joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140011c70
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400da060]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14010c8c0]
mov edi, edx
cmp byte [rbx + 0x212d], 0
jne 0x140011cd1
cmp byte [rbx + 0x212e], 0
jne 0x140011cd1
movsx r9d, word [rbx + 0x321e]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140002c10
test dil, 1
je 0x140011e07
jmp 0x140011d61
movss xmm1, dword [rbx + 0x1708]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x321e]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400c967c]
mulss xmm1, dword [0x1400c9670]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1e44], rax
mov dword [rbx + 0x1e2c], 1
movss dword [rbx + 0x1e3c], xmm0
mov byte [rbx + 0x1e64], 1
movss dword [rbx + 0x1e40], xmm1
movss xmm0, dword [rbx + 0x1764]
mulss xmm0, dword [0x1400c95d4]
or dword [rbx + 0x1e28], 0x41
movss dword [rbx + 0x1e88], xmm0
call fcn.140002c10
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov edx, r10d
test r9b, r9b
je 0x140011db1
lea r11, [0x1400c14c0]
cmp r9b, 0x23
jne 0x140011d94
cmp byte [r8], r9b
jne 0x140011d94
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x140011d81
mov rcx, qword [0x14010c8c0]
not edx
add rcx, 0x1d08
call fcn.1400032b0
test rax, rax
je 0x140011e07
cmp byte [rax + 0xc7], 0
je 0x140011e07
mov byte [rax + 0xce], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xe8], 1
lea rcx, [rsp + 0x20]
inc word [rbx + 0x321e]
mov edx, reloc.WS2_32.dll_recv
movsx r9d, word [rbx + 0x321e]
call fcn.140002c10
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.14000d7a0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400af130
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x1400177a0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x1400177f2
lea r11, [0x1400c14c0]
cmp r9b, 0x23
jne 0x1400177d5
cmp byte [r8], r9b
jne 0x1400177d5
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400177c2
mov r11, qword [0x14010c8c0]
mov r10, qword [r11 + 0x32d0]
test r10, r10
je 0x140017839
lea r9, [r10 + 4]
test r9, r9
je 0x140017839
not eax
cmp dword [r9], eax
je 0x140017842
movsxd r8, dword [r9 - 4]
lea rdx, [r10 + 4]
movsxd rcx, dword [r11 + 0x32c8]
add r8, r9
xor r9d, r9d
add rdx, rcx
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x140017810
mov rcx, rbx
pop rbx
jmp fcn.1400176b0
mov rax, r9
pop rbx
ret
Function at 0x14001ad90
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x14001af94
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x1400da060]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x18]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400c14c0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x18]
test edx, edx
je 0x14001af5c
mov rcx, rbp
call fcn.14001a460
mov edx, dword [rdi - 0x14]
mov rbx, rax
test edx, edx
je 0x14001ae0e
lea rcx, [rbp + 0x3268]
call fcn.1400032b0
mov rcx, rax
jmp 0x14001ae10
xor ecx, ecx
mov qword [rbx + 0x18], rcx
movsx eax, word [rdi]
movd xmm1, eax
movsx eax, word [rdi + 2]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 4]
movd xmm1, eax
movsx eax, word [rdi + 6]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x50], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
movsx eax, word [rdi + 8]
movd xmm1, eax
movsx eax, word [rdi + 0xa]
and dword [rbx + 0xbc], 0xfffffe49
or dword [rbx + 0xbc], 0x49
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x58], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x5c], xmm0
test rcx, rcx
je 0x14001aea1
cmp qword [rcx + 0x20], 0
jne 0x14001ae96
mov qword [rcx + 0x20], rbx
jmp 0x14001aea1
cmp qword [rcx + 0x28], 0
jne 0x14001aea1
mov qword [rcx + 0x28], rbx
mov eax, dword [rdi - 0xc]
mov dword [rbx + 0xb4], eax
movsx eax, byte [rdi - 8]
mov dword [rbx + 0x60], eax
mov ecx, dword [rdi - 4]
mov eax, dword [rbx + 0xc]
and ecx, 0xc1fc20
or eax, dword [rbx + 4]
or eax, ecx
mov dword [rbx + 8], ecx
mov dword [rbx + 0x10], eax
mov rcx, rbx
mov rax, qword [rbx + 0x18]
test rax, rax
je 0x14001aee0
mov rcx, rax
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14001aed4
mov r9d, dword [rcx]
lea r8, str.DockNode__02X
lea rcx, [rsp + 0x20]
mov edx, reloc.WS2_32.dll_sendto
call fcn.140002c10
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov edx, r14d
test r9b, r9b
je 0x14001af40
nop dword [rax]
cmp r9b, 0x23
jne 0x14001af23
cmp byte [r8], r9b
jne 0x14001af23
cmp byte [r8 + 1], r9b
cmove edx, r14d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r15 + rcx*4]
test r9b, r9b
jne 0x14001af10
mov rcx, qword [0x14010c8c0]
not edx
add rcx, 0x1d08
call fcn.1400032b0
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x14001ade0
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400af130
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x14003d950
Capabilities:
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x20
mov rsi, rdx
test r8, r8
je 0x14003d9e0
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x14003d9b0
lea r11, [0x1400c14c0]
nop
cmp r9b, 0x23
jne 0x14003d993
cmp byte [r8], r9b
jne 0x14003d993
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14003d980
mov rcx, qword [0x14010c8c0]
not eax
cmp dword [rcx + 0x1d7c], eax
jne 0x14003d9c7
mov dword [rcx + 0x1d80], eax
cmp dword [rcx + 0x1db8], eax
jne 0x14003da57
mov byte [rcx + 0x1dbc], 1
add rsp, 0x20
pop rsi
ret
mov qword [rsp + 0x30], rbx
xor edx, edx
mov qword [rsp + 0x38], rdi
mov rdi, qword [0x14010c8c0]
mov rax, qword [rdi + 0x1d28]
movsxd rcx, dword [rax + 0x100]
mov rax, qword [rax + 0x108]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, rsi
call fcn.140002d20
mov ebx, eax
cmp dword [rdi + 0x1d7c], eax
jne 0x14003da25
mov dword [rdi + 0x1d80], eax
cmp dword [rdi + 0x1db8], ebx
jne 0x14003da34
mov byte [rdi + 0x1dbc], 1
cmp dword [rdi + 0x1d64], ebx
mov rdi, qword [rsp + 0x38]
jne 0x14003da50
mov r8, rsi
mov edx, ntohl
mov ecx, ebx
call fcn.1400221b0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret
Function at 0x1400449e0
Capabilities:
Execute command
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xc0
lea rax, str..NiGgEr
xor edi, edi
mov qword [rsp + 0x40], rax
mov ebx, edi
lea rax, str..KsDumper
mov qword [rsp + 0x48], rax
nop dword [rax]
mov rcx, qword [rsp + rbx*8 + 0x40]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x140044a5c
inc rbx
cmp rbx, 2
jl 0x140044a10
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
movdqa xmm0, xmmword [0x1400c9990]
lea rcx, [rsp + 0x50]
movdqa xmm1, xmmword [0x1400c9f40]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x1400c9fb0]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm1, xmmword [0x1400c9f80]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x1400c9f30]
movdqa xmmword [rsp + 0x80], xmm1
movdqa xmm1, xmmword [0x1400ca000]
movdqa xmmword [rsp + 0x90], xmm0
movdqa xmmword [rsp + 0xa0], xmm1
mov dword [rsp + 0xb0], 0xbda5a1f0
mov word [rsp + 0xb4], 0x100
call fcn.140044af0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3

Function at 0x140044af0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x65], 0
je 0x140044b13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x64
jb 0x140044b00
mov byte [rcx + 0x65], 0
mov rax, rcx
ret
Function at 0x1400450b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 7], r8b
je 0x1400450e3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 6
jb 0x1400450d0
mov byte [rdx + 7], r8b
lea rcx, [rdx + 6]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004510c
mov r8d, 6
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140045120
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xd], r8b
je 0x140045153
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xc
jb 0x140045140
mov byte [rdx + 0xd], r8b
lea rcx, [rdx + 0xc]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004517c
mov r8d, ntohl
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140045190
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 8], r8b
je 0x1400451c3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 7
jb 0x1400451b0
mov byte [rdx + 8], r8b
lea rcx, [rdx + 7]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1400451ec
mov r8d, 7
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140045200
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x10], r8b
je 0x140045233
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xf
jb 0x140045220
mov byte [rdx + 0x10], r8b
lea rcx, [rdx + 0xf]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004525c
mov r8d, reloc.WS2_32.dll_ntohs
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140045270
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xf], r8b
je 0x1400452a3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xe
jb 0x140045290
mov byte [rdx + 0xf], r8b
lea rcx, [rdx + 0xe]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1400452cc
mov r8d, reloc.WS2_32.dll_ntohl
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret
Function at 0x1400452e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x12], r8b
je 0x140045313
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x11
jb 0x140045300
mov byte [rdx + 0x12], r8b
lea rcx, [rdx + 0x11]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004533c
mov r8d, reloc.WS2_32.dll_recvfrom
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140045350
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x16], r8b
je 0x140045383
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0x15
jb 0x140045370
mov byte [rdx + 0x16], r8b
lea rcx, [rdx + 0x15]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x1400453ac
mov r8d, reloc.WS2_32.dll_setsockopt
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400453c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xe], r8b
je 0x1400453f3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 0xd
jb 0x1400453e0
mov byte [rdx + 0xe], r8b
lea rcx, [rdx + 0xd]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004541c
mov r8d, reloc.WS2_32.dll_listen
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140045430
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 9], r8b
je 0x140045463
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 8
jb 0x140045450
mov byte [rdx + 9], r8b
lea rcx, [rdx + 8]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004548c
mov r8d, 8
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400454a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2b], 0
je 0x1400454c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2a
jb 0x1400454b0
mov byte [rcx + 0x2b], 0
ret
Function at 0x1400454d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 4], r8b
je 0x140045503
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 3
jb 0x1400454f0
mov byte [rdx + 4], r8b
lea rcx, [rdx + 3]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004552c
mov r8d, 3
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140045540
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor r8d, r8d
lea rbx, [0x14010cb58]
mov rdx, rcx
cmp byte [rcx + 0xb], r8b
je 0x140045573
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x140045560
mov byte [rdx + 0xb], r8b
lea rcx, [rdx + 0xa]
mov qword [0x14010cb58], r8
mov qword [0x14010cb68], r8
mov qword [0x14010cb70], 0xf
cmp rdx, rcx
je 0x1400455a3
mov r8d, 0xa
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400455b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xa], r8b
je 0x1400455e3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x6e]
xor byte [rcx + rdx], al
inc rcx
cmp rcx, 9
jb 0x1400455d0
mov byte [rdx + 0xa], r8b
lea rcx, [rdx + 9]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004560c
mov r8d, 9
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x1400458c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1400458e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x1400458d0
mov byte [rcx + 0xd], 0
ret

Function at 0x1400458f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x140045913
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x6e]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x140045900
mov byte [rcx + 0xa], 0
ret
Function at 0x140046ec0
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x1400da060]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140046f2b
lea rdx, str.FiveM_b2545_GTAProcess.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x140046f4f
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140046f03
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400af130
add rsp, 0x270
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
jmp 0x140046f36
Function at 0x140047290
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov r8, qword [rdx + 0x10]
mov rbx, rdx
xor edx, edx
mov dword [rsp + 0x20], 4
mov r9d, 0x3000
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rbp, rax
test rax, rax
jne 0x140047305
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1400472fe
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400472f9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400473b5
mov rcx, r8
call fcn.1400af708
xor edi, edi
jmp 0x140047399
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x140047312
mov r8, qword [rbx]
mov r9, qword [rbx + 0x10]
xor edi, edi
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140047363
mov r9, qword [0x1400b32b8]
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor edx, edx
mov dword [rsp + 0x28], edi
mov rcx, rsi
mov qword [rsp + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140047363
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140047399
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140047394
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400473b5
mov rcx, r8
call fcn.1400af708
mov byte [rbx], dil
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14004a170
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x1e], r8b
je 0x14004a1a3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x22]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x1d
jb 0x14004a190
mov byte [rdx + 0x1e], r8b
lea rcx, [rdx + 0x1d]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004a1cc
mov r8d, Ordinal_32
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14004a1e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x59], r8b
je 0x14004a213
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x22]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x58
jb 0x14004a200
mov byte [rdx + 0x59], r8b
lea rcx, [rdx + 0x58]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004a23c
mov r8d, 0x58
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14004a250
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x14004a273
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x14004a260
mov byte [rcx + 0x14], 0
ret

Function at 0x14004a280
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x14004a2a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x22]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x14004a290
mov byte [rcx + 0x17], 0
ret

Function at 0x14004a2b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x5b], r8b
je 0x14004a2e3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x22]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x5a
jb 0x14004a2d0
mov byte [rdx + 0x5b], r8b
lea rcx, [rdx + 0x5a]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004a30c
mov r8d, 0x5a
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x14004a320
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0x26], r8b
je 0x14004a353
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x22]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 0x25
jb 0x14004a340
mov byte [rdx + 0x26], r8b
lea rcx, [rdx + 0x25]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x14004a37c
mov r8d, Ordinal_41
mov rcx, rbx
call fcn.140045b30
mov rax, rbx
add rsp, 0x30
pop rbx
ret