joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400034a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [0x140090f00]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x1400035e4
movdqa xmm0, xmmword [0x140084560]
xor r9d, r9d
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x407151d
mov dword [rbp - 0x14], 0x82c1606
mov word [rbp - 0x10], 0x701
mov byte [rbp - 0xe], al
movsxd rcx, eax
lea rdx, [rbp - 0x28]
add rdx, rcx
lea ecx, [rax + 0x4f]
inc eax
xor byte [rdx], cl
cmp eax, 0x1a
jb 0x140003500
xor eax, eax
mov byte [rbp - 0xe], r9b
mov word [rbp - 0x30], ax
mov edx, r9d
mov dword [rbp - 0x48], 0x99359904
mov r8d, 0x66b1
mov dword [rbp - 0x44], 0x993c9923
mov dword [rbp - 0x40], 0x99389936
mov dword [rbp - 0x3c], 0x99649966
mov dword [rbp - 0x38], 0x993c9979
mov dword [rbp - 0x34], 0x99369935
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x48]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x140003560
mov word [rbp - 0x30], r9w
lea rcx, [rbp - 0x48]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r9w
jne 0x140003590
add rax, rax
lea r9, [rbp - 0x60]
mov ecx, 0xfffc
lea r8, [rbp - 0x58]
cmp rax, rcx
cmova rax, rcx
xor edx, edx
mov word [rbp - 0x58], ax
xor ecx, ecx
add ax, 2
mov word [rbp - 0x56], ax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x50], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x28]
call qword [0x1400752a0]
mov qword [0x140090f00], rax
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140071860
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003610
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [0x140090ef8]
mov rbx, rcx
test rax, rax
jne 0x140003744
mov dword [rbp - 0x38], 0x1e253508
xor r9d, r9d
mov dword [rbp - 0x34], 0x3a34373c
mov dword [rbp - 0x30], 0x3f343103
mov byte [rbp - 0x2c], al
nop dword [rax]
movsxd rcx, eax
lea rdx, [rbp - 0x38]
add rdx, rcx
lea ecx, [rax + 0x4f]
inc eax
xor byte [rdx], cl
cmp eax, 0xc
jb 0x140003660
xor eax, eax
mov byte [rbp - 0x2c], r9b
mov word [rbp - 0x10], ax
mov edx, r9d
mov dword [rbp - 0x28], 0x99359904
mov r8d, 0x66b1
mov dword [rbp - 0x24], 0x993c9923
mov dword [rbp - 0x20], 0x99389936
mov dword [rbp - 0x1c], 0x99649966
mov dword [rbp - 0x18], 0x993c9979
mov dword [rbp - 0x14], 0x99369935
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x28]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x1400036c0
mov word [rbp - 0x10], r9w
lea rcx, [rbp - 0x28]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r9w
jne 0x1400036f0
add rax, rax
lea r9, [rbp - 0x50]
mov ecx, 0xfffc
lea r8, [rbp - 0x48]
cmp rax, rcx
cmova rax, rcx
xor edx, edx
mov word [rbp - 0x48], ax
xor ecx, ecx
add ax, 2
mov word [rbp - 0x46], ax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x40], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x38]
call qword [0x1400752a0]
mov qword [0x140090ef8], rax
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140071860
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
Function at 0x140003770
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [0x140090f28]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x1400038a4
mov dword [rbp - 0x38], 0x7253508
xor r9d, r9d
mov dword [rbp - 0x34], 0x18273120
mov dword [rbp - 0x30], 0x1b3c3536
mov byte [rbp - 0x2c], al
movsxd rcx, eax
lea rdx, [rbp - 0x38]
add rdx, rcx
lea ecx, [rax + 0x4f]
inc eax
xor byte [rdx], cl
cmp eax, 0xc
jb 0x1400037c1
xor eax, eax
mov byte [rbp - 0x2c], r9b
mov word [rbp - 0x10], ax
mov edx, r9d
mov dword [rbp - 0x28], 0x9934990e
mov r8d, 0x66b1
mov dword [rbp - 0x24], 0x99339927
mov dword [rbp - 0x20], 0x993d9923
mov dword [rbp - 0x1c], 0x99649966
mov dword [rbp - 0x18], 0x993c9979
mov dword [rbp - 0x14], 0x99369935
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x28]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x140003820
mov word [rbp - 0x10], r9w
lea rcx, [rbp - 0x28]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r9w
jne 0x140003850
add rax, rax
lea r9, [rbp - 0x50]
mov ecx, 0xfffc
lea r8, [rbp - 0x48]
cmp rax, rcx
cmova rax, rcx
xor edx, edx
mov word [rbp - 0x48], ax
xor ecx, ecx
add ax, 2
mov word [rbp - 0x46], ax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x40], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x38]
call qword [0x1400752a0]
mov qword [0x140090f28], rax
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140071860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400038d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [0x140090ee8]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x140003a14
movdqa xmm0, xmmword [0x1400845b0]
xor r9d, r9d
movdqu xmmword [rbp - 0x28], xmm0
mov word [rbp - 0x18], 0x373a
mov byte [rbp - 0x16], al
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rbp - 0x28]
add rdx, rcx
lea ecx, [rax + 0x4f]
inc eax
xor byte [rdx], cl
cmp eax, 0x12
jb 0x140003930
xor eax, eax
mov byte [rbp - 0x16], r9b
mov word [rbp - 0x30], ax
mov edx, r9d
mov dword [rbp - 0x48], 0x99359904
mov r8d, 0x66b1
mov dword [rbp - 0x44], 0x993c9923
mov dword [rbp - 0x40], 0x99389936
mov dword [rbp - 0x3c], 0x99649966
mov dword [rbp - 0x38], 0x993c9979
mov dword [rbp - 0x34], 0x99369935
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x48]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x140003990
mov word [rbp - 0x30], r9w
lea rcx, [rbp - 0x48]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r9w
jne 0x1400039c0
add rax, rax
lea r9, [rbp - 0x60]
mov ecx, 0xfffc
lea r8, [rbp - 0x58]
cmp rax, rcx
cmova rax, rcx
xor edx, edx
mov word [rbp - 0x58], ax
xor ecx, ecx
add ax, 2
mov word [rbp - 0x56], ax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x50], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x28]
call qword [0x1400752a0]
mov qword [0x140090ee8], rax
mov r8d, 0x104
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140071860
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003a50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [0x140090ef0]
mov rbx, rcx
test rax, rax
jne 0x140003b84
mov dword [rbp - 0x38], 0x36303f03
xor r9d, r9d
mov dword [rbp - 0x34], 0x24373d1f
mov dword [rbp - 0x30], 0x1f202a36
mov word [rbp - 0x2c], 0x1d23
mov byte [rbp - 0x2a], al
nop
movsxd rcx, eax
lea rdx, [rbp - 0x38]
add rdx, rcx
lea ecx, [rax + 0x4f]
inc eax
xor byte [rdx], cl
cmp eax, 0xe
jb 0x140003aa0
xor eax, eax
mov byte [rbp - 0x2a], r9b
mov word [rbp - 0x10], ax
mov edx, r9d
mov dword [rbp - 0x28], 0x99359904
mov r8d, 0x66b1
mov dword [rbp - 0x24], 0x993c9923
mov dword [rbp - 0x20], 0x99389936
mov dword [rbp - 0x1c], 0x99649966
mov dword [rbp - 0x18], 0x993c9979
mov dword [rbp - 0x14], 0x99369935
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x28]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x140003b00
mov word [rbp - 0x10], r9w
lea rcx, [rbp - 0x28]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r9w
jne 0x140003b30
add rax, rax
lea r9, [rbp - 0x50]
mov ecx, 0xfffc
lea r8, [rbp - 0x48]
cmp rax, rcx
cmova rax, rcx
xor edx, edx
mov word [rbp - 0x48], ax
xor ecx, ecx
add ax, 2
mov word [rbp - 0x46], ax
lea rax, [rbp - 0x28]
mov qword [rbp - 0x40], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rcx, qword [rbp - 0x50]
lea rdx, [rbp - 0x38]
call qword [0x1400752a0]
mov qword [0x140090ef0], rax
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 1]
call rax
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140071860
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rbp
ret
Function at 0x140003bb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x3f]
sub rsp, 0x90
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rax, qword [0x140090f18]
xor edi, edi
mov rbx, rcx
test rax, rax
jne 0x140003ce3
mov dword [rbp + 7], 0x3334220c
mov eax, edi
mov dword [rbp + 0xb], 0x3f133127
mov dword [rbp + 0xf], 0x183d3b
movsxd rcx, eax
lea rdx, [rbp + 7]
add rdx, rcx
lea ecx, [rax + 0x4f]
inc eax
xor byte [rdx], cl
cmp eax, 0xb
jb 0x140003c01
xor eax, eax
mov byte [rbp + 0x12], dil
mov word [rbp + 0x2f], ax
mov edx, edi
mov dword [rbp + 0x17], 0x99359904
mov r8d, 0x66b1
mov dword [rbp + 0x1b], 0x993c9923
mov dword [rbp + 0x1f], 0x99389936
mov dword [rbp + 0x23], 0x99649966
mov dword [rbp + 0x27], 0x993c9979
mov dword [rbp + 0x2b], 0x99369935
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp + 0x17]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x140003c60
mov word [rbp + 0x2f], di
lea rcx, [rbp + 0x17]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], di
jne 0x140003c90
add rax, rax
lea r9, [rbp - 0x11]
mov ecx, 0xfffc
lea r8, [rbp - 9]
cmp rax, rcx
cmova rax, rcx
xor edx, edx
mov word [rbp - 9], ax
xor ecx, ecx
add ax, 2
mov word [rbp - 7], ax
lea rax, [rbp + 0x17]
mov qword [rbp - 1], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rcx, qword [rbp - 0x11]
lea rdx, [rbp + 7]
call qword [0x1400752a0]
mov qword [0x140090f18], rax
mov qword [rsp + 0x30], rdi
xor r9d, r9d
mov dword [rsp + 0x28], pe_nt_image_headers64
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
mov rcx, rbx
call rax
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.140071860
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140003d30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [0x140090ee0]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x140003e74
movdqa xmm0, xmmword [0x140084590]
xor r9d, r9d
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x70c090b
mov byte [rbp - 0x14], al
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rbp - 0x28]
add rdx, rcx
lea ecx, [rax + 0x4f]
inc eax
xor byte [rdx], cl
cmp eax, 0x14
jb 0x140003d90
xor eax, eax
mov byte [rbp - 0x14], r9b
mov word [rbp - 0x30], ax
mov edx, r9d
mov dword [rbp - 0x48], 0x99359904
mov r8d, 0x66b1
mov dword [rbp - 0x44], 0x993c9923
mov dword [rbp - 0x40], 0x99389936
mov dword [rbp - 0x3c], 0x99649966
mov dword [rbp - 0x38], 0x993c9979
mov dword [rbp - 0x34], 0x99369935
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x48]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x140003df0
mov word [rbp - 0x30], r9w
lea rcx, [rbp - 0x48]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r9w
jne 0x140003e20
add rax, rax
lea r9, [rbp - 0x60]
mov ecx, 0xfffc
lea r8, [rbp - 0x58]
cmp rax, rcx
cmova rax, rcx
xor edx, edx
mov word [rbp - 0x58], ax
xor ecx, ecx
add ax, 2
mov word [rbp - 0x56], ax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x50], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x28]
call qword [0x1400752a0]
mov qword [0x140090ee0], rax
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140071860
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x140003ea0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [0x140090ed8]
mov rdi, rdx
mov rbx, rcx
test rax, rax
jne 0x140003fe4
movdqa xmm0, xmmword [0x140084610]
xor r9d, r9d
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x70c090b
mov byte [rbp - 0x14], al
nop dword [rax]
nop word [rax + rax]
movsxd rcx, eax
lea rdx, [rbp - 0x28]
add rdx, rcx
lea ecx, [rax + 0x4f]
inc eax
xor byte [rdx], cl
cmp eax, 0x14
jb 0x140003f00
xor eax, eax
mov byte [rbp - 0x14], r9b
mov word [rbp - 0x30], ax
mov edx, r9d
mov dword [rbp - 0x48], 0x99359904
mov r8d, 0x66b1
mov dword [rbp - 0x44], 0x993c9923
mov dword [rbp - 0x40], 0x99389936
mov dword [rbp - 0x3c], 0x99649966
mov dword [rbp - 0x38], 0x993c9979
mov dword [rbp - 0x34], 0x99369935
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x48]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 0xc
jb 0x140003f60
mov word [rbp - 0x30], r9w
lea rcx, [rbp - 0x48]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r9w
jne 0x140003f90
add rax, rax
lea r9, [rbp - 0x60]
mov ecx, 0xfffc
lea r8, [rbp - 0x58]
cmp rax, rcx
cmova rax, rcx
xor edx, edx
mov word [rbp - 0x58], ax
xor ecx, ecx
add ax, 2
mov word [rbp - 0x56], ax
lea rax, [rbp - 0x48]
mov qword [rbp - 0x50], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x28]
call qword [0x1400752a0]
mov qword [0x140090ed8], rax
mov rdx, rdi
mov rcx, rbx
call rax
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140071860
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1400040c0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x170
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rsp + 0x160], rax
xor edx, edx
mov dword [rsp + 0x30], 0x130
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400041c2
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x5c]
test rbx, rbx
je 0x140004158
movzx ecx, byte [rbx]
cmp cl, byte [rsp + 0x5c]
jne 0x140004150
lea r8, [rsp + 0x5c]
mov rax, rbx
sub rax, r8
nop
test cl, cl
je 0x140004147
cmp byte [rdx], 0
je 0x140004150
movzx ecx, byte [rax + rdx + 1]
inc rdx
cmp cl, byte [rdx]
je 0x140004130
jmp 0x140004150
cmp byte [rdx], 0
je 0x1400041e5
cmp cl, byte [rdx]
je 0x1400041e5
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400041c2
nop word [rax + rax]
lea rcx, [rsp + 0x5c]
test rbx, rbx
je 0x1400041b0
movzx eax, byte [rbx]
cmp al, byte [rsp + 0x5c]
jne 0x1400041ac
lea r8, [rsp + 0x5c]
mov rdx, rbx
sub rdx, r8
nop
test al, al
je 0x1400041a7
cmp byte [rcx], 0
je 0x1400041ac
movzx eax, byte [rdx + rcx + 1]
inc rcx
cmp al, byte [rcx]
je 0x140004190
jmp 0x1400041ac
cmp byte [rcx], 0
je 0x1400041e5
cmp al, byte [rcx]
je 0x1400041e5
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140004170
xor eax, eax
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.140071860
mov rbx, qword [rsp + 0x180]
add rsp, 0x170
pop rdi
ret
mov eax, dword [rsp + 0x38]
jmp 0x1400041c4
Function at 0x140004f40
Capabilities:
Encode data using xor
Print debug messages

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 8], rax
lea rcx, str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
movdqa xmm0, xmmword [0x1400845d0]
xor ebx, ebx
mov dword [rbp - 0x40], ebx
mov edx, ebx
movdqu xmmword [rbp - 0x28], xmm0
mov dword [rbp - 0x18], 0x10310e30
mov dword [rbp - 0x14], 0x1500070c
mov word [rbp - 0x10], reloc.WS2_32.dll_sendto
movsxd rax, edx
lea rcx, [rbp - 0x28]
add rcx, rax
lea eax, [rdx + 0x4f]
inc edx
xor byte [rcx], al
cmp edx, 0x19
jb 0x140004f90
lea r9, [rbp - 0x40]
mov byte [rbp - 0xf], bl
mov r8d, Ordinal_32
mov qword [rsp + 0x20], 4
lea rcx, [rbp - 0x28]
call fcn.14000c430
cmp dword [rbp - 0x40], ebx
je 0x1400050a0
movdqa xmm0, xmmword [0x1400845d0]
mov edx, ebx
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x38], rbx
mov dword [rbp - 0x18], 0x10310e30
mov dword [rbp - 0x14], 0x1500070c
mov word [rbp - 0x10], reloc.WS2_32.dll_sendto
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x28]
add rcx, rax
lea eax, [rdx + 0x4f]
inc edx
xor byte [rcx], al
cmp edx, 0x19
jb 0x140005000
lea r9, [rbp - 0x38]
mov byte [rbp - 0xf], bl
mov r8d, 7
mov qword [rsp + 0x20], 8
lea rcx, [rbp - 0x28]
call fcn.14000c430
cmp qword [rbp - 0x38], rbx
jne 0x1400050a0
movdqa xmm0, xmmword [0x1400845d0]
movdqu xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x30], rbx
mov dword [rbp - 0x18], 0x10310e30
mov dword [rbp - 0x14], 0x1500070c
mov word [rbp - 0x10], reloc.WS2_32.dll_sendto
movsxd rax, ebx
lea rcx, [rbp - 0x28]
add rcx, rax
lea eax, [rbx + 0x4f]
inc ebx
xor byte [rcx], al
cmp ebx, 0x19
jb 0x140005060
lea r9, [rbp - 0x30]
mov byte [rbp - 0xf], 0
mov r8d, reloc.WLDAP32.dll_Ordinal_30
mov qword [rsp + 0x20], 8
lea rcx, [rbp - 0x28]
call fcn.14000c430
cmp qword [rbp - 0x30], 0
setne al
jmp 0x1400050a2
mov al, 1
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140071860
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x140005a40
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
push rbp
push rbx
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140090080]
xor rax, rsp
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [0x140084550]
xor eax, eax
xor ebx, ebx
mov dword [rbp - 0x18], 0x713080b
mov edx, ebx
mov word [rbp - 0x14], 2
mov r15, rcx
mov byte [rbp - 0x12], al
movdqu xmmword [rbp - 0x28], xmm0
nop dword [rax]
nop word [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x28]
add rcx, rax
lea eax, [rdx + 0x4f]
inc edx
xor byte [rcx], al
cmp edx, 0x16
jb 0x140005a90
mov byte [rbp - 0x12], bl
mov edx, ebx
mov dword [rbp - 0x40], 0x99249921
mov r8d, 0x66b1
mov dword [rbp - 0x3c], 0x993e9935
mov dword [rbp - 0x38], 0x997a993f
mov dword [rbp - 0x34], 0x993a9931
mov dword [rbp - 0x30], 0x993b
nop dword [rax]
nop dword [rax + rax]
movsxd rax, edx
lea rcx, [rbp - 0x40]
lea rcx, [rcx + rax*2]
movzx eax, dx
sub ax, r8w
inc edx
xor word [rcx], ax
cmp edx, 9
jb 0x140005ae0
mov word [rbp - 0x2e], bx
lea rcx, [rbp - 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], bx
jne 0x140005b10
add rax, rax
mov qword [rsp + 0xa8], rsi
mov ecx, 0xfffc
mov qword [rsp + 0xb0], rdi
cmp rax, rcx
mov qword [rsp + 0xb8], r14
lea r9, [rbp - 0x58]
cmova rax, rcx
lea r8, [rbp - 0x50]
mov word [rbp - 0x50], ax
xor edx, edx
add ax, 2
xor ecx, ecx
mov word [rbp - 0x4e], ax
lea rax, [rbp - 0x40]
mov qword [rbp - 0x48], rax
call qword [sym.imp.ntdll.dll_LdrGetDllHandle]
mov r9, qword [rbp - 0x58]
test r9, r9
je 0x140005bdf
movsxd rax, dword [r9 + 0x3c]
mov r10d, dword [rax + r9 + 0x88]
add r10, r9
mov r11d, dword [r10 + 0x18]
test r11d, r11d
je 0x140005bdf
mov r14d, dword [r10 + 0x20]
movzx esi, byte [rbp - 0x28]
nop
lea rax, [r14 + rbx*4]
mov r8d, dword [rax + r9]
lea rdx, [rbp - 0x28]
add r8, r9
je 0x140005bd8
movzx eax, byte [r8]
cmp al, sil
jne 0x140005bce
lea rcx, [rbp - 0x28]
sub r8, rcx
test al, al
je 0x140005bc9
cmp byte [rdx], 0
je 0x140005bce
movzx eax, byte [r8 + rdx + 1]
inc rdx
cmp al, byte [rdx]
je 0x140005bb1
jmp 0x140005bce
cmp byte [rdx], 0
je 0x140005c11
movsx ecx, byte [rdx]
movsx edx, al
cmp edx, ecx
je 0x140005c11
inc ebx
cmp ebx, r11d
jb 0x140005b90
xor al, al
mov r14, qword [rsp + 0xb8]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140071860
add rsp, 0x80
pop r15
pop rbx
pop rbp
ret
mov ecx, dword [r10 + 0x24]
add rcx, r9
movzx edx, word [rcx + rbx*2]
mov ecx, dword [r10 + 0x1c]
add rcx, r9
mov ebx, dword [rcx + rdx*4]
add rbx, r9
je 0x140005bdf
test r15, r15
jne 0x140005c3b
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
jmp 0x140005c3e
mov rcx, r15
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x11]
call rbx
test eax, eax
sete al
jmp 0x140005be1
Function at 0x140008d80
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x15
jb 0x140008d90
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x140008db0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xf
jb 0x140008dc0
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x140008de0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x11
jb 0x140008df0
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x140008e10
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x18
jb 0x140008e20
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x140008eb0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x3e
jb 0x140008ec0
mov byte [rcx + 0x3e], 0
mov rax, rcx
ret

Function at 0x140008ee0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 9
jb 0x140008ef0
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x140008f10
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x14
jb 0x140008f20
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x140008f40
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x16
jb 0x140008f50
mov byte [rcx + 0x16], 0
mov rax, rcx
ret

Function at 0x140008f70
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xb
jb 0x140008f80
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x140008fa0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0xc
jb 0x140008fb0
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x140008fd0
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 7
jb 0x140008fe0
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x140009000
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
nop dword [rax]
nop word [rax + rax]
movsxd r8, eax
lea edx, [rax + 0x4f]
inc eax
xor byte [r8 + rcx], dl
cmp eax, 0x10
jb 0x140009010
mov byte [rcx + 0x10], 0
mov rax, rcx
ret