joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000e2f0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x60
xor esi, esi
mov qword [rbp - 0x28], rcx
lea rax, [0x14000e510]
mov qword [rbp - 0x1e], rsi
mov qword [rbp - 0x30], rax
lea r9, [rbp + 0x10]
mov eax, 0xb848
mov dword [rbp - 0x16], 0x4894865
mov word [rbp - 0x20], ax
lea r8d, [rsi + 0x40]
mov eax, 0xe0ff
mov word [rbp - 0x12], 0x2825
mov rdi, rdx
mov word [rbp - 3], ax
mov rbx, rcx
mov byte [rbp - 0x10], sil
lea edx, [rsi + 0x1f]
mov dword [rbp - 0xf], 0xb8480000
lea rcx, [rbp - 0x20]
mov qword [rbp - 0xb], rsi
mov dword [rbp + 0x10], esi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, word [rbx + 0x80]
lea rax, [rbp - 0x30]
mov qword [rbp - 0x1e], rax
lea r9, [rbp - 0x20]
lea rax, [0x1400111f8]
mov qword [rsp + 0x20], rsi
mov r8, rdi
mov qword [rbp - 0xb], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_DialogBoxParamW]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x14000e3ac
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0x90
mov rdi, rdx
mov ebx, r8d
xor edx, edx
mov rsi, rcx
lea rcx, [rbp + 0x17]
lea r8d, [rdx + 0x30]
call fcn.140088180
movzx edx, bx
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor r14d, r14d
mov byte [rsi + 0x84], 1
mov rbx, rax
mov qword [rbp - 0x11], rsi
lea rax, [0x14000e510]
mov qword [rbp - 7], r14
mov qword [rbp - 0x19], rax
lea r9, [rbp + 0x77]
mov eax, 0xb848
mov dword [rbp + 1], 0x4894865
mov word [rbp - 9], ax
lea edx, [r14 + 0x1f]
mov eax, 0xe0ff
mov word [rbp + 5], 0x2825
lea r8d, [r14 + 0x40]
mov word [rbp + 0x14], ax
lea rcx, [rbp - 9]
mov byte [rbp + 7], r14b
mov dword [rbp + 8], 0xb8480000
mov qword [rbp + 0xc], r14
mov dword [rbp + 0x77], r14d
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
movzx edx, word [rsi + 0x80]
lea rax, [rbp - 0x19]
mov qword [rbp - 7], rax
lea r9, [rbp - 9]
lea rax, [0x1400111f8]
mov qword [rsp + 0x20], r14
mov r8, rdi
mov qword [rbp + 0xc], rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateDialogParamW]
mov rcx, rax
mov qword [rsi + 8], rax
lea edx, [r14 + 5]
call qword [sym.imp.USER32.dll_ShowWindow]
jmp 0x14000e4e3
xor r9d, r9d
lea rcx, [rbp + 0x17]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jle 0x14000e4f1
mov rcx, qword [rsi + 8]
lea r8, [rbp + 0x17]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x14000e4e3
mov rcx, qword [rsi + 8]
lea rdx, [rbp + 0x17]
call qword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
jne 0x14000e4e3
lea rcx, [rbp + 0x17]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x17]
call qword [sym.imp.USER32.dll_DispatchMessageW]
mov rcx, qword [rsi + 8]
call qword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x14000e492
lea r11, [rsp + 0x90]
mov eax, 1
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
Function at 0x14000efb0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0xc0
mov qword [rbp - 0x21], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rbp + 0x47], rax
lea rdi, str.BlackBoneDrv7.sys
xor edx, edx
lea ecx, [rdx + 0xa]
xor r9d, r9d
call fcn.14000eebc
xor r14d, r14d
test al, al
je 0x14000f00e
lea rdi, str.BlackBoneDrv10.sys
mov ebx, 0x96
jmp 0x14000f056
mov edx, 3
lea esi, [rdx + 3]
mov ecx, esi
xor r9d, r9d
call fcn.14000eebc
test al, al
je 0x14000f032
lea rdi, str.BlackBoneDrv81.sys
mov ebx, 0x95
jmp 0x14000f056
mov ebx, 0x8e
mov edx, 2
mov ecx, esi
xor r9d, r9d
call fcn.14000eebc
test al, al
je 0x14000f056
lea rdi, str.BlackBoneDrv8.sys
mov ebx, 0x93
lea r8, str.Driver
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
je 0x14000f199
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rsi, rax
lea rcx, [rbp + 0x27]
call fcn.1400225c0
nop
mov r8d, 1
lea rdx, [0x1400d3c08]
mov rcx, rax
call fcn.1400080f4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x17], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
or r8, 0xffffffffffffffff
inc r8
cmp word [rdi + r8*2], r14w
jne 0x14000f0d5
mov rdx, rdi
lea rcx, [rbp + 7]
call fcn.1400080f4
xorps xmm0, xmm0
movdqu xmmword [rbp - 9], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x19], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 9], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rcx, [rbp - 0x19]
cmp qword [rbp - 1], 8
cmovae rcx, qword [rbp - 0x19]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x120116
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
lea rcx, [rbp - 0x19]
call fcn.140003d5c
nop
lea rcx, [rbp + 7]
call fcn.140003d5c
nop
lea rcx, [rbp + 0x27]
call fcn.140003d5c
cmp rdi, 0xffffffffffffffff
je 0x14000f199
mov dword [rbp - 0x29], r14d
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r8d, eax
mov qword [rsp + 0x20], r14
lea r9, [rbp - 0x29]
mov rdx, rsi
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.140069650
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x14000f1c4
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x5f]
sub rsp, 0x90
mov qword [rbp - 0x19], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rbp + 0x4f], rax
lea rsi, str.BlackBoneDrv7.sys
xor edx, edx
lea ecx, [rdx + 0xa]
xor r9d, r9d
call fcn.14000eebc
xor edi, edi
test al, al
je 0x14000f218
lea rbx, str.BlackBoneDrv10.sys
jmp 0x14000f253
mov edx, 3
lea ebx, [rdx + 3]
mov ecx, ebx
xor r9d, r9d
call fcn.14000eebc
test al, al
je 0x14000f237
lea rbx, str.BlackBoneDrv81.sys
jmp 0x14000f253
xor r9d, r9d
mov dx, 2
movzx ecx, bx
call fcn.14000eebc
lea rbx, str.BlackBoneDrv8.sys
test al, al
cmove rbx, rsi
lea rcx, [rbp + 0x2f]
call fcn.1400225c0
nop
mov r8d, 1
lea rdx, [0x1400d3c08]
mov rcx, rax
call fcn.1400080f4
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f], xmm1
mov qword [rax + 0x10], rdi
mov esi, 7
mov qword [rax + 0x18], rsi
mov word [rax], di
or r8, 0xffffffffffffffff
inc r8
cmp word [rbx + r8*2], di
jne 0x14000f29d
mov rdx, rbx
lea rcx, [rbp + 0xf]
call fcn.1400080f4
xorps xmm0, xmm0
movdqu xmmword [rbp - 1], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x11], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 1], xmm1
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rsi
mov word [rax], di
lea rcx, [rbp - 0x11]
cmp qword [rbp + 7], 8
cmovae rcx, qword [rbp - 0x11]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
lea rcx, [rbp - 0x11]
call fcn.140003d5c
nop
lea rcx, [rbp + 0xf]
call fcn.140003d5c
nop
lea rcx, [rbp + 0x2f]
call fcn.140003d5c
mov rcx, qword [rbp + 0x4f]
xor rcx, rsp
call fcn.140069650
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1400135b8
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
xor ebx, ebx
mov byte [0x1400f9ba8], 1
xorps xmm0, xmm0
mov qword [0x1400f9ba0], rbx
lea rdx, [0x1400ca234]
mov qword [0x1400f9bac], rbx
lea rcx, [0x1400f9bd0]
mov qword [0x1400f9bb8], rbx
movdqa xmmword [0x1400f9bc0], xmm0
lea rdi, [0x1400f9ba0]
mov qword [0x1400f9be0], rbx
mov word [0x1400f9bd0], bx
mov qword [0x1400f9be8], 7
call fcn.140003dc0
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov r9, rdi
mov qword [0x1400f9bc0], rcx
lea r8, [0x140013720]
mov qword [0x1400f9bf0], rbx
xor edx, edx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rbx, qword [rsp + 0x48]
mov qword [0x1400f9bb8], rax
mov rax, rdi
add rsp, 0x30
pop rdi
ret

Function at 0x140013758
Capabilities:
Terminate process

Disassembly:
mov r11, rsp
push rdi
sub rsp, 0x70
mov qword [r11 - 0x58], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rbx, rcx
movdqa xmm0, xmmword [0x1400d6210]
movdqu xmmword [rsp + 0x38], xmm0
xor esi, esi
mov word [rsp + 0x28], si
movdqu xmmword [rsp + 0x58], xmm0
mov word [rsp + 0x48], si
lea r8, [r11 - 0x30]
lea rdx, [r11 - 0x50]
call fcn.1400138d8
mov eax, dword [rbx + 0xc]
test al, 2
je 0x1400137ca
lea r8d, [rsi + 0x47]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call fcn.140013814
mov eax, dword [rbx + 0xc]
test al, 1
je 0x1400137de
xor r8d, r8d
lea rdx, [rsp + 0x48]
mov rcx, rbx
call fcn.140013814
mov rdi, qword [rbx + 0x50]
test rdi, rdi
je 0x140013801
lea rcx, [rsp + 0x28]
call fcn.1400037a4
mov r9b, 1
mov r8, qword [rbx + 0x20]
mov rdx, qword [rbx + 0x28]
mov rcx, rax
call rdi
mov qword [rbx + 0x18], rsi
mov ecx, 0x1337
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x140013814
Capabilities:
Create process memory minidump

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x50
cmp qword [rdx + 0x18], 8
mov esi, r8d
mov rax, rdx
mov rbx, rcx
jb 0x140013836
mov rax, qword [rdx]
and qword [rsp + 0x30], 0
xor r9d, r9d
and dword [rsp + 0x28], 0
xor r8d, r8d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov ecx, dword [rbx + 0x10]
mov rdi, rax
mov dword [rsp + 0x40], ecx
mov rcx, qword [rbx + 0x20]
mov qword [rsp + 0x44], rcx
mov dword [rsp + 0x4c], 1
cmp rax, 0xffffffffffffffff
je 0x1400138c5
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
and qword [rsp + 0x28], 0
mov r9d, esi
mov qword [rsp + 0x20], rcx
mov r8, rdi
mov rcx, rax
mov edx, ebx
call qword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
Function at 0x1400162c0
Capabilities:
Resume thread

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x70
xor eax, eax
mov rbx, rdx
mov edx, dword [rdx + 0xa4]
mov rbp, rcx
mov qword [r11 - 0x38], rax
mov qword [r11 - 0x30], rax
mov qword [r11 - 0x28], rax
test edx, edx
jne 0x140016305
cmp dword [rbx + 0xc0], eax
jne 0x140016305
mov eax, dword [rbx + 0x98]
mov dword [rbx + 0xc0], eax
lea r10, [rbx + 0x78]
cmp qword [r10 + 0x18], 8
jb 0x140016313
mov r10, qword [r10]
lea r9, [rbx + 0x58]
cmp qword [r9 + 0x18], 8
jb 0x140016321
mov r9, qword [r9]
movzx eax, byte [rbx + 0xb4]
movzx ecx, byte [rbx + 0xb5]
movzx r8d, byte [rbx + 0xb6]
mov qword [rsp + 0x48], r10
mov qword [rsp + 0x40], r9
mov r9d, dword [rbx + 0xc0]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x9c]
mov dword [rsp + 0x30], ecx
lea rcx, str.Injection_initiated._Mode:__d__process_type:__d__pid:__d__mmap_flags:_0x_X__erasePE:__d__unlink:__d__thread_hijack:__d__init_routine:__s__init_arg:__ls
mov dword [rsp + 0x28], r8d
mov r8d, dword [rbx + 0xa0]
mov dword [rsp + 0x20], eax
call fcn.140014588
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rcx, rbp
call fcn.140014ab8
mov edi, eax
test eax, eax
jne 0x140016463
mov ecx, dword [rbx + 0xa8]
test ecx, ecx
je 0x14001639c
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r14, qword [rbx + 0xd0]
mov rsi, qword [rbx + 0xc8]
jmp 0x1400163d0
mov r8, qword [rsi]
mov rdx, rbx
mov rcx, rbp
call fcn.140016478
mov ecx, dword [rbx + 0xac]
or edi, eax
test ecx, ecx
je 0x1400163cc
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsi, 0x10
cmp rsi, r14
jne 0x1400163ac
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x1400163f4
test edi, edi
jne 0x1400163ee
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140016404
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x140016452
test byte [rbx + 0x9c], 0x10
je 0x140016452
mov eax, dword [rbx + 0xa4]
cmp eax, 1
je 0x140016421
cmp eax, 4
jne 0x140016452
mov eax, dword [rbp + 0x10]
lea rcx, [rbp + 0x368]
mov rdx, qword [rcx + 8]
mov dword [rsp + 0x98], eax
cmp qword [rcx + 0x10], rdx
je 0x140016445
mov dword [rdx], eax
add qword [rcx + 8], 4
jmp 0x140016452
lea r8, [rsp + 0x98]
call fcn.140018590
lea rcx, [rbp + 8]
cmp qword [rcx], 0
je 0x140016461
call fcn.14002f6f0
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140020a80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp qword [rdx + 0x18], 8
mov r14, rdx
mov r10, qword [rdx + 0x10]
mov r9, rdx
jb 0x140020ab0
mov r9, qword [rdx]
xor ebp, ebp
movabs rdx, 0xcbf29ce484222325
mov r8d, ebp
add r10, r10
je 0x140020ae2
movzx eax, byte [r8 + r9]
movabs r11, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, r11
cmp r8, r10
jb 0x140020ac4
movsxd r12, dword [r14 + 0x20]
mov r13, qword [rcx + 0x18]
xor r12, rdx
and r12, qword [rcx + 0x30]
mov r15, qword [rcx + 8]
add r12, r12
mov rbx, qword [r13 + r12*8]
cmp qword [r13 + r12*8], r15
jne 0x140020b09
mov rax, r15
jmp 0x140020b11
mov rax, qword [r13 + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140020b64
lea rdx, [rbx + 0x10]
mov r8, r14
call fcn.140020dd8
test al, al
je 0x140020b2b
mov rbx, qword [rbx]
jmp 0x140020afd
mov rsi, rbx
mov rdi, rbx
cmp qword [r13 + r12*8], r15
jne 0x140020b3d
mov rax, r15
jmp 0x140020b45
mov rax, qword [r13 + r12*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x140020b5f
lea r8, [rbx + 0x10]
mov rdx, r14
call fcn.140020dd8
test al, al
jne 0x140020b5f
mov rbx, qword [rbx]
jmp 0x140020b31
cmp rsi, rbx
jne 0x140020b72
mov rdi, r15
mov rbx, r15
jmp 0x140020b72
mov rdi, qword [rdi]
inc rbp
cmp rdi, rbx
jne 0x140020b6c
mov rbx, qword [rsp + 0x50]
mov rax, rbp
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1400214b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, r9
mov r12, r8
mov r14, rdx
mov r15, rcx
mov r9, qword [r8 + 0x10]
cmp qword [r8 + 0x18], 8
jb 0x1400214ec
mov r8, qword [r8]
movabs rdx, 0xcbf29ce484222325
xor ecx, ecx
add r9, r9
je 0x14002151b
movzx eax, byte [rcx + r8]
xor rdx, rax
movabs r10, 0x100000001b3
imul rdx, r10
inc rcx
cmp rcx, r9
jb 0x1400214fd
movsxd rsi, dword [r12 + 0x20]
xor rsi, rdx
and rsi, qword [r15 + 0x30]
add rsi, rsi
mov r13, qword [r15 + 0x18]
lea rax, [r15 + 8]
mov qword [rsp + 0x80], rax
mov rdi, qword [rax]
cmp rdi, qword [r13 + rsi*8]
je 0x14002158c
mov rdi, qword [r13 + rsi*8 + 8]
mov rdi, qword [rdi]
cmp rdi, qword [r13 + rsi*8]
je 0x14002158c
mov rdi, qword [rdi + 8]
lea r8, [rdi + 0x10]
mov rdx, r12
call fcn.140020dd8
test al, al
jne 0x14002154c
mov r8, rbx
lea rdx, [rsp + 0x70]
mov rcx, qword [rsp + 0x80]
call fcn.1400216e4
mov qword [r14], rdi
mov byte [r14 + 8], 0
mov rax, r14
jmp 0x140021621
mov rax, qword [rbx]
cmp rdi, rax
je 0x1400215c1
mov rcx, qword [rbx + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rdi
mov rcx, qword [rdi + 8]
mov qword [rcx], rbx
mov rdx, qword [rdi + 8]
mov rcx, qword [rax + 8]
mov qword [rdi + 8], rcx
mov rcx, qword [rbx + 8]
mov qword [rax + 8], rcx
mov qword [rbx + 8], rdx
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8]
cmp rax, qword [r15 + 8]
jne 0x1400215de
mov qword [rdx + rsi*8], rbx
mov rax, qword [r15 + 0x18]
mov qword [rax + rsi*8 + 8], rbx
jmp 0x14002160d
cmp rax, rdi
jne 0x1400215e9
mov qword [rdx + rsi*8], rbx
jmp 0x14002160d
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax]
mov qword [rdx + rsi*8 + 8], rcx
cmp rcx, rbx
je 0x14002160d
mov rdx, qword [r15 + 0x18]
mov rax, qword [rdx + rsi*8 + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi*8 + 8], rcx
mov rcx, r15
call fcn.140021634
nop
mov qword [r14], rbx
mov byte [r14 + 8], 1
mov rax, r14
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002182c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x28], 8
lea rbx, [r8 + 0x10]
mov rdi, rdx
mov r10, rcx
mov rdx, qword [r8 + 0x20]
jb 0x140021854
mov rbx, qword [r8 + 0x10]
xor ecx, ecx
movabs r11, 0xcbf29ce484222325
add rdx, rdx
je 0x140021882
movzx eax, byte [rcx + rbx]
movabs rsi, 0x100000001b3
xor r11, rax
inc rcx
imul r11, rsi
cmp rcx, rdx
jb 0x140021865
movsxd rdx, dword [r8 + 0x30]
mov rcx, qword [r10 + 0x18]
xor rdx, r11
and rdx, qword [r10 + 0x30]
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], r8
jne 0x1400218be
cmp qword [rcx + rdx*8], r8
jne 0x1400218b3
mov rax, qword [r10 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
jmp 0x1400218b7
mov rax, qword [r8 + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400218cb
cmp qword [rcx + rdx*8], r8
jne 0x1400218cb
mov rax, qword [r8]
mov qword [rcx + rdx*8], rax
lea rcx, [r10 + 8]
mov rdx, rdi
call fcn.1400216e4
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140022d20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x18], 8
jb 0x140022d2e
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
add rsp, 0x28
ret
Function at 0x1400231f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rdx
mov qword [rsp + 0x28], rcx
mov rdi, rcx
call fcn.140045aa0
lea r15, [rdi + 0x40]
mov rcx, r15
mov qword [rsp + 0x30], r15
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r13, qword [rsi + 0x18]
mov r8, rsi
mov r14, qword [rsi + 0x10]
cmp r13, 0x10
jb 0x14002323a
mov r8, qword [rsi]
xor ebp, ebp
movabs rdx, 0xcbf29ce484222325
mov ecx, ebp
test r14, r14
je 0x140023274
movabs r9, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
inc rcx
xor rdx, rax
imul rdx, r9
cmp rcx, r14
jb 0x140023260
mov rax, qword [rdi + 0x18]
mov rcx, qword [rdi + 0x30]
mov rdi, qword [rdi + 8]
and rcx, rdx
shl rcx, 4
mov r12, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r12
mov qword [rsp + 0x20], rax
nop word [rax + rax]
cmp r12, rdi
jne 0x1400232aa
mov rax, rdi
jmp 0x1400232b0
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x140023326
lea rcx, [rbx + 0x10]
mov rdx, rsi
cmp r13, 0x10
jb 0x1400232c5
mov rdx, qword [rsi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x1400232d6
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x1400232e7
mov r8, rbp
call fcn.140088340
test eax, eax
je 0x1400232f1
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x20]
jmp 0x1400232a0
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x1400232fe
mov rdx, qword [rdx]
cmp r13, 0x10
jb 0x140023307
mov rsi, qword [rsi]
cmp r14, rbp
jne 0x140023326
mov r8, r14
mov rcx, rsi
call fcn.140088340
test eax, eax
jne 0x140023326
mov rdi, qword [rsp + 0x28]
mov rdi, qword [rdi + 8]
jmp 0x140023329
mov rbx, rdi
cmp rbx, rdi
je 0x140023334
mov rbp, qword [rbx + 0x30]
jmp 0x140023336
xor ebp, ebp
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x90]
mov rax, rbp
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002ef00
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rdx
mov r8, qword [r8 + 0x20]
mov r10, rcx
cmp qword [rdi + 0x28], 8
lea r9, [rdi + 0x10]
jb 0x14002ef2b
mov r9, qword [rdi + 0x10]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
add r8, r8
je 0x14002ef64
movabs rbx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r9]
inc rcx
xor rdx, rax
imul rdx, rbx
cmp rcx, r8
jb 0x14002ef50
mov r8, qword [r10 + 0x30]
mov rcx, qword [r10 + 0x18]
and r8, rdx
shl r8, 4
add rcx, r8
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x14002efa4
cmp rax, rdi
jne 0x14002ef9a
mov rax, qword [r10 + 8]
mov qword [rcx], rax
mov rcx, qword [r10 + 0x18]
mov rax, qword [r10 + 8]
mov qword [r8 + rcx + 8], rax
jmp 0x14002efaf
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x14002efaf
cmp rax, rdi
jne 0x14002efaf
mov rax, qword [rdi]
mov qword [rcx], rax
mov rdx, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rdx], rbx
mov r8, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [r8 + 8], rdx
dec qword [r10 + 0x10]
call fcn.14002e340
mov edx, 0x48
mov rcx, rdi
call fcn.140069674
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x14002f910
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x2a0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov rax, qword [0x1400f4080]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rsi, rdx
mov r14, rcx
mov qword [rsp + 0x40], rcx
xor r12d, r12d
mov ebp, r12d
mov qword [rsp + 0x28], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x30], xmm0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
setg r15b
test rax, rax
jg 0x14002f993
mov qword [r14], r12
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r12
jmp 0x14002fa3c
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call fcn.140088180
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov rdi, qword [rsp + 0x30]
test eax, eax
je 0x14002fa2c
cmp qword [rsi + 0x10], 0
je 0x14002f9e6
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x14002f9d8
mov rdx, qword [rsi]
lea rcx, [rsp + 0x7c]
call fcn.140094224
test eax, eax
jne 0x14002fa15
cmp qword [rsp + 0x38], rdi
je 0x14002f9fe
mov eax, dword [rsp + 0x58]
mov dword [rdi], eax
add rdi, 4
mov qword [rsp + 0x30], rdi
jmp 0x14002fa15
lea r8, [rsp + 0x58]
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.140030640
mov rdi, qword [rsp + 0x30]
lea rdx, [rsp + 0x50]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14002f9c4
mov rbp, qword [rsp + 0x28]
mov qword [r14], rbp
mov qword [r14 + 8], rdi
mov rax, qword [rsp + 0x38]
mov qword [r14 + 0x10], rax
test r15b, r15b
je 0x14002fa4b
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rax, r14
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140069650
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret