joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10033939
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov eax, 0
mov dword [rbp - 0x10], eax
mov eax, 1
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x10]
add rax, 0x520
mov ecx, dword [rbp - 0xc]
mov eax, dword [rax]
cmp ecx, eax
jge 0x10033a69
jmp 0x1003397f
mov eax, dword [rbp - 0xc]
mov ecx, eax
add eax, 1
mov dword [rbp - 0xc], eax
jmp 0x10033955
mov rax, qword [rbp + 0x10]
add rax, 0x518
mov ecx, dword [rbp - 0xc]
movsxd rcx, ecx
shl rcx, 2
mov rdx, qword [rbp + 0x20]
add rdx, rcx
mov edx, dword [rdx]
movsxd rdx, edx
shl rdx, 3
mov rax, qword [rax]
add rax, rdx
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
add rax, 0x28
mov eax, dword [rax]
cmp eax, 8
je 0x10033a64
mov rax, qword [rbp - 8]
add rax, 0x2c
mov eax, dword [rax]
and eax, 2
cmp eax, 0
je 0x10033a64
mov rax, qword [rbp - 8]
add rax, 0x48
mov ecx, dword [rbp - 0x10]
mov eax, dword [rax]
cmp ecx, eax
jae 0x10033a16
mov rax, qword [rbp + 0x18]
mov r11, rax
mov eax, 0
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fputc
mov eax, dword [rbp - 0x10]
mov ecx, eax
add eax, 1
mov dword [rbp - 0x10], eax
jmp 0x100339da
mov rax, qword [rbp - 8]
add rax, 0x3c
mov eax, dword [rax]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
add rax, 8
mov ecx, dword [rbp - 0x14]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x18]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rax, qword [rax]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
mov eax, dword [rbp - 0x10]
mov ecx, dword [rbp - 0x14]
add eax, ecx
mov dword [rbp - 0x10], eax
jmp 0x10033972
mov eax, 0
leave
ret

Function at 0x10033f1d
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 0x10]
sub rax, rcx
shl rax, 0x20
shr rax, 0x20
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
movsxd rax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
jge 0x10033f96
mov rax, qword [rbp - 0x18]
jmp 0x10033fd0
mov rax, qword [rbp - 0x18]
cmp rax, 0
jne 0x10033fad
mov rax, qword [rbp - 0x10]
jmp 0x10033fd0
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
add rax, rcx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
jmp 0x10033f4a
leave
ret
Function at 0x10033f28
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
mov qword [rbp - 8], rax
movabs rax, 0
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 0x10]
sub rax, rcx
shl rax, 0x20
shr rax, 0x20
mov r8, rax
mov rax, qword [rbp - 8]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
movsxd rax, eax
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
cmp rax, 0
jge 0x10033f96
mov rax, qword [rbp - 0x18]
jmp 0x10033fd0
mov rax, qword [rbp - 0x18]
cmp rax, 0
jne 0x10033fad
mov rax, qword [rbp - 0x10]
jmp 0x10033fd0
mov rax, qword [rbp - 0x10]
mov rcx, qword [rbp - 0x18]
add rax, rcx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
jmp 0x10033f4a
leave
ret
Function at 0x1004396c
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x20]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rcx, qword [rbp + 0x10]
mov r10, rcx
mov qword [rbp - 0x20], rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
shl rax, 0x20
shr rax, 0x20
mov dword [rbp - 0x10], eax
mov rcx, qword [rbp - 0x20]
mov ecx, dword [rcx]
add ecx, eax
mov rax, qword [rbp - 0x20]
mov dword [rax], ecx
mov rax, qword [rbp + 0x20]
add rax, 8
mov eax, dword [rax]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0
jle 0x10043a60
jmp 0x10043a11
mov eax, dword [rbp - 0x14]
sub eax, 2
mov dword [rbp - 0x14], eax
jmp 0x100439f5
mov eax, dword [rbp - 0x14]
cmp eax, 2
jl 0x10043a31
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 2
mov qword [rbp - 8], rax
jmp 0x10043a3d
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
jmp 0x10043a42
movzx ecx, word [rcx]
mov eax, ecx
mov ecx, dword [rbp - 0xc]
add ecx, eax
mov dword [rbp - 0xc], ecx
mov eax, dword [rbp - 0xc]
shr eax, 0x10
mov ecx, dword [rbp - 0xc]
add ecx, eax
and ecx, 0xffff
mov dword [rbp - 0xc], ecx
jmp 0x10043a06
mov rax, qword [rbp + 0x20]
add rax, 8
mov ecx, dword [rbp - 0xc]
mov dword [rax], ecx
mov eax, dword [rbp + 0x18]
mov ecx, dword [rbp - 0x10]
cmp eax, ecx
jne 0x10043a80
jmp 0x10043a8a
mov eax, 0xffffffff
jmp 0x10043a8f
mov eax, 0
leave
ret
Function at 0x10043977
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x20]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
movsxd rcx, ecx
mov rdx, qword [rbp + 0x20]
mov rdx, qword [rdx]
mov r9, rdx
mov r8, rcx
movabs rcx, 1
mov r11, rcx
mov rcx, qword [rbp + 0x10]
mov r10, rcx
mov qword [rbp - 0x20], rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
shl rax, 0x20
shr rax, 0x20
mov dword [rbp - 0x10], eax
mov rcx, qword [rbp - 0x20]
mov ecx, dword [rcx]
add ecx, eax
mov rax, qword [rbp - 0x20]
mov dword [rax], ecx
mov rax, qword [rbp + 0x20]
add rax, 8
mov eax, dword [rax]
mov dword [rbp - 0xc], eax
mov eax, dword [rbp + 0x18]
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x14]
cmp eax, 0
jle 0x10043a60
jmp 0x10043a11
mov eax, dword [rbp - 0x14]
sub eax, 2
mov dword [rbp - 0x14], eax
jmp 0x100439f5
mov eax, dword [rbp - 0x14]
cmp eax, 2
jl 0x10043a31
mov rax, qword [rbp - 8]
mov rcx, rax
add rax, 2
mov qword [rbp - 8], rax
jmp 0x10043a3d
mov rax, qword [rbp - 8]
movzx eax, byte [rax]
jmp 0x10043a42
movzx ecx, word [rcx]
mov eax, ecx
mov ecx, dword [rbp - 0xc]
add ecx, eax
mov dword [rbp - 0xc], ecx
mov eax, dword [rbp - 0xc]
shr eax, 0x10
mov ecx, dword [rbp - 0xc]
add ecx, eax
and ecx, 0xffff
mov dword [rbp - 0xc], ecx
jmp 0x10043a06
mov rax, qword [rbp + 0x20]
add rax, 8
mov ecx, dword [rbp - 0xc]
mov dword [rax], ecx
mov eax, dword [rbp + 0x18]
mov ecx, dword [rbp - 0x10]
cmp eax, ecx
jne 0x10043a80
jmp 0x10043a8a
mov eax, 0xffffffff
jmp 0x10043a8f
mov eax, 0
leave
ret

Function at 0x10043a91
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x130
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
mov eax, dword [rax]
sub ecx, eax
mov dword [rbp - 0x108], ecx
movabs rax, 0x100
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x108]
cmp eax, 0
jle 0x10043b5c
mov eax, 0x100
mov r11, rax
mov eax, dword [rbp - 0x108]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.100437d6
mov dword [rbp - 0x104], eax
mov ecx, dword [rbp - 0x108]
sub ecx, eax
mov dword [rbp - 0x108], ecx
mov eax, dword [rbp - 0x104]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
mov rcx, qword [rcx]
mov r9, rcx
movabs rcx, 1
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
jmp 0x10043ae3
mov rax, qword [rbp + 0x10]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
mov dword [rax], ecx
leave
ret
Function at 0x10043a9c
Capabilities:
Write file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x130
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
mov eax, dword [rax]
sub ecx, eax
mov dword [rbp - 0x108], ecx
movabs rax, 0x100
mov r8, rax
mov eax, 0
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_memset
mov eax, dword [rbp - 0x108]
cmp eax, 0
jle 0x10043b5c
mov eax, 0x100
mov r11, rax
mov eax, dword [rbp - 0x108]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.100437d6
mov dword [rbp - 0x104], eax
mov ecx, dword [rbp - 0x108]
sub ecx, eax
mov dword [rbp - 0x108], ecx
mov eax, dword [rbp - 0x104]
movsxd rax, eax
mov rcx, qword [rbp + 0x10]
mov rcx, qword [rcx]
mov r9, rcx
movabs rcx, 1
mov r8, rcx
mov r11, rax
lea rax, [rbp - 0x100]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_fwrite
jmp 0x10043ae3
mov rax, qword [rbp + 0x10]
add rax, 0xc
mov ecx, dword [rbp + 0x18]
mov dword [rax], ecx
leave
ret

Function at 0x10043c27
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x150
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x18]
mov r9, rax
lea rax, str.cv2pdb.exe__s
mov r8, rax
movabs rax, 0x12c
mov r11, rax
lea rax, [rbp - 0x12c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__snprintf
lea rax, [rbp - 0x12c]
mov r10, rax
mov rcx, r10
call sub.msvcrt.dll_system
mov dword [rbp - 0x130], eax
mov rax, qword [rbp + 0x18]
mov r11, rax
lea rax, [rbp - 0x12c]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcpy
mov r10, rax
mov rcx, r10
call sym.libtccbs.dll_tcc_fileextension
lea rcx, [0x1005805e]
mov r11, rcx
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcpy
mov eax, dword [rbp - 0x130]
cmp eax, 0
je 0x10043d06
mov rax, qword [rbp + 0x10]
mov r10, rax
mov rcx, r10
call sym.libtccbs.dll_tcc_enter_state
lea rax, [rbp - 0x12c]
mov r11, rax
lea rax, str.could_not_create__s_n_need_working_cv2pdb_from_https:__github.com_rainers_cv2pdb_
mov r10, rax
mov rcx, r10
mov rdx, r11
call sym.libtccbs.dll__tcc_error_noabort
jmp 0x10043d35
mov rax, qword [rbp + 0x10]
movzx eax, byte [rax]
cmp eax, 0
je 0x10043d35
lea rax, [rbp - 0x12c]
mov r11, rax
lea rax, str.____s_n
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_printf
leave
ret
Function at 0x10046aca
Capabilities:
Read file on windows

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov qword [rbp + 0x28], r9
mov eax, 0
mov r8, rax
mov eax, dword [rbp + 0x18]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__lseek
mov eax, dword [rbp + 0x28]
mov r8, rax
mov rax, qword [rbp + 0x20]
mov r11, rax
mov eax, dword [rbp + 0x10]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll__read
mov ecx, dword [rbp + 0x28]
cmp ecx, eax
sete al
movzx eax, al
leave
ret

Function at 0x1004bc37
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [0x10058f21]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.1004acd1
cmp eax, 0
sete al
movzx eax, al
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x18]
add rax, 2
movzx eax, word [rax]
and eax, 1
cmp eax, 0
je 0x1004bced
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, str.error
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.1004acd1
cmp eax, 0
je 0x1004bced
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x1004bcd3
jmp 0x1004bcdd
mov eax, 4
jmp 0x1004bce2
mov eax, 3
mov dword [rbp - 4], eax
mov eax, 1
mov dword [rbp - 8], eax
mov eax, 0xffffffff
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
add rax, 8
mov rax, qword [rax]
cmp rax, 0
je 0x1004be0d
jmp 0x1004bd25
mov rax, qword [rbp - 0x18]
add rax, 0x10
mov qword [rbp - 0x18], rax
jmp 0x1004bcfd
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x1004bd64
mov rax, qword [rbp - 0x18]
add rax, 8
mov rax, qword [rax]
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
je 0x1004bd5f
jmp 0x1004bd17
jmp 0x1004bd80
mov rax, qword [rbp - 0x18]
add rax, 2
movzx eax, word [rax]
and eax, 1
cmp eax, 0
jne 0x1004bd80
jmp 0x1004bd17
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
mov rcx, qword [rbp + 0x10]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x28]
movzx ecx, byte [rcx]
mov edx, dword [rbp - 8]
and ecx, edx
mov rdx, qword [rbp - 0x18]
add rdx, 2
movzx edx, word [rdx]
and edx, 2
cmp edx, 0
setne dl
movzx edx, dl
mov qword [rbp - 0x30], rax
mov eax, dword [rbp - 4]
xor eax, edx
or ecx, eax
mov rax, qword [rbp - 0x30]
mov byte [rax], cl
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x1004be08
mov eax, 0
mov dword [rbp - 0xc], eax
lea rax, [0x10058f2c]
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
je 0x1004be08
jmp 0x1004be0d
jmp 0x1004bd17
mov eax, dword [rbp - 0xc]
leave
ret
Function at 0x1004bc42
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, [0x10058f21]
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.1004acd1
cmp eax, 0
sete al
movzx eax, al
mov dword [rbp - 4], eax
mov eax, 0
mov dword [rbp - 8], eax
mov rax, qword [rbp + 0x18]
add rax, 2
movzx eax, word [rax]
and eax, 1
cmp eax, 0
je 0x1004bced
lea rax, [rbp - 0x20]
mov r11, rax
lea rax, str.error
mov r10, rax
mov rcx, r10
mov rdx, r11
call fcn.1004acd1
cmp eax, 0
je 0x1004bced
mov eax, dword [rbp - 4]
cmp eax, 0
je 0x1004bcd3
jmp 0x1004bcdd
mov eax, 4
jmp 0x1004bce2
mov eax, 3
mov dword [rbp - 4], eax
mov eax, 1
mov dword [rbp - 8], eax
mov eax, 0xffffffff
mov dword [rbp - 0xc], eax
mov rax, qword [rbp + 0x18]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
add rax, 8
mov rax, qword [rax]
cmp rax, 0
je 0x1004be0d
jmp 0x1004bd25
mov rax, qword [rbp - 0x18]
add rax, 0x10
mov qword [rbp - 0x18], rax
jmp 0x1004bcfd
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x1004bd64
mov rax, qword [rbp - 0x18]
add rax, 8
mov rax, qword [rax]
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
je 0x1004bd5f
jmp 0x1004bd17
jmp 0x1004bd80
mov rax, qword [rbp - 0x18]
add rax, 2
movzx eax, word [rax]
and eax, 1
cmp eax, 0
jne 0x1004bd80
jmp 0x1004bd17
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
mov rcx, qword [rbp + 0x10]
add rcx, rax
mov qword [rbp - 0x28], rcx
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x28]
movzx ecx, byte [rcx]
mov edx, dword [rbp - 8]
and ecx, edx
mov rdx, qword [rbp - 0x18]
add rdx, 2
movzx edx, word [rdx]
and edx, 2
cmp edx, 0
setne dl
movzx edx, dl
mov qword [rbp - 0x30], rax
mov eax, dword [rbp - 4]
xor eax, edx
or ecx, eax
mov rax, qword [rbp - 0x30]
mov byte [rax], cl
mov eax, dword [rbp - 0xc]
cmp eax, 0
je 0x1004be08
mov eax, 0
mov dword [rbp - 0xc], eax
lea rax, [0x10058f2c]
mov r11, rax
mov rax, qword [rbp - 0x20]
mov r10, rax
mov rcx, r10
mov rdx, r11
call sub.msvcrt.dll_strcmp
cmp eax, 0
je 0x1004be08
jmp 0x1004be0d
jmp 0x1004bd17
mov eax, dword [rbp - 0xc]
leave
ret
Function at 0x1004db26
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
jmp 0x1004dc6b
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
movsxd rdx, edx
mov qword [rax], rdx
jmp 0x1004dd41
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov qword [rax], rdx
jmp 0x1004dd41
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
jmp 0x1004dd41
mov rax, qword [rbp + 0x20]
add rax, 8
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x20]
add rax, 8
mov eax, dword [rax]
movsxd rax, eax
add rax, 4
sub rax, 1
shr rax, 2
shl rax, 2
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
jmp 0x1004dd41
mov eax, 2
mov dword [rbp - 0xc], eax
jmp 0x1004dc2d
mov eax, 2
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 0x18]
mov rcx, rax
add rax, 4
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 8]
mov rdx, rax
add rax, 4
mov qword [rbp - 8], rax
mov edx, dword [rdx]
mov dword [rcx], edx
mov eax, dword [rbp - 0xc]
add eax, 0xffffffff
mov dword [rbp - 0xc], eax
cmp eax, 0
jne 0x1004dc2d
jmp 0x1004dd41
jmp 0x1004dd41
cmp edx, 0xc8
jg 0x1004dce8
cmp edx, 0xc8
jge 0x1004dbc5
cmp edx, 0xc0
je 0x1004db6c
cmp edx, 0xc1
je 0x1004db6c
cmp edx, 0xc2
je 0x1004db6c
cmp edx, 0xc3
je 0x1004db8c
cmp edx, 0xc4
je 0x1004dc18
cmp edx, 0xc5
je 0x1004dc18
cmp edx, 0xc6
je 0x1004db6c
cmp edx, 0xc7
je 0x1004db8c
jmp 0x1004dc66
cmp edx, 0xc9
je 0x1004dbc5
cmp edx, 0xca
je 0x1004dba9
cmp edx, 0xcb
je 0x1004dc18
cmp edx, 0xcc
je 0x1004dc25
cmp edx, 0xcd
je 0x1004dbc5
cmp edx, 0xce
je 0x1004dbc5
cmp edx, 0xcf
je 0x1004db6c
jmp 0x1004dc66
mov rax, qword [rbp + 0x18]
mov rcx, qword [rbp - 8]
mov qword [rax], rcx
leave
ret
Function at 0x1004db31
Capabilities:
Check for software breakpoints

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov qword [rbp + 0x20], r8
mov rax, qword [rbp + 0x18]
mov rax, qword [rax]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x20]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x10]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
jmp 0x1004dc6b
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
movsxd rdx, edx
mov qword [rax], rdx
jmp 0x1004dd41
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov qword [rax], rdx
jmp 0x1004dd41
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
jmp 0x1004dd41
mov rax, qword [rbp + 0x20]
add rax, 8
mov rcx, qword [rbp - 8]
mov rdx, rcx
add rcx, 4
mov qword [rbp - 8], rcx
mov edx, dword [rdx]
mov dword [rax], edx
mov rax, qword [rbp + 0x20]
mov rcx, qword [rbp - 8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x20]
add rax, 8
mov eax, dword [rax]
movsxd rax, eax
add rax, 4
sub rax, 1
shr rax, 2
shl rax, 2
mov rcx, qword [rbp - 8]
add rcx, rax
mov qword [rbp - 8], rcx
jmp 0x1004dd41
mov eax, 2
mov dword [rbp - 0xc], eax
jmp 0x1004dc2d
mov eax, 2
mov dword [rbp - 0xc], eax
mov rax, qword [rbp - 0x18]
mov rcx, rax
add rax, 4
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 8]
mov rdx, rax
add rax, 4
mov qword [rbp - 8], rax
mov edx, dword [rdx]
mov dword [rcx], edx
mov eax, dword [rbp - 0xc]
add eax, 0xffffffff
mov dword [rbp - 0xc], eax
cmp eax, 0
jne 0x1004dc2d
jmp 0x1004dd41
jmp 0x1004dd41
cmp edx, 0xc8
jg 0x1004dce8
cmp edx, 0xc8
jge 0x1004dbc5
cmp edx, 0xc0
je 0x1004db6c
cmp edx, 0xc1
je 0x1004db6c
cmp edx, 0xc2
je 0x1004db6c
cmp edx, 0xc3
je 0x1004db8c
cmp edx, 0xc4
je 0x1004dc18
cmp edx, 0xc5
je 0x1004dc18
cmp edx, 0xc6
je 0x1004db6c
cmp edx, 0xc7
je 0x1004db8c
jmp 0x1004dc66
cmp edx, 0xc9
je 0x1004dbc5
cmp edx, 0xca
je 0x1004dba9
cmp edx, 0xcb
je 0x1004dc18
cmp edx, 0xcc
je 0x1004dc25
cmp edx, 0xcd
je 0x1004dbc5
cmp edx, 0xce
je 0x1004dbc5
cmp edx, 0xcf
je 0x1004db6c
jmp 0x1004dc66
mov rax, qword [rbp + 0x18]
mov rcx, qword [rbp - 8]
mov qword [rax], rcx
leave
ret
Function at 0x140005980
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x1400059a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x40]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x140005990
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x1400059b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140038240]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov esi, 0xffffffff
xor edx, edx
lea ecx, [rsi + 3]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
je 0x140005a26
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140005a00
jmp 0x140005a2a
mov esi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140006a40
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret