joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45cf60
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
mov rcx, qword [r14 + 0x30]
inc dword [rcx + 0xd8]
lea rcx, [rsp + 0x30]
nop dword [rax]
cmp qword [r14 + 0x70], rcx
jb 0x45d18e
mov qword [rsp + 0x10], r14
mov qword [r14 + 0xa8], 0
mov rcx, qword [r14 + 0x30]
mov rax, qword [rcx + 0xb0]
mov qword [rsp + 0x18], rax
mov qword [rcx + 0xb0], 0
call fcn.0043fee0
test al, al
jne 0x45cfe5
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], 0
cmp byte [0x0070b1f0], 0
je 0x45d0cf
mov rax, qword [rsp + 0x18]
jmp 0x45d14b
cmp byte [0x0070b1f0], 0
je 0x45d042
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rsi, qword [rdx + 0xa0]
mov rdi, qword [rsp + 0x18]
cmp rsi, rdi
jne 0x45d013
mov edx, dword [rdx + 0x26c]
cmp dword [rsi + 0x14], edx
je 0x45d047
lea rax, fcn.004548a0
mov qword [rsp], rax
nop
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
nop
jmp 0x45d047
mov rax, qword [rsp + 0x10]
mov rdx, qword [rax + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov ebx, 3
mov ecx, 2
nop
call fcn.00439ea0
mov rax, qword [rsp + 0x10]
mov qword [rax + 0x70], 0
mov rdx, qword [rax + 0x30]
dec dword [rdx + 0xd8]
cmp byte [rax + 0xb1], 0
je 0x45d08f
mov qword [rax + 0x10], 0xfffffffffffffade
jmp 0x45d09d
mov rcx, qword [rax]
add rcx, 0x13a0
mov qword [rax + 0x10], rcx
mov byte [rax + 0xb7], 0
cmp byte [0x00705bd8], 0
je 0x45d0c5
mov ebx, 1
call fcn.00458ac0
test al, al
jne 0x45d0c5
nop dword [rax + rax]
call fcn.00438440
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov rdx, qword [rcx + 0x30]
dec dword [rdx + 0xd8]
lea rax, [0x005c5c08]
call fcn.0045f9e0
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0x70], 0
mov rdx, qword [rcx + 0x30]
mov rdx, qword [rdx + 0xa0]
inc dword [rdx + 0x14]
mov byte [rcx + 0xb7], 0
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
lea rax, [0x005c5e60]
mov qword [rsp], rax
nop dword [rax]
call fcn.0045fa60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rax, rcx
mov rcx, qword [rsp + 0x10]
test rax, rax
je 0x45d15f
mov rdx, qword [rcx + 0x30]
mov ebx, dword [rax + 0x14]
cmp dword [rdx + 0x26c], ebx
je 0x45d111
nop
call fcn.00461c60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov rcx, qword [rsp + 0x10]
mov qword [rcx + 0xd0], rax
jmp 0x45d0cf
lea rax, [0x005b6e17]
mov ebx, 0x2d
call fcn.00435b40
nop
Function at 0x461d20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00759300]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00758ff6], 0
je 0x461d56
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007595c0]
aesenc xmm0, xmmword [0x007595d0]
aesenc xmm0, xmmword [0x007595e0]
movq rax, xmm0
ret
jmp 0x40a240

Function at 0x463f00
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x431038
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
cmp dword [0x007592a0], 0
nop
jne 0x430ef2
lea rdx, [0x00463620]
mov qword [0x00703fb0], rdx
jmp 0x430f05
lea rdi, [0x00703fb0]
lea rdx, [0x00463620]
call fcn.00461f00
xor eax, eax
jmp 0x430f20
lea r8, [0x00759540]
mov byte [r8 + rax], sil
inc dword [0x00759010]
mov rax, rdi
nop dword [rax]
cmp rax, 0x36
jge 0x430f70
lea rdx, [0x005b83bc]
movzx esi, byte [rdx + rax]
cmp esi, 0x80
jge 0x430f3f
lea rdi, [rax + 1]
jmp 0x430f65
mov qword [rsp + 0x20], rax
mov ebx, 0x36
mov rcx, rax
mov rax, rdx
call fcn.0045afc0
lea rdx, [0x005b83bc]
mov esi, eax
mov rdi, rbx
mov rax, qword [rsp + 0x20]
cmp rax, 0x64
jb 0x430f09
jmp 0x43102d
call fcn.00430040
call fcn.004483a0
call fcn.00448440
nop
call fcn.00430b40
xor eax, eax
call fcn.00430a80
mov dword [0x0075905c], eax
call fcn.00430c00
call fcn.00430960
mov dword [0x0075903c], eax
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
mov rax, qword [0x006e10e8]
lea rcx, [rsp + 0x28]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
call fcn.00432ce0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov eax, dword [rsp + 0x2c]
mov qword [0x00759180], rax
mov rax, qword [0x006e1098]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 1
call fcn.00432d60
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov ecx, 0x64
call fcn.00462280
nop
call fcn.0045fba0
nop dword [rax]
jmp 0x430ec0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x430ec0
Function at 0x4640e0
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x439417
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x38], r14
mov dword [0x00705b98], 0x2710
lea rax, [0x006e8040]
jmp 0x4391a6
mov qword [rsp + 0x30], rax
call fcn.0044e9a0
mov rcx, qword [rsp + 0x30]
mov rax, qword [rcx + 0x220]
test rax, rax
jne 0x439190
xor eax, eax
jmp 0x4391d3
mov rcx, rax
shl rax, 6
lea rdx, [0x00759640]
mov qword [rdx + rax + 8], 0
mov qword [rdx + rax + 0x10], 0
lea rax, [rcx + 1]
cmp rax, 2
jl 0x4391af
xor eax, eax
jmp 0x439200
mov rcx, rax
shl rax, 4
lea rdx, [0x00759f48]
mov qword [rdx + rax], 0
mov qword [rdx + rax + 8], 0
lea rax, [rcx + 1]
cmp rax, 0x23
jl 0x4391dd
call fcn.0040c0a0
call fcn.00439100
call fcn.00404220
nop
lea rax, [0x007590f0]
mov ebx, 8
mov rcx, rbx
call fcn.004314c0
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rcx
nop dword [rax]
call fcn.00439540
call fcn.0044e740
call fcn.00459d20
call fcn.0040ab60
call fcn.0044c740
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x30]
test byte [rax], al
call fcn.00431560
call fcn.004454c0
call fcn.00418ca0
nop
nop
lea rax, [0x00705b78]
nop dword [rax]
call fcn.0040b700
call fcn.00463b80
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp]
mov qword [0x00705b68], rax
mov eax, dword [0x0075903c]
mov dword [rsp + 0x1c], eax
mov ebx, 0xa
lea rax, [0x005ac4f8]
nop
call fcn.004080a0
call fcn.0044d9e0
movsxd rcx, eax
cmp rax, rcx
mov ecx, 0
cmove ecx, eax
sete al
and eax, ebx
nop dword [rax]
test al, al
je 0x4392e8
test ecx, ecx
jg 0x4392ec
mov ecx, dword [rsp + 0x1c]
mov eax, ecx
call fcn.00441960
test rax, rax
jne 0x439405
nop
nop
lea rax, [0x00705b78]
call fcn.0040b920
cmp dword [0x007594e0], 1
jle 0x439345
mov byte [0x007592a5], 1
mov byte [0x007592a0], 1
mov rcx, qword [0x00704f30]
mov qword [rsp + 0x40], rcx
mov rdx, qword [0x00704f38]
mov qword [rsp + 0x28], rdx
xor eax, eax
nop dword [rax + rax]
jmp 0x4393f8
cmp qword [0x006fc908], 0
jne 0x439386
mov qword [0x006fc908], 7
cmp dword [0x007592a0], 0
jne 0x439373
lea rax, [0x005abc62]
mov qword [0x006fc900], rax
jmp 0x439386
lea rdi, [0x006fc900]
lea rax, [0x005abc62]
call fcn.00461de0
cmp qword [0x00704b08], 1
jne 0x4393bf
mov qword [0x00704b08], 0
cmp dword [0x007592a0], 0
jne 0x4393b1
mov qword [0x00704b00], 0
jmp 0x4393bf
lea rdi, [0x00704b00]
xor eax, eax
call fcn.00461de0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov qword [rsp + 0x20], rax
mov rdx, qword [rcx + rax*8]
test byte [rdx], al
add rdx, 0x1260
mov rax, rdx
nop
call fcn.0042e940
mov rcx, qword [rsp + 0x20]
lea rax, [rcx + 1]
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x28]
cmp rax, rdx
jl 0x4393c9
nop dword [rax]
jmp 0x439345
lea rax, [0x005b6a20]
mov ebx, 0x2b
call fcn.00435b40
nop
call fcn.0045fba0
nop dword [rax]
jmp 0x439160
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x439160
Function at 0x464340
Capabilities:
Delete volume shadow copies
Run powershell expression

Disassembly:
sub rsp, 0x18
mov qword [rsp + 0x10], rbp
lea rbp, [rsp + 0x10]
lea rax, [0x005b7c9f]
mov ebx, 0x32
call fcn.00435b40
nop
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
jmp 0x45dc60
Function at 0x1400069a0
Capabilities:
Create directory
Get disk information
Query environment variable

Disassembly:
push rdi
mov eax, 0x4040
call fcn.14000acb0
sub rsp, rax
mov rax, qword [0x14003e040]
xor rax, rsp
mov qword [rsp + 0x4030], rax
xor r8d, r8d
xor edx, edx
call fcn.140007800
mov rdi, rax
test rax, rax
jne 0x1400069e6
lea rcx, str.LOADER:_failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.140001e50
xor eax, eax
jmp 0x140006b67
mov r8d, 0x1000
mov qword [rsp + 0x4058], rbx
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov rcx, rdi
mov ebx, eax
call fcn.140014c1c
test ebx, ebx
jne 0x140006a23
lea rcx, str.LOADER:_failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.140001e50
xor eax, eax
jmp 0x140006b5f
lea rcx, [rsp + 0x30]
call fcn.140007670
test eax, eax
je 0x140006a8f
cmp word [rsp + 0x34], 0x5c
je 0x140006a55
lea rcx, [rsp + 0x30]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x140006a42
mov eax, dword [0x14002d350]
mov dword [rcx], eax
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jg 0x140006a80
mov r8d, eax
lea rdx, [rsp + 0x30]
lea rcx, str.LOADER:_runtime_tmpdir_points_to_non_existent_drive__ls__type:__d___n
call fcn.140001e50
xor eax, eax
jmp 0x140006b5f
lea rcx, [rsp + 0x30]
call fcn.140017708
jmp 0x140006b5f
mov r8d, 0x1000
lea rdx, [rsp + 0x30]
xor ecx, ecx
call fcn.1400179bc
mov rbx, rax
test rax, rax
jne 0x140006abc
lea rcx, str.LOADER:_failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.140001e50
xor eax, eax
jmp 0x140006b5f
mov edx, 0x5c
mov rcx, rbx
call fcn.14000ba00
mov rdi, rax
test rax, rax
je 0x140006b1e
mov r9, rdi
mov qword [rsp + 0x20], rbx
sub r9, rbx
lea r8, [0x14002d478]
sar r9, 1
lea rcx, [rsp + 0x2030]
mov edx, 0x1000
call fcn.140006e10
xor edx, edx
lea rcx, [rsp + 0x2030]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edx, 0x5c
lea rcx, [rdi + 2]
call fcn.14000ba00
mov rdi, rax
test rax, rax
jne 0x140006ad1
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x140006b5c
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140006b5c
mov r8, rbx
lea rdx, str.LOADER:_failed_to_create_runtime_tmpdir_path__ls__n
lea rcx, str.CreateDirectory
call fcn.140001ed0
mov rcx, rbx
call fcn.140014c1c
xor eax, eax
jmp 0x140006b5f
mov rax, rbx
mov rbx, qword [rsp + 0x4058]
mov rcx, qword [rsp + 0x4030]
xor rcx, rsp
call fcn.14000a9b0
add rsp, 0x4040
pop rdi
ret
Function at 0x1400346c0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1188
call fcn.14034daf0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x10f0], xmm6
mov qword [rbp + 0x10e8], 0xfffffffffffffffe
call sub.kernel32.dll_IsDebuggerPresent
test eax, eax
jne 0x140034967
call sub.kernel32.dll_GetCurrentProcessId
mov ecx, 0x410
xor edx, edx
mov r8d, eax
call sub.kernel32.dll_OpenProcess
test rax, rax
je 0x14003475c
lea rsi, [rbp - 0x60]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x10e4], 0
lea r8, [rbp + 0x10e4]
mov rcx, rsi
mov edx, 0x1000
call sub.psapi.dll_EnumProcesses
test eax, eax
je 0x14003475c
mov r14d, dword [rbp + 0x10e4]
cmp r14d, 4
jae 0x140034777
movaps xmm6, xmmword [rbp + 0x10f0]
add rsp, 0x1188
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
shr r14d, 2
xor r15d, r15d
xorps xmm6, xmm6
lea rsi, [rbp + 0xfa0]
lea rdi, [rbp + 0x10c0]
lea rbx, [rbp + 0x10a8]
movabs r12, 0x2e77656976676264
movabs r13, 0x6578652e77656976
jmp 0x1400347b8
inc r15
cmp r14, r15
je 0x14003475c
cmp r15, 0x400
je 0x1400348fd
mov r8d, dword [rbp + r15*4 - 0x60]
mov ecx, 0x410
xor edx, edx
call sub.kernel32.dll_OpenProcess
test rax, rax
je 0x1400347b0
movaps xmmword [rbp + 0x1090], xmm6
movaps xmmword [rbp + 0x1080], xmm6
movaps xmmword [rbp + 0x1070], xmm6
movaps xmmword [rbp + 0x1060], xmm6
movaps xmmword [rbp + 0x1050], xmm6
movaps xmmword [rbp + 0x1040], xmm6
movaps xmmword [rbp + 0x1030], xmm6
movaps xmmword [rbp + 0x1020], xmm6
movaps xmmword [rbp + 0x1010], xmm6
movaps xmmword [rbp + 0x1000], xmm6
movaps xmmword [rbp + 0xff0], xmm6
movaps xmmword [rbp + 0xfe0], xmm6
movaps xmmword [rbp + 0xfd0], xmm6
movaps xmmword [rbp + 0xfc0], xmm6
movaps xmmword [rbp + 0xfb0], xmm6
movaps xmmword [rbp + 0xfa0], xmm6
mov rcx, rax
xor edx, edx
mov r8, rsi
mov r9d, pe_nt_image_headers64
call sub.psapi.dll_GetModuleBaseNameA
mov r8d, eax
cmp eax, 0x101
jae 0x140034913
mov rcx, rdi
mov rdx, rsi
call fcn.140213280
mov rdx, qword [rbp + 0x10c8]
mov r8, qword [rbp + 0x10d0]
mov rcx, rbx
mov qword [rbp + 0x10d8], rdx
call fcn.140212a10
mov rcx, qword [rbp + 0x10b0]
cmp qword [rbp + 0x10b8], 0xb
jne 0x1400348b7
mov rax, qword [rcx]
xor rax, r12
mov rdx, qword [rcx + 3]
xor rdx, r13
or rdx, rax
je 0x14003492a
mov rdx, qword [rbp + 0x10a8]
test rdx, rdx
je 0x1400348ce
mov r8d, 1
call fcn.14004d520
mov rdx, qword [rbp + 0x10c0]
lea rax, [rdx*2]
test rax, rax
je 0x1400347b0
mov r8d, 1
mov rcx, qword [rbp + 0x10d8]
call fcn.14004d520
jmp 0x1400347b0
lea r8, str.src_vmdbg.rs
mov ecx, 0x400
mov edx, 0x400
call fcn.14035a010
lea rax, str.src_vmdbg.rs
mov edx, pe_nt_image_headers64
mov rcx, r8
mov r8, rax
call fcn.14035a3b0
mov rdx, qword [rbp + 0x10a8]
test rdx, rdx
je 0x140034941
mov r8d, 1
call fcn.14004d520
mov rdx, qword [rbp + 0x10c0]
lea rax, [rdx*2]
test rax, rax
je 0x140034967
mov r8d, 1
mov rcx, qword [rbp + 0x10d8]
call fcn.14004d520
xor ecx, ecx
call fcn.1401f8950
int3
Function at 0x14003b270
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm6
mov qword [rbp + 0xc8], 0xfffffffffffffffe
xorps xmm6, xmm6
movaps xmmword [rbp + 0x80], xmm6
mov qword [rbp + 0x90], 0
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
mov qword [rbp + 0x50], 0
mov dword [rbp - 0x10], 0x68
lea rax, str.getmacsrc_vm_network.rs
mov qword [rbp + 0xa0], rax
lea rax, [0x1403626d6]
mov qword [rbp + 0xa8], rax
mov word [rbp + 0xb0], 0
lea rsi, [rbp - 0x28]
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call fcn.140041250
lea rcx, [rbp + 0x60]
mov rdx, rsi
call fcn.1400379d0
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x60], rax
jne 0x14003b404
mov rdi, qword [rbp + 0x68]
mov rsi, qword [rbp + 0x70]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x14003b3cf
mov dword [rbp + 0xa0], 0
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0xa0]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0x80]
mov rbx, qword [sym.imp.kernel32.dll_CloseHandle]
call rbx
mov rcx, qword [rbp + 0x88]
call rbx
cmp dword [rbp + 0xa0], 0
sete bl
mov word [rdi], 0
test rsi, rsi
je 0x14003b3ef
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004d520
jmp 0x14003b3ef
mov word [rdi], 0
test rsi, rsi
je 0x14003b3ed
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004d520
xor ebx, ebx
mov eax, ebx
movaps xmm6, xmmword [rbp + 0xd0]
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
movups xmm0, xmmword [rbp + 0x60]
movups xmm1, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0xb0], xmm1
movaps xmmword [rbp + 0xa0], xmm0
lea rax, [0x1403626e8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140362438]
lea r9, [0x140362418]
lea r8, [rbp + 0xa0]
mov edx, 0x2b
call fcn.14035a2b0
ud2
Function at 0x14003b850
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm6
mov qword [rbp + 0xc8], 0xfffffffffffffffe
xorps xmm6, xmm6
movaps xmmword [rbp + 0x80], xmm6
mov qword [rbp + 0x90], 0
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
mov qword [rbp + 0x50], 0
mov dword [rbp - 0x10], 0x68
lea rax, str.wmic_smbios_getsrc_vm_smbios.rs
mov qword [rbp + 0xa0], rax
lea rax, [0x1403627a7]
mov qword [rbp + 0xa8], rax
mov word [rbp + 0xb0], 0
lea rsi, [rbp - 0x28]
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call fcn.140041250
lea rcx, [rbp + 0x60]
mov rdx, rsi
call fcn.1400379d0
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x60], rax
jne 0x14003b9e4
mov rdi, qword [rbp + 0x68]
mov rsi, qword [rbp + 0x70]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x14003b9af
mov dword [rbp + 0xa0], 0
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0xa0]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0x80]
mov rbx, qword [sym.imp.kernel32.dll_CloseHandle]
call rbx
mov rcx, qword [rbp + 0x88]
call rbx
cmp dword [rbp + 0xa0], 0
sete bl
mov word [rdi], 0
test rsi, rsi
je 0x14003b9cf
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004d520
jmp 0x14003b9cf
mov word [rdi], 0
test rsi, rsi
je 0x14003b9cd
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004d520
xor ebx, ebx
mov eax, ebx
movaps xmm6, xmmword [rbp + 0xd0]
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
movups xmm0, xmmword [rbp + 0x60]
movups xmm1, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0xb0], xmm1
movaps xmmword [rbp + 0xa0], xmm0
lea rax, [0x1403627b8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140362438]
lea r9, [0x140362418]
lea r8, [rbp + 0xa0]
mov edx, 0x2b
call fcn.14035a2b0
ud2
Function at 0x14003ba80
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm6
mov qword [rbp + 0xc8], 0xfffffffffffffffe
xorps xmm6, xmm6
movaps xmmword [rbp + 0x80], xmm6
mov qword [rbp + 0x90], 0
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
mov qword [rbp + 0x50], 0
mov dword [rbp - 0x10], 0x68
lea rax, str.wmic_computersystem_getsrc_vmwmi.rs
mov qword [rbp + 0xa0], rax
lea rax, [0x1403627e7]
mov qword [rbp + 0xa8], rax
mov word [rbp + 0xb0], 0
lea rsi, [rbp - 0x28]
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call fcn.140041250
lea rcx, [rbp + 0x60]
mov rdx, rsi
call fcn.1400379d0
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x60], rax
jne 0x14003bc14
mov rdi, qword [rbp + 0x68]
mov rsi, qword [rbp + 0x70]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x14003bbdf
mov dword [rbp + 0xa0], 0
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0xa0]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0x80]
mov rbx, qword [sym.imp.kernel32.dll_CloseHandle]
call rbx
mov rcx, qword [rbp + 0x88]
call rbx
cmp dword [rbp + 0xa0], 0
sete bl
mov word [rdi], 0
test rsi, rsi
je 0x14003bbff
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004d520
jmp 0x14003bbff
mov word [rdi], 0
test rsi, rsi
je 0x14003bbfd
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004d520
xor ebx, ebx
mov eax, ebx
movaps xmm6, xmmword [rbp + 0xd0]
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
movups xmm0, xmmword [rbp + 0x60]
movups xmm1, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0xb0], xmm1
movaps xmmword [rbp + 0xa0], xmm0
lea rax, [0x1403627f8]
mov qword [rsp + 0x20], rax
lea rcx, [0x140362438]
lea r9, [0x140362418]
lea r8, [rbp + 0xa0]
mov edx, 0x2b
call fcn.14035a2b0
ud2

Function at 0x14003cc90
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push rsi
push rdi
sub rsp, 0xa8
mov rsi, rdx
mov rdi, rcx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
mov edx, 0x20
call fcn.1401ea1a0
test eax, eax
je 0x14003ccc5
mov rax, qword [rdi + 0x30]
jmp 0x14003cd19
movaps xmm0, xmmword [rsp + 0x20]
movaps xmm1, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x50], xmm1
movaps xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x70]
lea r8, [0x140363aff]
lea rdx, [rsp + 0x40]
mov r9d, 8
call fcn.1401e9f70
mov rax, qword [rdi + 0x30]
movaps xmm0, xmmword [rsp + 0x70]
movaps xmm1, xmmword [rsp + 0x80]
movaps xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdi], xmm0
movaps xmmword [rdi + 0x10], xmm1
movaps xmmword [rdi + 0x20], xmm2
add rax, 0xffffffffffffff00
mov qword [rdi + 0x38], rax
mov rcx, rdi
mov edx, 6
mov r8, rsi
add rsp, 0xa8
pop rdi
pop rsi
jmp fcn.1401e84a0
Function at 0x1400415d0
Capabilities:
Create process on windows

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x168
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xd0], xmm6
mov qword [rbp + 0xc8], 0xfffffffffffffffe
xorps xmm6, xmm6
movaps xmmword [rbp + 0x80], xmm6
mov qword [rbp + 0x90], 0
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp + 0x40], xmm6
movaps xmmword [rbp + 0x30], xmm6
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
mov qword [rbp + 0x50], 0
mov dword [rbp - 0x10], 0x68
lea rax, str.net_statistics_workstationsrc_vmuptime.rs
mov qword [rbp + 0xa0], rax
lea rax, [0x140363442]
mov qword [rbp + 0xa8], rax
mov word [rbp + 0xb0], 0
lea rsi, [rbp - 0x28]
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call fcn.140041250
lea rcx, [rbp + 0x60]
mov rdx, rsi
call fcn.1400379d0
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x60], rax
jne 0x140041764
mov rdi, qword [rbp + 0x68]
mov rsi, qword [rbp + 0x70]
lea rax, [rbp + 0x80]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x10]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
mov rcx, rdi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x14004172f
mov dword [rbp + 0xa0], 0
mov rcx, qword [rbp + 0x80]
lea rdx, [rbp + 0xa0]
call sub.kernel32.dll_GetExitCodeProcess
mov rcx, qword [rbp + 0x80]
mov rbx, qword [sym.imp.kernel32.dll_CloseHandle]
call rbx
mov rcx, qword [rbp + 0x88]
call rbx
cmp dword [rbp + 0xa0], 0
sete bl
mov word [rdi], 0
test rsi, rsi
je 0x14004174f
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004d520
jmp 0x14004174f
mov word [rdi], 0
test rsi, rsi
je 0x14004174d
add rsi, rsi
mov r8d, 2
mov rcx, rdi
mov rdx, rsi
call fcn.14004d520
xor ebx, ebx
mov eax, ebx
movaps xmm6, xmmword [rbp + 0xd0]
add rsp, 0x168
pop rbx
pop rdi
pop rsi
pop rbp
ret
movups xmm0, xmmword [rbp + 0x60]
movups xmm1, xmmword [rbp + 0x70]
movaps xmmword [rbp + 0xb0], xmm1
movaps xmmword [rbp + 0xa0], xmm0
lea rax, str.B46_
mov qword [rsp + 0x20], rax
lea rcx, [0x140363108]
lea r9, [0x1403630e8]
lea r8, [rbp + 0xa0]
mov edx, 0x2b
call fcn.14035a2b0
ud2