joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009b28c
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1f88]
mov eax, 0x2060
call fcn.140049010
sub rsp, rax
mov r15, rcx
lea rcx, [rsp + 0x20]
call fcn.1400096d8
xor r12d, r12d
mov rcx, r15
mov esi, r12d
call fcn.14000d56c
mov rax, qword [r15 + 8]
mov r14b, r12b
mov rdi, qword [rax]
movzx eax, word [rdi]
test ax, ax
je 0x14009b41f
mov ebx, r12d
lea r13d, [r12 + 0x25]
inc esi
inc rbx
cmp ax, r13w
jne 0x14009b3c4
cmp word [rdi + rbx*2], r13w
jne 0x14009b319
mov edx, r13d
lea rcx, [rsp + 0x20]
call fcn.14000a7b4
jmp 0x14009b3ba
lea rdx, [0x1400b64d8]
lea rcx, [rsp + 0x40]
call fcn.14000eca0
jmp 0x14009b343
test ax, ax
je 0x14009b34d
movzx edx, ax
lea rcx, [rsp + 0x40]
call fcn.14000a7b4
inc esi
inc rbx
movzx eax, word [rdi + rbx*2]
cmp ax, r13w
jne 0x14009b32c
cmp word [rdi + rbx*2], r12w
je 0x14009b3e0
mov rcx, qword [rsp + 0x40]
lea rdx, [rsp + 0x60]
mov r8d, 0xfff
mov word [rsp + 0x60], r12w
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x14009b37f
lea rdx, [rsp + 0x60]
jmp 0x14009b3a6
lea rdx, [0x1400de044]
lea rcx, [rsp + 0x20]
call fcn.1400073d8
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140007cbc
lea rdx, [0x1400de044]
lea rcx, [rsp + 0x20]
call fcn.1400073d8
lea rcx, [rsp + 0x40]
call fcn.14000a11c
inc esi
mov r14b, 1
inc rbx
jmp 0x14009b3d1
movzx edx, ax
lea rcx, [rsp + 0x20]
call fcn.14000a7b4
movzx eax, word [rdi + rbx*2]
test ax, ax
jne 0x14009b2f1
jmp 0x14009b40d
lea rdx, [0x1400de044]
mov r14b, 1
lea rcx, [rsp + 0x20]
call fcn.1400073d8
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.140007cbc
lea rcx, [rsp + 0x40]
call fcn.14000a11c
test r14b, r14b
je 0x14009b41f
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.140007c50
lea rcx, [rsp + 0x20]
call fcn.14000a11c
lea r11, [rsp + 0x2060]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1400a16b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x160]
sub rsp, 0x260
lea rax, [rsp + 0x40]
mov dword [rbp + 0x190], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x190]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
mov r14d, edx
and qword [rsp + 0x20], 0
xor edx, edx
mov rsi, rcx
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x1400a180f
mov edi, r14d
or edi, 0x20019
lea rax, [rbp + 0x198]
mov r9d, edi
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400a1834
mov rcx, qword [rbp + 0x198]
mov edx, r14d
call fcn.1400a16b0
mov rcx, qword [rbp + 0x198]
mov bl, al
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x1400a1834
and qword [rsp + 0x48], 0
lea rcx, [rsp + 0x48]
and qword [rsp + 0x58], 0
call fcn.1400a11b4
test al, al
je 0x1400a17a5
lea rcx, [rsp + 0x48]
call fcn.14009fd84
xor r9d, r9d
lea rdx, [rsp + 0x60]
mov r8d, r14d
mov rcx, rsi
call rax
jmp 0x1400a17b3
lea rdx, [rsp + 0x60]
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rsp + 0x48]
test eax, eax
jne 0x1400a1829
test rcx, rcx
je 0x1400a17c7
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea rax, [rsp + 0x40]
mov dword [rbp + 0x190], 0xff
mov qword [rsp + 0x38], rax
lea r9, [rbp + 0x190]
and qword [rsp + 0x30], 0
lea r8, [rsp + 0x60]
and qword [rsp + 0x28], 0
xor edx, edx
and qword [rsp + 0x20], 0
mov rcx, rsi
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
jne 0x1400a1721
mov al, 1
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
test rcx, rcx
je 0x1400a1834
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
xor al, al
jmp 0x1400a1811
Function at 0x1400afeac
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x50
mov rbx, rdx
lea rbp, [0x1400f30a0]
xor edx, edx
mov rcx, rbp
lea r8d, [rdx + 0x68]
call fcn.1400262c0
xor edx, edx
lea rdi, [0x1400f3108]
mov rcx, rdi
lea r8d, [rdx + 0x18]
call fcn.1400262c0
mov qword [rsp + 0x48], rdi
mov eax, 1
mov qword [rsp + 0x40], rbp
xor edi, edi
mov qword [rsp + 0x38], rdi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov dword [rsp + 0x28], reloc.OLEAUT32.dll_RegisterActiveObject
mov rdx, rbx
xor ecx, ecx
mov dword [rsp + 0x20], edi
mov dword [0x1400f30a0], 0x68
mov dword [0x1400f30dc], eax
mov word [0x1400f30e0], ax
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1400aff48
mov rcx, qword [0x1400f3108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400b03d8
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x20], rsi
mov qword [r11 + 8], rcx
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
xor r12d, r12d
mov r14, r9
mov rax, r8
mov rsi, rdx
cmp word [r8], r12w
je 0x1400b0563
mov qword [r11 - 0x68], r12
xor r9d, r9d
mov dword [r11 - 0x70], r12d
xor r8d, r8d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400b0464
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, eax
lea ecx, [r12 + 2]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, rax
test rax, rax
jne 0x1400b046b
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400b059e
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalLock]
lea r9, [rbp + 0x30]
mov qword [rsp + 0x20], r12
mov rdx, rax
mov r8d, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov rcx, r15
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x1400b0464
lea r8, [rbp - 0x28]
mov edx, 1
mov rcx, r15
call qword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov rcx, qword [rbp - 0x28]
lea rax, [rbp - 0x30]
lea r9, [0x1400b9950]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov qword [rbp - 0x30], r12
xor edx, edx
call qword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov rcx, qword [rbp - 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_GlobalFree]
mov rcx, qword [rbp - 0x30]
test rcx, rcx
je 0x1400b0464
mov rax, qword [rcx]
lea rdx, [rbp + 0x40]
call qword [rax + reloc.OLEAUT32.dll_SafeArrayGetElement]
mov rcx, qword [rbp + 0x40]
lea r8, [rbp - 0x20]
mov edx, reloc.OLEAUT32.dll_RegisterActiveObject
call qword [sym.imp.GDI32.dll_GetObjectW]
mov r8d, dword [r14]
mov rcx, qword [rbp + 0x50]
test r8d, r8d
jne 0x1400b0538
mov r8d, r12d
cmp dword [rcx], r12d
jne 0x1400b0538
mov eax, dword [rbp - 0x1c]
mov dword [r14], eax
mov eax, dword [rbp - 0x18]
mov dword [rcx], eax
mov r8d, dword [r14]
mov r9d, dword [rcx]
xor edx, edx
mov rcx, qword [rbp + 0x40]
mov dword [rsp + 0x20], 0x2000
call qword [sym.imp.USER32.dll_CopyImage]
mov rcx, qword [rbp - 0x30]
mov qword [rbp + 0x40], rax
mov rax, qword [rcx]
call qword [rax + reloc.WSOCK32.dll_recv]
mov r9, qword [rbp + 0x40]
jmp 0x1400b056a
mov r9, r12
mov qword [rbp + 0x40], r12
mov rcx, qword [rsi + 0xc0]
test rcx, rcx
je 0x1400b0580
call qword [sym.imp.GDI32.dll_DeleteObject]
mov r9, qword [rbp + 0x40]
mov rbx, qword [rsi]
xor r8d, r8d
mov rcx, rbx
mov qword [rsi + 0xc0], r9
mov edx, 0x172
call qword [sym.imp.USER32.dll_SendMessageW]
mov rax, rbx
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1400b1048
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x30
lea rcx, [0x1400f0cf0]
mov r14d, r9d
mov rsi, r8
mov rdi, rdx
call fcn.140002a64
movsxd rcx, eax
mov rax, qword [0x1400f0d90]
mov rcx, qword [rax + rcx*8]
mov rbx, qword [rcx]
cmp rsi, rdi
jne 0x1400b10cc
cmp qword [rbx + 0x2d0], 0
je 0x1400b1130
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
and qword [rsp + 0x28], 0
mov rcx, qword [rbx + 0x2d0]
mov qword [rsp + 0x20], rdi
mov r8d, dword [rsp + 0x50]
xor edx, edx
mov r9d, dword [rsp + 0x54]
call qword [sym.imp.USER32.dll_TrackPopupMenuEx]
jmp 0x1400b1152
mov rdx, rsi
call fcn.140002760
cmp eax, 0xffffffff
je 0x1400b1130
movsxd rbp, eax
mov rax, qword [0x1400f0db8]
mov rcx, qword [rax + rbp*8]
mov rdx, qword [rcx]
mov cl, byte [rdx + 0xfc]
lea eax, [rcx - 0xe]
cmp al, 2
jbe 0x1400b1130
cmp cl, 0x13
je 0x1400b1130
cmp qword [rdx + 0x18], 0
je 0x1400b1130
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_GetCursorPos]
mov rax, qword [0x1400f0db8]
and qword [rsp + 0x28], 0
mov rcx, qword [rax + rbp*8]
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rcx, qword [rcx]
mov rcx, qword [rcx + 0x18]
jmp 0x1400b10b5
movzx r9d, word [rsp + 0x70]
mov r8, rsi
shl r9, 0x10
mov edx, 0x7b
movzx eax, r14w
mov rcx, rdi
or r9, rax
call qword [sym.imp.USER32.dll_DefDlgProcW]
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret
Function at 0x140005c10
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x168
mov rax, qword [0x14000d018]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov qword [rsp + 0x30], 0
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x140005c61
xor eax, eax
jmp 0x140005dbf
mov rax, qword [rsp + 0x38]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
cmp dword [rax], 0x4550
je 0x140005c94
mov rax, qword [rsp + 0x30]
jmp 0x140005dbf
lea rax, [rsp + 0x60]
mov rcx, qword [rsp + 0x40]
mov rdi, rax
lea rsi, [rcx + 0x18]
mov ecx, 0xf0
rep movsb byte [rdi], byte [rsi]
mov eax, 8
imul rax, rax, 0
cmp dword [rsp + rax + 0xd0], 0
jne 0x140005cc9
mov rax, qword [rsp + 0x30]
jmp 0x140005dbf
mov eax, 8
imul rax, rax, 0
mov eax, dword [rsp + rax + 0xd0]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x1c]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x24]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x20]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x20], 0
jmp 0x140005d51
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x28]
mov eax, dword [rax + 0x18]
cmp dword [rsp + 0x20], eax
jae 0x140005dba
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x48]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov rdx, qword [rsp + 0x188]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
jne 0x140005db8
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x50]
movzx eax, word [rcx + rax*2]
mov rcx, qword [rsp + 0x58]
mov eax, dword [rcx + rax*4]
mov rcx, qword [rsp + 0x180]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
jmp 0x140005dba
jmp 0x140005d47
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140007b80
add rsp, 0x168
pop rdi
pop rsi
ret
Function at 0x140006490
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x288
mov rax, qword [0x14000d018]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140006515
mov rdx, qword [rsp + 0x290]
lea rcx, [rsp + 0x5c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x140006502
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x38]
jmp 0x140006522
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1400064da
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.140007b80
add rsp, 0x288
ret

Function at 0x140006540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x18
mov qword [rsp], 0
jmp 0x140006568
mov rax, qword [rsp]
inc rax
mov qword [rsp], rax
mov rax, qword [rsp + 0x28]
cmp qword [rsp], rax
jae 0x1400065c5
xor edx, edx
mov rax, qword [rsp]
mov ecx, 8
div rcx
mov rax, rdx
shl rax, 3
movzx ecx, al
mov rax, qword [rsp + 0x30]
shr rax, cl
and rax, 0xff
movsx eax, al
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
add rdx, rcx
mov rcx, rdx
movsx ecx, byte [rcx]
xor ecx, eax
mov eax, ecx
mov rcx, qword [rsp]
mov rdx, qword [rsp + 0x20]
add rdx, rcx
mov rcx, rdx
mov byte [rcx], al
jmp 0x14000655d
add rsp, 0x18
ret
Function at 0x140007830
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
mov eax, 0x2258
call fcn.140007d90
sub rsp, rax
mov rax, qword [0x14000d018]
xor rax, rsp
mov qword [rsp + 0x2240], rax
lea r9, [rsp + 0x24]
mov r8d, 0x2000
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x2260]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
je 0x140007900
mov dword [rsp + 0x20], 0
jmp 0x140007892
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
mov qword [rsp + 0x28], rax
mov ecx, dword [rsp + 0x24]
xor edx, edx
mov eax, ecx
mov ecx, 8
div rcx
mov rcx, qword [rsp + 0x28]
cmp rcx, rax
jae 0x140007900
mov eax, dword [rsp + 0x20]
mov r9d, 0x104
lea r8, [rsp + 0x2030]
mov rdx, qword [rsp + rax*8 + 0x30]
mov rcx, qword [rsp + 0x2260]
call sub.KERNEL32.dll_K32GetModuleBaseNameW
test eax, eax
je 0x1400078fe
mov rdx, qword [rsp + 0x2268]
lea rcx, [rsp + 0x2030]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscmp]
test eax, eax
jne 0x1400078fe
mov eax, 1
jmp 0x140007902
jmp 0x140007888
xor eax, eax
mov rcx, qword [rsp + 0x2240]
xor rcx, rsp
call fcn.140007b80
add rsp, 0x2258
ret

Function at 0x1400086fc
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140008746
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140008746
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140008746
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140008746
cmp dword [rcx + 0x84], 0xe
jbe 0x140008746
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140008748
xor al, al
add rsp, 0x28
ret
Function at 0x14065e210
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14065e397
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14065e241
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065e227
add dl, dl
jne 0x14065e24e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065e2ae
xor eax, eax
add dl, dl
jne 0x14065e25d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14065e365
add dl, dl
jne 0x14065e26e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065e27b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065e288
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065e295
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14065e2a2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14065e236
mov eax, 1
add dl, dl
jne 0x14065e2be
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14065e2cb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065e2b3
sub eax, ebx
mov ebx, 1
jne 0x14065e304
mov ecx, 1
add dl, dl
jne 0x14065e2e6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14065e2f3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065e2db
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065e236
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14065e320
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14065e32d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14065e315
cmp eax, 0x7d00
jae 0x14065e353
cmp eax, 0x500
jb 0x14065e34e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065e236
cmp eax, 0x7f
ja 0x14065e356
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14065e236
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14065e38a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14065e236
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140024200
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
mov eax, dword [0x140094430]
mov edx, dword [0x140094434]
shrd edx, eax, 9
xor edx, 0x21e5847
cmp dword [0x14009dbe4], edx
je 0x1400242cd
lea r10, [r8 + 0x12]
xor eax, eax
nop dword [rax]
movsxd r11, eax
mov eax, dword [0x140094438]
mov edx, dword [0x14009443c]
shrd edx, eax, 9
movzx ebx, byte [r10 + r11]
mov esi, edx
xor esi, 0x998fcf0d
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
imul eax, dword [0x140094440], 0x10aec869
imul edx, dword [0x140094444], 0x5522409e
add edx, eax
mov eax, r11d
imul r9d, dword [0x140094448], 0xc3f1a1e0
add edx, eax
add edx, 0x60f2c328
imul eax, dword [0x14009444c], 0xa9d7fb4c
add r9d, eax
add r9d, 0xe2c89fa7
mov eax, edx
cmp edx, r9d
jne 0x140024230
imul eax, dword [0x140094450], 0xbd2dac55
imul ecx, dword [0x140094454], 0xf43822b2
add eax, ecx
add eax, 0xa1a88139
mov dword [0x14009dbe4], eax
imul eax, dword [0x140094458], 0x7e324bef
imul ecx, dword [0x14009445c], 0x5f2fede
add eax, ecx
add eax, 0xad60341
pop rbx
pop rsi
ret

Function at 0x1400242f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x140094460], 0x7a18b765
imul edx, dword [0x140094464], 0x3c5f0f48
add eax, edx
add eax, 0x2f216f77
cmp dword [0x14009dc0c], eax
je 0x1400243bf
lea r10, [r8 + 0x1b]
xor eax, eax
nop word cs:[rax + rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x140094468], 0x88a9014d
imul edx, dword [0x14009446c], 0x48682bb1
lea esi, [rax + rdx]
add esi, 0xb025b194
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x140094470]
mov edx, dword [0x140094474]
shrd edx, eax, 5
xor edx, 0x17aeca0a
add edx, r11d
mov eax, dword [0x140094478]
mov r9d, dword [0x14009447c]
shrd r9d, eax, 0x11
xor r9d, 0xdcb97655
mov eax, edx
cmp edx, r9d
jne 0x140024330
mov eax, dword [0x140094480]
mov ecx, dword [0x140094484]
shrd ecx, eax, 7
xor ecx, 0xc64b28ea
mov dword [0x14009dc0c], ecx
mov eax, dword [0x140094488]
mov ecx, dword [0x14009448c]
shrd ecx, eax, 0x17
mov eax, ecx
xor eax, 0xa0a4dcb3
pop rbx
pop rsi
ret
Function at 0x1400243e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rbx
mov r8, rdx
imul eax, dword [0x140094490], 0x256354ce
imul edx, dword [0x140094494], 0x38bbd8cf
add eax, edx
add eax, 0xb32d3f08
cmp dword [0x14009dc18], eax
je 0x1400244b4
lea r10, [r8 + 0x18]
xor eax, eax
nop word cs:[rax + rax]
movsxd r11, eax
movzx ebx, byte [r10 + r11]
imul eax, dword [0x140094498], 0x81e2b5e4
imul edx, dword [0x14009449c], 0x3891449
lea esi, [rax + rdx]
add esi, 0xc864e222
mov r9d, r11d
mov eax, r11d
xor edx, edx
div esi
movsxd rax, edx
xor bl, byte [r8 + rax]
mov byte [rcx + r11], bl
mov eax, dword [0x1400944a0]
mov edx, dword [0x1400944a4]
shrd edx, eax, 0x15
xor edx, 0x9abc3408
add edx, r11d
mov eax, dword [0x1400944a8]
mov r9d, dword [0x1400944ac]
shrd r9d, eax, 0x10
xor r9d, 0xd3ca2ac8
mov eax, edx
cmp edx, r9d
jne 0x140024420
imul eax, dword [0x1400944b0], 0x441ab62a
imul ecx, dword [0x1400944b4], 0xc8024721
add eax, ecx
add eax, 0x96e8c506
mov dword [0x14009dc18], eax
mov eax, dword [0x1400944b8]
mov ecx, dword [0x1400944bc]
shrd ecx, eax, 6
mov eax, ecx
xor eax, 0xbcbab67c
pop rbx
pop rsi
ret
Function at 0x180007070
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x290
mov rax, qword [0x1801a70c0]
xor rax, rsp
mov qword [rsp + 0x280], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800070c9
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1800070d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1800071ba
mov qword [rsp + 0x2a0], rdi
xor edi, edi
nop word [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x30], rdi
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], di
jne 0x180007100
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.1800152b0
cmp qword [rbx + 0x18], 7
mov rax, rbx
jbe 0x180007126
mov rax, qword [rbx]
mov r10, qword [rsp + 0x38]
lea r8, [rsp + 0x20]
mov r9, qword [rsp + 0x20]
cmp r10, 7
mov rdx, qword [rsp + 0x30]
cmova r8, r9
cmp rdx, qword [rbx + 0x10]
jne 0x1800071db
test rdx, rdx
je 0x180007168
sub r8, rax
movzx ecx, word [r8 + rax]
cmp cx, word [rax]
jne 0x1800071db
add rax, 2
sub rdx, 1
jne 0x180007154
mov edi, dword [rsp + 0x48]
cmp r10, 7
jbe 0x1800071a7
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x18000719f
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000722d
mov rcx, r9
call fcn.18011a440
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
mov rdi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.18011a420
mov rbx, qword [rsp + 0x2a8]
add rsp, 0x290
pop rsi
ret
cmp r10, 7
jbe 0x180007212
lea rdx, [r10*2 + 2]
mov rax, r9
cmp rdx, 0x1000
jb 0x18000720a
mov r9, qword [r9 - 8]
add rdx, 0x27
sub rax, r9
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000722d
mov rcx, r9
call fcn.18011a440
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800070e0
jmp 0x1800071a7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3