joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140007b80
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push r12
push rsi
push rbx
sub rsp, 0x20
mov rbx, qword [0x14000e620]
mov rax, qword [rbx]
mov r12, rcx
mov esi, edx
test rax, rax
je 0x140007c50
cmp qword [rax + 0x60], 0
jne 0x140007c70
lea rcx, [0x14000d198]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_lock
mov rcx, r12
call sym.__pthread_get_pointer
test rax, rax
je 0x140007c80
cmp qword [rax + 0x1d8], r12
jne 0x140007c80
test byte [rax + 0x40], 0xc
jne 0x140007c80
mov edx, dword [rax + 0xbc]
test edx, edx
jne 0x140007c80
mov rax, qword [rax + 0x28]
sub rax, 1
cmp rax, 0xfffffffffffffffd
ja 0x140007c80
mov rax, qword [rbx]
test rax, rax
je 0x140007ce0
cmp qword [rax + 0x60], 0
jne 0x140007d00
lea rcx, [0x14000d198]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
test esi, esi
je 0x140007d10
lea edx, [rsi - 2]
cmp edx, 0x15
ja 0x140007d18
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop r12
jmp sym.pthread_cancel
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x140007bab
test rax, rax
jne 0x140007c70
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007bb6
mov rax, qword [rbx]
test rax, rax
je 0x140007cb0
cmp qword [rax + 0x60], 0
jne 0x140007cd0
lea rcx, [0x14000d198]
mov qword [rax + 0x60], rcx
call sym.pthread_mutex_unlock
mov eax, 3
add rsp, 0x20
pop rbx
pop rsi
pop r12
ret
call sym.__shmem3_winpthreads_tdm_init_local_region
mov r8, rax
mov rax, qword [rbx]
cmp qword [r8 + 0x60], 0
je 0x140007c8f
test rax, rax
jne 0x140007cd0
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007c9a
call sym.__shmem3_winpthreads_tdm_init_local_region
cmp qword [rax + 0x60], 0
mov rax, qword [rbx]
je 0x140007c1a
test rax, rax
jne 0x140007d00
call sym.__shmem3_winpthreads_tdm_init_local_region
nop dword [rax]
mov rcx, qword [rax + 0x60]
jmp 0x140007c25
xor eax, eax
jmp 0x140007ca4
mov eax, 0x16
jmp 0x140007ca4
Function at 0x140008c80
Capabilities:
Print debug messages

Disassembly:
push r12
push rbx
sub rsp, 0x58
mov r12, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140008ca0
add rsp, 0x58
pop rbx
pop r12
ret
lea rdx, [rsp + 0x48]
mov r9d, 0x400
mov r8d, eax
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x20], rdx
mov ecx, 0x1100
xor edx, edx
mov dword [rsp + 0x28], 0
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
jne 0x140008ce8
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140008c94
int3
mov rcx, qword [rsp + 0x48]
mov rbx, qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call rbx
mov rcx, r12
call rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x140008cd5

Function at 0x140008d10
Capabilities:
Check mutex on windows

Disassembly:
push r12
sub rsp, 0x20
xor edx, edx
xor ecx, ecx
lea r8, [0x1400112c0]
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov r12, rax
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x140008dc8
mov rdx, qword [0x140011200]
lea rcx, [0x140011200]
mov rax, qword [rdx + 8]
test rax, rax
je 0x140008d98
cmp rdx, rcx
jne 0x140008d7a
mov qword [rdx], rax
cmp rax, rcx
je 0x140008d7f
nop dword [rax]
test rax, rax
je 0x140008daa
mov rdx, qword [rdx]
mov qword [rax], rdx
mov rdx, rax
mov rax, qword [rdx + 8]
cmp rax, rcx
jne 0x140008d68
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
test rax, rax
je 0x140008daa
mov rdx, rax
jmp 0x140008d76
lea rcx, [0x140011300]
call qword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x140008de6
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
lea rcx, str.failed_to_to_lock_cleanup_mutex_n
call sym.__shmem_get_error
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x20
pop r12
ret
movzx ecx, ax
call qword [sym.imp.KERNEL32.dll_DeleteAtom]
jmp 0x140008daa
Function at 0x140002e40
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140002e9d
lea rbx, [0x1400b0570]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x140002e84
cmp r10, 2
jb 0x140002e84
cmp byte [r9], r8b
jne 0x140002e84
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x140002e60
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140002edf
lea rbx, [0x1400b0570]
cmp r8b, 0x23
jne 0x140002ec3
cmp byte [r9], r8b
jne 0x140002ec3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140002eb0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x1400030a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rcx
test rcx, rcx
jne 0x1400030cf
mov r8d, 0x60e
lea rdx, str.D:_ramknifeimgui.cpp
lea rcx, str.filename__mode
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
test rdi, rdi
je 0x1400030db
mov qword [rdi], 0
lea rdx, [0x1400b01c0]
mov rcx, rbx
call fcn.140002ef0
mov rbx, rax
test rax, rax
jne 0x1400030fd
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
mov rcx, rbx
mov qword [rsp + 0x38], rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov ebp, eax
cmp eax, 0xffffffff
je 0x1400031d4
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400031d4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x1400031d4
xor r8d, r8d
mov edx, ebp
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x1400031d4
cmp rsi, 0xffffffffffffffff
je 0x1400031d4
mov rax, qword [0x1402d5090]
test rax, rax
je 0x140003171
inc dword [rax + 0x3b4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbp, rax
test rax, rax
je 0x1400031d4
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rsi
je 0x1400031c1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1402d5090]
test rax, rax
je 0x1400031b6
dec dword [rax + 0x3b4]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x1400031dd
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x1400031cf
mov qword [rdi], rsi
mov rax, rbp
jmp 0x1400031df
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140004c50
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov dword [rsp + 0x10], edx
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xc0], 0
mov rbx, rcx
mov edi, edx
jg 0x140004c86
mov r8d, 0x661
lea rdx, str.D:_ramknifeimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd r8, dword [rbx + 0xc0]
mov rax, qword [rbx + 0xc8]
mov edx, dword [rax + r8*4 - 4]
lea r8, [0x1400b0570]
not edx
movzx eax, dil
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x39]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3a]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
movzx eax, byte [rsp + 0x3b]
xor edx, dword [r8 + rcx*4]
movzx ecx, dl
xor rcx, rax
shr edx, 8
mov rax, qword [0x1402d5090]
xor edx, dword [r8 + rcx*4]
not edx
cmp dword [rax + 0x1b60], edx
jne 0x140004d00
mov dword [rax + 0x1b64], edx
cmp dword [rax + 0x1ba0], edx
jne 0x140004d0f
mov byte [rax + 0x1ba4], 1
mov rbx, qword [rsp + 0x30]
mov eax, edx
add rsp, 0x20
pop rdi
ret
Function at 0x1400050d0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x78
mov rax, qword [0x1402d5090]
test rax, rax
je 0x1400050f6
inc dword [rax + 0x3b4]
mov ecx, 0x3fb0
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp + 0x40], rax
lea rcx, [rbp + 0x38]
mov qword [rbp + 0x48], rcx
mov qword [rbp + 0x50], rax
xor r14d, r14d
test rax, rax
je 0x140005128
xor edx, edx
mov rcx, rax
call fcn.140001a10
mov rbx, rax
jmp 0x14000512b
mov rbx, r14
cmp qword [0x1402d5090], 0
jne 0x14000513c
mov qword [0x1402d5090], rbx
cmp byte [rbx], 0
jne 0x14000514a
cmp byte [rbx + 0x3101], 0
je 0x140005164
mov r8d, 0xfb5
lea rdx, str.D:_ramknifeimgui.cpp
lea rcx, str._g.Initialized___g.SettingsLoaded
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
mov dword [rbp - 0x4c], r14d
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x18], r14
lea rax, str.Window
mov qword [rbp - 0x58], rax
mov esi, 0xffffffff
mov edx, esi
lea r8, [0x1400ad909]
mov r9b, 0x57
lea r15, [0x1400b0570]
cmp r9b, 0x23
jne 0x1400051a5
cmp byte [r8], r9b
jne 0x1400051a5
cmp byte [r8 + 1], r9b
cmove edx, esi
movzx ecx, dl
movzx eax, r9b
xor rcx, rax
shr edx, 8
xor edx, dword [r15 + rcx*4]
movzx r9d, byte [r8]
inc r8
test r9b, r9b
jne 0x140005193
not edx
mov dword [rbp - 0x50], edx
lea rax, [0x140015c30]
mov qword [rbp - 0x48], rax
lea rax, [0x140015cf0]
mov qword [rbp - 0x38], rax
lea rax, [0x140015d70]
mov qword [rbp - 0x30], rax
lea rax, [0x140015e40]
mov qword [rbp - 0x28], rax
lea rax, [0x140015ff0]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbx + 0x3118]
call fcn.140016610
mov dword [rbp - 0x4c], r14d
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x18], r14
lea rax, str.Table
mov qword [rbp - 0x58], rax
mov eax, esi
lea r8, [0x1400b6465]
mov r9b, 0x54
cmp r9b, 0x23
jne 0x140005243
cmp byte [r8], r9b
jne 0x140005243
cmp byte [r8 + 1], r9b
cmove eax, esi
movzx edx, al
movzx ecx, r9b
xor rdx, rcx
shr eax, 8
xor eax, dword [r15 + rdx*4]
movzx r9d, byte [r8]
inc r8
test r9b, r9b
jne 0x140005231
not eax
mov dword [rbp - 0x50], eax
lea rax, [0x140028ec0]
mov qword [rbp - 0x48], rax
lea rax, [0x140029010]
mov qword [rbp - 0x38], rax
lea rax, [0x1400290b0]
mov qword [rbp - 0x30], rax
lea rax, [0x140028f80]
mov qword [rbp - 0x28], rax
lea rax, [0x140029330]
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x58]
lea rcx, [rbx + 0x3118]
call fcn.140016610
mov byte [rbx], 1
mov rax, rbx
add rsp, 0x78
pop r15
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x14000f490
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x1402d5090]
mov rsi, rcx
mov rbx, qword [rax + 0x1b10]
add rbx, 0xc0
cmp dword [rbx], 0
jg 0x14000f4db
mov r8d, 0x661
lea rdx, str.D:_ramknifeimgui.h
lea rcx, str.Size___0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
movsxd rdx, dword [rbx]
lea r8, [0x1400b0570]
mov rax, qword [rbx + 8]
mov edi, dword [rax + rdx*4 - 4]
not edi
movzx eax, sil
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x34]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x35]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x36]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x37]
xor edi, dword [r8 + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [r8 + rcx*4]
mov r8d, dword [rbx + 4]
not edi
cmp edx, r8d
jne 0x14000f5ba
lea ecx, [rdx + 1]
test r8d, r8d
je 0x14000f5a6
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x14000f5ab
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.1400174a0
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov rsi, qword [rsp + 0x40]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1400103e0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x1402d5090]
mov edi, edx
cmp byte [rbx + 0x2025], 0
jne 0x140010431
cmp byte [rbx + 0x2026], 0
jne 0x140010431
mov r9d, dword [rbx + 0x30c8]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140002dc0
test dil, 1
je 0x140010556
jmp 0x1400104b9
movss xmm1, dword [rbx + 0x1618]
lea r8, str.Tooltip__02d
movaps xmm0, xmm1
lea rcx, [rsp + 0x20]
mulss xmm0, dword [0x1400b7538]
xor eax, eax
mulss xmm1, dword [0x1400b7520]
addss xmm0, dword [rbx + 0x128]
lea edx, [rax + 0x10]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1bd0], rax
mov dword [rbx + 0x1bbc], 1
movss dword [rbx + 0x1bc8], xmm0
movss dword [rbx + 0x1bcc], xmm1
movss xmm0, dword [rbx + 0x1684]
mulss xmm0, dword [0x1400b74b4]
or dword [rbx + 0x1bb8], 0x41
movss dword [rbx + 0x1c18], xmm0
mov r9d, dword [rbx + 0x30c8]
call fcn.140002dc0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140010510
lea r11, [0x1400b0570]
nop dword [rax]
cmp r9b, 0x23
jne 0x1400104f3
cmp byte [r8], r9b
jne 0x1400104f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x1400104e0
not ecx
call fcn.140009770
test rax, rax
je 0x140010556
cmp byte [rax + 0x86], 0
je 0x140010556
mov byte [rax + 0x8d], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xa4], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x30c8]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x30c8]
call fcn.140002dc0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.14000be00
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1400151c0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x40
mov rbx, qword [0x1402d5090]
cmp byte [rbx + 0x3158], 0
je 0x1400152ac
cmp qword [rbx + 0x3160], 0
mov qword [rax - 0x18], rsi
lea rsi, [rax + 0x10]
mov qword [rax - 0x20], rdi
lea rdi, [rbx + 0x3168]
je 0x140015294
mov r9d, dword [rdi + 4]
mov qword [rax - 0x10], rbp
xor ebp, ebp
test r9d, r9d
jns 0x14001523b
mov eax, r9d
mov rcx, rdi
cdq
sub eax, edx
mov edx, ebp
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.140017220
mov rcx, qword [rsp + 0x50]
mov rdx, rcx
mov dword [rdi], ebp
mov rcx, rdi
mov r8, rsi
call fcn.140003610
mov eax, dword [rdi]
mov edx, 1
mov r9, qword [rbx + 0x3160]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rbx + 0x3170]
cmove ecx, ebp
test rax, rax
movsxd r8, ecx
lea rcx, [0x1402d5088]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
mov r8, rsi
mov rcx, rdi
call fcn.140003610
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
add rsp, 0x40
pop rbx
ret
Function at 0x140030c80
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov ecx, 0x1fffff
mov r8d, eax
call qword [sym.imp.KERNEL32.dll_OpenProcess]
movabs r13, 0x312d5d9de85696c
lea rcx, [rsp + 0x40]
mov rbp, rax
mov qword [rsp + 0x38], r13
movabs rax, 0x9daa14905d5f5ab1
movabs r15, 0xf1ce3afc313b2edf
mov qword [rsp + 0x40], r15
movabs r12, 0x312d5d9de856900
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x30], rax
movaps xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r14d, r14d
lea rbx, [0x1402d4260]
mov esi, r14d
mov rdi, rax
nop dword [rax]
mov rdx, qword [rbx - 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx - 0x18], rax
mov rcx, rdi
mov rdx, qword [rbx - 8]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
mov rcx, rdi
mov rdx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add esi, 3
mov qword [rbx + 0x18], rax
lea rbx, [rbx + 0x48]
cmp esi, 3
jb 0x140030d20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov qword [rsp + 0x48], r13
lea rdx, [rsp + 0x40]
mov rbx, rax
mov qword [rsp + 0x30], r15
movabs rax, 0xf1a23a98314f2eb1
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rax
mov rcx, rbx
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
jne 0x140030df5
movabs rax, 0xf1823ab8316f2e91
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x40]
movabs rax, 0x312d5d9de85694c
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x48], rax
mov rcx, rbx
movaps xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x40], xmm0
call qword [sym.imp.VCRUNTIME140.dll_wcsstr]
test rax, rax
je 0x140030e69
mov esi, r14d
lea rdi, [0x1402d4248]
nop
mov r8, qword [rdi + 8]
lea rax, [rsp + 0x80]
mov rdx, qword [rdi]
mov r9d, 0x40
mov rcx, rbp
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov rdx, qword [rdi]
mov rcx, rbp
mov r9, qword [rdi + 8]
mov r8, rdx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov r9d, dword [rsp + 0x80]
mov rcx, rbp
mov r8, qword [rdi + 8]
mov ebx, eax
mov rdx, qword [rdi]
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test ebx, ebx
je 0x140030e69
inc esi
add rdi, 0x18
cmp esi, 3
jb 0x140030e00
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x50]
xor eax, eax
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140031350
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x260
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov rdi, rcx
xor sil, sil
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x20]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400313cb
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x1400313cb
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400313c8
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400313a2
jmp 0x1400313cb
mov sil, 1
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x260]
movzx eax, sil
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140032a70
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r14d, r14d
mov dword [rsp + 0x40], r14d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140032b28
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140032b28
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140032b23
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140032b00
cmp edx, 0x4cfe97c1
je 0x140032beb
test r8d, r8d
jne 0x140032ae0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140032b3d
cmp qword [rax + 0x30], r14
jne 0x140032ab0
mov rbp, r14
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140032bd4
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140032bd4
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140032bcf
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140032bb0
cmp edx, 0x6dd8a845
je 0x140032c07
test r8d, r8d
jne 0x140032b90
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x140032c1f
cmp qword [rax + 0x30], r14
jne 0x140032b60
jmp 0x140032c1f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ebp, dword [rcx + rdx*4]
add rbp, r9
jmp 0x140032b40
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r14d, dword [rcx + rdx*4]
add r14, r9
call r14
lea rdx, [rsp + 0x40]
mov rcx, rax
call rbp
mov eax, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret