joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020ed0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test r9d, 0xff000000
je 0x140021087
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
movss xmm3, dword [rsp + 0x70]
xorps xmm0, xmm0
comiss xmm3, xmm0
mov esi, r9d
mov rdi, r8
mov rbp, rdx
mov rbx, rcx
jbe 0x140020f66
mov eax, dword [rsp + 0x78]
mov dword [rsp + 0x20], eax
call fcn.140020840
mov r8d, dword [rbx + 0x80]
mov r9d, esi
mov rdx, qword [rbx + 0x88]
mov rcx, rbx
call fcn.14001fe50
mov ecx, dword [rbx + 0x84]
test ecx, ecx
jns 0x140020f57
mov eax, ecx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, ecx
lea rcx, [rbx + 0x80]
test eax, eax
cmovg edx, eax
call fcn.140015cb0
mov dword [rbx + 0x80], 0
jmp 0x140021073
mov edx, 6
movaps xmmword [rsp + 0x30], xmm6
lea r8d, [rdx - 2]
call fcn.14001ed40
movzx edx, word [rbx + 0x48]
mov rax, qword [rbx + 0x38]
movss xmm1, dword [rdi]
movss xmm2, dword [rbp + 4]
movss xmm3, dword [rbp]
lea ecx, [rdx + 1]
movss xmm6, dword [rax + 4]
movss xmm5, dword [rax]
movss xmm4, dword [rdi + 4]
mov rax, qword [rbx + 0x58]
mov word [rax], dx
mov rax, qword [rbx + 0x58]
mov word [rax + 2], cx
lea ecx, [rdx + 2]
mov rax, qword [rbx + 0x58]
mov word [rax + 4], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 6], dx
add dx, 3
mov rax, qword [rbx + 0x58]
mov word [rax + 8], cx
mov rax, qword [rbx + 0x58]
mov word [rax + 0xa], dx
movsd xmm0, qword [rbp]
mov rax, qword [rbx + 0x50]
movsd qword [rax], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 8], xmm5
movss dword [rax + 0xc], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x10], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x14], xmm1
movss dword [rax + 0x18], xmm2
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x1c], xmm5
movss dword [rax + 0x20], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x24], esi
movsd xmm0, qword [rdi]
mov rax, qword [rbx + 0x50]
movsd qword [rax + 0x28], xmm0
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x30], xmm5
movss dword [rax + 0x34], xmm6
mov rax, qword [rbx + 0x50]
mov dword [rax + 0x38], esi
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x3c], xmm3
movss dword [rax + 0x40], xmm4
mov rax, qword [rbx + 0x50]
movss dword [rax + 0x44], xmm5
movss dword [rax + 0x48], xmm6
mov rax, qword [rbx + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
mov dword [rax + 0x4c], esi
add qword [rbx + 0x50], 0x50
add dword [rbx + 0x48], 4
add qword [rbx + 0x58], 0xc
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x14003a190
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401b51c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x14003a1c1
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003a262
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14003a234
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003a22f
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a30b
mov rcx, r8
call fcn.140102c20
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401027d0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14003a2a7
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14003a2a3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003a29e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a30b
mov rcx, r8
call fcn.140102c20
xor al, al
jmp 0x14003a236
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x21a00
mov qword [rsp + 0x20], rbp
lea rdx, [0x1401b7470]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x14003a2f4
cmp rax, 7
jbe 0x14003a2a3
lea rdx, [rax*2 + 2]
jmp 0x14003a27a
cmp rax, 7
jbe 0x14003a234
lea rdx, [rax*2 + 2]
jmp 0x14003a207
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003a320
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x1401b51c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor ebp, ebp
mov rdi, rcx
cmp qword [rcx + 0x18], 7
mov dword [rsp + 0x40], ebp
jbe 0x14003a351
mov rcx, qword [rcx]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
mov dword [rsp + 0x28], 0x80
xor r8d, r8d
mov edx, 0x10000000
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
jne 0x14003a3f2
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14003a3c4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003a3bf
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a49b
mov rcx, r8
call fcn.140102c20
mov al, 1
mov word [rdi], bp
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rbp
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1401027d0
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
cmp rsi, 0xffffffffffffffff
jne 0x14003a437
mov rdx, qword [rdi + 0x18]
cmp rdx, 7
jbe 0x14003a433
lea rdx, [rdx*2 + 2]
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x14003a42e
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003a49b
mov rcx, r8
call fcn.140102c20
xor al, al
jmp 0x14003a3c6
lea r9, [rsp + 0x40]
mov qword [rsp + 0x68], rbx
mov r8d, 0x2200
mov qword [rsp + 0x20], rbp
lea rdx, [0x1401b5240]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rsi
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rdi + 0x18]
test bl, bl
mov rbx, qword [rsp + 0x68]
jne 0x14003a484
cmp rax, 7
jbe 0x14003a433
lea rdx, [rax*2 + 2]
jmp 0x14003a40a
cmp rax, 7
jbe 0x14003a3c4
lea rdx, [rax*2 + 2]
jmp 0x14003a397
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14003ac10
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x98
movups xmm0, xmmword [0x1401879e0]
movzx eax, word [0x140187a00]
xor r9d, r9d
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, r9d
movups xmm1, xmmword [0x1401879f0]
mov word [rsp + 0x60], ax
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
jl 0x14003ad79
movdqa xmm5, xmmword [0x1401889c0]
lea rdx, [rsp + 0x40]
movdqa xmm4, xmmword [0x140188a70]
movaps xmmword [rsp + 0x80], xmm6
movdqa xmm6, xmmword [0x1401889f0]
movaps xmmword [rsp + 0x70], xmm7
movdqa xmm7, xmmword [str.77777777]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x10
jl 0x14003ac80
movaps xmm7, xmmword [rsp + 0x70]
movaps xmm6, xmmword [rsp + 0x80]
cmp ecx, 0x11
jge 0x14003adc1
movsxd rax, ecx
lea r8, [rsp + 0x40]
lea r8, [r8 + rax*2]
nop word [rax + rax]
mov eax, 0x94f2095
lea r8, [r8 + 2]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub ax, dx
movzx eax, ax
imul edx, eax, 0x37
add dx, cx
inc ecx
xor word [r8 - 2], dx
cmp ecx, 0x11
jl 0x14003ad90
mov qword [rsp + 0x30], r9
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x28], r9d
mov edx, 0xc0000000
mov r8d, 3
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1401dafa0], rax
test rax, rax
je 0x14003ae04
cmp rax, 0xffffffffffffffff
setne al
add rsp, 0x98
ret
add rsp, 0x98
ret
Function at 0x14003af30
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1401b51c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14003afa4
nop word [rax + rax]
mov rdx, rdi
lea rcx, [rsp + 0x4c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov rcx, rbx
test eax, eax
je 0x14003afd4
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14003af80
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1401dafa8]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401027d0
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov dword [0x1401dafa8], eax
jmp 0x14003afb3
Function at 0x1400420a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
mov eax, 0x1060
call fcn.1401033b0
sub rsp, rax
mov rax, qword [0x1401b51c0]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov qword [rsp + 0x20], rcx
mov eax, edx
sar eax, 0x10
mov rdi, rcx
mov ebx, edx
xor esi, esi
lea ecx, [rax*8 + 0x10]
mov rax, qword [0x1401db018]
add rax, 0xa376a80
add rcx, rax
call fcn.140066280
mov rcx, rax
xor edx, edx
movzx eax, bx
mov r8d, 0x808
lea rbx, [rcx + rax*4]
lea rcx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x808
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.14003ae10
lea rcx, [rsp + 0x840]
mov r8d, 0x808
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [0x1401dafb8]
add rcx, qword [0x1401dafe0]
call fcn.140066280
mov qword [rsp + 0x20], rax
movzx r9d, si
movzx eax, word [rsp + 0x34]
shr ax, 1
cmp si, ax
jae 0x1400421a8
nop word [rax + rax]
movzx ecx, r9w
lea r8, [rsp + 0x846]
add r8, rcx
movzx ecx, r9b
and ecx, 3
inc r9w
movzx edx, byte [rsp + rcx + 0x20]
xor dl, byte [r8]
xor dl, al
mov byte [r8], dl
movzx eax, word [rsp + 0x844]
shr ax, 1
cmp r9w, ax
jb 0x140042170
xorps xmm0, xmm0
lea rax, [rsp + 0x846]
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], rsi
mov r8, 0xffffffffffffffff
mov qword [rdi + 0x18], rsi
inc r8
cmp byte [rax + r8], sil
jne 0x1400421c5
lea rdx, [rsp + 0x846]
mov rcx, rdi
call fcn.140067c60
mov rax, rdi
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.1401027d0
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1400544d0
Capabilities:
Access peb ldr_data
Encode data using xor
Get kernel32 base address
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1401db920]
test rax, rax
jne 0x1400546d4
mov rax, qword gs:[0x60]
xor r8d, r8d
mov qword [rsp + 0x48], rbx
mov ebx, 0x694a8c81
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r8d, r8d
je 0x14005456d
psrldq xmm0, 8
mov edx, 0x811c9dc5
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r9, [rcx + rax*2]
cmp rcx, r9
je 0x140054564
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r9
jne 0x140054550
cmp edx, r8d
jne 0x140054697
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov r11d, ecx
shr r15, 0x20
add r11, r10
cmp r11, r10
je 0x140054697
mov r9d, dword [r11 + 0x18]
test r9d, r9d
je 0x140054697
mov r14d, dword [r11 + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov edx, 0x811c9dc5
lea rax, [r14 + r9*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400545e7
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x1400545d0
cmp edx, ebx
je 0x1400545f5
test r9d, r9d
jne 0x1400545b0
jmp 0x140054697
mov ecx, dword [r11 + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, r11
jbe 0x1400546af
lea rcx, [r15 + r11]
cmp rax, rcx
jae 0x1400546af
movzx ecx, byte [rax]
mov r8d, 0x811c9dc5
mov dword [rsp + 0x40], r8d
mov edx, r8d
mov dword [rsp + 0x44], edx
cmp cl, 0x2e
je 0x14005465d
nop
movsx ecx, cl
inc rax
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x140054640
mov dword [rsp + 0x40], r8d
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x14005468a
nop dword [rax + rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x140054670
mov dword [rsp + 0x44], edx
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rbp]
shr rbx, 0x20
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x1400546ad
cmp qword [rax + 0x30], 0
jne 0x140054521
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x1401db920], rax
add rsp, 0x38
jmp rax
Function at 0x140056bd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0xc0
mov rax, qword [0x1401b51c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
cmp byte [0x1401881cf], 0
mov r9, rdx
movups xmm0, xmmword [0x1401881b8]
mov rbx, rcx
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x28], xmm0
movsd xmm0, qword [0x1401881c8]
movsd qword [rsp + 0x38], xmm0
je 0x140056dae
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140056d79
movdqa xmm0, xmmword [0x140188a80]
lea rcx, [rsp + 0x2c]
movdqa xmm5, xmmword [0x1401889c0]
xor edx, edx
movdqa xmm4, xmmword [0x140188a70]
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [rsp + 0xb0], xmm6
movdqa xmm6, xmmword [0x1401889f0]
nop dword [rax]
nop dword [rax + rax]
movd xmm2, edx
lea eax, [rdx + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add edx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140188a60]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rcx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140188a60]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rcx - 8]
xorps xmm2, xmm0
movd dword [rcx - 8], xmm2
cmp edx, 0x18
jl 0x140056c70
movaps xmm6, xmmword [rsp + 0xb0]
jmp 0x140056dae
lea r8, [rsp + 0x28]
xor ecx, ecx
mov eax, 0x94f2095
lea r8, [r8 + 1]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x37
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0x18
jl 0x140056d80
lea r8, [rsp + 0x28]
mov edx, 0x50
lea rcx, [rsp + 0x50]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_strftime]
xorps xmm0, xmm0
lea rax, [rsp + 0x50]
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], 0
mov r8, 0xffffffffffffffff
mov qword [rbx + 0x18], 0
inc r8
cmp byte [rax + r8], 0
jne 0x140056de5
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.140067c60
mov rax, rbx
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1401027d0
add rsp, 0xc0
pop rbx
ret
Function at 0x140056e20
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x1401b51c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edx, edx
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140056eaa
nop word [rax + rax]
lea rcx, [rsp + 0x4c]
mov r8, rdi
sub r8, rcx
nop dword [rax + rax]
movzx edx, word [rcx]
movzx eax, word [rcx + r8]
sub edx, eax
jne 0x140056e94
add rcx, 2
test eax, eax
jne 0x140056e80
mov rcx, rbx
test edx, edx
je 0x140056ed6
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140056e70
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1401027d0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140056eb5
Function at 0x14005afc0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
cmp ecx, 0xffffffff
jne 0x14005b149
cmp byte [0x1401882bb], 0
movsd xmm0, qword [0x1401882b0]
mov eax, dword [0x1401882b8]
movsd qword [rsp + 0x20], xmm0
mov dword [rsp + 0x28], eax
je 0x14005b13e
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14005b0fc
movdqa xmm2, xmmword [0x1401889c0]
mov ecx, 8
movdqa xmm4, xmmword [0x140188a70]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x1401889e0]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401889f0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1401882b0]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x140188a60]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140188a80]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x20], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 1
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1401889f0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x24]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x140188a60]
packuswb xmm2, xmm2
paddb xmm2, xmmword [0x140188a80]
xorps xmm2, xmm0
movd dword [rsp + 0x24], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x94f2095
lea r8, [r8 + 1]
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 1
sub al, dl
movsx eax, al
imul edx, eax, 0x37
add dl, cl
inc ecx
xor byte [r8 - 1], dl
cmp ecx, 0xc
jl 0x14005b110
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_perror]
add rsp, 0x38
ret
Function at 0x1400627a0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400627c8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x1400627ee
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1400627f0
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140062849
test ecx, ecx
jle 0x140062829
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140062849
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140062849
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x140062870
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140062892
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x1400628a8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400628c4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400628c6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140062902
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14006299e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14006293d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14006297e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14006299e
cmp rbx, rax
ja 0x140062950
test rbx, rbx
je 0x14006299e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret