joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800130c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x90
mov rdi, rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x40], xmm1
xor r8d, r8d
lea rdx, [0x180121ed8]
lea rcx, [rsp + 0x30]
call fcn.180008da0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x60], xmm1
xor r8d, r8d
lea rdx, [0x180121edc]
lea rcx, [rsp + 0x50]
call fcn.180008da0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x80], xmm1
xor r8d, r8d
lea rdx, [0x180121ee0]
lea rcx, [rsp + 0x70]
call fcn.180008da0
nop
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.180013a50
nop
lea r9, [fcn.1800074f0]
mov edx, 0x20
lea r8d, [rdx - 0x1d]
lea rcx, [rsp + 0x30]
call fcn.1800bdc40
xor esi, esi
mov qword [rdi + 0x18], rsi
mov qword [rdi + 0x20], rsi
mov dword [rdi + 0x28], 9
mov byte [rdi + 0x2c], sil
mov dword [rdi + 0x30], esi
mov word [rdi + 0x34], si
mov dword [rdi + 0x38], esi
mov qword [rdi + 0x3c], 1
lea rbx, [rdi + 0x48]
mov qword [rsp + 0xa8], rbx
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], rsi
lea r8d, [rsi + 0xe]
lea rdx, str.kernelbase.dll
mov rcx, rbx
call fcn.180008da0
nop
xorps xmm0, xmm0
movups xmmword [rbx + 0x20], xmm0
mov qword [rbx + 0x30], 5
mov qword [rbx + 0x38], send
mov eax, dword [0x18015bbd8]
mov dword [rbx + 0x20], eax
movzx eax, byte [0x18015bbdc]
mov byte [rbx + 0x24], al
mov byte [rbx + 0x25], sil
mov byte [rdi + 0x88], sil
mov qword [rdi + 0x8c], rsi
mov qword [rdi + 0x98], rsi
mov qword [rdi + 0xa0], rsi
mov qword [rdi + 0xa8], rsi
mov qword [rdi + 0xb0], rsi
mov qword [rdi + 0xb8], rsi
mov qword [0x180366bf8], rdi
mov rax, rdi
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x1800155d0
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x180366bf8]
xor ebx, ebx
mov r14, r8
mov r15, rdx
mov rdi, rcx
cmp dword [rax + 0x30], ebx
je 0x18001570e
mov qword [r11 + 8], rsi
mov qword [rbp + 0x7f], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
je 0x18001566e
mov rsi, rdi
and rsi, 0xffffffffa0000000
je 0x18001566e
test dil, 3
jne 0x18001566e
lea rax, [rbp + 0x7f]
mov qword [rbp - 9], rbx
lea rdx, [rbp - 9]
mov qword [rbp + 0x17], rax
lea ecx, [rbx + 0x17]
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x33], rbx
mov dword [rbp + 0x3b], ebx
mov qword [rbp + 0x3f], 0x25
mov qword [rbp - 1], rdi
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r14
mov dword [rbp + 0x2f], ebx
call fcn.18002c840
mov r14d, ebx
jmp 0x180015684
mov rsi, rdi
mov r14, rdi
and rsi, 0xffffffffa0000000
mov eax, 0x122
and r14d, 3
mov dword [0x1803670c8], eax
mov rax, qword [0x180366bf8]
cmp byte [rax + 0x35], bl
je 0x1800156ed
mov r15, qword [rbp + 0x7f]
test r15, r15
je 0x1800156ed
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
je 0x1800156ed
test rsi, rsi
je 0x1800156ed
test r14, r14
jne 0x1800156ed
xorps xmm0, xmm0
mov qword [rbp - 9], rbx
lea rdx, [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm0
lea ecx, [r14 + 0x18]
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], rbx
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], 0x25
mov qword [rbp - 1], rdi
mov qword [rbp + 7], r15
call fcn.18002c840
mov rsi, qword [rsp + 0xb0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x30], rbx
mov r9, r15
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
jmp 0x1800156f5
Function at 0x18001c8f0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 0x38]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x18001ca0d
mov qword [rsp + 0x58], rbp
movabs rbp, 0x100000001b3
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
movabs r14, 0xcbf29ce484222325
mov qword [rsp + 0x68], rdi
nop dword [rax]
nop word [rax + rax]
cmp qword [rbx + 0x38], 0x10
lea rdx, [rbx + 0x20]
mov r8, qword [rbx + 0x30]
jb 0x18001c953
mov rdx, qword [rbx + 0x20]
xor ecx, ecx
mov r9, r14
test r8, r8
je 0x18001c973
nop dword [rax]
movzx eax, byte [rcx + rdx]
inc rcx
xor r9, rax
imul r9, rbp
cmp rcx, r8
jb 0x18001c960
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x20]
call fcn.18001ea60
cmp qword [rax + 8], 0
je 0x18001c9a1
mov rdi, qword [rbx + 0x40]
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x30]
call fcn.18001e250
mov rcx, qword [rax]
mov qword [rcx + 0x30], rdi
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18001c9cd
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18001c9c8
cmp rbx, qword [rax + 0x10]
jne 0x18001c9c8
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18001c9b5
mov rbx, rax
jmp 0x18001c9ef
mov rcx, qword [rax]
mov rbx, rax
cmp byte [rcx + 0x19], 0
jne 0x18001c9ef
nop dword [rax]
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18001c9e0
cmp byte [rbx + 0x19], 0
je 0x18001c940
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [0x180366f08]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rcx]
cmp rax, rcx
je 0x18001ca30
cmp qword [rax + 0x30], 0
je 0x18001ca37
mov rax, qword [rax]
cmp rax, rcx
jne 0x18001ca21
mov al, 1
add rsp, 0x48
ret
xor al, al
add rsp, 0x48
ret
Function at 0x18001ca40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbp, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rdx]
mov rcx, qword [rdi + 8]
cmp rdx, rcx
je 0x18001cba2
cmp qword [r8 + 0x10], 0
je 0x18001cba2
cmp qword [r9 + 0x10], 0
je 0x18001cba2
mov rax, qword [rbx + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18001cba2
mov rsi, qword [rbx + 8]
sub rcx, rdx
lea r8, [rcx + 0x1000]
cmp qword [rsi + 8], 0
jne 0x18001cad0
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsi + 8], rax
test rax, rax
je 0x18001cba2
mov rcx, rbx
call fcn.18001c8f0
test al, al
je 0x18001cba2
lea rax, [rsp + 0x40]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea r8, [0x180366e20]
lea rdx, [rsp + 0x30]
call fcn.18001e250
mov rcx, qword [rax]
lea r8, [rsp + 0x40]
mov rdx, qword [rcx + 0x30]
mov rcx, rbx
call fcn.18001d6d0
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18001cba2
mov rdx, rdi
mov rcx, rbx
call fcn.18001cbc0
test rax, rax
je 0x18001cba2
mov byte [rbx + 0x20], 1
mov rdx, rax
mov rcx, rbx
call fcn.18001ce10
mov rdi, rax
test rax, rax
je 0x18001cba2
mov rdx, rax
mov rcx, rbx
call fcn.18001d060
test rax, rax
je 0x18001cba2
mov r9, rbp
mov r8, r14
mov rdx, rax
mov rcx, rbx
call fcn.18001d0e0
test rax, rax
je 0x18001cba2
mov r8, qword [rsp + 0xa0]
mov rdx, rax
mov rcx, rbx
call fcn.18001d1a0
test rax, rax
je 0x18001cba2
mov rdx, rax
mov rcx, rbx
call fcn.18001d250
mov rax, rdi
jmp 0x18001cba4
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180026780
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
call fcn.180026a40
nop
mov eax, dword [rsi + 0x18]
mov dword [rbp + 0x18], eax
mov eax, dword [rsi + 0x1c]
mov dword [rbp + 0x1c], eax
mov eax, dword [rsi + 0x20]
mov dword [rbp + 0x20], eax
mov eax, dword [rsi + 0x24]
mov dword [rbp + 0x24], eax
mov eax, dword [rsi + 0x28]
mov dword [rbp + 0x28], eax
movzx eax, byte [rsi + 0x2c]
mov byte [rbp + 0x2c], al
mov eax, dword [rsi + 0x30]
mov dword [rbp + 0x30], eax
movzx eax, byte [rsi + 0x34]
mov byte [rbp + 0x34], al
movzx eax, byte [rsi + 0x35]
mov byte [rbp + 0x35], al
mov eax, dword [rsi + 0x38]
mov dword [rbp + 0x38], eax
mov eax, dword [rsi + 0x3c]
mov dword [rbp + 0x3c], eax
mov eax, dword [rsi + 0x40]
mov dword [rbp + 0x40], eax
lea rdi, [rbp + 0x48]
mov qword [rsp + 0x48], rdi
lea rdx, [rsi + 0x48]
mov rcx, rdi
call fcn.180007680
nop
lea rcx, [rdi + 0x20]
lea rdx, [rsi + 0x68]
call fcn.1800079d0
nop
movzx eax, byte [rsi + 0x88]
mov byte [rbp + 0x88], al
mov eax, dword [rsi + 0x8c]
mov dword [rbp + 0x8c], eax
mov eax, dword [rsi + 0x90]
mov dword [rbp + 0x90], eax
mov rax, qword [rsi + 0x98]
mov qword [rbp + 0x98], rax
mov rax, qword [rsi + 0xa0]
mov qword [rbp + 0xa0], rax
mov rax, qword [rsi + 0xa8]
mov qword [rbp + 0xa8], rax
mov rax, qword [rsi + 0xb0]
mov qword [rbp + 0xb0], rax
mov rax, qword [rsi + 0xb8]
mov qword [rbp + 0xb8], rax
mov rax, rbp
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800268b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov qword [rsp + 0x50], r14
mov rdi, rdx
mov qword [rsp + 0x20], r15
mov rsi, rcx
cmp rcx, rdx
je 0x1800268df
mov rdx, qword [rdx]
mov r8, qword [rdi + 8]
sub r8, rdx
sar r8, 5
call fcn.180026c90
mov eax, dword [rdi + 0x18]
lea r15, [rdi + 0x48]
mov dword [rsi + 0x18], eax
lea r14, [rsi + 0x48]
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x1c], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x20], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov eax, dword [rdi + 0x28]
mov dword [rsi + 0x28], eax
movzx eax, byte [rdi + 0x2c]
mov byte [rsi + 0x2c], al
mov eax, dword [rdi + 0x30]
mov dword [rsi + 0x30], eax
movzx eax, byte [rdi + 0x34]
mov byte [rsi + 0x34], al
movzx eax, byte [rdi + 0x35]
mov byte [rsi + 0x35], al
mov eax, dword [rdi + 0x38]
mov dword [rsi + 0x38], eax
mov eax, dword [rdi + 0x3c]
mov dword [rsi + 0x3c], eax
mov eax, dword [rdi + 0x40]
mov dword [rsi + 0x40], eax
cmp r14, r15
je 0x180026997
cmp qword [r15 + 0x18], 8
mov r9, r15
mov rdx, qword [r15 + 0x10]
jb 0x180026948
mov r9, qword [r15]
mov rax, qword [r14 + 0x18]
cmp rdx, rax
ja 0x18002698f
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rbp, r14
cmp rax, 8
jb 0x180026967
mov rbp, qword [r14]
lea rbx, [rdx + rdx]
mov qword [r14 + 0x10], rdx
mov r8, rbx
mov rdx, r9
mov rcx, rbp
call fcn.1800c0160
xor eax, eax
mov word [rbx + rbp], ax
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
jmp 0x180026997
mov rcx, r14
call fcn.1800168a0
lea rdx, [r15 + 0x20]
mov r15, qword [rsp + 0x20]
lea rcx, [r14 + 0x20]
mov r14, qword [rsp + 0x50]
cmp rcx, rdx
je 0x1800269c1
cmp qword [rdx + 0x18], 0x10
mov r8, qword [rdx + 0x10]
jb 0x1800269bc
mov rdx, qword [rdx]
call fcn.180026b30
movzx eax, byte [rdi + 0x88]
mov byte [rsi + 0x88], al
mov eax, dword [rdi + 0x8c]
mov dword [rsi + 0x8c], eax
mov eax, dword [rdi + 0x90]
mov dword [rsi + 0x90], eax
mov rax, qword [rdi + 0x98]
mov qword [rsi + 0x98], rax
mov rax, qword [rdi + 0xa0]
mov qword [rsi + 0xa0], rax
mov rax, qword [rdi + 0xa8]
mov qword [rsi + 0xa8], rax
mov rax, qword [rdi + 0xb0]
mov qword [rsi + 0xb0], rax
mov rax, qword [rdi + 0xb8]
mov qword [rsi + 0xb8], rax
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x180029380
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x1800293b1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x18002942b
mov rdi, r14
mov rcx, rbx
call fcn.18002a630
test rax, rax
jle 0x180029403
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.1800c0160
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18002941b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180029423
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x1800293c5
sub r14, rdi
jmp 0x18002950f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180029442
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180029444
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180029476
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1800c0160
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18002950c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800294b1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x1800294ed
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1800cef38
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18002950c
cmp rbp, rax
ja 0x1800294c0
test rbp, rbp
je 0x18002950c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1800cef38
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18002d4c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xb8
movups xmm0, xmmword [0x18015c700]
mov eax, dword [0x18015c730]
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
movups xmm1, xmmword [0x18015c710]
mov dword [rsp + 0x60], eax
movzx eax, word [0x18015c734]
movups xmmword [rsp + 0x30], xmm0
mov qword [r11 + 8], rcx
movups xmm0, xmmword [0x18015c720]
mov word [rsp + 0x64], ax
movups xmmword [rsp + 0x40], xmm1
movups xmmword [rsp + 0x50], xmm0
jl 0x18002d67d
movdqa xmm5, xmmword [0x1801600f0]
lea rdx, [rsp + 0x30]
movdqa xmm4, xmmword [0x1801602c0]
mov eax, 4
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x180160140]
movaps xmmword [r11 - 0x38], xmm8
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x48], xmm9
movdqa xmm9, xmmword [str.4444444455555555]
movd xmm8, eax
nop dword [rax]
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov eax, ecx
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x18
jl 0x18002d570
movaps xmm9, xmmword [rsp + 0x70]
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp eax, 0x1b
jge 0x18002d6c1
movsxd rax, ecx
lea r8, [rsp + 0x30]
lea r8, [r8 + rax*2]
nop dword [rax]
mov eax, 0x4d4873ed
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x35
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x34
xor word [r8 - 2], ax
cmp ecx, 0x1b
jl 0x18002d690
lea rax, [rsp + 0xc0]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x18002d70a
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rax, qword [rsp + 0xc0]
test rax, rax
setne al
add rsp, 0xb8
ret
Function at 0x18002d720
Capabilities:
Enumerate files on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0xa0
mov rdi, r9
lea r14, [0x18002d920]
xor esi, esi
mov dword [rax + 0x10], esi
mov dword [rax + 0x18], esi
mov qword [rax - 0x70], rsi
xorps xmm0, xmm0
movups xmmword [rax - 0x50], xmm0
movups xmmword [rax - 0x40], xmm0
movups xmmword [rax - 0x30], xmm0
test rcx, rcx
je 0x18002d8fa
movups xmmword [rax - 0x60], xmm0
mov rdx, rcx
lea rcx, [rax - 0x60]
call qword [sym.imp.ntdll.dll_RtlInitUnicodeString]
mov dword [rsp + 0x68], 0x30
mov qword [rsp + 0x70], rsi
mov dword [rsp + 0x80], 0x40
lea rax, [rsp + 0x58]
mov qword [rsp + 0x78], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x88], xmm0
lea r8, [rsp + 0x68]
lea edx, [rsi + 1]
lea rcx, [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtOpenDirectoryObject]
mov dword [rsp + 0x40], eax
test eax, eax
jne 0x18002d90c
nop word [rax + rax]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
mov r9b, 1
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov ebx, eax
mov dword [rsp + 0x40], eax
cmp eax, 0xc0000023
jne 0x18002d8e8
mov r8d, dword [rsp + 0xd0]
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov edx, 8
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlAllocateHeap]
mov rbx, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x18002d8e4
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov byte [rsp + 0x20], 0
mov r9b, 1
mov r8d, dword [rsp + 0xd0]
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ntdll.dll_NtQueryDirectoryObject]
mov dword [rsp + 0x40], eax
test eax, eax
js 0x18002d8c6
mov rdx, rdi
mov rcx, rbx
call r14
mov dword [rsp + 0x44], eax
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
cmp dword [rsp + 0x44], 0
jl 0x18002d7d0
mov ebx, esi
mov dword [rsp + 0x40], ebx
jmp 0x18002d8e8
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x60]
mov r8, qword [rsp + 0x50]
xor edx, edx
mov rcx, qword [rcx + 0x30]
call qword [sym.imp.ntdll.dll_RtlFreeHeap]
mov ebx, dword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18002d8f8
call qword [sym.imp.ntdll.dll_NtClose]
jmp 0x18002d90a
mov eax, 0xc00000f0
jmp 0x18002d90c
mov eax, ebx
mov rbx, qword [rsp + 0xc0]
add rsp, 0xa0
pop r14
pop rdi
pop rsi
ret
Function at 0x18002dfe0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0xc0
mov rdi, rdx
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov dword [rax - 0x34], ebx
mov dword [rax - 0x1c], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rax - 0x58]
call qword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
jne 0x18002e025
xor eax, eax
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
mov dword [rsp + 0x90], 0x30
mov qword [rsp + 0x98], rbx
mov dword [rsp + 0xa8], 0x40
lea rax, [rsp + 0x70]
mov qword [rsp + 0xa0], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], 0x60
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], ebx
mov dword [rsp + 0x28], 0x80
mov qword [rsp + 0x20], rbx
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x90]
mov edx, 0x100002
lea rcx, [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_NtCreateFile]
test eax, eax
js 0x18002e0fb
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x10ac0
mov qword [rsp + 0x28], rdi
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0xd8]
call qword [sym.imp.ntdll.dll_NtWriteFile]
test eax, eax
js 0x18002e0fb
mov ebx, dword [rsp + 0x88]
mov dword [rsp + 0x60], ebx
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x18002e10e
call qword [sym.imp.ntdll.dll_NtClose]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov eax, ebx
mov rbx, qword [rsp + 0xd0]
add rsp, 0xc0
pop rdi
ret
Function at 0x180031900
Capabilities:
Enumerate processes

Disassembly:
push r12
push r13
push r14
push r15
sub rsp, 0x298
xor r13d, r13d
movzx r12d, r8b
mov r15, rcx
test r8b, r8b
jne 0x180031921
mov dword [rcx], r13d
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x234
call fcn.1800c0800
xor edx, edx
mov dword [rsp + 0x50], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x180031961
xor al, al
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
ret
mov qword [rsp + 0x2c0], rbx
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x2c8], rbp
mov rcx, r14
mov qword [rsp + 0x2d0], rsi
mov qword [rsp + 0x290], rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180031a83
nop word [rax + rax]
xorps xmm0, xmm0
mov qword [rsp + 0x40], r13
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r13
lea rax, [rsp + 0x7c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], r13w
jne 0x1800319c0
lea rdx, [rsp + 0x7c]
lea rcx, [rsp + 0x30]
call fcn.180008da0
cmp qword [r15 + 0x90], 8
lea r9, [r15 + 0x78]
mov rax, qword [r15 + 0x88]
jb 0x1800319f2
mov r9, qword [r15 + 0x78]
mov rsi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
cmp rsi, 8
mov rdx, qword [rsp + 0x40]
cmovae rcx, rbx
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.180015730
mov rbp, rax
cmp rsi, 8
jb 0x180031a59
lea rdx, [rsi*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x180031a51
mov rbx, qword [rbx - 8]
add rdx, 0x27
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180031ad2
mov rcx, rbx
call fcn.1800bdc0c
cmp rbp, 0xffffffffffffffff
je 0x180031a6d
test r12b, r12b
je 0x180031abe
mov eax, dword [rsp + 0x58]
cmp dword [r15], eax
je 0x180031ace
lea rdx, [rsp + 0x50]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1800319a0
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rsi, qword [rsp + 0x2d0]
mov rbp, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x2c0]
mov rdi, qword [rsp + 0x290]
add rsp, 0x298
pop r15
pop r14
pop r13
pop r12
ret
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x58]
mov dword [r15], eax
mov al, 1
jmp 0x180031a8e
call fcn.1800c9ad0
int3