joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140025560
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140025583
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
repz ret

Function at 0x1400255e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
add rax, 0x10
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140025603
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
repz ret

Function at 0x140025660
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140025689
aesenc xmm2, xmm1
invalid
invalid
invalid

Function at 0x1400256f0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
xorps xmm4, xmm0
xorps xmm5, xmm0
movups xmm0, xmmword [rcx + 0x20]
lea rcx, [rcx + rax + 0x20]
neg rax
nop dword [rax]
add rax, 0x10

Function at 0x140025758
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
shl dword [rsi + 0xf], 1
cmp dh, bl
fldenv [rsi + 0xf]
cmp dh, bl
loope 0x1400257ca
invalid
nop
nop
nop
nop
nop
nop

Function at 0x140025780
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesenc xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesenc xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400257df
Function at 0x1400257d0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne fcn.1400257d0
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
repz ret

Function at 0x140025860
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
pxor xmm3, xmm0
pxor xmm4, xmm0
aesdec xmm2, xmm1
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm3, xmm1
pxor xmm5, xmm0
pxor xmm6, xmm0
aesdec xmm4, xmm1
pxor xmm7, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x1400258bf
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x1400258b0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdeclast xmm2, xmm0
aesdeclast xmm3, xmm0
aesdeclast xmm4, xmm0
aesdeclast xmm5, xmm0
aesdeclast xmm6, xmm0
aesdeclast xmm7, xmm0
repz ret

Function at 0x140025940
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesenc xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesenc xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x14002599a

Function at 0x1400259ba
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesenc xmm2, xmm0
aesenc xmm3, xmm0
aesenc xmm4, xmm0
aesenc xmm5, xmm0
aesenc xmm6, xmm0
aesenc xmm7, xmm0
aesenc xmm8, xmm0
aesenc xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140025990
aesenc xmm2, xmm1
aesenc xmm3, xmm1
aesenc xmm4, xmm1
aesenc xmm5, xmm1
aesenc xmm6, xmm1
aesenc xmm7, xmm1
aesenc xmm8, xmm1
aesenc xmm9, xmm1
aesenclast xmm2, xmm0
aesenclast xmm3, xmm0
aesenclast xmm4, xmm0
aesenclast xmm5, xmm0
aesenclast xmm6, xmm0
aesenclast xmm7, xmm0
aesenclast xmm8, xmm0
aesenclast xmm9, xmm0
repz ret
Function at 0x140025a50
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
movups xmm0, xmmword [rcx]
shl eax, 4
movups xmm1, xmmword [rcx + 0x10]
xorps xmm2, xmm0
xorps xmm3, xmm0
pxor xmm4, xmm0
pxor xmm5, xmm0
pxor xmm6, xmm0
lea rcx, [rcx + rax + 0x20]
neg rax
aesdec xmm2, xmm1
pxor xmm7, xmm0
pxor xmm8, xmm0
aesdec xmm3, xmm1
pxor xmm9, xmm0
movups xmm0, xmmword [rcx + rax]
add rax, 0x10
jmp 0x140025aaa
aesdec xmm2, xmm1
aesdec xmm3, xmm1
fcompp
aesdec xmm4, xmm1
aesdec xmm5, xmm1
aesdec xmm6, xmm1
aesdec xmm7, xmm1
aesdec xmm8, xmm1
aesdec xmm9, xmm1
movups xmm1, xmmword [rcx + rax]
add rax, 0x20
aesdec xmm2, xmm0
aesdec xmm3, xmm0
aesdec xmm4, xmm0
aesdec xmm5, xmm0
aesdec xmm6, xmm0
aesdec xmm7, xmm0
aesdec xmm8, xmm0
aesdec xmm9, xmm0
movups xmm0, xmmword [rcx + rax - 0x10]
jne 0x140025aa0
aesdec xmm2, xmm1
aesdec xmm3, xmm1
fldenv [rsi + 0xf]
cmp dh, bl
loope 0x140025b7d
invalid
Function at 0x140026424
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
lea rdi, [rdi + 0x60]
movups xmm1, xmmword [rcx + r10 - 0x40]
pxor xmm8, xmm2
movaps xmm2, xmmword [rsp]
pxor xmm9, xmm3
movaps xmm3, xmmword [rsp + 0x10]
pxor xmm10, xmm4
movaps xmm4, xmmword [rsp + 0x20]
pxor xmm11, xmm5
movaps xmm5, xmmword [rsp + 0x30]
pxor xmm12, xmm6
movaps xmm6, xmmword [rsp + 0x40]
pxor xmm13, xmm7
movaps xmm7, xmmword [rsp + 0x50]
movdqu xmmword [rsi], xmm8
movdqu xmmword [rsi + 0x10], xmm9
movdqu xmmword [rsi + 0x20], xmm10
movdqu xmmword [rsi + 0x30], xmm11
movdqu xmmword [rsi + 0x40], xmm12
movdqu xmmword [rsi + 0x50], xmm13
lea rsi, [rsi + 0x60]
sub rdx, 6

Function at 0x140026494
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
add r8d, 6
movups xmm0, xmmword [rcx + r10 - 0x30]
aesenc xmm2, xmm1
mov eax, r8d
xor eax, ebp
aesenc xmm3, xmm1
movbe dword [rsp + 0xc], eax
lea eax, [r8 + 1]
aesenc xmm4, xmm1
xor eax, ebp
movbe dword [rsp + 0x1c], eax
aesenc xmm5, xmm1
lea eax, [r8 + 2]
xor eax, ebp
aesenc xmm6, xmm1
movbe dword [rsp + 0x2c], eax
lea eax, [r8 + 3]
aesenc xmm7, xmm1
movups xmm1, xmmword [rcx + r10 - 0x20]
xor eax, ebp
aesenc xmm2, xmm0
movbe dword [rsp + 0x3c], eax
lea eax, [r8 + 4]
aesenc xmm3, xmm0
xor eax, ebp
movbe dword [rsp + 0x4c], eax
aesenc xmm4, xmm0
lea eax, [r8 + 5]
xor eax, ebp
aesenc xmm5, xmm0
movbe dword [rsp + 0x5c], eax
mov rax, r10
aesenc xmm6, xmm0
aesenc xmm7, xmm0
movups xmm0, xmmword [rcx + r10 - 0x10]
call fcn.1400257d0
movdqu xmm8, xmmword [rdi]
movdqu xmm9, xmmword [rdi + 0x10]
movdqu xmm10, xmmword [rdi + 0x20]
movdqu xmm11, xmmword [rdi + 0x30]
movdqu xmm12, xmmword [rdi + 0x40]
movdqu xmm13, xmmword [rdi + 0x50]
jae 0x140026360
add rdx, 6
je 0x140026aa2
invalid
invalid
add byte [rax], al
lea eax, [r10 - 0x30]
lea rcx, [rcx + r10 - 0x50]
neg eax
shr eax, 4
jmp 0x1400268da
xorps xmm0, xmm0
xor ebp, ebp
pxor xmm1, xmm1
pxor xmm2, xmm2
pxor xmm3, xmm3
pxor xmm4, xmm4
pxor xmm5, xmm5
movaps xmm6, xmmword [r11 - 0xa8]
movaps xmmword [r11 - 0xa8], xmm0
movaps xmm7, xmmword [r11 - 0x98]
movaps xmmword [r11 - 0x98], xmm0
movaps xmm8, xmmword [r11 - 0x88]
movaps xmmword [r11 - 0x88], xmm0
movaps xmm9, xmmword [r11 - 0x78]
movaps xmmword [r11 - 0x78], xmm0
movaps xmm10, xmmword [r11 - 0x68]
movaps xmmword [r11 - 0x68], xmm0
movaps xmm11, xmmword [r11 - 0x58]
movaps xmmword [r11 - 0x58], xmm0
movaps xmm12, xmmword [r11 - 0x48]
movaps xmmword [r11 - 0x48], xmm0
movaps xmm13, xmmword [r11 - 0x38]
movaps xmmword [r11 - 0x38], xmm0
movaps xmm14, xmmword [r11 - 0x28]
movaps xmmword [r11 - 0x28], xmm0
movaps xmm15, xmmword [r11 - 0x18]
movaps xmmword [r11 - 0x18], xmm0
movaps xmmword [rsp], xmm0
movaps xmmword [rsp + 0x10], xmm0
movaps xmmword [rsp + 0x20], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x50], xmm0
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm0
mov rbp, qword [r11 - 8]
lea rsp, [r11]
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
Function at 0x1400264a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
inc byte [0xcd4364a6]
ror byte [rdx - 0x73], 1
adc qword [rax - 0x173e2709], r14
add al, 0xe9
and eax, dword [rax + rax]
add byte [rax - 0x6f6f6f70], dl
nop
nop
nop
nop
Function at 0x140030c1c
Capabilities:
Encode data using xor

Disassembly:
add byte [rax], al
sub r9, 0x30
movabs rax, 0xa040608020c0e000
movdqu xmm14, xmmword [rdx + 0x30]
jb 0x140030c4e
movdqu xmm15, xmmword [rdx + 0x40]
movdqu xmm3, xmmword [r8 + 0x30]
movdqu xmm11, xmmword [r8 + 0x20]
pshufb xmm3, xmm10
pshufb xmm11, xmm10
movdqa xmm5, xmm3
pshufd xmm4, xmm3, 0x4e
pxor xmm4, xmm3
pclmulqdq xmm3, xmm2, 0
pclmulqdq xmm5, xmm2, 0x11
pclmulqdq xmm4, xmm7, 0
movdqa xmm13, xmm11
pshufd xmm12, xmm11, 0x4e
pxor xmm12, xmm11
pclmulqdq xmm11, xmm6, 0
pclmulqdq xmm13, xmm6, 0x11
pclmulqdq xmm12, xmm7, 0x10
xorps xmm3, xmm11
xorps xmm5, xmm13
movups xmm7, xmmword [rdx + 0x50]
xorps xmm4, xmm12
movdqu xmm11, xmmword [r8 + 0x10]
movdqu xmm8, xmmword [r8]
pshufb xmm11, xmm10
pshufb xmm8, xmm10
movdqa xmm13, xmm11
pshufd xmm12, xmm11, 0x4e
pxor xmm0, xmm8
pxor xmm12, xmm11
pclmulqdq xmm11, xmm14, 0
movdqa xmm1, xmm0
pshufd xmm8, xmm0, 0x4e
pxor xmm8, xmm0
pclmulqdq xmm13, xmm14, 0x11
pclmulqdq xmm12, xmm7, 0
xorps xmm3, xmm11
xorps xmm5, xmm13
lea r8, [r8 + 0x40]
sub r9, 0x40
jb 0x140030e85
jmp 0x140030d00
pclmulqdq xmm0, xmm15, 0
xorps xmm4, xmm12
movdqu xmm11, xmmword [r8 + 0x30]
pshufb xmm11, xmm10
pclmulqdq xmm1, xmm15, 0x11
xorps xmm0, xmm3
movdqu xmm3, xmmword [r8 + 0x20]
movdqa xmm13, xmm11
pclmulqdq xmm8, xmm7, 0x10
pshufd xmm12, xmm11, 0x4e
xorps xmm1, xmm5
pxor xmm12, xmm11
pshufb xmm3, xmm10
movups xmm7, xmmword [rdx + 0x20]
xorps xmm8, xmm4
pclmulqdq xmm11, xmm2, 0
pshufd xmm4, xmm3, 0x4e
pxor xmm8, xmm0
pxor mm0, mm0
movdqa xmm5, xmm3
pxor xmm8, xmm1
pxor xmm4, xmm3
movdqa xmm9, xmm8
pclmulqdq xmm13, xmm2, 0x11
pslldq xmm8, 8
psrldq xmm9, 8
pxor xmm0, xmm8
movdqa xmm8, xmmword [0x140031be0]
pxor xmm1, xmm9
movq xmm9, rax
pand xmm8, xmm0
pshufb xmm9, xmm8
pxor xmm9, xmm0
pclmulqdq xmm12, xmm7, 0
psllq xmm9, 0x39
movdqa xmm8, xmm9
pslldq xmm9, 8
pclmulqdq xmm3, xmm6, 0
psrldq xmm8, 8
pxor xmm0, xmm9
pxor xmm1, xmm8
movdqu xmm8, xmmword [r8]
movdqa xmm9, xmm0
psrlq xmm0, 1
pclmulqdq xmm5, xmm6, 0x11
xorps xmm3, xmm11
movdqu xmm11, xmmword [r8 + 0x10]
pshufb xmm11, xmm10
pclmulqdq xmm4, xmm7, 0x10
xorps xmm5, xmm13
movups xmm7, xmmword [rdx + 0x50]
pshufb xmm8, xmm10
pxor xmm1, xmm9
pxor xmm9, xmm0
psrlq xmm0, 5
movdqa xmm13, xmm11
pxor xmm4, xmm12
pshufd xmm12, xmm11, 0x4e
pxor xmm0, xmm9
pxor xmm1, xmm8
pxor xmm12, xmm11
pclmulqdq xmm11, xmm14, 0
psrlq xmm0, 1
pxor xmm0, xmm1
movdqa xmm1, xmm0
pclmulqdq xmm13, xmm14, 0x11
xorps xmm3, xmm11
pshufd xmm8, xmm0, 0x4e
pxor xmm8, xmm0
pclmulqdq xmm12, xmm7, 0
xorps xmm5, xmm13
lea r8, [r8 + 0x40]
sub r9, 0x40
jae 0x140030d00
pclmulqdq xmm0, xmm15, 0
pclmulqdq xmm1, xmm15, 0x11
pclmulqdq xmm8, xmm7, 0x10
xorps xmm4, xmm12
xorps xmm0, xmm3
xorps xmm1, xmm5
pxor xmm1, xmm0
pxor xmm8, xmm4
pxor xmm8, xmm1
pxor xmm1, xmm0
movdqa xmm9, xmm8
invalid
Function at 0x140003da0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140003e30
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003e24
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003e1f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003efd
mov rcx, r8
call fcn.140012510
xor eax, eax
jmp 0x140003ec9
cmp qword [rbx + 0x18], 0xf
mov r8, rbx
jbe 0x140003e3d
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140003e63
inc rax
test ecx, ecx
jne 0x140003e50
mov rcx, rdi
test edx, edx
je 0x140003e87
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140003e30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140003dea
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
mov edi, dword [rsp + 0x28]
cmp rdx, 0xf
jbe 0x140003ec7
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003ec2
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003efd
mov rcx, r8
call fcn.140012510
mov eax, edi
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400124f0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x140005310
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x170
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov esi, edx
mov qword [rsp + 0x28], rcx
mov rbx, rcx
xor ebp, ebp
xor edx, edx
lea ecx, [rbp + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140005394
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14000538b
cmp dword [rsp + 0x38], esi
je 0x1400053e0
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005373
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xorps xmm0, xmm0
lea rdx, [0x14001776f]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
xor r8d, r8d
mov qword [rbx + 0x18], rbp
mov rcx, rbx
call fcn.140003880
mov rax, rbx
mov rcx, qword [rsp + 0x160]
xor rcx, rsp
call fcn.1400124f0
lea r11, [rsp + 0x170]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
xorps xmm0, xmm0
lea rax, [rsp + 0x5c]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rbp
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], rbp
nop word [rax + rax]
inc r8
cmp byte [rax + r8], bpl
jne 0x140005400
lea rdx, [rsp + 0x5c]
jmp 0x1400053ac

Function at 0x140005ad0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140005af8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140005b1e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005b20
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005b79
test ecx, ecx
jle 0x140005b59
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_strchr_1
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005b79
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005b79
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret
Function at 0x140005ba0
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140005bc2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x140005bd8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x140005bf4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140005bf6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140005c32
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_strchr_1
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x140005cce
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x140005c6d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x140005cae
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x140005cce
cmp rbx, rax
ja 0x140005c80
test rbx, rbx
je 0x140005cce
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x140006130
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x14000615d
xor eax, eax
jmp 0x1400062c9
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140006197
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140006197
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x1400062c9
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x1400062bc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1400061da
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140006205
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400062c1
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006274
sub eax, 1
je 0x140006274
cmp eax, 2
jne 0x1400062bc
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x1400062c1
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x1400062a2
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x1400062bc
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x1400062c1
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400124f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x140006df0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140006ec3
cmp byte [rcx + 0x71], 0
je 0x140006ec3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x140006ebf
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140006e84
sub eax, 1
je 0x140006e88
cmp eax, 2
jne 0x140006ebf
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400124f0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140006eb6
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x140006ebf
cmp byte [rbx + 0x71], 0
sete al
jmp 0x140006e6c
xor al, al
jmp 0x140006e6c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400124f0
add rsp, 0x60
pop rbx
ret

Function at 0x140008510
Capabilities:
Allocate or change rwx memory

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x14001e040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rsi, r8
lea rax, [rsp + 0x30]
mov r8, qword [r8 + 8]
mov r14, rcx
mov rcx, qword [rcx]
mov r9d, 8
mov rbp, rdx
mov qword [rsp + 0x20], rax
sub r8, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rax, qword [rsi + 8]
sub rax, qword [rsi]
movsxd rbx, eax
mov rcx, rbx
call fcn.140012554
mov r8, qword [rsi + 8]
mov rcx, rax
mov rdx, qword [rsi]
mov rdi, rax
sub r8, rdx
call sub.VCRUNTIME140.dll_memmove
mov rcx, qword [r14]
mov r9, rbx
mov r8, rdi
mov qword [rsp + 0x20], 0
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_HeapLock]
mov rcx, rdi
call fcn.140012510
mov r8, qword [rsi + 8]
lea rax, [rsp + 0x30]
sub r8, qword [rsi]
mov r9d, 0x20
mov rcx, qword [r14]
mov rdx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400124f0
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret