joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002f300
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14002f32d
xor eax, eax
jmp 0x14002f499
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x14002f367
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x14002f367
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x14002f499
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x14002f48c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x14002f3aa
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x14002f3d5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002f491
lea rax, [rsp + 0x48]
mov byte [rsp + 0x40], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x41]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x40]
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002f444
sub eax, 1
je 0x14002f444
cmp eax, 2
jne 0x14002f48c
movsx ecx, byte [rsp + 0x40]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x14002f491
mov rsi, qword [rsp + 0x48]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x14002f472
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x14002f48c
lea rax, [rsp + 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x50], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x14002f491
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004dd20
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x14002f810
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x14002f8e3
cmp byte [rcx + 0x71], 0
je 0x14002f8e3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14002f8df
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x14002f8a4
sub eax, 1
je 0x14002f8a8
cmp eax, 2
jne 0x14002f8df
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004dd20
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x14002f8d6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14002f8df
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14002f88c
xor al, al
jmp 0x14002f88c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.14004dd20
add rsp, 0x60
pop rbx
ret
Function at 0x1400305b0
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x28], rdx
xor esi, esi
mov edx, 0x100
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [rsp + 0x70]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x140030613
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x50]
call fcn.14002fad0
nop
mov r8d, 9
lea rdx, str.INFLSM_
lea rcx, [rsp + 0x50]
call fcn.14004b710
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x1400306bc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400306b6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400306b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e134
nop
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x1400306c9
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
lea rcx, [rsp + 0x30]
call fcn.14004b710
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 7
mov word [rax], si
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140030748
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030742
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140030742
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e134
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x140030783
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14003077e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400307ba
mov rcx, r8
call fcn.14004e134
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rax, rdi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14004dd20
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1400307d0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 7
mov rbx, rdx
mov rdi, rcx
mov r9, rdx
jbe 0x1400307f2
mov r9, qword [rdx]
cmp qword [rcx + 0x18], 7
mov r8, rdi
jbe 0x1400307ff
mov r8, qword [rcx]
xor esi, esi
lea rdx, str.runas
mov dword [rsp + 0x28], esi
xor ecx, ecx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140030854
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14003084f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400308bd
mov rcx, r8
call fcn.14004e134
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
mov rdx, qword [rbx + 0x18]
cmp rdx, 7
jbe 0x14003089e
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x140030899
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400308bd
mov rcx, r8
call fcn.14004e134
mov qword [rbx + 0x10], rsi
mov word [rbx], si
mov rsi, qword [rsp + 0x58]
mov qword [rbx + 0x18], 7
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x1400308d0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x1400308f2
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140030986
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140030965
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140030960
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140030a2f
mov rcx, r8
call fcn.14004e134
mov al, 1
mov rsi, qword [rsp + 0x78]
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x1400309cb
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x1400309c7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400309c2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140030a2f
mov rcx, r8
call fcn.14004e134
xor al, al
jmp 0x140030967
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x21a00
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400d40c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140030a18
cmp rax, 7
jbe 0x1400309c7
lea rdx, [rax*2 + 2]
jmp 0x14003099e
cmp rax, 7
jbe 0x140030965
lea rdx, [rax*2 + 2]
jmp 0x140030938
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140030a40
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x140030a62
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x140030af6
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140030ad5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140030ad0
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140030b9f
mov rcx, r8
call fcn.14004e134
mov al, 1
mov rsi, qword [rsp + 0x78]
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rbp, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x140030b3b
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x140030b37
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140030b32
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140030b9f
mov rcx, r8
call fcn.14004e134
xor al, al
jmp 0x140030ad7
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2000
mov qword [rsp + 0x20], rbp
lea rdx, [0x1400d20c0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x140030b88
cmp rax, 7
jbe 0x140030b37
lea rdx, [rax*2 + 2]
jmp 0x140030b0e
cmp rax, 7
jbe 0x140030ad5
lea rdx, [rax*2 + 2]
jmp 0x140030aa8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x140030bb0
Capabilities:
Delete file
Terminate process

Disassembly:
push rbx
sub rsp, 0xe0
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0xd0], rax
lea rdx, str.er7VEBcx.sys
lea rcx, [rsp + 0xb0]
call fcn.14002f630
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.1400305b0
nop
lea rdx, str.0UhClpoZ.exe
lea rcx, [rsp + 0x28]
call fcn.14002f630
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.1400305b0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xb0]
call fcn.14004a7b0
nop
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.14004a7b0
mov rcx, rax
call fcn.140030a40
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x28]
call fcn.14004a7b0
mov rcx, rax
call fcn.1400308d0
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x28]
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x28]
call fcn.14004a7b0
mov rbx, rax
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.14004a7b0
nop
mov rdx, rbx
mov rcx, rax
call fcn.1400307d0
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x70]
call fcn.14002f5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rsp + 0x90]
call fcn.14002f5b0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
Function at 0x140030ce0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140030d58
nop word [rax + rax]
lea rdx, str.VALORANT_Win64_Shipping.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140030d80
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140030d30
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1400f7008]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14004dd20
add rsp, 0x270
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x1400f7008], eax
jmp 0x140030d67

Function at 0x140030da0
Capabilities:
Terminate process

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rbx, rcx
mov esi, r8d
mov rcx, qword [0x1400f70d0]
mov rdi, rdx
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x140030de3
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov eax, dword [0x1400f7008]
lea r8, [rsp + 0x40]
xor ecx, ecx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x38], rcx
mov r9d, 0x40
mov qword [rsp + 0x30], rcx
mov edx, 0x3667c58
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x61], ecx
mov word [rsp + 0x65], cx
mov byte [rsp + 0x67], cl
mov byte [rsp + 0x60], cl
mov rcx, qword [0x1400f7000]
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x68], 0x7bfef4c
mov qword [rsp + 0x70], 0xa3dcf6c
mov qword [rsp + 0x78], 0xf5a8672
call qword [0x1400f73f8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.14004dd20
add rsp, 0x90
pop rdi
pop rsi
pop rbx
ret

Function at 0x140030ef0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
mov dword [rsp + 0x20], 0x238
mov ecx, 2
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140030f50
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x140030f7a
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, rbx
test eax, eax
je 0x140030f72
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140030f38
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14004dd20
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
Function at 0x140039640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.14004eff0
sub rsp, rax
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov qword [rsp + 0x20], rcx
mov eax, edx
sar eax, 0x10
mov rdi, rcx
mov ebx, edx
xor esi, esi
lea ecx, [rax*8 + 0x10]
mov rax, qword [0x1400f6ff8]
add rax, 0xa7b6780
add rcx, rax
call fcn.14004c0e0
mov rcx, rax
xor edx, edx
movzx eax, bx
mov r8d, 0x808
lea rbx, [rcx + rax*4]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x808
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.140030da0
lea rcx, [rsp + 0x840]
mov r8d, 0x808
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x1400f6fc8]
call fcn.14004c0e0
mov qword [rsp + 0x20], rax
movzx r8d, si
movzx eax, word [rsp + 0x34]
shr ax, 1
cmp si, ax
jae 0x140039731
movzx ecx, r8w
lea rdx, [rsp + 0x846]
add rdx, rcx
movzx ecx, r8b
and ecx, 3
inc r8w
xor al, byte [rsp + rcx + 0x20]
xor byte [rdx], al
movzx eax, word [rsp + 0x844]
shr ax, 1
cmp r8w, ax
jb 0x140039700
xorps xmm0, xmm0
lea rax, [rsp + 0x846]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
nop
inc r8
cmp byte [rax + r8], sil
jne 0x140039750
lea rdx, [rsp + 0x846]
mov rcx, rdi
call fcn.14002fc00
mov rax, rdi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14004dd20
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x140044f20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
mov rdx, rcx
je 0x140045065
movdqa xmm3, xmmword [0x1400c76c0]
lea r8, [rcx + 8]
movdqa xmm4, xmmword [0x1400c7890]
xor eax, eax
mov r9d, 0x4df6
nop dword [rax]
movd xmm1, dword [r8 - 8]
lea rcx, [r9 - 5]
xorps xmm0, xmm0
lea r8, [r8 + 0x10]
punpcklwd xmm1, xmm0
movq xmm2, rax
punpckldq xmm1, xmm0
add rax, 8
punpcklqdq xmm2, xmm2
paddq xmm2, xmm4
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 3]
movd dword [r8 - 0x18], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x14]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
lea rcx, [r9 - 1]
movd dword [r8 - 0x14], xmm1
xorps xmm0, xmm0
movd xmm1, dword [r8 - 0x10]
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
punpcklqdq xmm2, xmm2
paddq xmm2, xmm3
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
movq xmm2, rcx
pshuflw xmm1, xmm0, 0xd8
movq xmm0, r9
movd dword [r8 - 0x10], xmm1
add r9, 8
movd xmm1, dword [r8 - 0xc]
punpcklqdq xmm2, xmm0
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 0xc], xmm1
cmp r9, 0x4e06
jb 0x140044f50
cmp rax, 0x11
jae 0x140045061
mov r8d, 0x4def
nop word [rax + rax]
lea ecx, [r8 + rax]
xor word [rdx + rax*2], cx
inc rax
cmp rax, 0x11
jb 0x140045050
mov byte [rdx + 0x24], 0
mov rax, rdx
ret
Function at 0x140049b50
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x80
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x78], rax
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0x80
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
mov ecx, 8
call fcn.14004e328
lea rcx, [0x140030fa0]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14004db00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x140049d20
mov ecx, 8
call fcn.14004e328
lea rcx, [0x140033330]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14004db00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140049d10
lea rdx, str.Turkish
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_setlocale]
lea rcx, str.Fp2t49b5
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginMutation]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
lea r8, [0x140046370]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
lea rcx, [rsp + 0x58]
call fcn.140046550
nop
lea rcx, [rsp + 0x58]
call fcn.1400481d0
call fcn.140036010
call fcn.140049450
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140049cc9
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049cc4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049cc4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004e134
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
cmp dword [rsp + 0x40], 0
je 0x140049cea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp dword [rsp + 0x50], 0
je 0x140049cf8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
int3
xor eax, eax
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.14004dd20
add rsp, 0x80
pop rbx
ret
mov dword [rsp + 0x40], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x50], ebx
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x14004bff0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov dword [rsp + 0x40], 0
mov rcx, qword [0x1400f70d0]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14004c033
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor ecx, ecx
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x38], rcx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rcx
lea r8, [rsp + 0x50]
mov dword [rsp + 0x28], ecx
mov r9d, 0x40
mov qword [rsp + 0x20], rcx
mov edx, 0x3667c58
mov dword [rsp + 0x54], ecx
mov dword [rsp + 0x71], ecx
mov word [rsp + 0x75], cx
mov byte [rsp + 0x77], cl
mov qword [rsp + 0x60], rax
mov eax, dword [0x1400f7008]
mov byte [rsp + 0x70], cl
mov rcx, qword [0x1400f7000]
mov qword [rsp + 0x68], 4
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x78], 0x7bfef4c
mov qword [rsp + 0x80], 0xa3dcf6c
mov qword [rsp + 0x88], 0xf5a8672
call qword [0x1400f73f8]
movss xmm0, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14004dd20
add rsp, 0xa0
pop rbx
ret

Function at 0x14004c0e0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xa0
mov rax, qword [0x1400d2040]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
xor edi, edi
mov rcx, qword [0x1400f70d0]
mov qword [rsp + 0x40], rdi
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14004c126
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rcx, qword [0x1400f7000]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x38], rdi
lea r8, [rsp + 0x50]
mov qword [rsp + 0x60], rax
mov r9d, 0x40
mov eax, dword [0x1400f7008]
mov edx, 0x3667c58
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x50], eax
mov dword [rsp + 0x54], edi
mov dword [rsp + 0x71], edi
mov word [rsp + 0x75], di
mov byte [rsp + 0x77], dil
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x68], 8
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x78], 0x7bfef4c
mov qword [rsp + 0x80], 0xa3dcf6c
mov qword [rsp + 0x88], 0xf5a8672
mov qword [rsp + 0x20], rdi
call qword [0x1400f73f8]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.14004dd20
mov rbx, qword [rsp + 0xb8]
add rsp, 0xa0
pop rdi
ret