joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140006350
Capabilities:
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x270
mov rax, qword [0x14010a0c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor ebx, ebx
lea rdx, [0x140134230]
mov ecx, ebx
mov rax, rdx
nop dword [rax]
cmp dword [rax], ebx
je 0x1400063ca
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x140006380
xor eax, eax
mov qword [rsp + 0x280], rdi
lea rdi, [rsp + 0x20]
mov ecx, 0x238
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140006412
lea rcx, [0x1400f2628]
call fcn.140050a00
jmp 0x1400064a1
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x14000638f
mov ecx, ebx
mov rax, rdx
nop
cmp dword [rax], ebx
je 0x1400063f6
inc ecx
add rax, 0x30
cmp ecx, 0x1f
jb 0x1400063e0
call rbx
jmp 0x1400064ab
movsxd rax, ecx
lea rcx, [rax + rax*2]
add rcx, rcx
cmp byte [rdx + rcx*8 + 0x24], bl
je 0x14000640b
mov rbx, qword [rdx + rcx*8 + 0x28]
call rbx
jmp 0x1400064ab
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x14000643a
lea rcx, str.Process32First
call fcn.140050a00
jmp 0x140006498
lea rdx, str.csrss.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov rcx, rdi
test eax, eax
jne 0x14000645f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x28]
jmp 0x1400064a1
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140006498
nop
lea rdx, str.csrss.exe
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
mov rcx, rdi
test eax, eax
je 0x140006453
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140006470
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x280]
mov eax, ebx
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400d3a80
add rsp, 0x270
pop rbx
ret
Function at 0x140008030
Capabilities:
Enumerate processes
Enumerate threads
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x4c0
mov rax, qword [0x14010a0c0]
xor rax, rsp
mov qword [rsp + 0x4b0], rax
movups xmm0, xmmword [str.InjectedDLL.dll]
xor eax, eax
lea rdi, [rsp + 0x40]
movups xmm1, xmmword [0x1400ea7e8]
mov ecx, 0x238
xor edx, edx
rep stosb byte [rdi], al
lea ecx, [rax + 2]
movups xmmword [rsp + 0x280], xmm0
movups xmmword [rsp + 0x290], xmm1
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400081bb
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400080c7
lea rcx, str.Process32First
call fcn.140050a00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400081c7
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x140008126
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140008118
nop
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x6c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x140008126
lea rdx, [rsp + 0x40]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400080f0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400081c7
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x48]
test ebx, ebx
je 0x1400081c7
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400081bb
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], Ordinal_30
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1400081b2
nop dword [rax]
cmp dword [rsp + 0x20], 0x10
jb 0x1400081a0
cmp dword [rsp + 0x2c], ebx
jne 0x1400081a0
mov r8d, dword [rsp + 0x28]
xor edx, edx
mov ecx, 0x20000
call qword [sym.imp.KERNEL32.dll_OpenThread]
test rax, rax
jne 0x1400081ea
lea rcx, [0x1400f25e0]
call fcn.140050a00
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x140008170
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [0x1400f2628]
call fcn.140050a00
xor eax, eax
mov rcx, qword [rsp + 0x4b0]
xor rcx, rsp
call fcn.1400d3a80
mov rbx, qword [rsp + 0x4d0]
add rsp, 0x4c0
pop rdi
ret
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rsp + 0x28]
test ebx, ebx
je 0x1400081c7
xor r9d, r9d
lea r8, [rsp + 0x2a0]
mov edx, 0x104
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
lea rcx, [rsp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rdi, rax
test rax, rax
je 0x1400081c7
lea rdx, str.MyProc
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400081c7
mov r9d, ebx
mov r8, rdi
mov rdx, rax
mov ecx, 2
call qword [sym.imp.USER32.dll_SetWindowsHookExW]
xor ecx, ecx
test rax, rax
setne cl
mov eax, ecx
jmp 0x1400081c9
Function at 0x1400099b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x140009a0d
lea rbx, [0x1400eaff0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x1400099f4
cmp r10, 2
jb 0x1400099f4
cmp byte [r9], r8b
jne 0x1400099f4
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x1400099d0
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x140009a4f
lea rbx, [0x1400eaff0]
cmp r8b, 0x23
jne 0x140009a33
cmp byte [r9], r8b
jne 0x140009a33
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x140009a20
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x140009b90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x140009baa
mov qword [r8], 0
lea rdx, [0x1400eaa94]
call fcn.140009a60
mov rbx, rax
test rax, rax
jne 0x140009bca
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x140009ca1
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009ca1
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x140009ca1
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x140009ca1
cmp rdi, 0xffffffffffffffff
je 0x140009ca1
mov rax, qword [0x140135bb0]
test rax, rax
je 0x140009c3e
inc dword [rax + 0x3b0]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x140009ca1
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x140009c8e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x140135bb0]
test rax, rax
je 0x140009c83
dec dword [rax + 0x3b0]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140009caa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x140009c9c
mov qword [r14], rdi
mov rax, rsi
jmp 0x140009cac
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400137e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rcx
mov dword [rsp + 0x40], 0xcadbdfd8
mov byte [rsp + 0x44], 0xb0
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov ecx, 0x1c4
mov eax, dword [rcx + rdi]
mov r14d, 0x174
xor ebx, ebx
test al, 1
jne 0x1400138a2
or eax, 1
mov dword [rcx + rdi], eax
lea rax, [r14 + rdi]
mov byte [rax], bl
xor ecx, ecx
mov dword [rax + 1], ecx
mov byte [rax + 5], cl
mov edx, ebx
lea rcx, [rax + 2]
lea r8, [rsp + 0x40]
sub r8, rax
lea r9, [rsp + 0x41]
sub r9, rax
lea r10, [rsp + 0x42]
sub r10, rax
nop word [rax + rax]
movzx eax, byte [r8 + rcx - 2]
mov byte [rcx - 1], al
movzx eax, byte [r9 + rcx - 2]
mov byte [rcx], al
movzx eax, byte [r8 + rcx]
mov byte [rcx + 1], al
movzx eax, byte [r9 + rcx]
mov byte [rcx + 2], al
movzx eax, byte [r10 + rcx]
mov byte [rcx + 3], al
add edx, 5
lea rcx, [rcx + 5]
cmp edx, 5
jb 0x140013860
lea rcx, [0x1400d8ef0]
call fcn.1400d436c
nop
lea rdx, [rdi + r14]
cmp byte [rdx], 0
jne 0x1400138c1
nop dword [rax + rax]
movsxd rcx, ebx
lea eax, [rbx - 0x54]
xor byte [rcx + rdx + 1], al
inc ebx
cmp ebx, 5
jb 0x1400138b0
mov byte [rdx], 1
lea r8, [rdx + 1]
mov rax, rsi
sub r8, rsi
nop
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1400138e3
inc rax
test ecx, ecx
jne 0x1400138d0
test edx, edx
jne 0x1400138ec
lea eax, [rdx + 1]
jmp 0x1400138fb
xor edx, edx
lea r8d, [rdx + 0xa]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtol]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x1400191d0
Capabilities:
Hash data with crc32

Disassembly:
mov dword [rsp + 8], ecx
sub rsp, 0x28
mov rax, qword [0x140135bb0]
lea r10, [0x1400eaff0]
mov r9, qword [rax + 0x1d18]
movsxd rdx, dword [r9 + 0x108]
mov rax, qword [r9 + 0x110]
mov r8d, dword [rax + rdx*4 - 4]
not r8d
movzx eax, cl
movzx edx, r8b
shr r8d, 8
xor rdx, rax
movzx eax, byte [rsp + 0x31]
xor r8d, dword [r10 + rdx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0x32]
xor r8d, dword [r10 + rcx*4]
movzx ecx, r8b
shr r8d, 8
xor rcx, rax
movzx eax, byte [rsp + 0x33]
xor r8d, dword [r10 + rcx*4]
lea rcx, [r9 + 0x108]
movzx edx, r8b
xor rdx, rax
shr r8d, 8
xor r8d, dword [r10 + rdx*4]
lea rdx, [rsp + 0x30]
not r8d
mov dword [rsp + 0x30], r8d
call fcn.14002b040
add rsp, 0x28
ret

Function at 0x14001a0c0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14010a0c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x140135bb0]
mov edi, edx
cmp byte [rbx + 0x20d5], 0
jne 0x14001a120
cmp byte [rbx + 0x20d6], 0
jne 0x14001a120
mov r9d, dword [rbx + 0x3178]
lea r8, str.Tooltip__02d
mov edx, reloc.WS2_32.dll_recv
lea rcx, [rsp + 0x20]
call fcn.140009930
test dil, 1
je 0x14001a246
jmp 0x14001a1af
movss xmm1, dword [rbx + 0x16ec]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x3178]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x1400f42c0]
mulss xmm1, dword [0x1400f42ac]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x120]
addss xmm1, dword [rbx + 0x124]
mov qword [rbx + 0x1ddc], rax
mov dword [rbx + 0x1dc4], 1
movss dword [rbx + 0x1dd4], xmm0
mov byte [rbx + 0x1dfc], 1
movss dword [rbx + 0x1dd8], xmm1
movss xmm0, dword [rbx + 0x1748]
mulss xmm0, dword [0x1400f41f8]
or dword [rbx + 0x1dc0], 0x41
movss dword [rbx + 0x1e20], xmm0
call fcn.140009930
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x14001a200
lea r11, [0x1400eaff0]
nop
cmp r9b, 0x23
jne 0x14001a1e3
cmp byte [r8], r9b
jne 0x14001a1e3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001a1d0
not ecx
call fcn.140011c30
test rax, rax
je 0x14001a246
cmp byte [rax + 0xcf], 0
je 0x14001a246
mov byte [rax + 0xd6], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xf0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x3178]
mov edx, reloc.WS2_32.dll_recv
mov r9d, dword [rbx + 0x3178]
call fcn.140009930
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x22c0347
call fcn.140015670
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400d3a80
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x14001ee10
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x3260], 0
lea rbx, [rcx + 0x3268]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x14001eeb7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14001ee6a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.14002b880
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.14000a250
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x3260]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x3270]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x140135ba1]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x14001eebf
mov rcx, rbx
call fcn.14000a250
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x14001f300
Capabilities:
Hash data with crc32

Disassembly:
push rbx
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10d, 0xffffffff
mov rbx, rcx
mov eax, r10d
test r9b, r9b
je 0x14001f352
lea r11, [0x1400eaff0]
cmp r9b, 0x23
jne 0x14001f335
cmp byte [r8], r9b
jne 0x14001f335
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x14001f322
mov r11, qword [0x140135bb0]
xor r9d, r9d
mov r10, qword [r11 + 0x3228]
test r10, r10
lea rcx, [r10 + 4]
cmovne r9, rcx
test r9, r9
je 0x14001f39e
not eax
cmp dword [r9], eax
je 0x14001f3a7
movsxd r8, dword [r9 - 4]
movsxd rdx, dword [r11 + 0x3220]
add r8, r9
add rdx, 4
xor r9d, r9d
add rdx, r10
cmp r8, rdx
cmovne r9, r8
test r9, r9
jne 0x14001f375
mov rcx, rbx
pop rbx
jmp fcn.14001f210
mov rax, r9
pop rbx
ret
Function at 0x140022840
Capabilities:
Hash data with crc32

Disassembly:
test r8d, r8d
jle 0x140022a7e
mov r11, rsp
push rbp
push rsi
sub rsp, 0x58
mov rax, qword [0x14010a0c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov qword [r11 - 0x18], rdi
mov rbp, rcx
mov qword [r11 - 0x20], r14
lea rdi, [rdx + 0x1a]
mov qword [r11 - 0x28], r15
mov r14d, 0xffffffff
lea r15, [0x1400eaff0]
mov qword [r11 + 0x18], rbx
movsxd rsi, r8d
nop dword [rax + rax]
mov edx, dword [rdi - 0x1a]
test edx, edx
je 0x140022a46
mov rcx, rbp
call fcn.140021f20
mov r9d, dword [rdi - 0x16]
mov rbx, rax
test r9d, r9d
je 0x140022911
movsxd rdx, dword [rbp + 0x31c0]
mov r8, qword [rbp + 0x31c8]
mov r10, rdx
shl r10, 4
add r10, r8
test rdx, rdx
je 0x140022901
nop dword [rax]
mov rcx, rdx
shr rcx, 1
mov rax, rcx
add rax, rax
cmp dword [r8 + rax*8], r9d
jae 0x1400228f9
lea r8, [r8 + rax*8]
mov rax, 0xffffffffffffffff
sub rax, rcx
add r8, 0x10
add rdx, rax
jmp 0x1400228fc
mov rdx, rcx
test rdx, rdx
jne 0x1400228d0
cmp r8, r10
je 0x140022911
cmp dword [r8], r9d
jne 0x140022911
mov rcx, qword [r8 + 8]
jmp 0x140022913
xor ecx, ecx
mov qword [rbx + 0x10], rcx
movsx eax, word [rdi - 2]
movd xmm1, eax
movsx eax, word [rdi]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x40], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x44], xmm0
movsx eax, word [rdi + 2]
movd xmm1, eax
movsx eax, word [rdi + 4]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
movss dword [rbx + 0x48], xmm1
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x4c], xmm0
movsx eax, word [rdi + 6]
movd xmm1, eax
movsx eax, word [rdi + 8]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
mov eax, dword [rbx + 0xb8]
and eax, 0xfffffe49
movss dword [rbx + 0x50], xmm1
or eax, 0x49
mov dword [rbx + 0xb8], eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x54], xmm0
test rcx, rcx
je 0x1400229a7
cmp qword [rcx + 0x18], 0
jne 0x14002299c
mov qword [rcx + 0x18], rbx
jmp 0x1400229a7
cmp qword [rcx + 0x20], 0
jne 0x1400229a7
mov qword [rcx + 0x20], rbx
mov eax, dword [rdi - 0xe]
mov r9, rbx
mov dword [rbx + 0xb0], eax
movsx eax, byte [rdi - 0xa]
mov dword [rbx + 0x58], eax
mov eax, dword [rdi - 6]
and eax, 0x61fc20
or dword [rbx + 8], eax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x1400229dc
nop
mov r9, rax
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1400229d0
mov r9d, dword [r9]
lea r8, str.DockNode__02X
mov edx, reloc.WS2_32.dll_sendto
lea rcx, [rsp + 0x20]
call fcn.140009930
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov ecx, r14d
test r9b, r9b
je 0x140022a38
cmp r9b, 0x23
jne 0x140022a1b
cmp byte [r8], r9b
jne 0x140022a1b
cmp byte [r8 + 1], r9b
cmove ecx, r14d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r15 + rdx*4]
test r9b, r9b
jne 0x140022a08
not ecx
call fcn.140011c30
mov qword [rbx + 0x80], rax
add rdi, 0x24
sub rsi, 1
jne 0x140022890
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400d3a80
add rsp, 0x58
pop rsi
pop rbp
ret
Function at 0x140050ac0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rbx
sub rsp, 0xc0
mov rax, qword [0x14010a0c0]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor ebx, ebx
lea rdx, str.log.txt
cmp dword [0x140136024], ebx
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rbx
lea r8, [0x1400f2508]
jg 0x140050b12
lea r8, [0x1400f2528]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
test eax, eax
jne 0x140050c98
cmp qword [rsp + 0x20], rbx
je 0x140050c98
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
xorps xmm0, xmm0
mov qword [rsp + 0x28], rax
xor eax, eax
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__localtime64_s]
test eax, eax
je 0x140050b77
lea rcx, str.localtime_s
call fcn.140050a00
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, [rsp + 0x30]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea rcx, [rsp + 0x60]
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__wasctime_s]
test eax, eax
je 0x140050ba8
lea rcx, str._tasctime_s
call fcn.140050a00
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rax, 0xffffffffffffffff
lea rdx, [rsp + 0x60]
mov rcx, rax
nop word [rax + rax]
cmp word [rdx + rcx*2 + 2], bx
lea rcx, [rcx + 1]
jne 0x140050bc0
lea rcx, [rcx*2 - 2]
cmp rcx, 0x40
jae 0x140050cb1
mov word [rsp + rcx + 0x60], bx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xb8], rdi
nop
cmp word [rcx + rax*2 + 2], bx
lea rax, [rax + 1]
jne 0x140050bf0
lea rdi, [rax*2 + 6]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
je 0x140050c2a
mov r8, rdi
xor edx, edx
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rbx, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0xb8]
movzx eax, word [rbx]
test ax, ax
je 0x140050c77
cmp ax, 0x25
je 0x140050c4d
movzx ecx, ax
jmp 0x140050c5f
movzx ecx, word [rbx + 2]
add rbx, 2
cmp ecx, 0x64
je 0x140050c6a
cmp ecx, 0x73
je 0x140050c6a
mov rdx, qword [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
movzx eax, word [rbx + 2]
add rbx, 2
test ax, ax
jne 0x140050c42
mov rdx, qword [rsp + 0x20]
mov ecx, 0xa
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov rcx, qword [rsp + 0x20]
inc dword [0x140136024]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1400d3a80
add rsp, 0xc0
pop rbx
ret
call fcn.1400d3e60
int3
Function at 0x140050d80
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14010a0c0]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rbx, rcx
lea rdi, [rsp + 0x20]
xor eax, eax
mov ecx, 0x238
rep stosb byte [rdi], al
lea ecx, [rax + 2]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x140050dd7
lea rcx, [0x1400f2628]
call fcn.140050a00
xor eax, eax
jmp 0x140050e6e
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140050e0a
lea rcx, str.Process32First
call fcn.140050a00
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140050e6e
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x140050e61
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140050e54
nop
mov rdx, rbx
lea rcx, [rsp + 0x4c]
call qword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x140050e61
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140050e30
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x140050e6e
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x28]
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.1400d3a80
mov rbx, qword [rsp + 0x288]
add rsp, 0x270
pop rdi
ret