joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5731e0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x573429
push rbp
mov rbp, rsp
sub rsp, 0xa8
nop word [rax + rax]
test rax, rax
je 0x573414
mov qword [rsp + 0xb8], rax
mov rbx, qword [rax + 8]
test rbx, rbx
jne 0x573222
xor ebx, ebx
xor ecx, ecx
nop
jmp 0x57323c
mov rdx, qword [rax]
mov rcx, qword [rax + 0x10]
mov rax, rdx
call sym.net.IP.String
mov rcx, rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x88], rcx
mov qword [rsp + 0x48], rbx
cmp qword [rax + 0x28], 0
je 0x573351
mov rcx, qword [rax + 0x18]
mov rax, rcx
nop dword [rax + rax]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x58], rbx
mov rcx, qword [rsp + 0xb8]
mov r8, qword [rcx + 0x20]
mov r9, qword [rcx + 0x28]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006d9ed8]
mov esi, 1
lea rax, [rsp + 0x68]
mov rbx, qword [rsp + 0x88]
call sym.runtime.concatstring3
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x008afa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
jl 0x57331b
xor eax, eax
lea rbx, [0x006da028]
mov ecx, 1
mov rdi, qword [rsp + 0xa0]
mov rsi, qword [rsp + 0x60]
lea r8, [0x00669d14]
mov r9d, 2
mov r10, qword [rsp + 0x98]
mov r11, qword [rsp + 0x58]
call sym.runtime.concatstring4
jmp 0x573348
xor eax, eax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
lea rdi, [0x006d9fe8]
mov esi, 1
mov r8, qword [rsp + 0x98]
mov r9, qword [rsp + 0x58]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
mov rax, qword [rax + 0x18]
call sym.internal_itoa.Itoa
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x50], rbx
mov rcx, qword [rsp + 0x88]
mov qword [rsp], rcx
mov rdx, qword [rsp + 0x48]
mov qword [rsp + 8], rdx
mov byte [rsp + 0x10], 0x3a
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x008afa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0
nop
jl 0x5733de
xor eax, eax
lea rbx, [0x006da028]
mov ecx, 1
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x48]
lea r8, [0x00669d14]
mov r9d, 2
mov r10, qword [rsp + 0x90]
mov r11, qword [rsp + 0x50]
call sym.runtime.concatstring4
jmp 0x57340b
xor eax, eax
mov rbx, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x48]
lea rdi, [0x006d9fe8]
mov esi, 1
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x50]
call sym.runtime.concatstring3
add rsp, 0xa8
pop rbp
ret
lea rax, [0x0066a145]
mov ebx, 5
add rsp, 0xa8
pop rbp
ret
mov qword [rsp + 8], rax
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
jmp sym.net._UDPAddr_.String
Function at 0x577700
Capabilities:
Parse credit card information

Disassembly:
lea ecx, [rax - 0x61]
cmp cl, 0x19
jbe 0x577718
lea ecx, [rax - 0x41]
cmp cl, 0x19
jbe 0x577718
lea ecx, [rax - 0x30]
cmp cl, 9
ja 0x577720
xor eax, eax
ret
cmp rbx, 3
je 0x57772c
cmp rbx, 4
jne 0x577759
cmp al, 0x2c
ja 0x577746
lea ecx, [rax - 0x21]
cmp cl, 1
jbe 0x577756
cmp al, 0x24
je 0x577756
nop dword [rax]
cmp al, 0x26
jae 0x577756
jmp 0x577759
lea ecx, [rax - 0x3a]
cmp cl, 4
jbe 0x577756
cmp al, 0x5b
je 0x577756
cmp al, 0x5d
jne 0x577759
xor eax, eax
ret
cmp al, 0x2f
ja 0x577792
nop dword [rax]
cmp al, 0x26
ja 0x577771
cmp al, 0x24
je 0x5777b1
cmp al, 0x26
je 0x5777b1
jmp 0x57782b
lea ecx, [rax - 0x2b]
cmp cl, 1
jbe 0x5777b1
lea ecx, [rax - 0x2d]
nop dword [rax]
cmp cl, 1
jbe 0x577828
cmp al, 0x2f
je 0x5777b1
jmp 0x57782b
cmp al, 0x3d
ja 0x5777a9
lea ecx, [rax - 0x3a]
cmp cl, 1
jbe 0x5777b1
nop
cmp al, 0x3d
je 0x5777b1
jmp 0x57782b
lea ecx, [rax - 0x3f]
cmp cl, 1
ja 0x577820
cmp rbx, 2
jg 0x5777e7
cmp rbx, 1
je 0x5777e1
nop dword [rax]
cmp rbx, 2
jne 0x57782b
cmp al, 0x2f
je 0x5777d2
cmp al, 0x3b
je 0x5777d2
cmp al, 0x2c
jne 0x5777d9
mov ecx, 1
jmp 0x5777de
cmp al, 0x3f
sete cl
mov eax, ecx
ret
cmp al, 0x3f
sete al
ret
cmp rbx, 5
jne 0x57780a
cmp al, 0x40
je 0x5777f9
cmp al, 0x2f
je 0x5777f9
cmp al, 0x3f
jne 0x577802
mov ecx, 1
nop
jmp 0x577807
cmp al, 0x3a
sete cl
mov eax, ecx
ret
cmp rbx, 6
je 0x577819
cmp rbx, 7
jne 0x57782b
xor eax, eax
ret
mov eax, 1
ret
cmp al, 0x5f
je 0x577828
cmp al, 0x7e
jne 0x57782b
xor eax, eax
ret
cmp rbx, 7
jne 0x577841
cmp al, 0x21
je 0x57783d
lea ecx, [rax - 0x28]
cmp cl, 2
ja 0x577841
xor eax, eax
nop
ret
mov eax, 1
ret

Function at 0x57b580
Capabilities:
Encrypt data using des

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
xor eax, eax
jmp 0x57b58f
inc rax
cmp rax, 8
jge 0x57b599
xor ecx, ecx
jmp 0x57b5a2
add rsp, 0x10
pop rbp
ret
inc rcx
cmp rcx, 4
jge 0x57b58c
xor edx, edx
jmp 0x57b5c0
mov dword [rbx + rax*4], ecx
lea rbx, [rdi + 1]
mov rax, r10
mov rcx, r9
mov rdx, rbx
nop dword [rax]
cmp rdx, 0x10
jge 0x57b59f
mov rbx, rax
shl rax, 6
lea rsi, [0x00823c40]
lea rdi, [rsi + rax]
mov r8, rcx
shl rcx, 4
add rdi, rcx
movzx edi, byte [rdi + rdx]
lea rcx, [rbx - 7]
neg rcx
shl rcx, 2
shl rdi, cl
cmp rcx, 0x40
sbb r9, r9
and rdi, r9
xor eax, eax
xor ecx, ecx
jmp 0x57b696
mov rdi, r8
and r8d, 2
shl r8, 4
mov r9, rdi
and edi, 1
or r8, rdi
mov rdi, rdx
shl rdx, 1
or r8d, edx
mov rdx, rcx
shl rcx, 1
shr rdx, 0x1f
mov r10, rbx
shl rbx, 8
movzx eax, r8b
or rcx, rdx
lea rdx, [0x008b1a80]
add rbx, rdx
cmp rax, 0x40
jb 0x57b5ac
jmp 0x57b6a5
lea r9, [0x00821060]
movzx r10d, byte [r9 + rax]
mov r11, rcx
mov ecx, r10d
mov r12, rdi
shr r12, cl
lea r13, [rax - 0x1f]
neg r13
inc rax
cmp cl, 0x40
sbb rcx, rcx
and rcx, r12
and ecx, 1
mov r10, rcx
mov rcx, r13
shl r10, cl
cmp rcx, 0x40
sbb rcx, rcx
and rcx, r10
or rcx, r11
cmp rax, 0x20
jl 0x57b652
nop dword [rax]
jmp 0x57b607
mov ecx, 0x40
call sym.runtime.panicIndex
nop
int3
Function at 0x57ca80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57cc8b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x57cba4
cmp rdx, 0x40
ja 0x57cc7d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x57cb14
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x57cb80
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x008afa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x57cc75
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x57cba7
mov r8, rcx
cmp r8, 0x40
jl 0x57cc25
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call sym.crypto_md5.block.abi0
xorps xmm15, xmm15
mov r14, qword [0x008afa40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x57cc68
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x57cc64
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call sym.runtime.memmove
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call sym.runtime.panicSliceB
mov rax, rdx
mov ecx, 0x40
call sym.runtime.panicSliceB
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp sym.crypto_md5._digest_.Write
Function at 0x591e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x591f7e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x591f02
cmp r8, rdi
ja 0x591f72
cmp rsi, rbx
je 0x591ee5
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x591ee2
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x591f5f
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x591ee5
mov rbx, rdx
test byte [rax], al
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x591f57
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
jmp 0x591f40
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x591f08
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call sym.runtime.panicIndex
lea rax, [0x00622160]
lea rbx, [0x006dc610]
call sym.runtime.gopanic
mov rcx, r8
mov rdx, rdi
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.crypto_rc4._Cipher_.XORKeyStream
Function at 0x594c20
Capabilities:
Encode data using xor

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov r15, qword [rsp + 0x18]
mov r8, qword [rdi]
mov r9, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r11, qword [rdi + 0x18]
mov r12, qword [rdi + 0x20]
cmp r15, 0x10
jb 0x594ce7
add r8, qword [rsi]
adc r9, qword [rsi + 8]
adc r10, 1
lea rsi, [rsi + 0x10]
mov rax, r11
mul r8
mov rbx, rax
mov rcx, rdx
mov rax, r11
mul r9
add rcx, rax
adc rdx, 0
mov r13, r11
imul r13, r10
add r13, rdx
mov rax, r12
mul r8
add rcx, rax
adc rdx, 0
mov r8, rdx
mov r14, r12
imul r14, r10
mov rax, r12
mul r9
add r13, rax
adc r14, rdx
add r13, r8
adc r14, 0
mov r8, rbx
mov r9, rcx
mov r10, r13
and r10, 3
mov rbx, r13
and rbx, 0xfffffffffffffffc
add r8, rbx
adc r9, r14
adc r10, 0
shrd r13, r14, 2
shr r14, 2
add r8, r13
adc r9, r14
adc r10, 0
sub r15, 0x10
cmp r15, 0x10
jae 0x594c4c
test r15, r15
je 0x594d2a
mov rbx, 1
xor rcx, rcx
xor r13, r13
add rsi, r15
shld rcx, rbx, 8
shl rbx, 8
mov r13b, byte [rsi - 1]
xor rbx, r13
dec rsi
dec r15
jne 0x594cfc
add r8, rbx
adc r9, rcx
adc r10, 0
mov r15, 0x10
jmp 0x594c5b
mov qword [rdi], r8
mov qword [rdi + 8], r9
mov qword [rdi + 0x10], r10
ret
Function at 0x5961e0
Capabilities:
Encode data using xor

Disassembly:
xor r10, r10
xor r11, r11
xor r12, r12
cmp r9, 0xd
jne 0x596287
mov r10, qword [rcx]
mov r11, qword [rcx + 5]
shr r11, 0x18
mov r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
cmp r9, 0x10
jb 0x59632a
add r10, qword [rcx]
adc r11, qword [rcx + 8]
adc r12, 1
lea rcx, [rcx + 0x10]
sub r9, 0x10
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
jmp 0x596287
cmp r9, 0
je 0x5963e3
xor r13, r13
xor r14, r14
xor r15, r15
add rcx, r9
shld r14, r13, 8
shl r13, 8
mov r15b, byte [rcx - 1]
xor r13, r15
dec rcx
dec r9
jne 0x596340
add r10, r13
adc r11, r14
adc r12, 1
mov rax, qword [rbp]
mov r15, rax
mul r10
mov r13, rax
mov r14, rdx
mov rax, qword [rbp]
mul r11
imul r15, r12
add r14, rax
adc r15, rdx
mov rax, qword [rbp + 8]
mov r8, rax
mul r10
add r14, rax
adc rdx, 0
mov r10, rdx
mov rax, qword [rbp + 8]
mul r11
add r15, rax
adc rdx, 0
imul r8, r12
add r15, r10
adc r8, rdx
mov r10, r13
mov r11, r14
mov r12, r15
and r12, 3
mov r13, r15
and r13, 0xfffffffffffffffc
mov r14, r8
shrd r15, r8, 2
shr r8, 2
add r10, r13
adc r11, r14
adc r12, 0
add r10, r15
adc r11, r8
adc r12, 0
ret
Function at 0x1800099e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x50
cmp byte [rcx], 0
mov rbx, rcx
jne 0x1800099fb
cmp byte [rcx + 0x2ef4], 0
je 0x180009a15
mov r8d, 0xed0
lea rdx, str.C:UsersKediDesktopToolsProjectsCPHOOK_MAIN___BETAImGui_DirectX_11_Kiero_Hookimguiimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
xor eax, eax
lea r8, [0x180043839]
mov dword [rsp + 0x2c], eax
lea r11, [0x18003e740]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov edx, r10d
mov qword [rsp + 0x20], rax
mov r9b, 0x57
cmp r9b, 0x23
jne 0x180009a59
cmp byte [r8], r9b
jne 0x180009a59
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x180009a46
mov ecx, dword [rbx + 0x2f14]
lea rax, [0x180017260]
mov edi, dword [rbx + 0x2f10]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1800172e0]
mov qword [rsp + 0x38], rax
lea rax, [0x1800173c0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x180009b5f
inc edi
test ecx, ecx
je 0x180009ac5
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x180009aca
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x180009b5f
mov rax, qword [0x18004faf0]
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rsi
test rax, rax
je 0x180009af3
inc dword [rax + 0x3bc]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, qword [rbx + 0x2f18]
mov rbp, rax
test rsi, rsi
je 0x180009b48
movsxd rcx, dword [rbx + 0x2f10]
mov rdx, rsi
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [0x18004faf0]
test rax, rax
je 0x180009b3f
dec dword [rax + 0x3bc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rsi, qword [rsp + 0x68]
mov qword [rbx + 0x2f18], rbp
mov rbp, qword [rsp + 0x60]
mov dword [rbx + 0x2f14], edi
movsxd rax, dword [rbx + 0x2f10]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2f18]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2f10]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14000da34
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_0.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140017850], eax
call fcn.14000d780
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_UnhandledExceptionFilter]
cmp dword [0x140017850], 0
jne case.default.0x14000da8a
mov ecx, 1
call fcn.14000d780
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_TerminateProcess]
test al, 0x83
in eax, dx
call [rdi]
movabs al, byte [0xbac7f26037c4c6bb]
invalid
Function at 0x1400036a0
Capabilities:
Enumerate processes
Get graphical window text

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x1d0]
sub rsp, 0x2d0
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp + 0x1c0], rax
movabs rcx, 0xca1092302b431da2
lea rdx, [rsp + 0x30]
movabs rax, 0x7012224cbedceb5e
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rcx
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x38], rax
movabs rax, 0x70775a2990ee983d
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x40]
mov qword [rbp + 0xa0], rax
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0xa8], rax
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140004c70
xor esi, esi
xor edx, edx
mov edi, esi
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400037d7
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400037d7
cmp dword [rsp + 0x78], esi
jne 0x1400037a0
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
nop word [rax + rax]
cmp qword [rsp + 0x58], 0x10
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x64]
cmovae rdx, qword [rsp + 0x40]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400037d3
lea rdx, [rsp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400037a0
jmp 0x1400037d7
mov edi, dword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, rsi
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowExA]
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], esi
mov rcx, rax
mov rbx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [rsp + 0x60], edi
jne 0x14000383b
mov r8d, 0x104
lea rdx, [rbp + 0xb0]
mov rcx, rbx
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x14000383b
cmp byte [rbp + 0xb0], sil
jne 0x140003843
test rbx, rbx
jne 0x1400037e3
mov rbx, rsi
mov rdx, qword [rsp + 0x58]
mov qword [0x14000a718], rbx
cmp rdx, 0x10
jb 0x140003891
mov rcx, qword [rsp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003885
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003885
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005ac0
mov rbx, qword [0x14000a718]
test rbx, rbx
sete al
mov rcx, qword [rbp + 0x1c0]
xor rcx, rsp
call fcn.140005aa0
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140005900
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r10, rcx
mov r9d, 0x270
mov ecx, dword [rcx]
cmp ecx, r9d
jne 0x140005961
lea r8, [r10 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140005920
mov ecx, dword [r10]
jmp 0x140005a4a
cmp ecx, 0x4e0
jb 0x140005a4a
lea r11, [r10 + 0x9c4]
mov qword [rsp], rbx
mov eax, dword [r11]
mov ebx, 0xe3
mov edx, dword [r11 + 4]
lea r8, [r11 + 4]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 + 0x634]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x140005980
lea r11, [r10 + 0xd50]
mov ebx, 0x18c
mov eax, dword [r11]
nop dword [rax + rax]
mov edx, eax
lea r8, [r11 + 4]
xor edx, dword [r8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r11 - 0xd4c]
xor ecx, edx
mov dword [r11 - 0x9c0], ecx
lea r11, [r8]
sub rbx, 1
jne 0x1400059d0
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
xor ecx, ecx
mov dword [r10], ecx
mov eax, ecx
mov edx, dword [r10 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r10], eax
mov ecx, edx
mov eax, dword [r10 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret

Function at 0x140006434
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000647e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000647e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000647e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000647e
cmp dword [rcx + 0x84], 0xe
jbe 0x14000647e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140006480
xor al, al
add rsp, 0x28
ret