joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400261e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d55f4], 1
je 0x140026243
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x35
mov rdx, rsi
jne 0x140026200
mov dword [0x1400d55f4], 1
mov eax, 0xcca76a77
pop rsi
ret

Function at 0x1400266e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d555c], 1
je 0x140026759
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2a
mov r9, rax
jne 0x140026710
mov dword [0x1400d555c], 1
mov eax, 0x63f61cd
pop rsi
ret

Function at 0x140026f30
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d5584], 1
je 0x140026f97
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe7
movzx edx, byte [r8 + r9 + 0x19]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x24
jne 0x140026f50
mov dword [0x1400d5584], 1
mov eax, 0xced9a193
ret

Function at 0x1400270a0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d55a0], 1
je 0x1400270fd
mov r8, rdx
movabs r10, 0xd79435e50d79435f
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffed
movzx edx, byte [r8 + r9 + 0x13]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x16
jne 0x1400270c0
mov dword [0x1400d55a0], 1
mov eax, 0xeb1aceae
ret

Function at 0x140027110
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d55c0], 1
je 0x14002716d
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 2
mov eax, edx
imul eax, edx, 0xffffffea
movzx edx, byte [r8 + r9 + 0x16]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x19
jne 0x140027130
mov dword [0x1400d55c0], 1
mov eax, 0x8296b481
ret
Function at 0x1400278d0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5544], 1
je 0x140027940
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x2d
mov rax, rsi
jne 0x140027900
mov dword [0x1400d5544], 1
mov eax, 0xb8fe9480
pop rsi
ret

Function at 0x140027950
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d5518], 1
je 0x1400279b7
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe9
movzx edx, byte [r8 + r9 + 0x17]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x18
jne 0x140027970
mov dword [0x1400d5518], 1
mov eax, 0xeab2d8d8
ret

Function at 0x140027db0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d3eac], 1
je 0x140027e05
xor eax, eax
nop dword [rax + rax]
mov r8d, eax
mov r9d, eax
imul r9, r9, 0x51eb851f
shr r9, 0x23
imul r9d, r9d, 0xffffffe7
movzx r10d, byte [rdx + rax + 0x19]
add r9d, eax
movsxd r8, r9d
xor r10b, byte [rdx + r8]
mov byte [rcx + rax], r10b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x556
jne 0x140027dc0
mov dword [0x1400d3eac], 1
mov eax, 0xe93af2f2
ret

Function at 0x140027e10
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d3ed4], 1
je 0x140027e71
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
nop dword [rax + rax]
mov r10, rax
shr rax, 2
mul r9
shr rdx, 1
mov eax, edx
imul eax, edx, 0xffffffe4
movzx edx, byte [r8 + r10 + 0x1c]
mov r11d, r10d
add eax, r10d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r10], dl
inc r10
mov rax, r10
mov edx, r10d
cmp r10d, 0x22
jne 0x140027e30
mov dword [0x1400d3ed4], 1
mov eax, 0x2eec69ef
ret

Function at 0x140028030
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d45c4], 1
je 0x140028082
xor eax, eax
nop dword [rax + rax]
mov r8d, eax
mov r9d, eax
imul r9, r9, 0x51eb851f
shr r9, 0x23
imul r9d, r9d, 0xffffffe7
movzx r10d, byte [rdx + rax + 0x19]
add r9d, eax
movsxd r8, r9d
xor r10b, byte [rdx + r8]
mov byte [rcx + rax], r10b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x3f
jne 0x140028040
mov dword [0x1400d45c4], 1
mov eax, 0x9b471f77
ret

Function at 0x140028210
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3414], 1
je 0x14002828f
mov r8, rdx
movabs r10, 0x842108421084211
xor r9d, r9d
mov r11, rdx
mov esi, 0x1f
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
mov rdx, r9
shl r9, 5
sub rdx, r9
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1f], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x30
mov r9, rax
jne 0x140028240
mov dword [0x1400d3414], 1
mov eax, 0xc9e3aa0e
pop rsi
ret
Function at 0x1400282a0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d3420], 1
je 0x140028303
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
mov eax, 0x1b
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe5
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1b], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x21
mov rdx, rsi
jne 0x1400282c0
mov dword [0x1400d3420], 1
mov eax, 0x75e8990a
pop rsi
ret
Function at 0x140029710
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d4208], 1
je 0x140029773
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
mov eax, 0x1e
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 4
imul rax, rdx, 0xffffffffffffffe2
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x1e], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x26
mov rdx, rsi
jne 0x140029730
mov dword [0x1400d4208], 1
mov eax, 0x241e5f70
pop rsi
ret

