joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008fb60
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov qword [rsp + 0x30], rbx
mov ecx, dword [0x140128630]
mov qword [rsp + 0x38], rdi
call fcn.14008e920
test al, al
jne 0x14008fbc3
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x14008fbc3
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x14008fbc3
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x14008fbc3
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x14008fc77
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14008fc57
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14008fc57
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x7eb8f75a
lea rcx, [rdi + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x14008fc52
nop
movsx ecx, cl
lea rdx, [rdx + 1]
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx - 1]
test cl, cl
jne 0x14008fc30
cmp r8d, 0xaf9b0fd2
je 0x14008fc5c
test r9d, r9d
jne 0x14008fc10
mov rax, qword [rax]
jmp 0x14008fbe0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x14008fcc7
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x14008fcc7
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x14008fcc7
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x14008fcc7
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x14008fd77
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14008fd57
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14008fd57
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xdee28306
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14008fd52
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14008fd30
cmp r8d, 0xc30fcb6e
je 0x14008fd5c
test r9d, r9d
jne 0x14008fd10
mov rax, qword [rax]
jmp 0x14008fce0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
cmp byte [rsi + 0x47], 0
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
je 0x14008fda3
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 0x46
jb 0x14008fd90
mov byte [rsi + 0x47], 0
mov rax, rsi
add rsp, 0x20
pop rsi
ret
Function at 0x140091c30
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x140091c89
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x140091c89
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x140091c89
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x140091c89
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140091d51
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140091d27
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140091d27
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xdee28306
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140091d22
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140091d00
cmp r8d, 0xc30fcb6e
je 0x140091d2c
test r9d, r9d
jne 0x140091ce0
mov rax, qword [rax]
jmp 0x140091cb0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 6], 0
je 0x140091d73
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 5
jb 0x140091d60
mov byte [rsi + 6], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140091d80
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x140091dd9
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x140091dd9
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x140091dd9
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x140091dd9
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140091ea1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140091e77
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140091e77
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xdee28306
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140091e72
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140091e50
cmp r8d, 0xc30fcb6e
je 0x140091e7c
test r9d, r9d
jne 0x140091e30
mov rax, qword [rax]
jmp 0x140091e00
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 7], 0
je 0x140091ec3
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 6
jb 0x140091eb0
mov byte [rsi + 7], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140091ed0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x140091f29
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x140091f29
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x140091f29
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x140091f29
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140091ff1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140091fc7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140091fc7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xdee28306
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140091fc2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140091fa0
cmp r8d, 0xc30fcb6e
je 0x140091fcc
test r9d, r9d
jne 0x140091f80
mov rax, qword [rax]
jmp 0x140091f50
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 0xa], 0
je 0x140092013
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 9
jb 0x140092000
mov byte [rsi + 0xa], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140092020
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x140092079
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x140092079
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x140092079
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x140092079
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140092141
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140092117
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140092117
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xdee28306
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140092112
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x1400920f0
cmp r8d, 0xc30fcb6e
je 0x14009211c
test r9d, r9d
jne 0x1400920d0
mov rax, qword [rax]
jmp 0x1400920a0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 0xb], 0
je 0x140092163
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 0xa
jb 0x140092150
mov byte [rsi + 0xb], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140092170
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x1400921c9
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x1400921c9
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x1400921c9
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x1400921c9
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140092291
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140092267
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140092267
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xdee28306
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140092262
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140092240
cmp r8d, 0xc30fcb6e
je 0x14009226c
test r9d, r9d
jne 0x140092220
mov rax, qword [rax]
jmp 0x1400921f0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
cmp byte [rsi + 0xd], 0
je 0x1400922b3
xor ecx, ecx
nop dword [rax]
lea eax, [rcx - 0x12]
xor byte [rcx + rsi], al
inc rcx
cmp rcx, 0xc
jb 0x1400922a0
mov byte [rsi + 0xd], 0
add rsp, 0x20
pop rsi
ret
Function at 0x140097ba0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1401210c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rdx
mov rbp, rcx
mov qword [rsp + 0x20], rdx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x140097c16
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x140097c16
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x140097c16
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x140097c16
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x140097cc6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140097ca6
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140097ca6
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x520c0c7f
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140097ca1
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140097c80
cmp r8d, 0x6957b0ff
je 0x140097cab
test r9d, r9d
jne 0x140097c60
mov rax, qword [rax]
jmp 0x140097c30
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rbx + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rdx, str.success
mov rcx, rsi
call fcn.14007b160
lea rcx, [rax + 8]
xor ebx, ebx
cmp byte [rax], 4
cmovne rcx, rbx
movzx eax, byte [rcx]
mov byte [rbp + 0x210], al
lea rdx, str.message
mov rcx, rsi
call fcn.14007b160
cmp byte [rax], 3
jne 0x140097d03
mov rbx, qword [rax + 8]
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140097d10
mov rdx, qword [rbx]
lea rcx, [rbp + 0x218]
mov r8, qword [rbx + 0x10]
call fcn.1400777c0
nop
lea rcx, [rsi + 8]
movzx edx, byte [rsi]
call fcn.140076e90
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400eaeb0
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x140098680
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov rax, qword [0x1401210c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
mov r9, qword [r11 + 0x30]
xor r14d, r14d
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140098738
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140098738
mov edi, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x5baedbec
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140098733
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140098710
cmp edx, 0x8ae4d9c0
je 0x1400987fb
test r8d, r8d
jne 0x1400986f0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14009874d
cmp qword [rax + 0x30], r14
jne 0x1400986c0
mov rbp, r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400987e4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400987e4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x5caedd7f
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400987df
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400987c0
cmp edx, 0x10d0b68b
je 0x140098817
test r8d, r8d
jne 0x1400987a0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x14009882f
cmp qword [rax + 0x30], r14
jne 0x140098770
jmp 0x14009882f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x140098750
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
call r14
lea rdx, [rsp + 0x20]
mov rcx, rax
call rbp
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1400eaeb0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x14009b2a0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x14009b300
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x14009b300
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x14009b300
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x14009b300
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x14009b3c1
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009b397
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009b397
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc298db10
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14009b392
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14009b370
cmp r8d, 0xbb744aa0
je 0x14009b39c
test r9d, r9d
jne 0x14009b350
mov rax, qword [rax]
jmp 0x14009b320
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.140091c30
lea r8, [rbp + 5]
mov rdx, rbp
lea r9, [rsp + 0x48]
mov rcx, rsi
call fcn.140080a20
mov rbp, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x14009b3f0
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x14009b450
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x14009b450
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x14009b450
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x14009b450
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x14009b511
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009b4e7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009b4e7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc298db10
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14009b4e2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14009b4c0
cmp r8d, 0xbb744aa0
je 0x14009b4ec
test r9d, r9d
jne 0x14009b4a0
mov rax, qword [rax]
jmp 0x14009b470
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.140091d80
lea r8, [rbp + 6]
mov rdx, rbp
lea r9, [rsp + 0x48]
mov rcx, rsi
call fcn.140080a20
mov rbp, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop rsi
ret
Function at 0x14009ba20
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate gui resources
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x30
mov rbp, rcx
mov rsi, rdx
mov ecx, dword [0x140128630]
call fcn.14008e920
test al, al
jne 0x14009ba80
mov ecx, dword [0x140128634]
call fcn.14008e920
test al, al
jne 0x14009ba80
mov ecx, dword [0x140128638]
call fcn.14008e920
test al, al
jne 0x14009ba80
mov ecx, dword [0x14012863c]
call fcn.14008e920
test al, al
jne 0x14009ba80
xor edx, edx
lea rcx, [0x14008b390]
call qword [sym.imp.USER32.dll_EnumWindows]
jmp 0x14009bb41
mov rax, qword gs:[0x60]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rdi
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x14009bb17
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x14009bb17
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xc298db10
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x14009bb12
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x14009baf0
cmp r8d, 0xbb744aa0
je 0x14009bb1c
test r9d, r9d
jne 0x14009bad0
mov rax, qword [rax]
jmp 0x14009baa0
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
xor ecx, ecx
add rax, r10
call rax
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x40]
mov rcx, rbp
call fcn.140091ed0
lea r8, [rbp + 9]
mov rdx, rbp
lea r9, [rsp + 0x48]
mov rcx, rsi
call fcn.140080a20
mov rbp, qword [rsp + 0x58]
mov rax, rsi
add rsp, 0x30
pop rsi
ret