joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455d20
Capabilities:
Allocate thread local storage

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [0x00462338], eax
je 0x455d3a
add rsp, 0x28
ret
call sub.msvcrt.dll_abort
nop

Function at 0x456290
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x48
cmp dword [0x0047fec8], 1
je 0x4562a6
call fcn.00456200
mov ecx, dword [0x00462338]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
mov rbx, rax
je 0x4562d0
mov rax, rbx
add rsp, 0x48
pop rbx
pop rsi
pop rdi
pop rbp
ret
call fcn.00456140
cmp qword [0x00484050], 0
mov rsi, rax
je 0x4562ba
test rax, rax
je 0x4562ba
mov dword [rax + 0x44], 1
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
mov dword [rsi + 0x68], eax
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov rbx, qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], 0xffffffffffffffff
mov qword [rsi + 0x60], 0xffffffffffffffff
mov dword [rsi + 0xb0], 0
mov qword [rsi + 0x28], 0
call rbx
mov rbp, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rdi, rax
call rbx
mov dword [rsp + 0x30], 2
mov dword [rsp + 0x28], 0
lea r9, [rsi + 0x28]
mov dword [rsp + 0x20], 0
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DuplicateHandle]
test eax, eax
je 0x4563b8
mov rcx, qword [rsi + 0x28]
call qword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [rsi + 0xb8], eax
movzx eax, byte [rsi + 0x40]
mov rdx, rsi
mov dword [rsi + 0xb4], 0
mov ecx, dword [0x00462338]
and eax, 0xffffffcf
or eax, 0x10
mov byte [rsi + 0x40], al
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
test eax, eax
je 0x4563b8
mov rbx, rsi
jmp 0x4562ba
call sub.msvcrt.dll_abort
nop
nop
Function at 0x4578b0
Capabilities:
Create thread
Resume thread

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x30
mov r13, rcx
mov rbp, rdx
mov rsi, r8
mov rdi, r9
call fcn.00456140
test rax, rax
mov rbx, rax
je 0x457a63
test r13, r13
je 0x4578eb
mov rax, qword [rax + 0x1c8]
mov qword [r13], rax
mov r12, qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbx + 8], rdi
mov rdi, qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x10], rsi
mov esi, 1
mov dword [rbx + 0xb4], 0
mov dword [rbx + 0x44], 1
mov qword [rbx + 0x28], 0xffffffffffffffff
mov r14, r12
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov edx, 1
call rdi
test rax, rax
mov qword [rbx + 0x30], rax
jne 0x457b10
cmp esi, 1
je 0x457955
mov ecx, 0x14
call r14
cmp esi, 5
je 0x457960
add esi, 1
jmp 0x457922
xor ecx, ecx
call r12
jmp 0x457950
mov rax, qword [rbx + 0x30]
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
test rax, rax
je 0x457a48
test rbp, rbp
je 0x457b50
mov eax, dword [rbp]
mov rsi, qword [rbp + 0x10]
test al, 8
mov dword [rbx + 0x44], eax
jne 0x457ae0
mov eax, dword [rbp + 0x18]
mov edx, esi
mov dword [rbx + 0xb8], eax
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 4
mov r9, rbx
lea r8, [0x00456690]
call qword [sym.imp.msvcrt.dll__beginthreadex]
cmp rax, 0xffffffffffffffff
mov rsi, rax
je 0x457a20
test rax, rax
je 0x457a20
mov edx, dword [rbx + 0xb8]
cmp edx, 0xfffffff2
jl 0x457a80
cmp edx, 0xffffffff
jl 0x457b00
cmp edx, 0xe
jg 0x457b40
cmp edx, 2
mov eax, 2
cmovge edx, eax
jmp 0x457a85
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x457a2f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbx + 0x38]
call fcn.00455a00
mov qword [rbx + 0x60], 0xffffffffffffffff
mov qword [rbx + 0x30], 0
test r13, r13
je 0x457a55
mov qword [r13], 0
cmp qword [rbx + 0x1c0], 0
je 0x457b57
mov eax, 0xb
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov edx, 0xfffffff1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov rcx, qword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
test byte [rbx + 0x44], 4
je 0x457ad1
mov rcx, rsi
mov qword [rbx + 0x28], 0
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
add rsp, 0x30
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
mov qword [rbx + 0x28], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x457ab8
call fcn.00456290
mov eax, dword [rax + 0xb8]
mov edx, esi
mov dword [rbx + 0xb8], eax
jmp 0x4579bd
mov edx, 0xfffffffe
jmp 0x457a85
mov qword [rbx + 0x38], 0xffffffffffffffff
mov qword [rbx + 0x60], 0xffffffffffffffff
mov dword [rbx], 0xbab1f00d
mov dword [rbx + 0xb8], 0
mov dword [rbx + 0xb0], 0
jmp 0x457997
mov edx, 0xf
jmp 0x457a85
xor edx, edx
jmp 0x4579bd
mov rcx, rbx
call fcn.00455f70
nop
jmp 0x457a63
Function at 0x45a000
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x60
mov rsi, rcx
mov ecx, dword [0x0047ff34]
mov rdi, rdx
mov rbp, r8
test ecx, ecx
jle 0x45a1e5
mov rax, qword [0x0047ff38]
xor ebx, ebx
nop
mov r9, qword [rax + 8]
cmp rsi, r9
jb 0x45a04c
mov rdx, qword [rax + 0x10]
mov edx, dword [rdx + 8]
add r9, rdx
cmp rsi, r9
jb 0x45a120
add ebx, 1
add rax, 0x18
cmp ebx, ecx
jne 0x45a030
mov rcx, rsi
call fcn.0045af20
test rax, rax
mov r12, rax
je 0x45a209
movsxd rbx, ebx
lea r13, [rsp + 0x30]
lea r14, [rbx + rbx*2]
shl r14, 3
mov rbx, r14
add rbx, qword [0x0047ff38]
mov qword [rbx + 0x10], rax
mov dword [rbx], 0
call fcn.0045b060
mov edx, dword [r12 + 0xc]
mov r8d, 0x30
add rax, rdx
mov rdx, r13
mov qword [rbx + 8], rax
mov rax, qword [0x0047ff38]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
mov rcx, qword [rax + r14 + 8]
call rbx
test rax, rax
je 0x45a1ec
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x45a1a0
add dword [0x0047ff34], 1
mov r8d, 0x30
mov rdx, r13
mov rcx, rsi
call rbx
test rax, rax
je 0x45a218
mov eax, dword [rsp + 0x54]
cmp eax, 4
jne 0x45a130
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
jmp sub.msvcrt.dll_memcpy
lea r13, [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualQuery]
jmp 0x45a0db
cmp eax, 0x40
je 0x45a0fb
lea r12, [rsp + 0x2c]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rbx, qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r9, r12
call rbx
mov r8, rbp
mov rdx, rdi
mov rcx, rsi
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0x54]
cmp eax, 0x40
je 0x45a187
cmp eax, 4
je 0x45a187
mov r9, r12
mov r8d, dword [rsp + 0x2c]
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
call rbx
nop
add rsp, 0x60
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
ret
cmp eax, 0x40
je 0x45a0d4
add r14, qword [0x0047ff38]
mov r8d, 0x40
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov r9, r14
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x45a0d4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.00459f90
xor ebx, ebx
jmp 0x45a057
mov rax, qword [0x0047ff38]
mov edx, dword [r12 + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + r14 + 8]
call fcn.00459f90
lea rcx, str.Address__p_has_no_image_section
mov rdx, rsi
call fcn.00459f90
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, rsi
mov edx, 0x30
call fcn.00459f90
nop
nop dword [rax]

Function at 0x45ae20
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
lea rax, [rcx + rax + 0x18]
movzx ecx, word [rcx + 6]
test ecx, ecx
je 0x45ae60
sub ecx, 1
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
mov ecx, dword [rax + 0xc]
mov r8d, ecx
cmp r8, rdx
ja 0x45ae57
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x45ae62
add rax, 0x28
cmp rax, r9
jne 0x45ae44
xor eax, eax
repz ret
Function at 0x45af20
Capabilities:
Enumerate pe sections

Disassembly:
push rsi
push rbx
sub rsp, 0x28
cmp word [0x00400000], 0x5a4d
lea rbx, [0x00400000]
mov rsi, rcx
je 0x45af44
xor eax, eax
add rsp, 0x28
pop rbx
pop rsi
ret
mov rcx, rbx
call fcn.0045ade0
test eax, eax
je 0x45af3b
sub rsi, rbx
mov rcx, rbx
mov rdx, rsi
add rsp, 0x28
pop rbx
pop rsi
jmp fcn.0045ae20

Function at 0x45b1b0
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00480800]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004807e0]
test rbx, rbx
je 0x45b204
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x45b1fb
test rsi, rsi
je 0x45b1fb
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x45b1e0
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea rcx, [0x00480800]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp rax
Function at 0x4616cb
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
mov byte [rsp + 0x21], r8b
mov rcx, rdx
mov byte [rsp + 0x22], r9b
mov esi, r8d
mov edi, r9d
mov rbp, qword [rbx]
xor r9d, r9d
mov byte [rsp + 0x20], 0xff
lea rdx, [rsp + 0x20]
mov r8d, 3
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x461721
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov r8d, eax
mov rcx, rbp
call fcn.00416f80
mov rcx, qword [rbx]
lea rdx, str.SENT
mov r9d, edi
mov r8d, esi
call fcn.004615c0
nop
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x461a70
Capabilities:
Send data
Send data on socket

Disassembly:
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov rbp, qword [rcx]
cmp edx, 0x1f
mov rbx, qword [rbp + 0x1f0]
jne 0x461c7d
lea rdx, [rbx + 0x1cb9]
lea rsi, [rbx + 0x1eb8]
lea r12, [rbx + 0x1cb8]
mov byte [rbx + 0x1cb8], 0xff
cmp rsi, rdx
mov qword [rbx + 0x1eb8], rdx
jbe 0x461acc
lea rdx, [rbx + 0x1cba]
mov byte [rbx + 0x1cb9], 0xfa
mov qword [rbx + 0x1eb8], rdx
mov rdx, qword [rbx + 0x1eb8]
cmp rsi, rdx
jbe 0x461ae6
lea rax, [rdx + 1]
mov qword [rbx + 0x1eb8], rax
mov byte [rdx], 0x1f
mov rdi, rcx
movzx ecx, word [rbx + 0x1ca8]
mov r13, qword [sym.imp.WS2_32.dll_htons]
call r13
movzx ecx, word [rbx + 0x1caa]
mov word [rsp + 0x2c], ax
call r13
mov word [rsp + 0x2e], ax
mov rax, qword [rbx + 0x1eb8]
cmp rsi, rax
jbe 0x461b2b
lea rdx, [rax + 1]
mov qword [rbx + 0x1eb8], rdx
mov dl, byte [rsp + 0x2c]
mov byte [rax], dl
mov rax, qword [rbx + 0x1eb8]
cmp rsi, rax
jbe 0x461b48
lea rdx, [rax + 1]
mov qword [rbx + 0x1eb8], rdx
mov dl, byte [rsp + 0x2d]
mov byte [rax], dl
mov rax, qword [rbx + 0x1eb8]
cmp rsi, rax
jbe 0x461b65
lea rdx, [rax + 1]
mov qword [rbx + 0x1eb8], rdx
mov dl, byte [rsp + 0x2e]
mov byte [rax], dl
mov rax, qword [rbx + 0x1eb8]
cmp rsi, rax
jbe 0x461b82
lea rdx, [rax + 1]
mov qword [rbx + 0x1eb8], rdx
mov dl, byte [rsp + 0x2f]
mov byte [rax], dl
mov rax, qword [rbx + 0x1eb8]
cmp rsi, rax
jbe 0x461b9c
lea rdx, [rax + 1]
mov qword [rbx + 0x1eb8], rdx
mov byte [rax], 0xff
mov rax, qword [rbx + 0x1eb8]
cmp rsi, rax
jbe 0x461bb6
lea rdx, [rax + 1]
mov qword [rbx + 0x1eb8], rdx
mov byte [rax], 0xf0
cmp byte [rbp + 0x498], 0
mov rax, qword [rbx + 0x1eb8]
mov qword [rbx + 0x1eb8], r12
mov qword [rbx + 0x1ec0], rax
je 0x461bef
sub rax, r12
lea r8, [rbx + 0x1cba]
mov edx, 0x3e
lea r9, [rax - 2]
mov rcx, rbp
call fcn.00461740
xor r9d, r9d
mov rcx, qword [rdi + 0x1a8]
mov r8d, 3
mov rdx, r12
mov rsi, qword [sym.imp.WS2_32.dll_send]
call rsi
test eax, eax
jns 0x461c27
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov r8d, eax
mov rcx, rbp
call fcn.00416f80
lea rdx, [rbx + 0x1cbb]
mov r8d, 4
mov rcx, rdi
call fcn.0042fea0
xor r9d, r9d
lea rdx, [rbx + 0x1cbf]
mov rcx, qword [rdi + 0x1a8]
mov r8d, 2
call rsi
test eax, eax
jns 0x461c7d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov r8d, eax
mov rcx, rbp
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
jmp fcn.00416f80
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
ret
Function at 0x461c8a
Capabilities:
Send data
Send data on socket

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x968
cmp byte [rcx + 0x498], 0
mov rbx, qword [rcx + 0x1f0]
mov r13, rdx
mov rbp, rcx
mov rax, qword [rbx + 0x1ec0]
mov rdx, qword [rbx + 0x1eb8]
je 0x461cd9
sub rax, rdx
lea r8, [rbx + 0x1cb8]
mov edx, 0x3c
lea r9, [rax + 2]
call fcn.00461740
mov rax, qword [rbx + 0x1eb8]
lea rdx, [rax + 1]
mov qword [rbx + 0x1eb8], rdx
mov al, byte [rax]
cmp al, 0x23
je 0x461d4c
cmp al, 0x27
je 0x461e0f
cmp al, 0x18
jne 0x461f55
add rbx, 0x1c08
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x160]
mov dword [rsp + 0x48], 0xf0
mov dword [rsp + 0x40], 0xff
mov rsi, rcx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0
not rsi
mov dword [rsp + 0x28], 0x18
lea r12, [rsi - 1]
jmp 0x461d95
add rbx, 0x1c28
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rbx
repne scasb al, byte [rdi]
lea rdi, [rsp + 0x160]
mov dword [rsp + 0x48], 0xf0
mov dword [rsp + 0x40], 0xff
mov rsi, rcx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0
not rsi
mov dword [rsp + 0x28], 0x23
lea r12, [rsi - 1]
lea r8, str._c_c_c_c_s_c_c
mov r9d, 0xff
mov edx, 0x800
mov rcx, rdi
mov dword [rsp + 0x20], 0xfa
call fcn.00413d50
xor r9d, r9d
lea r8d, [rsi + 5]
mov rdx, rdi
mov rcx, qword [r13]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x461de7
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov r8d, eax
mov rcx, rbp
call fcn.00416f80
cmp byte [rbp + 0x498], 0
je 0x461f55
lea r9, [r12 + 4]
lea r8, [rdi + 2]
mov edx, 0x3e
mov rcx, rbp
call fcn.00461740
jmp 0x461f55
lea r12, [rsp + 0x160]
lea r8, [0x0046c277]
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x27
mov dword [rsp + 0x20], 0xfa
mov r9d, 0xff
mov edx, 0x800
mov rcx, r12
lea r15, [rsp + 0xe0]
call fcn.00413d50
mov rbx, qword [rbx + 0x1cb0]
lea r14, [rsp + 0x60]
mov esi, 4
or r11, 0xffffffffffffffff
test rbx, rbx
je 0x461ee0
mov r10, qword [rbx]
xor eax, eax
mov rcx, r11
mov rdi, r10
repne scasb al, byte [rdi]
mov rax, rcx
not rax
lea rdi, [rsi + rax]
cmp rdi, 0x7f9
ja 0x461eda
lea rdx, str._127_____127s
mov rcx, r10
mov r9, r15
mov r8, r14
mov qword [rsp + 0x58], r11
call sub.msvcrt.dll_sscanf
lea rcx, [r12 + rsi]
mov edx, 0x800
lea r8, str._c_s_c_s
sub rdx, rsi
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r14
xor r9d, r9d
mov rsi, rdi
call fcn.00413d50
mov r11, qword [rsp + 0x58]
mov rbx, qword [rbx + 8]
jmp 0x461e66
lea rcx, [r12 + rsi]
lea r8, [0x0046c298]
mov edx, 0x800
sub rdx, rsi
mov r9d, 0xff
mov dword [rsp + 0x20], 0xf0
call fcn.00413d50
xor r9d, r9d
lea r8d, [rsi + 2]
mov rdx, r12
mov rcx, qword [r13]
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x461f36
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
lea rdx, str.Sending_data_failed___d_
mov r8d, eax
mov rcx, rbp
call fcn.00416f80
cmp byte [rbp + 0x498], 0
je 0x461f55
lea r8, [r12 + 2]
mov r9, rsi
mov edx, 0x3e
mov rcx, rbp
call fcn.00461740
nop
add rsp, 0x968
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x140001d50
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x140030010]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov rdi, rdx
mov rbx, rcx
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx], rcx
mov qword [rbx + 8], rcx
mov qword [rbx + 0x10], rcx
mov dword [rsp + 0x20], 1
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
test rax, rax
je 0x140001e57
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x34]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140001e4e
mov r8, rdi
cmp qword [rdi + 0x18], 8
jb 0x140001dee
mov r8, qword [rdi]
lea rax, [rsp + 0x5c]
sub r8, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x140001e14
add rax, 2
test ecx, ecx
jne 0x140001e00
test edx, edx
jne 0x140001e3c
mov rdx, qword [rbx + 8]
cmp rdx, qword [rbx + 0x10]
je 0x140001e2f
mov eax, dword [rsp + 0x38]
mov dword [rdx], eax
add qword [rbx + 8], 4
jmp 0x140001e3c
lea r8, [rsp + 0x38]
mov rcx, rbx
call fcn.1400020a0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140001de1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rbx
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1400243d0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x1400037b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000380d
lea rbx, [0x140026850]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400037f4
cmp r10, 2
jb 0x1400037f4
cmp byte [r9], r8b
jne 0x1400037f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400037d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000384f
lea rbx, [0x140026850]
cmp r8b, 0x23
jne 0x140003833
cmp byte [r9], r8b
jne 0x140003833
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140003820
mov rbx, qword [rsp + 8]
not eax
ret
Function at 0x140007090
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r8, [0x140026635]
mov dword [rsp + 0x2c], eax
lea r11, [0x140026850]
mov qword [rsp + 0x48], rax
mov r10d, 0xffffffff
lea rax, str.Window
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov edx, r10d
mov r9b, 0x57
nop
cmp r9b, 0x23
jne 0x1400070e3
cmp byte [r8], r9b
jne 0x1400070e3
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x1400070d0
mov ecx, dword [rbx + 0x2ecc]
lea rax, [0x1400107e0]
mov edi, dword [rbx + 0x2ec8]
not edx
mov qword [rsp + 0x30], rax
lea rax, [0x1400108b0]
mov qword [rsp + 0x38], rax
lea rax, [0x1400109a0]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x28], edx
cmp edi, ecx
jne 0x1400071e5
inc edi
test ecx, ecx
je 0x14000714f
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x140007154
mov eax, 8
cmp eax, edi
cmovg edi, eax
cmp edi, ecx
jle 0x1400071e5
mov rax, qword [0x1400309e0]
mov qword [rsp + 0x60], rsi
test rax, rax
je 0x140007178
inc dword [rax + 0x390]
movsxd rax, edi
lea rcx, [rax + rax*2]
shl rcx, 4
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, qword [rbx + 0x2ed0]
mov rsi, rax
test rdx, rdx
je 0x1400071d3
movsxd rcx, dword [rbx + 0x2ec8]
lea r8, [rcx + rcx*2]
mov rcx, rax
shl r8, 4
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2ed0]
test rcx, rcx
je 0x1400071cd
mov rax, qword [0x1400309e0]
test rax, rax
je 0x1400071cd
dec dword [rax + 0x390]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2ed0], rsi
mov rsi, qword [rsp + 0x60]
mov dword [rbx + 0x2ecc], edi
movsxd rax, dword [rbx + 0x2ec8]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x2ed0]
add rcx, rcx
movups xmmword [rax + rcx*8], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movups xmmword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x2ec8]
mov byte [rbx], 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret

Function at 0x140007cc0
Capabilities:
Hash data with crc32

Disassembly:
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140007d10
lea r11, [0x140026850]
nop dword [rax]
cmp r9b, 0x23
jne 0x140007cf3
cmp byte [r8], r9b
jne 0x140007cf3
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140007ce0
mov rcx, qword [0x1400309e0]
not eax
movsxd rdx, dword [rcx + 0x19e0]
mov r9, qword [rcx + 0x19e8]
mov r10, rdx
shl r10, 4
add r10, r9
test rdx, rdx
je 0x140007d71
nop word [rax + rax]
mov r8, rdx
shr r8, 1
mov rcx, r8
add rcx, rcx
cmp dword [r9 + rcx*8], eax
jae 0x140007d69
lea r9, [r9 + rcx*8]
mov rcx, 0xffffffffffffffff
sub rcx, r8
add r9, 0x10
add rdx, rcx
jmp 0x140007d6c
mov rdx, r8
test rdx, rdx
jne 0x140007d40
cmp r9, r10
je 0x140007d80
cmp dword [r9], eax
jne 0x140007d80
mov rax, qword [r9 + 8]
ret
xor eax, eax
ret
Function at 0x140010600
Capabilities:
Hash data with crc32

Disassembly:
push rsi
sub rsp, 0x40
xor eax, eax
mov qword [rsp + 0x50], rbx
mov rbx, qword [0x1400309e0]
mov qword [rsp + 0x60], rdi
mov rdi, rcx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov ecx, dword [rbx + 0x2edc]
mov esi, dword [rbx + 0x2ed8]
mov qword [rsp + 0x34], rax
mov dword [rsp + 0x30], eax
mov byte [rsp + 0x3c], al
cmp esi, ecx
jne 0x1400106db
inc esi
test ecx, ecx
je 0x140010658
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x14001065d
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1400106db
mov qword [rsp + 0x58], rbp
test rbx, rbx
je 0x140010676
inc dword [rbx + 0x390]
movsxd rcx, esi
shl rcx, 5
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdx, qword [rbx + 0x2ee0]
mov rbp, rax
test rdx, rdx
je 0x1400106c9
movsxd r8, dword [rbx + 0x2ed8]
mov rcx, rax
shl r8, 5
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbx + 0x2ee0]
test rcx, rcx
je 0x1400106c3
mov rax, qword [0x1400309e0]
test rax, rax
je 0x1400106c3
dec dword [rax + 0x390]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov qword [rbx + 0x2ee0], rbp
mov rbp, qword [rsp + 0x58]
mov dword [rbx + 0x2edc], esi
movsxd rcx, dword [rbx + 0x2ed8]
lea rdx, [0x1400266b4]
mov rax, qword [rbx + 0x2ee0]
movups xmm0, xmmword [rsp + 0x20]
shl rcx, 5
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rcx + rax], xmm0
movups xmmword [rcx + rax + 0x10], xmm1
movsxd rcx, dword [rbx + 0x2ed8]
mov rsi, rcx
shl rsi, 5
lea eax, [rcx + 1]
mov rcx, rdi
mov dword [rbx + 0x2ed8], eax
add rsi, qword [rbx + 0x2ee0]
call qword [sym.imp.VCRUNTIME140.dll_strstr]
test rax, rax
mov rbx, 0xffffffffffffffff
cmovne rdi, rax
nop dword [rax]
cmp byte [rdi + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x140010740
mov rax, qword [0x1400309e0]
test rax, rax
je 0x14001075d
inc dword [rax + 0x390]
lea rcx, [rbx + 1]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x50]
lea r8, [rdi + 1]
mov qword [rsi], rax
mov r10d, 0xffffffff
movzx r9d, byte [rdi]
mov edx, r10d
mov rdi, qword [rsp + 0x60]
test r9b, r9b
je 0x1400107d0
lea r11, [0x140026850]
cmp r9b, 0x23
jne 0x1400107b3
cmp byte [r8], r9b
jne 0x1400107b3
cmp byte [r8 + 1], r9b
cmove edx, r10d
movzx ecx, dl
movzx eax, r9b
movzx r9d, byte [r8]
xor rcx, rax
shr edx, 8
inc r8
xor edx, dword [r11 + rcx*4]
test r9b, r9b
jne 0x1400107a0
not edx
mov rax, rsi
mov dword [rsi + 8], edx
add rsp, 0x40
pop rsi
ret