joyce8/EMBER2024-capa huggingface dataset:
Function at 0x540140
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x540389
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x540374
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x540182
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x54019c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call fcn.00532660
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x5402b1
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call fcn.004703e0
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006d1250]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call fcn.0044f2a0
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call fcn.00403d00
xorps xmm15, xmm15
mov r14, qword [0x00887b60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x54027b
xor eax, eax
lea rbx, [0x006d1378]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x006460d8]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call fcn.0044f360
jmp 0x5402a8
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x006d1238]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call fcn.0044f2a0
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call fcn.004703e0
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call fcn.00403d00
xorps xmm15, xmm15
mov r14, qword [0x00887b60]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x54033e
xor eax, eax
lea rbx, [0x006d1378]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x006460d8]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call fcn.0044f360
jmp 0x54036b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006d1238]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call fcn.0044f2a0
add rsp, 0xa8
pop rbp
ret
lea rax, [0x00646631]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call fcn.00464360
mov rax, qword [rsp + 8]
jmp fcn.00540140
Function at 0x55cdc0
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x55cde2
cmp rbx, 9
jg 0x55cde2
xor ecx, ecx
mov edx, 0x9acb0442
nop
jmp 0x55cdf9
xor eax, eax
add rsp, 0x10
pop rbp
ret
movzx esi, byte [rax + rcx]
xor edx, esi
inc rcx
imul edx, edx, 0x1000193
cmp rbx, rcx
jg 0x55cdea
mov esi, edx
and edx, 7
lea rdi, [0x007ef0a0]
mov r8d, dword [rdi + rdx*4]
movzx r9d, r8b
cmp rbx, r9
jne 0x55ce56
mov r10d, r8d
shr r8d, 8
lea ecx, [r9 + r8]
cmp rcx, 0x2a
ja 0x55cf25
cmp r8, rcx
ja 0x55cf1b
sub rcx, r8
mov r9, rcx
neg r9
sar r9, 0x3f
and r8, r9
lea r9, [0x00656470]
add r8, r9
xor edx, edx
jmp 0x55ceea
shr esi, 0x10
and esi, 7
mov esi, dword [rdi + rsi*4]
movzx edi, sil
cmp rbx, rdi
jne 0x55ce9a
mov r8d, esi
shr esi, 8
lea ecx, [rsi + rdi]
cmp rcx, 0x2a
ja 0x55cedd
cmp rsi, rcx
ja 0x55ced6
sub rcx, rsi
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rsi, rdx
lea rdx, [0x00656470]
add rdx, rsi
xor esi, esi
jmp 0x55cea5
xor eax, eax
add rsp, 0x10
pop rbp
ret
inc rsi
cmp rbx, rsi
jle 0x55cec5
cmp rsi, rcx
jae 0x55cece
movzx edi, byte [rsi + rdx]
movzx r9d, byte [rsi + rax]
cmp r9b, dil
je 0x55cea2
xor eax, eax
add rsp, 0x10
pop rbp
ret
mov eax, r8d
add rsp, 0x10
pop rbp
ret
mov rax, rsi
call fcn.00466620
mov eax, esi
call fcn.004666e0
mov edx, 0x2a
call fcn.00466660
inc rdx
cmp rbx, rdx
jle 0x55cf0a
cmp rdx, rcx
jae 0x55cf13
movzx r9d, byte [rdx + r8]
movzx r11d, byte [rax + rdx]
nop
cmp r11b, r9b
je 0x55cee7
jmp 0x55ce56
mov eax, r10d
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call fcn.00466620
mov eax, r8d
nop
call fcn.004666e0
mov edx, 0x2a
call fcn.00466660
nop
int3
Function at 0x576300
Capabilities:
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
je 0x576322
cmp rbx, 9
jg 0x576322
xor ecx, ecx
mov edx, 0x9acb0442
nop
jmp 0x576339
xor eax, eax
add rsp, 0x10
pop rbp
ret
movzx esi, byte [rax + rcx]
xor edx, esi
inc rcx
imul edx, edx, 0x1000193
cmp rbx, rcx
jg 0x57632a
mov esi, edx
and edx, 0xf
lea rdi, [0x007eff40]
mov r8d, dword [rdi + rdx*4]
movzx r9d, r8b
cmp rbx, r9
jne 0x576396
mov r10d, r8d
shr r8d, 8
lea ecx, [r9 + r8]
cmp rcx, 0x2b
ja 0x576465
cmp r8, rcx
ja 0x57645b
sub rcx, r8
mov r9, rcx
neg r9
sar r9, 0x3f
and r8, r9
lea r9, [0x00656774]
add r8, r9
xor edx, edx
jmp 0x57642a
shr esi, 0x10
and esi, 0xf
mov esi, dword [rdi + rsi*4]
movzx edi, sil
cmp rbx, rdi
jne 0x5763da
mov r8d, esi
shr esi, 8
lea ecx, [rsi + rdi]
cmp rcx, 0x2b
ja 0x57641d
cmp rsi, rcx
ja 0x576416
sub rcx, rsi
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rsi, rdx
lea rdx, [0x00656774]
add rdx, rsi
xor esi, esi
jmp 0x5763e5
xor eax, eax
add rsp, 0x10
pop rbp
ret
inc rsi
cmp rbx, rsi
jle 0x576405
cmp rsi, rcx
jae 0x57640e
movzx edi, byte [rsi + rdx]
movzx r9d, byte [rsi + rax]
cmp r9b, dil
je 0x5763e2
xor eax, eax
add rsp, 0x10
pop rbp
ret
mov eax, r8d
add rsp, 0x10
pop rbp
ret
mov rax, rsi
call fcn.00466620
mov eax, esi
call fcn.004666e0
mov edx, 0x2b
call fcn.00466660
inc rdx
cmp rbx, rdx
jle 0x57644a
cmp rdx, rcx
jae 0x576453
movzx r9d, byte [rdx + r8]
movzx r11d, byte [rax + rdx]
nop
cmp r11b, r9b
je 0x576427
jmp 0x576396
mov eax, r10d
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call fcn.00466620
mov eax, r8d
nop
call fcn.004666e0
mov edx, 0x2b
call fcn.00466660
nop
int3
Function at 0x578e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov rdx, qword [rax]
mov rbx, qword [rdx + 0x18]
mov rcx, qword [rdx + 8]
cmp rcx, rbx
jbe 0x578f4d
mov rsi, qword [rdx]
mov rdi, qword [rax + 0x28]
mov r8, qword [rax + 0x20]
movzx r9d, byte [rsi + rbx]
xor r10d, r10d
jmp 0x578e80
test r9b, r9b
jne 0x578e58
mov rsi, qword [rdx + 0x28]
test rsi, rsi
jne 0x578e53
lea rsi, [rcx - 1]
cmp rbx, rsi
jl 0x578e51
mov rsi, qword [0x0081d570]
jmp 0x578e53
xor esi, esi
test rsi, rsi
jne 0x578ea7
cmp r9b, 0x22
je 0x578e66
nop
cmp r9b, 0x27
jne 0x578e71
inc rbx
mov qword [rdx + 0x18], rbx
xor ecx, ecx
jmp 0x578ec3
inc rbx
mov qword [rdx + 0x18], rbx
jmp 0x578e08
inc r10
nop dword [rax]
cmp r10, rdi
jge 0x578ea7
lea r11, [r10 + rbx]
movzx r12d, byte [r8 + r10]
cmp rcx, r11
jbe 0x578f45
movzx r11d, byte [r11 + rsi]
nop dword [rax]
cmp r11b, r12b
je 0x578e7a
jmp 0x578e31
test r9b, r9b
je 0x578eb5
lea rax, [rdi + rbx]
nop
mov qword [rdx + 0x18], rax
add rsp, 0x10
pop rbp
ret
inc rbx
nop
mov qword [rdx + 0x18], rbx
mov rdx, qword [rax]
mov rbx, qword [rdx + 0x18]
mov rsi, qword [rdx + 8]
cmp rsi, rbx
jbe 0x578f36
mov rdi, qword [rdx]
movzx edi, byte [rdi + rbx]
test cl, cl
jne 0x578ee5
nop
cmp dil, r9b
je 0x578f20
test dil, dil
jne 0x578f0c
mov r8, qword [rdx + 0x28]
test r8, r8
jne 0x578f07
dec rsi
cmp rbx, rsi
jl 0x578f04
mov r8, qword [0x0081d570]
jmp 0x578f07
xor r8d, r8d
test r8, r8
jne 0x578f20
cmp dil, 0x5c
jne 0x578f17
xor ecx, 1
jmp 0x578ebb
xor ecx, ecx
jmp 0x578ebb
test dil, dil
je 0x578e08
inc rbx
nop
mov qword [rdx + 0x18], rbx
jmp 0x578e08
mov rax, rbx
mov rcx, rsi
nop dword [rax]
call fcn.00466620
mov rax, r11
call fcn.00466620
mov rax, rbx
call fcn.00466620
nop
int3
Function at 0x5ba6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ba8ff
push rbp
mov rbp, rsp
sub rsp, 0x28
lea rax, [0x00612f60]
mov ebx, 0xe
xor ecx, ecx
call fcn.0040e140
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x1f], 0x3d
mov rbx, rax
lea rcx, [rsp + 0x1f]
lea rax, [0x00612f60]
nop
call fcn.0040eb80
mov word [rax], 0x601
mov byte [rsp + 0x1f], 0x21
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x604
mov byte [rsp + 0x1f], 0x3c
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x607
mov byte [rsp + 0x1f], 0x3e
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x60b
mov byte [rsp + 0x1f], 0x2b
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x611
mov byte [rsp + 0x1f], 0x2d
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x614
mov byte [rsp + 0x1f], 0x2a
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x617
mov byte [rsp + 0x1f], 0x2f
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61b
mov byte [rsp + 0x1f], 0x25
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61d
mov byte [rsp + 0x1f], 0x26
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61f
mov byte [rsp + 0x1f], 0x7c
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x620
mov byte [rsp + 0x1f], 0x5e
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x621
mov byte [rsp + 0x1f], 0x7e
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x622
mov byte [rsp + 0x1f], 0x3f
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x20a
cmp dword [0x00887c00], 0
jne 0x5ba8da
mov rax, qword [rsp + 0x20]
jmp 0x5ba8f2
call fcn.00466280
mov rax, qword [rsp + 0x20]
mov qword [r11], rax
mov rcx, qword [0x00833030]
mov qword [r11 + 8], rcx
mov qword [0x00833030], rax
add rsp, 0x28
pop rbp
ret
nop
call fcn.00464360
jmp fcn.005ba6e0
Function at 0x5ba920
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5baaff
push rbp
mov rbp, rsp
sub rsp, 0x28
lea rax, [0x00612f60]
mov ebx, 0xc
xor ecx, ecx
call fcn.0040e140
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x1f], 0x3d
mov rbx, rax
lea rcx, [rsp + 0x1f]
lea rax, [0x00612f60]
nop
call fcn.0040eb80
mov word [rax], 0x602
mov byte [rsp + 0x1f], 0x21
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x605
mov byte [rsp + 0x1f], 0x3c
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x608
mov byte [rsp + 0x1f], 0x3e
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x60c
mov byte [rsp + 0x1f], 0x2b
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x612
mov byte [rsp + 0x1f], 0x2d
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x615
mov byte [rsp + 0x1f], 0x2a
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x618
mov byte [rsp + 0x1f], 0x2f
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61c
mov byte [rsp + 0x1f], 0x25
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x61e
mov byte [rsp + 0x1f], 0x26
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x623
mov byte [rsp + 0x1f], 0x7c
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x624
mov byte [rsp + 0x1f], 0x5e
lea rax, [0x00612f60]
mov rbx, qword [rsp + 0x20]
lea rcx, [rsp + 0x1f]
call fcn.0040eb80
mov word [rax], 0x625
cmp dword [0x00887c00], 0
jne 0x5baada
mov rax, qword [rsp + 0x20]
jmp 0x5baaf2
call fcn.00466280
mov rax, qword [rsp + 0x20]
mov qword [r11], rax
mov rcx, qword [0x00833038]
mov qword [r11 + 8], rcx
mov qword [0x00833038], rax
add rsp, 0x28
pop rbp
ret
nop
call fcn.00464360
jmp fcn.005ba920
Function at 0x14000a9a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x14000aa01
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x14000a9c0
mov ecx, dword [r9]
jmp 0x14000aae8
cmp ecx, 0x4e0
jb 0x14000aae8
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000aa20
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, r11d
lea r10, [r10 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x14000aa70
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret
Function at 0x14000b180
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x470], rbx
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x488], rdi
mov rax, qword [0x140095140]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov dword [rbp], 0x438
mov edx, dword [0x14009d700]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
lea rcx, [rbp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14000b200
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000b27a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000b22b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400767c0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14000b27a
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x30]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x14000b27d
mov rbx, r14
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x14000b28a
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x14000b2a2
inc rbx
test eax, eax
jne 0x14000b290
test ecx, ecx
mov rcx, rsi
je 0x14000b302
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x14000b1f0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14000b2fe
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000b2f9
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b385
mov rcx, r8
call fcn.14007620c
xor eax, eax
jmp 0x14000b345
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov rbx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x14000b342
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000b33d
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000b385
mov rcx, r8
call fcn.14007620c
mov rax, rbx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.140075d80
mov rbx, qword [rbp + 0x470]
mov rsi, qword [rbp + 0x480]
mov rdi, qword [rbp + 0x488]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000bcc0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x290
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x270], rbx
mov qword [rbp + 0x280], rsi
mov qword [rbp + 0x288], rdi
mov rax, qword [0x140095140]
xor rax, rbp
mov qword [rbp + 0x240], rax
mov rdi, rdx
mov dword [rbp], 0x238
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
nop word [rax + rax]
lea rcx, [rbp + 0x2c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x14000bd40
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000bdba
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000bd6b
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400767c0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14000bdba
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x2c]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x14000bdbd
mov rbx, r14
cmp qword [rdi + 0x18], 0xf
mov rdx, rdi
jbe 0x14000bdca
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x14000bde2
inc rbx
test eax, eax
jne 0x14000bdd0
test ecx, ecx
mov rcx, rsi
je 0x14000be42
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000bd30
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14000be3e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000be39
