joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14092a2b9
Capabilities:
Packed with generic packer

Disassembly:
jbe 0x140967858
neg si
sub esi, esi
add word [rsp + rsi*2 + 0x30], 0x8fa1
add qword [rsp + rsi*8], 0xffffffffbf691fa4
not word [rsp + rsi + 8]
mov rsi, qword [rsp + rsi + 0x50]
sub byte [rsp + 8], 0xba
shr word [rsp + 0x30], 0x61
jge 0x14096d073
sub dword [rsp + 0x30], 0xe30a83ab
xor dword [rsp + 8], 0x67bee91c
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret 8
sete dl
or byte [rsp + rdx*2 + 8], 0xa0
mov rdx, qword [rsp + 0x38]
ja 0x140883c2c
push rdi
add qword [rsp + rcx*2 + 0x480a8a2], 0xfffffffffffd5c73
mov rbx, qword [rsp + rcx*2 + 0x480a8aa]
mov rbx, qword [rbx + rcx + 0x2405441]
add qword [rsp + rcx + 0x2405451], rcx
mov rdi, rcx
neg qword [rsp + rcx + 0x2405451]
jo fcn.140945585
call fcn.140930df2

Function at 0x14092b4ec
Capabilities:
Encode data using base64

Disassembly:
jg 0x14095a0b0
pop rax
push r14
movabs r14, 0x13038caa9880be9c
pushfq
shl r14d, 0x95
seta r14b
and r14d, r14d
jg fcn.1408826ca
xchg qword [rsp + 0x10], rax
not r14d
sub r14d, r14d
add r14, 0xffffffffd30ca531
sub r14w, 0x4b09
mov r14, qword [rsp + r14 + 0x2cf3a5e0]
mov qword [rsp + 8], rax
push r15
push rsi
push rdx

Function at 0x140930d65
Capabilities:
Packed with generic packer

Disassembly:
neg rbx
mov r11, qword [rsp + 0x60]
ja 0x14093db35
and r8d, ebx
jg 0x14091760d
mov ah, 0xb2
dec dword es:[rbx + 0x491a86be]
mov esi, 0x6718399e
and dword [rdi - 0x55], edx
add byte [rcx - 0xa], 0xc7
and esp, dword [rsi + 0x41]
mov esi, 0x874a2287
test byte [rax + rdi*2 + 0x1d], bh
cmp esi, ebp
jl 0x14090fe19
shl byte [rsp + r11*4 + 0x18], 0xbf

Function at 0x140930dfb
Capabilities:
Packed with generic packer

Disassembly:
call fcn.1408a97e0
test r8b, r13b
push rdx
not byte [rsp + 0x38]
call fcn.14094abe6
mov rdx, qword [rdx + r11 - 0x419e0000]
and r11d, r11d
call fcn.140908b6a
mov r10w, 0xf833
jno 0x1409b0ce9
lea rbx, [rbx + r10 - 0x7665f832]
test r10, 0x171987a4
jbe 0x1409173b0
push r13
mov r13, r10
bswap r10d
mov qword [rsp + r13 - 0x7665f803], rbx
js 0x140881616
mov r13d, 0x1b3b260b
shl r10b, 9
call fcn.140901ebc
mov eax, 0xf792aa1a
out dx, al
jmp 0x1bd15c686

Function at 0x140939171
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
mov qword [rsp + rbx + 0x68], r8
shl qword [rsp + 0x68], 0xa2
jns 0x14088366b
Function at 0x140943a8a
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + rdi*2 - 0x1698], rcx
neg dil
movabs r11, 0xfda2ed3b6b8e1bb1
movabs r15, 0x792a395b894b509
not r15b
call fcn.140997564
and r12w, r12w
add dword [rsp + r12 - 0x64028af1], 0xb2b52bbe
mov r12, qword [rsp + r12 - 0x64028b19]
and byte [rsp + 0x48], 0x1c
not byte [rsp + 0x38]
mov qword [rsp + 0x38], 0x56357d85
neg word [rsp + 0x48]
jbe 0x1409b8a28
cmova si, word [rsp + rsi + 0x10c06fd7]
lea rdx, [rdx + rsi + 0x10c09042]
setl byte [rsp + rsi*2 + 0x2181209a]
sub rsi, 0xffffffffab3015ba
lea rsi, [rsi + rsi*8 - 0x6cf313ef]
add qword [rsp + 8], 0x5495f
mov qword [rsp + 0x30], rdx
call fcn.140893c86
not dil
push r15
jns 0x14088188c
invalid
mov rsi, qword [rsp + 0x30]
mov rsi, qword [rsi + r12*4 + 0x6fd0f13c]
sub bpl, 0x92
bswap rbp
neg rbp
movabs rbp, 0x66bf763a8d3a5fab
neg word [rsp + r12*4 + 0x6fd0f17c]
and bp, word [rsp + r12*2 + 0x37e878df]
mov qword [rsp + r12 + 0x1bf43c7f], r12
or qword [rsp + 0x30], 0x4e82d003
and r12d, 0x6c02ba1d
lea rsi, [rsi + r12 - 0x58d68691]
or r12w, bp
sub qword [rsp + 0x40], 0xfffffffff5183006
setbe bpl
push rsi
neg ebp
xchg qword [rsp + r12 - 0x64028ae1], rsi
mov rbp, qword [rsp + r12 - 0x64028b09]
add byte [rsp + r12 - 0x64028b01], 0x27
cmp word [rsp + r12 - 0x64028af1], 0xfbb2
jb 0x140953412
test byte [rsp + r12 - 0x64028af1], r12b
jne 0x14088917a
test byte [rsp + 0x38], 0xb8
call fcn.140895b92
cmove r12, qword [rsp + r12 + 0x136e7a04]
neg r12b
xor r12b, r12b
call fcn.1408967db
xchg esi, eax
invalid

Function at 0x140945585
Capabilities:
Packed with generic packer

Disassembly:
not esi
shr si, 0xe6
push r10
push rbx
cmp word [rsp + 0x38], di
mov r10, qword [rsp + 0x38]
xchg qword [rsp + 0x48], rbx
mov rdi, qword [rsp + 0x18]
seta sil
add qword [rsp + r10*4 - 0x6e270ac4], 0xffffffffbf678d7a
or dword [rsp + 0x38], 0x52259184
test byte [rsp + 0x28], sil
not r10w
mov r10, qword [rsp + r10*4 - 0x6e24f520]
sets byte [rsp + 0x38]
ja 0x14089632f

Function at 0x140949119
Capabilities:
Authenticate hmac

Disassembly:
add r10d, 0x218e7c21
shl r9b, 0xca
not r15
shr r10w, 0x79
sub r9w, 0x58aa
js 0x140884130
lea rsi, [rsi + 0xb2bfb80]
jl 0x1408ffdd6

Function at 0x1409533aa
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movabs rdi, 0x4cbb82ae108eb206
not rdi
not r9b
jbe 0x140923820
add qword [rsp], 0x30ffb
sub r9, 0x55212dad
setb dil
push rcx
call fcn.14092810b

Function at 0x1409533da
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
or r15b, 5
jbe 0x140940b6a
js 0x1409429cd
neg dword [rsp + r15 - 0xee87]
movsx r15d, r15b
not word [rsp + 0x20]
mov r15, qword [rsp + 0x18]
test qword [rsp + 0x20], 0x2108d682
mov qword [rsp + 0x20], 0x65a5c1be
mov qword [rsp + 0x20], 0xffffffff8021bc07
push qword [rsp + 0x28]
popfq
lea rsp, [rsp + 0x38]
ret
mov r11, qword [rsp + r15*2 - 0x1dd2c]
mov r11, qword [rsp + r15*2 - 0x1dd3c]
jne 0x14088299e

Function at 0x1409533f0
Capabilities:
Encode data using base64

Disassembly:
pushfq
add qword [rsp + 8], 0xffffffffbf77987b
mov qword [rsp + 8], 0x2dd5fb31
push qword [rsp]
popfq
lea rsp, [rsp + 8]
call fcn.1409c38a4
Function at 0x140956c78
Capabilities:
Authenticate hmac

Disassembly:
mov byte [rsp + rcx - 0x6431ffb2], 0x3d
xchg qword [rsp + rcx - 0x6431ffaa], rsi
mov rbx, qword [rsp + 8]

Function at 0x1409572c5
Capabilities:
Authenticate hmac

Disassembly:
push rdi
push r8
movabs r8, 0x708e333e8437b628
pushfq
xor r8w, 0xd23e
call fcn.14097646c
Function at 0x140968f41
Capabilities:
Encode data using base64

Disassembly:
sub word [rsp + 0x28], di
jae 0x140983bf6

Function at 0x14096a034
Capabilities:
Authenticate hmac

Disassembly:
and word [rsp + 0x18], 0xd2ad
movabs r11, 0xe93bfa86b0277f81
and dword [rsp + 0x18], 0xc9105a5
cmp qword [rsp + 0x18], 0xffffffffb520522e
lea rax, [rax + 1]
call fcn.14091110b
cmp bl, byte [rcx + 0x6f8e8f48]
cmp al, 0xe3
invalid
push rax
push 0xfffffffff0bf2c25
pushfq
or byte [rsp + 8], 0x8d
setbe byte [rsp + 8]
mov word [rsp + 8], 0xdb81
push r11
je 0x1409a9bd1
mov rax, qword [rsp + 0x20]
push r10
jle 0x140908174
mov r8, qword [rsp + 8]
lea rsp, [rsp + 0x20]
ret 8

Function at 0x14096b0dd
Capabilities:
Authenticate hmac
Encode data using base64

Disassembly:
movabs r9, 0x988e1c99908b801b
push r10
push rdi
lea rsi, [r9*4 - 0x6672fed8]

Function at 0x140974068
Capabilities:
Authenticate hmac
Encode data using base64
Packed with generic packer

Disassembly:
jne 0x1408893c6
not r9b
test r10, r10
call fcn.140949119
mov dl, 0x4e
mov dword [rdi - 0x2ed57063], 0x2331e97
invalid

Function at 0x14097b269
Capabilities:
Packed with generic packer

Disassembly:
shr dword [rsp + 0x38], 0x12
sub byte [rsp + 0x38], bpl
xchg qword [rsp + 0x58], rbx
mov rbp, qword [rsp + 0x50]
sete byte [rsp + 0x38]
mov word [rsp + 0x38], 0x2299
mov dword [rsp + 0x38], 0x658168a9
neg qword [rsp + 0x38]
ja 0x140926f05
test byte [rsp + 0x38], 0x1f
push qword [rsp + 0x48]
popfq
lea rsp, [rsp + 0x58]
ret

Function at 0x14097ca5e
Capabilities:
Check http status code
Packed with generic packer

Disassembly:
mov rax, qword [rsp + rax - 0x322]
mov rax, qword [rax]
movsx r9, r14w
je 0x1409264cd
mov qword [rsp + 0x18], r14
shr qword [rsp + 0x50], 0xf6
lea r9, [r14 + r9*4 + 0x67290008]
mov rax, qword [rsp + 0x50]
jns 0x140913d58
mov dh, 0x8c
mov ah, 0xaf
mov word [rsi], gs
xor al, ah

Function at 0x140980dfc
Capabilities:
Packed with generic packer

Disassembly:
pushfq
movabs rdx, 0x548d4c0bf2a02498
call fcn.1409a42a8
call fcn.140896b0d
mov qword [rsp], 0x2e0815e9
call fcn.1409c38a4
jo 0x140930ed2
bswap r13
jo 0x140890862
or r15w, 0xf27
call fcn.14088e5b3
push rbx
push r9
pushfq
movabs r9, 0xe719e31c00a6a5b0
add r9w, 0xcb38
call fcn.140912471
and ebp, edi
invalid
neg cl
lea rdx, [rdx + 1]
mov r9b, 0x98
push rdx
add dword [rcx - 0x4f], eax
cwde
shl r8, 0xf
mov rdi, r8
ja 0x1409aaff3
push r9
mov qword [rsp + 0x50], rdx
neg edi
xor byte [rsp], 0x1c
shr r8b, 5
sets r9b
xor r8b, 0x93
jo 0x14090b837
setbe byte [rsp]
add qword [rsp + 0x20], 0xfffffffffff94b29
or r9, rdi
call fcn.140897536
xor al, 0xc7
scasb al, byte [rdi]
mov edx, 0xafbe20b4
sbb cl, dh
add byte [rbx], bl
sbb al, 0x71
jo 0x140980dfe
invalid
Function at 0x14098ce1e
Capabilities:
Authenticate hmac

Disassembly:
push qword [rsp + 0x60]
popfq
lea rsp, [rsp + 0x70]
ret
call fcn.14098a10d
xor r14, r14
call fcn.140992f45
je 0x140987c26
and r9w, dx
xchg qword [rsp + 0x38], rax
mov r9, qword [rsp]
neg dx
sub r15w, 0x482
add edx, 0x2baf8215
movabs r10, 0xbb1d9022061bb0b2
neg r10
mov r15, qword [rsp + 0x20]
add qword [rsp + 0x10], 0xfffffffffffecc55
neg r10
neg r10
mov dx, 0x2833
or dx, dx
xor dx, 0x7f00
mov r10, qword [rsp + 8]
and rdx, 0xffffffffdc35f3b7
cmp dl, 0x13
lea rsp, [rsp + 0x10]
ret 0x10
call fcn.1408f37ce
test ch, cl
mov rcx, qword [rsp + 0x30]
mov rcx, qword [rcx]
jno 0x1409110a6
invalid
mov rcx, qword [rsp + 8]
shl dword [rsp + 8], cl
jb 0x1408fb452
call fcn.1409a88eb
pushfq
mov qword [rsp + 8], 0x2e9a5689
lea rsp, [rsp + 8]
call fcn.1409c38a4
js 0x1409253fe
or word [rsp + 0x10], 0x35b6
and dword [rsp + 0x10], 0x9cbd0f29
je 0x140996243
setno byte [rsp + 0x10]
jae 0x140899f6b
mov edx, 0x9d0d2f34
call fcn.1408956da
or qword [rsp + 8], 0xfffffffff6b5cca9
lea rbp, [rbp + 0x540a3ab1]
xor rdi, 0xffffffff8d3c8524
seto byte [rsp + 8]
mov qword [rsp + 0x20], rdi
xor byte [rsp + 8], 0xb4
neg di
xchg qword [rsp + 0x28], rbp
mov rdi, qword [rsp + 0x18]
mov byte [rsp + 0x20], 5
jbe 0x140957236
seta r15b
neg r15
lea rax, [rax - 0x67d17dee]
jno 0x140911ec2
lea rbp, [rbp + 0x479f293d]
not ebx
mov qword [rsp + 0x28], r9
sets r9b
cmp word [rsp + 0x28], r9w
push rcx
push 0xffffffffe485499b
push rbp
xchg qword [rsp + 0x60], rbp
mov r9, qword [rsp + 0x48]
jno 0x14098ce0a
invalid

Function at 0x14099295f
Capabilities:
Packed with generic packer

Disassembly:
lea rsp, [rsp + 0x28]
call fcn.1409c38a4

Function at 0x1409951de
Capabilities:
Check http status code
Packed with generic packer

Disassembly:
add qword [rsp + 0x10], 0xffffffffbf64dbd6
neg qword [rsp + 0x38]
shr byte [rsp + 0x38], 0x97
add dword [rsp + 0x38], 0x3d86e0a6
not qword [rsp + 0x38]
push qword [rsp + 0x40]
popfq
lea rsp, [rsp + 0x48]
ret
ret
test r13, r13
mov r15, qword [rsp + 0x28]
mov r13d, 0x33a6cf88
js 0x14092dc3e
sub r13b, r13b
setle r13b
call fcn.14093cba8
or bp, 0xa02e
xchg qword [rsp + 0x50], rcx
mov rbp, qword [rsp + r15*4 - 0x58e23058]
neg r15d
xor r15b, 0x1f
js 0x140945565
and qword [rsp + 0x38], 0xfffffffffc3540bd
xor r9w, word [rsp + 0x3d]
shr dword [rsp + 0x38], cl
jb 0x140934f1b
mov r9, qword [rsp + 0x18]
xor rcx, rcx
setl cl
test rcx, rcx
mov rcx, qword [rsp + rcx*2 + 0x20]
jbe 0x14088c5c0
invalid
ja 0x140904384
lea r13, [rbp + r13*4 + 0x5a308b34]
jo 0x140975699

Function at 0x14099520b
Capabilities:
Check http status code
Packed with generic packer

Disassembly:
lea rdi, [rdi + 1]
push rbx
call fcn.1409534ac

Function at 0x1409992c9
Capabilities:
Authenticate hmac

Disassembly:
push r8
shl bx, cl
je 0x1409278be
Function at 0x1409aac27
Capabilities:
Encode data using xor

Disassembly:
cmovae rbp, qword [rsp + rcx + 0x30]
shl byte [rsp + r15*2 + 0x30], 0x37
not word [rsp + r15 + 0x18]
lea rdx, [rdx + rbp*2 + 0x1db0a2b1]
cmp rcx, r15
not dword [rsp + rcx + 0x30]
call fcn.1408f8268
shr word [rsp + rdx - 0x79b7d076], 8
sub r15w, 0x4f17
mov rcx, rbp
push rdx
movsxd r15, dword [rsp + rdx - 0x79b7d06e]
mov rdx, qword [rsp + rbp*2 + 0x30]
mov rdx, qword [rdx + rbp]
mov qword [rsp + r15 + 0x30], rbp
test r15d, 0x2e8334b5
jns 0x14088fdd8
push r15
xchg qword [rsp + 0x18], rdx
pushfq
movabs r15, 0xc5075e8f2322b18a
sub r15b, 0x12
sub r15d, r15d
cmp r15b, 0x28
push r15
seto r15b
add qword [rsp + r15*8 + 0x20], 0xffffffffbf701e6c
mov qword [rsp + 0x20], rdx
push rbp
add qword [rsp + r15 + 0x20], 0xffffffffffff63f9
shr word [rsp + r15 + 8], 0xa4
or r15, r15
mov rbp, qword [rsp + r15*2 + 8]
push rcx
nop
mov rdx, r15
lea rdx, [rbp*2 + 0x79b7d086]
jle 0x140919ab1
mov dh, 0x7f
sub dword cs:[rax + 0x15e4f269], ebx
js 0x1409aad14
mov esi, 0x43153eaf
shr byte [rdi - 0x47c2cf0a], cl
in al, 0x3c
movabs al, byte ds:[0xaaebbd06d13d79e1]
invalid
sal byte [rcx + 0x47a184e8], cl
mov esi, 0x15238b94
mov al, 0x16
fcomp st(1)
sbb dword [rdx], ebx
lodsd eax, dword [rsi]
sbb byte [rsi + 6], ah
outsd dx, dword [rsi]
test eax, 0xccff49b3
pushfq
add eax, 0xaac8cf44
xor eax, 0x8513a386
or byte [rax + 0x45], bh
push rsi
fstp st(4)
ror eax, 0xaa
xor eax, 0x8513a386
invalid
adc eax, 0x1e22f4e0
ja 0x1409aad67
and dword [rbx + 0x6ab8c658], 0xffffff87
movabs dword [0x94a30388a7008513], eax
push rdx
or bl, byte [0xc81109c7]
movabs dword [0xc161b4a7eada8513], eax
xchg ebp, eax
pop rsp
jbe 0x1409aacc7
movabs dword [0x54c85cdf9e738513], eax
ret 0x283b
xchg byte [rbx + 0x283b8513], ah
adc al, al
sub ebx, dword [rax + 0xd]
invalid

Function at 0x1409b0ca0
Capabilities:
Encode data using xor

Disassembly:
push r9
pushfq
movabs r9, 0xe1348cb39b3e559e
push rcx
xor r9w, r9w
mov rcx, r9
bswap r9
mov qword [rsp + 0x20], 0x2dd45e31
mov r9, qword [rsp + 0x10]
xor rcx, 0xfffffffff11f84bd
not cl
mov rcx, qword [rsp]
jbe 0x1409b0cc6
push qword [rsp + 8]
popfq
lea rsp, [rsp + 0x20]
call fcn.1409c38a4

Function at 0x1409bd45a
Capabilities:
Encode data using xor

Disassembly:
not r14w
movabs r14, 0x6328428ecf3e8abc
sub rbx, 0x3c0d7317
lea rax, [rax + rbx + 0x54f1c702]
mov rbp, rdx
cmp rbx, 0x1a928e28
setne dl
jl 0x14094e6a8
Function at 0x1413ef7a7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
test si, 0xa9a6
add rbx, rcx
mov qword [rsp + 0x10], rdi
xor edi, edi
inc r10b
movzx ebx, r8b
mov r8b, 0x2a
movsx r9d, r13w
mov r11, rcx
not r8d
bswap r8w
mov r8, rdi
setle r10b
nop
movzx r9d, byte [r11]
xchg r10, r10
movzx r10d, byte [rdx]
inc r11
inc rdx
test bl, bl
jmp 0x1413ef7f3
je 0x1413ef826
mov ecx, r8d
cbw
mov eax, 0x76312d8e
cmc
stc
rol eax, cl
cmc
test r13, r15
add al, r8b
cmp edi, r11d
jmp 0x1413ef816
xor r9b, al
jmp 0x1413ef81e
inc r8
test r8w, r10w
clc
test r9b, r9b
jmp 0x1413ef82e
je 0x1413ef83d
cmp r9b, r10b
je 0x1413ef7db
cmp r9b, r10b
jae 0x1413ef858
or eax, 0xffffffff
movsx rbx, r10w
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
ret
mov rbx, qword [rsp + 8]
lahf
seta dil
movzx rax, dx
cmovnp ax, dx
mov eax, edi
movsx di, r10b
xchg dil, dil
movzx di, r15b
mov rdi, qword [rsp + 0x10]
jmp 0x1413ef883
ret
Function at 0x14001127b
Capabilities:
Terminate process

Disassembly:
jmp 0x140015050
mov qword [rsp + 8], rcx
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x28
ret

Function at 0x140011334
Capabilities:
Parse pe header

Disassembly:
jmp 0x1400163a0
sub rsp, 0x38
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
jne 0x1400163c0
xor al, al
jmp 0x140016441
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1400163d3
xor al, al
jmp 0x140016441
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
cmp dword [rax], 0x4550
je 0x1400163fd
xor al, al
jmp 0x140016441
mov rax, qword [rsp + 0x28]
movzx eax, word [rax + 0x18]
cmp eax, 0x20b
je 0x140016411
xor al, al
jmp 0x140016441
mov rax, qword [rsp + 0x28]
cmp dword [rax + 0x84], 0xe
ja 0x140016423
xor al, al
jmp 0x140016441
mov eax, 8
imul rax, rax, 0xe
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x88], 0
jne 0x14001643f
xor al, al
jmp 0x140016441
mov al, 1
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Enumerate process modules
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x6c0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rsp + 0x6b0], rax
mov rdi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x238
call fcn.140001f50
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x14000104e
xor al, al
jmp 0x140001192
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rsi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001187
mov qword [rsp + 0x6d8], rbx
nop dword [rax]
nop word [rax + rax]
xor edx, edx
lea rcx, [rsp + 0x270]
mov r8d, 0x438
call fcn.140001f50
mov edx, dword [rsp + 0x38]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000116a
lea rdx, [rsp + 0x270]
mov dword [rsp + 0x270], 0x438
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
test eax, eax
je 0x140001161
nop dword [rax]
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x2a0]
call fcn.140002948
mov rcx, rbx
test eax, eax
je 0x14000110a
lea rdx, [rsp + 0x270]
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1400010e0
jmp 0x140001161
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
jne 0x140001144
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1f0fff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14000116a
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x140001161
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rsi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140001080
mov rbx, qword [rsp + 0x6d8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x6b0]
xor rcx, rsp
call fcn.1400012d0
mov rsi, qword [rsp + 0x6e0]
add rsp, 0x6c0
pop rdi
ret
Function at 0x140001330
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x290
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov rsi, rcx
mov dword [rsp + 0x30], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov ebp, 0xffffffff
cmp eax, 1
jne 0x14000147d
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x14000147d
xor r14d, r14d
mov ecx, 0x18
call fcn.140003958
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x1400013ed
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rax
mov qword [rbx + 8], r14
mov dword [rbx + 0x10], 1
lea rcx, [rsp + 0x5c]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x140001548
jmp 0x1400013f0
mov rbx, r14
mov qword [rsp + 0x278], rbx
test rbx, rbx
je 0x14000153d
mov rax, qword [rbx + 8]
test rax, rax
jne 0x140001416
mov rcx, qword [rbx]
call fcn.1400045d0
mov qword [rbx + 8], rax
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x1400014b0
mov eax, ebp
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140001466
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001447
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001459
call fcn.140003950
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003950
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1400013a6
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebp
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.140003930
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
mov r8d, dword [rsp + 0x38]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
lea rdx, [rsp + 0x270]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
cmp dword [rsp + 0x270], 0
je 0x1400014e7
mov edi, 0xfffffffe
jmp 0x1400014fc
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcessId]
mov edi, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lock xadd dword [rbx + 0x10], ebp
cmp ebp, 1
jne 0x140001536
mov rcx, qword [rbx]
test rcx, rcx
je 0x140001517
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140001529
call fcn.140003950
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140003950
mov eax, edi
jmp 0x140001488
mov ecx, 0x8007000e
call fcn.1400045c0
nop
mov ecx, 0x8007000e
call fcn.1400045c0
int3
Function at 0x140001d90
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x140008008]
xor rax, rsp
mov qword [rsp + 0x28], rax
xor edi, edi
mov rbx, rcx
cmp byte [rcx + 8], dil
jne 0x140001dbe
mov edx, dword [rcx + 0xc]
jmp 0x140001dc0
mov edx, edi
lea rcx, str.Loaded_PE_File_at:__t0x_X_n
call fcn.140001030
cmp byte [rbx + 8], dil
jne 0x140001dd7
mov edx, dword [rbx + 0x10]
jmp 0x140001dd9
mov edx, edi
lea rcx, str.Size:__t_t_t0x_X_n
call fcn.140001030
mov word [rsp + 0x20], 0x5a4d
mov word [rsp + 0x24], 0x4550
cmp byte [rbx + 8], dil
jne 0x140001e04
mov eax, dword [rbx + 0xc]
mov ecx, dword [rax + 0x3c]
add ecx, dword [rbx + 0xc]
jmp 0x140001e06
mov ecx, edi
movzx eax, word [rsp + 0x20]
cmp ax, word [rbx + 0xc]
je 0x140001e1c
cmp word [rsp + 0x24], cx
je 0x140001e1c
mov al, 1
jmp 0x140001e1e
xor al, al
test al, al
lea rcx, str.True
lea rdx, str.False
cmovne rdx, rcx
lea rcx, str.Valid_PE_File:__t_t_s_n
call fcn.140001030
cmp byte [rbx + 8], dil
jne 0x140001e5d
mov eax, dword [rbx + 0xc]
mov ecx, dword [rax + 0x3c]
add ecx, dword [rbx + 0xc]
movzx ecx, word [rcx + 6]
lea eax, [rcx + rcx*4]
lea edx, [rax*8 - 0x28]
jmp 0x140001e5f
mov edx, edi
lea rcx, str.Sectiontable_Size:__t0x_X_n
call fcn.140001030
cmp byte [rbx + 8], dil
jne 0x140001e80
mov eax, dword [rbx + 0xc]
mov ecx, dword [rax + 0x3c]
add ecx, dword [rbx + 0xc]
movzx ecx, word [rcx + 6]
jmp 0x140001e83
mov rcx, rdi
mov eax, 0x28
mov rsi, 0xffffffffffffffff
mul rcx
cmovo rax, rsi
mov rcx, rax
call fcn.14000399c
cmp byte [rbx + 8], dil
jne 0x140001ef0
mov ecx, dword [rbx + 0xc]
mov eax, 0x28
mov edx, dword [rcx + 0x3c]
add edx, dword [rbx + 0xc]
movzx edx, word [rdx + 6]
mul rdx
cmovo rax, rsi
mov rcx, rax
call fcn.14000399c
cmp byte [rbx + 8], dil
jne 0x140001eea
mov eax, dword [rbx + 0xc]
mov edx, dword [rax + 0x3c]
mov eax, dword [rbx + 0xc]
add edx, dword [rbx + 0xc]
mov ecx, dword [rax + 0x3c]
add ecx, dword [rbx + 0xc]
lea eax, [rdx + 0x18]
movzx ecx, word [rcx + 0x14]
add eax, ecx
mov esi, eax
jmp 0x140001ef3
mov eax, edi
mov esi, eax
jmp 0x140001ef3
mov rsi, rdi
mov rcx, rbx
call fcn.140001d70
test eax, eax
je 0x140001f27
nop
movsxd rax, edi
mov edx, edi
lea rcx, [rax + rax*4]
lea r8, [rsi + rcx*8]
lea rcx, str.Section__d:__t_t_s_n
call fcn.140001030
mov rcx, rbx
inc edi
call fcn.140001d70
cmp edi, eax
jb 0x140001f00
lea rcx, [0x1400056b4]
call fcn.140001030
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.140003930
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret