eax, di
add rcx, rsi
lea rdx, [rax + rax*4]
mov rax, r12
lea rbx, [rcx + rdx*8]
nop word [rax + rax]
movzx ecx, byte [rbx + rax + 0x18]
inc rax
cmp cl, byte [r8 + rax - 1]
jne 0x1400013b6
cmp rax, 6
jne 0x140001350
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x68]
mov edx, dword [rbx + 0x20]
lea r8d, [rax + 0x3a]
add rcx, rbp
mov dword [rsp + 0x68], r12d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rbx + 0x24]
mov r8d, dword [rbx + 0x20]
lea rdx, [rax + r14]
lea rcx, [rax + rbp]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [rbx + 0x24]
lea r9, [rsp + 0x68]
mov edx, dword [rbx + 0x20]
add rcx, rbp
mov r8d, dword [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
lea r8, str..text
inc di
cmp di, word [rsi + 6]
jb 0x140001330
mov r12, qword [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.140001890
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x14000221c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002266
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002266
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002266
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002266
cmp dword [rcx + 0x84], 0xe
jbe 0x140002266
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002268
xor al, al
add rsp, 0x28
ret
Function at 0x1400877cb
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400ab1e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x128
lea rbp, [rsp + 0x20]
lea rcx, [0x140211116]
call fcn.14008c8d9
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x68], 0
je 0x1400ab237
mov r8, qword [rbp + 0x130]
mov rdx, qword [rbp + 0x128]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
jmp 0x1400ab343
mov rax, qword [rbp + 0x130]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov qword [rbp + 0x28], rax
cmp qword [rbp + 0x130], 0
jle 0x1400ab2dc
cmp qword [rbp + 0x28], 0
jle 0x1400ab2dc
mov rax, qword [rbp + 0x28]
cmp qword [rbp + 0x130], rax
jge 0x1400ab27c
mov rax, qword [rbp + 0x130]
mov qword [rbp + 0x28], rax
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, qword [rbp + 0x28]
mov rdx, qword [rbp + 0x128]
mov rcx, rax
call fcn.14008c302
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x128]
add rcx, rax
mov rax, rcx
mov qword [rbp + 0x128], rax
mov rax, qword [rbp + 0x28]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov edx, dword [rbp + 0x28]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.MSVCP140D.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
cmp qword [rbp + 0x130], 0
jle 0x1400ab332
mov rax, qword [rbp + 0x120]
cmp qword [rax + 0x80], 0
je 0x1400ab332
mov rax, qword [rbp + 0x120]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x130]
mov edx, 1
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.ucrtbased.dll_fwrite]
mov rcx, qword [rbp + 0x130]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x130]
mov rcx, qword [rbp + 8]
sub rcx, rax
mov rax, rcx
lea rsp, [rbp + 0x108]
pop rdi
pop rbp
ret

Function at 0x140087a91
Capabilities:
Log keystrokes

Disassembly:
jmp 0x140164140
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x14021125c]
call fcn.14008c8d9
lea rdx, str.Roblox
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call qword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
cmp eax, 1
je 0x1401641d1
call qword [sym.imp.USER32.dll_GetForegroundWindow]
cmp rax, qword [rbp + 8]
jne 0x1401641cf
xor edx, edx
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 8
movzx edx, al
xor ecx, ecx
call qword [sym.imp.USER32.dll_keybd_event]
xor edx, edx
mov ecx, 0x1b
call qword [sym.imp.USER32.dll_MapVirtualKeyW]
xor r9d, r9d
mov r8d, 0xa
movzx edx, al
xor ecx, ecx
call qword [sym.imp.USER32.dll_keybd_event]
jmp 0x1401641d1
jmp 0x140164178
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret
Function at 0x140087ed8
Capabilities:
Hash data using fnv

Disassembly:
jmp 0x140131e80
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x108
lea rbp, [rsp + 0x20]
lea rcx, [0x140211170]
call fcn.14008c8d9
mov qword [rbp + 8], 0
jmp 0x140131ebe
mov rax, qword [rbp + 8]
inc rax
mov qword [rbp + 8], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 8], rax
jae 0x140131f14
mov rax, qword [rbp + 8]
mov rcx, qword [rbp + 0x108]
add rcx, rax
mov rax, rcx
movzx eax, byte [rax]
mov rcx, qword [rbp + 0x100]
xor rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
movabs rax, 0x100000001b3
mov rcx, qword [rbp + 0x100]
imul rcx, rax
mov rax, rcx
mov qword [rbp + 0x100], rax
jmp 0x140131eb3
mov rax, qword [rbp + 0x100]
lea rsp, [rbp + 0xe8]
pop rdi
pop rbp
ret

Function at 0x14008a0e8
Capabilities:
Terminate process

Disassembly:
jmp 0x140193ea0
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x14008a827
Capabilities:
Get geographical location

Disassembly:
jmp 0x14017c020
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x58
mov r9d, 2
lea r8, [rsp + 0x40]
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov dword [rsp + 0x44], eax
cmp dword [rsp + 0x44], 0
jne 0x14017c05d
mov dword [rsp + 0x40], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r9d, dword [rsp + 0x40]
mov r8d, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x48]
mov edx, eax
mov rax, qword [rsp + 0x68]
mov rcx, qword [rax]
call fcn.14008c88e
add rsp, 0x58
ret
Function at 0x14008ac69
Capabilities:
Create thread

Disassembly:
jmp 0x1400d63e0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x148
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x16
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x168]
mov rax, qword [0x1401f30c0]
xor rax, rbp
mov qword [rbp + 0x100], rax
lea rcx, [0x14021128c]
call fcn.14008c8d9
mov edx, 8
lea rcx, [rbp + 8]
call fcn.140088473
mov r8, qword [rbp + 0x140]
mov rdx, qword [rbp + 0x138]
lea rcx, [rbp + 8]
call fcn.1400873e8
nop
lea rax, [0x14008b416]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x130]
add rax, 8
mov qword [rbp + 0xf8], rax
lea rcx, [rbp + 8]
call fcn.14008c9e2
mov rcx, qword [rbp + 0xf8]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x130]
mov qword [rcx], rax
mov rax, qword [rbp + 0x130]
cmp qword [rax], 0
je 0x1400d64c6
lea rcx, [rbp + 8]
call fcn.14008b5f1
jmp 0x1400d64df
mov rax, qword [rbp + 0x130]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.140088324
nop
lea rcx, [rbp + 8]
call fcn.140089afd
lea rcx, [rbp - 0x30]
lea rdx, [0x1401bb660]
call fcn.14008b911
mov rcx, qword [rbp + 0x100]
xor rcx, rbp
call fcn.1400899e5
lea rsp, [rbp + 0x118]
pop rdi
pop rbp
ret

Function at 0x14008ac82
Capabilities:
Parse pe header

Disassembly:
jmp 0x1401946f0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x140194710
xor al, al
jmp 0x140194791
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140194723
xor al, al
jmp 0x140194791
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14019474d
xor al, al
jmp 0x140194791
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140194761
xor al, al
jmp 0x140194791
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140194773
xor al, al
jmp 0x140194791
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14019478f
xor al, al
jmp 0x140194791
mov al, 1
add rsp, 0x38
ret
Function at 0x14008b1d2
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140165190
push rbp
push rdi
sub rsp, 0x448
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xaa
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1401f30c0]
xor rax, rbp
mov qword [rbp + 0x418], rax
lea rcx, [0x14021125c]
call fcn.14008c8d9
mov byte [rbp + 4], 0
mov dword [rbp + 0x30], 0x238
xor edx, edx
mov ecx, 2
call fcn.14008990e
mov qword [rbp + 0x288], rax
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.14008a539
test eax, eax
je 0x14016522e
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll__wcsicmp]
test eax, eax
jne 0x14016521a
mov byte [rbp + 4], 1
jmp 0x14016522e
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 0x288]
call fcn.14008bbc3
test eax, eax
jne 0x1401651ff
mov rcx, qword [rbp + 0x288]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [rbp + 4]
mov edi, eax
lea rcx, [rbp - 0x20]
lea rdx, [0x1401afc70]
call fcn.14008b911
mov eax, edi
mov rcx, qword [rbp + 0x418]
xor rcx, rbp
call fcn.1400899e5
lea rsp, [rbp + 0x428]
pop rdi
pop rbp
ret

Function at 0x14008bba0
Capabilities:
Create directory

Disassembly:
jmp 0x14017d550
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [0x1401f30c0]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor edx, edx
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14017d58d
mov byte [rsp + 0x24], 1
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x14017d602
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xb7
jne 0x14017d5f0
mov edx, 1
mov ecx, 2
call fcn.140087262
mov r9d, 0xffffffff
mov r8d, eax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x70]
call fcn.14008886f
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jne 0x14017d5f0
mov edx, 0x10
mov ecx, dword [rsp + 0x48]
call fcn.140087a4b
movzx eax, al
test eax, eax
jne 0x14017d5f0
mov dword [rsp + 0x20], 0xb7
mov byte [rsp + 0x2c], 0
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400899e5
add rsp, 0x68
ret
Function at 0x14008c005
Capabilities:
Get common file path

Disassembly:
jmp 0x14017d8b0
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
sub rsp, 0x48
mov rdx, qword [rsp + 0x58]
mov ecx, dword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
je 0x14017d8f8
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x20], eax
ja 0x14017d8f8
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x24], eax
mov dword [rsp + 0x28], 0
mov rax, qword [rsp + 0x24]
jmp 0x14017d90f
mov eax, dword [rsp + 0x20]
mov dword [rsp + 0x2c], eax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x2c]
add rsp, 0x48
ret
Function at 0x14008c780
Capabilities:
Write file on windows

Disassembly:
jmp 0x1400a2a40
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1b8
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x1d8]
mov rax, qword [0x1401f30c0]
xor rax, rbp
mov qword [rbp + 0x170], rax
lea rcx, [0x140211116]
call fcn.14008c8d9
mov rax, qword [rbp + 0x1a0]
cmp qword [rax + 0x68], 0
je 0x1400a2aa6
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400a2aad
mov al, 1
jmp 0x1400a2c1d
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
mov qword [rbp + 0x158], rax
call fcn.14008879d
mov dword [rbp + 0x160], eax
mov edx, dword [rbp + 0x160]
mov rcx, qword [rbp + 0x1a0]
call qword [rbp + 0x158]
mov dword [rbp + 0x164], eax
call fcn.14008879d
mov dword [rbp + 0x168], eax
mov edx, dword [rbp + 0x164]
mov ecx, dword [rbp + 0x168]
call fcn.14008b506
movzx eax, al
test eax, eax
je 0x1400a2b10
xor al, al
jmp 0x1400a2c1d
mov qword [rbp + 8], 0x20
mov rax, qword [rbp + 0x1a0]
mov rax, qword [rax + 0x68]
mov qword [rbp + 0x158], rax
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x1a0]
add rcx, 0x74
lea rdx, [rbp + 0x68]
mov qword [rsp + 0x20], rdx
mov r9, rax
lea r8, [rbp + 0x28]
mov rdx, rcx
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.MSVCP140D.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
mov dword [rbp + 0x160], eax
cmp dword [rbp + 0x160], 0
je 0x1400a2b83
cmp dword [rbp + 0x160], 1
je 0x1400a2b8e
cmp dword [rbp + 0x160], 3
je 0x1400a2c0c
jmp 0x1400a2c1b
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
lea rax, [rbp + 0x28]
mov rcx, qword [rbp + 0x68]
sub rcx, rax
mov rax, rcx
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jbe 0x1400a2bde
mov rax, qword [rbp + 0x1a0]
mov r9, qword [rax + 0x80]
mov r8, qword [rbp + 0x88]
mov edx, 1
lea rcx, [rbp + 0x28]
call qword [sym.imp.ucrtbased.dll_fwrite]
cmp qword [rbp + 0x88], rax
je 0x1400a2bde
xor al, al
jmp 0x1400a2c1d
mov rax, qword [rbp + 0x1a0]
movzx eax, byte [rax + 0x71]
test eax, eax
jne 0x1400a2bf9
mov dword [rbp + 0x154], 1
jmp 0x1400a2c03
mov dword [rbp + 0x154], 0
movzx eax, byte [rbp + 0x154]
jmp 0x1400a2c1d
mov rax, qword [rbp + 0x1a0]
mov byte [rax + 0x71], 0
mov al, 1
jmp 0x1400a2c1d
xor al, al
mov rdi, rax
lea rcx, [rbp - 0x30]
lea rdx, [0x1401ac3d0]
call fcn.14008b911
mov rax, rdi
mov rcx, qword [rbp + 0x170]
xor rcx, rbp
call fcn.1400899e5
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x140004c80
Capabilities:
Parse pe header

Disassembly:
push rsi
push rdi
mov r8d, 0x100
mov eax, 1
cmp rdx, 0x40
jb 0x140004d82
test cl, 3
je 0x140004ca7
mov r8d, 0x400
jmp 0x140004d82
movzx r9d, word [rcx]
cmp r9d, 0x5a4d
jne 0x140004d7c
mov r9d, dword [rcx + 0x3c]
test r9b, 3
jne 0x140004c9c
cmp r9d, 0x1000000
jbe 0x140004cd6
mov r8d, 0x700
jmp 0x140004d82
lea r11, [r9 + 0x88]
cmp r11, rdx
ja 0x140004d82
cmp dword [rcx + r9], 0x4550
jne 0x140004d7c
movzx esi, word [rcx + r9 + 0x18]
cmp esi, 0x20b
je 0x140004d0a
cmp esi, 0x10b
jne 0x140004d7c
mov edi, dword [rcx + r9 + 0x54]
cmp rdi, rdx
ja 0x140004d82
mov r10d, dword [rcx + r9 + 0x50]
cmp edi, r10d
ja 0x140004ccb
movzx esi, si
cmp esi, 0x20b
jne 0x140004d88
mov esi, dword [rcx + r9 + 0x84]
cmp esi, 0x10
mov edi, 0x10
cmovb edi, esi
shl edi, 3
add r11, rdi
cmp r11, rdx
ja 0x140004d82
movzx r11d, word [rcx + r9 + 6]
cmp r11, 0x60
ja 0x140004ccb
lea r11, [r11 + r11*4]
lea r11, [r9 + r11*8]
movzx ecx, word [rcx + r9 + 0x14]
add rcx, r11
add rcx, 0x18
cmp rcx, rdx
ja 0x140004d82
shl r10, 0x20
xor eax, eax
mov r8, r10
jmp 0x140004d82
mov r8d, 0x500
or rax, r8
pop rdi
pop rsi
ret
mov r8d, 0x600
jmp 0x140004d82
Function at 0x140005500
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
mov qword [rbp - 0x10], rcx
mov qword [rbp - 0x28], 8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 4], 0
mov qword [rbp - 0x30], rdx
mov r14, qword [rdx]
mov edi, 8
lea r15, [rbp - 4]
xor ebx, ebx
xor esi, esi
jmp 0x14000555d
mov r13, r12
mov qword [rbp - 0x18], r13
mov rbx, r13
mov esi, r12d
lea r8d, [rbx*8]
mov dword [rsp + 0x20], 3
mov rcx, r14
mov rdx, rdi
mov r9, r15
call sub.PSAPI.DLL_EnumProcessModulesEx
test eax, eax
je 0x1400055fc
mov r12d, dword [rbp - 4]
cmp r12d, esi
jbe 0x140005658
mov rsi, r12
sub rsi, rbx
jbe 0x140005550
mov rax, qword [rbp - 0x20]
sub rax, rbx
mov r13, rbx
cmp rax, rsi
jae 0x1400055ba
lea rcx, [rbp - 0x28]
mov rdx, rbx
mov r8, rsi
call fcn.140031ba0
mov rdi, qword [rbp - 0x28]
mov r13, qword [rbp - 0x18]
lea rcx, [rdi + r13*8]
cmp rsi, 2
jb 0x1400055ed
mov r8, rbx
not r8
add r8, r12
shl r8, 3
xor edx, edx
call sub.VCRUNTIME140.dll_memset
lea rax, [r12 + r13]
sub rax, rbx
lea rcx, [rdi + rax*8]
add rcx, 0xfffffffffffffff8
add r13, rsi
dec r13
mov qword [rcx], 0
inc r13
jmp 0x140005553
call sub.KERNEL32.dll_GetLastError
shl rax, 0x20
or rax, 2
mov rcx, qword [rbp - 0x10]
mov qword [rcx + 8], rax
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rcx + 0x10], xmm0
mov rax, qword [rbp - 0x38]
mov qword [rcx + 0x20], rax
mov qword [rcx], 0
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x140005643
shl rdx, 3
mov r8d, 8
mov rcx, rdi
call fcn.140004520
mov rax, qword [rbp - 0x10]
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov r14d, r12d
shr r14d, 3
cmp rbx, r14
jb 0x140005728
cmp r12d, 8
jae 0x14000567a
mov eax, 8
xor ecx, ecx
jmp 0x1400056ff
mov r15, r14
shl r15, 4
movzx eax, byte [0x140059161]
mov edx, 8
mov rcx, r15
call fcn.140004510
test rax, rax
je 0x14000573c
cmp r14d, 1
jne 0x1400056ac
xor ecx, ecx
mov r10, qword [rbp - 0x30]
jmp 0x1400056e5
mov edx, r14d
and edx, 0xfffffffe
lea r8, [rax + 0x18]
xor ecx, ecx
mov r10, qword [rbp - 0x30]
nop dword [rax]
mov r9, qword [rdi + rcx*8]
mov qword [r8 - 0x18], r10
mov qword [r8 - 0x10], r9
mov r9, qword [rdi + rcx*8 + 8]
mov qword [r8 - 8], r10
mov qword [r8], r9
add rcx, 2
add r8, 0x20
cmp rdx, rcx
jne 0x1400056c0
test r14b, 1
je 0x1400056fc
mov rdx, qword [rdi + rcx*8]
shl rcx, 4
mov qword [rax + rcx], r10
mov qword [rax + rcx + 8], rdx
mov rcx, r14
mov rdx, qword [rbp - 0x10]
mov qword [rdx + 8], rax
mov qword [rdx + 0x10], r14
mov qword [rdx + 0x18], rcx
mov qword [rdx], 4
mov rdx, qword [rbp - 0x20]
test rdx, rdx
jne 0x140005631
jmp 0x140005643
lea r8, str.C:Usersjohn.cargo_registry_srcindex.crates.io_6f17d22bba15001fwinproc_0.6.4_srcprocessmod.rs
mov rcx, r14
mov rdx, rbx
call fcn.140032d20
jmp 0x140005749
mov ecx, 8
mov rdx, r15
call fcn.140032820
ud2