joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140003370
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword gs:[0x30]
mov r14, r8
mov rbp, qword [rcx + 0x88]
mov esi, edx
mov rdi, rcx
xor edx, edx
mov r8d, 0x4478
add rcx, 0x818
mov r9, qword [rax + 0x60]
lea rax, [0x1400c1910]
sub rbp, qword [r9 + 0x10]
add rbp, rax
mov qword [rsp + 0x60], 0
call sym.VirtualBoxVM.exe_nocrt_memset
mov rcx, qword [rdi]
lea rax, [rsp + 0x60]
mov r9d, 0x4478
mov qword [rsp + 0x20], rax
lea r8, [rdi + 0x818]
mov rdx, rbp
call qword [0x1400bf250]
test eax, eax
js 0x1400034d3
mov edx, dword [rdi + 0x830]
cmp edx, esi
je 0x1400034c0
mov byte [rdi + 0x4c8b], 0
lea rbx, [rdi + 0x88c]
mov byte [rdi + 0x88b], 0
lea rbp, [rdi + 0x83c]
mov r9d, dword [rdi + 0x838]
lea rcx, str.supR3HardenedWinCheckChild:_enmRequest_d_rc_d_enmWhat_d__s:__s_n
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbp
call fcn.14000d160
mov eax, dword [rdi + 0x830]
cmp eax, 2
jne 0x1400034f6
mov rcx, qword [rdi + 0x18]
xor edx, edx
call qword [0x1400bf2a0]
test eax, eax
js 0x140003520
mov rcx, qword [rdi]
lea r8, [rsp + 0x78]
xor edx, edx
mov qword [rsp + 0x78], 0xfffffffffd050f80
call fcn.140001cff
test eax, eax
je 0x14000349d
mov edx, eax
lea rcx, str.supR3HardNtChildProcessRequest:_Child_is_taking_too_long_to_quit__rcWait_x___killing_it..._n
call fcn.14000d160
mov rcx, qword [rdi]
mov edx, 0x40010004
call qword [0x1400bf320]
mov edx, dword [rdi + 0x838]
lea r9, [0x14007f970]
mov r8d, dword [rdi + 0x834]
mov qword [rsp + 0x20], rbx
test edx, edx
jne 0x140003550
jmp 0x14000353e
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
mov dword [rsp + 0x28], eax
lea r9, str.NtReadVirtualMemory___p___failed_reading_child_process_status:__x_n
mov r8d, eax
mov qword [rsp + 0x20], rbp
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140008120
int3
mov qword [rsp + 0x30], r14
lea r9, str.Unexpected_child_request__d._Was_expecting__d___s_._n
mov dword [rsp + 0x28], esi
lea rdx, str.supR3HardenedWinCheckChild
mov r8d, 0xfffffffe
mov dword [rsp + 0x20], eax
mov rcx, rdi
call fcn.140008120
int3
lea r9, str.NtSetEvent_failed:__x_n
mov dword [rsp + 0x20], eax
mov r8d, eax
lea rdx, str.supR3HardNtChildProcessRequest
mov rcx, rdi
call fcn.140008120
int3
mov edx, 5
lea rcx, str.supR3HardenedWinCheckChild
call fcn.14000cef0
int3
mov rcx, rbp
call fcn.14000cef0
int3
Function at 0x140015db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rcx + 0x10], 2
mov r11, rcx
mov r8, qword [rdx]
movabs rax, 0x112e0be826d694b3
imul r8
sar rdx, 0x1a
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3b9aca00
lea r9, [rdx - 1]
sub r8d, eax
cmovns r9, rdx
test r8d, r8d
lea eax, [r8 + 0x3b9aca00]
cmovns eax, r8d
mov dword [rcx + 0xc], eax
movabs rax, 0x8888888888888889
imul r9
add rdx, r9
sar rdx, 5
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul eax, edx, 0x3c
lea r8d, [rdx - 1]
sub r9d, eax
lea eax, [r9 + 0x3c]
movzx ecx, al
movzx eax, r9b
cmovns ecx, eax
test r9d, r9d
mov byte [r11 + 0xb], cl
mov eax, 0x88888889
cmovns r8d, edx
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x3c
lea r9d, [rdx - 1]
sub r8d, eax
cmovns r9d, edx
test r8d, r8d
lea eax, [r8 + 0x3c]
movzx ecx, al
movzx eax, r8b
cmovns ecx, eax
mov eax, 0x2aaaaaab
imul r9d
mov byte [r11 + 0xa], cl
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
lea ecx, [rdx - 1]
shl eax, 3
sub r9d, eax
cmovns ecx, edx
test r9d, r9d
lea eax, [r9 + 0x18]
movzx edx, al
movzx eax, r9b
cmovns edx, eax
mov eax, 0x92492493
mov byte [r11 + 9], dl
imul ecx
mov eax, 0x92492493
add edx, ecx
sar edx, 2
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
mov r8d, ecx
imul edx, edx, 7
sub r8d, edx
add r8d, 0xa
imul r8d
add edx, r8d
lea r10, [0x140086e00]
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub r8d, eax
mov eax, 0xb38cf9b1
mov byte [r11 + 5], r8b
imul ecx
add edx, ecx
sar edx, 8
mov r8d, edx
add edx, 0x12c
shr r8d, 0x1f
add r8d, edx
lea edx, [r8 + 1]
cmp dword [r10 + rdx*4], ecx
jg 0x140015f2c
nop dword [rax + rax]
inc r8d
lea edx, [rdx + 1]
cmp dword [r10 + rdx*4], ecx
jle 0x140015f20
cmp dword [r10 + r8*4], ecx
jle 0x140015f3b
dec r8d
cmp dword [r10 + r8*4], ecx
jg 0x140015f32
sub ecx, dword [r10 + r8*4]
lea r9d, [r8 + 0x686]
mov dword [r11], r9d
lea eax, [rcx + 1]
mov word [r11 + 6], ax
mov eax, r9d
and eax, 0x80000003
jge 0x140015f62
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x140015fa5
mov eax, 0x51eb851f
imul r9d
sar edx, 5
mov r8d, edx
shr r8d, 0x1f
add edx, r8d
imul r8d, edx, 0x64
cmp r9d, r8d
jne 0x140015fa1
mov eax, 0x51eb851f
imul r9d
sar edx, 7
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x190
cmp r9d, eax
jne 0x140015fa5
mov al, 1
jmp 0x140015fa7
xor al, al
test al, al
lea rdx, [0x140086db8]
movzx eax, al
lea r10, [0x140086dd8]
cmove r10, rdx
xor eax, 1
inc eax
shl eax, 6
or eax, 2
mov dword [r11 + 0x10], eax
mov eax, ecx
cdq
inc ecx
and edx, 0x1f
add eax, edx
sar eax, 5
movsxd r9, eax
movzx r8d, word [r10 + r9*2 + 2]
cmp r8d, ecx
jg 0x140016001
nop dword [rax + rax]
movsxd rdx, r9d
inc r9d
movzx r8d, word [r10 + rdx*2 + 4]
cmp r8d, ecx
jle 0x140015ff0
lea eax, [r9 + 1]
mov byte [r11 + 4], al
movsxd rax, r9d
sub cl, byte [r10 + rax*2]
mov rax, r11
inc cl
mov dword [r11 + 0x14], 0
mov byte [r11 + 8], cl
ret
Function at 0x14001b430
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov rax, qword [rcx + 0x28]
mov r8, rcx
xor edx, edx
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001b46d
mov edx, dword [rax + 0x3c]
cmp edx, 0x800
jbe 0x14001b46d
mov al, byte [2]
inc al
mov byte [2], al
int3
mov r9d, edx
add r9, rax
mov qword [r8 + 0x30], r9
cmp dword [r9], 0x4550
je 0x14001b491
mov al, byte [3]
inc al
mov byte [3], al
int3
mov eax, 0xf0
cmp word [r9 + 0x14], ax
je 0x14001b4ae
mov al, byte [4]
inc al
mov byte [4], al
int3
mov eax, 0x20b
cmp word [r9 + 0x18], ax
je 0x14001b4cb
mov al, byte [5]
inc al
mov byte [5], al
int3
cmp dword [r9 + 0x84], 0x10
je 0x14001b4e6
mov al, byte [6]
inc al
mov byte [6], al
int3
mov dword [r8 + 0x38], edx
movzx eax, word [r9 + 6]
lea ecx, [rax*4 + 0x21]
add ecx, eax
lea eax, [rdx + rcx*8]
mov edx, eax
mov dword [r8 + 0x3c], eax
mov eax, dword [r9 + 0x50]
mov dword [r8 + 0x40], eax
mov rax, qword [r9 + 0x88]
mov rcx, rax
shr rcx, 0x20
cmp ecx, 0x28
jb 0x14001b52e
cmp eax, edx
jb 0x14001b52e
mov edx, dword [r9 + 0x50]
cmp eax, edx
jae 0x14001b52e
add ecx, eax
cmp ecx, edx
jbe 0x14001b53f
mov cl, byte [7]
inc cl
mov byte [7], cl
int3
mov r10d, eax
mov rcx, rax
add r10, qword [r8 + 0x28]
shr rcx, 0x20
mov dword [r8 + 0x44], eax
mov dword [r8 + 0x48], ecx
mov eax, dword [r10 + 0x14]
dec eax
cmp eax, 0xffffe
ja 0x14001b572
mov eax, dword [r10 + 0x18]
cmp eax, 0x100000
jae 0x14001b572
cmp eax, 1
jae 0x14001b587
mov al, byte [8]
inc al
mov byte [8], al
int3
mov edi, dword [r8 + 0x3c]
mov dword [r8 + 0x5c], eax
mov ecx, dword [r10 + 0x18]
cmp ecx, dword [r10 + 0x14]
cmovb ecx, dword [r10 + 0x14]
mov dword [r8 + 0x58], ecx
mov r11d, dword [r10 + 0x1c]
cmp r11d, edi
jb 0x14001b5bb
mov ebx, dword [r9 + 0x50]
cmp r11d, ebx
jae 0x14001b5bb
lea rdx, [r11 + rcx*4]
cmp rdx, rbx
jbe 0x14001b5d4
mov al, byte [9]
inc al
mov byte [9], al
int3
mov rbx, qword [r8 + 0x28]
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x50], rax
mov r11d, dword [r10 + 0x20]
cmp r11d, edi
jb 0x14001b602
cmp r11d, dword [r9 + 0x50]
jae 0x14001b602
mov ecx, dword [r10 + 0x18]
mov eax, dword [r9 + 0x50]
lea rdx, [r11 + rcx*4]
cmp rdx, rax
jbe 0x14001b61f
mov al, byte [0xa]
inc al
mov byte [0xa], al
int3
mov eax, r11d
add rax, rbx
mov qword [r8 + 0x60], rax
mov r11d, dword [r10 + 0x24]
cmp r11d, edi
jb 0x14001b648
mov r9d, dword [r9 + 0x50]
cmp r11d, r9d
jae 0x14001b648
mov ecx, dword [r10 + 0x18]
lea rdx, [r11 + rcx*4]
cmp rdx, r9
jbe 0x14001b661
mov al, byte [0xb]
inc al
mov byte [0xb], al
int3
mov rdi, qword [rsp + 0x10]
mov eax, r11d
add rax, rbx
mov rbx, qword [rsp + 8]
mov qword [r8 + 0x68], rax
ret
Function at 0x1400204e0
Capabilities:
Parse pe header

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov rsi, r9
mov edi, r8d
mov ebp, edx
mov rbx, rcx
cmp r8d, 2
jne 0x140020501
call fcn.140024a70
mov edi, eax
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x80]
xor r9d, r9d
mov rcx, rbx
lea r8d, [r9 + 4]
call qword [case.0x140020b7f.0]
test eax, eax
js 0x1400206e0
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x40], r13
mov r13d, 0x5a4d
mov qword [rsp + 0x38], r14
mov r14d, 0x584c
mov qword [rsp + 0x30], r15
cmp ax, r13w
je 0x140020591
cmp eax, 0x4550
je 0x140020591
cmp eax, 0x464c457f
je 0x140020591
cmp ax, r14w
je 0x140020591
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x140020591
cmp eax, 0xfefaedfe
je 0x140020591
cmp eax, 0xcefaedfe
je 0x140020591
cmp eax, 0xcafebabe
je 0x140020591
cmp eax, 0xbebafeca
jne 0x14002061d
mov dword [rsp + 0x70], 0
mov r12d, 0x454c
lea r15d, [r12 + 2]
cmp ax, r13w
jne 0x140020627
mov rax, qword [rbx + 8]
lea rdx, [rsp + 0x70]
mov r9d, 0x3c
mov rcx, rbx
lea r8d, [r9 - 0x38]
call qword [case.0x140020b7f.0]
test eax, eax
js 0x1400206cc
mov eax, dword [rsp + 0x70]
cmp eax, 0x40
jbe 0x14002061d
mov r9d, eax
lea rdx, [rsp + 0x80]
mov rax, qword [rbx + 8]
mov r8d, 4
mov rcx, rbx
call qword [case.0x140020b7f.0]
test eax, eax
js 0x1400206cc
mov eax, dword [rsp + 0x80]
cmp eax, 0x4550
je 0x14002062e
cmp ax, r14w
je 0x140020627
cmp ax, r12w
je 0x140020627
cmp ax, r15w
je 0x140020627
mov eax, 0xfffffda8
jmp 0x1400206cc
cmp eax, 0x4550
jne 0x140020656
mov rax, qword [rsp + 0x90]
mov r8d, edi
mov r9d, dword [rsp + 0x70]
mov edx, ebp
mov qword [rsp + 0x28], rax
mov rcx, rbx
mov qword [rsp + 0x20], rsi
call fcn.140041410
mov ecx, eax
jmp 0x1400206ca
cmp eax, 0x464c457f
jne 0x140020664
mov ecx, 0xfffffda7
jmp 0x1400206ca
lea ecx, [rax + 0x1120532]
cmp ecx, 1
jbe 0x1400206c5
cmp eax, 0xfefaedfe
je 0x1400206c5
cmp eax, 0xcefaedfe
je 0x1400206c5
cmp eax, 0xcafebabe
je 0x1400206c5
cmp eax, 0xbebafeca
je 0x1400206c5
cmp ax, r14w
jne 0x140020698
mov ecx, 0xfffffda5
jmp 0x1400206ca
cmp ax, r12w
jne 0x1400206a5
mov ecx, 0xfffffda4
jmp 0x1400206ca
cmp ax, r15w
jne 0x1400206b2
mov ecx, 0xfffffda3
jmp 0x1400206ca
cmp ax, r13w
mov ecx, 0xfffffda8
mov edx, 0xfffffda2
cmove ecx, edx
jmp 0x1400206ca
mov ecx, 0xfffffda8
mov eax, ecx
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1400247f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
sub rsp, 0x28
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax - 8], rdi
mov qword [rax - 0x10], r12
mov r12, r9
mov qword [rax - 0x18], r13
xor r9d, r9d
mov qword [rax - 0x20], r14
mov r13, rdx
mov rax, rcx
mov qword [rsp], r15
movzx ecx, r8b
mov edx, r9d
shr r8d, 8
test r8d, r8d
jne 0x140024839
mov r8d, 0xffffffff
cmp ecx, 0x24
mov r10b, 1
cmovb edx, ecx
movzx ecx, byte [rax]
cmp cl, 0x2b
jne 0x14002484f
mov r10b, 1
jmp 0x140024858
cmp cl, 0x2d
jne 0x140024861
xor r10b, 1
inc rax
add r8d, 0xffffffff
jne 0x140024842
lea rbx, [0x140000000]
test edx, edx
jne 0x1400248b6
cmp byte [rax], 0x30
lea edi, [rdx + 0xa]
jne 0x1400248ee
cmp r8d, 1
jbe 0x1400248a1
movzx ecx, byte [rax + 1]
sub cl, 0x58
test cl, 0xdf
jne 0x1400248a1
movzx ecx, byte [rax + 2]
cmp byte [rcx + rbx + 0xa7940], 0x10
jae 0x1400248a1
add rax, 2
lea edi, [rdx + 0x10]
add r8d, 0xfffffffe
jmp 0x1400248ee
movzx ecx, byte [rax + 1]
cmp byte [rcx + rbx + 0xa7940], 8
jae 0x1400248ee
mov edi, 8
jmp 0x1400248ee
mov edi, edx
cmp edx, 0x10
jne 0x1400248ee
cmp byte [rax], 0x30
jne 0x1400248ee
cmp r8d, 1
jbe 0x1400248ee
movzx ecx, byte [rax + 1]
cmp cl, 0x78
je 0x1400248d6
cmp cl, 0x58
jne 0x1400248ee
movzx ecx, byte [rax + 2]
mov edi, edx
cmp byte [rcx + rbx + 0xa7940], 0x10
jae 0x1400248ee
add r8d, 0xfffffffe
add rax, 2
mov r14d, edi
mov r15, rax
movsx ebp, byte [r14 + rbx + 0xa7a40]
mov rbx, r9
test r8d, r8d
je 0x140024957
lea r13, [0x140000000]
mov qword [rsp + 0x48], rsi
movzx ecx, byte [rax]
test cl, cl
je 0x14002494d
movzx esi, byte [rcx + r13 + 0xa7940]
cmp esi, edi
jae 0x14002494d
mov r11, rbx
imul rbx, r14
add rbx, rsi
cmp r11, rbx
ja 0x14002493e
mov ecx, ebp
shr r11, cl
test r11, r11
je 0x140024944
mov r9d, 0x37
inc rax
add r8d, 0xffffffff
jne 0x140024911
mov r13, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
mov r14, qword [rsp + 8]
mov rdi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x40]
test r10b, r10b
jne 0x14002497a
test r9d, r9d
mov ecx, 0x39
cmove r9d, ecx
neg rbx
test r12, r12
je 0x140024983
mov qword [r12], rbx
mov r12, qword [rsp + 0x18]
cmp rax, r15
mov r15, qword [rsp]
mov ecx, 0xffffffc8
mov rbx, qword [rsp + 0x30]
cmove r9d, ecx
test r13, r13
je 0x1400249a6
mov qword [r13], rax
mov r13, qword [rsp + 0x10]
test r9d, r9d
jne 0x1400249f3
cmp byte [rax], r9b
je 0x1400249f3
test r8d, r8d
je 0x1400249f3
nop word [rax + rax]
movzx ecx, byte [rax]
cmp cl, 0x20
je 0x1400249cd
cmp cl, 9
jne 0x1400249e0
inc rax
add r8d, 0xffffffff
jne 0x1400249c0
mov eax, 0x4d
add rsp, 0x28
ret
test r8d, r8d
je 0x1400249d6
test cl, cl
je 0x1400249d6
mov eax, 0x4c
add rsp, 0x28
ret
mov eax, r9d
add rsp, 0x28
ret
Function at 0x14003d560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rcx + 0xb8]
mov qword [rcx + 0x130], rax
mov eax, dword [rcx + 0xb4]
mov qword [rcx + 0x128], rax
mov eax, dword [rcx + 0xb0]
mov qword [rcx + 0x120], rax
mov eax, dword [rcx + 0xac]
mov qword [rcx + 0x118], rax
mov eax, dword [rcx + 0xa8]
mov qword [rcx + 0x110], rax
mov eax, dword [rcx + 0xa4]
mov qword [rcx + 0x108], rax
mov eax, dword [rcx + 0xa0]
mov qword [rcx + 0x100], rax
mov eax, dword [rcx + 0x9c]
mov qword [rcx + 0xf8], rax
mov eax, dword [rcx + 0x98]
mov dword [rcx + 0xf4], eax
mov eax, dword [rcx + 0x94]
mov dword [rcx + 0xf0], eax
mov eax, dword [rcx + 0x90]
mov qword [rcx + 0xe8], rax
movzx eax, word [rcx + 0x8e]
mov word [rcx + 0xe6], ax
movzx eax, word [rcx + 0x8c]
mov word [rcx + 0xe4], ax
mov eax, dword [rcx + 0x88]
mov dword [rcx + 0xe0], eax
mov eax, dword [rcx + 0x84]
mov qword [rcx + 0xd8], rax
mov eax, dword [rcx + 0x80]
mov qword [rcx + 0xd0], rax
mov eax, dword [rcx + 0x7c]
mov qword [rcx + 0xc8], rax
mov eax, dword [rcx + 0x78]
mov qword [rcx + 0xc0], rax
mov eax, dword [rcx + 0x74]
mov qword [rcx + 0xb8], rax
mov eax, dword [rcx + 0x70]
mov qword [rcx + 0xb0], rax
mov eax, dword [rcx + 0x6c]
mov qword [rcx + 0xa8], rax
mov eax, dword [rcx + 0x68]
mov qword [rcx + 0xa0], rax
mov eax, dword [rcx + 0x64]
mov dword [rcx + 0x9c], eax
mov eax, dword [rcx + 0x60]
mov dword [rcx + 0x98], eax
movzx eax, word [rcx + 0x5e]
mov word [rcx + 0x96], ax
movzx eax, word [rcx + 0x5c]
mov word [rcx + 0x94], ax
mov eax, dword [rcx + 0x58]
mov dword [rcx + 0x90], eax
mov eax, dword [rcx + 0x54]
mov qword [rcx + 0x88], rax
mov eax, dword [rcx + 0x50]
mov qword [rcx + 0x80], rax
mov eax, dword [rcx + 0x4c]
mov qword [rcx + 0x78], rax
mov eax, dword [rcx + 0x48]
mov qword [rcx + 0x70], rax
mov eax, dword [rcx + 0x44]
mov qword [rcx + 0x68], rax
mov eax, dword [rcx + 0x40]
mov qword [rcx + 0x60], rax
mov eax, dword [rcx + 0x3c]
mov qword [rcx + 0x58], rax
mov eax, dword [rcx + 0x38]
mov qword [rcx + 0x50], rax
movzx eax, word [rcx + 0x36]
mov word [rcx + 0x4e], ax
movzx eax, word [rcx + 0x34]
mov word [rcx + 0x4c], ax
mov eax, dword [rcx + 0x2c]
mov dword [rcx + 0x48], eax
mov eax, dword [rcx + 0x30]
mov qword [rcx + 0x40], rax
mov eax, dword [rcx + 0x28]
mov qword [rcx + 0x38], rax
mov eax, dword [rcx + 0x24]
mov qword [rcx + 0x30], rax
mov eax, dword [rcx + 0x20]
mov qword [rcx + 0x28], rax
mov eax, dword [rcx + 0x1c]
mov qword [rcx + 0x20], rax
mov eax, dword [rcx + 0x18]
mov qword [rcx + 0x18], rax
ret
Function at 0x140064940
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rdx + 0xf]
and rax, 0xfffffffffffffff0
jbe 0x14006496d
mov rdx, qword [0x1400bf9d0]
dec rax
shr rax, 3
inc rax
nop dword [rax + rax]
xor qword [rcx], rdx
lea rcx, [rcx + 8]
sub rax, 1
jne 0x140064960
xor eax, eax
ret
Function at 0x1400027c0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x1250
call fcn.14016c980
sub rsp, rax
mov rax, qword [0x1419a1b80]
xor rax, rsp
mov qword [rsp + 0x1240], rax
mov rsi, rcx
lea r8, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov edx, 0x1000
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140002914
mov ebp, dword [rsp + 0x28]
xor ebx, ebx
shr ebp, 2
test ebp, ebp
je 0x140002914
mov r8d, dword [rsp + rbx*4 + 0x30]
test r8d, r8d
je 0x14000290a
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14000290a
lea r9, [rsp + 0x2c]
mov r8d, 8
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140002901
mov rdx, qword [rsp + 0x20]
lea r8, [rsp + 0x1030]
mov r9d, 0x104
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x140002901
lea rcx, [rsp + 0x1030]
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp word [rcx + rax*2], 0
jne 0x1400028a0
cmp qword [rsi + 0x18], 7
mov r8, rsi
mov rdx, qword [rsi + 0x10]
jbe 0x1400028bb
mov r8, qword [rsi]
cmp rdx, rax
jne 0x140002901
lea rax, [rsp + 0x1030]
test rdx, rdx
je 0x1400028f4
lea rcx, [rsp + 0x1030]
sub r8, rcx
nop dword [rax + rax]
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x140002901
add rax, 2
sub rdx, 1
jne 0x1400028e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140002916
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc ebx
cmp ebx, ebp
jb 0x140002820
xor al, al
mov rcx, qword [rsp + 0x1240]
xor rcx, rsp
call fcn.14016c210
lea r11, [rsp + 0x1250]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x140020ed0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov ebx, ecx
call fcn.140020f00
mov ecx, ebx
call fcn.14001f5c0
test al, al
je 0x140020ef2
add rsp, 0x20
pop rbx
jmp fcn.140064550
add rsp, 0x20
pop rbx
ret

Function at 0x140022820
Capabilities:
Print debug messages

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
lea r15, [0x1419a4100]
mov qword [rsp + 0x20], r15
xor eax, eax
mov r12d, 1
lock cmpxchg qword [0x1419a4100], r12
je 0x140022860
mov rcx, r15
call fcn.140064a80
mov byte [rsp + 0x28], r12b
xor r14d, r14d
cmp qword [rbp + 0x10], 0x7ffe
jg 0x140022888
mov rcx, rbp
call fcn.14001d9a0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x140022960
mov ecx, 0xfffe
call fcn.14016cb10
mov rsi, rax
mov rdi, r14
mov rax, qword [rbp + 0x10]
test rax, rax
jle 0x140022957
nop word [rax + rax]
mov rbx, rax
sub rbx, rdi
mov ecx, 0x7ffe
cmp rbx, rcx
cmovl rcx, rbx
mov r8, qword [rbp + 8]
test r8, r8
cmove r8, r14
mov rdx, rdi
cmp rdi, rax
jg 0x14002290f
test rdi, rdi
jns 0x140022902
test rcx, rcx
js 0x1400228f6
lea rbx, [rcx + rdi]
cmp rbx, rax
jge 0x1400228f6
test rbx, rbx
jle 0x14002290f
mov rdx, r14
lea rdx, [r8 + rdx*2]
jmp 0x140022924
mov rdx, r14
mov rbx, rax
lea rdx, [r8 + rdx*2]
jmp 0x140022924
cmp rcx, rbx
cmovbe rbx, rcx
lea rdx, [r8 + rdx*2]
jmp 0x140022924
xorps xmm1, xmm1
xorps xmm0, xmm0
psrldq xmm0, 8
movq rdx, xmm0
movq rbx, xmm1
test rdx, rdx
je 0x140022935
lea r8, [rbx + rbx]
mov rcx, rsi
call fcn.140191f10
mov word [rsi + rbx*2], r14w
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
add rdi, 0x7ffe
mov rax, qword [rbp + 0x10]
cmp rdi, rax
jl 0x1400228b0
mov rcx, rsi
call fcn.14016c230
nop
mov rax, r12
lock cmpxchg qword [0x1419a4100], r14
je 0x140022976
mov rcx, r15
call fcn.140064f80
mov rbx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1400271e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x68], rsi
mov r12, r9
lea rsi, [r8 - 1]
mov r14, r8
sar rsi, 1
mov rdi, rdx
mov rbp, rcx
mov r13, rdx
mov r10, rdx
cmp rdx, rsi
jge 0x1400272d9
mov qword [rsp + 0x60], rbx
nop
lea rbx, [r10 + r10]
lea rax, [rbx + 2]
imul rdx, rax, 0x38
lea rcx, [rsp + 0x80]
add rdx, rbp
lea r8, [rdx - 0x38]
call fcn.1400288c0
movzx r10d, al
xor r10, 1
imul rdx, rdi, 0x38
inc r10
add rdx, rbp
add r10, rbx
imul r8, r10, 0x38
mov rcx, qword [rdx]
mov rdi, r10
add r8, rbp
mov rax, qword [r8]
mov qword [rdx], rax
mov qword [r8], rcx
mov rax, qword [r8 + 8]
mov rcx, qword [rdx + 8]
mov qword [rdx + 8], rax
mov qword [r8 + 8], rcx
mov rax, qword [r8 + 0x10]
mov rcx, qword [rdx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [r8 + 0x10], rcx
mov rax, qword [r8 + 0x18]
mov rcx, qword [rdx + 0x18]
mov qword [rdx + 0x18], rax
mov qword [r8 + 0x18], rcx
mov rax, qword [r8 + 0x20]
mov rcx, qword [rdx + 0x20]
mov qword [rdx + 0x20], rax
mov qword [r8 + 0x20], rcx
mov rax, qword [r8 + 0x28]
mov rcx, qword [rdx + 0x28]
mov qword [rdx + 0x28], rax
mov qword [r8 + 0x28], rcx
mov rax, qword [r8 + 0x30]
mov rcx, qword [rdx + 0x30]
mov qword [rdx + 0x30], rax
mov qword [r8 + 0x30], rcx
cmp r10, rsi
jl 0x140027220
mov rbx, qword [rsp + 0x60]
cmp r10, rsi
mov rsi, qword [rsp + 0x68]
jne 0x140027371
test r14b, 1
jne 0x140027371
imul r9, r14, 0x38
imul rdx, rdi, 0x38
add r9, rbp
lea rdi, [r14 - 1]
mov rax, qword [r9 - 0x38]
add rdx, rbp
mov rcx, qword [rdx]
mov qword [rdx], rax
mov qword [r9 - 0x38], rcx
mov rax, qword [r9 - 0x30]
mov rcx, qword [rdx + 8]
mov qword [rdx + 8], rax
mov qword [r9 - 0x30], rcx
mov rax, qword [r9 - 0x28]
mov rcx, qword [rdx + 0x10]
mov qword [rdx + 0x10], rax
mov qword [r9 - 0x28], rcx
mov rax, qword [r9 - 0x20]
mov rcx, qword [rdx + 0x18]
mov qword [rdx + 0x18], rax
mov qword [r9 - 0x20], rcx
mov rax, qword [r9 - 0x18]
mov rcx, qword [rdx + 0x20]
mov qword [rdx + 0x20], rax
mov qword [r9 - 0x18], rcx
mov rax, qword [r9 - 0x10]
mov rcx, qword [rdx + 0x28]
mov qword [rdx + 0x28], rax
mov qword [r9 - 0x10], rcx
mov rax, qword [r9 - 8]
mov rcx, qword [rdx + 0x30]
mov qword [rdx + 0x30], rax
mov qword [r9 - 8], rcx
mov r9, r12
mov r8, r13
mov rdx, rdi
mov rcx, rbp
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.1400273a0