Function at 0x1400298a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d5820], 1
je 0x140029919
mov r8, rdx
movabs r10, 0x47ae147ae147ae15
xor r9d, r9d
mov r11, rdx
mov esi, 0x19
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe7
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x19], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x2e
mov r9, rax
jne 0x1400298d0
mov dword [0x1400d5820], 1
mov eax, 0xc27557ee
pop rsi
ret
Function at 0x14002a120
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x150
mov rsi, rcx
mov dword [rsp + 0x34], 0x104
lea rdi, [0x1400d3400]
lea rdx, [0x140030de9]
mov rcx, rdi
call fcn.140028210
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002a1c8
mov rdi, qword [rsp + 0x38]
lea rbx, [0x1400d3418]
lea rdx, [0x140030e35]
mov rcx, rbx
call fcn.1400282a0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14002a1f0
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rax, rsi
add rsp, 0x150
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002a2ae
mov rdi, rax
mov rbx, rax
cmp rax, 0xf
ja 0x14002a23d
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
mov byte [rdi], 0
jmp 0x14002a1de
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp rax, 0xfff
jb 0x14002a27c
lea rcx, [r15 + 0x28]
call fcn.14002e328
test rax, rax
je 0x14002a2b3
mov rcx, rax
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14002a288
lea rcx, [r15 + 1]
call fcn.14002e328
mov r14, rax
mov qword [rsi], r14
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r15
lea rdx, [rsp + 0x40]
mov rcx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
jmp 0x14002a1de
call fcn.1400030d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14002a2c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d37fc], 1
je 0x14002a339
mov r8, rdx
movabs r10, 0x1a7b9611a7b9611b
xor r9d, r9d
mov r11, rdx
mov esi, 0x1d
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffe3
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x1d], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x25
mov r9, rax
jne 0x14002a2f0
mov dword [0x1400d37fc], 1
mov eax, 0x6efde4ed
pop rsi
ret
Function at 0x14002a340
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d5844], 1
je 0x14002a3a7
mov r8, rdx
movabs r10, 0x642c8590b21642c9
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 4
imul eax, eax, 0xffffffe9
movzx edx, byte [r8 + r9 + 0x17]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1e
jne 0x14002a360
mov dword [0x1400d5844], 1
mov eax, 0xa9567a55
ret

Function at 0x14002a590
Capabilities:
Query or enumerate registry value

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x140
mov rsi, rcx
mov dword [rsp + 0x34], 0x100
lea rdi, [0x1400d344c]
lea rdx, [0x140030f15]
mov rcx, rdi
call fcn.14000d570
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14002a638
mov rdi, qword [rsp + 0x38]
lea rbx, [0x1400d3464]
lea rdx, [0x140030f59]
mov rcx, rbx
call fcn.14000d5e0
lea rax, [rsp + 0x34]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov rcx, rdi
mov rdx, rbx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
je 0x14002a660
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
mov qword [rsi + 0x10], 0
mov qword [rsi + 0x18], 0xf
mov rax, rsi
add rsp, 0x140
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xorps xmm0, xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi], xmm0
lea rcx, [rsp + 0x40]
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002a71e
mov rdi, rax
mov rbx, rax
cmp rax, 0xf
ja 0x14002a6ad
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 0xf
lea rdx, [rsp + 0x40]
mov rcx, rsi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, rsi
mov byte [rdi], 0
jmp 0x14002a64e
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp rax, 0xfff
jb 0x14002a6ec
lea rcx, [r15 + 0x28]
call fcn.14002e328
test rax, rax
je 0x14002a723
mov rcx, rax
mov r14, rax
add r14, 0x27
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14002a6f8
lea rcx, [r15 + 1]
call fcn.14002e328
mov r14, rax
mov qword [rsi], r14
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r15
lea rdx, [rsp + 0x40]
mov rcx, r14
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
add rdi, r14
mov byte [rdi], 0
jmp 0x14002a64e
call fcn.1400030d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x14002aff0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d37f0], 1
je 0x14002b02e
xor eax, eax
nop dword [rax + rax]
movzx r8d, byte [rdx + rax + 0x10]
mov r9d, eax
and r9d, 0xf
xor r8b, byte [rdx + r9]
mov byte [rcx + rax], r8b
mov r8, rax
inc r8
mov rax, r8
cmp r8d, 0x19
jne 0x14002b000
mov dword [0x1400d37f0], 1
mov eax, 0x62ccff5e
ret
Function at 0x14002b040
Capabilities:
Set registry value

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x68
mov rsi, rcx
mov rax, qword [0x140041040]
xor rax, rsp
mov qword [rsp + 0x60], rax
lea rdi, [0x1400d3400]
lea rdx, [0x140030de9]
mov rcx, rdi
call fcn.140028210
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], 0
mov rcx, 0xffffffff80000001
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x14002b108
lea rsi, [0x1400d3418]
lea rdx, [0x140030e35]
mov rcx, rsi
call fcn.1400282a0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov rdx, rsi
call fcn.14000bc20
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::put_char____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::flush_void____ptr64]
jmp 0x14002b15e
mov ebx, dword [rsi + 0x10]
inc ebx
cmp qword [rsi + 0x18], 0x10
jb 0x14002b117
mov rsi, qword [rsi]
mov r14, rsi
mov rsi, qword [rsp + 0x58]
lea rdi, [0x1400d3418]
lea rdx, [0x140030e35]
mov rcx, rdi
call fcn.1400282a0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], r14
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.14002ebc0
nop
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r14
ret

Function at 0x14002b180
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d3528], 1
je 0x14002b1dd
mov r8, rdx
movabs r10, 0x4ec4ec4ec4ec4ec5
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 3
mov eax, edx
imul eax, edx, 0xffffffe6
movzx edx, byte [r8 + r9 + 0x1a]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x24
jne 0x14002b1a0
mov dword [0x1400d3528], 1
mov eax, 0x7cbabad5
ret

Function at 0x14002b1f0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d353c], 1
je 0x14002b264
mov r8, rdx
movabs r10, 0xf0f0f0f0f0f0f0f1
xor r9d, r9d
mov r11, rdx
mov eax, 0x11
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
mov rax, r9
mul r10
mov rax, rdx
shr rdx, 4
and rax, 0xfffffffffffffff0
add rax, rdx
neg rax
movzx edx, byte [r8 + rsi]
xor dl, byte [r11 + rax]
mov byte [rcx + rsi - 0x11], dl
inc rsi
mov rax, rsi
mov edx, esi
inc r11
inc r9
cmp esi, 0x1e
jne 0x14002b220
mov dword [0x1400d353c], 1
mov eax, 0x96f27f21
pop rsi
ret
Function at 0x14002b270
Capabilities:
Enumerate processes

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x198
movups xmmword [rsp + 0x180], xmm6
mov rdi, rcx
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
cmp rax, 0xffffffffffffffff
je 0x14002b470
mov rsi, rax
mov dword [rsp + 0x50], 0x130
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14002b46c
lea rbx, [rsp + 0x7c]
xorps xmm6, xmm6
lea r14, [rsp + 0x20]
lea r15, [rsp + 0x50]
mov qword [rsp + 0x48], rdi
nop dword [rax + rax]
movups xmmword [rsp + 0x30], xmm6
movups xmmword [rsp + 0x20], xmm6
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strlen
test rax, rax
js 0x14002b49f
mov r12, rax
mov r13, rax
cmp rax, 0xf
ja 0x14002b330
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], 0xf
mov rcx, r14
mov rdx, rbx
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + r12]
add rax, 0x20
jmp 0x14002b3bd
mov rdi, rsi
mov rsi, r14
mov r14, r15
mov rax, r12
or rax, 0xf
cmp rax, 0x17
mov r15d, 0x16
cmovae r15, rax
cmp rax, 0xfff
jb 0x14002b380
lea rcx, [r15 + 0x28]
call fcn.14002e328
test rax, rax
je 0x14002b4a4
mov rcx, rax
mov rbp, rax
add rbp, 0x27
and rbp, 0xffffffffffffffe0
mov qword [rbp - 8], rax
jmp 0x14002b38c
lea rcx, [r15 + 1]
call fcn.14002e328
mov rbp, rax
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r15
mov rcx, rbp
mov rdx, rbx
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
add r12, rbp
mov rax, r12
mov r15, r14
mov r14, rsi
mov rsi, rdi
mov rdi, qword [rsp + 0x48]
mov byte [rax], 0
mov r8, qword [rdi + 0x10]
mov r12, qword [rsp + 0x38]
cmp qword [rsp + 0x30], r8
jne 0x14002b400
mov rcx, r14
cmp r12, 0x10
jb 0x14002b3de
mov rcx, qword [rsp + 0x20]
cmp qword [rdi + 0x18], 0x10
mov rdx, rdi
jb 0x14002b3eb
mov rdx, qword [rdi]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
sete al
jmp 0x14002b402
xor eax, eax
mov ebp, eax
cmp r12, 0x10
jb 0x14002b43d
mov rcx, qword [rsp + 0x20]
lea rdx, [r12 + 1]
cmp rdx, 0x1000
jb 0x14002b438
mov rax, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, rax
cmp rcx, 0x20
jae 0x14002b4a4
add r12, 0x28
mov rdx, r12
mov rcx, rax
call fcn.14002e36c
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
test bpl, bpl
jne 0x14002b474
mov rcx, rsi
mov rdx, r15
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14002b2e0
xor eax, eax
jmp 0x14002b476
xor eax, eax
jmp 0x14002b483
mov al, 1
mov ebx, eax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
movups xmm6, xmmword [rsp + 0x180]
add rsp, 0x198
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400030d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14002b4b0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d5804], 1
je 0x14002b511
mov r8, rdx
movabs r10, 0xaaaaaaaaaaaaaaab
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
shl eax, 3
lea eax, [rax + rax*2]
movzx edx, byte [r8 + r9 + 0x18]
mov r11d, r9d
sub r11d, eax
movsxd rax, r11d
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x1d
jne 0x14002b4d0
mov dword [0x1400d5804], 1
mov eax, 0x5da064f
ret

Function at 0x14002b650
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d34a4], 1
je 0x14002b6ad
mov r8, rdx
movabs r10, 0x97b425ed097b425f
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffe5
movzx edx, byte [r8 + r9 + 0x1b]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x28
jne 0x14002b670
mov dword [0x1400d34a4], 1
mov eax, 0x97313605
ret

Function at 0x14002b6c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d34b0], 1
je 0x14002b739
mov r8, rdx
movabs r10, 0x8618618618618619
xor r9d, r9d
mov r11, rdx
mov esi, 0x15
nop word cs:[rax + rax]
nop dword [rax]
mov rax, r9
mul r10
mov rax, r9
sub r9, rdx
shr r9, 1
add r9, rdx
shr r9, 4
imul rdx, r9, 0xffffffffffffffeb
movzx r9d, byte [r8 + rsi]
xor r9b, byte [r11 + rdx]
mov byte [rcx + rsi - 0x15], r9b
mov rdx, rsi
inc rdx
mov rsi, rdx
inc r11
inc rax
cmp edx, 0x1b
mov r9, rax
jne 0x14002b6f0
mov dword [0x1400d34b0], 1
mov eax, 0x86d14d59
pop rsi
ret

Function at 0x14002b7b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d34c4], 1
je 0x14002b813
mov r8, rdx
movabs r10, 0x2e8ba2e8ba2e8ba3
xor r9d, r9d
mov eax, 0x16
nop
mov r11, rax
mov rsi, rdx
mov rax, r9
mul r10
shr rdx, 2
imul rax, rdx, 0xffffffffffffffea
movzx edx, byte [r8 + r11]
xor dl, byte [rsi + rax]
mov byte [rcx + r11 - 0x16], dl
inc r11
mov rax, r11
mov edx, r11d
inc rsi
inc r9
cmp r11d, 0x25
mov rdx, rsi
jne 0x14002b7d0
mov dword [0x1400d34c4], 1
mov eax, 0xc6b0dbd3
pop rsi
ret

Function at 0x14002b820
Capabilities:
Encode data using xor

Disassembly:
push rsi
cmp dword [0x1400d34dc], 1
je 0x14002b890
mov r8, rdx
movabs r9, 0x4924924924924925
xor eax, eax
mov r10, rdx
mov r11d, 0x1c
nop word cs:[rax + rax]
nop dword [rax]
mov rsi, rax
shr rax, 2
mul r9
shr rdx, 1
imul rax, rdx, 0xffffffffffffffe4
movzx edx, byte [r8 + r11]
xor dl, byte [r10 + rax]
mov byte [rcx + r11 - 0x1c], dl
mov rax, r11
inc rax
mov r11, rax
inc r10
inc rsi
cmp eax, 0x2f
mov rax, rsi
jne 0x14002b850
mov dword [0x1400d34dc], 1
mov eax, 0x4dabddf2
pop rsi
ret

Function at 0x14002b8a0
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x1400d3500], 1
je 0x14002b8fd
mov r8, rdx
movabs r10, 0x8888888888888889
xor r9d, r9d
nop dword [rax]
mov rax, r9
mul r10
shr rdx, 4
mov eax, edx
imul eax, edx, 0xffffffe2
movzx edx, byte [r8 + r9 + 0x1e]
mov r11d, r9d
add eax, r9d
cdqe
xor dl, byte [r8 + rax]
mov byte [rcx + r9], dl
mov rax, r9
inc rax
mov r9, rax
cmp eax, 0x20
jne 0x14002b8c0
mov dword [0x1400d3500], 1
mov eax, 0xc24994fd
ret