joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14001bef0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c40], 0
lea rbx, [rcx + 0x5c48]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001bf97
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001bf4a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14001e750
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400040b0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c40]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5c50]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14019a948]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001bf9f
mov rcx, rbx
call fcn.1400040b0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001c640
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movzx r8d, byte [rcx]
lea rdx, [rcx + 1]
mov r14, qword [0x14019a950]
mov r9d, 0xffffffff
mov ebx, r9d
test r8b, r8b
je 0x14001c6a4
lea r10, [0x14007f250]
cmp r8b, 0x23
jne 0x14001c687
cmp byte [rdx], r8b
jne 0x14001c687
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x14001c674
mov eax, dword [r14 + 0x5bb8]
xor edi, edi
mov qword [rsp + 0x30], rbp
not ebx
mov qword [rsp + 0x38], rsi
test eax, eax
jle 0x14001c705
mov esi, edi
mov ebp, edi
test rsi, rsi
js 0x14001c6ca
cmp edi, eax
jl 0x14001c6e4
mov r8d, 0x6fb
lea rdx, str.C:UsersSteinDesktopCidialove_cidiaLoader_Cidiaimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov rax, qword [r14 + 0x5bc0]
cmp dword [rax + rbp + 8], ebx
je 0x14001c722
mov eax, dword [r14 + 0x5bb8]
inc edi
inc rsi
add rbp, 0x48
cmp edi, eax
jl 0x14001c6c1
xor eax, eax
mov rsi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test edi, edi
js 0x14001c72f
cmp edi, dword [r14 + 0x5bb8]
jl 0x14001c749
mov r8d, 0x6fb
lea rdx, str.C:UsersSteinDesktopCidialove_cidiaLoader_Cidiaimgui.h
lea rcx, str.i___0__i___Size
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rax, edi
lea rcx, [rax + rax*8]
mov rax, qword [r14 + 0x5bc0]
lea rax, [rax + rcx*8]
jmp 0x14001c707
Function at 0x140047130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140047153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140047140
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x1400474e0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
call fcn.140047160
mov r11, rax
test rax, rax
je 0x140047583
mov eax, 0x5a4d
cmp word [r11], ax
jne 0x140047583
movsxd rcx, dword [r11 + 0x3c]
cmp dword [rcx + r11], 0x4550
jne 0x140047583
mov eax, dword [rcx + r11 + 0x88]
test eax, eax
je 0x140047583
mov ebx, dword [rax + r11 + 0x1c]
xor r9d, r9d
mov r10d, dword [rax + r11 + 0x20]
mov ebp, dword [rax + r11 + 0x24]
add r10, r11
add rbp, r11
lea rsi, [r11 + rbx]
test ebx, ebx
je 0x140047583
nop dword [rax]
mov r8d, dword [r10]
mov rax, rdi
add r8, r11
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140047573
inc rax
test ecx, ecx
jne 0x140047560
test edx, edx
je 0x14004759a
inc r9d
add r10, 4
cmp r9d, ebx
jb 0x140047550
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx ecx, word [rbp + r9*2]
mov eax, dword [rsi + rcx*4]
add rax, r11
jmp 0x140047585
Function at 0x140047710
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x238
mov rcx, rax
mov r14, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14004788d
xor r15d, r15d
nop word [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x58], r15
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x60], r15
lea rax, [rbp - 0x64]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r15w
jne 0x140047790
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x48]
call fcn.140049720
mov rax, r15
mov dword [rsp + 0x30], 0x470055
mov dword [rsp + 0x34], 0x450055
mov dword [rsp + 0x38], 0x780064
mov dword [rsp + 0x3c], 0x7c007b
mov dword [rsp + 0x40], 0x680069
mov word [rsp + 0x44], r15w
mov byte [rsp + 0x46], 1
nop
lea ecx, [rax + 0x12]
xor word [rsp + rax*2 + 0x30], cx
inc rax
cmp rax, 0xa
jb 0x1400477e0
mov byte [rsp + 0x46], r15b
lea rcx, [rsp + 0x30]
mov rax, 0xffffffffffffffff
inc rax
cmp word [rcx + rax*2], r15w
jne 0x140047802
mov rdi, qword [rsp + 0x60]
lea rcx, [rsp + 0x48]
mov rbx, qword [rsp + 0x48]
lea r9, [rsp + 0x30]
mov rdx, qword [rsp + 0x58]
cmp rdi, 7
mov qword [rsp + 0x20], rax
cmova rcx, rbx
call fcn.140049640
mov rsi, rax
cmp rdi, 7
jbe 0x140047871
lea rdx, [rdi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140047869
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400478b9
mov rcx, rbx
call fcn.1400744bc
mov rcx, r14
cmp rsi, 0xffffffffffffffff
jne 0x1400478c0
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140047770
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x78]
jmp 0x140047898
Function at 0x140047bd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140047bf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140047be0
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x140048fe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x36], 0
je 0x140049003
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x35
jb 0x140048ff0
mov byte [rcx + 0x36], 0
ret

Function at 0x140049010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x2e], 0
je 0x140049033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x2d
jb 0x140049020
mov byte [rcx + 0x2e], 0
ret

Function at 0x140049040
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x39], 0
je 0x140049063
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x38
jb 0x140049050
mov byte [rcx + 0x39], 0
ret

Function at 0x140049070
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x140049093
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x140049080
mov byte [rcx + 0xe], 0
ret

Function at 0x1400490a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x1400490c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x1400490b0
mov byte [rcx + 0xf], 0
ret

Function at 0x1400490d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1b], 0
je 0x1400490f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1a
jb 0x1400490e0
mov byte [rcx + 0x1b], 0
ret

Function at 0x140049100
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x140049123
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x140049110
mov byte [rcx + 0x10], 0
ret

Function at 0x140049130
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x140049153
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x140049140
mov byte [rcx + 9], 0
ret

Function at 0x140049160
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x140049183
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x140049170
mov byte [rcx + 0x12], 0
ret

Function at 0x140049190
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x1400491b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x1400491a0
mov byte [rcx + 0xc], 0
ret

Function at 0x1400491c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x1400491e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x1400491d0
mov byte [rcx + 0xd], 0
ret

Function at 0x1400491f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x140049213
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x140049200
mov byte [rcx + 0x11], 0
ret
Function at 0x140049220
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x140049243
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x12]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x140049230
mov byte [rcx + 5], 0
ret
Function at 0x14004f740
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 8], rcx
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x290
mov rdi, rcx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r12d, r12d
test eax, eax
je 0x14004f85f
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r12
lea rax, [rsp + 0x7c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r12w
jne 0x14004f7b0
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call fcn.140049720
mov rax, qword [rdi + 0x10]
mov r9, rdi
cmp qword [rdi + 0x18], 7
jbe 0x14004f7da
mov r9, qword [rdi]
lea rcx, [rsp + 0x30]
mov rbp, qword [rsp + 0x48]
cmp rbp, 7
seta bl
mov rsi, qword [rsp + 0x30]
cmova rcx, rsi
mov qword [rsp + 0x20], rax
mov rdx, qword [rsp + 0x40]
call fcn.140049640
mov r14, rax
test bl, bl
je 0x14004f83f
lea rdx, [rbp*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14004f837
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004f8d6
mov rcx, rsi
call fcn.1400744bc
mov rcx, r15
cmp r14, 0xffffffffffffffff
jne 0x14004f8dd
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14004f790
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14004f8a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004f8a3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004f926
mov rcx, r8
call fcn.1400744bc
xor eax, eax
mov word [rdi], r12w
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], r12
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x58]
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14004f922
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14004f91d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14004f926
mov rcx, r8
call fcn.1400744bc
mov eax, ebx
jmp 0x14004f8aa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14004f930
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x14004f953
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x13]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x14004f940
mov byte [rcx + 6], 0
mov rax, rcx
ret
Function at 0x14004f960
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x40
xor eax, eax
mov dword [rbp - 0x20], 0x71757c5e
mov rbx, rdx
mov dword [rbp - 0x1c], 0x6b7a7e5a
mov edx, eax
mov dword [rbp - 0x18], 0x5c65697b
mov word [rbp - 0x14], pe_nt_image_headers64
nop
lea ecx, [rdx + 0x12]
xor byte [rbp + rdx - 0x20], cl
inc rdx
cmp rdx, 0xc
jb 0x14004f990
mov byte [rbp - 0x13], al
mov dword [rbp - 0x12], 0x7b667679
mov dword [rbp - 0xe], 0x2b2b7b73
mov dword [rbp - 0xa], 0x71707f34
mov word [rbp - 6], pe_nt_image_headers64
nop
lea ecx, [rax + 0x12]
xor byte [rbp + rax - 0x12], cl
inc rax
cmp rax, 0xc
jb 0x14004f9c0
lea rdx, [rbp - 0x20]
mov byte [rbp - 5], 0
lea rcx, [rbp - 0x12]
call fcn.1400474e0
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x50]
test rax, rax
setne al
add rsp, 0x40
pop rbp
ret

Function at 0x14004fa00
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x40
movdqa xmm0, xmmword [0x1400bb980]
xor eax, eax
movdqu xmmword [rsp + 0x2e], xmm0
mov r8d, eax
mov word [rsp + 0x3e], pe_nt_image_headers64
mov rbx, rdx
nop dword [rax]
nop word [rax + rax]
lea ecx, [r8 + 0x12]
xor byte [rsp + r8 + 0x2e], cl
inc r8
cmp r8, 0x10
jb 0x14004fa30
mov byte [rsp + 0x3f], al
mov dword [rsp + 0x20], 0x7b667679
mov dword [rsp + 0x24], 0x2b2b7b73
mov dword [rsp + 0x28], 0x71707f34
mov word [rsp + 0x2c], pe_nt_image_headers64
nop word [rax + rax]
lea ecx, [rax + 0x12]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0xc
jb 0x14004fa70
lea rdx, [rsp + 0x2e]
mov byte [rsp + 0x2d], 0
lea rcx, [rsp + 0x20]
call fcn.1400474e0
mov rcx, rbx
add rsp, 0x40
pop rbx
jmp rax
Function at 0x14004faa0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x24], 0x600047
mov word [rbp - 0x10], bx
mov ecx, ebx
mov edi, r9d
mov dword [rbp - 0x20], 0x670071
mov rsi, r8
mov dword [rbp - 0x1c], 0x250025
mov r14, rdx
mov dword [rbp - 0x18], 0x7d0036
mov dword [rbp - 0x14], 0x770076
mov byte [rbp - 0xe], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x12]
xor word [rbp + rcx*2 - 0x24], ax
inc rcx
cmp rcx, 0xa
jb 0x14004fb00
lea rdx, [rbp - 0x24]
mov byte [rbp - 0xe], bl
call fcn.14004fa00
mov rcx, rbx
test rax, rax
jne 0x14004fbc2
mov dword [rbp - 0x30], 0x64706746
mov dword [rbp - 0x2c], 0x7e372a24
mov dword [rbp - 0x28], 0x1007077
nop
lea eax, [rcx + 0x13]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0xa
jb 0x14004fb40
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x25], bl
call fcn.14004f960
test al, al
je 0x14004fc3e
mov dword [rbp - 0x24], 0x6667765f
mov rcx, rbx
mov dword [rbp - 0x20], 0x5b7d7077
mov dword [rbp - 0x1c], 0x5d6375
mov byte [rbp - 0x18], 1
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x24], al
inc rcx
cmp rcx, 0xb
jb 0x14004fb80
mov byte [rbp - 0x18], bl
mov dword [rbp - 0x30], 0x64706746
mov dword [rbp - 0x2c], 0x7e372a24
mov dword [rbp - 0x28], 0x1007077
nop dword [rax + rax]
lea eax, [rbx + 0x13]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0xa
jb 0x14004fbb0
jmp 0x14004fc20
mov dword [rbp - 0x24], 0x6667765f
mov dword [rbp - 0x20], 0x5b7d7077
mov dword [rbp - 0x1c], 0x5d6375
mov byte [rbp - 0x18], 1
nop dword [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x24], al
inc rcx
cmp rcx, 0xb
jb 0x14004fbe0
mov byte [rbp - 0x18], bl
mov dword [rbp - 0x30], 0x64706746
mov dword [rbp - 0x2c], 0x7e372a24
mov dword [rbp - 0x28], 0x1007077
nop dword [rax + rax]
lea eax, [rbx + 0x13]
xor byte [rbp + rbx - 0x30], al
inc rbx
cmp rbx, 0xa
jb 0x14004fc10
lea rdx, [rbp - 0x24]
mov byte [rbp - 0x25], 0
lea rcx, [rbp - 0x30]
call fcn.1400474e0
mov r9d, edi
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov r14, qword [rsp + 0x78]
add rsp, 0x50
pop rbp
ret
Function at 0x14004fc60
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x50
xor ebx, ebx
mov dword [rbp - 0x22], 0x710058
mov word [rbp - 0xa], bx
mov ecx, ebx
mov dword [rbp - 0x1e], 0x780067
mov dword [rbp - 0x1a], 0x740072
mov dword [rbp - 0x16], 0x28002a
mov dword [rbp - 0x12], 0x780035
mov dword [rbp - 0xe], 0x720071
mov byte [rbp - 8], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor word [rbp + rcx*2 - 0x22], ax
inc rcx
cmp rcx, 0xc
jb 0x14004fcb0
lea rdx, [rbp - 0x22]
mov byte [rbp - 8], bl
call fcn.14004fa00
mov rcx, rbx
test rax, rax
jne 0x14004fd82
mov dword [rbp - 0x30], 0x7b667659
mov dword [rbp - 0x2c], 0x2b2b7b73
mov dword [rbp - 0x28], 0x71707f34
mov word [rbp - 0x24], pe_nt_image_headers64
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0xc
jb 0x14004fd00
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x23], bl
call fcn.14004f960
test al, al
je 0x14004fdf5
mov dword [rbp - 0x30], 0x617d6b57
mov rcx, rbx
mov dword [rbp - 0x2c], 0x7a776546
mov dword [rbp - 0x28], 0x6f687f
mov byte [rbp - 0x24], 1
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0xb
jb 0x14004fd40
mov byte [rbp - 0x24], bl
mov dword [rbp - 0x22], 0x7b667659
mov dword [rbp - 0x1e], 0x2b2b7b73
mov dword [rbp - 0x1a], 0x71707f34
mov word [rbp - 0x16], pe_nt_image_headers64
nop
lea eax, [rbx + 0x12]
xor byte [rbp + rbx - 0x22], al
inc rbx
cmp rbx, 0xc
jb 0x14004fd70
jmp 0x14004fde0
mov dword [rbp - 0x30], 0x617d6b57
mov dword [rbp - 0x2c], 0x7a776546
mov dword [rbp - 0x28], 0x6f687f
mov byte [rbp - 0x24], 1
nop dword [rax + rax]
lea eax, [rcx + 0x12]
xor byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0xb
jb 0x14004fda0
mov byte [rbp - 0x24], bl
mov dword [rbp - 0x22], 0x7b667659
mov dword [rbp - 0x1e], 0x2b2b7b73
mov dword [rbp - 0x1a], 0x71707f34
mov word [rbp - 0x16], pe_nt_image_headers64
nop
lea eax, [rbx + 0x12]
xor byte [rbp + rbx - 0x22], al
inc rbx
cmp rbx, 0xc
jb 0x14004fdd0
lea rdx, [rbp - 0x30]
mov byte [rbp - 0x15], 0
lea rcx, [rbp - 0x22]
call fcn.1400474e0
xor ecx, ecx
call rax
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret

Function at 0x140050000
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x140050023
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x13]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x140050010
mov byte [rcx + 0x13], 0
mov rax, rcx
ret
Function at 0x140052310
Capabilities:
Check for debugger via api
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 8], rcx
push rbp
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
call fcn.140053f10
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140052350
call fcn.14004fc60
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140052343
xor ebx, ebx
mov dword [rbp + 0x2b0], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x2b0]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x2b0], ebx
je 0x14005238d
call fcn.14004fc60
nop dword [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140052380
movdqa xmm0, xmmword [0x1400bb770]
mov rcx, rbx
movdqu xmmword [rsp + 0x3b], xmm0
mov dword [rsp + 0x4b], 0x54754a4c
mov dword [rsp + 0x4f], 0x594c4b48
mov word [rsp + 0x53], 0x58
mov byte [rsp + 0x55], 1
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x3b], al
inc rcx
cmp rcx, 0x19
jb 0x1400523c0
mov byte [rsp + 0x55], bl
mov rcx, rbx
mov dword [rsp + 0x30], 0x7a71607d
mov dword [rsp + 0x34], 0x767d367b
mov word [rsp + 0x38], 0x77
mov byte [rsp + 0x3a], 1
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 0x13]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 9
jb 0x140052400
lea rdx, [rsp + 0x3b]
mov byte [rsp + 0x3a], bl
lea rcx, [rsp + 0x30]
call fcn.1400474e0
mov rdi, rax
test rax, rax
je 0x14005248d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9d, 0x30
mov qword [rsp + 0x20], rbx
mov rcx, rax
lea r8, [rbp - 0x60]
xor edx, edx
call rdi
test eax, eax
js 0x14005248d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rdx, qword [rbp - 0x58]
lea r8, [rbp - 0x30]
mov rcx, rax
mov qword [rsp + 0x20], rbx
mov r9d, 0x2c8
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14005248d
cmp byte [rbp - 0x2e], bl
je 0x14005248d
call fcn.14004fc60
nop dword [rax + rax]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140052480
movdqa xmm0, xmmword [0x1400bb7f0]
movdqa xmm1, xmmword [0x1400bb920]
movdqu xmmword [rsp + 0x56], xmm0
mov dword [rbp - 0x6a], 0x273127
movdqa xmm0, xmmword [0x1400bb460]
movdqu xmmword [rsp + 0x66], xmm1
mov byte [rbp - 0x66], 1
movdqa xmm1, xmmword [0x1400bb490]
movdqu xmmword [rsp + 0x76], xmm0
movdqu xmmword [rbp - 0x7a], xmm1
nop
lea eax, [rbx + 0x13]
xor byte [rsp + rbx + 0x56], al
inc rbx
cmp rbx, 0x43
jb 0x1400524d0
lea rax, [rbp + 0x2b8]
mov byte [rbp - 0x66], 0
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rsp + 0x56]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14005252e
mov rcx, qword [rbp + 0x2b8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.14004fc60
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140052521
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret