joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff741afc40
Capabilities:
Get graphical window text

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x198
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x180], rax
and dword [rsp + 0x20], 0
xor r12b, r12b
mov rdi, r9
mov r13, r8
mov rbp, rdx
mov rsi, rcx
test r9, 0xffffffffffff0000
jne 0x7ff741afd28
test rcx, rcx
je 0x7ff741afd28
movzx edx, r9w
mov ebx, 0x50
lea r8, [rsp + 0xe0]
mov r9d, ebx
call qword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
jne 0x7ff741afd17
test rbp, rbp
je 0x7ff741afd21
lea rdx, [rsp + 0xe0]
mov r8d, ebx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x7ff741afd21
lea rdx, str.Program_Manager
lea rcx, [rsp + 0xe0]
call sym.SHLWAPI.dll_StrCmpW
test eax, eax
jne 0x7ff741afd17
xor edx, edx
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp ebx, eax
jne 0x7ff741afd28
lea rdx, str.pszDesktopTitleW
mov rcx, rbp
call qword [sym.imp.USER32.dll_GetPropW]
lea rdi, [rsp + 0xe0]
test rax, rax
cmovne rdi, rax
jmp 0x7ff741afd28
lea rdi, [rsp + 0xe0]
jmp 0x7ff741afd28
lea rdi, [0x7ff741d0b50]
lea rax, [rsp + 0x1f8]
lea r8, [rsp + 0x28]
mov rdx, r13
mov rcx, rsi
mov qword [rsp + 0x28], rax
call fcn.7ff741c235c
and qword [rsp + 0x28], 0
mov rsi, rax
test rax, rax
je 0x7ff741afe0f
lea rcx, [rsp + 0x44]
xor edx, edx
mov r8d, 0x9c
call sub.ntdll.dll_memset
mov ecx, dword [rsp + 0x1f0]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0xa0
mov qword [rsp + 0x44], rbp
mov qword [rsp + 0x74], rsi
mov qword [rsp + 0x5c], rdi
call fcn.7ff741bf420
mov ebx, eax
test eax, eax
js 0x7ff741afe04
lea rcx, [rsp + 0x30]
call fcn.7ff74185c54
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
xor r9d, r9d
xor r8d, r8d
call fcn.7ff741c3cf4
mov ebx, eax
test eax, eax
js 0x7ff741afdd7
test byte [rsp + 0x1f0], 0xf
jne 0x7ff741afdfa
cmp dword [rsp + 0x20], 2
jne 0x7ff741afdfa
mov dword [rsp + 0x20], 1
jmp 0x7ff741afdfa
mov r9d, dword [rsp + 0x1f0]
mov r8, rdi
mov rdx, rsi
bts r9d, 0x10
mov rcx, rbp
mov r12b, 1
call qword [sym.imp.USER32.dll_MessageBoxW]
mov dword [rsp + 0x20], eax
mov rcx, qword [rsp + 0x30]
call fcn.7ff741c3cd4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x7ff741afe14
mov ebx, 0x8007000e
test ebx, ebx
jns 0x7ff741afe41
neg r12b
mov ecx, ebx
sbb eax, eax
and ecx, 0x1fff0000
and eax, dword [rsp + 0x20]
cmp ecx, 0x70000
mov dword [rsp + 0x20], eax
movzx eax, bx
cmove ebx, eax
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x180]
xor rcx, rsp
call fcn.7ff741947a0
add rsp, 0x198
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x7ff741b1708
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
sub rsp, 0x48
xor eax, eax
mov qword [r11 - 0x10], rax
mov qword [r11 - 0x18], rax
mov qword [r11 - 0x20], rax
mov qword [r11 - 0x28], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumKeyExA]
add rsp, 0x48
ret
Function at 0x7ff741b1734
Capabilities:
Query or enumerate registry value

Disassembly:
mov r11, rsp
sub rsp, 0x48
mov rax, qword [rsp + 0x80]
mov qword [r11 - 0x10], rax
mov rax, qword [rsp + 0x78]
mov qword [r11 - 0x18], rax
mov rax, qword [rsp + 0x70]
mov qword [r11 - 0x20], rax
and qword [r11 - 0x28], 0
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegEnumValueA]
add rsp, 0x48
ret

Function at 0x7ff741b1770
Capabilities:
Query or enumerate registry key

Disassembly:
mov r11, rsp
sub rsp, 0x68
mov rax, qword [rsp + 0x90]
xor r10d, r10d
mov qword [r11 - 0x10], r10
mov qword [r11 - 0x18], r10
mov qword [r11 - 0x20], r10
mov qword [r11 - 0x28], rax
mov qword [r11 - 0x30], r9
mov qword [r11 - 0x38], r10
mov qword [r11 - 0x40], r8
mov qword [r11 - 0x48], rdx
xor r9d, r9d
xor edx, edx
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryInfoKeyA]
add rsp, 0x68
ret

Function at 0x7ff741b46d8
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x7ff741e7790]
xor rax, rsp
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x38]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZoneMap
xor ebx, ebx
mov r9d, 0x20019
xor r8d, r8d
mov rcx, 0xffffffff80000001
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], rbx
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x7ff741b476e
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x34]
lea rdx, str.IEharden
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x34], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
cmp eax, ebx
jne 0x7ff741b4763
cmp dword [rsp + 0x30], 1
sete bl
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.7ff741947a0
add rsp, 0x50
pop rbx
ret

Function at 0x7ff741b6e58
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [reloc.ntdll.dll_Ordinal_1], 0
mov rbx, rdx
mov rdi, rcx
je 0x7ff741b6e84
lea rcx, [0x7ff741dd1a0]
call sub.ntdll.dll_Ordinal_1
mov byte [reloc.ntdll.dll_Ordinal_1], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExA]

Function at 0x7ff741b6ea8
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
cmp byte [reloc.ntdll.dll_Ordinal_1], 0
mov rbx, rdx
mov rdi, rcx
je 0x7ff741b6ed4
lea rcx, [0x7ff741dd1b0]
call sub.ntdll.dll_Ordinal_1
mov byte [reloc.ntdll.dll_Ordinal_1], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
Function at 0x7ff741be6bc
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x30
xor eax, eax
test r8d, r8d
mov edi, r8d
sete al
mov ebp, r8d
and edi, 0x10
and ebp, 1
mov r13d, r9d
mov rsi, rdx
mov rbx, rcx
test rcx, rcx
je 0x7ff741be7fc
cmp qword [rcx], 0
jne 0x7ff741be70b
cmp qword [rcx + 0x10], 0
je 0x7ff741be7fc
test eax, eax
jne 0x7ff741be71f
test ebp, ebp
jne 0x7ff741be71b
test edi, edi
je 0x7ff741be7fc
xor eax, eax
jmp 0x7ff741be764
mov r9d, dword [rcx + 0x220]
and dword [rsp + 0x20], 0
lea rdx, [rcx + 8]
lea r8, [rcx + 0x20]
call fcn.7ff7418c1a0
test eax, eax
je 0x7ff741be768
mov r9d, dword [rbx + 0x220]
and dword [rsp + 0x20], 0
lea rdx, [rbx + 0x18]
lea rcx, [rbx + 0x10]
lea r8, [rbx + 0x20]
call fcn.7ff7418c1a0
test eax, eax
jne 0x7ff741be801
lea edi, [rax + 1]
test ebp, ebp
je 0x7ff741be7b5
mov r9d, dword [rbx + 0x220]
and dword [rsp + 0x20], 0
lea r8, [rbx + 0x20]
lea rdx, [rbx + 8]
mov rcx, rbx
call fcn.7ff7418c1a0
test eax, eax
jne 0x7ff741be801
mov rcx, qword [rbx]
mov rdx, rsi
test r13d, r13d
je 0x7ff741be7a1
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
jmp 0x7ff741be7a7
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
cmp eax, 2
jne 0x7ff741be7b1
lea edi, [rax - 1]
xor eax, eax
test eax, eax
jne 0x7ff741be801
test edi, edi
je 0x7ff741be801
mov r9d, dword [rbx + 0x220]
and dword [rsp + 0x20], 0
lea r8, [rbx + 0x20]
lea rdx, [rbx + 0x18]
lea rcx, [rbx + 0x10]
call fcn.7ff7418c1a0
test eax, eax
jne 0x7ff741be801
mov rcx, qword [rbx + 0x10]
mov rdx, rsi
test r13d, r13d
je 0x7ff741be7f4
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteKeyExW]
jmp 0x7ff741be801
call qword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegDeleteValueW]
jmp 0x7ff741be801
mov eax, 0x57
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r13
pop r12
pop rdi
ret

Function at 0x7ff741bea2c
Capabilities:
Delete registry key
Delete registry value

Disassembly:
mov r9d, 1
jmp fcn.7ff741be6bc

Function at 0x7ff741c0e80
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
xor r10d, r10d
mov r11, rcx
test r8b, 2
je 0x7ff741c0e9c
mov rax, qword [rsp + 0x28]
lea r10, [rax + rcx]
jmp 0x7ff741c0f18
movzx eax, word [r9 + 0x14]
lea r8, [rax + r9 + 0x18]
cmp r8, rcx
jbe 0x7ff741c0f18
movzx ebx, word [r9 + 6]
sub rcx, r8
movabs rax, 0xcccccccccccccccd
add rcx, rdx
mul rcx
mov eax, 0x10
shr rdx, 5
cmp rdx, rax
cmova rdx, rax
cmp rbx, rdx
ja 0x7ff741c0f18
mov rcx, r10
cmp rbx, r10
je 0x7ff741c0f18
mov rdx, qword [rsp + 0x28]
mov r9d, dword [r8 + 0xc]
cmp rdx, r9
jb 0x7ff741c0efa
mov eax, dword [r8 + 0x10]
add rax, r9
cmp rdx, rax
jb 0x7ff741c0f06
inc rcx
add r8, 0x28
cmp rcx, rbx
jne 0x7ff741c0ee5
cmp rcx, rbx
je 0x7ff741c0f18
mov r10d, dword [r8 + 0x14]
sub r10, r9
add r10, r11
add r10, rdx
mov rbx, qword [rsp + 8]
mov rax, r10
ret
Function at 0x7ff741c0f28
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
xor ebx, ebx
mov r14d, r8d
mov rdi, rdx
mov rsi, rcx
cmp rdx, rbx
jne 0x7ff741c0f5b
or rdi, 0xffffffffffffffff
sub rdi, rcx
mov r9, rdi
mov r8, rcx
mov rdx, rdi
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
mov edx, 0x40
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
mov eax, 0x5a4d
cmp word [rsi], ax
jne 0x7ff741c11b6
movsxd rax, dword [rsi + 0x3c]
cmp rax, rdi
jae 0x7ff741c11b6
lea r13, [rax + rsi]
mov edx, 0x108
mov rcx, r13
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
cmp dword [r13], 0x4550
jne 0x7ff741c11b6
movzx eax, word [r13 + 0x14]
cmp rax, rdi
jae 0x7ff741c11b6
lea rcx, [r13 + 0x18]
mov edx, 0x10b
cmp word [rcx], dx
jne 0x7ff741c1006
cmp rax, 0x60
jb 0x7ff741c11b6
mov edx, 0xe0
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
mov eax, dword [rcx + 0x5c]
add rcx, 0x60
jmp 0x7ff741c1037
mov edx, 0x20b
cmp word [rcx], dx
jne 0x7ff741c11b6
cmp rax, 0x70
jb 0x7ff741c11b6
mov edx, 0xf0
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
mov eax, dword [rcx + 0x6c]
add rcx, 0x70
cmp rax, 2
jbe 0x7ff741c11b6
mov eax, dword [rcx + 0x10]
mov ebp, dword [rcx + 0x14]
cmp rax, rbx
je 0x7ff741c11b6
cmp rbp, rbx
je 0x7ff741c11b6
mov r9, r13
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.7ff741c0e80
mov r12, rax
cmp rax, rbx
je 0x7ff741c11b6
mov r9, rdi
mov r8, rsi
mov rdx, rbp
mov rcx, rax
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
mov r15d, 0x10
cmp rbp, r15
jb 0x7ff741c11b6
movzx ebp, word [rcx + 0xe]
cmp rbp, rbx
je 0x7ff741c11b6
movzx eax, word [rcx + 0xc]
mov r11, rbx
lea rcx, [rcx + rax*8 + 0x10]
mov r9, rdi
mov r8, rsi
mov edx, 8
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
cmp word [rcx], r15w
je 0x7ff741c10e5
inc r11
add rcx, rdx
cmp r11, rbp
jne 0x7ff741c10bc
cmp r11, rbp
je 0x7ff741c11b6
mov r11d, dword [rcx + 4]
bt r11d, 0x1f
jae 0x7ff741c1183
and r11d, 0x7fffffff
mov rdx, r15
add r11, r12
mov rcx, r11
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
cmp word [r11 + 0xe], bx
jne 0x7ff741c112c
cmp word [r11 + 0xc], bx
je 0x7ff741c11b6
mov ebp, 8
lea rcx, [r11 + 0x10]
mov rdx, rbp
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
mov r11d, dword [rcx + 4]
bt r11d, 0x1f
jae 0x7ff741c1183
and r11d, 0x7fffffff
mov rdx, r15
add r11, r12
mov rcx, r11
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
cmp word [r11 + 0xe], bx
jne 0x7ff741c1173
cmp word [r11 + 0xc], bx
je 0x7ff741c11b6
lea rcx, [r11 + 0x10]
mov rdx, rbp
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
mov ecx, dword [rcx + 4]
mov r9, rdi
mov r8, rsi
add rcx, r12
mov rdx, r15
call fcn.7ff741c0ba8
cmp al, bl
je 0x7ff741c11b6
mov eax, dword [rcx]
mov r9, r13
mov r8d, r14d
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.7ff741c0e80
mov rbx, rax
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rax, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140003f00
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x150
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140003f5b
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140003f6f
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003f33
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x150
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
add rsp, 0x150
pop rbx
ret
Function at 0x1400060a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400060c8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400060ee
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400060f0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140006149
test ecx, ecx
jle 0x140006129
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140006149
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140006149
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140006170
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x1400061a1
xor eax, eax
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
je 0x1400061bf
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x30], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400061db
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400061dd
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140006219
mov qword [rsp + 0x38], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x38]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x1400062ae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140006254
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14000628e
nop dword [rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x1400062ae
cmp rbx, rax
ja 0x140006260
test rbx, rbx
je 0x1400062ae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
mov rsi, qword [rsp + 0x48]
sub rbp, rbx
mov rbx, qword [rsp + 0x30]
mov rax, rbp
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400066f0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140006714
xor eax, eax
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x140006757
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x140006757
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, edi
mov byte [rdx], dil
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0x80], rsi
je 0x140006888
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14000679a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1400067c5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14000688d
lea rax, [rsp + 0x90]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x68]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x98]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14000683a
sub eax, 1
je 0x14000683a
cmp eax, 2
jne 0x140006888
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmove edi, ecx
mov eax, edi
jmp 0x14000688d
mov rsi, qword [rsp + 0x90]
lea rax, [rsp + 0x48]
sub rsi, rax
je 0x14000686b
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x48]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140006888
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x98], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14000688d
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret
Function at 0x140006d10
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006dd9
cmp byte [rcx + 0x71], 0
je 0x140006dd9
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x68], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140006dcc
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x60]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006d88
sub eax, 1
je 0x140006d8c
cmp eax, 2
jne 0x140006dcc
mov rdi, qword [rsp + 0x68]
mov al, 1
mov byte [rbx + 0x71], 0
add rsp, 0x50
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x140006dba
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140006dcc
cmp byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x68]
sete al
add rsp, 0x50
pop rbx
ret
mov rdi, qword [rsp + 0x68]
xor al, al
add rsp, 0x50
pop rbx
ret
mov al, 1
add rsp, 0x50
pop rbx
ret
Function at 0x140009d80
Capabilities:
Create thread
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x180
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rsp + 0x50], 0x130
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140009ddf
lea rdx, str.RobloxPlayerBeta.exe
lea rcx, [rsp + 0x7c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140009f1d
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140009db3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor r8d, r8d
mov dword [0x140117bf8], r8d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x140117c00], rax
call fcn.140003f00
mov r8d, eax
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
call fcn.140003f90
lea rdx, [rax + 0x118]
lea rax, [rsp + 0x198]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0x190]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rdx, qword [rsp + 0x190]
add rdx, 0x1a8
lea rax, [rsp + 0x198]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rsp + 0x1a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x1a0]
mov qword [0x140117c28], rax
call fcn.140004df0
mov ecx, 8
call fcn.140078ac0
lea rcx, [0x14000f3e0]
mov qword [rax], rcx
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140009f70]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140009f39
cmp dword [rsp + 0x38], 0
je 0x140009f2d
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x140009f2d
nop dword [rax + rax]
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009f10
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x58]
jmp 0x140009deb
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3