joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140001090
Capabilities:
Resume thread

Disassembly:
push rdi
sub rsp, 0x40
mov rdi, rcx
call fcn.140001c9c
test eax, eax
je 0x1400010b8
mov edx, eax
lea rcx, str.____MH_CreateHook_failed_with_error:__d_n
call fcn.140001010
xor eax, eax
add rsp, 0x40
pop rdi
ret
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x38], r12
mov r12d, 1
mov qword [rsp + 0x30], r14
xor r14d, r14d
mov ebx, r14d
xor eax, eax
lock cmpxchg dword [0x140006848], r12d
je 0x140001103
cmp rbx, 0x20
jae 0x1400010ea
xor ecx, ecx
jmp 0x1400010ed
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x140006848], r12d
jne 0x1400010e0
cmp qword [0x140006850], r14
je 0x14000121f
test rdi, rdi
jne 0x140001121
mov ecx, r12d
call fcn.140001b98
mov edi, eax
jmp 0x14000114c
mov ecx, dword [0x14000688c]
mov ebx, r14d
test ecx, ecx
je 0x140001147
mov r8, qword [0x140006880]
mov rax, r8
cmp rdi, qword [rax]
je 0x140001163
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x140001138
mov edi, 4
xchg dword [0x140006848], r14d
test edi, edi
jne 0x14000122b
mov eax, r12d
jmp 0x14000123e
cmp ebx, 0xffffffff
je 0x140001147
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
jne 0x140001215
mov r8d, r12d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1400016e0
mov edi, eax
test eax, eax
jne 0x14000114c
mov edx, r12d
mov ecx, ebx
call fcn.140001a8c
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x14000114c
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1400011fc
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x58], rbp
mov ebp, eax
mov qword [rsp + 0x60], rsi
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1400011e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1400011c0
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x140006850]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14000114c
mov edi, 5
jmp 0x14000114c
xchg dword [0x140006848], r14d
mov edi, 2
mov edx, edi
lea rcx, str.____MH_EnableHook_failed_with_error:__d_n
call fcn.140001010
mov eax, 0xffffffff
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x140001260
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
push r12
push r14
sub rsp, 0x30
xor r14d, r14d
mov rdi, rcx
mov ebx, r14d
xor eax, eax
mov r12d, 1
lock cmpxchg dword [0x140006848], r12d
je 0x1400012b3
nop word [rax + rax]
cmp rbx, 0x20
jae 0x14000129a
xor ecx, ecx
jmp 0x14000129d
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x140006848], r12d
jne 0x140001290
cmp qword [0x140006850], r14
je 0x1400013df
test rdi, rdi
jne 0x1400012d0
xor ecx, ecx
call fcn.140001b98
mov edi, eax
jmp 0x1400012fb
mov ecx, dword [0x14000688c]
mov ebx, r14d
test ecx, ecx
je 0x1400012f6
mov r8, qword [0x140006880]
mov rax, r8
cmp rdi, qword [rax]
je 0x14000131c
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x1400012e7
mov edi, 4
xchg dword [0x140006848], r14d
test edi, edi
jne 0x1400013eb
mov eax, r12d
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
cmp ebx, 0xffffffff
je 0x1400012f6
mov eax, ebx
imul rdx, rax, 0x38
test byte [rdx + r8 + 0x20], 2
je 0x1400013d5
mov r8d, r12d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1400016e0
mov edi, eax
test eax, eax
jne 0x1400012fb
xor edx, edx
mov ecx, ebx
call fcn.140001a8c
mov edi, eax
cmp qword [rsp + 0x20], r14
je 0x1400012fb
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x1400013bc
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x50], rbp
mov ebp, eax
mov qword [rsp + 0x58], rsi
nop dword [rax]
nop word [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x1400013a8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x140001380
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x140006850]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400012fb
mov edi, 6
jmp 0x1400012fb
xchg dword [0x140006848], r14d
mov edi, 2
mov edx, edi
lea rcx, str.____MH_DisableHook_failed_with_error:__d_n
call fcn.140001010
mov rbx, qword [rsp + 0x60]
xor eax, eax
add rsp, 0x30
pop r14
pop r12
pop rdi
ret
Function at 0x140001a18
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx], 0
mov rbx, rcx
je 0x140001a7c
xor edi, edi
cmp dword [rcx + 0xc], edi
jbe 0x140001a6a
mov rax, qword [rbx]
xor edx, edx
mov r8d, dword [rax + rdi*4]
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x140001a63
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, dword [rbx + 0xc]
jb 0x140001a37
mov r8, qword [rbx]
xor edx, edx
mov rcx, qword [0x140006850]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140001a8c
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov eax, ecx
mov esi, edx
imul rbx, rax, 0x38
add rbx, qword [0x140006880]
mov rdx, qword [rbx]
mov cl, byte [rbx + 0x20]
mov rbp, rdx
lea rdi, [rdx - 5]
and cl, 1
je 0x140001ac2
mov rbp, rdi
movzx eax, cl
lea r9, [rsp + 0x40]
test cl, cl
mov r8d, 0x40
cmove rdi, rdx
lea r14, [rax*2 + 5]
mov rcx, rdi
mov rdx, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x140001af8
mov eax, 0xa
jmp 0x140001b84
test esi, esi
je 0x140001b1a
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, ebp
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x140001b3b
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x140001b3b
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x140001b35
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
mov al, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x140001b3b
mov al, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x40]
lea r9, [rsp + 0x40]
mov rdx, r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, r14
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
mov al, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x140001e58
Capabilities:
Check for software breakpoints

Disassembly:
mov r8b, byte [rcx]
mov r9d, edx
test r8b, r8b
je 0x140001e6f
cmp r8b, 0x90
je 0x140001e6f
cmp r8b, 0xcc
jne 0x140001e91
mov r10d, 1
mov edx, r10d
cmp r9d, r10d
jbe 0x140001e8d
mov eax, edx
cmp byte [rax + rcx], r8b
jne 0x140001e91
add edx, r10d
cmp edx, r9d
jb 0x140001e7d
mov eax, r10d
ret
xor eax, eax
ret
Function at 0x1400021f8
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rdi, rcx
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r14, qword [rbp - 0x58]
cmp rdi, 0x40000000
jbe 0x140002242
lea rax, [rdi - 0x40000000]
cmp r14, rax
cmovb r14, rax
mov rbx, qword [0x140006870]
lea r12, [rdi + 0x40000000]
cmp qword [rbp - 0x50], r12
cmovbe r12, qword [rbp - 0x50]
sub r12, 0xfff
xor esi, esi
test rbx, rbx
je 0x140002280
cmp rbx, r14
jb 0x14000227b
cmp rbx, r12
jae 0x14000227b
cmp qword [rbx + 8], rsi
jne 0x1400023d7
mov rbx, qword [rbx]
jmp 0x140002262
mov r15, rdi
cmp rdi, r14
jb 0x140002304
mov r13d, dword [rbp - 0x38]
xor edx, edx
mov rax, r15
div r13
sub r15, rdx
sub r15, r13
cmp r15, r14
jb 0x1400022fb
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400022fb
cmp dword [rbp - 0x10], 0x10000
je 0x1400022cb
mov r15, qword [rbp - 0x28]
cmp r15, r13
jb 0x1400022fb
jmp 0x140002297
test r15, r15
je 0x1400022fb
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jne 0x14000239c
cmp r15, r14
jae 0x140002288
test rbx, rbx
jne 0x14000239c
cmp rdi, r12
ja 0x1400023d7
mov r15d, dword [rbp - 0x38]
xor edx, edx
mov rax, rdi
mov r14d, r15d
div r15
mov eax, r15d
sub rax, rdx
add rax, rdi
mov rdi, rax
cmp rax, r12
ja 0x1400023d7
mov r8d, 0x30
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400023d7
cmp dword [rbp - 0x10], 0x10000
je 0x140002372
xor edx, edx
lea edi, [r15 - 1]
add rdi, qword [rbp - 0x18]
add rdi, qword [rbp - 0x30]
mov rax, rdi
div r14
sub rdi, rdx
cmp rdi, r12
jmp 0x14000232b
test rdi, rdi
je 0x1400023d7
mov edx, 0x1000
mov r9d, 0x40
mov r8d, 0x3000
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
jmp 0x1400022fe
lea rcx, [rbx + 0x40]
mov dword [rbx + 0x10], esi
mov edx, 0x40
mov qword [rcx], rsi
mov rax, rcx
mov qword [rbx + 8], rcx
add rdx, 0x40
add rcx, 0x40
mov rsi, rax
cmp rdx, 0xfc0
jbe 0x1400023a8
mov rax, qword [0x140006870]
mov qword [rbx], rax
mov qword [0x140006870], rbx
lea r11, [rsp + 0x80]
mov rax, rbx
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x140003404
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000344e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000344e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000344e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000344e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000344e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003450
xor al, al
add rsp, 0x28
ret
Function at 0x7ff6d1e41150
Capabilities:
Copy file
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
lea r8, str.PAYLOAD
xor ecx, ecx
mov qword [rsp + 0x70], rbp
mov ebx, ebp
mov qword [rsp + 0x78], rbp
lea edx, [rbp + 0x66]
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x7ff6d1e4118b
mov rsi, rbp
mov edi, ebp
jmp 0x7ff6d1e411b4
mov rdx, rdi
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
je 0x7ff6d1e41184
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rdx, rdi
xor ecx, ecx
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
mov qword [rsp + 0x48], rbp
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rbp
xor r9d, r9d
mov dword [rsp + 0x38], ebp
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 0x1f003f
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
call qword [0x7ff6d1e59be0]
test eax, eax
js 0x7ff6d1e412d1
xor r8d, r8d
lea rdx, str.C:_notepad.exe
lea rcx, [0x7ff6d1e55830]
call qword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x7ff6d1e412d1
mov rax, qword [rsp + 0x70]
lea rcx, str.C:_notepad.exe
mov qword [rsp + 0x48], rbp
xor r9d, r9d
mov qword [rsp + 0x40], rbp
mov edx, 0xc0000000
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbp
lea r8d, [r9 + 1]
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileTransactedA]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x7ff6d1e412d1
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x7ff6d1e412d1
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x28], 0x1000000
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 2
mov edx, 0xf001f
call qword [0x7ff6d1e59bb0]
test eax, eax
js 0x7ff6d1e412d1
mov rcx, qword [rsp + 0x70]
mov dl, 1
call qword [0x7ff6d1e59bb8]
test eax, eax
js 0x7ff6d1e412d1
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x78]
jmp 0x7ff6d1e412f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x7ff6d1e412e7
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x7ff6d1e412f5
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
Function at 0x7ff6d1e41308
Capabilities:
Contain obfuscated stackstrings
Query environment variable