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bec3
mov rcx, r8
call fcn.14007620c
xor eax, eax
jmp 0x14000be83
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov ebx, dword [rbp + 8]
cmp rdx, 0xf
jbe 0x14000be81
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000be7c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000bec3
mov rcx, r8
call fcn.14007620c
mov eax, ebx
mov byte [rdi], r14b
mov qword [rdi + 0x18], 0xf
mov qword [rdi + 0x10], r14
mov rcx, qword [rbp + 0x240]
xor rcx, rbp
call fcn.140075d80
mov rbx, qword [rbp + 0x270]
mov rsi, qword [rbp + 0x280]
mov rdi, qword [rbp + 0x288]
lea rsp, [rbp + 0x250]
pop r15
pop r14
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000e130
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, 0x3b
call fcn.140076240
movzx r10d, byte [rbx]
lea r8, [rbx + 4]
mov rdx, rax
mov rcx, rax
sub rdx, rbx
mov r9d, 2
nop word [rax + rax]
movzx eax, byte [rbx + 2]
xor al, byte [r8]
xor al, r10b
mov byte [r8 + rdx - 4], al
movzx eax, byte [r8]
xor al, byte [r8 + 1]
mov byte [r8 + rdx - 3], al
movzx eax, byte [r8 + 2]
xor al, byte [r8 + 1]
mov byte [r8 + rdx - 2], al
movzx eax, byte [r8 + 3]
xor al, byte [r8 + 2]
mov byte [r8 + rdx - 1], al
movzx eax, byte [r8 + 3]
xor al, byte [r8 + 4]
mov byte [r8 + rdx], al
movzx eax, byte [r8 + 5]
xor al, byte [r8 + 4]
mov byte [r8 + rdx + 1], al
movzx eax, byte [r8 + 6]
xor al, byte [r8 + 5]
mov byte [r8 + rdx + 2], al
movzx eax, byte [r8 + 6]
xor al, byte [r8 + 7]
mov byte [r8 + rdx + 3], al
movzx eax, byte [r8 + 8]
xor al, byte [r8 + 7]
mov byte [r8 + rdx + 4], al
movzx eax, byte [r8 + 9]
xor al, byte [r8 + 8]
mov byte [r8 + rdx + 5], al
movzx eax, byte [r8 + 0xa]
xor al, byte [r8 + 9]
mov byte [r8 + rdx + 6], al
movzx eax, byte [r8 + 0xa]
xor al, byte [r8 + 0xb]
mov byte [r8 + rdx + 7], al
movzx eax, byte [r8 + 0xc]
xor al, byte [r8 + 0xb]
mov byte [r8 + rdx + 8], al
movzx eax, byte [r8 + 0xd]
xor al, byte [r8 + 0xc]
mov byte [r8 + rdx + 9], al
movzx eax, byte [r8 + 0xe]
xor al, byte [r8 + 0xd]
mov byte [r8 + rdx + 0xa], al
movzx eax, byte [r8 + 0xe]
xor al, byte [r8 + 0xf]
mov byte [r8 + rdx + 0xb], al
movzx eax, byte [r8 + 0x10]
xor al, byte [r8 + 0xf]
mov byte [r8 + rdx + 0xc], al
movzx eax, byte [r8 + 0x11]
xor al, byte [r8 + 0x10]
mov byte [r8 + rdx + 0xd], al
movzx eax, byte [r8 + 0x12]
xor al, byte [r8 + 0x11]
mov byte [r8 + rdx + 0xe], al
movzx eax, byte [r8 + 0x12]
xor al, byte [r8 + 0x13]
mov byte [r8 + rdx + 0xf], al
movzx eax, byte [r8 + 0x14]
xor al, byte [r8 + 0x13]
mov byte [r8 + rdx + 0x10], al
movzx eax, byte [r8 + 0x15]
xor al, byte [r8 + 0x14]
mov byte [r8 + rdx + 0x11], al
movzx eax, byte [r8 + 0x16]
xor al, byte [r8 + 0x15]
mov byte [r8 + rdx + 0x12], al
movzx eax, byte [r8 + 0x16]
xor al, byte [r8 + 0x17]
mov byte [r8 + rdx + 0x13], al
movzx eax, byte [r8 + 0x18]
xor al, byte [r8 + 0x17]
mov byte [rdx + r8 + 0x14], al
movzx eax, byte [r8 + 0x19]
xor al, byte [r8 + 0x18]
mov byte [rdx + r8 + 0x15], al
movzx eax, byte [r8 + 0x1a]
xor al, byte [r8 + 0x19]
mov byte [rdx + r8 + 0x16], al
movzx eax, byte [r8 + 0x1a]
xor al, byte [r8 + 0x1b]
mov byte [rdx + r8 + 0x17], al
movzx eax, byte [r8 + 0x1c]
xor al, byte [r8 + 0x1b]
mov byte [r8 + rdx + 0x18], al
lea r8, [r8 + 0x1d]
movzx r10d, byte [rbx + 2]
xor r10b, byte [r8 - 1]
sub r9, 1
jne 0x14000e160
mov byte [rcx + 0x3a], r9b
mov rax, rcx
add rsp, 0x20
pop rbx
ret