joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140022ae4
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r11, rdx
mov eax, 0x5e6ea9af
mul r8d
mov ebx, r8d
xor r9d, r9d
shr edx, 0xb
mov r10d, 1
imul eax, edx, 0x15b0
sub ebx, eax
test r8d, r8d
je 0x140022bd6
xor ecx, ecx
cmp ebx, 7
jbe 0x140022b83
lea edx, [rcx + 7]
movzx eax, byte [r11]
add ecx, 8
add r10d, eax
add edx, 8
movzx eax, byte [r11 + 1]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 2]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 3]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 4]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 5]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 6]
add r9d, r10d
add r10d, eax
movzx eax, byte [r11 + 7]
add r9d, r10d
add r10d, eax
add r11, 8
add r9d, r10d
cmp edx, ebx
jb 0x140022b1e
cmp ecx, ebx
jae 0x140022ba0
mov eax, ebx
sub eax, ecx
mov ecx, eax
movzx eax, byte [r11]
inc r11
add r10d, eax
add r9d, r10d
sub rcx, 1
jne 0x140022b8d
mov eax, 0x80078071
mul r10d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r10d, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul ecx, edx, 0xffff000f
add r9d, ecx
sub r8d, ebx
mov ebx, 0x15b0
jne 0x140022b14
mov rbx, qword [rsp + 8]
shl r9d, 0x10
lea eax, [r10 + r9]
ret
Function at 0x140024f60
Capabilities:
Log keystrokes via polling

Disassembly:
push rbx
sub rsp, 0x50
mov rax, qword [0x140037010]
xor rax, rsp
mov qword [rsp + 0x40], rax
call fcn.140009b2c
mov rcx, qword [0x140037c20]
lea rdx, [rsp + 0x28]
xorps xmm0, xmm0
mov rbx, rax
movdqu xmmword [rsp + 0x28], xmm0
call qword [sym.imp.USER32.dll_GetClientRect]
mov ecx, dword [rsp + 0x34]
sub ecx, dword [rsp + 0x2c]
movd xmm2, ecx
mov ecx, dword [rsp + 0x30]
sub ecx, dword [rsp + 0x28]
cvtdq2ps xmm2, xmm2
movd xmm1, ecx
lea rcx, [rsp + 0x20]
cvtdq2ps xmm1, xmm1
call fcn.140003f74
lea rcx, [rsp + 0x38]
movsd xmm0, qword [rax]
movsd qword [rbx + 8], xmm0
and qword [rsp + 0x38], 0
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x38]
xorps xmm1, xmm1
sub rax, qword [0x140037c28]
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x140037c30]
mov ecx, 0x11
cvtsi2ss xmm1, rax
divss xmm1, xmm0
movss dword [rbx + 0x10], xmm1
mov rax, qword [rsp + 0x38]
mov qword [0x140037c28], rax
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x10
and al, 1
mov byte [rbx + 0x138], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
mov ecx, 0x12
and al, 1
mov byte [rbx + 0x139], al
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13b], 0
mov byte [rbx + 0x13a], al
call fcn.140024b7c
cmp byte [rbx + 0xc0], 0
je 0x14002506b
or eax, 0xffffffff
jmp 0x140025070
call fcn.14000c2f8
cmp dword [0x140037074], eax
je 0x140025083
mov dword [0x140037074], eax
call fcn.140024acc
call fcn.140024c84
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002b2d0
add rsp, 0x50
pop rbx
ret

Function at 0x140027248
Capabilities:
Hash data with crc32

Disassembly:
mov eax, edx
lea r8, str.SCROLLX
test eax, eax
lea rdx, str.SCROLLY
cmove rdx, r8
jmp fcn.140009310
Function at 0x14183f058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.14183f1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x14183f089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14183f06f
add dl, dl
jne 0x14183f096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14183f0f6
xor eax, eax
add dl, dl
jne 0x14183f0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14183f1ad
add dl, dl
jne 0x14183f0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14183f0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14183f0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14183f0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x14183f0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14183f07e
mov eax, 1
add dl, dl
jne 0x14183f106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x14183f113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14183f0fb
sub eax, ebx
mov ebx, 1
jne 0x14183f14c
mov ecx, 1
add dl, dl
jne 0x14183f12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14183f13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14183f123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14183f07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x14183f168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14183f175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14183f15d
cmp eax, 0x7d00
jae 0x14183f19b
cmp eax, 0x500
jb 0x14183f196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14183f07e
cmp eax, 0x7f
ja 0x14183f19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14183f07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x14183f1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14183f07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x7ff788e22a4c
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3a8]
sub rsp, 0x480
mov ebx, edx
mov r12, rcx
xor edx, edx
mov dword [rsp + 0x30], 0x238
lea ecx, [rdx + 0xf]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x7ff788e22c30
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x7ff788e22c30
test ebx, ebx
jle 0x7ff788e22b0b
mov r14, r12
mov rdi, r12
mov r15d, ebx
mov rcx, rdi
xor r13d, r13d
call fcn.7ff788e29d88
test rax, rax
je 0x7ff788e22af6
mov r12, r14
movzx ecx, word [r12]
call fcn.7ff788e2990c
mov word [r12], ax
mov rcx, rdi
lea r12, [r12 + 2]
inc r13d
call fcn.7ff788e29d88
movsxd rcx, r13d
cmp rcx, rax
jb 0x7ff788e22acf
add rdi, 0x32
add r14, 0x32
sub r15, 1
jne 0x7ff788e22abc
mov r12, qword [rbp + 0x3b0]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x7ff788e22c27
lea r15d, [rbx - 1]
lea rcx, [rsp + 0x5c]
xor edi, edi
call fcn.7ff788e29d88
test rax, rax
je 0x7ff788e22b5d
lea rbx, [rsp + 0x5c]
movzx ecx, word [rbx]
call fcn.7ff788e29cb0
mov word [rbx], ax
lea rcx, [rsp + 0x5c]
lea rbx, [rbx + 2]
inc edi
call fcn.7ff788e29d88
movsxd rcx, edi
cmp rcx, rax
jb 0x7ff788e22b3a
xor edi, edi
test r15d, r15d
jle 0x7ff788e22c12
movsxd rax, edi
imul r14, rax, 0x32
add r14, r12
mov rcx, r14
call fcn.7ff788e29d88
lea rcx, [rsp + 0x5c]
mov rbx, rax
call fcn.7ff788e29d88
cmp rax, rbx
jb 0x7ff788e22baf
mov rdx, r14
lea rcx, [rsp + 0x5c]
call fcn.7ff788e28c60
test rax, rax
jne 0x7ff788e22bb8
mov rdx, r14
lea rcx, [rsp + 0x5c]
call fcn.7ff788e29d34
test eax, eax
je 0x7ff788e22bb8
inc edi
cmp edi, r15d
jge 0x7ff788e22c12
jmp 0x7ff788e22b68
lea rdx, str._IM
lea rcx, [rbp + 0x170]
call fcn.7ff788e29d6c
lea rdx, [rsp + 0x5c]
lea rcx, [rbp + 0x170]
call fcn.7ff788e29d08
lea rdx, [0x7ff788e334d8]
lea rcx, [rbp + 0x170]
call fcn.7ff788e29d08
and dword [rsp + 0x28], 0
lea r9, [rbp + 0x170]
and qword [rsp + 0x20], 0
lea r8, str.taskkill
xor edx, edx
xor ecx, ecx
call qword [0x7ff788f7e4e0]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x7ff788e22b24
mov rcx, rsi
call qword [0x7ff788f7e528]
lea r11, [rsp + 0x480]
mov eax, 1
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x7ff788e255a8
Capabilities:
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0xb0
lea rcx, str.Advapi32.dll
mov r12, r9
mov rsi, r8
mov r13d, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
jne 0x7ff788e255f4
xor eax, eax
jmp 0x7ff788e25792
lea rdx, str.CryptAcquireContextA
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptCreateHash
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptHashData
mov rcx, rdi
mov qword [rbp - 0x39], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptGetHashParam
mov rcx, rdi
mov qword [rbp - 0x31], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptDestroyHash
mov rcx, rdi
mov qword [rbp - 0x29], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.CryptReleaseContext
mov rcx, rdi
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov dword [rbp - 0x51], 0x10
lea rcx, [rbp - 0x11]
mov r14, rax
lea r8d, [rdx + 0x32]
call fcn.7ff788e27164
mov r9d, 1
mov dword [rsp + 0x20], 0xf0000000
lea r8, str.Microsoft_Base_Cryptographic_Provider_v1.0
xor edx, edx
lea rcx, [rbp - 0x49]
call rbx
xor ebx, ebx
test eax, eax
jne 0x7ff788e256b2
mov rcx, rdi
mov dword [rsi], ebx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x7ff788e255ed
mov rcx, qword [rbp - 0x49]
lea rax, [rbp - 0x41]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8003
call qword [rbp - 0x39]
test eax, eax
jne 0x7ff788e256dc
mov rcx, qword [rbp - 0x49]
xor edx, edx
call r14
jmp 0x7ff788e256a2
mov rdx, qword [rbp + 0x5f]
xor r9d, r9d
mov rcx, qword [rbp - 0x41]
mov r8d, r13d
call qword [rbp - 0x31]
test eax, eax
jne 0x7ff788e25703
mov rcx, qword [rbp - 0x49]
xor edx, edx
call r14
mov rcx, qword [rbp - 0x41]
call r15
jmp 0x7ff788e256a2
mov rcx, qword [rbp - 0x41]
lea r9, [rbp - 0x51]
lea r8, [rbp - 0x21]
mov dword [rsp + 0x20], ebx
mov edx, 2
call qword [rbp - 0x29]
test eax, eax
je 0x7ff788e256f1
mov eax, dword [rbp - 0x51]
test eax, eax
je 0x7ff788e2575f
lea r8, [rbp - 0x21]
mov r9d, eax
lea rdx, [rbp - 0x10]
lea r10, str.0123456789abcdef
movzx ecx, byte [r8]
inc r8
mov eax, ecx
and ecx, 0xf
shr rax, 4
mov al, byte [rax + r10]
mov byte [rdx - 1], al
mov al, byte [rcx + r10]
mov byte [rdx], al
lea rdx, [rdx + 2]
sub r9, 1
jne 0x7ff788e25738
mov rcx, qword [rbp - 0x49]
xor edx, edx
call r14
mov rcx, qword [rbp - 0x41]
call r15
lea rcx, [rbp - 0x11]
call fcn.7ff788e29ff0
movsxd rcx, dword [rbp + 0x7f]
cmp rax, rcx
jae 0x7ff788e2578d
lea rdx, [rbp - 0x11]
mov rcx, r12
call fcn.7ff788e29ea0
mov eax, 1
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x7ff788e2596c
Capabilities:
Initialize winsock library
Send data
Send data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r15
lea rbp, [rsp - 0x160]
sub rsp, 0x260
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x50]
lea r8d, [rdx + 0x66]
call fcn.7ff788e27164
xor r8d, r8d
mov byte [rbp + 0x190], 1
or r15, 0xffffffffffffffff
mov dword [rsp + 0x50], r15d
mov word [rsp + 0x54], r15w
mov al, byte [rbx + r8*4]
mov byte [rbp + r8 + 0x198], al
inc r8
cmp r8, 6
jl 0x7ff788e259b8
lea rbx, [rsp + 0x56]
mov edi, 0x10
mov r8d, 6
lea rdx, [rbp + 0x198]
mov rcx, rbx
call fcn.7ff788e285a0
add rbx, 6
sub rdi, 1
jne 0x7ff788e259d7
mov ecx, 0x202
lea rdx, [rbp - 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x7ff788e25a10
xor eax, eax
jmp 0x7ff788e25b0d
mov edi, 2
mov edx, edi
mov ecx, edi
lea r8d, [rdi + 0xf]
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
cmp rax, r15
je 0x7ff788e25a09
lea r9, [rbp + 0x190]
mov dword [rsp + 0x20], 1
mov edx, 0xffff
lea r8d, [rdi + 0x1e]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x7ff788e25a09
and qword [rsp + 0x30], 0
xor ecx, ecx
and qword [rsp + 0x38], 0
mov word [rsp + 0x30], di
call qword [sym.imp.WS2_32.dll_htonl]
xor ecx, ecx
mov dword [rsp + 0x34], eax
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rdi + 0xe]
mov rcx, rbx
lea rdx, [rsp + 0x30]
mov word [rsp + 0x32], ax
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jne 0x7ff788e25a09
and qword [rsp + 0x40], 0
mov rcx, rsi
and qword [rsp + 0x48], 0
mov word [rsp + 0x40], di
call qword [sym.imp.WS2_32.dll_inet_addr]
lea ecx, [rdi + 5]
mov dword [rsp + 0x44], eax
call qword [sym.imp.WS2_32.dll_htons]
mov dword [rsp + 0x28], 0x10
lea r8d, [rdi + 0x64]
mov word [rsp + 0x42], ax
lea rdx, [rsp + 0x50]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
cmp eax, r15d
je 0x7ff788e25a09
mov ecx, 0xfa
call qword [0x7ff788f79de0]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
lea eax, [rdi - 1]
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r15
pop rdi
pop rbp
ret
Function at 0x7ff788e25d78
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
xor r8d, r8d
lea rsi, [0x7ff788e20000]
mov r9d, r8d
lea rdi, [0x7ff788e3e180]
mov ecx, r8d
test r9b, 1
jne 0x7ff788e25da4
mov al, byte [rcx + rdi]
jmp 0x7ff788e25db8
mov eax, r9d
cdq
idiv dword [0x7ff788e3e3f4]
movsxd rax, edx
mov al, byte [rax + rsi + 0x1e420]
xor byte [rcx + rsi + 0x1e3f8], al
inc r9d
inc rcx
cmp r9d, 0x20
jl 0x7ff788e25d99
mov r9d, dword [0x7ff788f7e458]
test r9d, r9d
jne 0x7ff788e25e10
movsxd rcx, dword [0x7ff788e3e154]
mov r9d, r8d
test ecx, ecx
jle 0x7ff788e25e0a
mov r10, rdi
mov eax, r9d
inc r9d
cdq
idiv dword [0x7ff788e3e12c]
movsxd rax, edx
mov al, byte [rax + rsi + 0x1d6c0]
xor byte [r10], al
inc r10
cmp r9d, ecx
jl 0x7ff788e25de8
mov byte [rcx + rdi], r8b
jmp 0x7ff788e25e59
mov r10d, r8d
mov r11, rdi
mov rcx, rdi
mov eax, r10d
cdq
idiv r9d
test edx, edx
jne 0x7ff788e25e27
inc rcx
mov eax, r10d
cdq
idiv dword [0x7ff788e3e12c]
movsxd rax, edx
mov al, byte [rax + rsi + 0x1d6c0]
xor al, byte [rcx]
inc rcx
mov byte [r11], al
inc r11
movsxd rax, r10d
inc r10d
cmp r10d, 0x273
jb 0x7ff788e25e19
mov byte [rax + rdi], r8b
mov edx, 0x46
mov al, byte [r8 + rsi + 0x1e3f8]
inc r8
mov ecx, edx
inc edx
mov byte [rcx + rdi], al
cmp r8, 0x20
jl 0x7ff788e25e5e
mov rsi, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
Function at 0x7ff788e2a4e0
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x20
mov esi, r8d
mov ebx, edx
mov r14d, ecx
test r8d, r8d
jne 0x7ff788e2a2b4
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x7ff788e2a2b4
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x7ff788e2a2b4
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x7ff788e2a2b4
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x7ff788e2a2b4
cmp dword [rcx + 0x84], 0xe
jbe 0x7ff788e2a2b4
cmp dword [rcx + 0xf8], esi
je 0x7ff788e2a2b4
mov ecx, r14d
call fcn.7ff788e2a3fc
mov ecx, 2
call fcn.7ff788e2c730
nop
cmp byte [0x7ff788f7e810], 0
jne 0x7ff788e2a37e
mov r15d, 1
mov eax, r15d
xchg dword [0x7ff788f7e800], eax
test ebx, ebx
jne 0x7ff788e2a327
mov rdi, qword [0x7ff788e41258]
mov edx, edi
and edx, 0x3f
lea ecx, [rbx + 0x40]
sub ecx, edx
xor eax, eax
ror rax, cl
xor rax, rdi
mov rcx, qword [0x7ff788f7e808]
cmp rcx, rax
je 0x7ff788e2a31e
xor rdi, rcx
mov ecx, edx
ror rdi, cl
mov rcx, rdi
call qword [fcn.7ff788e27ed8]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rdi
lea rcx, [0x7ff788f7ea68]
jmp 0x7ff788e2a333
cmp ebx, r15d
jne 0x7ff788e2a339
lea rcx, [0x7ff788f7ea80]
call fcn.7ff788e2b3a4
nop
test ebx, ebx
jne 0x7ff788e2a350
lea rdx, [0x7ff788e33368]
lea rcx, [0x7ff788e33348]
call fcn.7ff788e2ad50
lea rdx, [0x7ff788e33378]
lea rcx, [0x7ff788e33370]
call fcn.7ff788e2ad50
movzx eax, byte [0x7ff788f7e810]
test esi, esi
cmove eax, r15d
mov byte [0x7ff788f7e810], al
jmp 0x7ff788e2a37e
mov ecx, 2
call fcn.7ff788e2c784
test esi, esi
jne 0x7ff788e2a395
mov ecx, r14d
call fcn.7ff788e2a3b0
int3
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret
xor r8d, r8d
xor edx, edx
jmp 0x7ff788e2a244
Function at 0x140001000
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
xor esi, esi
mov qword [rbp - 0x11], 0x2a0028
lea rax, str.KnownDlls_ntdll.dll
mov qword [rbp + 0x7f], rsi
mov qword [rbp - 9], rax
lea r8, [rbp - 1]
lea rax, [rbp - 0x11]
mov qword [rbp - 0x21], rsi
xorps xmm0, xmm0
mov qword [rbp - 1], 0x30
lea edx, [rsi + 0xd]
mov qword [rbp + 0x17], 0x40
lea rcx, [rbp + 0x7f]
mov qword [rbp - 0x19], rsi
mov edi, esi
mov qword [rbp + 7], rsi
mov qword [rbp + 0xf], rax
movdqu xmmword [rbp + 0x1f], xmm0
call fcn.140001550
test eax, eax
jne 0x1400010b2
mov rcx, qword [rbp + 0x7f]
lea rax, [rbp - 0x19]
mov dword [rsp + 0x48], 0x20
lea r8, [rbp - 0x21]
mov dword [rsp + 0x40], esi
lea rdx, [rsi - 1]
mov dword [rsp + 0x38], 1
xor r9d, r9d
mov qword [rsp + 0x30], rax
lea rax, [rbp - 0x29]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov qword [rbp - 0x29], rsi
call fcn.14000159d
mov rdi, qword [rbp - 0x21]
mov rcx, qword [rbp + 0x7f]
test rcx, rcx
je 0x1400010c0
call fcn.140001684
mov qword [rsp + 0xb8], rbx
test rdi, rdi
je 0x14000114d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x20]
mov rcx, qword [rax]
mov r9, qword [rcx + 0x20]
test r9, r9
je 0x1400010f9
mov eax, 0x5a4d
cmp word [r9], ax
jne 0x14000114d
movsxd rcx, dword [r9 + 0x3c]
add rcx, r9
cmp dword [rcx], 0x4550
jne 0x14000114d
mov qword [rbp + 0x77], rsi
mov r8d, esi
mov qword [rbp + 0x6f], rsi
movzx r11d, word [rcx + 0x14]
movzx r10d, word [rcx + 6]
add r11, rcx
test r10, r10
je 0x14000114d
mov rdx, rsi
lea rcx, [r11 + 0x18]
nop dword [rax]
mov eax, dword [rcx]
or eax, 0x20202020
cmp eax, 0x7865742e
je 0x140001165
inc r8d
inc rdx
add rcx, 0x28
cmp rdx, r10
jl 0x140001130
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xb8]
add rsp, 0xc0
pop rdi
pop rsi
pop rbp
ret
movsxd rax, r8d
lea rcx, [rax + rax*4]
mov edx, dword [r11 + rcx*8 + 0x24]
add rdx, r9
mov qword [rbp + 0x77], rdx
mov ebx, dword [r11 + rcx*8 + 0x24]
mov eax, dword [r11 + rcx*8 + 0x20]
add rbx, rdi
mov qword [rbp + 0x6f], rax
test rdx, rdx
je 0x14000114d
test rbx, rbx
je 0x14000114d
test rax, rax
je 0x14000114d
mov eax, dword [rbx]
cmp dword [rdx], eax
jne 0x14000114d
lea rax, [rbp + 0x67]
mov dword [rbp + 0x67], esi
mov r9d, 0x80
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x6f]
mov rcx, 0xffffffffffffffff
lea rdx, [rbp + 0x77]
call fcn.1400015ea
test eax, eax
jne 0x14000114d
mov rcx, qword [rbp + 0x6f]
mov rdx, qword [rbp + 0x77]
test rcx, rcx
je 0x1400011f3
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rdx], al
lea rdx, [rdx + 1]
sub rcx, 1
jne 0x1400011e0
mov r9d, dword [rbp + 0x67]
lea rax, [rbp + 0x67]
lea r8, [rbp + 0x6f]
mov qword [rsp + 0x20], rax
lea rdx, [rbp + 0x77]
mov rcx, 0xffffffffffffffff
call fcn.1400015ea
test eax, eax
jne 0x14000114d
mov rdx, rdi
mov rcx, 0xffffffffffffffff
call fcn.140001637
xor eax, eax
jmp 0x140001152
Function at 0x140c34058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c341df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c34089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c3406f
add dl, dl
jne 0x140c34096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c340f6
xor eax, eax
add dl, dl
jne 0x140c340a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c341ad
add dl, dl
jne 0x140c340b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c340c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c340d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c340dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c340ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c3407e
mov eax, 1
add dl, dl
jne 0x140c34106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c34113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c340fb
sub eax, ebx
mov ebx, 1
jne 0x140c3414c
mov ecx, 1
add dl, dl
jne 0x140c3412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c3413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c34123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c34168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c34175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c3415d
cmp eax, 0x7d00
jae 0x140c3419b
cmp eax, 0x500
jb 0x140c34196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3407e
cmp eax, 0x7f
ja 0x140c3419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c3407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c341d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c3407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140001000
Capabilities:
Enumerate processes

Disassembly:
sub rsp, 0x188
mov qword [rsp + 0x178], r8
mov qword [rsp + 0x170], rdx
mov qword [rsp + 0x168], rcx
mov dword [rsp + 0x164], 0
mov qword [rsp + 0x158], 0
mov ecx, 0xf
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rsp + 0x150], rax
mov rax, 0xffffffffffffffff
cmp qword [rsp + 0x150], rax
jne 0x140001083
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._ERROR__Invalid_HANDLE_to_process_snapshots___d__n
call fcn.140001470
mov dword [rsp + 0x184], 0
jmp 0x1400011f6
mov dword [rsp + 0x20], 0x130
mov rcx, qword [rsp + 0x150]
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32First
cmp eax, 0
jne 0x1400010ca
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, str._ERROR__Could_not_enumerate_processes___d__n
call fcn.140001470
mov dword [rsp + 0x184], 0
jmp 0x1400011f6
jmp 0x1400010cf
lea rdx, [rsp + 0x20]
add rdx, 0x2c
mov rcx, qword [rsp + 0x168]
call fcn.140004850
mov ecx, eax
xor eax, eax
cmp eax, ecx
jne 0x1400011bd
lea rdx, [rsp + 0x20]
add rdx, 0x2c
lea rcx, str.Process_name_matched_n
call fcn.140001470
mov eax, dword [rsp + 0x28]
mov dword [rsp + 0x164], eax
mov r8d, dword [rsp + 0x164]
mov rdx, qword [rsp + 0x168]
lea rcx, str.____Trying_to_open_handle_on__ls__on_pid__d_n
call fcn.140001470
mov r8d, dword [rsp + 0x164]
mov ecx, 0x43a
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x158], rax
cmp qword [rsp + 0x158], 0
jne 0x140001171
mov edx, dword [rsp + 0x164]
lea rcx, str._X__Could_not_open_handle_on__d__continuing_n
call fcn.140001470
jmp 0x1400011b8
mov edx, dword [rsp + 0x164]
lea rcx, str.___Successfully_got_handle_on__d_n
call fcn.140001470
mov ecx, dword [rsp + 0x164]
mov rax, qword [rsp + 0x178]
mov dword [rax], ecx
mov rcx, qword [rsp + 0x158]
mov rax, qword [rsp + 0x170]
mov qword [rax], rcx
mov dword [rsp + 0x184], 1
jmp 0x1400011f6
jmp 0x1400011bd
jmp 0x1400011c2
mov rcx, qword [rsp + 0x150]
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
cmp eax, 0
jne 0x1400010cf
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x184], 0
mov eax, dword [rsp + 0x184]
add rsp, 0x188
ret