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
lea rax, str.C:WindowsSystem32_notepad.exe
mov dword [rbp + 0x47], 0x40003e
mov qword [rbp + 0x4f], rax
xor ebx, ebx
mov qword [rbp + 0x3f], rax
lea rax, str.C:WindowsSystem32
mov qword [rbp + 0x2f], rax
lea rax, str._C:WindowsSystem32_notepad.exe_
mov qword [rbp + 0x1f], rax
lea rax, str.Untitled___Notepad
mov qword [rbp + 0xf], rax
mov qword [rbp + 0x67], rbx
mov dword [rbp + 0x37], 0x40003e
mov dword [rbp + 0x27], 0x280026
mov dword [rbp + 0x17], 0x440042
mov dword [rbp + 7], 0x260024
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [rsp + 0x50], 1
lea rcx, [rbp + 7]
mov qword [rsp + 0x48], rbx
lea r9, [rbp + 0x27]
mov qword [rsp + 0x40], rbx
lea r8, [rbp + 0x37]
mov qword [rsp + 0x38], rbx
lea rdx, [rbp + 0x47]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp + 0x67]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x17]
mov qword [rsp + 0x20], rax
call qword [0x7ff6d1e59bd8]
mov rcx, qword [rbp + 0x67]
test eax, eax
cmovs rcx, rbx
mov rbx, qword [rsp + 0xc8]
mov rax, rcx
add rsp, 0xb0
pop rbp
ret

Function at 0x7ff6d1e44008
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x7ff6d1e43e34
Function at 0x1400011c0
Capabilities:
Get storage device properties

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x2980
call fcn.1400028d0
sub rsp, rax
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x2970], rax
mov rbx, rdx
lea rcx, [rsp + 0x60]
lea rdx, str..PhysicalDrive_u
xor r8d, r8d
xor dil, dil
call qword [sym.imp.USER32.dll_wsprintfW]
xor ebp, ebp
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], ebp
xor edx, edx
mov dword [rsp + 0x20], 3
lea r8d, [rbp + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x14000130f
xor edx, edx
mov qword [rsp + 0x44], rbp
mov r8d, 0x2710
mov dword [rsp + 0x40], ebp
lea rcx, [rsp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r9d, [rbp + 0xc]
lea rax, [rsp + 0x260]
mov dword [rsp + 0x28], 0x2710
lea r8, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov edx, 0x2d1400
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x140001306
mov eax, dword [rsp + 0x278]
test eax, eax
je 0x140001306
lea r9, [rsp + 0x260]
mov rdx, 0xffffffffffffffff
add r9, rax
nop dword [rax + rax]
inc rdx
cmp word [r9 + rdx*2], bp
jne 0x1400012c0
mov rax, qword [rbx + 0x18]
cmp rdx, rax
ja 0x1400012fb
mov rdi, rbx
cmp rax, 7
jbe 0x1400012df
mov rdi, qword [rbx]
mov qword [rbx + 0x10], rdx
mov rcx, rdi
lea rbx, [rdx + rdx]
mov rdx, r9
mov r8, rbx
call sub.VCRUNTIME140.dll_memmove
mov word [rbx + rdi], bp
jmp 0x140001303
mov rcx, rbx
call fcn.1400016c0
mov dil, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, dil
mov rcx, qword [rsp + 0x2970]
xor rcx, rsp
call fcn.140001a80
lea r11, [rsp + 0x2980]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x140002400
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000244a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000244a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000244a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000244a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000244a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000244c
xor al, al
add rsp, 0x28
ret
Function at 0x1400040d0
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x1b8
mov rax, qword [0x14000e230]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0xffffffffffffffff
jne 0x14000410a
xor al, al
jmp 0x1400041b8
mov dword [rsp + 0x70], 0x130
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x14000412d
xor al, al
jmp 0x1400041b8
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x9c]
mov rcx, qword [rsp + 0x30]
call fcn.140001b48
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140003be8
movzx eax, al
test eax, eax
je 0x140004197
mov r8b, byte [rsp + 0x20]
lea rdx, str.Cheat_detected
lea rcx, [rsp + 0x40]
call fcn.140004d00
mov rcx, rax
call fcn.1400041d0
mov rdx, rax
lea rcx, [0x14000e270]
call fcn.1400031a8
mov byte [0x14000e940], 1
mov al, 1
jmp 0x1400041b8
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14000412d
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.1400097f0
add rsp, 0x1b8
ret

Function at 0x140006318
Capabilities:
Create thread

Disassembly:
sub rsp, 0xe8
mov rax, qword [0x14000e230]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x140001a00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x140006392
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [0x1400062c8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rax, qword [rsp + 0x38]
jmp 0x14000642d
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [rsp + 0x68]
call fcn.14000598c
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov r8b, byte [rsp + 0x30]
lea rdx, str.Failed_to_create_the_thread._Error_code:
lea rcx, [rsp + 0x88]
call fcn.140008058
mov rcx, rax
call fcn.140006448
mov qword [rsp + 0x58], rax
mov r8, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xb8]
call fcn.140006ed8
nop
lea rcx, [rsp + 0x68]
call fcn.140001b20
lea rcx, [rsp + 0xb8]
call fcn.140009488
mov qword [rsp + 0x60], 0
lea rcx, [rsp + 0xb8]
call fcn.140001b20
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.1400097f0
add rsp, 0xe8
ret

Function at 0x14000939c
Capabilities:
Set console window title

Disassembly:
sub rsp, 0x48
xor eax, eax
test eax, eax
je 0x1400093d2
call fcn.1400092fc
mov r8b, byte [rsp + 0x20]
lea rdx, str.StandKnife_Debug
lea rcx, [rsp + 0x28]
call fcn.1400094b8
mov rcx, rax
call fcn.1400093d8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
add rsp, 0x48
ret
Function at 0x14000a3c8
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a412
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a412
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a412
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a412
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a412
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000a414
xor al, al
add rsp, 0x28
ret
Function at 0x1400039b0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
push r15
sub rsp, 0x48
xor r15d, r15d
lea rcx, str.C:Windows_system32_rdpxgj.dat
mov rdi, r8
mov qword [rsp + 0x30], r15
mov r14, rdx
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
mov dword [rsp + 0x20], 3
lea r8d, [r15 + 1]
mov edx, 0x80000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x140003a0c
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
ret
lea rdx, [rsp + 0x88]
mov qword [rsp + 0x40], rbp
mov rcx, rsi
mov qword [rsp + 0x88], r15
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
mov ebp, dword [rsp + 0x88]
mov ecx, 0x40
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [r14], rax
test rax, rax
jne 0x140003a61
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x40]
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
ret
mov qword [rsp + 0x78], rbx
mov ebx, ebp
mov dword [rdi], r15d
test ebp, ebp
jle 0x140003a9e
nop
mov rdx, qword [r14]
lea r9, [rsp + 0x70]
mov r8d, ebx
mov dword [rsp + 0x70], r15d
mov rcx, rsi
mov qword [rsp + 0x20], r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140003a9e
add dword [rdi], eax
sub ebx, eax
test ebx, ebx
jg 0x140003a70
mov rcx, rsi
mov rbx, qword [rsp + 0x78]
cmp dword [rdi], ebp
je 0x140003acb
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rbp, qword [rsp + 0x40]
xor al, al
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbp, qword [rsp + 0x40]
mov al, 1
add rsp, 0x48
pop r15
pop r14
pop rdi
pop rsi
ret

Function at 0x140003d80
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov edi, r8d
mov dword [rsp + 0x28], 0x80
mov rsi, rdx
mov dword [rsp + 0x68], 0
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
lea r8d, [r9 + 2]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rbx, rax
test rax, rax
je 0x140003dfa
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], 0
mov r8d, edi
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
test eax, eax
jne 0x140003e0c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x50]
mov al, 1
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret