joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180015a30
Capabilities:
Create thread

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [r11 - 0x5f]
sub rsp, 0x90
mov rax, qword [0x1803ad4d8]
xor ebx, ebx
mov r14, r8
mov r15, rdx
mov rdi, rcx
cmp dword [rax + 0x30], ebx
je 0x180015b6e
mov qword [r11 + 8], rsi
mov qword [rbp + 0x7f], rbx
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
je 0x180015ace
mov rsi, rdi
and rsi, 0xffffffffa0000000
je 0x180015ace
test dil, 3
jne 0x180015ace
lea rax, [rbp + 0x7f]
mov qword [rbp - 9], rbx
lea rdx, [rbp - 9]
mov qword [rbp + 0x17], rax
lea ecx, [rbx + 0x17]
mov qword [rbp + 0x1f], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x33], rbx
mov dword [rbp + 0x3b], ebx
mov qword [rbp + 0x3f], 0x25
mov qword [rbp - 1], rdi
mov qword [rbp + 7], r15
mov qword [rbp + 0xf], r14
mov dword [rbp + 0x2f], ebx
call fcn.1800340f0
mov r14d, ebx
jmp 0x180015ae4
mov rsi, rdi
mov r14, rdi
and rsi, 0xffffffffa0000000
mov eax, 0x122
and r14d, 3
mov dword [0x1803adc20], eax
mov rax, qword [0x1803ad4d8]
cmp byte [rax + 0x35], bl
je 0x180015b4d
mov r15, qword [rbp + 0x7f]
test r15, r15
je 0x180015b4d
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp rdi, rax
je 0x180015b4d
test rsi, rsi
je 0x180015b4d
test r14, r14
jne 0x180015b4d
xorps xmm0, xmm0
mov qword [rbp - 9], rbx
lea rdx, [rbp - 9]
movdqa xmmword [rbp + 0x17], xmm0
lea ecx, [r14 + 0x18]
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x27], rbx
mov qword [rbp + 0x2f], rbx
mov qword [rbp + 0x37], rbx
mov qword [rbp + 0x3f], 0x25
mov qword [rbp - 1], rdi
mov qword [rbp + 7], r15
call fcn.1800340f0
mov rsi, qword [rsp + 0xb0]
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov qword [rsp + 0x30], rbx
mov r9, r15
mov dword [rsp + 0x28], ebx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
jmp 0x180015b55
Function at 0x18001cea0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov rbx, qword [rcx + 0x38]
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
jne 0x18001cfbd
mov qword [rsp + 0x58], rbp
movabs rbp, 0x100000001b3
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x40], r14
movabs r14, 0xcbf29ce484222325
mov qword [rsp + 0x68], rdi
nop dword [rax]
nop word [rax + rax]
cmp qword [rbx + 0x38], 0xf
lea rdx, [rbx + 0x20]
mov r8, qword [rbx + 0x30]
jbe 0x18001cf03
mov rdx, qword [rbx + 0x20]
xor ecx, ecx
mov r9, r14
test r8, r8
je 0x18001cf23
nop dword [rax]
movzx eax, byte [rdx + rcx]
inc rcx
xor r9, rax
imul r9, rbp
cmp rcx, r8
jb 0x18001cf10
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x20]
call fcn.18001f000
cmp qword [rax + 8], 0
je 0x18001cf51
mov rdi, qword [rbx + 0x40]
lea r8, [rbx + 0x20]
lea rdx, [rsp + 0x30]
call fcn.18001e7f0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rdi
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18001cf7d
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18001cf78
cmp rbx, qword [rax + 0x10]
jne 0x18001cf78
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18001cf65
mov rbx, rax
jmp 0x18001cf9f
mov rcx, qword [rax]
mov rbx, rax
cmp byte [rcx + 0x19], 0
jne 0x18001cf9f
nop dword [rax]
mov rax, qword [rcx]
mov rbx, rcx
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18001cf90
cmp byte [rbx + 0x19], 0
je 0x18001cef0
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rcx, qword [0x1803ad9c8]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rcx]
cmp rax, rcx
je 0x18001cfe0
cmp qword [rax + 0x30], 0
je 0x18001cfe7
mov rax, qword [rax]
cmp rax, rcx
jne 0x18001cfd1
mov al, 1
add rsp, 0x48
ret
xor al, al
add rsp, 0x48
ret
Function at 0x18001cff0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rbp, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rdx, qword [rdx]
mov rcx, qword [rdi + 8]
cmp rdx, rcx
je 0x18001d152
cmp qword [r8 + 0x10], 0
je 0x18001d152
cmp qword [r9 + 0x10], 0
je 0x18001d152
mov rax, qword [rbx + 0x28]
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x18001d152
mov rsi, qword [rbx + 8]
sub rcx, rdx
lea r8, [rcx + 0x1000]
cmp qword [rsi + 8], 0
jne 0x18001d080
mov dword [rsp + 0x20], 0x40
xor edx, edx
mov r9d, 0x1000
mov rcx, qword [rsi]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov qword [rsi + 8], rax
test rax, rax
je 0x18001d152
mov rcx, rbx
call fcn.18001cea0
test al, al
je 0x18001d152
lea rax, [rsp + 0x40]
mov qword [rsp + 0x88], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0
lea r8, [0x1803ad8e0]
lea rdx, [rsp + 0x30]
call fcn.18001e7f0
mov rcx, qword [rax]
lea r8, [rsp + 0x40]
mov rdx, qword [rcx + 0x30]
mov rcx, rbx
call fcn.18001dc70
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18001d152
mov rdx, rdi
mov rcx, rbx
call fcn.18001d170
test rax, rax
je 0x18001d152
mov byte [rbx + 0x20], 1
mov rdx, rax
mov rcx, rbx
call fcn.18001d3c0
mov rdi, rax
test rax, rax
je 0x18001d152
mov rdx, rax
mov rcx, rbx
call fcn.18001d610
test rax, rax
je 0x18001d152
mov r9, rbp
mov r8, r14
mov rdx, rax
mov rcx, rbx
call fcn.18001d690
test rax, rax
je 0x18001d152
mov r8, qword [rsp + 0xa0]
mov rdx, rax
mov rcx, rbx
call fcn.18001d750
test rax, rax
je 0x18001d152
mov rdx, rax
mov rcx, rbx
call fcn.18001d800
mov rax, rdi
jmp 0x18001d154
xor eax, eax
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x180026ca0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rsi, rdx
mov rbp, rcx
call fcn.180026f60
nop
mov eax, dword [rsi + 0x18]
mov dword [rbp + 0x18], eax
mov eax, dword [rsi + 0x1c]
mov dword [rbp + 0x1c], eax
mov eax, dword [rsi + 0x20]
mov dword [rbp + 0x20], eax
mov eax, dword [rsi + 0x24]
mov dword [rbp + 0x24], eax
mov eax, dword [rsi + 0x28]
mov dword [rbp + 0x28], eax
movzx eax, byte [rsi + 0x2c]
mov byte [rbp + 0x2c], al
mov eax, dword [rsi + 0x30]
mov dword [rbp + 0x30], eax
movzx eax, byte [rsi + 0x34]
mov byte [rbp + 0x34], al
movzx eax, byte [rsi + 0x35]
mov byte [rbp + 0x35], al
mov eax, dword [rsi + 0x38]
mov dword [rbp + 0x38], eax
mov eax, dword [rsi + 0x3c]
mov dword [rbp + 0x3c], eax
mov eax, dword [rsi + 0x40]
mov dword [rbp + 0x40], eax
lea rdi, [rbp + 0x48]
mov qword [rsp + 0x48], rdi
lea rdx, [rsi + 0x48]
mov rcx, rdi
call fcn.180007a70
nop
lea rcx, [rdi + 0x20]
lea rdx, [rsi + 0x68]
call fcn.180007dc0
nop
movzx eax, byte [rsi + 0x88]
mov byte [rbp + 0x88], al
mov eax, dword [rsi + 0x8c]
mov dword [rbp + 0x8c], eax
mov eax, dword [rsi + 0x90]
mov dword [rbp + 0x90], eax
mov rax, qword [rsi + 0x98]
mov qword [rbp + 0x98], rax
mov rax, qword [rsi + 0xa0]
mov qword [rbp + 0xa0], rax
mov rax, qword [rsi + 0xa8]
mov qword [rbp + 0xa8], rax
mov rax, qword [rsi + 0xb0]
mov qword [rbp + 0xb0], rax
mov rax, qword [rsi + 0xb8]
mov qword [rbp + 0xb8], rax
mov rax, rbp
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180026dd0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov qword [rsp + 0x50], r14
mov rdi, rdx
mov qword [rsp + 0x20], r15
mov rsi, rcx
cmp rcx, rdx
je 0x180026dff
mov rdx, qword [rdx]
mov r8, qword [rdi + 8]
sub r8, rdx
sar r8, 5
call fcn.1800271b0
mov eax, dword [rdi + 0x18]
lea r15, [rdi + 0x48]
mov dword [rsi + 0x18], eax
lea r14, [rsi + 0x48]
mov eax, dword [rdi + 0x1c]
mov dword [rsi + 0x1c], eax
mov eax, dword [rdi + 0x20]
mov dword [rsi + 0x20], eax
mov eax, dword [rdi + 0x24]
mov dword [rsi + 0x24], eax
mov eax, dword [rdi + 0x28]
mov dword [rsi + 0x28], eax
movzx eax, byte [rdi + 0x2c]
mov byte [rsi + 0x2c], al
mov eax, dword [rdi + 0x30]
mov dword [rsi + 0x30], eax
movzx eax, byte [rdi + 0x34]
mov byte [rsi + 0x34], al
movzx eax, byte [rdi + 0x35]
mov byte [rsi + 0x35], al
mov eax, dword [rdi + 0x38]
mov dword [rsi + 0x38], eax
mov eax, dword [rdi + 0x3c]
mov dword [rsi + 0x3c], eax
mov eax, dword [rdi + 0x40]
mov dword [rsi + 0x40], eax
cmp r14, r15
je 0x180026eb7
cmp qword [r15 + 0x18], 7
mov r9, r15
mov rdx, qword [r15 + 0x10]
jbe 0x180026e68
mov r9, qword [r15]
mov rax, qword [r14 + 0x18]
cmp rdx, rax
ja 0x180026eaf
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rbp, r14
cmp rax, 7
jbe 0x180026e87
mov rbp, qword [r14]
lea rbx, [rdx + rdx]
mov qword [r14 + 0x10], rdx
mov r8, rbx
mov rdx, r9
mov rcx, rbp
call fcn.18010b6e0
xor eax, eax
mov word [rbx + rbp], ax
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
jmp 0x180026eb7
mov rcx, r14
call fcn.180016fb0
lea rdx, [r15 + 0x20]
mov r15, qword [rsp + 0x20]
lea rcx, [r14 + 0x20]
mov r14, qword [rsp + 0x50]
cmp rcx, rdx
je 0x180026ee1
cmp qword [rdx + 0x18], 0xf
mov r8, qword [rdx + 0x10]
jbe 0x180026edc
mov rdx, qword [rdx]
call fcn.180027050
movzx eax, byte [rdi + 0x88]
mov byte [rsi + 0x88], al
mov eax, dword [rdi + 0x8c]
mov dword [rsi + 0x8c], eax
mov eax, dword [rdi + 0x90]
mov dword [rsi + 0x90], eax
mov rax, qword [rdi + 0x98]
mov qword [rsi + 0x98], rax
mov rax, qword [rdi + 0xa0]
mov qword [rsi + 0xa0], rax
mov rax, qword [rdi + 0xa8]
mov qword [rsi + 0xa8], rax
mov rax, qword [rdi + 0xb0]
mov qword [rsi + 0xb0], rax
mov rax, qword [rdi + 0xb8]
mov qword [rsi + 0xb8], rax
mov rax, rsi
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x180027ea0
Capabilities:
Acquire debug privileges
Check os version

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x170
mov rbx, r9
mov rsi, r8
call fcn.1800345b0
test eax, eax
jne 0x180027ecd
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rsi
ret
call fcn.180027490
test al, al
jne 0x180027eec
mov eax, 0x1faf
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rsi
ret
mov qword [rsp + 0x180], rbp
mov qword [rsp + 0x188], rdi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x38]
mov edx, 0x20
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
xor ebp, ebp
test eax, eax
je 0x180027f70
lea r8, [rsp + 0x44]
mov dword [rsp + 0x40], 1
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rsp + 0x38]
lea r9d, [rbp + 0x10]
lea r8, [rsp + 0x40]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov dword [rsp + 0x4c], 2
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rsp + 0x54]
mov r8d, 0x110
call fcn.18010bd80
xor eax, eax
lea rdi, [rsp + 0x50]
mov ecx, 0x114
rep stosb byte [rdi], al
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x50], 0x114
call qword [sym.imp.ntdll.dll_RtlGetVersion]
mov edi, eax
test eax, eax
jne 0x18002801b
cmp dword [rsp + 0x54], 6
jae 0x180027fb7
mov edi, 0x1f90
jmp 0x18002801b
mov eax, dword [rsp + 0x5c]
mov dword [0x1803ad50c], eax
call fcn.180034e10
mov byte [0x1803ad4e5], al
test al, al
je 0x180027fd7
mov edi, 0x1ff5
jmp 0x18002801b
lea rdx, [rsp + 0x38]
mov dword [rsp + 0x30], ebp
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x38], ebp
call fcn.180036b10
mov qword [0x18019f3e8], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x180028012
mov rdx, rbx
mov rcx, rsi
call fcn.180038100
mov edi, eax
call fcn.180037ad0
jmp 0x180028016
mov edi, dword [rsp + 0x30]
call fcn.180037ad0
mov ecx, 0xfa0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rbp, qword [rsp + 0x180]
mov eax, edi
mov rdi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rsi
ret
Function at 0x18002e160
Capabilities:
Get system information on windows
Make suspicious ntquerysysteminformation call

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x40
xor ebp, ebp
lea r9, [rsp + 0x68]
mov r14, rcx
mov dword [rsp + 0x68], ebp
xor r8d, r8d
xor edx, edx
mov ebx, ebp
lea ecx, [rbp + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
cmp eax, 0xc0000004
jne 0x18002e33f
test rbx, rbx
je 0x18002e1ae
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rsp + 0x68]
xor ecx, ecx
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
test rax, rax
je 0x18002e1e6
mov r8d, dword [rsp + 0x68]
lea r9, [rsp + 0x68]
mov rdx, rax
mov ecx, listen
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov edi, eax
cmp edi, 0xc0000004
je 0x18002e198
test rbx, rbx
je 0x18002e33f
mov qword [rsp + 0x60], rsi
test edi, edi
js 0x18002e2c6
mov edi, ebp
cmp dword [rbx], ebp
jbe 0x18002e2c6
nop
mov eax, edi
xorps xmm0, xmm0
imul rcx, rax, 0x128
movups xmmword [rsp + 0x20], xmm0
movzx edx, word [rcx + rbx + 0x2e]
lea rsi, [rcx + rbx]
add rdx, 0x30
mov qword [rsp + 0x30], rbp
add rdx, rcx
mov qword [rsp + 0x38], rbp
add rdx, rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], bpl
jne 0x18002e245
lea rcx, [rsp + 0x20]
call fcn.1800091d0
cmp qword [r14 + 0x18], 0xf
mov rdx, r14
jbe 0x18002e265
mov rdx, qword [r14]
cmp qword [rsp + 0x38], 0xf
lea rcx, [rsp + 0x20]
cmova rcx, qword [rsp + 0x20]
call fcn.1800e9c34
test eax, eax
je 0x18002e2ec
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x18002e2bc
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e2b7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002e34f
call fcn.1800d9c1c
inc edi
cmp edi, dword [rbx]
jb 0x18002e210
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
mov rdi, qword [rsi + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x18002e33a
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18002e335
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18002e34f
call fcn.1800d9c1c
mov rax, rdi
jmp 0x18002e2d9
mov rbx, qword [rsp + 0x70]
xor eax, eax
add rsp, 0x40
pop r14
pop rdi
pop rbp
ret
call fcn.1800e5f80
int3
Function at 0x18002ec10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18002ec41
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x18002ecbb
mov rdi, r14
mov rcx, rbx
call fcn.180030020
test rax, rax
jle 0x18002ec93
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.18010b6e0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18002ecab
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18002ecb3
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18002ec55
sub r14, rdi
jmp 0x18002ed9f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18002ecd2
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18002ecd4
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18002ed06
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.18010b6e0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18002ed9c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18002ed41
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18002ed7d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1800eb5d8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18002ed9c
cmp rbp, rax
ja 0x18002ed50
test rbp, rbp
je 0x18002ed9c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1800eb5d8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180030b50
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x60
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
mov eax, 0x5a4d
cmp word [rdx], ax
jne 0x180030c6f
movsxd rax, dword [rdx + 0x3c]
cmp dword [rax + rdx], 0x4550
jne 0x180030c6f
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov r9d, r14d
mov qword [rsp + 0x38], r14
mov ecx, dword [rax + rdx + 0xb0]
test ecx, ecx
jne 0x180030bbe
mov qword [rdi], r14
mov qword [rdi + 8], r14
mov qword [rdi + 0x10], r14
jmp 0x180030c7a
lea rbx, [rdx + rcx]
mov ebp, dword [rax + rdx + 0xb4]
add rbp, rbx
mov eax, dword [rbx]
mov rcx, qword [rsp + 0x30]
test eax, eax
je 0x180030c5d
nop dword [rax + rax]
mov edx, eax
cmp rdx, rbp
jae 0x180030c5d
mov r8d, dword [rbx + 4]
test r8d, r8d
je 0x180030c5d
mov dword [rsp + 0x54], r14d
lea rax, [rdx + rsi]
mov qword [rsp + 0x40], rax
lea rax, [rbx + 8]
mov qword [rsp + 0x48], rax
lea rax, [r8 - 8]
shr rax, 1
mov dword [rsp + 0x50], eax
cmp rcx, r9
je 0x180030c35
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx], xmm0
movsd xmm1, qword [rsp + 0x50]
movsd qword [rcx + 0x10], xmm1
add rcx, 0x18
mov qword [rsp + 0x30], rcx
jmp 0x180030c51
lea r8, [rsp + 0x40]
mov rdx, rcx
lea rcx, [rsp + 0x28]
call fcn.180031340
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
mov eax, dword [rbx + 4]
add rbx, rax
mov eax, dword [rbx]
test eax, eax
jne 0x180030be0
mov rax, qword [rsp + 0x28]
mov qword [rdi], rax
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], r9
jmp 0x180030c7a
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], r14
mov rax, rdi
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop r14
ret
Function at 0x180032380
Capabilities:
Encode data using xor
Enumerate services

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
xor ebp, ebp
movaps xmmword [rsp + 0x70], xmm6
mov qword [r11 - 0x60], rbp
lea rax, [r11 + 0x18]
mov qword [r11 - 0x68], rax
xor r9d, r9d
lea rax, [r11 + 0x10]
mov dword [r11 + 0x10], ebp
mov qword [r11 - 0x70], rax
lea edx, [rbp + 0xb]
lea r8d, [rbp + 3]
mov dword [rsp + 0x20], ebp
mov rbx, rcx
mov dword [r11 + 0x18], ebp
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
jne 0x1800323e0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x1800325ac
mov eax, dword [rsp + 0xa8]
add eax, 0x30
mov ecx, eax
mov dword [rsp + 0xa8], eax
call fcn.1800da090
mov ecx, dword [rsp + 0xa8]
mov rdi, rax
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rax
mov edx, listen
lea rax, [rsp + 0xa8]
mov r9, rdi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov rcx, rbx
lea r8d, [rdx - 8]
call qword [sym.imp.ADVAPI32.dll_EnumServicesStatusA]
test eax, eax
je 0x1800325a4
mov ebx, ebp
cmp dword [rsp + 0xb0], ebp
jbe 0x180032598
mov esi, dword [reloc.WS2_32.dll_accept]
nop word [rax + rax]
mov eax, ebx
lea rcx, [rax + rax*2]
mov eax, dword [str.NQ_]
add rcx, rcx
mov dword [rsp + 0xb8], eax
cmp byte [0x180183863], bpl
movups xmm4, xmmword [rdi + rcx*8]
movups xmm6, xmmword [rdi + rcx*8 + 0x10]
je 0x18003255f
cmp esi, 2
jl 0x18003251a
movdqa xmm3, xmmword [0x180187330]
movdqa xmm2, xmm3
movdqa xmm0, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x180187670]
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x180187670]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
psrad xmm2, 5
movdqa xmm0, xmm2
psrld xmm0, 0x1f
paddd xmm0, xmm2
pmulld xmm0, xmmword [0x180187410]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1801874b0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.88888888888888889999999999999999]
movd xmm0, eax
xorps xmm2, xmm0
movd dword [rsp + 0xb8], xmm2
jmp 0x18003255f
lea r8, [rsp + 0xb8]
mov ecx, ebp
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 1]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x3a
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor byte [r8 - 1], al
cmp ecx, 4
jl 0x180032530
lea rdx, [rsp + 0xb8]
movq rcx, xmm4
call fcn.1800dbca4
test rax, rax
je 0x180032589
psrldq xmm6, 4
movd eax, xmm6
add eax, 0xfffffffe
test eax, 0xfffffffd
je 0x1800325ac
inc ebx
cmp ebx, dword [rsp + 0xb0]
jb 0x180032460
mov rcx, rdi
call fcn.1800d9c1c
xor al, al
jmp 0x1800325ae
mov rcx, rdi
call fcn.1800d9c1c
mov al, 1
mov rbx, qword [rsp + 0xa0]
movaps xmm6, xmmword [rsp + 0x70]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800333e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1803adca0]
test rax, rax
jne 0x180033651
mov ecx, dword [0x180183930]
mov edx, 0x77
movups xmm0, xmmword [str.OPT_b]
movzx eax, word [0x180183934]
mov dword [rbp - 0x30], ecx
xor ax, 0x42
xor word [rbp - 0x2e], 0x41
xor cx, 0x40
movups xmmword [rbp - 0x40], xmm0
xor word [rbp - 0x3e], 0x39
xor word [rbp - 0x3c], 0x3a
xor word [rbp - 0x3a], 0x3b
xor word [rbp - 0x38], 0x3c
xor word [rbp - 0x36], 0x3d
xor word [rbp - 0x34], 0x3e
xor word [rbp - 0x32], 0x3f
mov word [rbp - 0x30], cx
lea rcx, [rbp - 0x40]
mov word [rbp - 0x40], dx
mov word [rbp - 0x2c], ax
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r9, rax
test rax, rax
je 0x180033646
cmp byte [0x1801838f9], 0
movups xmm0, xmmword [str.vMoHYOQ5_]
movzx eax, word [0x1801838f8]
mov word [rbp - 0x12], ax
movups xmmword [rbp - 0x2a], xmm0
movsd xmm0, qword [0x1801838f0]
movsd qword [rbp - 0x1a], xmm0
je 0x18003362d
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1800335e9
movdqa xmm0, xmmword [str.88888888888888889999999999999999]
lea rdx, [rbp - 0x26]
movdqa xmm5, xmmword [0x180187330]
movdqa xmm4, xmmword [0x180187600]
movdqa xmmword [rbp - 0x50], xmm0
mov r8d, dword [rbp - 0x50]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x180187390]
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1801874b0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1801874b0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x18
jl 0x1800334e0
movaps xmm6, xmmword [rsp + 0x60]
cmp ecx, 0x1a
jge 0x18003362d
movsxd rax, ecx
lea r8, [rbp - 0x2a]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x32
movzx eax, cl
inc ecx
sub al, dl
add al, 0x38
xor byte [r8 - 1], al
cmp ecx, 0x1a
jl 0x180033600
lea rdx, [rbp - 0x2a]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1803adca0], rax
test rax, rax
jne 0x180033651
mov eax, 1
add rsp, 0x70
pop rbp
ret
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call rax
xor eax, eax
add rsp, 0x70
pop rbp
ret